From 15bd5be7040445e7a5f03ee3af7c1989d42ca32e Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 09:43:59 +0000 Subject: [PATCH] fix(knowledge): isolate build-yt-dlp-args tests from host cookie env Six cases omitted env, so resolveYtDlpAuthArgs fell through to process.env and a runner with VIDEO_DIGEST_YT_DLP_COOKIES_FILE exported failed the positional assertions. Pass env: {} to match the conformance suite. Co-authored-by: ksextonmelodic --- plugins/knowledge/.claude-plugin/plugin.json | 2 +- plugins/knowledge/CHANGELOG.md | 9 +++++++ .../acquisition/build-yt-dlp-args.test.js | 27 +++++++++++++++++++ 3 files changed, 37 insertions(+), 1 deletion(-) diff --git a/plugins/knowledge/.claude-plugin/plugin.json b/plugins/knowledge/.claude-plugin/plugin.json index 5f03dda0af..5ddda76423 100644 --- a/plugins/knowledge/.claude-plugin/plugin.json +++ b/plugins/knowledge/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json", "name": "knowledge", - "version": "0.13.33", + "version": "0.13.34", "description": "Ingest external knowledge into durable, synthesized artifacts. Ships a book-distillation pipeline (PDF/EPUB into concept-organized, author-attributed skill reference files), a video-digest pipeline (watch a single public video from YouTube or X, formerly Twitter: transcript, link harvest, and repo-applicability synthesis), a course-digest pipeline (extract and synthesize online video courses \u2014 Dometrain, Teachable \u2014 into repo-applicable recommendations), a docpage-digest pipeline (single online documentation page into a verified knowledge slice with dual verification \u2014 one cross-vendor verifier \u2014 and an interview handoff), and a map-corpus pipeline (multi-resource corpus into a classified link map, deterministic node manifests, gate-verified relevance inventory, and an approved queue of docpage-digest runs), plus a re-runnable setup action; a configurable library directory governs where synthesized artifacts land in the consuming repo.", "author": { "name": "Melodic Software", diff --git a/plugins/knowledge/CHANGELOG.md b/plugins/knowledge/CHANGELOG.md index c408bca137..2c14ee4529 100644 --- a/plugins/knowledge/CHANGELOG.md +++ b/plugins/knowledge/CHANGELOG.md @@ -4,6 +4,15 @@ All notable changes to the `knowledge` plugin are recorded here. The `version` i `.claude-plugin/plugin.json` is the delivery vehicle — a consumer receives a change only after that version increases. +## [0.13.34] + +### Fixed + +- **`build-yt-dlp-args` tests pass an empty `env` so host cookie settings cannot inject argv.** Six + cases omitted `env`, so `resolveYtDlpAuthArgs` fell through to `process.env`. A runner with + `VIDEO_DIGEST_YT_DLP_COOKIES_FILE` (or the legacy `YOUTUBE_` spelling) exported then failed the + positional and `not.toContain` assertions. They now match the adapter-argv conformance suite. + ## [0.13.33] ### Fixed diff --git a/plugins/knowledge/skills/video-digest/extraction/acquisition/build-yt-dlp-args.test.js b/plugins/knowledge/skills/video-digest/extraction/acquisition/build-yt-dlp-args.test.js index b4baa0eb19..2b71e850c1 100644 --- a/plugins/knowledge/skills/video-digest/extraction/acquisition/build-yt-dlp-args.test.js +++ b/plugins/knowledge/skills/video-digest/extraction/acquisition/build-yt-dlp-args.test.js @@ -22,6 +22,7 @@ describe("buildYtDlpArgs", () => { mode: "full", outputTemplate: OUTPUT, workDir: WORK_DIR, + env: {}, source: adapterSourceDeclarations(youtubeAdapter), }); @@ -52,6 +53,7 @@ describe("buildYtDlpArgs", () => { mode: "full", outputTemplate: OUTPUT, workDir: WORK_DIR, + env: {}, }); expect(args).toContain("--write-info-json"); @@ -64,6 +66,7 @@ describe("buildYtDlpArgs", () => { mode: "full", outputTemplate: OUTPUT, workDir: WORK_DIR, + env: {}, }); expect(args).toContain("--no-playlist"); }); @@ -73,6 +76,7 @@ describe("buildYtDlpArgs", () => { mode: "video-only", outputTemplate: OUTPUT, workDir: WORK_DIR, + env: {}, }); expect(args).not.toContain("--write-subs"); @@ -87,6 +91,7 @@ describe("buildYtDlpArgs", () => { mode: "transcript", outputTemplate: OUTPUT, workDir: WORK_DIR, + env: {}, }); expect(args).toContain("--skip-download"); @@ -99,12 +104,34 @@ describe("buildYtDlpArgs", () => { mode: "transcript", outputTemplate: OUTPUT, workDir: WORK_DIR, + env: {}, }); expect(args).toContain("--paths"); expect(args[args.indexOf("--paths") + 1]).toBe(`temp:${WORK_DIR}`); }); + it("does not leak process.env cookie settings into isolated argv", () => { + const previous = process.env.VIDEO_DIGEST_YT_DLP_COOKIES_FILE; + process.env.VIDEO_DIGEST_YT_DLP_COOKIES_FILE = "/tmp/should-not-appear.txt"; + try { + const args = buildYtDlpArgs(URL, { + mode: "full", + outputTemplate: OUTPUT, + workDir: WORK_DIR, + env: {}, + }); + expect(args).not.toContain("--cookies"); + expect(args).not.toContain("/tmp/should-not-appear.txt"); + } finally { + if (previous === undefined) { + delete process.env.VIDEO_DIGEST_YT_DLP_COOKIES_FILE; + } else { + process.env.VIDEO_DIGEST_YT_DLP_COOKIES_FILE = previous; + } + } + }); + it("appends default js runtime before the URL", () => { const args = buildYtDlpArgs(URL, { mode: "transcript",