- get_yt_dlp_path() no longer implicitly executes a bare "yt-dlp" from
PATH (on Windows that lookup includes the CWD, so a planted binary
in a writable directory could be run). A system yt-dlp is used only
behind the explicit advanced.allow_system_ytdlp config opt-in, and
then always as a which()-resolved absolute path. Analysis and
download refuse to exec the not-installed sentinel.
- Analysis subprocesses now run in their own session and the whole
process group is killed on timeout, so deno grandchildren no longer
leak; partial stderr is preserved and logged, and output decoding is
pinned to utf-8 with replacement (Windows locale codecs crashed on
non-UTF8 titles).
- Flat-playlist entries are filtered for None (private/deleted first
video no longer breaks analysis).
- update_yt_dlp() normalizes the sentinel to Path, unbreaking the pip
fallback path that crashed on str.exists().
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pause only stopped the stdout reader loop; yt-dlp kept transferring at
full rate until the pipe buffer filled, consuming bandwidth while the
UI claimed the download was paused. Send SIGSTOP/SIGCONT to the whole
process group (yt-dlp and its ffmpeg children) on Unix. Windows has no
equivalent signal; the limitation is documented in the helper.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The yt-dlp stable/nightly channel switcher mutated QLabel/QRadioButton
state directly from a raw threading.Thread, which is undefined behavior
in Qt. The worker now only runs the subprocess and emits a signal; the
connected slot applies all widget updates on the GUI thread via Qt's
queued delivery.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three gaps allowed an unverified binary to reach a trusted location:
- The ffmpeg ZIP fallback logged a warning on checksum mismatch and
installed anyway (the 7z path already aborted). Abort instead.
- The yt-dlp auto-update path downloaded and renamed the binary over
the verified one with no checksum at all. Verify against the official
SHA2-256SUMS like the first-install path, and use atomic os.replace.
- The yt-dlp first install streamed the download directly to the
trusted path and only verified afterwards; a crash in between left an
unverified executable to be run on next launch. Download to .part and
os.replace only after verification.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
setx truncates values at 1024 characters, and the old code fed it the
merged process PATH (system + user), permanently duplicating every
system entry into the user hive and silently dropping anything past the
limit. Read and rewrite only the HKCU Environment Path value with
winreg, preserving REG_EXPAND_SZ, and broadcast WM_SETTINGCHANGE.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Unpacking getOpenFileName() into a variable named _ made _ local to
select_ytdlp_path(), so the i18n _() calls earlier in the function
raised UnboundLocalError before the file dialog could open, breaking
manual binary selection entirely.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
cleanup_partial_files() deleted every *.part and *.fNNN.* file in the
whole download directory, and cleanup_subtitle_files() deleted any new
.vtt/.srt under it recursively - including files belonging to other
applications (e.g. a browser's own .part downloads in ~/Downloads).
Track every destination path yt-dlp reports for this download and
restrict both cleanup passes to those files and their .part/.ytdl
siblings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Imports the full commit history of github.com/oop7/YTSage (MIT).
LICENSE keeps both copyright lines; upstream README preserved at
docs/UPSTREAM_README.md. Future syncs: git fetch upstream && git merge
upstream/main.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
