@litfamily/lithermes 1.0.7 → 1.0.9

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/excalidraw_support.py

@@ -0,0 +1,64 @@
+"""Bounded JSON and inert-label helpers for Excalidraw extraction."""
+
+from __future__ import annotations
+
+import hashlib
+import math
+import re
+from typing import Final, NoReturn, TypeAlias
+
+JsonValue: TypeAlias = str | int | float | bool | None | list["JsonValue"] | dict[str, "JsonValue"]
+JsonObject: TypeAlias = dict[str, JsonValue]
+MAX_DEPTH: Final = 64
+URL_RE: Final = re.compile(r"(?i)\b(?:https?|ftp|file|javascript|data):[^\s<>\"']+")
+EXEC_RE: Final = re.compile(r"(?is)<\s*(?:script|iframe|object|embed)\b|\bon[a-z]+\s*=")
+ID_RE: Final = re.compile(r"[A-Za-z][A-Za-z0-9_-]{0,63}\Z")
+
+class ImportFailure(Exception):
+    """A bounded, user-correctable import rejection."""
+
+def reject(message: str) -> NoReturn:
+    raise ImportFailure(message)
+
+def safe_id(source_id: str, used: set[str]) -> str:
+    """Keep readable ids when safe and hash all other source identifiers."""
+    if not source_id: reject("scene contains an element without an id")
+    candidate = source_id if ID_RE.fullmatch(source_id) else f"n-{hashlib.sha256(source_id.encode()).hexdigest()[:16]}"
+    if candidate in used: reject("scene contains duplicate or colliding element ids")
+    used.add(candidate)
+    return candidate
+
+def clean_label(raw: str) -> tuple[str, int]:
+    """Normalize inert label text and remove URL tokens."""
+    if EXEC_RE.search(raw):
+        reject("executable markup or event attributes in labels are unsupported")
+    urls = len(URL_RE.findall(raw))
+    text = URL_RE.sub("", raw).replace("\r\n", "\n").replace("\r", "\n")
+    text = "".join(char for char in text if char in "\n\t" or ord(char) >= 32)
+    lines = [re.sub(r"[ \t]+", " ", line).strip() for line in text.splitlines()]
+    return "\n".join(line for line in lines if line)[:2_000], urls
+
+def check_json_depth(text: str) -> None:
+    """Reject excessive structural nesting before the JSON decoder recurses."""
+    depth, quoted, escaped = 0, False, False
+    for char in text:
+        if quoted:
+            if escaped: escaped = False
+            elif char == "\\": escaped = True
+            elif char == '"': quoted = False
+        elif char == '"':
+            quoted = True
+        elif char in "[{":
+            depth += 1
+        if depth > MAX_DEPTH: reject("scene nesting exceeds the depth limit (64)")
+        elif char in "]}":
+            depth -= 1
+
+def finite_geometry(element: dict[str, JsonValue]) -> None:
+    """Validate present numeric geometry even though it is never exported."""
+    for key in ("x", "y", "width", "height"):
+        value = element.get(key)
+        if value is None:
+            continue
+        if isinstance(value, bool) or not isinstance(value, (int, float)): reject(f"element geometry field {key} must be numeric")
+        if abs(value) > 10_000_000 or isinstance(value, float) and not math.isfinite(value): reject(f"element geometry field {key} is outside the supported range")

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/export.mjs

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { buildBlockRegistry } from './block-registry.mjs';
+import { agentBrowserSupported } from './browser-version.mjs';
+import { expandXmlCharacterReferences, officeCssUrlsAreSafe, officeHrefRefsAreSafe } from './office-safety.mjs';
+
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
+const args=process.argv.slice(2);
+const value=(flag,fallback)=>{const i=args.indexOf(flag);return i>=0?args[i+1]:fallback;};
+const input=value('--input',args.find((x)=>!x.startsWith('--')));
+const output=path.resolve(value('--out',path.join(process.cwd(),'diagram-exports')));
+const all=args.includes('--all-scales');
+const office=args.includes('--office-safe');
+const registry=args.includes('--registry');
+const allowFontFallback=args.includes('--allow-font-fallback');
+const selected=Number(value('--scale','3'));
+if(!input||(!all&&![1,2,3].includes(selected))){console.error('Usage: node scripts/export.mjs --input <file.html|file.svg> [--out DIR] [--scale 1|2|3|--all-scales] [--office-safe] [--registry] [--allow-font-fallback]');process.exit(2);}
+if(path.basename(input)==='index.html'){console.error('EXPORT_SOURCE_REJECTED gallery pages are not diagram sources');process.exit(2);}
+const resolved=path.resolve(input);
+if(!fs.existsSync(resolved)){console.error('INPUT_MISSING '+resolved);process.exit(2);}
+const outputRelative=path.relative(root,output);
+if(outputRelative===''||(!outputRelative.startsWith('..'+path.sep)&&outputRelative!=='..'&&!path.isAbsolute(outputRelative))){console.error('EXPORT_OUTPUT_IN_PAYLOAD choose an output directory outside the installed skill');process.exit(2);}
+const browserVersion=spawnSync('agent-browser',['--version'],{encoding:'utf8'});
+if(browserVersion.status!==0||!agentBrowserSupported(browserVersion.stdout)){console.error('RENDERER_REQUIRED agent-browser 0.38.1 or later is required; install it yourself with: npm install -g agent-browser');process.exit(2);}
+const doctor=spawnSync('agent-browser',['doctor','--json'],{encoding:'utf8'});
+let doctorJson;
+try{doctorJson=JSON.parse(doctor.stdout);}catch{doctorJson=null;}
+const chrome=doctorJson?.checks?.find((x)=>x.id==='chrome.installed')?.message||'';
+if(!doctorJson?.success||!chrome.includes('154.')){console.error('CHROME_REQUIRED Chrome for Testing 154 must already be installed; user-run step: agent-browser install');process.exit(2);}
+let source=fs.readFileSync(resolved,'utf8');
+const svgMatch=source.match(/<svg\b[^>]*>[\s\S]*?<\/svg>/i);
+if(!svgMatch){console.error('SVG_MISSING '+resolved);process.exit(2);}
+const svg=svgMatch[0];
+let registryData=null;
+if(registry){try{registryData=buildBlockRegistry(svg,resolved);}catch(e){console.error('REGISTRY_FAILED '+e.message);process.exit(2);}}
+const view=svg.match(/\bviewBox\s*=\s*["']([^"']+)["']/i)?.[1]?.trim().split(/[\s,]+/).map(Number);
+if(!view||view.length!==4||view.some((x)=>!Number.isFinite(x))){console.error('VIEWBOX_REQUIRED '+resolved);process.exit(2);}
+let officeSvg=null;
+if(office){
+  const font=path.join(root,'assets/fonts/PretendardVariable.woff2');
+  if(!fs.existsSync(font)){console.error('FONT_MISSING '+font);process.exit(2);}
+  const normalizedOfficeSource=expandXmlCharacterReferences(svg);
+  if(normalizedOfficeSource===null){console.error('OFFICE_UNSAFE_ACTIVE_OR_EXTERNAL_CONTENT');process.exit(2);}
+  officeSvg=svg.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi,'');
+  if(/<foreignObject\b|\bon[a-z]+\s*=|<script\b/i.test(normalizedOfficeSource)||!officeHrefRefsAreSafe(normalizedOfficeSource)){console.error('OFFICE_UNSAFE_ACTIVE_OR_EXTERNAL_CONTENT');process.exit(2);}
+  if(/\bvar\s*\(|@import/i.test(normalizedOfficeSource)||!officeCssUrlsAreSafe(normalizedOfficeSource)){console.error('OFFICE_UNSUPPORTED_CSS_URL_OR_VARIABLE');process.exit(2);}
+  officeSvg=officeSvg.replace(/<filter\b[^>]*>[\s\S]*?<\/filter>/gi,'');
+  officeSvg=officeSvg.replace(/\s+(?:filter|mask)\s*=\s*(["'])url\(#.*?\)\1/gi,'');
+  officeSvg=officeSvg.replace(/<(rect|circle|ellipse|line|path|polygon|polyline|text)\b([^>]*)>/gi,(tag,name,attributes)=>{
+    let extra='';
+    const converted=attributes.replace(/(\b(?:fill|stroke)\s*=\s*)(["'])(.*?)\2/gi,(whole,prefix,quote,value)=>{
+      if(value.toLowerCase()==='transparent')return prefix+quote+'none'+quote;
+      const rgba=value.match(/^rgba?\(\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d+)(?:\s*,\s*([\d.]+))?\s*\)$/i);
+      if(!rgba)return whole;
+      const channels=rgba.slice(1,4).map((n)=>Math.max(0,Math.min(255,Number(n))).toString(16).padStart(2,'0'));
+      const alpha=rgba[4]===undefined?1:Math.max(0,Math.min(1,Number(rgba[4])));
+      if(alpha<1)extra+=' '+prefix.trim().split('=')[0]+'-opacity="'+alpha+'"';
+      return prefix+quote+'#'+channels.join('')+quote;
+    });
+    return '<'+name+converted+extra+'>';
+  });
+  const rootOpen=officeSvg.match(/<svg\b[^>]*>/i)?.[0];
+  if(!rootOpen){console.error('OFFICE_SVG_ROOT_MISSING');process.exit(2);}
+  let nextRoot=rootOpen;
+  if(!/\bxmlns\s*=/.test(nextRoot))nextRoot=nextRoot.replace(/<svg\b/,'<svg xmlns="http://www.w3.org/2000/svg"');
+  if(!/\bwidth\s*=/.test(nextRoot))nextRoot=nextRoot.replace(/>$/,' width="'+view[2]+'" height="'+view[3]+'">');
+  officeSvg=officeSvg.replace(rootOpen,nextRoot);
+  const fontData=fs.readFileSync(font).toString('base64');
+  const style='<style>@font-face{font-family:Pretendard;src:url(data:font/woff2;base64,'+fontData+') format("woff2");font-weight:100 900}text{font-family:Pretendard,Arial,sans-serif}</style>';
+  officeSvg=officeSvg.replace(/(<svg\b[^>]*>)/i,'$1'+style);
+}
+function run(commandArgs, env={}) {
+  const r=spawnSync('agent-browser',['--profile',profile,'--session',session,...commandArgs],{encoding:'utf8',env:{...process.env,AGENT_BROWSER_ALLOW_FILE_ACCESS:'true',...env},maxBuffer:2*1024*1024});
+  if(r.status!==0) throw new Error((r.stderr||r.stdout||'agent-browser failed').trim());
+  return (r.stdout||'').trim();
+}
+fs.mkdirSync(output,{recursive:true});
+const profile=fs.mkdtempSync(path.join(output,'.lit-diagram-profile-'));
+const session='lit-diagram-export-'+process.pid+'-'+Date.now();
+const url=pathToFileURL(resolved).href;
+let opened=false;
+try{
+  run(['open',url]);opened=true;
+  run(['set','media','light','reduced-motion']);
+  const outputs=[];
+  const scales=all?[1,2,3]:[selected];
+  for(const scale of scales){
+    const width=Math.round(view[2]*scale), height=Math.round(view[3]*scale);
+    run(['set','viewport',String(Math.max(width+8,640)),String(Math.max(height+8,480))]);
+    run(['eval','document.fonts.ready.then(()=>true)']);
+    const script='(async()=>{const s=document.querySelector("svg");if(!s)throw new Error("SVG missing");document.documentElement.style.margin="0";document.body.style.margin="0";document.body.style.padding="0";const main=s.closest("main");if(main){main.style.width="'+width+'px";main.style.maxWidth="none";main.style.margin="0";main.style.padding="0"}s.style.width="'+width+'px";s.style.height="'+height+'px";s.style.maxWidth="none";s.style.display="block";await document.fonts.ready;const t=s.querySelector("text"),family=t?getComputedStyle(t).fontFamily:"",size=t?getComputedStyle(t).fontSize:"16px",face=[...document.fonts].find(f=>f.family.replace(/[\"\']/g,"").toLowerCase()==="pretendard"),r=s.getBoundingClientRect();const font=Boolean(t&&/Pretendard/i.test(family)&&face?.status==="loaded"&&document.fonts.check(size+" Pretendard"));return JSON.stringify({width:r.width,height:r.height,x:r.x,y:r.y,viewportWidth:innerWidth,viewportHeight:innerHeight,font,family,fontFaceStatus:face?.status||"missing"})})()';
+    const dimensions=run(['eval',script]);
+    let measurement;
+    try{const outer=JSON.parse(dimensions);measurement=typeof outer==='string'?JSON.parse(outer):outer;}catch{throw new Error('FONT_PROOF_INVALID '+dimensions);}
+    if(Math.abs(measurement.width-width)>0.5||Math.abs(measurement.height-height)>0.5)throw new Error('SVG_DIMENSIONS_MISMATCH '+JSON.stringify(measurement));
+    if(measurement.x<0||measurement.y<0||measurement.x+measurement.width>measurement.viewportWidth||measurement.y+measurement.height>measurement.viewportHeight)throw new Error('SVG_OUTSIDE_VIEWPORT '+JSON.stringify(measurement));
+    if(!measurement.font&&!allowFontFallback)throw new Error('PRETENDARD_NOT_LOADED_OR_COMPUTED '+JSON.stringify(measurement));
+    const filename=path.join(output,path.basename(resolved).replace(/\.(?:html|svg)$/i,'')+'-'+scale+'x.png');
+    run(['screenshot','svg',filename]);
+    if(!fs.existsSync(filename)||fs.statSync(filename).size===0) throw new Error('PNG_WRITE_FAILED '+filename+' '+dimensions);
+    outputs.push({file:filename,bytes:fs.statSync(filename).size,scale,dimensions});
+  }
+  for(const out of outputs) console.log('PNG '+out.scale+'x '+out.bytes+' bytes '+out.file+' '+out.dimensions);
+} catch(e) {
+  console.error('EXPORT_FAILED '+e.message);
+  process.exitCode=1;
+} finally {
+  if(opened) {
+    const close=spawnSync('agent-browser',['--profile',profile,'--session',session,'close'],{encoding:'utf8'});
+    if(close.status!==0) console.error('BROWSER_CLOSE_WARNING '+(close.stderr||''));
+  }
+  fs.rmSync(profile,{recursive:true,force:true});
+}
+if(officeSvg){
+  const target=path.join(output,path.basename(resolved).replace(/\.(?:html|svg)$/i,'')+'-office.svg');
+  fs.writeFileSync(target,'<?xml version="1.0" encoding="UTF-8"?>\n'+officeSvg);
+  console.log('OFFICE_SVG '+fs.statSync(target).size+' bytes '+target+' text=live font=embedded-woff2');
+}
+if(registry) {
+  const target=path.join(output,path.basename(resolved).replace(/\.(?:html|svg)$/i,'')+'.registry.json');
+  if(!process.exitCode){fs.writeFileSync(target,JSON.stringify(registryData,null,2)+'\n');console.log('REGISTRY '+registryData.blocks.length+' blocks '+target);}
+}

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/mermaid_extract.py

@@ -0,0 +1,240 @@
+#!/usr/bin/env python3
+"""Bounded stdlib-only Mermaid extraction; labels are inert and never executed."""
+
+# /// script
+# requires-python = ">=3.10"
+# dependencies = []
+# ///
+# ─── How to run ───
+# python3 mermaid_extract.py input.mmd [--diagram 0]
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import html
+import json
+import re
+import sys
+from mermaid_source import ImportFailure, read_blocks, reject
+from pathlib import Path
+from typing import Final, TypeAlias
+
+JsonValue: TypeAlias = str | int | float | bool | None | list["JsonValue"] | dict[str, "JsonValue"]
+JsonObject: TypeAlias = dict[str, JsonValue]
+MAX_NODES: Final = 2_000
+MAX_EDGES: Final = 5_000
+MAX_DEPTH: Final = 64
+URL_RE: Final = re.compile(r"(?i)\b(?:https?|ftp|file|javascript|data):[^\s<>\"']+")
+EXEC_RE: Final = re.compile(r"(?is)<\s*(?:script|iframe|object|embed)\b|\bon[a-z]+\s*=")
+ID_RE: Final = re.compile(r"[A-Za-z][A-Za-z0-9_-]{0,63}\Z")
+HEADER_RE: Final = re.compile(r"(?i)^(flowchart|graph|sequenceDiagram|stateDiagram-v2|erDiagram)\b(.*)$")
+KINDS: Final = {"flowchart": "flowchart", "graph": "flowchart", "sequencediagram": "sequence", "statediagram-v2": "state", "erdiagram": "er"}
+
+def safe_id(raw: str, used: set[str]) -> str:
+    """Return a stable, bounded output identifier."""
+    if not raw: reject("diagram contains an empty element id")
+    safe = raw if ID_RE.fullmatch(raw) else f"n-{hashlib.sha256(raw.encode()).hexdigest()[:16]}"
+    if safe in used: reject("diagram contains duplicate or colliding ids")
+    used.add(safe)
+    return safe
+
+def label(raw: str) -> tuple[str, int]:
+    """Normalize visible text without executing markup or retaining URLs."""
+    if EXEC_RE.search(raw): reject("executable markup or event attributes in labels are unsupported")
+    urls = len(URL_RE.findall(raw))
+    raw = URL_RE.sub("", raw).replace("<br/>", "\n").replace("<br>", "\n")
+    raw = re.sub(r"<[^>]*>", "", raw)
+    raw = html.unescape(raw).replace("\xa0", " ")
+    raw = re.sub(r"\*\*(.*?)\*\*|__(.*?)__", lambda m: m.group(1) or m.group(2), raw)
+    return "\n".join(re.sub(r"[ \t]+", " ", s).strip() for s in raw.splitlines() if s.strip())[:2_000], urls
+
+def extract(path: Path, index: int) -> JsonObject:
+    """Parse one supported Mermaid block into the shared import schema."""
+    data, blocks = read_blocks(path)
+    if index < 0 or index >= len(blocks): reject(f"diagram index out of range ({len(blocks)} block(s))")
+    source, first_line = blocks[index]
+    lines = source.splitlines()
+    if lines and lines[0].strip() == "---":
+        try: end = next(i for i, line in enumerate(lines[1:], 1) if line.strip() == "---")
+        except StopIteration: reject("unterminated Mermaid frontmatter")
+        lines = lines[end + 1:]
+        first_line += end + 1
+    lines = [(first_line + i, line.strip()) for i, line in enumerate(lines) if line.strip() and not line.strip().startswith("%%")]
+    header = next(((i, text, number) for i, (number, text) in enumerate(lines) if HEADER_RE.match(text)), None)
+    if header is None: reject("unsupported or missing Mermaid diagram declaration")
+    header_i, header_text, header_line = header
+    match = HEADER_RE.match(header_text)
+    if match is None: reject(f"malformed diagram declaration at line {header_line}")
+    raw_kind = match.group(1).casefold()
+    if raw_kind not in KINDS: reject(f"unsupported Mermaid grammar at line {header_line}")
+    grammar = KINDS[raw_kind]
+    direction = re.search(r"\b(TD|TB|BT|LR|RL)\b", match.group(2), re.I)
+    direction_hint = direction.group(1).upper() if direction else ""
+    nodes: dict[str, tuple[str, str, str, str | None]] = {}
+    groups: dict[str, str] = {}
+    relations: list[tuple[str, str, str, str, str]] = []
+    stack: list[str] = []
+    fields: dict[str, list[str]] = {}
+    entity: str | None = None
+    title = ""
+    discarded: dict[str, JsonValue] = {"styles": 0, "links": 0, "urls": 0, "scripts": 0, "directives": 0, "unsupportedElements": 0}
+
+    def add(raw_id: str, text: str = "", shape: str = "rectangle", kind: str = "component") -> None:
+        if raw_id not in nodes:
+            if len(nodes) >= MAX_NODES: reject("node limit exceeded (max 2,000)")
+            nodes[raw_id] = (text or raw_id, shape, kind, stack[-1] if stack else None)
+        elif text and nodes[raw_id][0] == raw_id:
+            nodes[raw_id] = (text, shape, nodes[raw_id][2], nodes[raw_id][3])
+
+    def connect(a: str, b: str, caption: str, kind: str, arrow: str) -> None:
+        if len(relations) >= MAX_EDGES: reject("relationship limit exceeded (max 5,000)")
+        relations.append((a, b, caption, kind, arrow))
+
+    for number, text in lines[header_i + 1:]:
+        if text.startswith("%%{"):
+            discarded["directives"] = int(discarded["directives"]) + 1
+            continue
+        if re.match(r"(?i)^(click|href|link)\b", text):
+            discarded["links"] = int(discarded["links"]) + 1
+            continue
+        if re.match(r"(?i)^(style|classDef|class|linkStyle)\b", text):
+            discarded["styles"] = int(discarded["styles"]) + 1
+            continue
+        if text.startswith("title "):
+            title, count = label(text[6:])
+            discarded["urls"] = int(discarded["urls"]) + count
+            continue
+        if text.casefold().startswith("direction "):
+            direction_hint = text.split(None, 1)[1].upper()
+            if direction_hint not in {"TD", "TB", "BT", "LR", "RL"}: reject(f"invalid direction at line {number}")
+            continue
+        if grammar == "flowchart":
+            if text.casefold() == "end":
+                if not stack: reject(f"unexpected subgraph end at line {number}")
+                stack.pop()
+                continue
+            sub = re.match(r"(?i)^subgraph\s+([\w.-]+)(?:\s*\[([^]]*)\])?$", text)
+            if sub:
+                gid = sub.group(1)
+                groups[gid], count = label(sub.group(2) or gid)
+                discarded["urls"] = int(discarded["urls"]) + count
+                add(gid, groups[gid], "container", "container")
+                stack.append(gid)
+                if len(stack) > MAX_DEPTH: reject("subgraph depth exceeds 64")
+                continue
+            edge = re.match(r"^([\w.-]+)(?:\[([^]]*)\]|\{([^}]*)\}|\(([^)]*)\))?\s*(<-->|<--|-->|---|-.->|==>|->|--o|--x)\s*(?:\|([^|]*)\|\s*)?([\w.-]+)(?:\[([^]]*)\]|\{([^}]*)\}|\(([^)]*)\))?$", text)
+            if edge:
+                a, al, ad, ae, arrow, et, b, bl, bd, be = edge.groups()
+                left, c1 = label(al or ad or ae or a)
+                right, c2 = label(bl or bd or be or b)
+                caption, c3 = label(et or "")
+                discarded["urls"] = int(discarded["urls"]) + c1 + c2 + c3
+                add(a, left, "diamond" if ad else "ellipse" if ae else "rectangle")
+                add(b, right, "diamond" if bd else "ellipse" if be else "rectangle")
+                connect(a, b, caption, "flow", "both" if arrow == "<-->" else "reverse" if arrow == "<--" else "none" if arrow == "---" else "forward")
+                continue
+            node = re.match(r"^([\w.-]+)(?:\[([^]]*)\]|\{([^}]*)\}|\(([^)]*)\))?$", text)
+            if node:
+                nid, rect, diamond, ellipse = node.groups()
+                visible, count = label(rect or diamond or ellipse or nid)
+                discarded["urls"] = int(discarded["urls"]) + count
+                add(nid, visible, "diamond" if diamond else "ellipse" if ellipse else "rectangle")
+                continue
+            reject(f"unsupported flowchart syntax at line {number}")
+        if grammar == "sequence":
+            participant = re.match(r'(?i)^(?:participant|actor)\s+(?:"([^"]+)"\s+as\s+)?([\w.-]+)(?:\s+as\s+(?:"([^"]+)"|([\w.-]+)))?$', text)
+            if participant:
+                quoted, pid, quoted_alias, alias = participant.groups()
+                name, count = label(quoted_alias or alias or quoted or pid)
+                discarded["urls"] = int(discarded["urls"]) + count
+                add(pid, name, "rectangle", "participant")
+                continue
+            message = re.match(r"^([\w.-]+)\s*(<<->>|<-->|->>|-->>|->|-->|-x|--x)(?:[+-])?\s*([\w.-]+)(?:\s*:\s*(.*))?$", text)
+            if message:
+                a, arrow, b, raw_label = message.groups()
+                caption, count = label(raw_label or "")
+                discarded["urls"] = int(discarded["urls"]) + count
+                add(a, kind="participant")
+                add(b, kind="participant")
+                connect(a, b, caption, "message", "both" if "<<" in arrow or arrow == "<-->" else "forward")
+                continue
+            reject(f"unsupported sequence syntax at line {number}")
+        if grammar == "state":
+            alias = re.match(r'^state\s+"([^"]+)"\s+as\s+([\w.-]+)$', text, re.I)
+            if alias:
+                name, count = label(alias.group(1))
+                discarded["urls"] = int(discarded["urls"]) + count
+                add(alias.group(2), name, "ellipse", "state")
+                continue
+            transition = re.match(r"^(\[\s*\*\s*\]|[\w.-]+)\s*(-->|-[.])\s*(\[\s*\*\s*\]|[\w.-]+)(?:\s*:\s*(.*))?$", text)
+            if transition:
+                a, _, b, raw_label = transition.groups()
+                a, b = ("initial" if "*" in a else a), ("final" if "*" in b else b)
+                caption, count = label(raw_label or "")
+                discarded["urls"] = int(discarded["urls"]) + count
+                add(a, "Initial" if a == "initial" else a, "ellipse", "state")
+                add(b, "Final" if b == "final" else b, "ellipse", "state")
+                connect(a, b, caption, "transition", "forward")
+                continue
+            if re.fullmatch(r"[\w.-]+", text):
+                add(text, text, "ellipse", "state")
+                continue
+            reject(f"unsupported state syntax at line {number}")
+        if grammar == "er":
+            if text == "}":
+                entity = None
+                continue
+            declaration = re.match(r"^([\w.-]+)\s*\{$", text)
+            if declaration:
+                entity = declaration.group(1)
+                fields.setdefault(entity, [])
+                add(entity, entity, "rectangle", "entity")
+                continue
+            relation = re.match(r"^([\w.-]+)\s+([|}o{.]+--[|}o{.]+)\s+([\w.-]+)(?:\s*:\s*(.*))?$", text)
+            if relation:
+                a, cardinality, b, raw_label = relation.groups()
+                caption, count = label(raw_label or "")
+                discarded["urls"] = int(discarded["urls"]) + count
+                add(a, kind="entity")
+                add(b, kind="entity")
+                connect(a, b, f"{cardinality}: {caption}" if caption else cardinality, "association", "forward")
+                continue
+            if entity:
+                field = re.match(r"^[\w.-]+\s+([\w.-]+)(?:\s+\w+)?$", text)
+                if field:
+                    fields[entity].append(field.group(1))
+                    continue
+            reject(f"unsupported ER syntax at line {number}")
+
+    if stack: reject("flowchart has an unterminated subgraph")
+    if entity: reject("ER diagram has an unterminated entity")
+    if not nodes: reject("diagram contains no supported nodes")
+    used: set[str] = set()
+    ids = {raw_id: safe_id(raw_id, used) for raw_id in nodes}
+    output_nodes: list[JsonObject] = []
+    for raw_id, (name, shape, kind, parent) in nodes.items():
+        if fields.get(raw_id): name += "\n" + "\n".join(fields[raw_id][:100])
+        item: JsonObject = {"id": ids[raw_id], "label": name, "kind": kind, "shape": shape}
+        if parent in ids: item["parentId"] = ids[parent]
+        output_nodes.append(item)
+    output_groups = [{"id": ids[gid], "label": name, "nodeIds": [ids[nid] for nid, value in nodes.items() if value[3] == gid]} for gid, name in groups.items() if any(value[3] == gid for value in nodes.values())]
+    output_relations: list[JsonObject] = [{"from": ids[a], "to": ids[b], "label": caption, "kind": kind, "direction": direction} for a, b, caption, kind, direction in relations if a in ids and b in ids]
+    warnings = ["Source layout and styling are omitted; labels are inert data."]
+    if direction_hint: warnings.append(f"Declared direction: {direction_hint}.")
+    return {"schemaVersion": 1, "sourceFormat": "mermaid", "sourceDigest": hashlib.sha256(data).hexdigest(), "title": title or path.stem or "Imported diagram", "suggestedType": "architecture" if grammar == "flowchart" and groups else grammar, "nodes": output_nodes, "relationships": output_relations, "groups": output_groups, "discarded": discarded, "warnings": warnings}
+
+def main() -> int:
+    """Run the standalone JSON extractor."""
+    parser = argparse.ArgumentParser(description="Extract inert diagram meaning from Mermaid source.")
+    parser.add_argument("file", type=Path)
+    parser.add_argument("--diagram", type=int, default=0, help="zero-based Markdown block (default: 0)")
+    args = parser.parse_args()
+    try: result = extract(args.file, args.diagram)
+    except ImportFailure as error:
+        print(f"mermaid_extract: {error}", file=sys.stderr)
+        return 2
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+if __name__ == "__main__": raise SystemExit(main())

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/mermaid_source.py

@@ -0,0 +1,39 @@
+"""Bounded Mermaid and Markdown source reading."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Final, NoReturn
+
+MAX_INPUT: Final = 4 * 1024 * 1024
+
+class ImportFailure(Exception):
+    """An input rejection suitable for a concise CLI diagnostic."""
+
+def reject(message: str) -> NoReturn:
+    raise ImportFailure(message)
+
+def read_blocks(path: Path) -> tuple[bytes, list[tuple[str, int]]]:
+    """Read one bounded source or fenced Mermaid blocks from Markdown."""
+    try:
+        with path.open("rb") as stream: data = stream.read(MAX_INPUT + 1)
+    except OSError as error: reject(f"cannot read input: {error.strerror or 'I/O error'}")
+    if len(data) > MAX_INPUT: reject("input exceeds the 4 MiB limit")
+    try: source = data.decode("utf-8", "strict")
+    except UnicodeDecodeError: reject("input is not valid UTF-8")
+    if path.suffix.casefold() in {".mmd", ".mermaid"}: return data, [(source, 1)]
+    if path.suffix.casefold() not in {".md", ".markdown", ".mdown", ".mkd"}: reject("provide .mmd, .mermaid, or Markdown")
+    blocks: list[tuple[str, int]] = []
+    active, fence, content = 0, "", []
+    for number, line in enumerate(source.splitlines(), 1):
+        if not active:
+            found = re.match(r"^\s*(`{3,}|~{3,})\s*mermaid\s*$", line, re.I)
+            if found: active, fence, content = number + 1, found.group(1), []
+        elif re.match(rf"^\s*{re.escape(fence[0])}{{{len(fence)},}}\s*$", line):
+            blocks.append(("\n".join(content), active))
+            active, fence, content = 0, "", []
+        else: content.append(line)
+    if active: reject(f"unterminated Mermaid fence at line {active - 1}")
+    if not blocks: reject("Markdown contains no fenced Mermaid block")
+    return data, blocks

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/office-safety.mjs

@@ -0,0 +1,54 @@
+export function expandXmlCharacterReferences(value) {
+  try{
+    const decoded=String(value).replace(/&#(?:x([0-9a-fA-F]+)|([0-9]+));/g,(_entity,hex,decimal)=>{
+      const code=Number.parseInt(hex||decimal,hex?16:10);
+      if(!Number.isInteger(code)||!(code===9||code===10||code===13||(code>=32&&code<=0xd7ff)||(code>=0xe000&&code<=0xfffd)||(code>=0x10000&&code<=0x10ffff)))throw new Error('invalid XML character reference');
+      return String.fromCodePoint(code);
+    });
+    return decoded.includes('&#')?null:decoded;
+  }catch{return null;}
+}
+
+export function cssUrlsAreSafe(svg,{allowReference=(value)=>/^#[A-Za-z0-9_.:-]+$/.test(value)}={}) {
+  const source=expandXmlCharacterReferences(svg);
+  if(source===null)return false;
+  const sourceWithoutComments=source.replace(/<!--[\s\S]*?-->/g,'').replace(/\/\*[\s\S]*?\*\//g,'');
+  const cssParts=[...sourceWithoutComments.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map((match)=>match[1]);
+  cssParts.push(...[...sourceWithoutComments.matchAll(/\bstyle\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi)].map((match)=>match[1]??match[2]??match[3]));
+  if(sourceWithoutComments.includes('\\')||/@import\b|\bvar\s*\(|\blocal\s*\(|\bunicode-range\s*:/i.test(sourceWithoutComments)||cssParts.some((part)=>part.includes('&')))return false;
+  const url=/url\s*\(/ig;
+  let match;
+  while((match=url.exec(sourceWithoutComments))){
+    let quote=null,end=-1;
+    for(let i=url.lastIndex;i<sourceWithoutComments.length;i++){
+      const char=sourceWithoutComments[i];
+      if(quote){if(char===quote)quote=null;continue;}
+      if(char==='"'||char==="'"){quote=char;continue;}
+      if(char==='(')return false;
+      if(char===')'){end=i;break;}
+    }
+    if(end<0||quote)return false;
+    let value=sourceWithoutComments.slice(url.lastIndex,end).trim();
+    if((value.startsWith('"')&&value.endsWith('"'))||(value.startsWith("'")&&value.endsWith("'")))value=value.slice(1,-1).trim();
+    if(!allowReference(value))return false;
+    url.lastIndex=end+1;
+  }
+  return true;
+}
+
+export function officeCssUrlsAreSafe(svg) {
+  return cssUrlsAreSafe(svg);
+}
+
+export function officeHrefRefsAreSafe(svg) {
+  const decoded=expandXmlCharacterReferences(svg);
+  if(decoded===null)return false;
+  if(/<base\b|\bxml:base\s*=/i.test(decoded))return false;
+  const source=decoded.replace(/<!--[\s\S]*?-->/g,'');
+  const attribute=/\b(?:href|src)\s*=\s*(?:(['"])(.*?)\1|([^\s'"<>`]+))/ig;
+  let match;
+  while((match=attribute.exec(source))){
+    if(!match[1]||!/^#[A-Za-z0-9_.:-]+$/.test(match[2].trim()))return false;
+  }
+  return true;
+}

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/verify-all.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.10"
+# dependencies = []
+# ///
+# ─── How to run ───
+# python scripts/verify-all.py
+
+from diagram_cli import verify_corpus_main
+
+if __name__ == "__main__":
+    raise SystemExit(verify_corpus_main())

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/verify-brief.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.10"
+# dependencies = []
+# ///
+# ─── How to run ───
+# python scripts/verify-brief.py --brief <brief.md> <diagram.html|diagram.svg>
+
+from diagram_cli import verify_brief_main
+
+if __name__ == "__main__":
+    raise SystemExit(verify_brief_main())

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/verify-diagram.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.10"
+# dependencies = []
+# ///
+# ─── How to run ───
+# python scripts/verify-diagram.py <diagram.html|diagram.svg> [--canvas]
+
+from diagram_cli import verify_diagram_main
+
+if __name__ == "__main__":
+    raise SystemExit(verify_diagram_main())

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/verify-motion.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.10"
+# dependencies = []
+# ///
+# ─── How to run ───
+# python scripts/verify-motion.py <diagram.html|diagram.svg>
+
+from diagram_cli import verify_motion_main
+
+if __name__ == "__main__":
+    raise SystemExit(verify_motion_main())

package/assets/lithermes-plugin/skills/lit-diagram-drawer/scripts/verify-type.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.10"
+# dependencies = []
+# ///
+# ─── How to run ───
+# python scripts/verify-type.py --type=<catalog-id> <diagram.html|diagram.svg>
+
+from diagram_cli import verify_type_main
+
+if __name__ == "__main__":
+    raise SystemExit(verify_type_main())

package/assets/lithermes-plugin/skills/lit-docx/NOTICE

@@ -0,0 +1 @@
+The publisher-docx source was provided under the MIT license. LitHermes adapts it for Hermes Agent. See the repository MIT license for terms.