Sync third-party and MCP marketplace plugins

Constraint: Public skills are published only by explicit administrator action unless they are tracked third-party market sources.
Confidence: high
Scope-risk: narrow
Directive: Keep private/internal skills out of the public marketplace and preserve normal incremental market Git history.
Tested: Marketplace validation passed.

scripts/tests/test_document_portability.py

@@ -0,0 +1,77 @@
+import importlib.util
+import subprocess
+import tempfile
+import unittest
+import zipfile
+from pathlib import Path
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[2]
+COMMON = ROOT / "config/skill-overrides/common"
+
+
+def load_module(name):
+    spec = importlib.util.spec_from_file_location(name, COMMON / f"{name}.py")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class OfficePortabilityTests(unittest.TestCase):
+    def test_windows_install_path_and_arguments_with_spaces(self):
+        office = load_module("soffice")
+        with tempfile.TemporaryDirectory() as temporary:
+            program_files = Path(temporary) / "Program Files"
+            executable = program_files / "LibreOffice/program/soffice.com"
+            executable.parent.mkdir(parents=True)
+            executable.touch()
+            with patch.object(office.platform, "system", return_value="Windows"), \
+                    patch.object(office.shutil, "which", return_value=None), \
+                    patch.dict(office.os.environ, {"ProgramFiles": str(program_files)}, clear=True), \
+                    patch.object(office.subprocess, "run", return_value=subprocess.CompletedProcess([], 0)) as run:
+                office.run_soffice(["--headless", "--convert-to", "pdf", "中文 文件.docx"])
+                args, kwargs = run.call_args
+                self.assertEqual(args[0][0], str(executable))
+                self.assertEqual(args[0][-1], "中文 文件.docx")
+                self.assertTrue(args[0][1].startswith("-env:UserInstallation=file:"))
+                self.assertNotIn("LD_PRELOAD", kwargs["env"])
+
+    def test_existing_profile_is_preserved(self):
+        office = load_module("soffice")
+        with patch.object(office, "resolve_soffice_binary", return_value="soffice"), \
+                patch.object(office.subprocess, "run", return_value=subprocess.CompletedProcess([], 0)) as run:
+            office.run_soffice(["-env:UserInstallation=file:///profile", "--headless"])
+            self.assertEqual(run.call_args.args[0], ["soffice", "-env:UserInstallation=file:///profile", "--headless"])
+
+    def test_package_roundtrip_and_removed_parts(self):
+        package = load_module("office_package")
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = root / "中文 输入.docx"
+            with zipfile.ZipFile(source, "w") as archive:
+                archive.writestr("[Content_Types].xml", "<Types/>")
+                archive.writestr("word/document.xml", "<正文/>")
+                archive.writestr("word/removed.xml", "<remove/>")
+            extracted = root / "解包"
+            package.unpack(source, extracted)
+            (extracted / "word/removed.xml").unlink()
+            output = root / "中文 输出.docx"
+            package.pack(extracted, output)
+            with zipfile.ZipFile(output) as archive:
+                self.assertNotIn("word/removed.xml", archive.namelist())
+                self.assertEqual(archive.read("word/document.xml").decode(), "<正文/>")
+
+    def test_package_rejects_path_escape(self):
+        package = load_module("office_package")
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            source = root / "bad.docx"
+            with zipfile.ZipFile(source, "w") as archive:
+                archive.writestr("../escape.txt", "bad")
+            with self.assertRaisesRegex(ValueError, "Unsafe ZIP entry"):
+                package.unpack(source, root / "unpacked")
+            self.assertFalse((root / "escape.txt").exists())
+
+
+if __name__ == "__main__":
+    unittest.main()