@kaydash9999/banker-plugins 0.16.0 → 0.16.2

package/skills/3d-intro-setup/references/azure-adapter.mjs

@@ -36,8 +36,9 @@ function originOf(url) {
     const u = new URL(raw);
     return `${u.protocol}//${u.host}`;
   } catch {
-    const m = raw.match(/^(https?:\/\/[^/]+)/i);
-    return m ? m[1] : raw.replace(/\/+$/, '');
+    // Not a URL: null, never the raw text, which may be a key pasted into the endpoint field.
+    const m = raw.match(/^(https?:\/\/[^/\s]+)/i);
+    return m ? m[1] : null;
   }
 }
 
@@ -50,6 +51,10 @@ function truncate(x, n = 300) {
   return s.length > n ? `${s.slice(0, n)}…(+${s.length - n})` : s;
 }
 
+// Why an azFetch result has no HTTP answer, for error messages: " (EINSECURE)" and the like. The
+// error's code or name only, never its text: fetch can quote a header value, a key included.
+const why = (r) => (r.error ? ` (${r.error.cause?.code || r.error.code || r.error.name})` : '');
+
 // Last n chars of ffmpeg stderr (the useful part) for error messages.
 const tail = (s, n = 400) => { const str = String(s || ''); return str.length > n ? str.slice(-n) : str; };
 
@@ -77,7 +82,7 @@ export function parseConsoleSample(text) {
   const out = { endpoint: null, deployment: null, apiKey: null, apiVersion: null };
 
   // endpoint: an explicit kwarg (python/JS SDK) wins; else the origin of the first URL (curl).
-  let m = s.match(/(?:azure_endpoint|azure_openai_endpoint|base_url|endpoint)\s*[=:]\s*["']([^"']+)["']/i);
+  let m = s.match(/(?:azure_endpoint|azure_openai_endpoint|base_url|endpoint)\s*[=:]\s*["']([^"'\r\n]+)["']/i);
   if (m) out.endpoint = originOf(m[1]);
   else { m = s.match(/https?:\/\/[^\s"'`)]+/); if (m) out.endpoint = originOf(m[0]); }
 
@@ -89,13 +94,16 @@ export function parseConsoleSample(text) {
   m = s.match(/\/deployments\/([^/?"'\s]+)/i);
   if (m) out.deployment = decodeURIComponent(m[1]);
   else {
-    m = s.match(/(?:azure_deployment|deployment_name|deployment|model)\s*[=:]\s*["']([^"']+)["']/i);
+    m = s.match(/(?:azure_deployment|deployment_name|deployment|model)\s*[=:]\s*["']([^"'\r\n]+)["']/i);
     if (m) out.deployment = m[1];
   }
 
-  // key: Authorization: Bearer <k> | api-key: <k> (curl header) | api_key="<k>" (python/JS SDK).
-  m = s.match(/Authorization["']?\s*[:=]\s*["']?\s*Bearer\s+([A-Za-z0-9._-]+)/i);
-  if (!m) m = s.match(/api[-_]?key["']?\s*[:=]\s*["']?\s*([A-Za-z0-9._-]+)/i);
+  // key: Authorization: Bearer <k> | api-key: <k> (curl header) | api_key="<k>", "api-key": "<k>",
+  // apiKey: '<k>' (python/JS SDK). An SDK value counts only in quotes: api_key=subscription_key or
+  // apiKey: process.env.X names a variable, and taking that name for the key would replace a real one.
+  m = s.match(/Authorization["']?\s*[:=]\s*["']?\s*Bearer\s+([A-Za-z0-9._-]+)/i)
+    || s.match(/api-key\s*:\s*([A-Za-z0-9._-]+)/i)
+    || s.match(/api[-_]?key["']?\s*[:=]\s*["']([A-Za-z0-9._-]+)["']/i);
   if (m) out.apiKey = m[1];
 
   return out;
@@ -126,56 +134,164 @@ function envValue(raw) {
   return raw.trimEnd().replace(/\s+#.*$/, '').trim().replace(/^["']|["']$/g, '');
 }
 
+/** The home key file, `~/.config/banker/3d-intro/env`: the keys when no project key file is used. */
+export function homeCredsPath() {
+  return path.join(os.homedir(), '.config', 'banker', '3d-intro', 'env');
+}
+
+/**
+ * This machine's settings file, `~/.config/banker/3d-intro/settings.env` (FFMPEG_PATH). It holds no
+ * key, so it can exist without making the home key file look set up.
+ */
+export function homeSettingsPath() {
+  return path.join(os.homedir(), '.config', 'banker', '3d-intro', 'settings.env');
+}
+
+/** The settings file as a KEY=VALUE map; {} when it is missing or cannot be read. */
+export function readSettings() {
+  return readEnvQuietly(homeSettingsPath);
+}
+
+// A KEY=VALUE file named by fileOf(); {} when there is none or it cannot be read (no home folder, no
+// permission, a folder in its place).
+function readEnvQuietly(fileOf) {
+  try { return parseEnvFile(fs.readFileSync(fileOf(), 'utf8')); } catch { return {}; }
+}
+
+// Settings that name a program to run. Only the shell or this machine's own files set them (the
+// settings file, or the home key file from an earlier setup): a project's .env.3d-intro.local can come
+// with a repository, and must not choose what runs on this machine.
+const MACHINE_ONLY = ['FFMPEG_PATH'];
+
 /**
  * Load creds from `.env.3d-intro.local` in projectDir, else `~/.config/banker/3d-intro/env`.
- * Returns the parsed KEY=VALUE map plus `_source` (the file used, or null if none found).
+ * Returns the parsed KEY=VALUE map plus `_source` (the file used, or null if none found). From a
+ * project file, FFMPEG_PATH is left out and returned under `_ignored` so the caller can say why.
  */
 export function resolveCreds({ projectDir } = {}) {
+  const home = homeCredsPath();
   const candidates = [];
   if (projectDir) candidates.push(path.join(projectDir, '.env.3d-intro.local'));
-  candidates.push(path.join(os.homedir(), '.config', 'banker', '3d-intro', 'env'));
-  for (const p of candidates) {
-    if (fs.existsSync(p)) return { ...parseEnvFile(fs.readFileSync(p, 'utf8')), _source: p };
-  }
-  return { _source: null };
+  candidates.push(home);
+  const p = candidates.find((c) => fs.existsSync(c));
+  if (!p) return { _source: null };
+  const creds = { ...parseEnvFile(fs.readFileSync(p, 'utf8')), _source: p };
+  return p === home ? creds : withoutMachineOnly(creds);
+}
+
+function withoutMachineOnly(creds) {
+  const ignored = Object.fromEntries(MACHINE_ONLY.filter((k) => creds[k] != null).map((k) => [k, creds[k]]));
+  for (const k of MACHINE_ONLY) delete creds[k];
+  return Object.keys(ignored).length ? { ...creds, _ignored: ignored } : creds;
 }
 
 /**
  * Persist creds to a KEY=VALUE env file, chmod 0600 where supported. Keys starting with `_`
- * and null/undefined values are skipped. Returns the written path.
+ * and null/undefined values are skipped. Returns the written path. A name that is not a variable
+ * name, or a value with a line break, throws before anything is written: either would add lines of
+ * its own (a FFMPEG_PATH, a second endpoint) to the file.
  */
 export function persistCreds(creds, { target } = {}) {
   if (!target) throw new Error('persistCreds: target path required');
-  const lines = [];
-  for (const [k, v] of Object.entries(creds || {})) {
-    if (k.startsWith('_') || v == null) continue;
-    lines.push(`${k}=${envLiteral(String(v))}`);
-  }
+  const lines = Object.entries(creds || {}).filter(([k, v]) => !k.startsWith('_') && v != null).map(([k, v]) => envLine(k, String(v)));
   const body = lines.length ? `${lines.join('\n')}\n` : '';
-  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
   fs.writeFileSync(target, body, { mode: 0o600 });
   try { fs.chmodSync(target, 0o600); } catch { /* chmod unsupported (e.g. Windows) — best effort */ }
   return target;
 }
 
+// One KEY=VALUE line for persistCreds, refusing a name or value that would make lines of its own.
+function envLine(k, v) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(k)) throw new Error(`persistCreds: ${JSON.stringify(k)} is not a variable name; nothing was written`);
+  if (/[\r\n]/.test(v)) throw new Error(`persistCreds: ${k} contains a line break; nothing was written`);
+  return `${k}=${envLiteral(v)}`;
+}
+
 // Quote a value that parseEnvFile would otherwise cut at " #", trim, or strip of its quotes.
 function envLiteral(v) {
   if (!/\s#|^["'\s]|["'\s]$/.test(v)) return v;
   return v.includes('"') ? `'${v}'` : `"${v}"`;
 }
 
-/** Redact a secret to `abcd…wxyz(len)`; short (<=8) secrets are fully masked; falsy -> "(missing)". */
+/**
+ * Redact a secret to its length only, `…(len)`: no character of it, since keys share fixed
+ * prefixes (`sk-ws-`) and a shown tail narrows them down. Falsy -> "(missing)".
+ */
 export function redact(s) {
   if (!s) return '(missing)';
-  const str = String(s);
-  if (str.length <= 8) return `…(${str.length})`;
-  return `${str.slice(0, 4)}…${str.slice(-4)}(${str.length})`;
+  return `…(${String(s).length})`;
 }
 
 // ---------------------------------------------------------------------------
 // HTTP
 // ---------------------------------------------------------------------------
 
+const REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);
+const SECRET_HEADERS = new Set(['authorization', 'api-key', 'proxy-authorization', 'cookie']);
+const MAX_HOPS = 5;
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
+const localHttp = (u) => u.protocol === 'http:' && LOOPBACK.has(u.hostname);
+const refused = (code, message) => Object.assign(new TypeError(`fetch failed: ${message}`), { cause: { code } });
+const isSecret = (name) => SECRET_HEADERS.has(name.toLowerCase());
+const withoutSecrets = (headers) => Object.fromEntries(Object.entries(headers).filter(([k]) => !isSecret(k)));
+// Every form fetch takes (an object, [name, value] pairs, Headers) as one plain object, so a key is
+// found in any of them. Pairs would otherwise read as headers named "0", "1".
+const plainHeaders = (h) => (Array.isArray(h) || h instanceof Headers ? Object.fromEntries(new Headers(h)) : { ...h });
+
+/** Whether a key may go to this URL: over https, or over http only to this machine (a local mock or proxy). */
+export const safeForKey = (u) => u.protocol === 'https:' || localHttp(u);
+
+// Where a redirect goes. The request was sent already, so a Location that is not a URL, or one that
+// leaves https, ends it with a code that does not read as "nothing sent". http stays allowed only
+// while the request is on this machine over http (a local mock); from anywhere else, an https
+// localhost included, it would reach a service here or on the network.
+function redirectTarget(location, from) {
+  let next;
+  try { next = new URL(location, from); } catch { throw refused('EBADREDIRECT', 'the redirect location is not a URL'); }
+  if (next.protocol === 'https:' || (localHttp(next) && localHttp(from))) return next;
+  throw refused('EINSECUREREDIRECT', 'a redirect away from https is not followed');
+}
+
+// The request for the next hop of a redirect. A request with a body (a prompt, a frame, a paid submit)
+// follows only a 307 or 308 within its origin, which send it again as it was. A 301, 302 or 303 would
+// make it a GET, and another origin is another server: either way the next answer does not answer this
+// request, and its 401 or 429 would read as this key's (a key retired, a submit sent again elsewhere).
+// Without a body, a 303, and a 301 or 302 after a POST, go on as a GET, as browsers do, and a hop to
+// another origin goes without the secret headers.
+function nextHop(req, status, crossOrigin) {
+  if (req.body != null && (crossOrigin || status < 307)) {
+    throw refused(crossOrigin ? 'ECROSSREDIRECT' : 'EBODYREDIRECT', 'a request with a body follows only a 307 or 308 within its origin');
+  }
+  const toGet = status === 303 || ((status === 301 || status === 302) && req.method === 'POST');
+  const next = toGet ? { ...req, method: 'GET', body: undefined } : req;
+  return crossOrigin ? { ...next, headers: withoutSecrets(next.headers) } : next;
+}
+
+/**
+ * fetch that follows redirects by hand (at most 5): a request without a body as fetch would, but to
+ * another origin without the key headers; a request with a body only by a 307 or 308 within its
+ * origin (fetch itself forwards a custom `api-key` header and re-sends the body on 307 and 308 to
+ * any origin, and turns a POST into a GET on 301 to 303). A key goes only where safeForKey allows: an http
+ * URL with one is refused before anything is sent (cause.code EINSECURE), and no redirect leaves
+ * https. Throws as fetch does on a network error.
+ */
+export async function fetchGuarded(url, init = {}) {
+  let target = new URL(String(url));
+  let req = { ...init, headers: plainHeaders(init.headers), redirect: 'manual' };
+  if (!safeForKey(target) && Object.keys(req.headers).some(isSecret)) throw refused('EINSECURE', 'a key is sent only over https');
+  for (let hop = 0; hop <= MAX_HOPS; hop++) {
+    const r = await globalThis.fetch(target.href, req);
+    const location = REDIRECT_STATUS.has(r.status) ? r.headers.get('location') : null;
+    if (!location) return r;
+    try { await r.body?.cancel(); } catch { /* the redirect body is not needed */ }
+    const next = redirectTarget(location, target);
+    req = nextHop(req, r.status, next.origin !== target.origin);
+    target = next;
+  }
+  throw refused('ETOOMANYREDIRECTS', 'too many redirects');
+}
+
 // Retry-After / retry-after-ms response header -> milliseconds (null when absent or unparsable).
 function retryAfterMsOf(headers) {
   const ms = Number(headers.get('retry-after-ms'));
@@ -202,7 +318,7 @@ export async function azFetch(url, { key, binary = false, headers = {}, method =
     if (body !== undefined) opts.body = body;
     let r;
     try {
-      r = await globalThis.fetch(url, opts);
+      r = await fetchGuarded(url, opts);
     } catch (e) {
       last = { status: 0, ok: false, ct: '', body: null, authStyle: null, error: e };
       break; // network error is not an auth problem — do not retry other styles
@@ -260,7 +376,7 @@ export async function generateImage({
     });
   }
   const b64 = r.body?.data?.[0]?.b64_json;
-  if (!(r.ok && b64)) throw new Error(`generateImage failed (${note}): HTTP ${r.status} ${truncate(r.body)}`);
+  if (!(r.ok && b64)) throw new Error(`generateImage failed (${note}): HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
   return Buffer.from(b64, 'base64');
 }
 
@@ -278,7 +394,7 @@ export async function editImage({
     key, method: 'POST', body: fd,
   });
   const b64 = r.body?.data?.[0]?.b64_json;
-  if (!(r.ok && b64)) throw new Error(`editImage failed: HTTP ${r.status} ${truncate(r.body)}`);
+  if (!(r.ok && b64)) throw new Error(`editImage failed: HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
   return Buffer.from(b64, 'base64');
 }
 
@@ -289,7 +405,7 @@ export async function generateImageFlux({ endpoint, key, prompt, width, height,
     body: JSON.stringify({ prompt, width, height }),
   });
   const b64 = r.body?.data?.[0]?.b64_json || r.body?.b64_json || r.body?.image;
-  if (!(r.ok && b64)) throw new Error(`generateImageFlux failed: HTTP ${r.status} ${truncate(r.body)}`);
+  if (!(r.ok && b64)) throw new Error(`generateImageFlux failed: HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
   return Buffer.from(b64, 'base64');
 }
 
@@ -322,7 +438,7 @@ export async function createVideo({
   const r = await azFetch(`${endpoint}/openai/v1/videos?api-version=${apiVersion}`, { key, method: 'POST', body: fd });
   if (!(r.ok && r.body?.id)) {
     // status 0 = network error; errno tells a refused connection (nothing sent) from a lost one
-    const err = new Error(`createVideo failed: HTTP ${r.status} ${truncate(r.body)}`);
+    const err = new Error(`createVideo failed: HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
     err.status = r.status;
     err.errno = r.error?.cause?.code || r.error?.code || null;
     throw err;
@@ -368,7 +484,7 @@ export async function downloadVideo({ endpoint, key, id, apiVersion = 'preview'
   const r = await azFetch(`${endpoint}/openai/v1/videos/${id}/content?api-version=${apiVersion}`, {
     key, method: 'GET', binary: true,
   });
-  if (!(r.status === 200 && r.body?.length)) throw new Error(`downloadVideo failed: HTTP ${r.status}`);
+  if (!(r.status === 200 && r.body?.length)) throw new Error(`downloadVideo failed: HTTP ${r.status}${why(r)}`);
   return r.body;
 }
 
@@ -413,7 +529,7 @@ export async function createVideoTwoImage({
     key, method: 'POST', body: fd,
   });
   const id = r.body?.id || r.body?.job_id;
-  if (!(r.ok && id)) throw new Error(`createVideoTwoImage (UNVALIDATED) failed: HTTP ${r.status} ${truncate(r.body)}`);
+  if (!(r.ok && id)) throw new Error(`createVideoTwoImage (UNVALIDATED) failed: HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
   return r.body;
 }
 
@@ -423,30 +539,43 @@ export async function createVideoTwoImage({
 
 /**
  * Locate an ffmpeg binary without ever invoking a shell:
- *   1) $FFMPEG_PATH (if it exists)
- *   2) scan $PATH entries (split on path.delimiter) for ffmpeg / ffmpeg.exe
+ *   1) $FFMPEG_PATH from the shell, else FFMPEG_PATH in the settings file, else one an earlier setup
+ *      left in the home key file; absolute paths only
+ *   2) the absolute $PATH entries (split on path.delimiter), for ffmpeg / ffmpeg.exe
  *   3) the optional ffmpeg-static package (dynamic import — may be absent)
+ * A project's .env.3d-intro.local never names the program, and "." or another relative PATH entry is
+ * skipped: either would let the files of a project, a cloned repository say, choose what runs.
  * Throws an actionable error if none is found.
  */
 export async function resolveFfmpeg() {
-  const fromEnv = process.env.FFMPEG_PATH;
-  if (fromEnv && fs.existsSync(fromEnv)) return fromEnv;
+  const found = namedFfmpeg() || ffmpegOnPath() || await staticFfmpeg();
+  if (!found) throw new Error('ffmpeg not found; run motion-graphic-setup or 3d-intro-setup');
+  return found;
+}
+
+// The ffmpeg this machine names. Absolute only: a relative value would be looked up in the current
+// folder, the project. The files are read only when the shell names nothing usable.
+function namedFfmpeg() {
+  const usable = (p) => !!p && path.isAbsolute(p) && fs.existsSync(p);
+  if (usable(process.env.FFMPEG_PATH)) return process.env.FFMPEG_PATH;
+  return [readSettings(), readEnvQuietly(homeCredsPath)].map((s) => s.FFMPEG_PATH).find(usable) || null;
+}
 
+function ffmpegOnPath() {
   const names = process.platform === 'win32' ? ['ffmpeg.exe', 'ffmpeg'] : ['ffmpeg'];
-  for (const dir of (process.env.PATH || '').split(path.delimiter).filter(Boolean)) {
-    for (const name of names) {
-      const candidate = path.join(dir, name);
-      if (fs.existsSync(candidate)) return candidate;
-    }
+  for (const dir of (process.env.PATH || '').split(path.delimiter).filter((d) => path.isAbsolute(d))) {
+    const hit = names.map((name) => path.join(dir, name)).find((c) => fs.existsSync(c));
+    if (hit) return hit;
   }
+  return null;
+}
 
+async function staticFfmpeg() {
   try {
     const mod = await import('ffmpeg-static');
     const p = mod?.default || mod;
-    if (typeof p === 'string' && fs.existsSync(p)) return p;
-  } catch { /* ffmpeg-static not installed — fall through to the error */ }
-
-  throw new Error('ffmpeg not found; run motion-graphic-setup or 3d-intro-setup');
+    return typeof p === 'string' && fs.existsSync(p) ? p : null;
+  } catch { return null; /* ffmpeg-static not installed */ }
 }
 
 // Run ffmpeg with an ARGUMENT ARRAY (never a shell string). Returns {code, stdout, stderr, args}.

package/skills/3d-intro-setup/references/video-pool.mjs

@@ -37,7 +37,7 @@ import path from 'node:path';
 import os from 'node:os';
 import crypto from 'node:crypto';
 import cp from 'node:child_process';
-import { createVideo, pollVideo, downloadVideo, resolveFfmpeg, redact } from './azure-adapter.mjs';
+import { createVideo, pollVideo, downloadVideo, resolveFfmpeg, redact, fetchGuarded, safeForKey } from './azure-adapter.mjs';
 
 export const WAN_DEFAULT_MODEL = 'wan3.0-video-prime';
 const WAN_CREATE_PATH = '/api/v1/services/aigc/video-generation/video-synthesis';
@@ -50,6 +50,8 @@ const PROBE_TASK_ID = '00000000-0000-0000-0000-000000000000';
 
 const RATE_BASE_MS = 30_000;
 const RATE_MAX_MS = 10 * 60_000;
+// A server Retry-After is held to this range: 0 would retry at once, a huge value rest a key for years.
+const RETRY_MIN_MS = 1000;
 const QUOTA_STRIKES_TO_EXHAUST = 3;
 const QUOTA_STRIKE_TTL_MS = 3_600_000;
 const TRANSIENT_BASE_MS = 15_000;
@@ -72,7 +74,9 @@ const TRANSIENT_CODES = new Set([
   'InternalError', 'InternalError.Timeout', 'ServiceUnavailable', 'ModelUnavailable', 'Throttling.ServiceOverloaded',
 ]);
 // Errors that mean the request never left this machine, so resubmitting elsewhere cannot double-bill.
-const PRE_SEND_ERRORS = new Set(['ENOTFOUND', 'EAI_AGAIN', 'ECONNREFUSED', 'EHOSTUNREACH', 'ENETUNREACH', 'UND_ERR_CONNECT_TIMEOUT', 'ERR_INVALID_URL']);
+// EINSECURE is fetchGuarded refusing a key over http before sending. Its redirect codes are not here:
+// a redirect answers a request that was sent.
+const PRE_SEND_ERRORS = new Set(['ENOTFOUND', 'EAI_AGAIN', 'ECONNREFUSED', 'EHOSTUNREACH', 'ENETUNREACH', 'UND_ERR_CONNECT_TIMEOUT', 'ERR_INVALID_URL', 'EINSECURE']);
 
 /**
  * Map a WAN failure to a pool action.
@@ -115,11 +119,13 @@ function codeKind(code) {
 
 // Endpoints are origins: a pasted console URL with a path would otherwise 404 every call. A value
 // new URL() rejects (a bare host, a value with spaces, a key pasted into the wrong field) gives
-// null. The raw value is never echoed, because it may be a key.
+// null. The raw value is never echoed, because it may be a key. The key goes only over https: an
+// http:// endpoint (one typo) would send it in the clear, so it counts as malformed too, except on
+// this machine (a local mock or proxy). safeForKey is the same rule fetchGuarded enforces.
 function originOf(url) {
   try {
     const u = new URL(String(url).trim());
-    return /^https?:$/.test(u.protocol) && u.host ? `${u.protocol}//${u.host}` : null;
+    return safeForKey(u) && u.host ? `${u.protocol}//${u.host}` : null;
   } catch { return null; }
 }
 const fingerprint = (endpoint, key, model) => crypto.createHash('sha256').update(`${endpoint}\n${key}\n${model}`).digest('hex').slice(0, 16);
@@ -136,8 +142,8 @@ const malformedField = (e) => (e.badEndpoint ? 'endpoint' : e.badModel ? 'model'
 
 /**
  * Build the WAN pool from creds: every WAN_<n>_ENDPOINT with a matching WAN_<n>_API_KEY, by n.
- * An entry whose endpoint is not an http(s) URL (`badEndpoint`) or whose model is not one model id
- * (`badModel`) is kept so the preflight can report it; generateClip skips it.
+ * An entry whose endpoint is not an https URL (`badEndpoint`; http only to this machine) or whose
+ * model is not one model id (`badModel`) is kept so the preflight can report it; generateClip skips it.
  */
 export function loadWanPool(creds = {}) {
   const pool = [];
@@ -171,11 +177,20 @@ export function loadPoolState(file = defaultStatePath()) {
   return { version: 1, entries: {} };
 }
 
+// Written through a fresh random name opened exclusively ('wx'), so a link someone planted at a
+// guessable name is never followed; the folder is private when this creates it. A failed write or
+// rename removes the temp file.
 export function savePoolState(state, file = defaultStatePath()) {
-  fs.mkdirSync(path.dirname(file), { recursive: true });
-  const tmp = `${file}.${process.pid}.tmp`;
-  fs.writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
-  fs.renameSync(tmp, file);
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  const tmp = `${file}.${crypto.randomBytes(8).toString('hex')}.tmp`;
+  const fd = fs.openSync(tmp, 'wx', 0o600);
+  try {
+    try { fs.writeFileSync(fd, `${JSON.stringify(state, null, 2)}\n`); } finally { fs.closeSync(fd); }
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    fs.rmSync(tmp, { force: true });
+    throw e;
+  }
   try { fs.chmodSync(file, 0o600); } catch { /* chmod unsupported (e.g. Windows) — best effort */ }
   return file;
 }
@@ -258,9 +273,9 @@ function pickEntry(pool, state, t, limit) {
 function parseRetryAfter(h) {
   if (!h) return null;
   const sec = Number(h);
-  if (Number.isFinite(sec)) return Math.max(0, sec * 1000);
   const at = Date.parse(h);
-  return Number.isFinite(at) ? Math.max(0, at - Date.now()) : null;
+  const ms = Number.isFinite(sec) ? sec * 1000 : Number.isFinite(at) ? at - Date.now() : null;
+  return ms === null ? null : Math.min(RATE_MAX_MS, Math.max(RETRY_MIN_MS, ms));
 }
 
 const WAN_FETCH_DEFAULTS = { method: 'GET', binary: false, timeoutMs: API_TIMEOUT_MS };
@@ -269,7 +284,7 @@ async function wanFetch(url, opts = {}) {
   const o = { ...WAN_FETCH_DEFAULTS, ...defined(opts) };
   let r;
   try {
-    r = await globalThis.fetch(url, {
+    r = await fetchGuarded(url, {
       method: o.method, headers: wanHeaders(o), body: o.body === undefined ? undefined : JSON.stringify(o.body), signal: AbortSignal.timeout(o.timeoutMs),
     });
   } catch (e) {
@@ -391,7 +406,13 @@ export async function wanPollTask({ entry, taskId, intervalMs = 15_000, timeoutM
 }
 
 /** Download a finished WAN video (signed URL, no auth header). Returns an mp4 Buffer. */
+// The video URL comes from the provider's answer: only https is fetched.
+function httpsOnly(url) {
+  if (!/^https:\/\//i.test(String(url))) throw new Error('WAN video download refused: the video_url is not https');
+}
+
 export async function downloadWanVideo(url, { sleep = realSleep, tries = 3 } = {}) {
+  httpsOnly(url);
   let last;
   for (let i = 0; i < tries; i++) {
     last = await wanFetch(url, { binary: true, timeoutMs: DOWNLOAD_TIMEOUT_MS });
@@ -436,9 +457,12 @@ export class ContentRejectedError extends Error {
 
 // An error that must NOT be retried by resubmitting the leg: the task may exist and bill.
 // kind: timeout | submit_unknown | download | no_video | task_lost. Carries taskId/label when known.
-function stopError(kind, message, props = {}) {
+// A stop the caller can act on. `props` are plain properties (they show in logs); `hidden` ones (a
+// signed download URL) read as err.<name> but stay out of JSON.stringify and console.error.
+function stopError(kind, message, props = {}, hidden = {}) {
   const err = new Error(message);
   Object.assign(err, { kind, ...props });
+  for (const [k, v] of Object.entries(hidden)) Object.defineProperty(err, k, { value: v, enumerable: false });
   return err;
 }
 
@@ -530,8 +554,8 @@ async function succeededClip(ctx, e, taskId, p, seconds) {
   try {
     mp4 = await downloadWanVideo(videoUrl, { sleep: ctx.sleep });
   } catch (err) {
-    // videoUrl is a signed URL: kept as a property for recovery (valid 24 h), never in the message
-    throw stopError('download', `${err.message} for WAN task ${taskId} (${e.label}); resume with resumeClip within 24 h`, { provider: 'wan', taskId, label: e.label, videoUrl, seconds });
+    // videoUrl is a signed URL (valid 24 h): readable as err.videoUrl for recovery, never in the message or a log
+    throw stopError('download', `${err.message} for WAN task ${taskId} (${e.label}); resume with resumeClip within 24 h`, { provider: 'wan', taskId, label: e.label, seconds }, { videoUrl });
   }
   ctx.emit({ type: 'done', provider: 'wan', label: e.label, taskId });
   return { mp4, provider: 'wan', label: e.label, model: shownModel(e), seconds: seconds ?? p.usage?.duration ?? null, taskId, usage: p.usage };
@@ -563,7 +587,7 @@ async function runWan(ctx) {
 function usablePool(ctx) {
   const all = loadWanPool(ctx.creds);
   const bad = all.filter(malformedField);
-  for (const b of bad) ctx.emit({ type: 'skip', provider: 'wan', label: b.label, reason: `${malformedField(b)} is malformed (not an http(s) URL / not one model id)` });
+  for (const b of bad) ctx.emit({ type: 'skip', provider: 'wan', label: b.label, reason: `${malformedField(b)} is malformed (not an https URL / not one model id)` });
   if (all.length && bad.length === all.length) {
     throw stopError('invalid_request', `every WAN entry is malformed (${bad.map((b) => `${b.label} ${malformedField(b)}`).join(', ')}); fix the env file — nothing was sent, and Sora was not used`, { provider: 'wan' });
   }
@@ -722,7 +746,8 @@ const DEFAULTS = { size: '720x1280', seconds: 5, pollIntervalMs: 15_000, pollTim
  *
  * Throws (never resubmitting the leg) when retrying could pay twice or cannot help:
  *   ContentRejectedError                moderation — change the prompt/frame
- *   kind 'invalid_request'              malformed request, ModelNotFound or every WAN entry malformed (config)
+ *   kind 'invalid_request'              malformed request, ModelNotFound, every WAN entry malformed or a
+ *                                       Sora endpoint that is not https (config)
  *   kind 'timeout' | 'download'         the task exists — call resumeClip({ ..., provider, label, taskId })
  *   kind 'submit_unknown' | 'task_lost' | 'no_video' | 'failed'  outcome unknown — check the console
  *                                       ('failed': the task ended for a reason the pool does not know)
@@ -741,7 +766,7 @@ export async function generateClip(opts = {}) {
       const r = await runWan(ctx);
       if (r) return r;
     } else if (p === 'sora') {
-      if (!o.creds.AZURE_SORA_ENDPOINT || !o.creds.AZURE_SORA_API_KEY) { ctx.emit({ type: 'skip', provider: 'sora', reason: 'AZURE_SORA_ENDPOINT/API_KEY missing' }); continue; }
+      if (!soraReady(ctx)) continue;
       tried.push('sora');
       ctx.emit({ type: 'fallback', provider: 'sora', from: tried.slice(0, -1) });
       return runSora(ctx);
@@ -750,6 +775,18 @@ export async function generateClip(opts = {}) {
   throw new Error(`generateClip: no video provider available (tried: ${tried.join(', ') || 'none'})`);
 }
 
+// Whether Sora can take the leg. Not set up: skipped with an event. An endpoint that is set but not
+// https (http only to this machine) stops the leg before the key is sent in the clear.
+function soraReady(ctx) {
+  const { AZURE_SORA_ENDPOINT: endpoint, AZURE_SORA_API_KEY: key } = ctx.creds;
+  if (!endpoint || !key) {
+    ctx.emit({ type: 'skip', provider: 'sora', reason: 'AZURE_SORA_ENDPOINT/API_KEY missing' });
+    return false;
+  }
+  if (!originOf(endpoint)) throw stopError('invalid_request', 'AZURE_SORA_ENDPOINT is not an https URL; fix the env file — nothing was sent', { provider: 'sora' });
+  return true;
+}
+
 /**
  * Finish a clip whose task already exists (after a 'timeout' or 'download' error) without
  * submitting anything new. FREE except for the work already billed. Same return shape as
@@ -763,7 +800,7 @@ export async function resumeClip(opts = {}) {
   const ctx = makeCtx(o);
   if (o.provider !== 'sora') return resumeWan(ctx, o);
   if (!originOf(o.creds.AZURE_SORA_ENDPOINT) || !o.creds.AZURE_SORA_API_KEY) {
-    throw stopError('invalid_request', 'resumeClip: resuming a Sora job needs AZURE_SORA_ENDPOINT as an http(s) URL and AZURE_SORA_API_KEY (run 3d-intro-setup); nothing was sent', { provider: 'sora', taskId: o.taskId });
+    throw stopError('invalid_request', 'resumeClip: resuming a Sora job needs AZURE_SORA_ENDPOINT as an https URL and AZURE_SORA_API_KEY (run 3d-intro-setup); nothing was sent', { provider: 'sora', taskId: o.taskId });
   }
   return finishSoraJob(ctx, o.taskId, o.seconds == null ? null : snapSoraSeconds(o.seconds));
 }
@@ -772,7 +809,7 @@ async function resumeWan(ctx, o) {
   const e = loadWanPool(o.creds).find((x) => x.label === o.label);
   if (!e) throw new Error(`resumeClip: ${o.label} is not in the WAN pool (was the key removed?)`);
   if (e.badEndpoint) {
-    throw stopError('invalid_request', `resumeClip: ${o.label} endpoint is not an http(s) URL; fix the env file — nothing was sent`, { provider: 'wan', label: o.label, taskId: o.taskId });
+    throw stopError('invalid_request', `resumeClip: ${o.label} endpoint is not an https URL; fix the env file — nothing was sent`, { provider: 'wan', label: o.label, taskId: o.taskId });
   }
   const out = await finishWanTask(ctx, e, o.taskId, { duration: Math.round(Number(o.seconds) || 0) || null });
   if (out.clip) return out.clip;