Add Seal-parity download options + playlist support (Phase A)

Phase A of the Seal feature-parity roadmap: configurable post-processing via a
shared DownloadOptions model (src/shared/ipc.ts), editable as persisted defaults
in Settings and overridable per-download in the download bar.

- audio formats (mp3/m4a/opus/flac/wav/aac), video container (mp4/mkv/webm),
  preferred-codec sort (-S vcodec)
- subtitles (download/embed/langs/auto), SponsorBlock (remove/mark + categories
  + force-keyframes-at-cuts), embed chapters/metadata/thumbnail, square-crop
  audio artwork
- playlist downloads: probe via `-J --flat-playlist`, inline selection UI
  (checkbox list, select-all/none, live count); each entry enqueued as its own
  single-video download, reusing the existing queue/concurrency/history
- reusable DownloadOptionsForm shared by Settings and the download bar so the
  defaults and per-download override never drift
- ROADMAP.md tracking full Seal parity (phases A-E)

Also includes in-tree security hardening that landed alongside: preload sandbox
(CJS preload output), http(s)-only window-open + blocked renderer navigation,
argv-injection guard for URLs (src/main/url.ts), extension-allowlisted file
open/reveal (src/main/reveal.ts), yt-dlp version-check timeout, and a minimal
window.electron presence marker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/probe.ts

@@ -2,7 +2,15 @@ import { execFile } from 'child_process'
 import { existsSync } from 'fs'
 import { getYtdlpPath } from './binaries'
 import { fmtBytes } from './download'
-import { BEST_FORMAT_ID, type ProbeResult, type MediaInfo, type FormatOption } from '@shared/ipc'
+import { assertHttpUrl } from './url'
+import {
+  BEST_FORMAT_ID,
+  type ProbeResult,
+  type MediaInfo,
+  type FormatOption,
+  type PlaylistInfo,
+  type PlaylistEntry
+} from '@shared/ipc'
 
 // The slice of `yt-dlp -J` output we actually read.
 interface RawFormat {
@@ -17,13 +25,25 @@ interface RawFormat {
   filesize_approx?: number
 }
 
+interface RawEntry {
+  id?: string
+  title?: string
+  url?: string
+  webpage_url?: string
+  duration?: number
+  uploader?: string
+  channel?: string
+}
+
 interface RawInfo {
+  _type?: string
   title?: string
   uploader?: string
   channel?: string
   duration_string?: string
   thumbnail?: string
   formats?: RawFormat[]
+  entries?: RawEntry[]
 }
 
 /** Quality proxy for picking the best format at a given height. */
@@ -71,6 +91,51 @@ function buildInfo(data: RawInfo): MediaInfo {
   }
 }
 
+/** Seconds → 'M:SS' or 'H:MM:SS'. Flat playlist entries give duration as a number. */
+function fmtDuration(sec?: number): string | undefined {
+  if (sec == null || !Number.isFinite(sec)) return undefined
+  const s = Math.max(0, Math.round(sec))
+  const h = Math.floor(s / 3600)
+  const m = Math.floor((s % 3600) / 60)
+  const r = s % 60
+  const mm = h ? String(m).padStart(2, '0') : String(m)
+  return `${h ? `${h}:` : ''}${mm}:${String(r).padStart(2, '0')}`
+}
+
+/**
+ * Resolve the URL we'll enqueue for a playlist entry. Prefer an explicit http(s)
+ * URL; fall back to a YouTube watch URL built from the id (the common case where
+ * flat entries carry only an id). Returns null when nothing usable is present.
+ */
+function entryUrl(e: RawEntry): string | null {
+  const cand = e.url || e.webpage_url
+  if (cand && /^https?:\/\//i.test(cand)) return cand
+  if (e.id) return `https://www.youtube.com/watch?v=${e.id}`
+  return null
+}
+
+function buildPlaylist(data: RawInfo): PlaylistInfo {
+  const entries: PlaylistEntry[] = []
+  ;(data.entries ?? []).forEach((e, i) => {
+    const url = entryUrl(e)
+    if (!url) return // skip entries we can't turn into a downloadable URL
+    entries.push({
+      index: i + 1,
+      id: e.id || String(i + 1),
+      title: e.title || `Item ${i + 1}`,
+      url,
+      durationLabel: fmtDuration(e.duration),
+      uploader: e.uploader || e.channel || undefined
+    })
+  })
+  return {
+    title: data.title || 'Playlist',
+    uploader: data.uploader || data.channel || undefined,
+    count: entries.length,
+    entries
+  }
+}
+
 function cleanError(stderr: string): string {
   const lines = stderr
     .split('\n')
@@ -80,7 +145,11 @@ function cleanError(stderr: string): string {
   return (errLine ?? lines[lines.length - 1] ?? '').replace(/^error:\s*/i, '').trim()
 }
 
-/** Probe a URL with `yt-dlp -J` and return metadata + available video formats. */
+/**
+ * Probe a URL with `yt-dlp -J --flat-playlist`. Resolves to a single video (with
+ * its format list) or, when the URL is a playlist, the flat list of its entries.
+ * `--flat-playlist` is a no-op for a lone video, so one call covers both cases.
+ */
 export function probeMedia(url: string): Promise<ProbeResult> {
   const ytdlp = getYtdlpPath()
   if (!existsSync(ytdlp)) {
@@ -89,19 +158,39 @@ export function probeMedia(url: string): Promise<ProbeResult> {
       error: `yt-dlp.exe not found at ${ytdlp}\nDrop it into resources/bin/ (see the README there).`
     })
   }
+  try {
+    assertHttpUrl(url)
+  } catch (e) {
+    return Promise.resolve({ ok: false, error: (e as Error).message })
+  }
 
   return new Promise((resolve) => {
     execFile(
       ytdlp,
-      ['-J', '--no-playlist', '--no-warnings', url],
-      { windowsHide: true, maxBuffer: 64 * 1024 * 1024 },
+      // `--` terminates option parsing so the URL can never be read as a flag.
+      ['-J', '--flat-playlist', '--no-warnings', '--', url],
+      { windowsHide: true, maxBuffer: 64 * 1024 * 1024, timeout: 60_000 },
       (err, stdout, stderr) => {
         if (err) {
-          resolve({ ok: false, error: cleanError(stderr) || err.message })
+          // execFile sets `killed` when it terminated the process on timeout.
+          const msg = (err as { killed?: boolean }).killed
+            ? 'Timed out fetching video info. Check the link or your connection.'
+            : cleanError(stderr) || err.message
+          resolve({ ok: false, error: msg })
           return
         }
         try {
-          resolve({ ok: true, info: buildInfo(JSON.parse(stdout) as RawInfo) })
+          const data = JSON.parse(stdout) as RawInfo
+          if (data._type === 'playlist' || Array.isArray(data.entries)) {
+            const playlist = buildPlaylist(data)
+            if (playlist.count === 0) {
+              resolve({ ok: false, error: 'This playlist has no downloadable entries.' })
+              return
+            }
+            resolve({ ok: true, kind: 'playlist', playlist })
+          } else {
+            resolve({ ok: true, kind: 'video', info: buildInfo(data) })
+          }
         } catch {
           resolve({ ok: false, error: 'Could not parse video info from yt-dlp.' })
         }