@follenfang/fupload 0.0.25 → 0.0.26

package/fupload/SKILL.md

@@ -2,7 +2,7 @@
 name: fupload
 description: Explicit author-publishing workflow for World of Warcraft plugins, configuration shares, and WA/strings on NewBeeBox, NetEase DD, CurseForge, Heybox Workshop, and ModUs.Creator, including local Creator login reuse and plugin ZIP publishing. Use only when the user explicitly invokes `$fupload`, explicitly asks to use the Fupload Skill, or loads this Skill by path. Do not trigger from ordinary mentions of publishing, NewBeeBox, DD, CurseForge, Heybox, ModUs, plugins, configurations, or WA.
 metadata:
-  version: "0.0.25"
+  version: "0.0.26"
 ---
 
 # Fupload

package/fupload/references/dd.md

@@ -81,7 +81,7 @@ When rebuilding a plugin update/edit form, preserve field presence from the curr
 
 Before `plugin update`, traverse `/addon/addon_versions` pages as an optional duplicate guard. If it returns version rows, reject any candidate version already present anywhere in that history before upload; if it is empty or unavailable, retain the current-version check and continue. After update, confirm the submitted version fields from the matching item in the author plugin list, whose `latest_version` is the official update projection. `detail_v2` is supplementary. An empty history never marks a successful private-plugin update as failed and never triggers replay.
 
-Read `plugin categories`, choose `primary_category_id`, then choose only returned `second_category_ids`. Read `plugin game-versions --game-type <id>` and use its stable values. The package accepts `.zip` only. Authorization always uses `file_type=a19-ui-res`, `business_id=addon`, fixed `file_name=addon.zip`, and `mime_type=application/x-zip-compressed`. Plugin image authorization uses `a19-ui-media/img` with an explicit empty wire file name.
+Read `plugin categories`, choose `primary_category_id`, then choose only returned `second_category_ids`. Read `plugin game-versions --game-type <id>` and use its stable values. The package accepts `.zip` only. Before login/upload, local plugin ZIP files are checked for backslash paths in both the central directory and local file headers; DD cannot recognize these paths reliably. Rebuild such ZIPs with forward-slash (`/`) entry names (Windows PowerShell 5 `Compress-Archive` may produce incompatible backslash names). Fupload rejects the package rather than rewriting it. External `detail_url` packages are not downloaded for this check. Authorization always uses `file_type=a19-ui-res`, `business_id=addon`, fixed `file_name=addon.zip`, and `mime_type=application/x-zip-compressed`. Plugin image authorization uses `a19-ui-media/img` with an explicit empty wire file name.
 
 ## Configuration share
 

package/fupload/scripts/fupload_cli/__init__.py

@@ -1,3 +1,3 @@
 """Fupload Python CLI."""
 
-__version__ = "0.0.25"
+__version__ = "0.0.26"

package/fupload/scripts/fupload_cli/schema.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import os
+import struct
 import zipfile
 from dataclasses import dataclass, field
 from typing import Any, Dict, Iterable, Mapping, Optional, Sequence, Tuple
@@ -10,6 +11,33 @@ from typing import Any, Dict, Iterable, Mapping, Optional, Sequence, Tuple
 from .errors import ValidationError
 
 
+def _validate_dd_plugin_zip(path: str) -> None:
+    """Inspect stored paths before Windows ZipInfo normalizes separators."""
+    try:
+        with open(path, "rb") as source, zipfile.ZipFile(source) as archive:
+            for info in archive.infolist():
+                if "\\" in info.orig_filename:
+                    raise ValidationError(
+                        "DD plugin ZIP contains backslash paths; rebuild the ZIP with forward-slash (/) entry names",
+                        path="$.file",
+                    )
+                source.seek(info.header_offset)
+                header = source.read(30)
+                if len(header) != 30 or header[:4] != b"PK\x03\x04":
+                    raise zipfile.BadZipFile("invalid local file header")
+                name_length = struct.unpack_from("<H", header, 26)[0]
+                name = source.read(name_length)
+                if len(name) != name_length:
+                    raise zipfile.BadZipFile("truncated local entry name")
+                if b"\\" in name:
+                    raise ValidationError(
+                        "DD plugin ZIP contains backslash paths in a local file header; rebuild the ZIP with forward-slash (/) entry names",
+                        path="$.file",
+                    )
+    except (OSError, zipfile.BadZipFile) as exc:
+        raise ValidationError("file must be a valid ZIP archive", path="$.file") from exc
+
+
 JSON_TYPES = {
     "string": (str,),
     "integer": (int,),
@@ -308,6 +336,8 @@ class Schema:
             ):
                 scalar_array(name, (str,), "array must contain nonempty strings")
         if self.name.startswith("fupload.v1.dd"):
+            if self.name.startswith("fupload.v1.dd.plugin.") and "file" in value:
+                _validate_dd_plugin_zip(value["file"])
             object_array("associated_acts", {"sn", "act_type"}, ("sn", "act_type"))
             for name in ("second_category_ids", "vip_levels"):
                 if name in value and any(isinstance(item, bool) or not isinstance(item, int) for item in value[name]):

package/fupload/scripts/fupload_cli/trust.py

@@ -191,6 +191,7 @@ def verify_dd_executable(executable: Path) -> Dict[str, str]:
             [powershell, "-NoProfile", "-NonInteractive", "-Command", script],
             capture_output=True, text=True, encoding="utf-8", errors="strict",
             timeout=20, check=False, env=environment,
+            creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
         )
         if completed.returncode != 0:
             raise FuploadError("DD Authenticode verification process failed", kind="trust_boundary")

package/npm/skill-manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "fupload.npm-skill-manifest.v1",
   "package_name": "@follenfang/fupload",
-  "package_version": "0.0.25",
-  "skill_version": "0.0.25",
-  "tree_sha256": "a90fdc7fc77bec86d92215bd4adc50d3aef7eb48b6e9cfac1f20051e5eb3a3e5",
+  "package_version": "0.0.26",
+  "skill_version": "0.0.26",
+  "tree_sha256": "4af4e44df9949daa9432d47bc5d7913d6dd58442e8436981c22922a1e365b63f",
   "files": [
     {
       "path": "agents/openai.yaml",
@@ -87,8 +87,8 @@
     },
     {
       "path": "references/dd.md",
-      "bytes": 21111,
-      "sha256": "18895d95e5221b3c2243922bbfc6f2e826f9084a0d5d11c37c3eb923a9dd7547"
+      "bytes": 21542,
+      "sha256": "2bff00091259535980e42fac12f9765f9e51f8beea43dee9bff377c67fa2bce3"
     },
     {
       "path": "references/modus.md",
@@ -113,7 +113,7 @@
     {
       "path": "scripts/fupload_cli/__init__.py",
       "bytes": 50,
-      "sha256": "33eefade5f5f7a8d274c5106873503d86397e994c0b22a0fad6d27bacd7960de"
+      "sha256": "8affb4fcf748b4f6b76907e88051a6a4aa5110146ea5adbe56231509962b1de4"
     },
     {
       "path": "scripts/fupload_cli/blackbox_web.py",
@@ -182,8 +182,8 @@
     },
     {
       "path": "scripts/fupload_cli/schema.py",
-      "bytes": 55131,
-      "sha256": "b651963c504896cfef46f65b61d5fb638884aacb14a8e09593162526e239133f"
+      "bytes": 56696,
+      "sha256": "9d690fea8fe7b249c089a24a6c59d783f83d2ffd0215def770cd9849d09e52f8"
     },
     {
       "path": "scripts/fupload_cli/state_machine.py",
@@ -197,8 +197,8 @@
     },
     {
       "path": "scripts/fupload_cli/trust.py",
-      "bytes": 9392,
-      "sha256": "83298b6aaf63144381451b9e486469215aa5fa5fbde115a20c376d5daf4cef11"
+      "bytes": 9462,
+      "sha256": "79d31833a16d71ec132612a4a2fd2f015770df469e7db06933b3ea530022c97d"
     },
     {
       "path": "scripts/fupload.py",
@@ -208,7 +208,7 @@
     {
       "path": "SKILL.md",
       "bytes": 28729,
-      "sha256": "24c423a3f33cafc5d98e7efc5be199147088d268673ea03d121bbbc850a5f90e"
+      "sha256": "863223ca2e78adb854511a18fea9c9bead7238d5014b229a0ea21a335409fc90"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@follenfang/fupload",
-  "version": "0.0.25",
+  "version": "0.0.26",
   "description": "Install and run the Fuploader Agent Skill and Python CLI.",
   "type": "module",
   "bin": {