feat: adopt typed yt-dlp broker and reproducible CI

[mpiton]

Summary

• migrate host-managed downloads to the typed yt-dlp contract
• add complete WASM ABI smoke coverage and pinned reproducible CI
• use upstream Extism 1.30.0

Validation

• 79 unit tests and the WASM smoke pass
• native and WASM Clippy pass with warnings denied
• release WASM build and cargo audit pass

Linear: MAT-129, MAT-131

---

Summary by cubic

Switch downloads to the typed run_ytdlp broker and harden reproducible CI with split verify/release workflows repinned to canonical upstream SHAs, gated by tags, and restricted to the repository owner. Bumps the plugin to 1.3.0, requires Vortex host 0.2.0, and adds a release WASM ABI smoke test (addresses Linear MAT-129, MAT-131).

• New Features

  • Adopt typed run_ytdlp broker: replace run_subprocess, send only url/format/output_dir/audio_only, and parse the typed response.
  • Add tests/wasm_smoke.rs to validate exports and the broker contract end-to-end.
  • CI: split verification and release via reusable configs, repin workflows by commit to canonical upstream, pin Rust toolchain (1.95.0), and restrict release to owner tag builds.
  • Bump extism to =1.30.0.

• Migration

  • Host must expose the typed run_ytdlp function (Vortex ≥ 0.2.0) and subprocess: ["yt-dlp"] capability.
  • No user-facing changes; the plugin cannot set binaries, args, timeouts, env, or cwd.

^{Written for commit 6e5ca16. Summary will update on new commits.}

Summary by CodeRabbit

• New Features
  • Adaptive media downloads now use the host’s typed download service.
  • Download requests provide structured media details, including format, audio-only mode, and output location.
• Improvements
  • Updated compatibility requirements to Vortex 0.2.0 or later.
  • Strengthened host-controlled network access and download execution safeguards.
• Documentation
  • Clarified supported host capabilities and adaptive stream download behavior.
• Release
  • Updated the plugin version to 1.3.0.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

📝 Walkthrough

Walkthrough

The plugin version is updated to 1.3.0 and requires Vortex 0.2.0. Download execution now uses the typed run_ytdlp broker, with new request/response models, updated host wiring, release configuration, and a WASM ABI smoke test.

Changes

Typed yt-dlp broker migration

Layer / File(s)	Summary
Host contract and release setup Cargo.toml, README.md, plugin.toml, rust-toolchain.toml, .github/workflows/plugin-ci.yml	Version metadata, host requirements, typed broker capabilities, Rust tooling, pinned CI workflows, and the Extism test dependency are updated.
Typed yt-dlp request implementation src/extractor.rs, src/plugin_api.rs	Subprocess request construction is replaced with typed request serialization, run_ytdlp invocation, and typed response parsing.
Release WASM ABI validation tests/wasm_smoke.rs, src/client_id.rs	The release artifact is exercised with host stubs, exported operations are validated, broker payloads are checked, and two existing assertions are reformatted.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant WASMSmokeTest
  participant PluginAPI
  participant HostStubs
  WASMSmokeTest->>PluginAPI: invoke download_to_file
  PluginAPI->>HostStubs: run_ytdlp(request JSON)
  HostStubs-->>PluginAPI: response JSON with exit_code and stdout
  PluginAPI-->>WASMSmokeTest: downloaded path
  WASMSmokeTest->>HostStubs: inspect captured request

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly captures the main changes: migrating to the typed yt-dlp broker and tightening CI reproducibility.

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	extism@​1.30.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo im-rc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/im-rc@15.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/im-rc@15.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/libc@0.2.186 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.186. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo writeable is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/writeable@0.6.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo zerocopy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/zerocopy@0.8.54 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.54. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>