fix: ungate anonymous Video Pack v0 emit on paste-URL by groupthinking · Pull Request #1612 · groupthinking/EventRelay

groupthinking · 2026-09-02T22:29:05Z

#1610 was closed by #1609 (5ccbdf7) but live uvai.io still failed: anonymous POST /api/video/pack and POST /api/v1/video/pack returned 401 {"error":"Authentication required"}. Home paste+Run then showed "No transcript yet" / "source evidence could not be verified" with no pack JSON, source_url, source_hash, or cite:youtube.

CoS lock (do not skip)

Home paste is public — pack emit cannot require login.
Identity hashed Video Pack v0 must emit from paste-URL even when transcript fetch fails.
Pack JSON must include source_url + source_hash.
Fail closed on verification — not a silent empty UI.
Stay on EventRelay / uvai.io. Do not start Qwen.

Canonical issue

Closes #1611 (open). #1610 is already closed; GitHub issue create returned 403 from this agent.

Outcome

Anonymous paste-URL emits a hashed Video Pack v0 tied to the YouTube video ID without sign-in and without waiting on speech evidence. The persisted/shown pack JSON includes source_url and provenance.source_hash. Missing either field is a visible verification failure. Same URL retry reuses the same hash; a different video ID gets a different hash.

Scope

Included:
- Exact public allowlist for /api/video/pack and /api/v1/video/pack (siblings /api/video and /api/video/generate stay gated)
- Next.js alias POST /api/v1/video/pack → existing 1609 identity handler
- FastAPI API-key allowlist for /api/v1/video/pack
- verifyIdentityPack fail-closed: requires source_url (http) + 64-char source_hash
- Home shows pack JSON (source_url + source_hash) even when transcript is missing
- Tests: 401-not-required, hash stability, emit-without-transcript, fail-closed verification
Explicitly excluded:
- Qwen / Qwen3.8-27B extract
- vLLM, Origin wasm, FORGE, slingshot, reach, ClipToAction
- A second pack format

Risk

Risk level: low
Failure mode: identity pack is public (version + video_id hash only; no speech, no secrets). Over-allowlisting is prevented by exact paths. Incomplete packs throw instead of rendering empty.
Rollback: revert this PR; pack emit returns to the feat: emit hashed Video Pack v0 from paste-URL #1609 401.

Verification

Head: b333a393e

Focused tests
- cd apps/web && npx vitest run src/lib/__tests__/auth-paths.test.ts src/lib/__tests__/video-pack.test.ts src/lib/__tests__/emit-video-pack.test.ts src/lib/__tests__/studio-pipeline-status.test.ts src/app/api/video/pack src/app/api/v1/video/pack src/store/__tests__/dashboard-store.test.ts → 76 passed
- PYTHONPATH=src pytest tests/unit/test_api_key_auth.py tests/unit/test_videopack_identity.py tests/unit/test_videopack_store.py -o addopts= → 23 passed
- Golden hashes unchanged: auJzb1D-fag → 2778c5fc08a1b7f19fe0a83bca959e24ecf20040c3cc1a3b6edd244d68c5e4ea; jNQXAC9IVRw → 97150a5c21eef3d12a4543ce2108ca28fd6f829db1da120d7e75655ab471f97d
Required CI
Review threads resolved

Production evidence

Reproduced on live uvai.io before this change (anonymous):

POST https://uvai.io/api/video/pack → 401 {"error":"Authentication required"}
POST https://uvai.io/api/v1/video/pack → 401 {"error":"Authentication required"}

Production will stay 401 until this branch deploys to Vercel project v0-uvai. Unit evidence is above.

Agent handoff

One canonical issue is linked (Closes #1611)
No competing PR implements the same issue
Acceptance criteria are satisfied for this slice
Required checks pass on the current head
Human decision is requested only for production deploy to uvai.io / v0-uvai

Home paste was public but POST /api/video/pack and /api/v1/video/pack were session-gated after #1609, so identity packs never emitted. Allowlist those exact paths, alias the v1 Next.js route, and show the cite/hash even when transcript fetch fails. Co-authored-by: Hayden <groupthinking@users.noreply.github.com>

vercel · 2026-09-02T22:29:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Error		Sep 2, 2026 10:32pm UTC

coderabbitai · 2026-09-02T22:29:16Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 1c07672d-c8b1-4ba5-95eb-515bdf1b09ec

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-02T22:29:17Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA b333a39.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

vercel · 2026-09-02T22:31:27Z

@@ -0,0 +1 @@
+export { POST, runtime } from '../../../video/pack/route';


Re-exporting the runtime route segment config from another module breaks the Next.js build

CoS lock: anonymous paste must emit identity Video Pack v0 even without a transcript. Verification requires source_url + source_hash; missing either is a visible failure, not an empty UI. Co-authored-by: Hayden <groupthinking@users.noreply.github.com>

linear-code · 2026-09-02T22:32:47Z

GRV-460

Copilot

🟡 Changes recommended

Public exposure currently permits unsafe backend path inputs and unbounded anonymous cache growth.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Ungates anonymous Video Pack v0 generation and preserves its citation when transcript extraction fails.

Changes:

Publicly allowlists exact Next.js pack routes and adds a v1 alias.
Ungates the FastAPI pack endpoint.
Displays and tests stable identity-pack citations.

File summaries

File	Description
`tests/unit/test_api_key_auth.py`	Tests anonymous FastAPI access.
`src/youtube_extension/videopack/PLAN.md`	Updates implementation plan.
`src/youtube_extension/backend/middleware/api_key_auth.py`	Publicly allowlists pack API.
`apps/web/src/store/__tests__/dashboard-store.test.ts`	Tests pack retention after transcript failure.
`apps/web/src/lib/studio-pipeline-status.ts`	Formats citations and outcomes.
`apps/web/src/lib/auth-paths.ts`	Ungates and reclassifies pack routes.
`apps/web/src/lib/__tests__/video-pack.test.ts`	Tests speech-free identity packs.
`apps/web/src/lib/__tests__/studio-pipeline-status.test.ts`	Tests citation messaging.
`apps/web/src/lib/__tests__/auth-paths.test.ts`	Tests auth and metering policy.
`apps/web/src/components/OneLoopStudio.tsx`	Displays persisted pack details.
`apps/web/src/app/api/v1/video/pack/route.ts`	Adds the v1 route alias.
`apps/web/src/app/api/v1/video/pack/__tests__/route.test.ts`	Tests v1 pack responses.

Review details

Files reviewed: 17/17 changed files
Comments generated: 3
Review effort level: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    # Identity Video Pack v0: version + video_id hash. Public home paste
+    # must emit this without an API key and without speech evidence.
+    "/api/v1/video/pack",


+  '/api/video/pack',
+  '/api/v1/video/pack',


    "/api/v1/health",
+    # Identity Video Pack v0: version + video_id hash. Public home paste
+    # must emit this without an API key and without speech evidence.
+    "/api/v1/video/pack",


* fix(web): parse v1 video pack runtime at compile time (#1613) Next cannot statically parse re-exported `runtime` from the v1 pack alias, which failed v0-uvai `next build` after #1612. Declare a literal runtime and call the shared identity-pack POST handler instead. Co-authored-by: Hayden <groupthinking@users.noreply.github.com> * docs(videopack): record v1 pack runtime parse verification Co-authored-by: Hayden <groupthinking@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Hayden <groupthinking@users.noreply.github.com>

package.json requires @ai-sdk/gateway@^4.0.55 and postcss@^8.5.26 but the lockfile pinned @ai-sdk/gateway@4.0.23 and postcss@8.5.21 (apps/web nested). npm ci --workspace=apps/web --production --legacy-peer-deps aborted at the integrity check, causing the trivy Security Scan job to fail before it could run any vulnerability scans (seen on PRs #1609, #1612, #1621, and on main). Regenerated lockfile with npm install --package-lock-only. Only package-lock.json is touched; no application code changed. Verified: - npm ci --workspace=apps/web --production --legacy-peer-deps: exit 0 - npm ci (full dev): exit 0 - apps/web test suite: 509/509 passed - google/gemini-3.8-flash model pin: unchanged Closes #1624 Co-authored-by: Hayden <groupthinking@users.noreply.github.com>

…1625) package.json requires @ai-sdk/gateway@^4.0.55 and postcss@^8.5.26 but the lockfile pinned @ai-sdk/gateway@4.0.23 and postcss@8.5.21 (apps/web nested). npm ci --workspace=apps/web --production --legacy-peer-deps aborted at the integrity check, causing the trivy Security Scan job to fail before it could run any vulnerability scans (seen on PRs #1609, #1612, #1621, and on main). Regenerated lockfile with npm install --package-lock-only. Only package-lock.json is touched; no application code changed. Verified: - npm ci --workspace=apps/web --production --legacy-peer-deps: exit 0 - npm ci (full dev): exit 0 - apps/web test suite: 509/509 passed - google/gemini-3.8-flash model pin: unchanged Closes #1624 Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Hayden <groupthinking@users.noreply.github.com>

groupthinking marked this pull request as ready for review September 2, 2026 22:29

Copilot AI balanced review requested due to automatic review settings September 2, 2026 22:29

github-actions Bot added documentation Improvements or additions to documentation javascript Pull requests that update javascript code labels Sep 2, 2026

github-actions Bot added python tests labels Sep 2, 2026

vercel Bot had a problem deploying to Preview September 2, 2026 22:29 Failure

Copilot started reviewing on behalf of groupthinking September 2, 2026 22:29 View session

vercel Bot reviewed Sep 2, 2026

View reviewed changes

kk-agent merged commit 25b4de4 into main Sep 2, 2026
21 of 25 checks passed

kk-agent deleted the cursor/public-video-pack-emit-fb40 branch September 2, 2026 22:32

vercel Bot had a problem deploying to Preview September 2, 2026 22:32 Failure

Copilot AI reviewed Sep 2, 2026

View reviewed changes

groupthinking mentioned this pull request Sep 2, 2026

fix(web): parse v1 video pack runtime at compile time #1614

Merged

10 tasks

cursor Bot mentioned this pull request Sep 3, 2026

lockfile out of sync with package.json — breaks npm ci in trivy Security Scan #1624

Closed

groupthinking mentioned this pull request Sep 3, 2026

fix: sync package-lock.json to satisfy npm ci in trivy Security Scan #1625

Merged

9 tasks

Navigation Menu

fix: ungate anonymous Video Pack v0 emit on paste-URL - #1612

fix: ungate anonymous Video Pack v0 emit on paste-URL#1612
kk-agent merged 2 commits into
mainfrom
cursor/public-video-pack-emit-fb40

groupthinking commented Sep 2, 2026 •

edited by cursor Bot

Loading

Uh oh!

vercel Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

vercel Bot Sep 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

linear-code Bot commented Sep 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -0,0 +1 @@
		export { POST, runtime } from '../../../video/pack/route';

Conversation

groupthinking commented Sep 2, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CoS lock (do not skip)

Canonical issue

Outcome

Scope

Risk

Verification

Production evidence

Agent handoff

Uh oh!

vercel Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Snapshot Warnings

Scanned Files

Uh oh!

vercel Bot Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

linear-code Bot commented Sep 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

groupthinking commented Sep 2, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Sep 2, 2026 •

edited

Loading

coderabbitai Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

vercel Bot Sep 2, 2026 •

edited

Loading