opencode-skills-collection 3.1.14 → 3.1.16

package/bundled-skills/youtube-notetaker/scripts/serve.py

@@ -19,7 +19,7 @@ arbitrary and kept only so the same artifact HTML works unmodified):
   GET   /api/video-deepdives/_media/<f>   a slide image
   PATCH /api/video-deepdives/<id>         merge {fields:{...}} into frontmatter, rewrite
 """
-import argparse, json, os, sys, re, mimetypes, posixpath
+import argparse, json, os, sys, re, posixpath
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from tempfile import TemporaryDirectory
@@ -35,6 +35,13 @@ SAFE_SLUG_RE = re.compile(r"^[A-Za-z0-9_-]+$")
 SAFE_MEDIA_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
 SAFE_PATH_PART_RE = re.compile(r"^[A-Za-z0-9_.-]+$")
 SAFE_CTYPE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*(?:; charset=[A-Za-z0-9._-]+)?$")
+MEDIA_CONTENT_TYPES = {
+    ".gif": "image/gif",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".png": "image/png",
+    ".webp": "image/webp",
+}
 LOCAL_ORIGINS = {
     "http://127.0.0.1:8000": "http://127.0.0.1:8000",
     "http://localhost:8000": "http://localhost:8000",
@@ -55,46 +62,38 @@ def dump_file(meta, body):
     return out + body
 
 
-def library_path(lib, *parts):
-    root = Path(lib).resolve()
-    candidate = root
-    for part in parts:
-        value = str(part)
-        if not SAFE_PATH_PART_RE.fullmatch(value) or value in {".", ".."}:
-            return None
-        candidate = candidate / value
-    candidate = candidate.resolve()
+def listed_file(directory, filename, *, allow_directory_symlink=False):
+    if not SAFE_PATH_PART_RE.fullmatch(filename or "") or filename in {".", ".."}:
+        return None
     try:
-        candidate.relative_to(root)
-    except ValueError:
+        directory_path = Path(directory)
+        if directory_path.is_symlink() and not allow_directory_symlink:
+            return None
+        root = directory_path.resolve(strict=True)
+        for path in root.iterdir():
+            if path.name != filename:
+                continue
+            if path.is_symlink() or not path.is_file():
+                return None
+            try:
+                path.resolve(strict=True).relative_to(root)
+            except (OSError, ValueError):
+                return None
+            return path
+    except OSError:
         return None
-    return candidate
 
 
 def media_path(lib, filename):
     if not SAFE_MEDIA_RE.fullmatch(filename or ""):
         return None
-    root = Path(lib).resolve()
-    candidate = root / "_media" / filename
-    if candidate.is_symlink():
-        return None
-    path = library_path(lib, "_media", filename)
-    if not path or not path.is_file():
-        return None
-    return path
+    return listed_file(Path(lib) / "_media", filename)
 
 
 def item_path(lib, slug):
     if not SAFE_SLUG_RE.fullmatch(slug or ""):
         return None
-    root = Path(lib).resolve()
-    candidate = root / (slug + ".md")
-    if candidate.is_symlink():
-        return None
-    path = library_path(lib, slug + ".md")
-    if not path or not path.is_file():
-        return None
-    return path
+    return listed_file(lib, slug + ".md", allow_directory_symlink=True)
 
 
 def safe_content_type(ctype):
@@ -105,6 +104,10 @@ def safe_local_origin(origin):
     return LOCAL_ORIGINS.get(origin or "")
 
 
+def media_content_type(filename):
+    return MEDIA_CONTENT_TYPES.get(Path(filename).suffix.lower(), "application/octet-stream")
+
+
 def load_item(lib, slug):
     path = item_path(lib, slug)
     if not path or not path.is_file():
@@ -181,7 +184,7 @@ class Handler(BaseHTTPRequestHandler):
             fp = media_path(self.lib, fn)
             if not fp or not fp.is_file():
                 return self._send(404, {"error": "no such media"})
-            ctype = mimetypes.guess_type(str(fp))[0] or "application/octet-stream"
+            ctype = media_content_type(fn)
             return self._send(200, fp.read_bytes(), ctype)
 
         if path.startswith(API + "/"):
@@ -226,16 +229,23 @@ def self_test():
         (root / "video_1.md").write_text("---\ntitle: Demo\n---\nBody", encoding="utf-8")
         (root / "_media").mkdir()
         (root / "_media" / "video_1-slide-01.jpg").write_bytes(b"x")
+        media_target = root / "media-target"
+        media_target.mkdir()
+        (media_target / "outside.jpg").write_bytes(b"outside")
         (root / "secret.md").write_text("secret", encoding="utf-8")
         (root / "linked.md").symlink_to(root / "secret.md")
         (root / "_media" / "linked.jpg").symlink_to(root / "secret.md")
+        (root / "_media_link").symlink_to(media_target)
         assert load_item(str(root), "video_1")
         assert load_item(str(root), "linked") is None
         assert media_path(str(root), "linked.jpg") is None
+        assert listed_file(root / "_media_link", "outside.jpg") is None
         assert load_item(str(root), "../secret") is None
-        assert library_path(str(root), "_media", "../video_1.md") is None
+        assert listed_file(root / "_media", "../video_1.md") is None
         assert safe_content_type("text/html; charset=utf-8") == "text/html; charset=utf-8"
         assert safe_content_type("text/html\r\nX-Bad: 1") == "application/octet-stream"
+        assert media_content_type("video_1-slide-01.jpg") == "image/jpeg"
+        assert media_content_type("video_1-slide-01.svg") == "application/octet-stream"
         assert safe_local_origin("http://localhost:8000") == LOCAL_ORIGINS["http://localhost:8000"]
         assert safe_local_origin("http://localhost:3000") is None
         assert safe_local_origin("http://localhost:8000\r\nX-Bad: 1") is None

package/bundled-skills/youtube-notetaker/scripts/vtt_to_transcript.py

@@ -8,6 +8,20 @@ previous cue, so we keep only newly-added words per cue and emit one line per cu
 time. Strips inline <00:00:00.000> word-timing tags and HTML tags.
 """
 import sys, re, html
+from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 
 TS=re.compile(r'(\d{2}):(\d{2}):(\d{2})\.\d{3}\s*-->\s*(\d{2}):(\d{2}):(\d{2})')
 INLINE=re.compile(r'<[^>]+>')
@@ -21,7 +35,7 @@ def clean(text):
 
 def main():
     if len(sys.argv)!=3: sys.exit("usage: vtt_to_transcript.py <in.vtt> <out.txt>")
-    raw=open(sys.argv[1],encoding='utf-8',errors='replace').read().splitlines()
+    raw=safe_user_path(sys.argv[1]).open(encoding='utf-8',errors='replace').read().splitlines()
     cues=[]  # (start_label, text)
     i=0; cur=None
     while i<len(raw):
@@ -52,7 +66,7 @@ def main():
         if new:
             out.append(f"{label} {' '.join(new)}")
         seen_words=(seen_words+new)[-40:]  # bounded window
-    with open(sys.argv[2],'w',encoding='utf-8') as f:
+    with safe_user_path(sys.argv[2]).open('w',encoding='utf-8') as f:
         f.write('\n'.join(out)+'\n')
     print(f"wrote {len(out)} transcript lines -> {sys.argv[2]}")
 

package/bundled-skills/youtube-notetaker/scripts/write_library_item.py

@@ -19,6 +19,20 @@ Writes  $VIDEO_LIBRARY_DIR/<YTID>.md  (default ~/video-deepdives/<YTID>.md)
 with YAML frontmatter + transcript body. No em dashes or arrows in titles/notes.
 """
 import argparse, json, os, sys, datetime
+from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 try:
     import yaml
 except ImportError:
@@ -58,7 +72,7 @@ def main():
     body=open(a.transcript,encoding="utf-8").read().strip()
     os.makedirs(LIB,exist_ok=True)
     path=os.path.join(LIB,f"{a.id}.md")
-    with open(path,"w",encoding="utf-8") as f:
+    with safe_user_path(path).open("w",encoding="utf-8") as f:
         f.write("---\n")
         yaml.safe_dump(fm,f,sort_keys=False,allow_unicode=True,width=100)
         f.write("---\n## Transcript\n")

package/bundled-skills/youtube-transcript/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: youtube-transcript
+description: "Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output."
+category: research
+risk: safe
+source: community
+source_repo: davidondrej/skills
+source_type: community
+date_added: "2026-07-07"
+author: davidondrej
+tags: [youtube, transcripts, research]
+tools: [claude, codex]
+license: "MIT"
+license_source: "https://github.com/davidondrej/skills/blob/main/LICENSE"
+---
+
+# YouTube Transcript (via DeepAPI, yt-dlp fallback)
+
+## When to Use
+
+- Use when the user asks for a YouTube transcript, captions, subtitles, or spoken-content extraction.
+- Use when DeepAPI or a local fallback can fetch the transcript safely.
+
+Fetch a YouTube video's transcript and save a clean raw `.txt` file. Primary path is DeepAPI `POST /v1/scrape/youtube/transcript`. It runs server-side, so it avoids the local-IP bot flagging that plagues yt-dlp.
+
+## Save location
+- If the user is in a real project/working dir → save there.
+- Otherwise (no dir given, or cwd makes no sense) → save to `~/Downloads`.
+- **Always name the file `Channel_Title` with spaces replaced by `_`** (e.g. `David_Ondrej_title_of_video.txt`). If metadata is unavailable, fall back to the video ID.
+
+## Primary path — DeepAPI
+
+`DEEPAPI_API_KEY` must already be present in the environment. Do not read shell
+startup files or print secrets:
+
+```bash
+test -n "$DEEPAPI_API_KEY" || { echo "DEEPAPI_API_KEY is not set"; exit 1; }
+BASE=${DEEPAPI_API_BASE_URL:-https://deepapi.co}
+```
+
+Run the scrape (keep the Idempotency-Key; retries must reuse the SAME one):
+
+```bash
+IDK=$(uuidgen)
+curl -s --max-time 120 "$BASE/v1/scrape/youtube/transcript" \
+  -H "Authorization: Bearer $DEEPAPI_API_KEY" \
+  -H "Content-Type: application/json" \
+  -H "Idempotency-Key: $IDK" \
+  -d '{"url": "VIDEO_URL", "maxCostUsd": "0.05", "waitForFinishSecs": 60}' \
+  > /tmp/yt_transcript.json
+```
+
+- Non-English videos: add `"language": "de"` (etc.) to the body.
+- `status: running` → wait `next.afterSecs`, then `curl "$BASE$(jq -r '.next.path' /tmp/yt_transcript.json)" -H "Authorization: Bearer $KEY"` until `succeeded` or `failed`.
+
+Extract the text and save it:
+
+```bash
+jq -r '.status' /tmp/yt_transcript.json                # succeeded | running | failed
+jq -r '.output[0].text' /tmp/yt_transcript.json > "$OUT/$NAME.txt"
+jq -r '.debitMicrousd' /tmp/yt_transcript.json         # cost (50000 = $0.05)
+```
+
+`.output[0].segments` also has timed segments (`startSecs`, `durationSecs`, `text`) if the user wants timestamps. Empty `output` = video has no captions; report it, don't retry.
+
+For the `Channel_Title` filename, get metadata with a quick `yt-dlp --print "%(channel)s|%(title)s" --skip-download "URL"`; if that fails, use the video ID.
+
+## When to fall back to yt-dlp
+
+- `DEEPAPI_API_KEY` missing from the environment.
+- HTTP 402 `insufficient_credits` (tell the user to top up at deepapi.co/credits first; fall back only if they're unavailable).
+- DeepAPI request `failed` twice.
+
+Tell the user whenever you fall back — a fallback means the product missed a real use case.
+
+## Fallback path — yt-dlp (local)
+
+```bash
+OUT="$(pwd)"            # or ~/Downloads if cwd makes no sense
+META=$(yt-dlp --print "%(channel)s|%(title)s" --skip-download "URL")
+NAME=$(echo "$META" | tr '| ' '__' | tr -cd '[:alnum:]_.-')   # "Channel_Title", spaces -> _, strip unsafe chars
+yt-dlp --skip-download --write-subs --write-auto-subs \
+  --sub-langs "en.*" --sub-format json3 \
+  -o "$OUT/$NAME.%(ext)s" "URL"
+```
+
+- Fall back `channel` → `uploader` → `uploader_id` if `channel` is null.
+- `--skip-download` = captions only. `--write-subs` + `--write-auto-subs` = manual first, auto as fallback.
+- **Always use `json3`, never VTT/SRT** — auto VTT repeats every line twice (rolling captions).
+
+Flatten json3 → raw text:
+
+```bash
+python3 - "$OUT" <<'PY'
+import json, html, re, glob, sys, pathlib
+f = glob.glob(sys.argv[1] + "/*.json3")
+if not f: sys.exit("no json3 file")
+data = json.load(open(f[0], encoding="utf-8"))
+parts = ["".join(s.get("utf8","") for s in e.get("segs") or []) for e in data.get("events", [])]
+txt = re.sub(r"\s+", " ", html.unescape(" ".join(p.strip() for p in parts if p.strip()))).strip()
+out = pathlib.Path(f[0]).with_suffix(".txt")
+out.write_text(txt, encoding="utf-8"); print(out)
+PY
+```
+
+### yt-dlp failure handling
+- Non-English / unknown language: run `yt-dlp --list-subs "URL"` first, then set `--sub-langs`.
+- Newer yt-dlp may need `deno` on PATH for YouTube extraction.
+- On first failure: run `yt-dlp -U` once, retry once, then stop.
+- **429 / "Sign in to confirm you're not a bot"** = IP flagged. STOP — do NOT retry in a loop (makes it worse).
+- Never fall back to downloading audio for Whisper unless the user explicitly asks.
+
+## Output
+
+Report the saved path; print the text if short. If DeepAPI was used, also report the cost in dollars.
+
+## Limitations
+
+- Adapted from `davidondrej/skills`; verify local paths, tools, credentials, and agent features before acting.
+- For commands, remote access, scheduling, browser automation, or file-changing workflows, get explicit user approval and confirm the target environment first.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-skills-collection",
-  "version": "3.1.14",
+  "version": "3.1.16",
   "description": "OpenCode CLI plugin that automatically downloads and keeps skills up to date.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -33,6 +33,10 @@
   ],
   "author": "Davide Ladisa <info@davideladisa.it>",
   "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "dependencies": {
     "@opencode-ai/plugin": "^1.15.5",
     "strip-json-comments": "^5.0.3"