@follenfang/fupload 0.0.24 → 0.0.26

package/fupload/SKILL.md

@@ -2,7 +2,7 @@
 name: fupload
 description: Explicit author-publishing workflow for World of Warcraft plugins, configuration shares, and WA/strings on NewBeeBox, NetEase DD, CurseForge, Heybox Workshop, and ModUs.Creator, including local Creator login reuse and plugin ZIP publishing. Use only when the user explicitly invokes `$fupload`, explicitly asks to use the Fupload Skill, or loads this Skill by path. Do not trigger from ordinary mentions of publishing, NewBeeBox, DD, CurseForge, Heybox, ModUs, plugins, configurations, or WA.
 metadata:
-  version: "0.0.24"
+  version: "0.0.26"
 ---
 
 # Fupload

package/fupload/references/dd.md

@@ -81,7 +81,7 @@ When rebuilding a plugin update/edit form, preserve field presence from the curr
 
 Before `plugin update`, traverse `/addon/addon_versions` pages as an optional duplicate guard. If it returns version rows, reject any candidate version already present anywhere in that history before upload; if it is empty or unavailable, retain the current-version check and continue. After update, confirm the submitted version fields from the matching item in the author plugin list, whose `latest_version` is the official update projection. `detail_v2` is supplementary. An empty history never marks a successful private-plugin update as failed and never triggers replay.
 
-Read `plugin categories`, choose `primary_category_id`, then choose only returned `second_category_ids`. Read `plugin game-versions --game-type <id>` and use its stable values. The package accepts `.zip` only. Authorization always uses `file_type=a19-ui-res`, `business_id=addon`, fixed `file_name=addon.zip`, and `mime_type=application/x-zip-compressed`. Plugin image authorization uses `a19-ui-media/img` with an explicit empty wire file name.
+Read `plugin categories`, choose `primary_category_id`, then choose only returned `second_category_ids`. Read `plugin game-versions --game-type <id>` and use its stable values. The package accepts `.zip` only. Before login/upload, local plugin ZIP files are checked for backslash paths in both the central directory and local file headers; DD cannot recognize these paths reliably. Rebuild such ZIPs with forward-slash (`/`) entry names (Windows PowerShell 5 `Compress-Archive` may produce incompatible backslash names). Fupload rejects the package rather than rewriting it. External `detail_url` packages are not downloaded for this check. Authorization always uses `file_type=a19-ui-res`, `business_id=addon`, fixed `file_name=addon.zip`, and `mime_type=application/x-zip-compressed`. Plugin image authorization uses `a19-ui-media/img` with an explicit empty wire file name.
 
 ## Configuration share
 

package/fupload/references/modus.md

@@ -131,7 +131,7 @@ PUT are separate stages.
 | `file_id` | `fileId` | positive integer | update/edit/delete required; upload allocates | `GET /game/data/author/project/fileId/{projectId}` | allocated ID is used by signature; create metadata omits it | update/delete/signature | `id`/`fileId` in release detail |
 | `version` | `version` | non-empty string, max 120 | create/upload required after ZIP preflight | ZIP `.toc` plus caller label | caller value preserved | metadata create/update | `version` |
 | `type` | `type` | non-empty string, max 40 | create/upload required | Creator release-type choices/API | must be a server-supported value | metadata create/update | `type` |
-| `supported_game_versions` | `supportedGameVersionsReqs[]` | non-empty object array | required; ZIP-derived | installed `.toc` `Interface` values and game config | each entry requires string `gameVersion` and `server`; explicit caller value must be a nonempty subset of ZIP and live `wow_builds` choices | metadata create/update | `supportedGameVersionsReqs`/version compatibility rows |
+| `supported_game_versions` | `supportedGameVersionsReqs[]` | non-empty object array | required; defaults to ZIP-derived builds | installed `.toc` `Interface` values and game config | each entry requires string `gameVersion` and `server`; explicit caller values must be live `wow_builds` choices on client branches declared in the ZIP | metadata create/update | `supportedGameVersionsReqs`/version compatibility rows |
 | `md5` | `md5` | hex string, max 64 | derived from exact ZIP bytes | local ZIP preflight | must describe bytes later PUT | metadata create/update | `md5` |
 | `zip_size` | `zipSize` | non-negative integer | derived | local ZIP stat | must describe exact ZIP | metadata create/update | `zipSize` |
 | `unzip_size` | `unzipSize` | non-negative integer | derived | ZIP central directory | bounded by ZIP preflight | metadata create/update | `unzipSize` |
@@ -149,7 +149,7 @@ before file-ID allocation and ZIP preflight, so those early failures are also
 durable. Binary-upload errors expose only a query-free endpoint identifier,
 status when available, and a bounded redacted response summary. The provider parses each addon `.toc`
 `Interface` value to derive
-`toc_version` and `supported_game_versions`, and ignores TOCs under a `Libs` directory. Explicit `toc_version` must match. Known clients absent from live `wow_builds` are excluded from automatic selection; unknown Interface codes still fail. Explicit `supported_game_versions` may narrow selection to a product's supported scope, but must be a nonempty subset of both ZIP and live choices. Creator `plugin get/versions` uses the Creator session; main-client addon reads retain their separate session.
+`toc_version` and `supported_game_versions`, and ignores TOCs under a `Libs` directory. Explicit `toc_version` must match. Interface `16001` maps to `wow_forever` / `1.60.1`. Known clients absent from live `wow_builds` are excluded from automatic selection; unknown Interface codes still fail. Omitted `supported_game_versions` continues to select only exact TOC-derived builds offered by the live service. Explicit values are the author's compatibility declaration: they may select a newer live build (for example `12.1.5` for a `120100` retail TOC), but cannot add a client branch absent from the ZIP or a build absent from live choices. Empty and duplicate selections are rejected. This does not rewrite the ZIP or `toc_version`, or automatically assert compatibility with newer builds. Creator `plugin get/versions` uses the Creator session; main-client addon reads retain their separate session.
 The provider validates the ZIP, computes `md5`, `zip_size`, and `unzip_size`,
 registers metadata, obtains a signed URL, then uploads the ZIP bytes with HTTP
 `PUT` and `Content-Type: application/zip`. A local path is metadata only; it is

package/fupload/scripts/fupload_cli/__init__.py

@@ -1,3 +1,3 @@
 """Fupload Python CLI."""
 
-__version__ = "0.0.24"
+__version__ = "0.0.26"

package/fupload/scripts/fupload_cli/modus_zip.py

@@ -40,6 +40,7 @@ INTERFACE_GAME_VERSION_MAP: Mapping[str, Mapping[str, str]] = {
     "11508": {"gameVersion": "Classic Era", "server": "wow_classic_era"},
     "40401": {"gameVersion": "Cataclysm Classic", "server": "wow_classic_cata"},
     "11509": {"gameVersion": "1.15.9", "server": "wow_classic_era"},
+    "16001": {"gameVersion": "1.60.1", "server": "wow_forever"},
     "20506": {"gameVersion": "2.5.6", "server": "wow_anniversary"},
     "38002": {"gameVersion": "3.80.2", "server": "wow_classic_titan"},
     "40402": {"gameVersion": "4.4.2", "server": "wow_classic_cata"},
@@ -48,7 +49,7 @@ INTERFACE_GAME_VERSION_MAP: Mapping[str, Mapping[str, str]] = {
 
 # Recognized WoW clients in universal ZIPs which currently have no Creator
 # server mapping. Preserve their Interface codes, without inventing wire keys.
-KNOWN_UNMAPPED_INTERFACES = {"16001", "30405"}
+KNOWN_UNMAPPED_INTERFACES = {"30405"}
 
 _INTERFACE_RE = re.compile(r"^\s*##\s*Interface\s*:\s*(.*?)\s*$", re.IGNORECASE)
 _INTERFACE_VALUE_RE = re.compile(r"^\d+$")
@@ -213,7 +214,7 @@ parse_zip_metadata = parse_modus_zip
 
 def select_game_versions(derived: Sequence[Mapping[str, str]], config: Any,
                          supplied: Any = None) -> List[Dict[str, str]]:
-    """Intersect known ZIP clients with live Creator choices and caller scope."""
+    """Default to exact TOC builds; allow explicit live builds on ZIP clients."""
     rows = config if isinstance(config, list) else []
     row = next((item for item in rows if isinstance(item, Mapping) and item.get("key") == "wow_builds"), None)
     try:
@@ -228,9 +229,16 @@ def select_game_versions(derived: Sequence[Mapping[str, str]], config: Any,
         raise ValidationError("live wow_builds config is missing or malformed", path="$.supported_game_versions")
     available = [dict(item) for item in derived
                  if item["server"] in builds and item["gameVersion"] in builds[item["server"]]["versions"]]
+    # An explicit build is the author's compatibility declaration, like the
+    # Creator dropdown. It must still belong to a client present in the ZIP
+    # and be offered by the live service. Never opt into newer builds by default.
+    clients = {item["server"] for item in derived}
+    live_choices = [{"server": server, "gameVersion": version}
+                    for server in builds if server in clients
+                    for version in builds[server]["versions"]]
     selected = available if supplied is None else supplied
-    if not isinstance(selected, list) or not selected or any(item not in available for item in selected):
-        raise ValidationError("supported_game_versions must be a nonempty subset of ZIP and live Creator choices", path="$.supported_game_versions")
+    if not isinstance(selected, list) or not selected or any(item not in live_choices for item in selected):
+        raise ValidationError("supported_game_versions must be a nonempty subset of ZIP client branches and live Creator choices", path="$.supported_game_versions")
     if len({(item["server"], item["gameVersion"]) for item in selected}) != len(selected):
         raise ValidationError("supported_game_versions must not contain duplicates", path="$.supported_game_versions")
     return [dict(item) for item in selected]

package/fupload/scripts/fupload_cli/schema.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import os
+import struct
 import zipfile
 from dataclasses import dataclass, field
 from typing import Any, Dict, Iterable, Mapping, Optional, Sequence, Tuple
@@ -10,6 +11,33 @@ from typing import Any, Dict, Iterable, Mapping, Optional, Sequence, Tuple
 from .errors import ValidationError
 
 
+def _validate_dd_plugin_zip(path: str) -> None:
+    """Inspect stored paths before Windows ZipInfo normalizes separators."""
+    try:
+        with open(path, "rb") as source, zipfile.ZipFile(source) as archive:
+            for info in archive.infolist():
+                if "\\" in info.orig_filename:
+                    raise ValidationError(
+                        "DD plugin ZIP contains backslash paths; rebuild the ZIP with forward-slash (/) entry names",
+                        path="$.file",
+                    )
+                source.seek(info.header_offset)
+                header = source.read(30)
+                if len(header) != 30 or header[:4] != b"PK\x03\x04":
+                    raise zipfile.BadZipFile("invalid local file header")
+                name_length = struct.unpack_from("<H", header, 26)[0]
+                name = source.read(name_length)
+                if len(name) != name_length:
+                    raise zipfile.BadZipFile("truncated local entry name")
+                if b"\\" in name:
+                    raise ValidationError(
+                        "DD plugin ZIP contains backslash paths in a local file header; rebuild the ZIP with forward-slash (/) entry names",
+                        path="$.file",
+                    )
+    except (OSError, zipfile.BadZipFile) as exc:
+        raise ValidationError("file must be a valid ZIP archive", path="$.file") from exc
+
+
 JSON_TYPES = {
     "string": (str,),
     "integer": (int,),
@@ -308,6 +336,8 @@ class Schema:
             ):
                 scalar_array(name, (str,), "array must contain nonempty strings")
         if self.name.startswith("fupload.v1.dd"):
+            if self.name.startswith("fupload.v1.dd.plugin.") and "file" in value:
+                _validate_dd_plugin_zip(value["file"])
             object_array("associated_acts", {"sn", "act_type"}, ("sn", "act_type"))
             for name in ("second_category_ids", "vip_levels"):
                 if name in value and any(isinstance(item, bool) or not isinstance(item, int) for item in value[name]):

package/fupload/scripts/fupload_cli/trust.py

@@ -191,6 +191,7 @@ def verify_dd_executable(executable: Path) -> Dict[str, str]:
             [powershell, "-NoProfile", "-NonInteractive", "-Command", script],
             capture_output=True, text=True, encoding="utf-8", errors="strict",
             timeout=20, check=False, env=environment,
+            creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
         )
         if completed.returncode != 0:
             raise FuploadError("DD Authenticode verification process failed", kind="trust_boundary")

package/npm/skill-manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "fupload.npm-skill-manifest.v1",
   "package_name": "@follenfang/fupload",
-  "package_version": "0.0.24",
-  "skill_version": "0.0.24",
-  "tree_sha256": "53bc8cdcaab317ddace896026d8668614dfaeb19f421cf0195fe4846f6e9933c",
+  "package_version": "0.0.26",
+  "skill_version": "0.0.26",
+  "tree_sha256": "4af4e44df9949daa9432d47bc5d7913d6dd58442e8436981c22922a1e365b63f",
   "files": [
     {
       "path": "agents/openai.yaml",
@@ -87,13 +87,13 @@
     },
     {
       "path": "references/dd.md",
-      "bytes": 21111,
-      "sha256": "18895d95e5221b3c2243922bbfc6f2e826f9084a0d5d11c37c3eb923a9dd7547"
+      "bytes": 21542,
+      "sha256": "2bff00091259535980e42fac12f9765f9e51f8beea43dee9bff377c67fa2bce3"
     },
     {
       "path": "references/modus.md",
-      "bytes": 37716,
-      "sha256": "f462731d05d786cdfd290eceaea9104b0f28814c9a5bd793358e4dc1a7abcdce"
+      "bytes": 38146,
+      "sha256": "1aa357333988e076b2ab3754a6f530b6e0b8ed30cc6bdd0091bab3cece970f18"
     },
     {
       "path": "references/newbee-official-cli.md",
@@ -113,7 +113,7 @@
     {
       "path": "scripts/fupload_cli/__init__.py",
       "bytes": 50,
-      "sha256": "8903ed57cd646124d87b730c4c5923b97cacd906cef920de53c6b91acfb554f4"
+      "sha256": "8affb4fcf748b4f6b76907e88051a6a4aa5110146ea5adbe56231509962b1de4"
     },
     {
       "path": "scripts/fupload_cli/blackbox_web.py",
@@ -162,8 +162,8 @@
     },
     {
       "path": "scripts/fupload_cli/modus_zip.py",
-      "bytes": 11445,
-      "sha256": "ddf603cb24d5e9758be0428446f134e02aa1a44a8be39f697b8985ac34463e2f"
+      "bytes": 11993,
+      "sha256": "45e84c175feccfc1f05368048ea3e6f24058fe30bbc770396f3be7a43868d188"
     },
     {
       "path": "scripts/fupload_cli/modus.py",
@@ -182,8 +182,8 @@
     },
     {
       "path": "scripts/fupload_cli/schema.py",
-      "bytes": 55131,
-      "sha256": "b651963c504896cfef46f65b61d5fb638884aacb14a8e09593162526e239133f"
+      "bytes": 56696,
+      "sha256": "9d690fea8fe7b249c089a24a6c59d783f83d2ffd0215def770cd9849d09e52f8"
     },
     {
       "path": "scripts/fupload_cli/state_machine.py",
@@ -197,8 +197,8 @@
     },
     {
       "path": "scripts/fupload_cli/trust.py",
-      "bytes": 9392,
-      "sha256": "83298b6aaf63144381451b9e486469215aa5fa5fbde115a20c376d5daf4cef11"
+      "bytes": 9462,
+      "sha256": "79d31833a16d71ec132612a4a2fd2f015770df469e7db06933b3ea530022c97d"
     },
     {
       "path": "scripts/fupload.py",
@@ -208,7 +208,7 @@
     {
       "path": "SKILL.md",
       "bytes": 28729,
-      "sha256": "9625fb102b1fcc347978d0b9fe73a51703ec8296d344550938e8a2dbe593565f"
+      "sha256": "863223ca2e78adb854511a18fea9c9bead7238d5014b229a0ea21a335409fc90"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@follenfang/fupload",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "description": "Install and run the Fuploader Agent Skill and Python CLI.",
   "type": "module",
   "bin": {