feat: adopt typed yt-dlp broker and handle adaptive audio

[mpiton]

Summary

• migrate download operations to the typed yt-dlp host contract
• route adaptive audio-only streams through host-managed extraction instead of returning raw HLS
• add complete WASM ABI smoke coverage and pinned reproducible CI
• use upstream Extism 1.30.0

Validation

• 103 unit tests and 4 WASM smokes pass
• native and WASM Clippy pass with warnings denied
• release WASM build and cargo audit pass

Linear: MAT-129, MAT-131

---

Summary by cubic

Moves Vimeo downloads to the typed run_ytdlp broker and ensures resolve_stream_url never returns HLS, routing adaptive audio/video through the host for safer, more reliable downloads. Adds release-WASM ABI smokes with extism 1.30.0, pins/repins reusable CI/release workflows, and restricts releases to the repository owner.

• New Features

  • Migrated download_to_file from run_subprocess to the typed run_ytdlp contract; no argv building in WASM. (Linear: MAT-129)
  • Audio-only: return a dedicated audio URL when available; otherwise signal AdaptiveStreamOnly so the host calls download_to_file. Added resolve_audio_only_url and tests. (Linear: MAT-131)
  • Added release-WASM ABI smoke tests; split Plugin CI into verification and release jobs; repinned canonical workflows and rust-toolchain.

• Migration

  • Requires Vortex host ≥ 0.2.0 with http_request, get_config, and the typed run_ytdlp broker enabled; plugin.toml continues to declare subprocess = ["yt-dlp"].
  • Hosts must call download_to_file when resolve_stream_url returns AdaptiveStreamOnly; HLS manifests are no longer returned.

^{Written for commit 0c00bc8. Summary will update on new commits.}

Summary by CodeRabbit

• New Features

  • Added support for Vortex 0.2’s typed media-download integration.
  • Improved audio-only stream resolution and adaptive-stream handling.
  • Updated plugin compatibility to Vortex 0.2.0 and released version 1.4.0.

• Bug Fixes

  • Improved validation of audio-only media variants and download requests.

• Tests

  • Added end-to-end WebAssembly smoke tests covering routing, metadata, media, downloads, and playlist behavior.

• Documentation

  • Updated requirements, testing instructions, and changelog details.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[coderabbitai]

📝 Walkthrough

Walkthrough

Version 1.4.0 migrates Vimeo downloads to Vortex 0.2’s typed run_ytdlp broker, adds audio-only stream resolution handling, introduces Extism-based release WASM smoke tests, and updates tooling, metadata, documentation, and CI.

Changes

Typed broker migration and release validation

Layer / File(s)	Summary
Typed yt-dlp broker contract src/yt_dlp.rs, src/error.rs	Typed download requests and responses replace subprocess arguments and process-control fields; quality and audio formats are validated and tested.
Plugin API integration and audio resolution src/lib.rs, src/plugin_api.rs	Audio-only variant selection is centralized, adaptive-only streams return an error, and downloads use the typed run_ytdlp host function.
Release WASM ABI smoke tests tests/wasm_smoke.rs, Cargo.toml	Extism loads the release WASM artifact and stubs HTTP, configuration, and yt-dlp calls while testing exported routing, metadata, media, and playlist functions.
Release metadata and CI configuration plugin.toml, rust-toolchain.toml, README.md, CHANGELOG.md, .github/workflows/plugin-ci.yml, src/url_matcher.rs	Version and host requirements are updated, WASM tooling and CI are configured, documentation and release notes describe the new broker and smoke test, and two assertions are reformatted.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Plugin
  participant VortexHost
  participant YtDlp
  Plugin->>VortexHost: Submit typed run_ytdlp download request
  VortexHost->>YtDlp: Run host-managed yt-dlp operation
  YtDlp-->>VortexHost: Return exit code and output path
  VortexHost-->>Plugin: Return typed response JSON

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: moving to the typed yt-dlp broker and handling adaptive audio streams.

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	extism@​1.30.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo im-rc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/im-rc@15.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/im-rc@15.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/libc@0.2.186 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.186. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo writeable is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/writeable@0.6.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo zerocopy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/extism@1.30.0 → cargo/zerocopy@0.8.54 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.54. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[coderabbitai]

🧹 Nitpick comments (1)

src/lib.rs (1)

433-440: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Missing success-path test for resolve_audio_only_url.

Only the "all variants filtered down to Adaptive" rejection path is tested. The success branch — returning variant.url when a real VariantKind::Audio entry survives filter_audio_only — is never exercised, so a regression in the .next() selection (e.g., wrong variant picked if multiple audio-kind entries ever exist) wouldn't be caught.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib.rs` around lines 433 - 440, Extend the tests around
resolve_audio_only_url with a success-path case containing at least one real
VariantKind::Audio entry that survives filter_audio_only, and assert the
function returns that variant’s URL. Include multiple audio candidates if
supported by the existing fixtures to verify the intended .next() selection
while preserving the existing AdaptiveStreamOnly rejection test.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib.rs`:
- Around line 433-440: Extend the tests around resolve_audio_only_url with a
success-path case containing at least one real VariantKind::Audio entry that
survives filter_audio_only, and assert the function returns that variant’s URL.
Include multiple audio candidates if supported by the existing fixtures to
verify the intended .next() selection while preserving the existing
AdaptiveStreamOnly rejection test.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b387f639-9329-4e96-aa20-a1a77aacb42d

📥 Commits

Reviewing files that changed from the base of the PR and between 2c1b12c and 6a0643f.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (12)

• .github/workflows/plugin-ci.yml
• CHANGELOG.md
• Cargo.toml
• README.md
• plugin.toml
• rust-toolchain.toml
• src/error.rs
• src/lib.rs
• src/plugin_api.rs
• src/url_matcher.rs
• src/yt_dlp.rs
• tests/wasm_smoke.rs

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>