security: harden command exec, IPC, deep-link, cookies, and persistence

Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.

- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
  (blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
  the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
  taskkill/schtasks by absolute System32 path; validate per-download
  outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
  ('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
  untrusted id in entryUrl; catch reserved device names with extensions in
  sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
  normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
  URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
  aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
  Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
  youtube.com feed URLs (SSRF guard); complete isValidSource validation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

test/buildArgs.test.ts

@@ -2,6 +2,7 @@ import { describe, it, expect } from 'vitest'
 import {
   buildArgs,
   parseExtraArgs,
+  selectExtraArgs,
   formatCommandLine,
   sanitizeDirSegment,
   collectionOutputTemplate,
@@ -328,6 +329,80 @@ describe('parseExtraArgs', () => {
   })
 })
 
+describe('selectExtraArgs — custom-command consent gate (audit F2)', () => {
+  const templates = [
+    { id: 'thumb', args: '--write-thumbnail' },
+    { id: 'danger', args: '--exec "calc.exe"' }
+  ]
+
+  it('returns [] when custom commands are disabled, even with a per-download override', () => {
+    // The core fix: a renderer-supplied extraArgs must NOT run while the gate is off.
+    expect(
+      selectExtraArgs({
+        customCommandEnabled: false,
+        perDownloadExtraArgs: '--exec "calc.exe"',
+        defaultTemplateId: 'danger',
+        templates
+      })
+    ).toEqual([])
+  })
+
+  it('returns [] when disabled even if a default template id is set', () => {
+    expect(
+      selectExtraArgs({
+        customCommandEnabled: false,
+        perDownloadExtraArgs: undefined,
+        defaultTemplateId: 'thumb',
+        templates
+      })
+    ).toEqual([])
+  })
+
+  it('parses a per-download override when enabled', () => {
+    expect(
+      selectExtraArgs({
+        customCommandEnabled: true,
+        perDownloadExtraArgs: '--write-thumbnail --no-mtime',
+        defaultTemplateId: null,
+        templates
+      })
+    ).toEqual(['--write-thumbnail', '--no-mtime'])
+  })
+
+  it('an explicit empty override yields [] even with a default template set', () => {
+    expect(
+      selectExtraArgs({
+        customCommandEnabled: true,
+        perDownloadExtraArgs: '',
+        defaultTemplateId: 'thumb',
+        templates
+      })
+    ).toEqual([])
+  })
+
+  it('falls back to the default template when no per-download override is given', () => {
+    expect(
+      selectExtraArgs({
+        customCommandEnabled: true,
+        perDownloadExtraArgs: undefined,
+        defaultTemplateId: 'thumb',
+        templates
+      })
+    ).toEqual(['--write-thumbnail'])
+  })
+
+  it('returns [] when the default template id matches nothing', () => {
+    expect(
+      selectExtraArgs({
+        customCommandEnabled: true,
+        perDownloadExtraArgs: undefined,
+        defaultTemplateId: 'missing',
+        templates
+      })
+    ).toEqual([])
+  })
+})
+
 describe('formatCommandLine', () => {
   it('joins the exe and args with spaces when nothing needs quoting', () => {
     expect(formatCommandLine('yt-dlp.exe', ['-f', 'best', '--', 'https://x.test/v'])).toBe(
@@ -410,6 +485,14 @@ describe('sanitizeDirSegment', () => {
     expect(sanitizeDirSegment('com1')).toBe('_com1')
   })
 
+  it('prefixes a reserved device name even when it carries an extension (audit T3)', () => {
+    expect(sanitizeDirSegment('CON.txt')).toBe('_CON.txt')
+    expect(sanitizeDirSegment('nul.mp4')).toBe('_nul.mp4')
+    expect(sanitizeDirSegment('LPT1.foo.bar')).toBe('_LPT1.foo.bar')
+    // a non-reserved name that merely starts with similar letters is left alone
+    expect(sanitizeDirSegment('console.log')).toBe('console.log')
+  })
+
   it('falls back to Untitled for empty / all-illegal input', () => {
     expect(sanitizeDirSegment('')).toBe('Untitled')
     expect(sanitizeDirSegment('???')).toBe('Untitled')