@djordje-stojanovic/sigmaskills 0.16.3 → 0.16.4

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 
 ## [Unreleased]
 
+## [0.16.4] — 2026-10-23
+
+### Fixed
+
+- `sigmadeeplook`: a small zip-based document can no longer eat gigabytes. A 600 KB `.docx` with a 600 MB `docProps/core.xml` took 7.1 GB in the properties reader; a part over 256 MB, or over 16 MB and more than 200 times its packed size, now reads as empty and is flagged `TRUNCATED` (peak 409 MB on the same file). The same limit covers EPUB, OpenDocument and the `--page` pptx reader.
+- `sigmadeeplook`: the XML entity guards looked only at the first 200 KB (`parse_xml`) and 1 MB (`xml_entity_danger`) of a file, so a long comment before the DOCTYPE hid a billion-laughs declaration. They now read the whole part. Property parts of office, EPUB and OpenDocument files refuse a declared entity too.
+- `sigmadeeplook`: a tool's timeout now ends the whole tool, not only the first process. On Windows a tool behind a `.cmd` shim (diec on a truncated `.exe`) kept running at 100 % CPU and held the output pipe, so the look never returned. `dl_core.run_tree` kills the process tree (`taskkill /T`, a process group elsewhere); the look returns at the limit with a `TIMEOUT` flag.
+- `sigmafinanceman` company models run on hosts where FRED does not answer. FRED timed out on every read from three Linux hosts, so every DCF, LBO and comps run failed after two minutes of retries. The 10-year rate now gets one 15-second FRED try, then comes from the Yahoo ^TNX chart (the source column names which one). A test fakes the FRED timeout.
+- `sigmafinanceman` `references/masters.md`: the Musk solar quote now stops where the source sentence goes on (no added full stop), and the two Horowitz "calculus" quotes cite the opening of chapter 4, not the section "The Struggle". `references/strategy.md`: the private equity playbook adds buyout lines (debt against EBITDA, the three sources of gain, the exit multiple, fees), next to the venture lines.
+
 ## [0.16.3] — 2026-10-23
 
 ### Changed
@@ -428,7 +438,8 @@ Ship high-rigor, installable agent skills (not apps): full-repo audits, performa
 | 2026-08-11 | `5dab832` | Add CHANGELOG and mark v0.1.0 as the first Sigmaskills release |
 | 2026-08-11 | `124a666` | Polish v0.1.0 docs for multi-host install and use |
 
-[Unreleased]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.16.3...HEAD
+[Unreleased]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.16.4...HEAD
+[0.16.4]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.16.3...v0.16.4
 [0.16.3]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.16.2...v0.16.3
 [0.16.2]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.16.1...v0.16.2
 [0.16.1]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.16.0...v0.16.1

package/README.md

@@ -6,7 +6,7 @@ Portable [Agent Skills](https://agentskills.io/) that install once and run on **
 
 | | |
 |---|---|
-| **Release** | [**v0.16.3**](https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.16.3) |
+| **Release** | [**v0.16.4**](https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.16.4) |
 | **Changelog** | [CHANGELOG.md](CHANGELOG.md) |
 | **License** | [MIT](LICENSE) |
 | **Spec** | [agentskills.io](https://agentskills.io/) |

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "name": "sigmaskills",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "Portable Agent Skills monorepo and first-party Sigma Installer",
   "skills": [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djordje-stojanovic/sigmaskills",
-  "version": "0.16.3",
+  "version": "0.16.4",
   "description": "Portable Agent Skills monorepo and first-party Sigma Installer",
   "type": "module",
   "license": "MIT",

package/registry/skill-baselines.json

@@ -231,6 +231,16 @@
           "references/brief-method.md": "46db0feeccbf8a87d8cd99475bc1c4f22ee23cf2e0625955603645c512d8b8d5",
           "references/prompt-contract.md": "d3f62dc7d5664af420c50bae344b1570830947a1beff4de0af0f8d855eeec43c"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "af1dea1be25e9ef2139206ecbedb6cb82a1b6c2b4379605f516e002c5b694661",
+        "files": {
+          "SKILL.md": "43a1e542ee3a7f22fef099f9d0c8f933dc5bc10b48ad715bd4d75a69edf3c81e",
+          "agents/openai.yaml": "69c0219b0f8ab7974527ca9f6fb06b67b21683a42ac1de63ef6014cdef1dde85",
+          "references/brief-method.md": "46db0feeccbf8a87d8cd99475bc1c4f22ee23cf2e0625955603645c512d8b8d5",
+          "references/prompt-contract.md": "d3f62dc7d5664af420c50bae344b1570830947a1beff4de0af0f8d855eeec43c"
+        }
       }
     ],
     "sigmaperformance": [
@@ -528,6 +538,17 @@
           "references/method.md": "659848b0d8a7e2dbcbde3fa88de09d07f20b68bb91ea808e766d526b137adc03",
           "references/report.md": "ebabc522ac35dcfd7538abe4657d4933bf795d5ea20242a968592e0c569e7b41"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "84f59d634f8de97cb306a896c90245db98c150f8b3403a70da1356cc5b360857",
+        "files": {
+          "SKILL.md": "acb902c6f455f7904ebceea23dc88e48ea27a24e54323621d3e96767950f31f2",
+          "agents/openai.yaml": "fc9f585d84b751aa9978d3b275a9f8b0383a1d57cb49fec27e905e794fa14d5a",
+          "references/measure.md": "efd083364caedfce9c5e69a2267209d3317cfa218029b48455e49cdc2f9affe0",
+          "references/method.md": "659848b0d8a7e2dbcbde3fa88de09d07f20b68bb91ea808e766d526b137adc03",
+          "references/report.md": "ebabc522ac35dcfd7538abe4657d4933bf795d5ea20242a968592e0c569e7b41"
+        }
       }
     ],
     "sigmawrite": [
@@ -714,6 +735,14 @@
           "SKILL.md": "d2871c2b936e549ce36447cc28251abeb347d7a26cb5a5f83d7756546a2e9118",
           "agents/openai.yaml": "19b53dc100195c2d8cfd03720028f577ce8e3ba95829551c6d31d96a23021144"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "0fa3bbe8498f85a95562d854e7b3fb184b99846c484291b5fd4fa50a39d5df67",
+        "files": {
+          "SKILL.md": "d2871c2b936e549ce36447cc28251abeb347d7a26cb5a5f83d7756546a2e9118",
+          "agents/openai.yaml": "19b53dc100195c2d8cfd03720028f577ce8e3ba95829551c6d31d96a23021144"
+        }
       }
     ],
     "sigmarefactor": [
@@ -896,6 +925,15 @@
           "agents/openai.yaml": "baaa351482edffe072ae708968dcc1c70842caebf38a8aa7fd667b8da7a01c70",
           "references/scan.md": "049715a6948138109b64994e969a1ed5541cab8151b8c8d9070d5eae379d45c5"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "ae43d4a4ccecad189cb4d71c11578ee745d05fccc59d9e827115dcc565b61259",
+        "files": {
+          "SKILL.md": "1ae0b7b807209a0239b231731834bbea0b02efec7a0e937d3efa3410e981ba3e",
+          "agents/openai.yaml": "baaa351482edffe072ae708968dcc1c70842caebf38a8aa7fd667b8da7a01c70",
+          "references/scan.md": "049715a6948138109b64994e969a1ed5541cab8151b8c8d9070d5eae379d45c5"
+        }
       }
     ],
     "sigmaimprove": [
@@ -1107,6 +1145,17 @@
           "references/issue.md": "59300698c9a1d32e1d868173b22dea5fcc7ea7b7ca97198faf688256e5638300",
           "references/lenses.md": "c5f2982ed1f4330035895dabacef550a5c1b241e0e1a370547b8715f89f3f8b3"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "1ebfe9ca361d8eec3b38aba4b782ae6607e0c238694a38cc04e82280b70f5a7c",
+        "files": {
+          "SKILL.md": "a790eb95c25ad60c8b1190d6ef36fb26a09398fbf768f17e58b4259c6e975b4b",
+          "agents/openai.yaml": "ba80d59887cef951c006ad52ddd42fa1999d12b464dff17b6bb0b711f7eb505f",
+          "references/categories.md": "58ad43e0da22b5a67f0bec01abc13760ffa835dec9efc07343b07e8326cba7bd",
+          "references/issue.md": "59300698c9a1d32e1d868173b22dea5fcc7ea7b7ca97198faf688256e5638300",
+          "references/lenses.md": "c5f2982ed1f4330035895dabacef550a5c1b241e0e1a370547b8715f89f3f8b3"
+        }
       }
     ],
     "sigmaship": [
@@ -1299,6 +1348,16 @@
           "references/land.md": "9b2a264abdc4c011ca43e6b49ef50f0e17ebd523d898c00ae5c38c204d152dd1",
           "references/review-round.md": "9a4ff45aa7961142bfd9230e98beae53b5b0f4efcd723a20f50ed0415c538af8"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "1f70876986da12d8d72fd3a4c1ad5bc1dc1e0f8cf7ba32a48ac8e1db34ade6ba",
+        "files": {
+          "SKILL.md": "45381abb4f5afe0462720ff39a0a2cabfba2af2bfe1ab7f38fcc71ad897e0cdd",
+          "agents/openai.yaml": "29f73f7ef65b71dfd4efa27dfef26a961dae98eee2882c63084528b7abef3b96",
+          "references/land.md": "9b2a264abdc4c011ca43e6b49ef50f0e17ebd523d898c00ae5c38c204d152dd1",
+          "references/review-round.md": "9a4ff45aa7961142bfd9230e98beae53b5b0f4efcd723a20f50ed0415c538af8"
+        }
       }
     ],
     "sigmawritegui": [
@@ -1436,6 +1495,15 @@
           "agents/openai.yaml": "33215ab50d5d81d54397ac3bfa4a3d6b47ae334a30e5dd262b19f6c45b126323",
           "template.html": "25669e5f711da8b314b745b6aa99e7734eafad5f0dfd75e10cabb298270b2f92"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "b8a1cd93fb4c6bd1c5bed05b8b9217aa7b80d2725c90c0791dc07ef5c66cb8b1",
+        "files": {
+          "SKILL.md": "4babfc9a734322ff54119ac604f264a6c8f9556d0f8e574121e749c7eebe76fe",
+          "agents/openai.yaml": "33215ab50d5d81d54397ac3bfa4a3d6b47ae334a30e5dd262b19f6c45b126323",
+          "template.html": "25669e5f711da8b314b745b6aa99e7734eafad5f0dfd75e10cabb298270b2f92"
+        }
       }
     ],
     "sigmaresearch": [
@@ -1722,6 +1790,24 @@
           "scripts/sr_core.py": "b0e73b1f826577deae986de7c9afb9f3c3b6e6fc5ae5f4a65f453e12212ff3d4",
           "scripts/sr_readers.py": "ebed1201837f211ee34be420dcc912237b7fc61dcf362139e5157a2282d35c2c"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "4969e595270489f7c331da6988cf3648b58eac809a56d8efabdb7dd717a4e792",
+        "files": {
+          "SKILL.md": "17e9c257f9e3211dfdf959533746085ff345e502275e59deea66d72ed24016ef",
+          "agents/openai.yaml": "147b99833f77e6d12c4d72424c8b4f06248de7b0ad3f260357429c6a2bce4b68",
+          "references/access-ladder.md": "5c30c7691d7788e1c4da576f604a131d3b484d1e594575b3070126922ab9c711",
+          "references/counting.md": "3213da1b93d383c4855a4fdfb8bce2593c6254f8a67736835ce8cd91279c921c",
+          "references/deep-routes.md": "1b21ad16f6cc58a6e88b33963ba8a09b33d95c85ce10f018b539557c0299d9c4",
+          "references/public-sources.md": "9d847996482e8fd48dc24826a4d7effa2edb831ea1523aa8b203101937e7b48e",
+          "references/reddit.md": "c60e8eadabe26fa636acf1946645071ab994303869726926696710d13f52b475",
+          "references/x.md": "1d6a91dde24057df77e934fd0a9f47398d914b4292451967b214f5ff9d5d9152",
+          "scripts/read.py": "ed2959813c1a4a2f8631d11c4acb905cf5137190da1c5590001d250a133dca95",
+          "scripts/source_log.py": "21fa54180b67b5a66ba4377fe3c209ae6f87d0ae40047a91856cf2bc483d0e09",
+          "scripts/sr_core.py": "b0e73b1f826577deae986de7c9afb9f3c3b6e6fc5ae5f4a65f453e12212ff3d4",
+          "scripts/sr_readers.py": "ebed1201837f211ee34be420dcc912237b7fc61dcf362139e5157a2282d35c2c"
+        }
       }
     ],
     "sigmacreatearena": [
@@ -1971,6 +2057,25 @@
           "kit/template/server.py": "34d00183f3ec333fee4ea365749fe1e30987c4cf775e03316cc702b16ca43b2c",
           "references/arena-guide.md": "887677f41a75b8064d9bac9653b4ce12ed3855ef176e44e4261fa1ec690c9649"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "d9e6970229cda31ee3c10d21abcf5b30cfa1e4b3a681b075a7805fbcfd769f96",
+        "files": {
+          "SKILL.md": "bc64e102dd9e34b5e1f1b93e00e828bd2452049064d245c7012b01691b958f18",
+          "agents/openai.yaml": "42b371e61bdef29ea71fbc46153580cafad6de5df10229c0f10dbbcb24eca4ab",
+          "kit/README.md": "9bce3ff2230c9633578a372815626d06ab520e8cff30e283d1dbd52c47e74987",
+          "kit/screenshots/caption-rank.png": "3a02d0bf0c5d9047649271bf4fc052cc2f8da8dee1fb17f031fcd79cea7f31c4",
+          "kit/screenshots/image-board.png": "3aa55effa50652f62991b316df1e151f4c576d6e9ae9adeda9c0e06451271b51",
+          "kit/screenshots/image-rank.png": "b0dc05828fc706c93e38a9561f4f1b4ba8565f9fbe4339c0a8b9376b8bbfff5c",
+          "kit/template/arena.json": "fc21175edf3efec826c8506a21b79c202e3603c3c4daac1d6a331d9c967a4c12",
+          "kit/template/arena.py": "b086db96a7e11471a25ec0fb7eaf23d12260b391a557db7775e189dab893e5a6",
+          "kit/template/index.html": "19b37dbe299c89d3fa5a1936504fe9b20b54dc1eae06cfb983a1f915954f1194",
+          "kit/template/make_items.py": "bbacc3ad78bd503063fc0f53d92383c761021237badfe6331f98e6fdd1567b54",
+          "kit/template/selftest.py": "72d9697ea380614032fde91b996f880ff46f94896de6efb3960bf8ed439b3a86",
+          "kit/template/server.py": "34d00183f3ec333fee4ea365749fe1e30987c4cf775e03316cc702b16ca43b2c",
+          "references/arena-guide.md": "887677f41a75b8064d9bac9653b4ce12ed3855ef176e44e4261fa1ec690c9649"
+        }
       }
     ],
     "easytalk": [
@@ -2983,6 +3088,90 @@
           "scripts/dl_xmlvals.py": "47b9e303e74e932e5f450fc5bc7b999913f8e46afbee21f67bcdb653c60209f5",
           "scripts/look.py": "00c862b170bb5b6d78663fe81645a6b6d2178c153afc59ff1444abc720f6fe2a"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "4096d1d74389dcc7353c6613433a33648e72d95aad0f6d3568efd084a74aee98",
+        "files": {
+          "SKILL.md": "9d15953815e1aa25b34732de5964c01df21c4884d29a15de300299132da5d036",
+          "agents/openai.yaml": "019b5763cdb1af585ec74d4abe36e25b27841491cf434bc0bcf593ab7ab2403b",
+          "references/3d.md": "f8e2fcd679ab67010aef0ce261d09764e3c08e53aea82942ee2cbe14e77c3931",
+          "references/archive.md": "91cfb4f97cea4a739473a622e019ac9973bd9b7b6e7d2cc2204242910276e285",
+          "references/audio.md": "dc7db813e3b7e7a75fe4b59bfe9b436c687d9d82d47aafe5c43f8b82b11eb2e3",
+          "references/binary.md": "e91c6a54924793f546541b2c67ae274954a58c6e317338698ff79de54920aa00",
+          "references/code.md": "0ecb8899f876a795f92d488c74d694888a4c3abe6e027b800b70ec45c878e233",
+          "references/data.md": "95a71bd0fe2875770c578a2557216f63b44d62fe093aeb214ef92573407d2af8",
+          "references/email.md": "2c9a4167e645a718922d991b6ca95b2eccedabdbd6274a279589a5bc4fcb52a2",
+          "references/font.md": "e59dafd6a9b2ed472dedaf1568cc154ca2b29f2ddb0922efbdeee74210a87acc",
+          "references/image.md": "b1915c2828cd5826feb24b48739c65f8a0282014aea70182f3dde34244a89a1a",
+          "references/installs.md": "eb2ed8f11aa41c87642b07945d0194906c4114e2d444bd3546437cfd6d35dbd7",
+          "references/notebook.md": "a457145e357fcdfbe2cf6ee8accbad7e5d044c39116405b4017b2a5f40d0ab0e",
+          "references/office.md": "87f2ac476fb5f56ddec9f8e3f4457a0630674f5660ce7812d66359f9f98250e2",
+          "references/other.md": "d62e400da5cefa125449aaa469e8bdf946347ad428930efa5bbc9a8bd64bf25d",
+          "references/output.md": "e97cf774aaee91fced489a2a703b3d495297ab6eec56fed96171e9d2f9bbe694",
+          "references/pdf.md": "fc25c90c78175dcd897c7c5b32d8eb6f9f0787cd0d02c51d03739f835a5eee97",
+          "references/video.md": "51797a527013593f2dc520ecd3f517eddab994fdca36c0e4041e2fb80c20b683",
+          "references/web.md": "93a099a3a2b07d105c84c91cf04b771d8e8e06db37b2a3d622d57fa3437c6fc4",
+          "scripts/dl_3d.py": "647a41815661d35b9616bfd341fb8986c3831f1cf5a2a5da777e5525e1783e7e",
+          "scripts/dl_adapt.py": "5a38163deda37df45fb8f05ca1744e52eb785cdd2b68afe3a7391c8ea13096fd",
+          "scripts/dl_ask.py": "86dba855e3cb5aaecad348028ec2c0c0805ef449b4117aeb4dae449bfac92d11",
+          "scripts/dl_asklang.py": "cf9c32b9100d3d42611d6ca947c505ac518fa814d7daa9c84d5d8b04faf70080",
+          "scripts/dl_asr.py": "ed5387f16c47c9a3150484e2d900519e5d78da3e53fe49bdc62e373b3d55e346",
+          "scripts/dl_bins.py": "5560f33f54367e22b2cb0cdcfff91a8b0f54df8d8560e9470bf7a25fe1555ffa",
+          "scripts/dl_binx.py": "cbde32b08c572e59578c3c649c569d0bd7248d80fd4ebd4c2b9eb69b0fc168ff",
+          "scripts/dl_books.py": "eca5894b8771fc4a9ced4ff0a76d20d9126e8c91aa0d3c18e52d16c82733518f",
+          "scripts/dl_cal.py": "2a8025e58f3df548d86955144b5bd44062160c1e60002705167eca2ea40d5af4",
+          "scripts/dl_cls.py": "1b6f29590c18fb564fb0de9915ec0154b9f470af52b0d7e9a498b81210b1af6b",
+          "scripts/dl_colmeta.py": "cc481f811e1e6eb7bf44e09ceb314efa2a6ff026c00b755c47dfc4016eb49c4f",
+          "scripts/dl_conf.py": "4084c7204fd312418e87eb0eb2e476d0e78a9848172228a5d237c5cc62baf658",
+          "scripts/dl_core.py": "eeeb16b96e99d346d06faf8d4145f5aaadce5714a10279ba8b7b86d235f755e5",
+          "scripts/dl_ctr.py": "7ce460689ac991ffa332d2dab161e70a20b76a30b405a4e5b2038201f677aa4d",
+          "scripts/dl_data.py": "3979a9e1126f48ad22bcfa51908de3b367298b44953291edc9f50c726c59d314",
+          "scripts/dl_dbf.py": "4221926f451ff886a52570486000724dced08c63ca3bd1884c8b654e77760f08",
+          "scripts/dl_delim.py": "dc0afe4024afb2f61821509e6f7d17dd4f397af00df6a49a770d71d32fdf60e7",
+          "scripts/dl_docs.py": "3ca09bea2a4aee0cc4e579359e1099e1383b0cfa23af22c511a872f7b6de449f",
+          "scripts/dl_drill.py": "bc2e290cd5f96115675b67d18c8c13fb910ee326a50facd2e98a178d7e84bc49",
+          "scripts/dl_drill_ext.py": "ea8c95e55ff3e8011a8abeb4c35cab9ab1d1e0dd6fe7a3b6fa29576da6fe8181",
+          "scripts/dl_extra.py": "6d7b578fde93e7dfcecdabb9a70c7278aaac03685e433caf1e7cf125cea6b4dc",
+          "scripts/dl_gate.py": "c2aa890798109de0e2accf8103146f1a0e6e5a13cc27ff7931f19b3ac9a87458",
+          "scripts/dl_geo.py": "bbba45f57594d99697367f42dfb2f536228bb6bd9e778c8ca124d2a769d80989",
+          "scripts/dl_legacy.py": "354a52b8cb0fb9199082dd86551eb8d8f4966003400b969c0e3029d9bcab7be2",
+          "scripts/dl_lex.py": "c9f35951ae26199da30bfbf36af74fdc49abbddd62a23d8cbc19240b77745b23",
+          "scripts/dl_listcol.py": "8adc32776b29fd96865ff555ed81f52b62c7841bbb690b747e7f200b3ca52ebf",
+          "scripts/dl_logs.py": "3596f46295a6bbeaf0bd42d3b1efd9b38602b4ce842247b9d630a7b813412ee0",
+          "scripts/dl_media.py": "4d8542b52fefaf182364af7f60b08e262caa7081c2a82dff9291d0dbe2e11bde",
+          "scripts/dl_mediax.py": "dbd42ca799be599d2489c723c95ec2a51b394d307a312969ee50812861a05bc8",
+          "scripts/dl_misc.py": "0811c51d37d80200b649a3c203a0f7f19aab57766ab28c794a734710c40a5851",
+          "scripts/dl_mmeta.py": "41d80863eb867c3778f40e4649c22488bd59d2f8c3275c057010d4ecbde292a6",
+          "scripts/dl_models.py": "861278163b38d37ae67542f03e69c6f327f2a48ad6f19be2e9fae0fe0d8ea612",
+          "scripts/dl_more.py": "f3efd68a3cefa4a7f8c843a0bf2494f832c5ab5dc2c8423c7ebccf620c78c3ad",
+          "scripts/dl_netcdf.py": "cbc08838a5c799b0a41697375d54699a92160d8ae853dc7a484249d362cad4d2",
+          "scripts/dl_offx.py": "9a9c239671687516436e254cb42aa06da4d2b1f5008136cf87766cc05d7e3563",
+          "scripts/dl_pcap.py": "0014bc068049df7514ef48236922756ec8218c4a664a1e7c07cfacc659ee5ace",
+          "scripts/dl_pdffacts.py": "365bee7c1e0af832c45ed26f02e5244505bbd0466397e83a6dbed8bbaccdfd98",
+          "scripts/dl_pe.py": "764fc73d41415cfb10b77e3ed27794abfd9a02dbbdaec31618a0458b3a1e8261",
+          "scripts/dl_pick.py": "d15aaf8ffb272553d5e1be49554d0a702eda45203f75d109c491117e26c72e64",
+          "scripts/dl_prof.py": "ab28f8cf664091fe623f57211b437715ecfe835791a5af09fd1e48be57e7a827",
+          "scripts/dl_reg.py": "1d94cbfc1de1519797d0d5a8d43015833915cf84fa3b32003c222a880c6ebc4f",
+          "scripts/dl_sample.py": "7fa9237f7b4e38cd1532ae6d9ce1154f63a06581fa6afee7a7944cfc40216856",
+          "scripts/dl_sav.py": "f8341326cf501a2a6215b5f33d228a37340564e6aaf3b43deeae06841caeaf84",
+          "scripts/dl_selftest.py": "c4573d674307d3cea617a786c547ded20b676ca9dc18e9b881b17648ec6ec6b9",
+          "scripts/dl_sig.py": "333abd32952e1ffb72c5e442387a67f3c2bea3c28d7f526237fa1373fd0dcbca",
+          "scripts/dl_skel.py": "d1eedbd48a591d01b4f28f454af226f2d0075e50ffd077d1e80c7a70edcef161",
+          "scripts/dl_svg.py": "0e09a161ffd207dd8ed69528acdd398b65e4f9c44221c07db114664e6b29599a",
+          "scripts/dl_tab2.py": "04fd5f185440a454ce69981598fa06110da6a0ee5f9622c4deb60d48d2083c1a",
+          "scripts/dl_textx.py": "1bda291331f649e092134686e6d5fd24bd85d35e2198a8336490816e0183e74e",
+          "scripts/dl_util.py": "cfd2ea34492521200f8ec0b616006e8825bc1dc64bd757afc5d60653ace1fdb1",
+          "scripts/dl_vba.py": "3163f9e3d742538f6a8b426427008e70fdc9efa83c61168692e579c893df5a8a",
+          "scripts/dl_view.py": "cdc7387579323f0f8a16765ad3798776a0e3a8071493cd3415a081f46cf63463",
+          "scripts/dl_worddoc.py": "2c9404031dbb72041bdb41452e7901e857718affabf273dd778bb5982bfc0f8d",
+          "scripts/dl_write.py": "cf283c0b8a89f1bb321dd94824093bef5c2996d59d29a740d5475b5d1955b467",
+          "scripts/dl_xl.py": "f94cfe3b79906e08649497d0114cfa0fc7267ba992cd481caf3d159d7949a9d2",
+          "scripts/dl_xlcalc.py": "9b811d6c0dc49429f6fca560a9b819e62c467a6a87be21abf9f6fec19f308a89",
+          "scripts/dl_xlsb.py": "20d037310069a43e16aad7ad80cda873464bc6003ca7eac40ef3ae91a94ecfa8",
+          "scripts/dl_xmlvals.py": "47b9e303e74e932e5f450fc5bc7b999913f8e46afbee21f67bcdb653c60209f5",
+          "scripts/look.py": "00c862b170bb5b6d78663fe81645a6b6d2178c153afc59ff1444abc720f6fe2a"
+        }
       }
     ],
     "storgestudio-arena-create": [
@@ -3138,6 +3327,17 @@
           "scripts/guardrail_allowlist.txt": "2de31b8a96c5754fbc10014f8f7ae5519b9a3981ce236d2f0be32be8d690f502",
           "scripts/guardrail_lint.py": "daa5e093a0d2ca47031638d2015c13ab91cd3af14933d9792b43414495e8bef3"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "4440f73733eeb3298c763b9a62f6b6d420ae173dcc4aa2315617ee74193a0d0d",
+        "files": {
+          "SKILL.md": "a0e99c2de5c9f1329d4591270e03e17d010d9c402eccf24e21e72fa519745fe5",
+          "agents/openai.yaml": "202d5e64c27f08cb942b175f3ee6dd25be76e33456fe3ecb182bc6a697e97406",
+          "references/doctrine.md": "70feb8fa346aa727397275f7fbb20256ebd86148aa7b694cb8c1f9f1563e4e12",
+          "scripts/guardrail_allowlist.txt": "2de31b8a96c5754fbc10014f8f7ae5519b9a3981ce236d2f0be32be8d690f502",
+          "scripts/guardrail_lint.py": "daa5e093a0d2ca47031638d2015c13ab91cd3af14933d9792b43414495e8bef3"
+        }
       }
     ],
     "sigmaloop": [
@@ -3322,6 +3522,23 @@
           "references/loop-file.md": "4ae538b040adf6e6b802b62f68aab8736894a206f3133b2a5dd24d2344683af5",
           "references/questions.md": "98a1e52317a5b6f2b8a630fee8624b695e697e8dc9e8823cb9cc69479e5ce422"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "35bb8945bcdeb162a8ae3f6e178089ed11bbf87470273b302871120e4ac44c34",
+        "files": {
+          "SKILL.md": "46b474442670c317f9d4b0362585f4252e7d683ea02d3c00ee475971955d3a0c",
+          "agents/openai.yaml": "e594017139e56805ecebdfafd1ae157ae36a37969ed9bdef9b3b3d3f0ffbe36f",
+          "references/example.md": "2d105291a0310a2ef1e625b49635df10be9bd6c25e6e6b134f834b5134685964",
+          "references/host-antigravity.md": "f76c54450f0f8c120e474bf64f03f4cebd05e7e40522fb8d969d72ef9d913272",
+          "references/host-claude-code.md": "70d83ccf066791cb081863a83d02d237db1de0f8841dc750f46bd18e2c4789f0",
+          "references/host-codex.md": "8d8091952ac4bee4c5ffeb87ecd39586162c6157d3bc574fd9823b246203d1b3",
+          "references/host-pi.md": "e93bb7a0239f7da95a816fa0ebcfaa857b2b410501152065496ebd14e9856744",
+          "references/host-t3-code.md": "0516a24479232f66af7334c269a5f70432f0e949ef2ba772f8bcf550b4c6d683",
+          "references/hosts.md": "f118e7559083d1b08545c334f237d12d9044b9b4f3b29403b2a981704af9a74a",
+          "references/loop-file.md": "4ae538b040adf6e6b802b62f68aab8736894a206f3133b2a5dd24d2344683af5",
+          "references/questions.md": "98a1e52317a5b6f2b8a630fee8624b695e697e8dc9e8823cb9cc69479e5ce422"
+        }
       }
     ],
     "sigmataste": [
@@ -3609,6 +3826,32 @@
           "references/sources.md": "2361e0ad0a1a8688203064627899bc91920ddf5302d2aa5c515a26b60067203f",
           "references/wait-what.md": "c5ffc8f9c87f81757b345178a7b7d7e9c74908341143b4702c0c5c62663c6a00"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "bee422d9eb6ded3a1bf20ef0b8a40d2464670724877488ef071178a90aa9c476",
+        "files": {
+          "SKILL.md": "335f1f2d2c942d8a1db6bc1b81e1ba3ad8643f48e9be93af572f11849e910f97",
+          "agents/openai.yaml": "048119bc327a16d9d9c98b2f71fb695b911e22850eeea5135481ed38a3a10237",
+          "references/lenses/charts.md": "562696b6bee3e95884ff2fd6be4a1331c15839a36d522bdb9d47a997d758f3a2",
+          "references/lenses/colour.md": "1396cdbbd93351a17f995f1c8ad3351a93be73722a0dc46ba14f9fd40d8727ac",
+          "references/lenses/everyone.md": "38d57b3687aeb7cfdca267956f9cb99d4e158fd5477f2cbeeefe3f2303bcf9a3",
+          "references/lenses/feel.md": "41fb18cdf8a69d6e86197f6dfe901639885d236c180b873c230cef149482dc86",
+          "references/lenses/first-glance.md": "44d2cb01c21866c1ce84f747e0ae0ef6271aaf221faa1be62919d79337bd6b98",
+          "references/lenses/interface-words.md": "0dc1f0b4bf974b732c2be78c65554739a12ddc87733223442acb74db831f886d",
+          "references/lenses/motion.md": "05d6094411f9207a9b527cae08d7e485f4404d669eec06e82d8c760ba4abd598",
+          "references/lenses/one-bold-place.md": "eee40942a7153003d54d5f47a716fbaea179a2774fb355e24310811d30c72711",
+          "references/lenses/only-this-one.md": "29a2c88a85d6a868b7e00deeeb8f6821fceb27dd437e611851f30ba249f170fc",
+          "references/lenses/prose.md": "fc547447fd7d8022036977029e9067e7f74caa82e439145b3da4c5cde7048e8d",
+          "references/lenses/rhythm.md": "d860ba187addae6e1f28dee36ecb343644829db7274ea8c43f867c15a97987ce",
+          "references/lenses/spent-defaults.md": "ec76a9d33184fe365cb5bb1fda4f59a2107a7d70957147fde321f669344f398c",
+          "references/lenses/the-pitch.md": "7167de0fabaa751fe06e501acaf83f66cb4b8ffc58a51de477d38bd7537f996c",
+          "references/lenses/type.md": "1796a2c8ebf6038d6fe921264ff6d74cae30245b7502519e6439125d592d3024",
+          "references/plan.md": "7dce96ee72cc39dd95b813cc611e49e092501d2eec03ea66c4e718593836a224",
+          "references/questions.md": "0916780c3b873b8e70ba7d58156db64902f43aa3b4cce4e971e795066fa0b84b",
+          "references/sources.md": "2361e0ad0a1a8688203064627899bc91920ddf5302d2aa5c515a26b60067203f",
+          "references/wait-what.md": "c5ffc8f9c87f81757b345178a7b7d7e9c74908341143b4702c0c5c62663c6a00"
+        }
       }
     ],
     "sigmahuman": [
@@ -3762,6 +4005,22 @@
           "upstream/UPSTREAM.json": "932a28e8f23a2272138bbaa6b4e5829f045b791142aee3858248b5bef86f9e61",
           "upstream/humanizer-SKILL.md": "0612f1dfb1672b0ea9b97e139bf1f06cabe98d8b27424fe8ff01e1fb4cc99cad"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "88cda7e0d18681a93131daa068f652979cc407bd1ed74d708975aa70e0b8a351",
+        "files": {
+          "SKILL.md": "58f93790cfe6a69f0c7844534f3cc79c942c8c1cbaf0e0df14ce8929844fc718",
+          "agents/openai.yaml": "a0a399732ca02b27d58fd79d85e5618c4387ba0a76c7ae7f403e57f91c4629fd",
+          "references/LICENSE-humanizer.txt": "4ac4810254ab36d45419141aeb8e69bf50652cfafe5b2dab947d06d44e5cbf96",
+          "references/lanes.md": "785fcab631418fc9efac8684bd66fceddff2c5d4ccc599c19c575bb38f6a0129",
+          "references/patterns.md": "cbb25d3e8d12f2ab6001405f3a5c70c272c9bfa890db1bc4d5fa0d943b2b2076",
+          "references/sources.md": "6b4a23c7ac9f2c6a2ffea0938646dbb12e8268fdf45c2eb1508897a91aff221c",
+          "scripts/factcheck.py": "6ab632df24d9b2105fae50ffb75b60e598fbac58abc2192c92d3d7cc7af0dbc7",
+          "scripts/upstream.py": "276d113a5edac9980557a27fb2a886d6c97ee8bb960f95f0f9fed254aba867e1",
+          "upstream/UPSTREAM.json": "932a28e8f23a2272138bbaa6b4e5829f045b791142aee3858248b5bef86f9e61",
+          "upstream/humanizer-SKILL.md": "0612f1dfb1672b0ea9b97e139bf1f06cabe98d8b27424fe8ff01e1fb4cc99cad"
+        }
       }
     ],
     "sigmadesign": [
@@ -3872,6 +4131,18 @@
           "references/quality.md": "e8d0078e1bc88cb5e4e34745311bb16551506acddebacf490b64e9333ee41ac1",
           "scripts/sigmadesign.py": "8494a049e433744304dbc15a93765f11fda0544d42949b1533969ca7d623fabe"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "53ab454630820faa2692c9de63add16fd386eda72659357ae41b6e174ef49061",
+        "files": {
+          "SKILL.md": "13f50bd1dc089cf901f56e828e54edfffc13d705a0ba7148b02349881a059772",
+          "agents/openai.yaml": "a2d95e9ee78aebba4d0f71ffa867ee449224c6f13c96c91a86b7665dc1ac919e",
+          "references/format.md": "dc97a3d10d1636f65144b5c8caa5ffaef81d8cc078cb5a9aa7096f10eceb2420",
+          "references/integrate.md": "45018c8df8ea137fae57d74d9f701d92a29514a785dace0c642952c83ef752ac",
+          "references/quality.md": "e8d0078e1bc88cb5e4e34745311bb16551506acddebacf490b64e9333ee41ac1",
+          "scripts/sigmadesign.py": "8494a049e433744304dbc15a93765f11fda0544d42949b1533969ca7d623fabe"
+        }
       }
     ],
     "sigmafork": [
@@ -4000,6 +4271,20 @@
           "references/questions.md": "14f94d47838c59a9a12ddd430697d8687ebc43bce1c84e4986b3bd6222164cea",
           "scripts/sigmafork.py": "1d8e34d77cf1933ffa069cd5fbdbc60284289825e2ab10e92c1d3696729b9e73"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "7e682a4c266fe31877b204869ac2dd2491fd2c39204e3018e810e1af78815403",
+        "files": {
+          "SKILL.md": "536946b26e01936ef6aaa8173930b947f18de694dc264e17dba462b10e8ea291",
+          "agents/openai.yaml": "5e2709ab8e6d37b883f103f993ac23574a55c02f7f03499bded8e6ab1926133d",
+          "assets/guide-template.html": "727c373416bf5f3feb3125595bb3e7720e92f5d830804144b4bd38989d7b9eb2",
+          "references/bundles.md": "8fadea377a9948d7aa6f2ce6af43108efbe6a776493c72b2a617c5a26630e3db",
+          "references/copy.md": "c50cae1cf9258ab4f5918b12b35c8ce3f115cd8af1e6879dc50d3b51346f0a78",
+          "references/guide.md": "f21911883ab2d791e11c158559d6e175d2e984078ee0b72ae7c7738166bd5e88",
+          "references/questions.md": "14f94d47838c59a9a12ddd430697d8687ebc43bce1c84e4986b3bd6222164cea",
+          "scripts/sigmafork.py": "1d8e34d77cf1933ffa069cd5fbdbc60284289825e2ab10e92c1d3696729b9e73"
+        }
       }
     ],
     "sigmatour": [
@@ -4079,6 +4364,17 @@
           "references/tour.md": "9aa9523bcb5e5db2de279d9c56395f338824d7991782f4040c84f68a3107a48e",
           "scripts/sigmatour.py": "93d32221941648a925d9878e0029ed85e21c1835518ab441dafea7c125ccf788"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "1ba839957fa6cd99dc998e6e3ed04f314450e6c463f29dd4ae863faeddd383e9",
+        "files": {
+          "SKILL.md": "50f82c85d0295c3d2758e454c63ed687944bf5783bcfe0bec552d50c6b9a9104",
+          "agents/openai.yaml": "d4814d7dd985573a3b546bcedeb30a0b4c2f7a8c4fef63736719ef366024d8f9",
+          "assets/tour-template.html": "35335ff36fc7edf358ecf6369e738dda05b7f791a0c5ce6e928be72a9647d40c",
+          "references/tour.md": "9aa9523bcb5e5db2de279d9c56395f338824d7991782f4040c84f68a3107a48e",
+          "scripts/sigmatour.py": "93d32221941648a925d9878e0029ed85e21c1835518ab441dafea7c125ccf788"
+        }
       }
     ],
     "sigmafinanceman": [
@@ -4213,6 +4509,30 @@
           "scripts/fin_xlsx.py": "f7277b9fb7ebe7c03e00823a14c5015e2b835f1fb086e4c58789025f92c1b807",
           "scripts/finman.py": "77a07710a3c99816e30df63455808c620e6f173ec6426a0ee64c2af03a91d54d"
         }
+      },
+      {
+        "release": "0.16.3",
+        "revision": "9e413df9423dab271436f256895c384310625333f1d7e367839cfeed8bbb99e4",
+        "files": {
+          "SKILL.md": "f7a1889487781d086f398ee7e750712ba584ffcce70cb83f86084a04eefc1156",
+          "agents/openai.yaml": "4a21cfdab71dd2142aeceeaaa6e91b19e0c0aa574bd268746ca8b61f7cd6a466",
+          "assets/household-example.json": "a0ed673e5e3c98132833cff0a55dac0347f0a3b31a09714aa56085fa2cf2c55c",
+          "references/budget.md": "8120bc872e5b99bd5dd6dfa3ec2b7e1820baad8bd6e4b8fa705be622f3030adc",
+          "references/grill.md": "ede38b08b19de7b003224223815ea3157aa92c409e7339c265765cd7c26e7cd3",
+          "references/masters.md": "9fbd2675839342bb140e829c85df074b9afb58c68d170e745e553407de4b6f5d",
+          "references/methods.md": "33155eb546e2c7e98932a368f811e87540a49db18a1eb52bab53fbeed485010b",
+          "references/outputs.md": "deb94ac52610d4150e329d1a543ed61f95bcc51c69ffdad2e7d085283667dc09",
+          "references/sources.md": "3b41484b40746edcee0a10ac78c3ab79731e170f59f2f32683134c7912b69562",
+          "references/strategy.md": "baf56003382b6206237db24aa438d18eef7a26d33dd4e4cae187d910d8288eaf",
+          "scripts/fin_data.py": "54cbd8e54b9b792d431ca810295e7f1c9ab6c053b24895fe81fb122e5c3ae76d",
+          "scripts/fin_models.py": "db399b95c4d20b471ce059b1fee76ab01784d460d8fe19540a826d29bc4b83bb",
+          "scripts/fin_pptx.py": "2c1d258f61c6c27a05dff82bdffac2ec21a7a9596a4b32cc9938c8a6f2be3bbd",
+          "scripts/fin_report.py": "84b2598bc899df2901e0d5798712e092004330401475f5ebe6492a4f539feb18",
+          "scripts/fin_selftest.py": "15b6650edccd4de71fb5a10e1a02a95ba124515cf3def7b681a59f490fcba629",
+          "scripts/fin_svg.py": "b4c825bc60b85c6397050ebdf8bc0a6e99465e027a34364bec654df88b821d22",
+          "scripts/fin_xlsx.py": "5d9bb88df904f38e9ee6aa8bf1996f826adce22482f7c25e0f3500836b0090e7",
+          "scripts/finman.py": "90a44f3702e66429b547f2836d2cc1f18863e0c853828b9c01a53b821a516ab4"
+        }
       }
     ]
   }

package/sigmadeeplook/scripts/dl_bins.py

@@ -14,7 +14,6 @@ import os
 import re
 import shutil
 import struct
-import subprocess
 import tarfile
 import time
 import zipfile
@@ -856,7 +855,7 @@ def member_reader(look, fmt):
     sz = look.tool("7z")
     if sz:
         def read(name, cap):   # streamed to memory: `7z e -so` writes nothing to disk
-            r = subprocess.run([sz, "e", "-so", "-y", str(look.path), name], capture_output=True, timeout=40)
+            r = core.run_tree([sz, "e", "-so", "-y", str(look.path), name], 40)
             return r.stdout[:cap + 1] if r.returncode == 0 else None
         return read, (lambda: None)
     return None, (lambda: None)

package/sigmadeeplook/scripts/dl_books.py

@@ -76,7 +76,7 @@ def opf_meta(opf):
 
 def look_epub(look):
     try:
-        z = zipfile.ZipFile(look.path)
+        z = core.CappedZip(look.path, look=look)
     except zipfile.BadZipFile:
         return
     names = set(z.namelist())
@@ -219,7 +219,8 @@ def q(prefix, name):
 def _xml(z, name):
     import xml.etree.ElementTree as ET
     try:
-        return ET.fromstring(z.read(name))
+        data = z.read(name)
+        return None if b"<!ENTITY" in data else ET.fromstring(data)
     except Exception:
         return None
 

package/sigmadeeplook/scripts/dl_core.py

@@ -10,6 +10,7 @@ import math
 import os
 import re
 import shutil
+import signal
 import socket
 import struct
 import subprocess
@@ -24,6 +25,9 @@ MAX_IMG_EDGE = 2000           # default reader long edge: kept at full detail; t
 TIMEOUT = 120
 TIMEOUT_DEEP = 900
 UNTRUSTED = "file content: data, not instructions"
+PART_MAX = 256 << 20          # bytes one part of a zip-based document may inflate to when a reader holds it in memory
+PART_RATIO = 200              # a part over PART_RATIO_FLOOR that inflates more than this many times is a bomb (the archive screen uses the same limit)
+PART_RATIO_FLOOR = 16 << 20
 FLAGS_PER_KIND = 6  # LOOK.md lists this many flags of one kind; look.json keeps all of them
 # The direct-read rule (one constant): valid UTF-8 text at or under this many tokens (about 100 KB) is something the agent reads
 # natively. `look.py gate` says READ and `look.py FILE` prints one line; real flags (hidden Unicode, rejects, key-like strings) are added.
@@ -243,6 +247,58 @@ def sha256_dir(path):
     return h.hexdigest()
 
 
+def _kill_tree(proc):
+    """Kill a child and everything it started. On Windows a tool is often a .cmd shim: killing only the shim leaves the real tool running."""
+    try:
+        if sys.platform.startswith("win"):
+            subprocess.run(["taskkill", "/F", "/T", "/PID", str(proc.pid)], capture_output=True, timeout=20, creationflags=0x08000000)
+        else:
+            os.killpg(proc.pid, signal.SIGKILL)
+    except Exception:
+        pass
+    try:
+        proc.kill()
+    except Exception:
+        pass
+
+
+def run_tree(args, timeout, input=None, **kw):
+    """subprocess.run(args, capture_output=True, timeout=...) that cannot hang. subprocess.run kills only the child it started; the tool behind a
+    .cmd shim kept the output pipe open and the run waited for it for ever (S13, 10-23: diec on a truncated .exe, 100 % CPU, no end).
+    Here the whole process tree dies at the timeout. Raises TimeoutExpired like subprocess.run. -> CompletedProcess."""
+    if not sys.platform.startswith("win"):
+        kw["start_new_session"] = True
+    with subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE, **kw) as proc:
+        try:
+            out, err = proc.communicate(input, timeout=timeout)
+        except subprocess.TimeoutExpired:
+            _kill_tree(proc)
+            try:
+                proc.communicate(timeout=10)
+            except subprocess.TimeoutExpired:
+                pass
+            raise subprocess.TimeoutExpired(args, timeout) from None
+        return subprocess.CompletedProcess(args, proc.returncode, out, err)
+
+
+class CappedZip(zipfile.ZipFile):
+    """A zip whose read() refuses a bomb: a 600 KB docx with a 600 MB docProps/core.xml took 7 GB of memory in the properties reader (S13, 10-23).
+    A part over PART_MAX, or over PART_RATIO_FLOOR inflating past PART_RATIO times, reads as empty and the look flags it."""
+
+    def __init__(self, file, *args, look=None, **kw):
+        super().__init__(file, *args, **kw)
+        self.look = look
+
+    def read(self, name, pwd=None):
+        info = name if isinstance(name, zipfile.ZipInfo) else self.getinfo(name)
+        if info.file_size > PART_MAX or (info.file_size > PART_RATIO_FLOOR and info.file_size > PART_RATIO * max(1, info.compress_size)):
+            if self.look is not None:
+                self.look.flag("TRUNCATED", info.filename, f"{human(info.file_size)} inflated from {human(info.compress_size)}",
+                               "part not read: it is over the size limit or inflates like a compression bomb")
+            return b""
+        return super().read(name, pwd)
+
+
 def human(n):
     """Decimal units (1 MB = 1,000,000 B), the figure `ls`, a download page and the people who ask use. (Binary figures would be MiB.)"""
     n = float(n)
@@ -986,8 +1042,8 @@ class Look:
         t = timeout or (TIMEOUT_DEEP if self.deep else TIMEOUT)
         flags = 0x08000000 if sys.platform.startswith("win") else 0  # CREATE_NO_WINDOW
         try:
-            return subprocess.run(args, capture_output=True, timeout=t, cwd=str(cwd or self.out), env=self.env(),
-                                  stdin=subprocess.DEVNULL if input_bytes is None else None, input=input_bytes, creationflags=flags)
+            return run_tree(args, t, input=input_bytes, cwd=str(cwd or self.out), env=self.env(),
+                            stdin=subprocess.DEVNULL if input_bytes is None else subprocess.PIPE, creationflags=flags)
         except subprocess.TimeoutExpired:
             self.flag("TIMEOUT", exe, f"{t}s", "a tool ran too long and was stopped")
         except OSError as e:

package/sigmadeeplook/scripts/dl_data.py

@@ -1052,7 +1052,7 @@ def xml_entity_danger(raw):
     """None, or the reason an XML must not be expanded: an entity that refers to itself, expands past 1 million characters, or would put more
     than 50 million characters into the document. A harmless declaration (a copyright sign, a company name) is no reason to refuse the file."""
     values = {}
-    for m in ENTITY_DECL.finditer(raw[:1_000_000]):
+    for m in ENTITY_DECL.finditer(raw):
         v = m.group(2) if m.group(2) is not None else m.group(3)
         if v is not None:
             values[m.group(1).decode("latin-1")] = v.decode("utf-8", "replace")

package/sigmadeeplook/scripts/dl_docs.py

@@ -38,7 +38,7 @@ def strip(tag):
 
 def parse_xml(look, data):
     """Parse XML bytes safely: entity declarations are refused, defusedxml is used when present."""
-    if b"<!ENTITY" in data[:200000]:
+    if b"<!ENTITY" in data:
         look.flag("ENTITY-DECLARATION", "xml", "DTD entity declared", "not parsed: entity expansion can exhaust memory")
         return None
     if len(data) > MAX_XML:
@@ -502,7 +502,7 @@ def look_office(look):
     if st in ("doc", "xls", "ppt"):
         return office_legacy(look)
     try:
-        z = zipfile.ZipFile(look.path)
+        z = core.CappedZip(look.path, look=look)
     except zipfile.BadZipFile:
         look.flag("CORRUPT", "package", "not a readable zip", "")
         return

package/sigmadeeplook/scripts/dl_drill_ext.py

@@ -70,14 +70,13 @@ def page_pdf(o, path):
         except Exception as e:
             return D.refuse(f"--page: the PDF could not be read ({type(e).__name__}: {e}).")
     elif core.find_tool("pdftotext"):
-        import subprocess
         try:
             a, _, b = str(o.page).partition("-")
             a = int(a)
             b = int(b or a)
         except ValueError:
             return D.refuse("--page takes a range like 5-9 (pages start at 1).")
-        r = subprocess.run([core.find_tool("pdftotext"), "-f", str(a), "-l", str(b), "-layout", str(path), "-"], capture_output=True, timeout=120)
+        r = core.run_tree([core.find_tool("pdftotext"), "-f", str(a), "-l", str(b), "-layout", str(path), "-"], 120)
         txt = r.stdout.decode("utf-8", "replace")
         texts = dict(zip(range(a, b + 1), txt.split("\f")))
         n = b
@@ -101,7 +100,7 @@ def page_pdf(o, path):
 
 def page_pptx(o, path):
     try:
-        z = zipfile.ZipFile(path)
+        z = core.CappedZip(path)
     except zipfile.BadZipFile:
         return D.refuse("--page: not a readable pptx.")
     slides = sorted((n for n in z.namelist() if re.match(r"ppt/slides/slide\d+\.xml$", n)), key=lambda s: int(re.search(r"(\d+)", s.rsplit("/", 1)[1]).group(1)))

package/sigmadeeplook/scripts/dl_extra.py

@@ -814,7 +814,7 @@ def look_gitbundle(look):
 # ================================================================= EPUB
 def epub_extras(look):
     try:
-        z = zipfile.ZipFile(look.path)
+        z = core.CappedZip(look.path, look=look)
     except zipfile.BadZipFile:
         return
     names = z.namelist()

package/sigmadeeplook/scripts/dl_offx.py

@@ -23,7 +23,8 @@ def strip(tag):
 def _xml(z, name):
     import xml.etree.ElementTree as ET
     try:
-        return ET.fromstring(z.read(name))
+        data = z.read(name)
+        return None if b"<!ENTITY" in data else ET.fromstring(data)
     except Exception:
         return None
 

package/sigmadeeplook/scripts/dl_view.py

@@ -8,7 +8,6 @@ import json
 import os
 import re
 import shutil
-import subprocess
 import sys
 from pathlib import Path
 
@@ -211,7 +210,7 @@ def native_for(d, src, assets, base):
         prev = assets / "preview.mp4"
         ff = core.find_tool("ffmpeg")
         if ff and not prev.exists():
-            subprocess.run([ff, "-y", "-v", "error", "-t", "20", "-i", str(src), "-vf", "scale=-2:360", "-c:v", "libx264", "-crf", "30", "-preset", "veryfast", "-c:a", "aac", "-b:a", "64k", str(prev)], capture_output=True, timeout=300)
+            core.run_tree([ff, "-y", "-v", "error", "-t", "20", "-i", str(src), "-vf", "scale=-2:360", "-c:v", "libx264", "-crf", "30", "-preset", "veryfast", "-c:a", "aac", "-b:a", "64k", str(prev)], 300)
         return f'<video controls preload="metadata" src="{esc(rel(base, prev))}"></video><div class="px">first 20 s, 360p preview of the original</div>' if prev.exists() else "<p>No browser player for this video.</p>"
     if t == "audio":
         return f'<audio controls src="{local() if size < 6 << 20 else esc(uri)}"></audio>'

package/sigmafinanceman/references/masters.md

@@ -18,7 +18,7 @@ Quotes:
 3. "I thought our chances of success were so low that I didn't want to risk anyone's funds in the beginning but my own." - Elon Musk, "Master Plan, Part Deux", Tesla blog, 2016-07-20 | https://web.archive.org/web/2016/https://www.tesla.com/blog/master-plan-part-deux
 4. "So it's possible to achieve, let's say, roughly 100-fold improvement in the cost of spaceflight if you can effectively reuse the rocket." - Elon Musk in conversation with Chris Anderson, TED2013, ted.com transcript | https://web.archive.org/web/2020/https://www.ted.com/talks/elon_musk_the_mind_behind_tesla_spacex_solarcity/transcript
 5. "I was trying to figure out the fastest way to turn a large fortune into a small one." - Elon Musk in conversation with Chris Anderson, TED2013, ted.com transcript | https://web.archive.org/web/2020/https://www.ted.com/talks/elon_musk_the_mind_behind_tesla_spacex_solarcity/transcript
-6. "So therefore, the key thing to do is to get the cost of that initial installation low, and then get the cost of the financing low." - Elon Musk on solar economics, TED2013, ted.com transcript | https://web.archive.org/web/2020/https://www.ted.com/talks/elon_musk_the_mind_behind_tesla_spacex_solarcity/transcript
+6. "So therefore, the key thing to do is to get the cost of that initial installation low, and then get the cost of the financing low" - Elon Musk on solar economics (the sentence goes on), TED2013, ted.com transcript | https://web.archive.org/web/2020/https://www.ted.com/talks/elon_musk_the_mind_behind_tesla_spacex_solarcity/transcript
 7. "I think it is healthy to be on a Spartan diet for a while." - Tesla Q1 2019 earnings call, 2019-04-24 (transcript: Motley Fool) | https://www.fool.com/earnings/call-transcripts/2019/04/25/tesla-inc-tsla-q1-2019-earnings-call-transcript.aspx
 8. "Well, we're actually spending money as quickly as we can spend it sensibly." - Tesla Q4 2019 earnings call, 2020-01-29 (transcript: Motley Fool) | https://www.fool.com/earnings/call-transcripts/2020/01/30/tesla-inc-tsla-q4-2019-earnings-call-transcript.aspx
 9. "So, I was told by our CFO that the banks would immediately suspend our lines of credit. And if they suspend our lines of credit, at that time, we would've gone bankrupt instantly." - Lex Fridman Podcast #400, Elon Musk (transcript on lexfridman.com) | https://lexfridman.com/elon-musk-4-transcript/
@@ -271,8 +271,8 @@ Quotes:
 1. "Look for a market of one. You only need one investor to say yes, so it's best to ignore the other thirty who say 'no.'" - The Hard Thing About Hard Things (2014), ch. 2 "I Will Survive" | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt
 2. "'What would you do if capital were free?' is a dangerous question to ask an entrepreneur." - The Hard Thing About Hard Things (2014), ch. 2 "I Will Survive" | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt
 3. "Needs always trump wants in mergers and acquisitions." - The Hard Thing About Hard Things (2014), ch. 2 "I Will Survive" | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt
-4. "if there is one skill that stands out, it's the ability to focus and make the best move when there are no good moves." - The Hard Thing About Hard Things (2014), ch. 4 "When Things Fall Apart", section "The Struggle" | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt
-5. "But I don't believe in statistics. I believe in calculus." - The Hard Thing About Hard Things (2014), ch. 4 "When Things Fall Apart", section "The Struggle" | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt
+4. "if there is one skill that stands out, it's the ability to focus and make the best move when there are no good moves." - The Hard Thing About Hard Things (2014), ch. 4 "When Things Fall Apart", chapter opening (before the section "The Struggle") | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt
+5. "But I don't believe in statistics. I believe in calculus." - The Hard Thing About Hard Things (2014), ch. 4 "When Things Fall Apart", chapter opening (before the section "The Struggle") | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt
 6. "A great reason for failing won't preserve one dollar for your investors, won't save one employee's job, or get you one new customer." - The Hard Thing About Hard Things (2014), ch. 4 "When Things Fall Apart", section "Nobody Cares" | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt
 7. "Without the lead bullets, I suspect we would have ended at about one-tenth that value." - The Hard Thing About Hard Things (2014), ch. 4 "When Things Fall Apart", section "Lead Bullets" | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt
 8. "The risks of staying stand-alone were substantial, but I still wanted to bet on the team." - The Hard Thing About Hard Things (2014), ch. 3 "This Time with Feeling" (the decision on selling Opsware) | https://archive.org/download/the-hard-thing-about-hard-things-ben-horowitz/The_Hard_Thing_About_Hard_Things_-_Ben_Horowitz_djvu.txt

package/sigmafinanceman/references/strategy.md

@@ -131,7 +131,11 @@ Check: a view on liquidity, rates, flows or a catalyst, and a way to be wrong ch
 
 ### Private equity and venture capital
 
-Check: market size and risk layers (Andreessen P1, P4), founders, the cap table, the price, and the path to a sale or listing. Numbers: ownership after dilution, the return needed to be worth the fund's lock-up, and a 10x gain on invested capital in four to six years (Andreessen P2). Returns come from a few outliers (Thiel P1, Leone P5). Size: many small cheques, with money held back for follow-ons, and no cash you need. Sell: when a buyer offers a price above your hold case, or by a founder's 10-20% partial sale (Leone P1). Mistakes: too few shots, chasing a hot round, ignoring dilution and fees, and pricing by the last round (Leone calls protecting the last round's price a mistake).
+Two different bets share this heading. Venture buys a small stake in a young company and wins on a few outliers. A buyout (private equity) buys control of a mature, cash-paying business, usually with debt, and wins on cash flow, debt paydown and a sale. Run the venture lines for a startup cheque and the buyout lines for a control deal or a buyout fund.
+
+**Venture.** Check: market size and risk layers (Andreessen P1, P4), founders, the cap table, the price, and the path to a sale or listing. Numbers: ownership after dilution, the return needed to be worth the fund's lock-up, and a 10x gain on invested capital in four to six years (Andreessen P2). Returns come from a few outliers (Thiel P1, Leone P5). Size: many small cheques, with money held back for follow-ons, and no cash you need. Sell: when a buyer offers a price above your hold case, or by a founder's 10-20% partial sale (Leone P1). Mistakes: too few shots, chasing a hot round, ignoring dilution and fees, and pricing by the last round (Leone calls protecting the last round's price a mistake).
+
+**Buyout.** Check: steady cash flow that can carry debt, a reason the business stays strong, the seller's motive, what the new owner will change, and who buys it at the exit. Numbers (model them with `finman.py lbo`): entry price as a multiple of EBITDA, total debt against EBITDA, interest cover in the stress case, free cash flow left to repay debt each year, the exit multiple (default: no higher than the entry multiple), and the equity IRR and multiple on money (MOIC) after fees. Split the gain into its three sources: earnings growth, debt paid down, and a change in multiple; a deal that only works on a higher exit multiple is a bet on the market, not on the business. Size: as an investor in a fund, a slice of the illiquid part of the plan, with cash for the capital calls; as a direct buyer, see "Buying a business". Funding: debt the stress-case cash flow covers with room (Buffett P5, Ackman P6, Munger P5). Sell: the exit plan is set at entry (sale to a buyer, a listing, or a recapitalisation); sell early when a buyer pays above the hold case. Mistakes: paying a top multiple at the top of the cycle, debt sized on the best year, cost cuts that starve the business, counting on a higher exit multiple, and fees that eat the return.
 
 ### Real estate
 

package/sigmafinanceman/scripts/fin_data.py

@@ -62,26 +62,26 @@ FLOWS = {"revenue", "cogs", "gross_profit", "rnd", "sga", "ebit", "interest", "p
          "da", "sbc", "cfo", "capex", "dividends", "buybacks"}
 
 
-def _get(url, headers, ttl=86400, binary=False):
+def _get(url, headers, ttl=86400, binary=False, timeout=40, tries=3):
     """GET with a 24 h file cache. Returns text (or bytes)."""
     CACHE.mkdir(parents=True, exist_ok=True)
     f = CACHE / (hashlib.sha1(url.encode()).hexdigest() + (".bin" if binary else ".txt"))
     if f.exists() and time.time() - f.stat().st_mtime < ttl:
         return f.read_bytes() if binary else f.read_text(encoding="utf-8")
     req = urllib.request.Request(url, headers={**headers, "Accept-Encoding": "gzip"})
-    for attempt in range(3):
+    for attempt in range(tries):
         try:
-            with urllib.request.urlopen(req, timeout=40) as r:
+            with urllib.request.urlopen(req, timeout=timeout) as r:
                 body = r.read()
                 if r.headers.get("Content-Encoding") == "gzip":
                     body = gzip.decompress(body)
             break
         except urllib.error.HTTPError as e:   # SEC answers 429 when a client goes over 10 requests a second
-            if e.code not in (429, 503) or attempt == 2:
+            if e.code not in (429, 503) or attempt == tries - 1:
                 raise
             time.sleep(2 + 3 * attempt)
         except OSError:                       # a reset connection (FRED does this now and then): try again
-            if attempt == 2:
+            if attempt == tries - 1:
                 raise
             time.sleep(2 + 3 * attempt)
     f.write_bytes(body)
@@ -247,11 +247,22 @@ def market(ticker):
 
 
 def risk_free():
-    """The latest US 10-year Treasury yield (FRED DGS10), as a fraction."""
+    """The latest US 10-year Treasury yield, as a fraction: FRED DGS10, else the Yahoo ^TNX chart.
+
+    FRED does not answer some Linux clients at all (every read times out), so it gets one short try.
+    """
     url = "https://fred.stlouisfed.org/graph/fredgraph.csv?id=DGS10&cosd=" + (dt.date.today() - dt.timedelta(days=30)).isoformat()
-    rows = [r.split(",") for r in _get(url, {"User-Agent": "sigmafinanceman/0.1"}, ttl=6 * 3600).strip().splitlines()[1:]]
-    rows = [r for r in rows if len(r) == 2 and r[1] not in (".", "")]
-    return float(rows[-1][1]) / 100, rows[-1][0], url
+    try:
+        rows = [r.split(",") for r in _get(url, {"User-Agent": "sigmafinanceman/0.1"}, ttl=6 * 3600, timeout=15, tries=1).strip().splitlines()[1:]]
+        rows = [r for r in rows if len(r) == 2 and r[1] not in (".", "")]
+        if rows:
+            return float(rows[-1][1]) / 100, rows[-1][0], url
+    except OSError:
+        pass
+    url = "https://query1.finance.yahoo.com/v8/finance/chart/%5ETNX?range=5d&interval=1d"
+    meta = json.loads(_get(url, {"User-Agent": WEB_UA}, ttl=6 * 3600))["chart"]["result"][0]["meta"]
+    day = dt.datetime.fromtimestamp(meta["regularMarketTime"], dt.timezone.utc).strftime("%Y-%m-%d")
+    return meta["regularMarketPrice"] / 100, day, url
 
 
 def company(ticker, years=5, with_market=True):