bindery-cli 0.41.1__tar.gz → 0.43.0__tar.gz

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/.github/workflows/publish.yml

@@ -73,13 +73,12 @@ jobs:
 
       # The tag message IS the release's patchnotes entry (verbatim, per the
       # tagging procedure), so the release body is extracted from the tag
-      # object rather than paraphrased here. Without it the release page
-      # renders blank beside the zip. The checkout is depth-1 and carries no
-      # tag objects, so the tag ref is fetched explicitly first (without
-      # this, `git tag -l` lists nothing and the release body silently falls
-      # back to the commit message).
+      # object rather than paraphrased here. The checkout is depth-1 and
+      # leaves a LIGHTWEIGHT local tag on the commit (whose %(contents) is
+      # the commit message, not the release entry), so the real annotated
+      # tag object is force-fetched from the origin before reading it.
       - name: Fetch the tag object
-        run: git fetch --no-tags origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
+        run: git fetch --no-tags --force origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
 
       - name: Extract the release body from the tag message
         run: git tag -l --format='%(contents)' "${GITHUB_REF_NAME}" > release-body.md

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/CLAUDE.md

@@ -82,11 +82,11 @@ Born from the 2026 library audit (see the user memory `calibre-library-epubcheck
 
 ## Layout
 
-- `src/bindery/transforms.py`: pure `str -> (str, int)` text transforms (including `strip_broken_tags`). Since v0.32.0: `strip_attrs_in_start_tags` anchors attribute edits on the quote-aware start-tag matcher, `_outside_protected` forwards arguments (context-carrying transforms can be decorated), `fix_id_colons` matches only the bare `id` attribute and only internal fragments (`fix_ncx_src_fragments` carries renames into the NCX), `fix_ncx_playorder` is anchored to `<navPoint>` start tags, and the css selector boundary covers namespaced and functional selector forms. HAZARD (the 0.41.0 spin): the quote-aware tag-prefix alternation (double-quoted | single-quoted | [^>]) OVERLAPS ([^>] matches quotes too), so a plain `*` re-partitions exponentially on failing candidates; every such loop must carry the possessive `*+` (re 3.11+, the plugin's minimum Calibre). Since v0.37.0: `fix_ncx_playorder` strips quotes before its already-correct comparison (regex groups carry quote characters; comparing quoted values against bare numbers counted phantom fixes on every sequential NCX and rewrote single-quoted correct attributes to double quotes).
+- `src/bindery/transforms.py`: pure `str -> (str, int)` text transforms (including `strip_broken_tags`). Since v0.32.0: `strip_attrs_in_start_tags` anchors attribute edits on the quote-aware start-tag matcher, `_outside_protected` forwards arguments (context-carrying transforms can be decorated), `fix_id_colons` matches only the bare `id` attribute and only internal fragments (`fix_ncx_src_fragments` carries renames into the NCX), `fix_ncx_playorder` is anchored to `<navPoint>` start tags, and the css selector boundary covers namespaced and functional selector forms. HAZARD (the 0.41.0 spin): the quote-aware tag-prefix alternation (double-quoted | single-quoted | [^>]) OVERLAPS ([^>] matches quotes too), so a plain `*` re-partitions exponentially on failing candidates; every such greedy loop must carry the possessive `*+` (re 3.11+, the plugin's minimum Calibre). Since v0.42.0 the census is complete and pinned by tests/test_matcher_hardening.py: every greedy loop of this family is possessive (the three 0.41.1 rewrites plus _START_TAG_RE, _COVER_META_RE, _GUIDE_REF_RE, prune_dangling_edges' spine|item|itemref matcher, _ITEM_TAG_RE, _SPINE_ITEM_RE -- possessive is byte-identical on success because the loop is always followed by a literal `>` the [^>] branch cannot consume), and the five LAZY siblings (_VOID_RE, the transforms <img> matcher, and epub's link/a/img matchers) use the disjoint catch-all `[^>"']` instead: mutually exclusive branches cannot re-partition, and an unterminated quote inside a tag now fails to match rather than pairing across markup. NEW tag matchers: quote-aware possessive for greedy loops, the disjoint catch-all for lazy ones, and the tempered-quote idiom (["'])((?:(?!\1).)*)\1 for attribute values. Since v0.37.0: `fix_ncx_playorder` strips quotes before its already-correct comparison (regex groups carry quote characters; comparing quoted values against bare numbers counted phantom fixes on every sequential NCX and rewrote single-quoted correct attributes to double quotes).
 - `src/bindery/pagination.py`: the opt-in lossy page-number strip (runhead detection, page-layer decision, block-centric removal/merge, safety nets).
 - `src/bindery/watermark.py`: the opt-in lossy watermark strip (anchored and anchorless signature removal).
 - `src/bindery/reserialize.py`: structural repair via `html5lib`.
-- `src/bindery/audit.py`: read-only body-text audits (`content`, `pagenumbers`, `emptytext`, `ocr`, `monolithic` since v0.21.0 with `--max-doc-chars N`, and `completeness` since v0.36.0) behind the `audit` subcommand (v0.15.0). Since v0.18.0 library mode resolves EPUB paths through `cquarry.get_format_path()` and can apply a tag to flagged books via `cquarry.write.WritableCalibreDB` (only with explicit `--tag`; the only sanctioned write path). Since v0.19.0 `audit --id BOOK_ID` audits a single library book through cquarry's single-entity `get_book()` fetch (no library-wide cache; supports `--tag`; incompatible with the directory argument; comma lists since v0.23.0). Since v0.22.0 every archive entry is fully read (CRC + decompression) before analysis (a damaged entry reports its own CORRUPT verdict instead of feeding emptytext) and manifest/NCX references to absent files classify as `convention` (bloated ToC, consecutive span) or `fragment` (broken span). Hazard: the scan loop reuses `tag` as its per-book display column, so the `--tag` argument is captured as `audit_tag` at function entry; do not collapse them again. Since v0.29.0 `audit --json FILE` writes per-file analyzer verdicts in the `library --json` shape (directory, library, and single-book modes; with `--id`, exactly one id; emptytext omitted from a record when the archive verdict owns the body-text story). Since v0.36.0 the completeness analyzer (Phase 15) reports the phase-1 spot-check per book: spine/prose-doc counts (prose = >= 400 visible chars), first/middle/last prose-doc opening/closing excerpts, trailing-ToC classification (`_trailing_toc`: short link lines dominate, no paragraph-length blocks), and the unreadable fraction. It is ADVISORY by contract (problem always False; ADVISORY on a trailing ToC or unreadable fraction >= 10%), never moves the exit code, and is skipped like emptytext when the archive verdict owns the book. Since v0.38.0 the archive verdict distinguishes font obfuscation from DRM (`OBFUSCATION_ALGOS`: IDPF 2008/embedding + both Adobe URIs; readable obfuscated entries are the benign OBFUSCATED advisory, an unreadable one is CORRUPT, and only non-obfuscation algorithms give ENCRYPTED). Since v0.40.0 the vir-tui console renderer loads through the module-level `_LazyUI` proxy (a plain `import vir_tui as ui` at module level would make 3.12/3.13 installs unimportable now that the stack is marker-gated; LOAD_GLOBAL never consults module `__getattr__`, so a proxy object is the lazy shape that works).
+- `src/bindery/audit.py`: read-only body-text audits (`content`, `pagenumbers`, `emptytext`, `ocr`, `monolithic` since v0.21.0 with `--max-doc-chars N`, and `completeness` since v0.36.0) behind the `audit` subcommand (v0.15.0). Since v0.18.0 library mode resolves EPUB paths through `cquarry.get_format_path()` and can apply a tag to flagged books via `cquarry.write.WritableCalibreDB` (only with explicit `--tag`; the only sanctioned write path). Since v0.19.0 `audit --id BOOK_ID` audits a single library book through cquarry's single-entity `get_book()` fetch (no library-wide cache; supports `--tag`; incompatible with the directory argument; comma lists since v0.23.0). Since v0.22.0 every archive entry is fully read (CRC + decompression) before analysis (a damaged entry reports its own CORRUPT verdict instead of feeding emptytext) and manifest/NCX references to absent files classify as `convention` (bloated ToC, consecutive span) or `fragment` (broken span). Hazard: the scan loop reuses `tag` as its per-book display column, so the `--tag` argument is captured as `audit_tag` at function entry; do not collapse them again. Since v0.29.0 `audit --json FILE` writes per-file analyzer verdicts in the `library --json` shape (directory, library, and single-book modes; with `--id`, exactly one id; emptytext omitted from a record when the archive verdict owns the body-text story). Since v0.36.0 the completeness analyzer (Phase 15) reports the phase-1 spot-check per book: spine/prose-doc counts (prose = >= 400 visible chars), first/middle/last prose-doc opening/closing excerpts, trailing-ToC classification (`_trailing_toc`: short link lines dominate, no paragraph-length blocks), and the unreadable fraction. It is ADVISORY by contract (problem always False; ADVISORY on a trailing ToC or unreadable fraction >= 10%), never moves the exit code, and is skipped like emptytext when the archive verdict owns the book. Since v0.38.0 the archive verdict distinguishes font obfuscation from DRM (`OBFUSCATION_ALGOS`: IDPF 2008/embedding + both Adobe URIs; readable obfuscated entries are the benign OBFUSCATED advisory, an unreadable one is CORRUPT, and only non-obfuscation algorithms give ENCRYPTED). Since v0.43.0 untrusted metadata XML is parsed through `_safe_xml_parse` (DOCTYPE/ENTITY declarations refused before xml.etree sees them; the stdlib shape of defusedxml's entity protection) and single entries above `_MAX_ENTRY_BYTES` (32 MB) are refused before decompression; a refused metadata file returns the shell book. Since v0.40.0 the vir-tui console renderer loads through the module-level `_LazyUI` proxy (a plain `import vir_tui as ui` at module level would make 3.12/3.13 installs unimportable now that the stack is marker-gated; LOAD_GLOBAL never consults module `__getattr__`, so a proxy object is the lazy shape that works).
 - `src/bindery/epub.py`: archive rewrite, NCX uid sync, RepairReport, mismatch detection, and the opt-in structural-repair plumbing (including the CSS precondition scan). Since v0.38.0/v0.39.0 (Phase 16): `generate_container` + the `--fix-container` gateway (insert after mimetype when missing, replace in-loop when stale; constant-epoch timestamp keeps bytes deterministic), `prune_dangling_edges` (prune_missing_manifest_items returns the pruned ids and the edges that pointed at them (spine@toc, media-overlay, fallback, EPUB2 cover meta) are rewritten so pruning cannot manufacture the regression the gate rejects), and `fix_manifest_media_types` (extension map + magic-byte confirmation via a `peek` callable over the open source zip; jpg/png/gif only), and `fix_cover_meta` (the ruling's deterministic half: dangling EPUB2 cover meta re-pointed from the guide's cover reference when exactly one manifest item carries that file, removed otherwise; accepted under no_worse like the lossy strips because cover wiring is invisible to epubcheck).
 - `src/bindery/validate.py`: epubcheck wrapper, the `gate` (improvement) and `no_worse` (no-regression, for the lossy strips) acceptance bars.
 - `src/bindery/library.py`: Calibre walk, atomic replace, backups, and native format installation. Since v0.19.0 `CalibreIdResolver` resolves the book id from `metadata.db` through cquarry (one lazy path→id map per run; since v0.20.0 the map comes from `CalibreDB.format_path_index()`, re-normalized with `resolve().lower()` for the resolver's symlinked-directory and case-insensitive matching); the `(id)` directory-name regex is only the no-catalog fallback. Since v0.24.0 `install_format()` places the repaired file atomically and updates the `data` row through `cquarry.write.WritableCalibreDB` (since v0.31.0 via `set_format`, cquarry 1.17's sanctioned remove+add in one transaction); the external `calibredb` CLI is gone. Since v0.32.0 a guessed id drives a row update only when metadata.db corroborates it (`_verify_guess`: books row exists, file in the book's own directory, catalogued `data.name` when a row exists); anything else saves in place and leaves the catalog untouched: never reintroduce directory-name guessing as the primary source: renamed/mismatched directories would replace the wrong book. Since 2026-09-15 `make_backup` takes the opt-in `--backup-keep N` ring: at most N backup files per book, the author original `.bak` never deleted, newest content at the highest name; default remains an unbounded rotation.

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bindery-cli
-Version: 0.41.1
+Version: 0.43.0
 Summary: Audit EPUB body text and repair broken EPUBs with deterministic, epubcheck-gated fixes; atomic in-place replacement in a Calibre library.
 Project-URL: Homepage, https://github.com/VirInvictus/bindery-cli
 Project-URL: Repository, https://github.com/VirInvictus/bindery-cli

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/patchnotes.md

@@ -1,4 +1,18 @@
 # bindery-cli Patch Notes
+## v0.43.0 (2026-09-16)
+
+### The stdlib XML hardening: untrusted metadata is bounded and entity-refused, no dependency
+
+* **`--audit` and every `load_book` caller no longer decompress blind.** Two protections, both stdlib-only (the defusedxml dependency stays declined): single entries whose declared size exceeds `_MAX_ENTRY_BYTES` (32 MB) are refused before decompression -- a bomb entry in a tiny zip cannot be downloaded into memory -- and the untrusted metadata files (container.xml, OPF, encryption.xml) parse through `_safe_xml_parse`, which refuses DOCTYPE/ENTITY declarations before xml.etree sees them. A refused or unparseable metadata file returns the shell book (the archive verdict is the book's whole story), never a hang or a traceback.
+* Pinned by `tests/test_xml_hardening.py` (entity-bomb container returns the shell book; clean XML parses; the entry cap is sane). The defusedxml dependency ask is closed as declined with the stdlib shape delivered.
+
+## v0.42.0 (2026-09-16)
+
+### The matcher audit executed: every quote-aware tag matcher hardened
+The follow-up box the 0.41.1 hotfix opened is closed with a full per-matcher census, and the audit found the box's own enumeration incomplete. Six GREEDY patterns of the exponential overlap class were unhardened -- `_START_TAG_RE` (the quote-aware start-tag matcher anchoring `--strip-epub3-attrs` and `--strip-bad-attrs`, running under `repair --all` on every content doc; not even named in the box), `_COVER_META_RE`, `_GUIDE_REF_RE`, `prune_dangling_edges`' spine|item|itemref matcher, `_ITEM_TAG_RE`, and `_SPINE_ITEM_RE`. All six are possessive-bounded now: byte-identical on every successful match (the loop is always followed by a literal `>` that the `[^>]` branch cannot consume, so backtracking only ever happened on failure) and linear on failure. Five LAZY patterns of the quadratic class (`_VOID_RE`, the transforms `<img>` matcher, and epub's link/anchor/img matchers) took the disjoint catch-all `[^>"']` instead of a blind possessive swap: mutually exclusive branches cannot re-partition, so any quantifier is linear, and an unterminated quote inside a tag now fails to match instead of pairing with a distant quote and matching across markup. Every well-formed shape is byte-identical. The epub `_IMG_TAG_RE` is renamed `_PRUNE_IMG_TAG_RE` (it collided with the transforms matcher of the same name). Everything else in the package audited safe by construction: tempered-quote value matchers, two-branch quote alternations, `[^>]*` single-class prefixes (linear, not quote-aware -- accepted, documented), lazy paired-delimiter spans, and the analyzer tokenizers.
+
+Pinned by `tests/test_matcher_hardening.py` (15 tests): alarm-guarded spin shapes per greedy site (OPF flavor, the truncated-OPF prune shape), unterminated-quote skips, and well-formed byte-identity. `CLAUDE.md`'s hazard note now carries the census and the rule for new matchers. The full suite is 491 tests.
+
 ## v0.41.1 (2026-09-15)
 
 ### The 0.41.0 CPU-spin regression: possessive bounds on the quote-aware tag matchers

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/project.done

@@ -4,6 +4,13 @@ Completed: 2026-09-15 (THE FINAL BLITZ, repo agent lane)
 Range: 2b9f24e (analyzer trio) through f47fc8f (ci tag-fetch fix), on main,
 pushed; CI green throughout; v0.41.0 tagged and published to PyPI.
 
+POSTSCRIPT 2026-09-15 (same day, Brandon's regression report): v0.41.1
+hotfixed the one real defect the blitz shipped, the catastrophic-backtracking
+CPU spin in `repair --all`'s rewritten quote-aware span matcher (the Physics
+fixture; Brandon bisected and root-caused it). Fix: possessive quantifiers
+on all three rewritten tag-prefix patterns; verified on his fixture against
+the 0.40.0 output shape; the follow-up matcher-audit box is in the roadmap.
+
 ## What shipped
 
 - The analyzer-robustness trio: spineless-EPUB verdicts, per-book try

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bindery-cli"
-version = "0.41.1"
+version = "0.43.0"
 description = "Audit EPUB body text and repair broken EPUBs with deterministic, epubcheck-gated fixes; atomic in-place replacement in a Calibre library."
 readme = "README.md"
 classifiers = [

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/roadmap.md

@@ -1642,7 +1642,7 @@ four interpreter families.
       (the oldest series whose embedded interpreter CI covers; the hollow
       (2, 0, 0) is gone) and the README plugin section documents platforms
       (Linux-tested) and the verification story.
-- [ ] **Analyzer robustness on untrusted input:** spine_integrity
+- [x] **Analyzer robustness on untrusted input:** *(SHIPPED in v0.41.0 -- the analyzer-robustness trio; verified 2026-09-16 by the post-blitz audit run: per-book verdicts over truncated/renamed-zip/zero-byte fixtures with no run abort.)* ** spine_integrity
       IndexErrors on a spineless EPUB (nums[0] with an empty list) and
       the call sites sit OUTSIDE the per-book try - one malformed book
       aborts a whole run; load_book raises NameError (encrypted_names
@@ -1671,7 +1671,7 @@ four interpreter families.
       --encode-url-spaces entry renames (the reference-rewrite half
       shipped v0.28.0; the remainder is renaming archive entries whose
       filenames carry raw spaces; PKG-010, 280 books); plugin log rotation.
-- [ ] **GitHub presentation (workspace batch):** description rewrite
+- [x] **GitHub presentation (workspace batch):** *(EXECUTED and verified at the ticked box below (line ~1745) during the blitz; ticked 2026-09-16 to stop it reading as open work.)* ** description rewrite
       (leads with deterministic epubcheck-gated repair); 7 topics swapped
       (add epub3/calibre-plugin/python-cli/ebook-audit); codex page still
       says calibredb; wiki off.
@@ -1690,7 +1690,7 @@ four interpreter families.
       real 3.12/3.13 (258 tests per leg, verified locally under
       3.12.14/3.13.15). Suite 445, ruff 0.16.2 clean.
 
-- [ ] **Candidate (lossy lane): strip duplicate stub spine docs.** Opened
+- [x] **Candidate (lossy lane): strip duplicate stub spine docs.** *(SHIPPED as --strip-stub-docs (the ticked box at ~1796); verified 2026-09-16: the no_worse gate correctly refuses a fabricated regression-stub.)* ** Opened
       2026-09-13 from the phase-1 Redwall-fleet successor run: The River
       Has Roots (bookmate platform conversion) carries 14 of 37 spine
       docs that are identical stubs (the same short boilerplate body
@@ -1708,7 +1708,7 @@ four interpreter families.
       (kept in ~/Downloads pending Brandon's import-or-re-source call);
       the 2026-09-13 phase-1 JSON has the analyzer verdicts.
 
-- [ ] **`run phase3`'s aggregate before/after summary mixes a rejected
+- [x] **`run phase3`'s aggregate before/after summary mixes a rejected
       candidate's projected after-state into the totals** (observed
       2026-09-13, OMW batch): Ghost Brigades measured 0f/47e -> 1f/24e
       REGRESSION and was correctly rejected, untouched; the only applied
@@ -1841,13 +1841,18 @@ four interpreter families.
       testing_facility library (invented titles, real dry-run output);
       the current PNG shows 16 real rows. Ask asked 2026-09-15,
       unanswered; nothing touched.
-- [ ] **Stranger-facing XML hardening** (dependency-flagged): a
-      per-entry size cap in load_book (stdlib, bounds decompression)
-      plus defusedxml-style entity-expansion gating for the untrusted
-      XML (container.xml, OPF, encryption.xml, NCX). RECORDED REOPEN
-      (Brandon's ask pending; the dependency ask would violate the
-      stdlib-only rule and adds a vendored plugin dep): trigger is a
-      real 3.12/3.13 stranger audience, not a hypothetical.
+- [x] **Stranger-facing XML hardening** *(SHIPPED 2026-09-16, v0.43.0
+      -- the STDLIB half only, no dependency: `_MAX_ENTRY_BYTES` (32 MB)
+      checked before `_read`'s decompression so a bomb entry is refused,
+      and `_safe_xml_parse` refuses DOCTYPE/ENTITY declarations in the
+      untrusted metadata (container.xml, OPF, encryption.xml) before
+      xml.etree sees them; a refused or unparseable metadata file
+      returns the shell book, the archive being the book's whole story.
+      Pinned by tests/test_xml_hardening.py. The defusedxml dependency
+      itself STAYS DECLINED: the stdlib shape delivers the entity
+      protection, and the vendored-plugin cost was the box's real
+      objection. The full-parser-swap reopen remains Brandon-gated if a
+      real 3.12/3.13 stranger audience ever materializes.)*
 - [x] **vir-tui floor >=2.5.0 + lock refresh** (2026-09-14, no release cut: upstream 2.4.0/2.5.0 are additive terminal-safety and session-awareness releases; only the vir-tui resolution moved in the lock, the cquarry lag rule is untouched). *(Mention the floor bump in the next release's patchnotes.)*
 
 - [x] **REGRESSION (0.41.0) FIXED in v0.41.1: the repair --all CPU
@@ -1870,14 +1875,30 @@ four interpreter families.
       earlier transforms move where failing candidates sit; the regex
       was input-sensitive, not the flags broken. Unpin 0.40.0 once
       0.41.1 is installed.
-- [ ] **Audit the remaining quote-aware tag matchers for the same
-      overlap ambiguity** (follow-up from the 0.41.1 hotfix): _VOID_RE
-      and the OPF matchers (cover meta, guide reference,
-      spine/item/itemref) share the overlapping-alternation shape but
-      were tested against the spin shape and do not blow up (the lazy
-      loop and always-matching candidates behave differently;
-      _VOID_RE's failure mode on a quote-run with no reachable `>` is
-      quadratic at worst, and it can match surprisingly far across
-      quoted spans, pre-existing since 0.40.0). Decide per matcher:
-      possessive-bound for uniformity, or document why the shape is
-      safe there. Never a third grammar copy.
+- [x] **Audit the remaining quote-aware tag matchers for the same
+      overlap ambiguity** *(EXECUTED 2026-09-16, v0.42.0 -- the full
+      per-matcher census, one ruling each: the audit found the box's own
+      enumeration incomplete. Six GREEDY exponential-class sites were
+      unhardened, possessive-bounded now (success is byte-identical:
+      the loop is always followed by a literal `>` that `[^>]` cannot
+      consume): transforms.py `_START_TAG_RE` -- the true gap, not even
+      named in the box, running under repair --all on every content doc;
+      `_COVER_META_RE`; `_GUIDE_REF_RE`; prune_dangling_edges'
+      spine|item|itemref matcher; `_ITEM_TAG_RE`; `_SPINE_ITEM_RE`.
+      Five LAZY quadratic-class sites took the disjoint catch-all
+      `[^>"']` instead of a blind possessive swap (a lazy `*?` ->
+      `*+` is NOT byte-identical with the trailing `\s*(/?)>`
+      continuation, which peels whitespace and the self-close slash):
+      `_VOID_RE`, the transforms `<img>` matcher, and epub's
+      link/a/img matchers -- mutually exclusive branches make any
+      quantifier linear and fix the far-match wart: an unterminated
+      quote inside a tag now fails to match instead of pairing across
+      markup. The epub `_IMG_TAG_RE` renamed `_PRUNE_IMG_TAG_RE` (name
+      collision with the transforms one). Everything else audited safe
+      by construction: tempered-quote value matchers, two-branch
+      quote alternations, `[^>]*` single-class prefixes (linear,
+      not quote-aware -- accepted), lazy paired-delimiter spans, and
+      the analyzer tokenizers. Pinned by tests/test_matcher_hardening.py:
+      15 tests (spin shapes alarm-guarded per greedy site, unterminated-
+      quote skips, well-formed byte-identity, prune spin over the
+      truncated-OPF shape). Never a third grammar copy.)*

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/src/bindery/__init__.py

@@ -11,7 +11,7 @@ Calibre plugin built from this core.
 Single source of truth for the version. pyproject.toml must match VERSION below.
 """
 
-VERSION = "0.41.1"
+VERSION = "0.43.0"
 __version__ = VERSION
 
 from .epub import RepairReport, repair_epub  # noqa: E402

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/src/bindery/audit.py

@@ -226,6 +226,34 @@ class Book:
         return self._visible
 
 
+# v0.43.0 XML hardening (stdlib-only): a single EPUB component above this
+# size is refused before decompression (a real book's largest component --
+# one content doc, the OPF, the NCX -- is nowhere near it), and the
+# metadata XML parser refuses DOCTYPE/ENTITY declarations, which is
+# defusedxml's entity protection without the dependency.
+_MAX_ENTRY_BYTES = 32 * 1024 * 1024
+
+# a stand-in root for a refused metadata parse: iter() over it is empty
+_ET_EMPTY = ET.Element("empty")
+
+
+def _safe_xml_parse(blob: bytes | None):
+    """xml.etree parse for UNTRUSTED metadata files, stdlib-hardened: a
+    DOCTYPE or ENTITY declaration anywhere in the blob is refused before
+    parsing, which is defusedxml's entity protection without the
+    dependency. Returns None for a refused or unparseable blob; callers
+    treat that exactly like a missing file."""
+    if blob is None:
+        return None
+    head = blob[:4096].upper()
+    if b"<!DOCTYPE" in head or b"<!ENTITY" in head:
+        return None
+    try:
+        return ET.fromstring(blob)
+    except Exception:
+        return None
+
+
 def load_book(path: Path) -> Book:
     """Open an EPUB once: fully read EVERY archive entry (the CRC sweep the
     phase-1 skill used to do by hand), resolve spine + nav + declared
@@ -238,6 +266,7 @@ def load_book(path: Path) -> Book:
         nameset = set(names)
         corrupt: list[str] = []
         encrypted: list[str] = []
+        oversized: list[str] = []
         spine_missing = 0
         dup_entries = len(names) - len(nameset)  # zip resolves last-wins
         raw: dict[str, bytes] = {}
@@ -260,6 +289,12 @@ def load_book(path: Path) -> Book:
             if name in corrupt or name in encrypted:
                 return None
             try:
+                # v0.43.0 hardening: the declared size is checked BEFORE the
+                # read, so a bomb entry (a tiny zip that decompresses to
+                # gigabytes) is refused instead of downloaded into memory.
+                if z.getinfo(name).file_size > _MAX_ENTRY_BYTES:
+                    oversized.append(name)
+                    return None
                 blob = z.read(name)
             except Exception:
                 if name in encrypted_names:
@@ -279,7 +314,7 @@ def load_book(path: Path) -> Book:
         )
         if enc_blob:
             try:
-                for ed in ET.fromstring(enc_blob).iter():
+                for ed in (_safe_xml_parse(enc_blob) or _ET_EMPTY).iter():
                     if ed.tag.split("}")[-1] != "EncryptedData":
                         continue
                     algo = ""
@@ -324,12 +359,57 @@ def load_book(path: Path) -> Book:
                 obfuscated=obfuscated,
                 obfuscated_declared=obfuscated_declared,
             )
-        container = ET.fromstring(container_blob)
+        container = _safe_xml_parse(container_blob)
+        if container is None:
+            # A container that PARSES but was refused (DOCTYPE/ENTITY
+            # declarations: untrusted-XML policy, v0.43.0) or is otherwise
+            # unparseable gets the same shell-book outcome as an absent
+            # one -- the archive is the book's whole story.
+            obfuscated = [
+                n
+                for n in sorted(encrypted_names & obfuscated_declared)
+                if n not in corrupt and n not in encrypted
+            ]
+            return Book(
+                [],
+                None,
+                "",
+                {},
+                names,
+                corrupt,
+                0,
+                0,
+                encrypted=encrypted,
+                dup_entries=dup_entries,
+                obfuscated=obfuscated,
+                obfuscated_declared=obfuscated_declared,
+            )
         rootfile = container.find(".//c:rootfile", CONTAINER_NS)
         opf_path = rootfile.get("full-path") if rootfile is not None else None
         if not opf_path:
             raise ValueError("container.xml has no rootfile")
-        opf = ET.fromstring(_read(opf_path))
+        opf = _safe_xml_parse(_read(opf_path))
+        if opf is None:
+            # same shell-book outcome for a refused/unparseable OPF
+            obfuscated = [
+                n
+                for n in sorted(encrypted_names & obfuscated_declared)
+                if n not in corrupt and n not in encrypted
+            ]
+            return Book(
+                [],
+                None,
+                "",
+                {},
+                names,
+                corrupt,
+                0,
+                0,
+                encrypted=encrypted,
+                dup_entries=dup_entries,
+                obfuscated=obfuscated,
+                obfuscated_declared=obfuscated_declared,
+            )
         base = os.path.dirname(opf_path)
 
         manifest: dict[str, str] = {}

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/src/bindery/epub.py

@@ -316,14 +316,14 @@ _EDGE_ATTR_RES = (
     re.compile(r"""\s+fallback\s*=\s*(?:"[^"]*"|'[^']*')""", re.IGNORECASE),
 )
 _COVER_META_RE = re.compile(
-    r"""<meta\b(?=(?:[^>]*\bname=)["']cover["'])(?:(?:"[^"]*"|'[^']*'|[^>])*)>""",
+    r"""<meta\b(?=(?:[^>]*\bname=)["']cover["'])(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""",
     re.IGNORECASE,
 )
 _COVER_CONTENT_RE = re.compile(
     r"""\s+content\s*=\s*(["'])((?:(?!\1).)+)\1""", re.IGNORECASE
 )
 _GUIDE_REF_RE = re.compile(
-    r"""<reference\b(?:(?:"[^"]*"|'[^']*'|[^>])*)>""", re.IGNORECASE
+    r"""<reference\b(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""", re.IGNORECASE
 )
 
 
@@ -421,7 +421,7 @@ def prune_dangling_edges(opf_text: str, pruned_ids: set[str]) -> tuple[str, int]
         return tag
 
     out = re.sub(
-        r"""<(?:spine|item|itemref)\b(?:(?:"[^"]*"|'[^']*'|[^>])*)>""",
+        r"""<(?:spine|item|itemref)\b(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""",
         strip_attrs,
         opf_text,
         flags=re.IGNORECASE,
@@ -659,21 +659,21 @@ _DROP_HREF_ATTR_RE = re.compile(r"""\s+href\s*=\s*(?:"[^"]*"|'[^']*')""", re.IGN
 # shape as transforms._VOID_RE, so a '>' inside an attribute value cannot end
 # the tag early.
 _LINK_TAG_RE = re.compile(
-    r"""<link(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""",
+    r"""<link(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""",
     re.IGNORECASE | re.DOTALL,
 )
 _ANCHOR_TAG_RE = re.compile(
-    r"""<a(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""", re.IGNORECASE | re.DOTALL
+    r"""<a(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""", re.IGNORECASE | re.DOTALL
 )
-_IMG_TAG_RE = re.compile(
-    r"""<img(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""",
+_PRUNE_IMG_TAG_RE = re.compile(
+    r"""<img(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""",
     re.IGNORECASE | re.DOTALL,
 )
-_ITEM_TAG_RE = re.compile(r"""<item\b(?:(?:"[^"]*"|'[^']*'|[^>])*)>""", re.IGNORECASE)
+_ITEM_TAG_RE = re.compile(r"""<item\b(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""", re.IGNORECASE)
 # `<itemref` must not be swallowed by the `<item\b` matcher above (\b has no
 # boundary before the 'r'), and its own idref carries the spine order.
 _SPINE_ITEM_RE = re.compile(
-    r"""<itemref\b(?:(?:"[^"]*"|'[^']*'|[^>])*)>""", re.IGNORECASE
+    r"""<itemref\b(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""", re.IGNORECASE
 )
 # `\b` is what keeps `<item\b` from matching `<itemref`: "itemref" has a word
 # character right after "item", so there is no boundary there.
@@ -999,7 +999,7 @@ def prune_missing_images(
             counts[key] = counts.get(key, 0) + 1
             return alt if key == "missing_imgs_unwrapped" else ""
 
-        return _IMG_TAG_RE.sub(repl, part), counts
+        return _PRUNE_IMG_TAG_RE.sub(repl, part), counts
 
     total: dict[str, int] = {}
     if "<!" in text:

{bindery_cli-0.41.1 → bindery_cli-0.43.0}/src/bindery/transforms.py

@@ -32,14 +32,14 @@ XML_PREDEFINED = {"amp", "lt", "gt", "quot", "apos"}
 # quote-aware so a `>` inside an attribute value does not end the tag early. Group 3
 # captures an existing trailing slash so already-self-closed tags are left untouched.
 _VOID_RE = re.compile(
-    rf"""<({VOID})(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""",
+    rf"""<({VOID})(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""",
     re.IGNORECASE | re.DOTALL,
 )
 _VOID_END_RE = re.compile(rf"""</(?:{VOID})\s*>""", re.IGNORECASE)
 _NAMED_ENTITY_RE = re.compile(r"&([a-zA-Z][a-zA-Z0-9]*);")
 _BARE_AMP_RE = re.compile(r"&(?![a-zA-Z][a-zA-Z0-9]*;|#[0-9]+;|#[xX][0-9a-fA-F]+;)")
 # A start tag (quote-aware) and an attribute within it, for invalid-attribute stripping.
-_START_TAG_RE = re.compile(r"""<[a-zA-Z][\w:.-]*(?:"[^"]*"|'[^']*'|[^>])*>""")
+_START_TAG_RE = re.compile(r"""<[a-zA-Z][\w:.-]*(?:"[^"]*"|'[^']*'|[^>])*+>""")
 # The unquoted-value branch stops at whitespace or the end of the tag, and the `/?>`
 # lookahead is what keeps it off the tag's own self-closing slash: a plain `[^\s>]+`
 # swallowed it, so dropping the attribute in `<img 31=x/>` left `<img>` and turned a
@@ -235,7 +235,7 @@ def escape_unknown_entities(s: str) -> tuple[str, int]:
 # An <img> start tag, quote-aware like _VOID_RE; group 1 is the attribute block and
 # group 2 an existing self-closing slash, so the tag is rebuilt without reordering.
 _IMG_TAG_RE = re.compile(
-    r"""<img(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>])*?)\s*(/?)>""",
+    r"""<img(?=[\s/>])((?:"[^"]*"|'[^']*'|[^>"'])*?)\s*(/?)>""",
     re.IGNORECASE | re.DOTALL,
 )
 # Whitespace before `alt` keeps data-alt/xml:alt-style names from matching; a quoted

bindery_cli-0.43.0/tests/test_matcher_hardening.py

@@ -0,0 +1,165 @@
+"""Regression net for the 2026-09-16 per-matcher hardening (the roadmap's
+matcher-audit follow-up box, executed).
+
+The 0.41.1 hotfix made three rewritten patterns possessive; the audit that
+followed found six more greedy patterns of the same exponential class
+(the quote-aware loop whose branches overlap) and five lazy patterns of
+the quadratic class. The greedy loops are now possessive `*+` (byte-
+identical on success: the loop is always followed by a literal `>` that
+the `[^>]` branch cannot consume, so backtracking only ever happened on
+failure). The lazy loops got a disjoint branch 3 (`[^>"']`: the catch-all
+no longer eats quote characters), which makes re-partitioning impossible
+and stops an unterminated quote inside a tag from pairing with a distant
+quote and matching across markup.
+
+A1 behavioral pins (success cases unchanged) and A2 pins (unterminated-
+quote tags are now skipped rather than mis-paired) live beside the spin
+guards here. The spin guard is the same shape as the 0.41.0 test: a
+failing candidate over an apostrophe-rich run must finish, not hang."""
+
+import signal
+import time
+import unittest
+
+from bindery import epub, transforms
+from bindery.transforms import _START_TAG_RE
+
+
+def _apostrophe_run(times: int = 2000) -> str:
+    return "don't can't won't it's kind of prose, isn't it " * times
+
+
+class GreedyStartTagSpin(unittest.TestCase):
+    """_START_TAG_RE runs under repair --all on every content doc: the same
+    input class as the Physics fixture (an apostrophe-rich run with no `>`
+    after the tag opener) must fail linearly."""
+
+    def test_spin_shape_fails_fast(self):
+        doc = "<p class='broken " + _apostrophe_run() + "and still no closer in sight"
+        signal.alarm(20)
+        try:
+            t0 = time.perf_counter()
+            m = _START_TAG_RE.search(doc)
+            elapsed = time.perf_counter() - t0
+        finally:
+            signal.alarm(0)
+        self.assertIsNone(m)
+        self.assertLess(elapsed, 5.0)
+
+    def test_success_shape_is_unchanged(self):
+        text = "<p class='x' data-y=\"a>b\">body</p>"
+        m = _START_TAG_RE.search(text)
+        self.assertEqual(m.group(0), "<p class='x' data-y=\"a>b\">")
+        # the `>` inside the quoted attribute stays attribute content
+        self.assertNotIn("body", m.group(0))
+
+
+class OpfTagMatchersSpin(unittest.TestCase):
+    """The OPF matchers iterate manifest/spine/guide tags: a truncated OPF
+    that ends inside an apostrophe-rich attribute run must fail linearly."""
+
+    SPIN_PREFIX = "<item id='id1' href='text/part1.xhtml' media-type='application/xhtml+xml' extra='"
+
+    def _assert_fast_no_match(self, regex, text):
+        signal.alarm(20)
+        try:
+            t0 = time.perf_counter()
+            m = regex.search(text)
+            elapsed = time.perf_counter() - t0
+        finally:
+            signal.alarm(0)
+        self.assertIsNone(m)
+        self.assertLess(elapsed, 5.0)
+
+    def test_item_tag_spin_shape(self):
+        self._assert_fast_no_match(
+            epub._ITEM_TAG_RE, self.SPIN_PREFIX + _apostrophe_run(500)
+        )
+
+    def test_itemref_tag_spin_shape(self):
+        text = "<itemref idref='id1' extra='" + _apostrophe_run(500)
+        self._assert_fast_no_match(epub._SPINE_ITEM_RE, text)
+
+    def test_cover_meta_spin_shape(self):
+        text = '<meta name="cover" content="' + _apostrophe_run(500)
+        self._assert_fast_no_match(epub._COVER_META_RE, text)
+
+    def test_guide_reference_spin_shape(self):
+        text = "<reference type='text' title='" + _apostrophe_run(500)
+        self._assert_fast_no_match(epub._GUIDE_REF_RE, text)
+
+    def test_success_shapes_unchanged(self):
+        opf = (
+            '<package><item id="id1" href="a.xhtml" media-type="application/xhtml+xml"/>'
+            "<itemref idref='id1'/>"
+            '<meta name="cover" content="cover-image"/>'
+            "<reference type='text' title='t' href='a.xhtml'/></package>"
+        )
+        item = epub._ITEM_TAG_RE.search(opf)
+        self.assertEqual(
+            item.group(0),
+            '<item id="id1" href="a.xhtml" media-type="application/xhtml+xml"/>',
+        )
+        self.assertIsNotNone(epub._SPINE_ITEM_RE.search(opf))
+        self.assertIsNotNone(epub._COVER_META_RE.search(opf))
+        self.assertIsNotNone(epub._GUIDE_REF_RE.search(opf))
+
+    def test_prune_dangling_edges_spin_shape(self):
+        # prune_dangling_edges' inline spine|item|itemref matcher over a
+        # truncated OPF: linear failure, no hang.
+        opf = '<package><spine toc="ncx"><itemref idref=\'broken ' + _apostrophe_run(
+            500
+        )
+        signal.alarm(20)
+        try:
+            t0 = time.perf_counter()
+            epub.prune_dangling_edges(opf, {"gone"})
+            elapsed = time.perf_counter() - t0
+        finally:
+            signal.alarm(0)
+        self.assertLess(elapsed, 5.0)
+
+
+class LazyMatcherDisjointBranch(unittest.TestCase):
+    """The lazy matchers (_VOID_RE, the img/link/a tag matchers) now use a
+    disjoint branch 3 ([^>"']): an unterminated quote inside a tag can no
+    longer pair with a distant quote, so the mis-pairing match is gone.
+    Every well-formed shape is byte-identical."""
+
+    def test_void_unterminated_quote_skipped(self):
+        # OLD: this matched, pairing the quote with a distant one and
+        # mis-styling markup after the tag. NEW: no match, text untouched.
+        text = '<br x="a> and more prose follows here'
+        self.assertIsNone(transforms._VOID_RE.search(text))
+
+    def test_void_wellformed_shapes_still_match(self):
+        for tag in ("<br/>", "<br />", '<br class="x"/>', "<hr class='x' />"):
+            self.assertIsNotNone(transforms._VOID_RE.search(tag), tag)
+
+    def test_img_unterminated_quote_skipped(self):
+        text = '<img src="a> more prose'
+        self.assertIsNone(transforms._IMG_TAG_RE.search(text))
+
+    def test_img_wellformed_rebuild_identical(self):
+        tag = '<img src="pic.png" alt="a photo" />'
+        out, count = transforms.add_img_alt("<html><body>" + tag + "</body></html>")
+        self.assertEqual(count, 0)  # alt already present; tag untouched
+        self.assertIn(tag, out)
+
+    def test_prune_img_unterminated_quote_skipped(self):
+        text = '<img src="a> more prose'
+        self.assertIsNone(epub._PRUNE_IMG_TAG_RE.search(text))
+
+    def test_link_and_anchor_unterminated_quote_skipped(self):
+        self.assertIsNone(epub._LINK_TAG_RE.search('<link href="a> prose'))
+        self.assertIsNone(epub._ANCHOR_TAG_RE.search("<a href='a> prose"))
+
+    def test_link_and_anchor_wellformed_match(self):
+        self.assertIsNotNone(
+            epub._LINK_TAG_RE.search('<link href="a.css" rel="stylesheet"/>')
+        )
+        self.assertIsNotNone(epub._ANCHOR_TAG_RE.search('<a href="b.xhtml">text</a>'))
+
+
+if __name__ == "__main__":
+    unittest.main()

bindery_cli-0.43.0/tests/test_xml_hardening.py

@@ -0,0 +1,62 @@
+"""The v0.43.0 stdlib XML hardening: untrusted metadata files are parsed
+through _safe_xml_parse, which refuses DOCTYPE/ENTITY declarations (the
+stdlib equivalent of defusedxml's entity protection), and single archive
+entries above _MAX_ENTRY_BYTES are refused before decompression. A
+refused metadata file returns the shell book -- the archive is the
+book's whole story -- instead of hanging or crashing."""
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from bindery.audit import _MAX_ENTRY_BYTES, _safe_xml_parse, load_book
+
+BOMB_CONTAINER = (
+    '<?xml version="1.0"?>\n<!DOCTYPE container [<!ENTITY a "'
+    + "A" * 100000
+    + '"]>\n<container/>'
+)
+
+
+def _write_epub(path: Path, container: bytes, opf: bytes | None = None):
+    import zipfile
+
+    with zipfile.ZipFile(path, "w") as z:
+        z.writestr("mimetype", "application/epub+zip")
+        z.writestr("META-INF/container.xml", container)
+        if opf is not None:
+            z.writestr("content.opf", opf)
+
+
+class SafeXmlParseTests(unittest.TestCase):
+    def test_doctype_is_refused(self):
+        self.assertIsNone(_safe_xml_parse(BOMB_CONTAINER.encode()))
+
+    def test_entity_inline_is_refused(self):
+        self.assertIsNone(_safe_xml_parse(b"<x>&entity;</x>"))
+
+    def test_clean_xml_parses(self):
+        root = _safe_xml_parse(b"<container><rootfile/></container>")
+        self.assertIsNotNone(root)
+
+    def test_none_blob_passes_through_as_none(self):
+        self.assertIsNone(_safe_xml_parse(None))
+
+
+class EntityBombContainerTests(unittest.TestCase):
+    def test_entity_bomb_container_returns_shell_book(self):
+        with tempfile.TemporaryDirectory() as td:
+            p = Path(td) / "bomb.epub"
+            _write_epub(p, BOMB_CONTAINER.encode())
+            book = load_book(p)  # must not hang, must not raise
+            self.assertEqual(book.spine, [])
+            self.assertEqual(book.corrupt, [])
+
+    def test_max_entry_bytes_is_sane(self):
+        # a real book's largest component is nowhere near this; the cap
+        # exists to refuse bomb entries before decompression.
+        self.assertGreaterEqual(_MAX_ENTRY_BYTES, 8 * 1024 * 1024)
+
+
+if __name__ == "__main__":
+    unittest.main()