security: harden command exec, IPC, deep-link, cookies, and persistence

Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.

- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
  (blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
  the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
  taskkill/schtasks by absolute System32 path; validate per-download
  outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
  ('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
  untrusted id in entryUrl; catch reserved device names with extensions in
  sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
  normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
  URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
  aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
  Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
  youtube.com feed URLs (SSRF guard); complete isValidSource validation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/buildArgs.ts

@@ -14,7 +14,8 @@ import {
   type StartDownloadOptions,
   type DownloadOptions,
   type CollectionContext,
-  type CookieBrowser
+  type CookieBrowser,
+  type CommandTemplate
 } from '@shared/ipc'
 
 // --- Quality → yt-dlp selector mapping --------------------------------------
@@ -127,6 +128,39 @@ export function parseExtraArgs(raw: string): string[] {
   return args
 }
 
+/**
+ * Resolve the extra yt-dlp args for a download, enforcing the custom-command
+ * consent gate (audit F2).
+ *
+ * Extra args are powerful enough to run arbitrary code (e.g. `--exec`), so they
+ * are honoured ONLY when custom commands are explicitly enabled in settings —
+ * the same persisted flag the Settings UI and backup-import treat as consent. A
+ * per-download override wins over the persisted default template, but NEITHER is
+ * applied while the gate is off. This keeps a compromised renderer from smuggling
+ * code-exec flags through a lone `startDownload({ extraArgs })` call: it would
+ * first have to flip the visible `customCommandEnabled` setting, leaving a trace
+ * (the same defence-in-depth posture as the main-side maxConcurrent cap).
+ *
+ *  - customCommandEnabled off               → [] (always)
+ *  - perDownloadExtraArgs defined (even '')  → those args
+ *  - else a matching defaultTemplateId       → that template's args
+ *  - else                                    → []
+ */
+export function selectExtraArgs(params: {
+  customCommandEnabled: boolean
+  perDownloadExtraArgs: string | undefined
+  defaultTemplateId: string | null
+  templates: Pick<CommandTemplate, 'id' | 'args'>[]
+}): string[] {
+  if (!params.customCommandEnabled) return []
+  if (params.perDownloadExtraArgs !== undefined) return parseExtraArgs(params.perDownloadExtraArgs)
+  if (params.defaultTemplateId) {
+    const tpl = params.templates.find((t) => t.id === params.defaultTemplateId)
+    if (tpl) return parseExtraArgs(tpl.args)
+  }
+  return []
+}
+
 // Wrap a single argv token for human-readable display only (Phase C command
 // preview) — never used to build the real argv that gets spawned.
 function quoteForDisplay(arg: string): string {
@@ -163,7 +197,9 @@ export function sanitizeDirSegment(name: string): string {
   let s = Array.from(name ?? '', (ch) => (ch.charCodeAt(0) < 0x20 ? ' ' : ch)).join('')
   s = s.replace(/[<>:"/\\|?*]/g, ' ')
   s = s.replace(/\s+/g, ' ').trim().replace(/[. ]+$/, '').replace(/^[. ]+/, '')
-  if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(s)) s = `_${s}`
+  // Reserved device names are reserved even WITH an extension ('CON.txt' is still
+  // the CON device), so match an optional trailing '.<ext>' too (audit T3).
+  if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i.test(s)) s = `_${s}`
   s = s.slice(0, 80).trim()
   return s || 'Untitled'
 }