@djordje-stojanovic/sigmaskills 0.9.0 → 0.9.2

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 
 ## [Unreleased]
 
+## [0.9.2] — 2026-10-18
+
+### Fixed
+
+- `sigmadeeplook` readers from the held-out rounds: binaries, archives, tables and spreadsheets read more fields correctly (typed binary fields, VBA source, `.reg`, `.deb` members, list columns, MIDI events, docx Title) (#111, #112). The headerless-records test now skips when numpy is missing, which turns the main branch CI green again.
+
+## [0.9.1] — 2026-10-18
+
+### Fixed
+
+- `sigmacreatearena`, `sigmaresearch` and `sigmawritegui` had a plain YAML description containing `: `, which strict YAML parsers reject. The descriptions are now quoted, the installer reads quoted values as plain text, and a test keeps every header strict YAML.
+
 ## [0.9.0] — 2026-10-18
 
 ### Changed
@@ -269,7 +281,9 @@ Ship high-rigor, installable agent skills (not apps): full-repo audits, performa
 | 2026-08-11 | `5dab832` | Add CHANGELOG and mark v0.1.0 as the first Sigmaskills release |
 | 2026-08-11 | `124a666` | Polish v0.1.0 docs for multi-host install and use |
 
-[Unreleased]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.9.2...HEAD
+[0.9.2]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.9.1...v0.9.2
+[0.9.1]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.9.0...v0.9.1
 [0.9.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.6.1...v0.7.0

package/README.md

@@ -6,7 +6,7 @@ Portable [Agent Skills](https://agentskills.io/) that install once and run on **
 
 | | |
 |---|---|
-| **Release** | [**v0.9.0**](https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.9.0) |
+| **Release** | [**v0.9.2**](https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.9.2) |
 | **Changelog** | [CHANGELOG.md](CHANGELOG.md) |
 | **License** | [MIT](LICENSE) |
 | **Spec** | [agentskills.io](https://agentskills.io/) |

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "name": "sigmaskills",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Portable Agent Skills monorepo and first-party Sigma Installer",
   "skills": [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djordje-stojanovic/sigmaskills",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Portable Agent Skills monorepo and first-party Sigma Installer",
   "type": "module",
   "license": "MIT",

package/sigmacreatearena/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: sigmacreatearena
-description: Builds a fast blind-pairs arena so the user ranks any options by Elo per metric: models, settings, voices, captions, thumbnails, outfits. Grills first, then ships a local page and a board. Use to rank, compare or pick the best of many options by taste. Do not use for 2-3 options (just ask), for measurable checks (script them), or to judge one draft against a reference.
+description: 'Builds a fast blind-pairs arena so the user ranks any options by Elo per metric: models, settings, voices, captions, thumbnails, outfits. Grills first, then ships a local page and a board. Use to rank, compare or pick the best of many options by taste. Do not use for 2-3 options (just ask), for measurable checks (script them), or to judge one draft against a reference.'
 ---
 
 # SigmaCreateArena

package/sigmadeeplook/references/installs.md

@@ -45,7 +45,7 @@ Every row below is a 'Not looked at' row when the tool is absent. Nothing needs
 | cairosvg | python package | rendering svg | pip install cairosvg |
 | rapidocr_onnxruntime | python package | OCR of video frames, images, scanned pages | pip install rapidocr-onnxruntime |
 | lief | python package | real Authenticode verification (chain and hash), imphash | pip install lief |
-| oletools | python package | VBA macro source, auto-run routines, suspicious calls | pip install oletools |
+| oletools | python package | fuller VBA analysis (the stdlib reader already decompresses the modules, lists auto-run routines, suspicious calls and strings) | pip install oletools |
 | python_calamine | python package | very large xlsx files | pip install python-calamine |
 | dnfile | python package | .NET assembly names, references, types | pip install dnfile |
 | pymupdf4llm | python package | (reserved) PDF to markdown with tables | pip install pymupdf4llm |

package/sigmadeeplook/scripts/dl_3d.py

@@ -120,7 +120,14 @@ def look_3d(look):
             look.flag("PARSE-ERROR", "glTF", f"{type(e).__name__}: {e}"[:100], "")
     elif st in ("stl", "stl-ascii"):
         tris = parse_stl(b, st == "stl-ascii")
-        look.line(f"STL ({'ASCII' if st == 'stl-ascii' else 'binary'}): {len(tris)} triangles. STL has no units and no colour.")
+        hdr = ""
+        if st != "stl-ascii":
+            hdr = b[:80].split(b"\0")[0].decode("latin-1").strip()
+            hdr = f" Header text: {hdr!r}." if hdr else " Empty 80-byte header."
+        else:
+            first = b[:200].decode("latin-1").splitlines()[0].strip()
+            hdr = f" First line: {first!r}."
+        look.line(f"STL ({'ASCII' if st == 'stl-ascii' else 'binary'}): {len(tris)} triangles.{hdr} STL has no units and no colour.")
     elif st == "obj":
         tris, c = parse_obj(b.decode("utf-8", "replace"))
         look.fact("vertices", c["v"])
@@ -158,6 +165,8 @@ def look_3d(look):
         look.fact("triangles", len(tris))
         look.fact("bbox", stats["bbox"])
         look.line(f"{len(tris)} triangles; bounding box {stats['bbox']['min']} to {stats['bbox']['max']} (size {stats['bbox']['size']}).")
+        look.line(f"Mesh measures: surface area {stats['surface_area']:,.3f}, signed volume {stats['signed_volume']:,.3f} (a true volume only when watertight), "
+                  + (f"centroid {stats['centroid']}, " if stats.get("centroid") else "") + f"{stats['unique_vertices']} unique vertices, {stats['degenerate_triangles']} zero-area triangles (units are those of the file).", 61)
         if stats.get("watertight") is not None:
             look.fact("watertight", stats["watertight"])
             look.line("Watertight (every edge shared by exactly two triangles): " + ("yes" if stats["watertight"] else f"NO ({stats['open_edges']} open edges)"))
@@ -257,6 +266,27 @@ def mesh_stats(look, tris):
     mn = [round(min(xs), 4), round(min(ys), 4), round(min(zs), 4)]
     mx = [round(max(xs), 4), round(max(ys), 4), round(max(zs), 4)]
     out = {"triangles": len(tris), "bbox": {"min": mn, "max": mx, "size": [round(a - b, 4) for a, b in zip(mx, mn)]}}
+    area = vol = 0.0
+    cx = cy = cz = 0.0
+    degenerate = 0
+    for a, b, c in tris:
+        ux, uy, uz = b[0] - a[0], b[1] - a[1], b[2] - a[2]
+        vx, vy, vz = c[0] - a[0], c[1] - a[1], c[2] - a[2]
+        nx, ny, nz = uy * vz - uz * vy, uz * vx - ux * vz, ux * vy - uy * vx
+        ar = 0.5 * math.sqrt(nx * nx + ny * ny + nz * nz)
+        if ar < 1e-12:
+            degenerate += 1
+        area += ar
+        d = (a[0] * (b[1] * c[2] - b[2] * c[1]) - a[1] * (b[0] * c[2] - b[2] * c[0]) + a[2] * (b[0] * c[1] - b[1] * c[0])) / 6.0
+        vol += d
+        cx += d * (a[0] + b[0] + c[0]) / 4.0
+        cy += d * (a[1] + b[1] + c[1]) / 4.0
+        cz += d * (a[2] + b[2] + c[2]) / 4.0
+    out["surface_area"] = round(area, 4)
+    out["signed_volume"] = round(vol, 4)
+    out["centroid"] = [round(cx / vol, 4), round(cy / vol, 4), round(cz / vol, 4)] if abs(vol) > 1e-12 else None
+    out["degenerate_triangles"] = degenerate
+    out["unique_vertices"] = len({(round(v[0] * 1e5), round(v[1] * 1e5), round(v[2] * 1e5)) for t in tris for v in t}) if len(tris) <= MAX_TRIS_PARSE else None
     if len(tris) <= MAX_TRIS_PARSE:
         q = lambda v: (round(v[0] * 1e5), round(v[1] * 1e5), round(v[2] * 1e5))
         edges = {}

package/sigmadeeplook/scripts/dl_adapt.py

@@ -108,6 +108,15 @@ def look_avro(look):
                     break
         look.write_text("sample.json", json.dumps(rows, indent=1, default=str)[:20000], "the first 5 records", "json", value=6)
         look.step("sample records", "fastavro")
+        if not look.quick and records:
+            import dl_data as D
+            names = [n for n, _t in fields]
+
+            def rowsgen():
+                with open(look.path, "rb") as f2:
+                    for k, rec in enumerate(fa.reader(f2), 1):
+                        yield k, [json.dumps(rec.get(n), default=str, sort_keys=True) if isinstance(rec.get(n), (list, dict)) else rec.get(n) for n in names]
+            D.table_profile(look, "Records", names, rowsgen, "record", records, 84, 28)
     except Exception as e:
         look.fail("record values", "fastavro", e)
 
@@ -327,8 +336,10 @@ def summarize_olevba(results):
 
 def olevba_facts(look, data, name):
     m = look.mod("oletools")
-    if not m:
-        look.skip("macro source: auto-run routines, suspicious calls and addresses", "python package oletools not importable" if not look.no_tools else "disabled by --no-tools", "oletools")
+    if not m:   # the standard-library reader: decompresses the VBA modules itself
+        import dl_vba
+        if not dl_vba.vba_facts(look, data, name):
+            look.skip("macro source: full oletools analysis", "python package oletools not importable" if not look.no_tools else "disabled by --no-tools", "oletools")
         return
     try:
         from oletools.olevba import VBA_Parser
@@ -348,6 +359,8 @@ def olevba_facts(look, data, name):
         look.step("macro analysis", "oletools")
     except Exception as e:
         look.fail("macro analysis", "oletools", e)
+        import dl_vba
+        dl_vba.vba_facts(look, data, name)
 
 
 # ================================================================= glTF validator

package/sigmadeeplook/scripts/dl_bins.py

@@ -14,6 +14,7 @@ import os
 import re
 import shutil
 import struct
+import subprocess
 import tarfile
 import time
 import zipfile
@@ -55,9 +56,16 @@ def look_unknown(look):
         look.skip("file -b type guess", "`file` not found" if not look.no_tools else "disabled by --no-tools", "file", "install the `file` utility (Git for Windows ships it)")
     if b:
         look.write_text("hexdump.txt", core.hexdump(b[:512]), "first 512 bytes as hex", "internal")
-    st = core.strings_of(b, 8, 2000)
+    if b and look.size == len(b) or (b and look.size <= (64 << 20)):
+        import dl_misc
+        for t in dl_misc.record_layout(read_bytes(look, 64 << 20), look.size):
+            look.headline = "Headerless binary file that looks like a table of fixed-size records (a guess from the bytes)"
+            look.line(t, 93)
+    if b:
+        look.line("First 32 bytes: " + b[:32].hex(" ") + " | " + "".join(chr(c) if 32 <= c < 127 else "." for c in b[:32]), 52)
+    st = [x for x in core.strings_of(b, 6, 4000) if wordy(x[2])]
     if st:
-        look.write_text("strings.txt", "\n".join(f"{o:08x} {s[:200]}" for o, k, s in st), "printable strings (min 8)")
+        look.write_text("strings.txt", "\n".join(f"{o:08x} {s[:200]}" for o, k, s in st), "printable strings that read as words, paths or names (min 6)")
     look.ask_human("What is this file meant to be, and where did it come from?")
 
 
@@ -438,7 +446,12 @@ def parse_pe(b):
                 end = b.find(b"\0", no)
                 imports.append(b[no:end].decode("latin-1"))
             p += 20
-    return {"machine": PE_MACHINES.get(machine, hex(machine)), "timestamp": ts, "subsystem": SUBSYS.get(subsystem, str(subsystem)),
+    base = struct.unpack_from("<Q", b, opt + 24)[0] if magic == 0x20B else struct.unpack_from("<I", b, opt + 28)[0]
+    osv = struct.unpack_from("<HH", b, opt + 40)
+    soi, _hs, csum, _sub, dllc = struct.unpack_from("<IIIHH", b, opt + 56)
+    dllflags = [n for bit, n in ((0x40, "ASLR"), (0x20, "high-entropy ASLR"), (0x100, "DEP/NX"), (0x4000, "control-flow guard"), (0x400, "no SEH"), (0x1000, "AppContainer")) if dllc & bit]
+    return {"image_base": base, "image_size": soi, "checksum": csum, "linker": f"{b[opt + 2]}.{b[opt + 3]}", "os_version": f"{osv[0]}.{osv[1]}", "mitigations": dllflags, "characteristics": chars,
+            "machine": PE_MACHINES.get(machine, hex(machine)), "timestamp": ts, "subsystem": SUBSYS.get(subsystem, str(subsystem)),
             "pe32plus": magic == 0x20B, "sections": secs, "imports": imports, "dll": bool(chars & 0x2000), "entry_rva": entry,
             "exports": exports, "export_count": export_count, "signed": bool(sec_off and sec_sz), "version": version}
 
@@ -481,6 +494,10 @@ def look_binary(look):
             look.headline = f"Windows {kind} ({info['machine']})" + (f", {info['version']['FileDescription']}" if info["version"].get("FileDescription") else "") + (f", {info['export_count']} exports" if info["export_count"] else "")
             look.dims = f"{info['machine']}"
             look.line(f"Windows PE ({kind}): machine {info['machine']}, subsystem {info['subsystem']}." + (f" Exports {info['export_count']} functions, e.g. " + ", ".join(info["exports"][:5]) + "." if info["export_count"] else " No exports."), 80)
+            look.line(f"PE header: entry point RVA 0x{info['entry_rva']:x}, image base 0x{info['image_base']:x}, image size {info['image_size']:,} B, {len(info['sections'])} sections, "
+                      f"linker {info['linker']}, minimum OS {info['os_version']}, mitigations: {', '.join(info['mitigations']) or 'none'}, header checksum {'set' if info['checksum'] else 'zero'}; "
+                      f"{len(info['imports'])} imported DLLs.", 76)
+            look.line("Section table (name, virtual size, raw size, rights): " + "; ".join(f"{x['name']} {x['vsize']:,} / {x['raw']:,} {x['perms']}" for x in info["sections"][:16]) + ".", 47)
             if info["version"]:
                 look.line("Version info: " + "; ".join(f"{k} {v}" for k, v in info["version"].items()), 78)
             import dl_pe
@@ -514,9 +531,19 @@ def look_binary(look):
                 look.line(f"Mach-O: cpu {MACHO_CPU.get(cpu, hex(cpu))}.")
                 look.fact("arch", MACHO_CPU.get(cpu, hex(cpu)))
         elif st == "wasm":
-            look.line(f"WebAssembly module, version {struct.unpack('<I', b[4:8])[0]}.")
+            import dl_cls
+            w = dl_cls.parse_wasm(b)
+            look.headline = f"WebAssembly module: {len(w['imports'])} imports, {len(w['exports'])} exports, {w['imported_funcs'] + w['functions']} functions"
+            for k, t in enumerate(dl_cls.wasm_lines(w)):
+                look.line(t, 97 - k)
+            look.fact("exports", [n for n, _ in w["exports"]])
         elif st == "java-class":
-            look.line(f"Java class file, major version {struct.unpack('>H', b[6:8])[0]}.")
+            import dl_cls
+            c = dl_cls.parse_class(b)
+            look.headline = f"Java class {c['name']}: {len(c['methods'])} methods, {len(c['fields'])} fields, Java {c['release']}"
+            for k, t in enumerate(dl_cls.class_lines(c)):
+                look.line(t, 97 - k)
+            look.fact("methods", [m["name"] for m in c["methods"]])
         elif st == "dex":
             look.line("Android Dalvik executable (dex).")
         else:
@@ -524,7 +551,7 @@ def look_binary(look):
     except (struct.error, ValueError, IndexError) as e:
         look.flag("PARSE-ERROR", "header", str(e)[:100], "the header is truncated or malformed; strings and entropy still ran")
     look.fact("entropy", round(core.entropy(b[:4 << 20]), 3))
-    st_list = core.strings_of(b, 8, STRINGS_CAP)
+    st_list = [x for x in core.strings_of(b, 8, STRINGS_CAP) if wordy(x[2])]   # machine-code bytes that happen to be printable are not strings
     lines = [f"{o:08x} {k} {s[:300]}" for o, k, s in st_list]
     if lines:
         look.write_text("strings.txt", "\n".join(lines), f"ASCII and UTF-16LE strings (min 8, {len(lines)} shown, capped at {STRINGS_CAP})", value=-5)
@@ -547,6 +574,19 @@ def look_binary(look):
     look.ask_human("May the strings or the file be uploaded anywhere? Default: no.", "Which function or behaviour do you need explained?")
 
 
+_WORD = re.compile(r"[a-z]{4,}|[A-Za-z]{3,}[_./\:-][A-Za-z]{2,}|[A-Z][A-Z0-9]*_[A-Z0-9_]{3,}|https?://|\d{1,4}[.:/-]\d{1,4}[.:/-]\d{1,4}")
+
+
+def wordy(s):
+    """True when a printable run reads like text (a word, a path, a constant name, a version or date) rather than code bytes."""
+    s = s.strip()
+    if len(s) < 6:
+        return False
+    if not _WORD.search(s):
+        return False
+    return sum(c.isalnum() or c in " _./\\:-,'\"()%=@#<>[]{}$&*+?!;" for c in s) / len(s) >= 0.85
+
+
 # ================================================================= archives
 RESERVED = {"CON", "PRN", "AUX", "NUL", *(f"COM{i}" for i in range(1, 10)), *(f"LPT{i}" for i in range(1, 10))}
 MAX_MEMBERS = 10000
@@ -639,7 +679,7 @@ def screen_members(look, members, depth):
         seen.add(key)
         if m["packed"] and m["size"] / max(1, m["packed"]) > MAX_RATIO:
             refusals.append(("ratio", m["name"], f"ratio {m['size'] // max(1, m['packed'])}:1 (limit {MAX_RATIO}:1)"))
-        if m["packed"]:
+        if m["packed"] and m.get("offset") is not None:   # a 7-Zip listing gives no offsets: nothing to compare
             ranges.append((m["offset"], m["offset"] + m["packed"], m["name"]))
     ranges.sort()
     for a, b in zip(ranges, ranges[1:]):
@@ -730,7 +770,7 @@ def archive_overview(members):
     out.append("Largest: " + "; ".join(f"{m['name']} ({core.human(m['size'])})" for m in big))
     nested = [m["name"] for m in files if m["name"].lower().endswith(NESTED_EXT)]
     if nested:
-        out.append(f"{len(nested)} members are archives themselves (not opened), e.g. {', '.join(nested[:2])}.")
+        out.append(f"{len(nested)} members are archives themselves, e.g. {', '.join(nested[:2])}.")
     risky = [m["name"] for m in files if m["name"].lower().endswith(RISKY_EXT)]
     if risky:
         out.append(f"{len(risky)} runnable-looking members (never run), e.g. {', '.join(risky[:3])}.")
@@ -766,9 +806,70 @@ def member_reader(look, fmt):
                 return None
             return t.extractfile(m).read(cap + 1)
         return read, t.close
+    sz = look.tool("7z")
+    if sz:
+        def read(name, cap):   # streamed to memory: `7z e -so` writes nothing to disk
+            r = subprocess.run([sz, "e", "-so", "-y", str(look.path), name], capture_output=True, timeout=40)
+            return r.stdout[:cap + 1] if r.returncode == 0 else None
+        return read, (lambda: None)
     return None, (lambda: None)
 
 
+NEST_OPEN = (".zip", ".jar", ".war", ".whl", ".nupkg", ".tar", ".tgz", ".tar.gz", ".tar.xz", ".tar.bz2", ".txz", ".tbz2")
+SMALL_NOTE = 600              # a text member this short is quoted whole
+SMALL_ANY = 65536             # a member this small is read whatever its name: a file with no extension is often text
+INNER_NEST_MAX = 48 << 20     # a nested archive up to this size is opened in memory
+
+
+def _is_textname(name):
+    import dl_prof as P
+    return P.is_text_name(name) or P.is_manifest(name)
+
+
+def nested_items(b, outer, depth, budget):
+    """Members of an archive held in memory -> (name, size, text or None); one more level for archives inside it (depth 2 at most).
+    Reads only text-like members of up to 4 MB; budget[0] counts the bytes read so far over the whole look."""
+    out = []
+    try:
+        if zipfile.is_zipfile(io.BytesIO(b)):
+            z = zipfile.ZipFile(io.BytesIO(b))
+            infos = [i for i in z.infolist() if not i.is_dir()][:5000]
+
+            def get(i):
+                return None if i.flag_bits & 1 else z.open(i).read(INNER_TEXT_MAX + 1)
+            ent = [(i.filename, i.file_size, i) for i in infos]
+        else:
+            t = tarfile.open(fileobj=io.BytesIO(b), mode="r:*")
+            ms = [m for m in t.getmembers() if m.isfile()][:5000]
+
+            def get(m):
+                return t.extractfile(m).read(INNER_TEXT_MAX + 1)
+            ent = [(m.name, m.size, m) for m in ms]
+    except Exception:
+        return out
+    for name, size, h in ent:
+        text = None
+        if depth < 2 and name.lower().endswith(NEST_OPEN) and size <= INNER_NEST_MAX and budget[0] + size <= INNER_TOTAL_MAX:
+            try:
+                nb = get(h) if size <= INNER_TEXT_MAX else None
+            except Exception:
+                nb = None
+            if nb is not None:
+                budget[0] += len(nb)
+                for n2, s2, t2 in nested_items(nb, name, depth + 1, budget):
+                    out.append((f"{name}!/{n2}", s2, t2))
+        elif size <= INNER_TEXT_MAX and (_is_textname(name) or 0 < size <= SMALL_ANY) and budget[0] + size <= INNER_TOTAL_MAX:
+            try:
+                bb = get(h)
+            except Exception:
+                bb = None
+            if bb is not None:
+                budget[0] += len(bb)
+                text, _enc = core.decode_text(bb)
+        out.append((name, size, text))
+    return out
+
+
 def archive_contents(look, members, fmt):
     """What is inside, read in memory: tree stats (lines, languages, tests, env vars, constants), every manifest / README / licence /
     changelog, and a field profile of each table (CSV, TSV, JSON, JSONL) member. Nothing is extracted to disk."""
@@ -778,11 +879,28 @@ def archive_contents(look, members, fmt):
     files = [m for m in members if m["kind"] == "file"]
     used, t0 = 0, time.time()
     texts = {}
+    opened, small = [], {}
     try:
         for m in files:
             name, size = m["name"], m["size"]
             text = None
-            want = read and not m["enc"] and (P.is_text_name(name) or P.is_manifest(name)) and size <= max(INNER_TEXT_MAX, INNER_TABLE_MAX if name.lower().endswith((".csv", ".tsv", ".json", ".jsonl", ".ndjson")) else 0)
+            if read and not m["enc"] and name.lower().endswith(NEST_OPEN) and size <= INNER_NEST_MAX and used + size <= INNER_TOTAL_MAX and time.time() - t0 < 60:
+                try:
+                    nb = read(name, INNER_NEST_MAX)
+                except Exception:
+                    nb = None
+                if nb is not None and len(nb) <= INNER_NEST_MAX:
+                    used += len(nb)
+                    n_in = 0
+                    for iname, isize, itext in nested_items(nb, name, 1, [used]):
+                        tree.add(f"{name}!/{iname}", isize, itext)
+                        n_in += 1
+                        if itext is not None and len(itext) <= SMALL_NOTE and not P.is_manifest(iname):
+                            small[f"{name}!/{iname}"] = itext
+                        if itext is not None and (P.is_manifest(iname) or iname.lower().endswith((".csv", ".tsv", ".json", ".jsonl", ".ndjson", ".yaml", ".yml", ".toml", ".xml", ".properties", ".ini", ".cfg", ".txt", ".md"))):
+                            texts[f"{name}!/{iname}"] = itext
+                    opened.append(f"{name} ({n_in} inner files)")
+            want = read and not m["enc"] and (P.is_text_name(name) or P.is_manifest(name) or 0 < size <= SMALL_ANY) and size <= max(INNER_TEXT_MAX, INNER_TABLE_MAX if name.lower().endswith((".csv", ".tsv", ".json", ".jsonl", ".ndjson")) else 0)
             if want and used + size <= INNER_TOTAL_MAX and time.time() - t0 < 60:
                 try:
                     b = read(name, max(INNER_TEXT_MAX, INNER_TABLE_MAX))
@@ -791,11 +909,18 @@ def archive_contents(look, members, fmt):
                 if b is not None:
                     used += len(b)
                     text, _enc = core.decode_text(b)
+                    if text is not None and len(text) <= SMALL_NOTE and not P.is_manifest(name):
+                        small[name] = text
                     if text is not None and (P.is_manifest(name) or name.lower().endswith((".csv", ".tsv", ".json", ".jsonl", ".ndjson", ".yaml", ".yml", ".toml", ".xml", ".properties", ".ini", ".cfg"))):
                         texts[name] = text
             tree.add(name, size, text)
     finally:
         close()
+    for n, t in list(small.items())[:20]:
+        if t.strip():
+            look.line(f"Small text member {n}: " + " | ".join(x.strip() for x in t.strip().splitlines()[:8])[:SMALL_NOTE], 64, "small")
+    if opened:
+        look.line("Archives inside this archive, opened in memory (nested names are written outer!/inner): " + "; ".join(opened[:10]) + ".", 91)
     tree.emit(look, "Contents", 90, [("members", len(members)), ("folders", sum(1 for m in members if m["kind"] == "dir") or None),
                                      ("encrypted members", sum(1 for m in members if m["enc"]) or None), ("bytes read to look inside", used)])
     # member dates
@@ -818,6 +943,57 @@ def archive_contents(look, members, fmt):
         look.line(f"Config member {n} ({len(t.splitlines())} lines): " + " | ".join(P.short(x, 80) for x in kv), 40, "config")
 
 
+MEMBER_LOOK_EXT = {".xlsx", ".xlsm", ".xls", ".ods", ".docx", ".doc", ".odt", ".pptx", ".odp", ".pdf", ".sqlite", ".sqlite3", ".db", ".parquet", ".avro", ".orc", ".npz", ".npy", ".dta",
+                   ".mid", ".ttf", ".otf", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".eml", ".ics", ".vcf", ".torrent", ".plist", ".pyc", ".class", ".wasm", ".exe", ".dll", ".deb", ".stl",
+                   ".glb", ".log", ".mp3", ".wav", ".flac", ".ogg", ".opus", ".m4a", ".mp4", ".mkv", ".mov", ".avi", ".webm", ".epub", ".duckdb", ".pcap", ".evtx", ".ipynb"}
+MEMBER_LOOK_N = 8             # members of a document or media type that get a look of their own, in place
+MEMBER_LOOK_BYTES = 40 << 20
+MEMBER_LOOK_TOKENS = 420      # facts carried up from one member's look
+
+
+def member_looks(look, members, fmt):
+    """After the safety screen passed: the members that are documents, tables, media or binaries get their own look (written under the look folder,
+    never run), and their top facts are carried up here, because a list of names says nothing about what the file inside holds."""
+    if getattr(look, "depth", 0) >= 1 or look.quick or not hasattr(core, "recurse_into"):
+        return
+    read, close = member_reader(look, fmt)
+    if not read:
+        return
+    import dl_write
+    files = [m for m in members if m["kind"] == "file" and not m["enc"] and 0 < m["size"] <= MEMBER_LOOK_BYTES and os.path.splitext(m["name"])[1].lower() in MEMBER_LOOK_EXT]
+    t0, done = time.time(), 0
+    try:
+        for m in files[:MEMBER_LOOK_N]:
+            if time.time() - t0 > 150:
+                look.line(f"Member looks stopped after {done} members (time cap); the rest are named in the list.", 30)
+                break
+            try:
+                b = read(m["name"], MEMBER_LOOK_BYTES)
+            except Exception:
+                b = None
+            if b is None or len(b) > MEMBER_LOOK_BYTES:
+                continue
+            d = look.out / "members" / f"{done + 1:02d}"
+            d.mkdir(parents=True, exist_ok=True)
+            fp = d / re.sub(r"[^\w.\-]+", "_", os.path.basename(m["name"].replace("\\", "/")))
+            fp.write_bytes(b)
+            tier = "quick" if os.path.splitext(fp.name)[1].lower() in (".mp3", ".wav", ".flac", ".ogg", ".opus", ".m4a", ".mp4", ".mkv", ".mov", ".avi", ".webm") and len(b) > (8 << 20) else "standard"
+            c = core.recurse_into(look, fp, m["name"], tier)
+            done += 1
+            chunks = [x for x in (c.stream or []) if x["sec"] in ("watch", "key")]
+            chunks.sort(key=lambda x: -x["pri"])
+            used, picked = 0, []
+            for x in chunks:
+                if used + x["tok"] > MEMBER_LOOK_TOKENS and picked:
+                    break
+                picked.append(x["text"])
+                used += x["tok"]
+            if picked:
+                look.line(f"Member {m['name']} ({c.type}/{c.subtype}), looked at in place: " + " | ".join(" ".join(t.split()) for t in picked), 66, "member")
+    finally:
+        close()
+
+
 def inner_tables(look, texts):
     """Each CSV/TSV/JSON/JSONL member: rows, columns and an exact field profile (sums, counts, extremes)."""
     import dl_prof as P
@@ -876,14 +1052,14 @@ def parse_7z_slt(text):
             if in_files and cur.get("Path"):
                 attr = cur.get("Attributes", "")
                 kind = "dir" if cur.get("Folder") == "+" or attr.startswith("D") else "symlink" if cur.get("Symbolic Link") or attr.startswith("l") or attr.startswith("_l") else "file"
-                members.append(dict(name=cur["Path"], size=int(cur.get("Size") or 0), packed=int(cur.get("Packed Size") or 0), kind=kind, enc=cur.get("Encrypted") == "+", offset=0))
+                members.append(dict(name=cur["Path"], size=int(cur.get("Size") or 0), packed=int(cur.get("Packed Size") or 0), kind=kind, enc=cur.get("Encrypted") == "+", offset=None))
             cur = {}
             continue
         if "=" in ln:
             k, v = ln.split("=", 1)
             (cur if in_files else extra).__setitem__(k.strip(), v.strip())
     if in_files and cur.get("Path"):
-        members.append(dict(name=cur["Path"], size=int(cur.get("Size") or 0), packed=int(cur.get("Packed Size") or 0), kind="file", enc=cur.get("Encrypted") == "+", offset=0))
+        members.append(dict(name=cur["Path"], size=int(cur.get("Size") or 0), packed=int(cur.get("Packed Size") or 0), kind="file", enc=cur.get("Encrypted") == "+", offset=None))
     extra = {"method": extra.get("Method", ""), "solid": extra.get("Solid", ""), "type": extra.get("Type", "")}
     return members, extra
 
@@ -1001,6 +1177,11 @@ def look_archive(look):
         archive_contents(look, members, extra.get("format"))
     except Exception as e:  # the listing stands even when a member cannot be read
         look.fail("member contents (manifests, tables, tree stats)", "stdlib", e)
+    if not refusals and extra.get("format") in ("zip", "tar", "7z", "iso", "rar"):
+        try:
+            member_looks(look, members, extra.get("format"))
+        except Exception as e:
+            look.fail("member looks (documents and media inside the archive)", "stdlib", e)
     rows =[(m["name"], m["size"], m["packed"], f"{m['size'] / max(1, m['packed']):.1f}" if m["packed"] else "", m["kind"], "encrypted" if m["enc"] else "") for m in members[:2000]]
     buf = io.StringIO()
     w = csv.writer(buf)
@@ -1227,9 +1408,15 @@ def look_font(look):
         facts["family"] = names.get(1, "")
         facts["subfamily"] = names.get(2, "")
         facts["full_name"] = names.get(4, "")
+    if font is not None:
+        try:
+            font_details(look, font, facts)
+        except Exception as e:
+            look.fail("font metrics", "fontTools", e)
     for k, v in facts.items():
         look.fact(k, v)
     if facts.get("family") or facts.get("glyphs"):
+        look.headline = f"Font {facts.get('full_name') or facts.get('family')!r} ({st}): {facts.get('glyphs', '?')} glyphs, {'variable' if facts.get('variable') else 'static'}; {len(facts.get('tables', []))} tables"
         look.line(f"Font {facts.get('full_name') or facts.get('family')!r} ({st}): {facts.get('glyphs', '?')} glyphs, {'variable' if facts.get('variable') else 'static'}; "
                   f"{len(facts.get('tables', []))} tables.")
     else:
@@ -1254,6 +1441,53 @@ def look_font(look):
     look.ask_human("Which scripts or languages must this font cover?", "Is the licence in the file the one you expect?")
 
 
+def font_details(look, font, facts):
+    """Name records, design metrics, style bits and layout features: the facts a type designer or a web developer asks first."""
+    h = font["head"]
+    labels = {0: "copyright", 1: "family", 2: "subfamily", 3: "unique id", 4: "full name", 5: "version string", 6: "PostScript name", 7: "trademark", 8: "manufacturer",
+              9: "designer", 11: "vendor URL", 12: "designer URL", 13: "licence", 14: "licence URL", 16: "typographic family", 17: "typographic subfamily"}
+    got = {}
+    for rec in font["name"].names:
+        if rec.nameID in labels and rec.nameID not in got:
+            try:
+                got[rec.nameID] = rec.toUnicode()
+            except Exception:
+                pass
+    look.line("Name records: " + "; ".join(f"{labels[i]} = {got[i][:90]}" for i in sorted(got)) + ".", 74)
+    bits = []
+    bits.append(f"{h.unitsPerEm} units per em, font revision {float(h.fontRevision):.3f}")
+    bits.append(f"glyph box x {h.xMin}..{h.xMax}, y {h.yMin}..{h.yMax}")
+    bits.append("macStyle: " + ", ".join(n for bit, n in ((1, "bold"), (2, "italic"), (4, "underline")) if h.macStyle & bit) if h.macStyle else "macStyle: regular")
+    if "OS/2" in font:
+        o = font["OS/2"]
+        sel = [n for bit, n in ((1, "italic"), (32, "bold"), (64, "regular"), (512, "oblique")) if o.fsSelection & bit]
+        bits.append(f"OS/2 weight class {o.usWeightClass}, width class {o.usWidthClass}, fsSelection {'+'.join(sel) or 'none'}, typo ascender {o.sTypoAscender}, typo descender {o.sTypoDescender}, "
+                    f"line gap {o.sTypoLineGap}, win ascent {o.usWinAscent}, win descent {o.usWinDescent}"
+                    + (f", x-height {o.sxHeight}, cap height {o.sCapHeight}" if getattr(o, "version", 0) >= 2 and getattr(o, "sxHeight", 0) else ""))
+    if "hhea" in font:
+        hh = font["hhea"]
+        bits.append(f"hhea ascent {hh.ascent}, descent {hh.descent}, line gap {hh.lineGap}")
+    if "post" in font:
+        bits.append(f"italic angle {font['post'].italicAngle}, fixed pitch {'yes' if font['post'].isFixedPitch else 'no'}")
+    try:
+        import datetime
+        epoch = datetime.datetime(1904, 1, 1)
+        bits.append(f"head created {(epoch + datetime.timedelta(seconds=h.created)).date()}, modified {(epoch + datetime.timedelta(seconds=h.modified)).date()}")
+    except Exception:
+        pass
+    look.line("Design metrics: " + "; ".join(bits) + ".", 73)
+    feats = {}
+    for tab in ("GSUB", "GPOS"):
+        if tab in font and getattr(font[tab].table, "FeatureList", None):
+            feats[tab] = sorted({r.FeatureTag for r in font[tab].table.FeatureList.FeatureRecord})
+    scripts = sorted({r.ScriptTag for tab in ("GSUB", "GPOS") if tab in font and getattr(font[tab].table, "ScriptList", None) for r in font[tab].table.ScriptList.ScriptRecord})
+    if feats or scripts:
+        look.line("Layout features: " + "; ".join(f"{t} {', '.join(v)}" for t, v in feats.items()) + (f"; scripts {', '.join(scripts)}" if scripts else "") + ".", 66)
+    look.line(f"cmap subtables: {len(font['cmap'].tables)}; kern table {'present' if 'kern' in font else 'absent'}; hinting {'TrueType instructions (fpgm/prep)' if 'fpgm' in font or 'prep' in font else 'none or unhinted'}; "
+              f"glyph outlines {'CFF (OpenType)' if 'CFF ' in font or 'CFF2' in font else 'TrueType quadratic'}.", 60)
+    facts["units_per_em"] = h.unitsPerEm
+
+
 def specimen(look, font, facts):
     from PIL import Image, ImageDraw, ImageFont
     buf = io.BytesIO()

package/sigmadeeplook/scripts/dl_binx.py

@@ -43,7 +43,8 @@ def run_diec(look):
     p = parse_diec(out)
     packers = [e for e in p["entries"] if e[0].lower() in ("packer", "protector", "cryptor")]
     keep = [(c, n, v) for c, n, v in p["entries"] if c.lower() in ("linker", "compiler", "tool", "packer", "protector", "installer", "library")][:4]
-    look.line("Detect It Easy: " + "; ".join(f"{c.lower()} {n}" + (f" {v}" if v else "") for c, n, v in keep) + ".", 68)
+    if keep:
+        look.line("Detect It Easy: " + "; ".join(f"{c.lower()} {n}" + (f" {v}" if v else "") for c, n, v in keep) + ".", 68)
     if packers:
         look.flag("PACKED?", "Detect It Easy", ", ".join(f"{n} {v}".strip() for _, n, v in packers), "a packer or protector is identified: static strings and imports describe the stub, not the program")
     look.step("packer and compiler identification", "diec")