video-pipeline 1.1.0 → 1.2.0

package/.env.example

@@ -27,10 +27,10 @@ EXCEL_FILE=data/export_2026-06-10_split.xlsx
 
 # ── 输出目录（相对于项目根目录）─────────────────────────────────────────────
 # 【自由】任意合法目录名
-DOWNLOADS_DIR=downloads          # 下载的视频文件
-TRANSCODED_DIR=transcoded        # 转码后的音频文件
-REPORTS_DIR=reports              # 执行报告 JSON
-COOKIES_DIR=cookies              # 站点 cookie 文件
+DOWNLOADS_DIR=output/downloads    # 下载的视频文件
+TRANSCODED_DIR=output/transcoded  # 转码后的音频文件
+REPORTS_DIR=output/reports        # 执行报告 JSON
+COOKIES_DIR=cookies               # 站点 cookie 文件
 
 # ── 外部工具 ────────────────────────────────────────────────────────────────
 # 【自由】可改为工具的绝对路径或自定义命令名
@@ -51,6 +51,9 @@ FFPROBE=ffprobe                  # ffprobe 媒体信息
 # 远程服务模式 - whisper.cpp server (默认)
 WHISPER_BACKEND=service          # 【自由】service 或 local
 WHISPER_SERVICE=http://localhost:9588   # 【自由】服务地址
+WHISPER_TEMPERATURE=0.0           # 【自由】whisper 推理温度 (0.0~1.0, 越低越确定)
+WHISPER_TEMPERATURE_INC=0.2       # 【自由】whisper 温度增量 (fallback 时升温步长)
+WHISPER_RESPONSE_FORMAT=json      # 【自由】whisper 返回格式 (json/text/srt/vtt)
 
 # 本地模式 - openai-whisper CLI (取消下方注释并注释上方即可切换)
 # WHISPER_BACKEND=local
@@ -157,12 +160,14 @@ YOUKU_USER_AGENT=                              # 【自由】
 # ── AI 分析/关键词归纳 ─────────────────────────────────────────────────────
 # 【自由】是否启用 AI 分析环节（true/false），在 transcribe 之后执行
 AI_ENABLED=true
-# 【自由】OpenAI 兼容 API 配置
-AI_API_KEY=sk-jewvkpoAQNKAARQMYULWW1vv8x6UH4H9Qe4j10tp2AJFM3TY
-AI_BASE_URL=https://apihub.agnes-ai.com/v1
-AI_MODEL=agnes-2.0-flash
+# 【自由】OpenAI 兼容 API 配置（⚠️ 请勿提交真实 API Key 到此文件）
+AI_API_KEY=your-api-key-here
+AI_BASE_URL=https://your-api-host/v1
+AI_MODEL=your-model-name
 # 【自由】请求超时（秒），默认 300
 AI_TIMEOUT=300
+# 【自由】AI 推理温度 (0.0~2.0, 越低越确定/保守, 越高越随机/创意)
+AI_TEMPERATURE=0.3
 # 【关联】提示词模板，{content} 占位符会被识别文本替换
 # 【自由】提示词内容可随意修改，但必须保留 {content} 占位符
 AI_PROMPT_TPL=帮我归纳总结一下Keywords，尽可能全一点，这是内容：{content}

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [1.2.0] - 2026-06-11
+
+### Bug Fixes
+
+- 安全漏洞修复 + dry-run 模式完善 + 全面测试套件 (`3677b6a`)
+
+### Refactoring
+
+- 输出目录统一归入 output/ 并清理测试产物 (`f5cad03`)
+- whisper/AI 硬编码参数改为 env 可配置 (`611b079`)
+
+
 ## [1.1.0] - 2026-06-11
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "video-pipeline",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "视频下载、转码、文本识别、AI 关键词分析一体化流程 CLI 工具",
   "keywords": [
     "video",

package/process_videos.js

@@ -43,10 +43,10 @@ function envPath(key, defaultValue) {
 }
 
 let EXCEL_FILE = envPath('EXCEL_FILE', 'data/export_2026-06-10_split.xlsx');
-const DOWNLOADS_DIR = envPath('DOWNLOADS_DIR', 'downloads');
-const TRANSCODED_DIR = envPath('TRANSCODED_DIR', 'transcoded');
+const DOWNLOADS_DIR = envPath('DOWNLOADS_DIR', 'output/downloads');
+const TRANSCODED_DIR = envPath('TRANSCODED_DIR', 'output/transcoded');
 const COOKIES_DIR = envPath('COOKIES_DIR', 'cookies');
-const REPORTS_DIR = envPath('REPORTS_DIR', 'reports');
+const REPORTS_DIR = envPath('REPORTS_DIR', 'output/reports');
 
 const YTDLP = process.env.YTDLP || 'yt-dlp';
 const FFMPEG = process.env.FFMPEG || 'ffmpeg';
@@ -57,6 +57,9 @@ const WHISPER_MODEL = process.env.WHISPER_MODEL || 'base';
 const WHISPER_DEVICE = process.env.WHISPER_DEVICE || 'cpu';
 const WHISPER_LANGUAGE = process.env.WHISPER_LANGUAGE || '';
 const WHISPER_SERVICE_MODEL = process.env.WHISPER_SERVICE_MODEL || '';
+const WHISPER_TEMPERATURE = process.env.WHISPER_TEMPERATURE || '0.0';
+const WHISPER_TEMPERATURE_INC = process.env.WHISPER_TEMPERATURE_INC || '0.2';
+const WHISPER_RESPONSE_FORMAT = process.env.WHISPER_RESPONSE_FORMAT || 'json';
 let _SERVICE_MODEL_LOADED = null;
 
 const TRANSCODE_EXT = process.env.TRANSCODE_EXT || '.wav';
@@ -181,27 +184,6 @@ function timestamp() {
   return new Date().toTimeString().slice(0, 8);
 }
 
-// ============================== 锁 / 并发控制 ==============================
-let _printLock = false;
-const _printQueue = [];
-function printLock(fn) {
-  return new Promise(resolve => {
-    _printQueue.push(async () => {
-      _printLock = true;
-      try { fn(); } finally { _printLock = false; }
-      resolve();
-    });
-    if (_printQueue.length === 1) processQueue();
-  });
-}
-async function processQueue() {
-  while (_printQueue.length) {
-    await _printQueue[0]();
-    _printQueue.shift();
-  }
-}
-
-// 简化：Node.js 单线程，简单场景下不需要锁
 function lockedPrint(s) {
   console.log(s);
 }
@@ -274,7 +256,12 @@ class TaskResult {
 
 // ============================== 工具函数 ==============================
 function safeFilename(name) {
-  return String(name).replace(/[\\/:*?"<>|]/g, '_').trim();
+  let safe = String(name).replace(/[\\/:*?"<>|]/g, '_').trim();
+  // 防止路径遍历：过滤 ..
+  while (safe.includes('..')) safe = safe.replace('..', '_');
+  // 防止以 . 开头（Unix 隐藏文件）
+  safe = safe.replace(/^\.+/, '');
+  return safe || 'unknown';
 }
 
 function readExcelSheet(sheetName) {
@@ -476,7 +463,7 @@ async function resolveUrlConflict(proposedPath) {
     console.log(c('yellow', '文件名不能为空，使用默认名称'));
     return { action: 'proceed', path: proposedPath };
   }
-  const newPath = path.join(dir, `${customName}${ext}`);
+  const newPath = path.join(dir, `${safeFilename(customName)}${ext}`);
   return resolveUrlConflict(newPath);
 }
 
@@ -697,6 +684,7 @@ async function stepAnalyze(text, maxRetries, retryDelay, timeout = 300) {
   const baseUrl = (process.env.AI_BASE_URL || '').replace(/\/$/, '');
   const model = process.env.AI_MODEL || '';
   const promptTpl = process.env.AI_PROMPT_TPL || '帮我归纳总结一下Keywords，尽可能全一点，这是内容：{content}';
+  const aiTemperature = parseFloat(process.env.AI_TEMPERATURE || '0.3');
   const aiTimeout = parseInt(process.env.AI_TIMEOUT || String(timeout), 10);
 
   if (!apiKey || !baseUrl || !model) {
@@ -708,7 +696,7 @@ async function stepAnalyze(text, maxRetries, retryDelay, timeout = 300) {
   const payload = JSON.stringify({
     model,
     messages: [{ role: 'user', content: prompt }],
-    temperature: 0.3,
+    temperature: aiTemperature,
   });
 
   let lastErr = null;
@@ -850,7 +838,7 @@ async function stepDownload(row, sheetName, maxRetries, retryDelay, force, timeo
   }
 
   try {
-    const { result, retriesUsed, error } = await retryCall(doDownload, maxRetries, retryDelay, stem);
+    await retryCall(doDownload, maxRetries, retryDelay, stem);
   } catch (e) {
     logError(`[${stem}] yt-dlp download failed: ${(e.stderr || e.message).slice(-2000)}`);
     return { file: null, retries: maxRetries, error: (e.stderr || e.message).slice(0, 500) };
@@ -1051,9 +1039,9 @@ async function transcribeService(audioFile, stem, maxRetries, retryDelay, timeou
       const fileBlob = await fs.openAsBlob(audioFile);
       const form = new FormData();
       form.append('file', fileBlob, path.basename(audioFile));
-      form.append('temperature', '0.0');
-      form.append('temperature_inc', '0.2');
-      form.append('response_format', 'json');
+      form.append('temperature', WHISPER_TEMPERATURE);
+      form.append('temperature_inc', WHISPER_TEMPERATURE_INC);
+      form.append('response_format', WHISPER_RESPONSE_FORMAT);
 
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), timeout * 1000);
@@ -1146,7 +1134,6 @@ function writeAllContentsToExcel(results, keywordsDict = null) {
   }
 
   // Write content column
-  writeColumn(null, COL_CONTENT, updates); // null sheetName means iterate all sheets
   for (const [sheetName, rowsObj] of groupBySheetMap(updates)) {
     writeColumn(sheetName, COL_CONTENT, Object.entries(rowsObj));
   }
@@ -1179,20 +1166,28 @@ function groupBySheetMap(updates) {
 }
 
 // ============================== 报告 ==============================
+function computeSummary(results) {
+  let success = 0, partial = 0, failed = 0, noVideo = 0;
+  for (const r of results) {
+    if (r.overall_status === 'success') success++;
+    else if (r.overall_status === 'partial') partial++;
+    else if (r.overall_status === 'failed') failed++;
+    else if (r.overall_status === 'no_video') noVideo++;
+  }
+  return { total: results.length, success, partial, failed, no_video: noVideo };
+}
+
 function generateReport(results, config) {
   fs.mkdirSync(REPORTS_DIR, { recursive: true });
   const ts = new Date().toISOString().replace(/[-:T]/g, '').slice(0, 15).replace(/(\d{8})(\d{6})/, '$1_$2');
   const reportFile = path.join(REPORTS_DIR, `report_${ts}.json`);
 
-  const success = results.filter(r => r.overall_status === 'success').length;
-  const partial = results.filter(r => r.overall_status === 'partial').length;
-  const failed = results.filter(r => r.overall_status === 'failed').length;
-  const noVideo = results.filter(r => r.overall_status === 'no_video').length;
+  const summary = computeSummary(results);
 
   const report = {
     timestamp: new Date().toISOString(),
     config,
-    summary: { total: results.length, success, partial, failed, no_video: noVideo },
+    summary,
     items: results.map(r => r.toJSON()),
     failed_items: results.filter(r => r.overall_status === 'failed' || r.overall_status === 'partial')
       .map(r => ({
@@ -1210,15 +1205,12 @@ function generateReport(results, config) {
 }
 
 function printReportSummary(results) {
-  const success = results.filter(r => r.overall_status === 'success').length;
-  const partial = results.filter(r => r.overall_status === 'partial').length;
-  const failed = results.filter(r => r.overall_status === 'failed').length;
-  const noVid = results.filter(r => r.overall_status === 'no_video').length;
+  const { total, success, partial, failed, no_video: noVid } = computeSummary(results);
 
   console.log(`\n${'='.repeat(60)}`);
   console.log(`  执行摘要`);
   console.log(`${'='.repeat(60)}`);
-  console.log(`  总计: ${results.length}`);
+  console.log(`  总计: ${total}`);
   console.log(`  ✅ 成功: ${success}`);
   console.log(`  ⚠️ 部分成功: ${partial}`);
   console.log(`  ❌ 失败: ${failed}`);
@@ -1239,6 +1231,35 @@ function printReportSummary(results) {
   }
 }
 
+
+// ============================== 环境预检 + 用户确认 ==============================
+async function checkAndConfirmEnv(envCheck, dryRun, confirmMsg) {
+  if (envCheck.allOk) return true;
+  console.log(`\n${'='.repeat(60)}`);
+  console.log('  \u26a0\ufe0f  工具/服务预检：以下依赖不可用');
+  console.log('='.repeat(60));
+  for (const issue of envCheck.issues) console.log(`  \u2022 ${issue}`);
+  console.log('\n  涉及的步骤将失败。');
+  if (dryRun) return true;
+  try {
+    const rl = require('readline').createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise(resolve => {
+      rl.question(`\n  ${confirmMsg}(输入 yes 继续，其他任意键取消): `, ans => {
+        rl.close();
+        resolve(ans.trim().toLowerCase());
+      });
+    });
+    if (answer !== 'yes') {
+      console.log('用户取消执行（工具不可用）');
+      return false;
+    }
+    return true;
+  } catch (e) {
+    console.log('非交互环境，取消执行');
+    return false;
+  }
+}
+
 // ============================== 单任务处理 ==============================
 async function processOneTask(row, sheetName, steps, maxRetries, retryDelay, force,
   whisperAvailable, positionLabel = '', downloadTimeout = 600, transcodeTimeout = 600,
@@ -1777,30 +1798,8 @@ async function run({
 
   logInfo(`tasks: ${tasks.length}, concurrency: ${concurrency}, max retries: ${maxRetries}`);
 
-  // ── 工具/服务预检 ──
   const envCheck = await checkEnvironmentAsync(steps);
-  if (!envCheck.allOk) {
-    console.log(`\n${'='.repeat(60)}`);
-    console.log('  ⚠️  工具/服务预检：以下依赖不可用');
-    console.log('='.repeat(60));
-    for (const issue of envCheck.issues) {
-      console.log(`  • ${issue}`);
-    }
-    console.log('\n  涉及的步骤将失败。');
-    if (!dryRun) {
-      const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-      const answer = await new Promise(resolve => {
-        rl.question('\n  是否继续执行？(输入 yes 继续，其他任意键取消): ', ans => {
-          rl.close();
-          resolve(ans.trim().toLowerCase());
-        });
-      });
-      if (answer !== 'yes') {
-        logInfo('用户取消执行（工具不可用）');
-        return;
-      }
-    }
-  }
+  if (!await checkAndConfirmEnv(envCheck, dryRun, '是否继续执行？')) return;
 
   // ── 干跑模式 ──
   if (dryRun) {
@@ -2011,26 +2010,8 @@ async function runFromReport(reportPath, steps, maxRetries, retryDelay, concurre
     return;
   }
 
-  // ── 工具/服务预检 ──
   const envRfr = await checkEnvironmentAsync(steps);
-  if (!envRfr.allOk) {
-    console.log(`\n${'='.repeat(60)}`);
-    console.log('  ⚠️  工具/服务预检：以下依赖不可用');
-    console.log('='.repeat(60));
-    for (const issue of envRfr.issues) console.log(`  • ${issue}`);
-    console.log('\n  涉及的步骤将失败。');
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const answer = await new Promise(resolve => {
-      rl.question('\n  是否继续重跑？(输入 yes 继续，其他任意键取消): ', ans => {
-        rl.close();
-        resolve(ans.trim().toLowerCase());
-      });
-    });
-    if (answer !== 'yes') {
-      logInfo('用户取消重跑（工具不可用）');
-      return;
-    }
-  }
+  if (!await checkAndConfirmEnv(envRfr, dryRun, '是否继续重跑？')) return;
 
   let whisperAvailable = false;
   if (steps.includes('transcribe')) {
@@ -2192,11 +2173,19 @@ if (process.argv[1] === __filename || process.argv[1]?.endsWith('process_videos.
     console.log(`  视频ID: ${c('cyan', parsed.videoId)}`);
     console.log(`  链接: ${c('cyan', parsed.watchUrl)}`);
 
-    // 构建文件路径: downloads/<platform>/<name>.mp4
+    // dry-run 模式
+    if (opts.dryRun) {
+      console.log(c('dim', '\n── 开始执行 (dry-run) ──\n'));
+      console.log(`  将执行步骤: ${c('cyan', steps.join(' → '))}`);
+      console.log(`  输出名称: ${c('cyan', opts.name || parsed.videoId)}`);
+      process.exit(0);
+    }
+
+    // 构建文件路径: output/downloads/<platform>/<name>.mp4
     fs.mkdirSync(DOWNLOADS_DIR, { recursive: true });
     const dlDir = path.join(DOWNLOADS_DIR, parsed.platform);
     fs.mkdirSync(dlDir, { recursive: true });
-    const fileName = opts.name || parsed.videoId;
+    const fileName = safeFilename(opts.name || parsed.videoId);
     const proposedPath = path.join(dlDir, `${fileName}.mp4`);
 
     // 冲突处理（--force 时直接覆盖）
@@ -2299,9 +2288,20 @@ if (process.argv[1] === __filename || process.argv[1]?.endsWith('process_videos.
     }
     console.log(`\n  可执行步骤: ${c('green', steps.join(' → '))}`);
 
+    // dry-run 模式
+    if (opts.dryRun) {
+      console.log(c('dim', '\n── 开始执行 (dry-run) ──\n'));
+      console.log(`  [本地文件] 将执行步骤: ${c('cyan', steps.join(' → '))}`);
+      console.log(`  输入文件: ${c('cyan', inputPath)}`);
+      if (opts.name) {
+        console.log(`  输出名称: ${c('cyan', opts.name)}`);
+      }
+      process.exit(0);
+    }
+
     // 确定输出文件名
     const sheetName = 'local';
-    const baseName = opts.name || path.parse(inputPath).name;
+    const baseName = safeFilename(opts.name || path.parse(inputPath).name);
     const stem = baseName;
 
     // 检查转码输出文件是否已有冲突