crabidy/quality/youtube-provider.md

Quality gates: youtube-provider

Criteria beyond the automatic tests (ytdy/src/lib.rs, ytdy/src/engine.rs, plus orchestrator wiring). Each gate is pass/fail by reading the code.

Engine (subprocess discipline)

• Every invocation is an argument list (tokio::process::Command) — never a shell string; user input (terms, ids) can contain anything.
• Every call is bounded: per-call timeout (kill_on_drop so a timed out process dies), and captured stdout capped at MAX_STDOUT_BYTES.
• All failures are typed EngineErrors mapped to ProviderError at the trait boundary; no subprocess condition panics.
• Error/log output carries the binary path, exit status, and a bounded stderr summary — never full stderr, never stream URLs, never cookie file contents (the path alone is loggable).
• The cookies flag is appended to every call when configured; nothing else about login is stored or invented.

Provider semantics

• Search terms mirror tidal's: in-memory, deduplicated, implicit recreation on stale paths, rename re-searches, delete idempotent — and only /youtube/search children are creatable/editable/deletable.
• Path parsing rejects foreign roots and malformed shapes with MalformedPath; track paths are exactly <node>/<videoid>.
• Downloadability follows the central rule (queueable or lists tracks; children mirror is_queable) applied in one place, not per-arm.
• duration floats are truncated to whole seconds; missing title/uploader degrade to empty strings, never errors.
• The playlists subtree exists only when logged in: absent from the root listing and MalformedPath when addressed directly.

Orchestrator wiring

• ytdy::Client::init failure (missing/broken binary) disables the provider with a warning — the server and every other provider keep running; get_lib_root lists youtube only when enabled.
• /youtube is routed in every ProviderClient method (same completeness as /tidal), including resolve_tracks_into, create/rename/delete.
• ytdy.toml is written back after init like the other providers' configs.
• extension_for maps audio/webm → webm so captures of YouTube audio get a sensible extension.

Hygiene

• yt-dlp is declared in devenv.nix, never assumed installed.
• New public items are documented; docs state error/edge behavior.
• clippy -D warnings, fmt, taplo, markdownlint clean; all tests green; no todo!() left.
• architecture/youtube-provider.md reconciled where the implementation diverged (esp. the playlists-feed invocation after the live probe).