2 Commits

Author	SHA1	Message	Date
root	65fd71dc0d	fix(workers): yt-dlp argv injection — scheme check + -- separator ... The url passed to yt-dlp is user-controllable (via /api/capture). Any string starting with '-' would be parsed as a flag (e.g. --config-location=/etc/passwd). Mitigations: 1. Validate scheme is http(s) and hostname is present before subprocess. 2. Pass `--` to yt-dlp so it stops flag parsing before the positional URL. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-01 10:11:57 +10:00
root	1ba7aae439	feat(workers): ingest.video via yt-dlp + Whisper ... yt-dlp pulls metadata (title, description, uploader, thumbnail) and bestaudio (opus). faster-whisper transcribes; audio file removed after. Creates a refs row with kind='video' and source_kind='youtube' for YouTube URLs, generic 'video' otherwise. Idempotent on sha256(space_id + url) via refs.external_id. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-06-01 10:07:33 +10:00