feat(platform): paste-link video ingestion in chat

[larryro]

Summary

Adds support for pasting a video URL into the chat composer. Tale ingests the video into a regular attachment — caption-first when the source has uploader-provided or auto-generated captions, audio extraction + Whisper fallback otherwise — and feeds the resulting transcript through the same cascade as a file upload.

Server

• New videoLinks/ module — schema, ingest orchestrator, yt-dlp wrapper, VTT/SRT captions parser, URL-safety helpers, internal mutations/queries. Orchestrator runs as a state machine (attempts / CAS guard / store-then-patch) with a direct watchdog cron for stuck jobs.
• yt-dlp subprocess hardening — version-gated flag probe, IPv6 SSRF coverage, stderr surfaced in retry logs, no fictional CLI flags. Dockerfile pins the binary.
• lib/http/safe_fetch.ts extended for DNS-pinned SSRF protection.
• New videoLinkJobs table with cascade + GDPR erasure coverage, plus RLS rules and access-control helpers.
• Caption/title text and VTT speaker labels are scrubbed and wrapped in <untrusted_source> markers before the agent sees them; the URL is preserved on the transcript header for provenance. RAG / document_retrieve output gets the same wrapper.
• Per-org concurrency gate (3 in flight), 4h duration cap, playlist rejection, 15-minute cooldown after source-side rate-limits.
• Wires into the existing audio + personalization cascade and surfaces the transcript with a document_retrieve hint to the agent.

Client

• New video-link-chip and use-chat-video-links hook. Pasting a URL into the composer binds a chip with live status (Reading info → Fetching captions → Extracting audio → Transcribing → Ready), or Failed on error.
• chat-input paste handler — IME-guarded, unbinds on failure, blocks Send while a chip is in the failed state. Dedup scoped to unbound rows in the same composer.
• Synchronous render on send to remove composer/bubble lag; scroll-to-bottom intent lands adjacent to setPendingMessage.
• Chip is width-bounded with title wrap to 2 lines.

i18n + Legal + Docs

• messages/{en,de,fr}.json — all new strings present in all three locales.
• ToS updated in all three locales with a derivative-works clause covering paste-link ingestion.
• docs/{en,de,fr}/platform/chat/attachments.md documents the new flow, limits, and the untrusted-source handling.
• README intro list mentions video-link paste under "AI chat basics".

Test plan

• Paste a YouTube URL with uploader captions → chip cycles through Reading info → Fetching captions → Ready, no audio extraction runs.
• Paste a URL where no captions are available → chip falls back to Extracting audio → Transcribing → Ready, billed against the same usage ledger as a file upload.
• Paste a URL longer than 4 hours → rejected before audio extraction with an inline error.
• Paste a playlist URL → rejected with an inline error.
• Submit a 4th concurrent video link in the same org → inline concurrency error; existing three continue.
• Trigger source-side rate-limit (bot detection) → chip stays in cooldown for 15 minutes, retry blocked until then; stderr visible in video_link.retrying log.
• Paste an IPv6 / localhost. / IDN / overlong URL → blocked by safe_fetch SSRF + URL-safety helpers.
• Failed chip present → Send button disabled until retry or chip removal.
• Send a message with a video-link attachment → transcript appears in the conversation, agent sees it wrapped in <untrusted_source> and gets the document_retrieve hint.
• Delete the user/org → videoLinkJobs rows cascade per GDPR erasure coverage.
• Translations: en/de/fr — new chip statuses, error strings, and docs page all render and follow terminology rules.
• ToS page in all three locales shows the derivative-works clause.

Summary by CodeRabbit

• New Features

  • Paste or drop video URLs into the composer to create video attachment chips; chips show progress, duration, title, and open-source links.
  • Send is blocked while video ingestion is processing or has failures; remove/retry actions available.

• Documentation

  • Chat attachment guides updated (EN/DE/FR) with video-link usage, limits (4h cap, max concurrent jobs), and failure behavior.
  • Terms of Service updated (date changed).

• Infrastructure

  • Stronger URL/SSRF protections and clearer user-facing error messages.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a complete “video links” feature: frontend extracts and ingests pasted URLs, renders chips, and gates send; backend defines videoLinkJobs with ingest action (yt-dlp captions/audio, transcription, indexing), mutations/queries, cron recovery, and cleanup/erasure. Integrates file metadata, paragraphization, and heartbeat. Introduces SSRF/DNS safety, hardened safe_fetch, and container firewall. Expands untrusted-content trust rules and wraps RAG/doc/integration outputs. Updates docs, i18n, README, and Terms.

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/video-analysis-via-link

[coderabbitai]

Actionable comments posted: 18

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@services/convex/docker-entrypoint.sh`:
- Around line 59-83: The current iptables OUTPUT rejects for RFC1918 (the
iptables -A OUTPUT -d 10.0.0.0/8, -d 172.16.0.0/12, -d 192.168.0.0/16 lines)
will block legitimate Compose sibling service traffic; change the firewall to
explicitly allow the container's local Docker network(s) before the rejects.
Concretely, detect or accept ENV-configured local subnets (or the docker bridge
address range) and insert explicit ALLOW rules for those CIDRs or for the
container-facing interface prior to the REJECT lines (or make
TALE_SKIP_SSRF_FIREWALL cover this case), so that the iptables -A OUTPUT rejects
only target external RFC1918 addresses and not intra-compose service addresses.

In `@services/convex/Dockerfile`:
- Around line 88-94: The checksum verification fails because the downloaded
archive is saved as /tmp/deno.zip while the checksum file (used by sha256sum -c
deno.sums) expects the original filename ${DENO_ASSET}; change the download
target to /tmp/${DENO_ASSET} (and adjust subsequent references like the unzip
source and rm targets) so that the filename in the checksum matches the archive,
ensuring sha256sum -c deno.sums succeeds when run in /tmp with DENO_ASSET used
consistently.

In `@services/platform/app/features/chat/components/video-link-chip.tsx`:
- Around line 68-70: The completed-status branch can render an empty string
because formatDurationLabel(job.videoDurationSec) returns '' when duration is
missing; update the completed branch in the VideoLinkChip component to use the
formatted label if non-empty, otherwise render a localized fallback (e.g.,
t('status.ready') or a passed-in i18n string) instead of ''. Concretely, change
the expression that uses formatDurationLabel(job.videoDurationSec) (and the
identical logic later in the file) to something like: let label =
formatDurationLabel(job.videoDurationSec); render label && label.length ? label
: localizedReadyFallback; and apply this fix for both occurrences referencing
job.displayStatus === 'completed' so the status row never appears blank.

In `@services/platform/app/features/chat/hooks/use-send-message.ts`:
- Around line 473-494: The catch blocks that handle errors from
bindCompletedJobsToMessage (seen around use-send-message.ts) currently swallow
the error, restore UI state (unmarkJobsSent with snapshotJobIds) and show a
failure toast, then allow the send flow to continue; change this so
bindCompletedJobsToMessage failures do not let the send proceed: either re-throw
the caught error to let the outer rollback handle it (remove the toast/unmark
side-effects in these inner catches), or convert bindCompletedJobsToMessage into
a non-fatal operation by explicitly treating its error as non-blocking (i.e.,
log the error but do NOT call toast or unmarkJobsSent and ensure the send flow
continues only when safe). Update the catch blocks that reference
bindCompletedJobsToMessage, unmarkJobsSent, snapshotJobIds, and toast (including
the other similar blocks noted) to follow one consistent approach.

In `@services/platform/convex/agent_tools/documents/helpers/retrieve_document.ts`:
- Around line 104-112: The call to
ctx.runQuery(internal.file_metadata.internal_queries.lookupVideoLinkSources,
...) can return undefined, but the code assumes an array by accessing
videoSources.length; update the code that assigns videoSources (and the second
occurrence) to default to an empty array when undefined (e.g., const
videoSources = (await ctx.runQuery(...)) || []), then proceed to check
videoSources.length and use videoSources[0].sourceUrl before calling
wrapUntrusted(result.content, meta); reference lookupVideoLinkSources,
videoSources, ctx.runQuery, wrapUntrusted, and result.content when making the
change.

In `@services/platform/convex/agent_tools/integrations/integration_tool.ts`:
- Around line 215-219: Replace the existing comment in integration_tool.ts with
a concise rationale (near the block that deals with `content`, `fileReferences`,
and `citations`) that explains why duplicating raw text was a prompt-injection
risk and that structured `fileReferences`/`citations` satisfy the legitimate
structured-output needs; do not mention or narrate removed fields or prior
implementation details—just state the security rationale and current approach.

In `@services/platform/convex/file_metadata/paragraphize.ts`:
- Around line 112-118: The flush function is concatenating cue texts with
current.join('') which can merge words across cues (e.g., "will" + "see" →
"willsee"); update flush (and the equivalent logic around lines 147-151) to join
cues safely by inserting a single space only when the boundary doesn't already
have whitespace — e.g., build body by iterating current and appending each
trimmed cue, inserting one space if the previous char is non-whitespace and the
next cue's first char is non-whitespace; keep existing paragraphSpeaker,
addTimestamps, paragraphStart and paragraphs handling the same and ensure
parseVtt-normalized cue text is respected.

In `@services/platform/convex/file_metadata/transcribe_audio.ts`:
- Around line 449-455: Timestamps are being applied from a compressed timeline
(chunkStartSec) when preCheck?.source === 'video_link' so the [HH:MM:SS]
prefixes drift; either build and use an original→compressed time map from
compressAudio() and convert chunkStartSec back to wall-clock times before
calling joinSegmentsWithParagraphs/whisperSegmentsToParagraphSegments, or
conservatively disable timestamping for the video_link path by forcing
addTimestamps: false when preCheck?.source === 'video_link' (update both call
sites that pass addTimestamps, e.g., the joinSegmentsWithParagraphs invocation
and the later similar call at 460-462) so video deep-links and agent citations
use correct wall-clock offsets.

In `@services/platform/convex/governance/erasure.ts`:
- Around line 1818-1844: The loop that deletes RAG documents uses
perCategory.videoLinks.ragPurgeStorageIds and can attempt duplicate DELETEs
(double-counting ragDocumentsRemoved); before iterating, deduplicate the storage
IDs (e.g., build a Set from perCategory.videoLinks.ragPurgeStorageIds) so each
storageId is processed once, then iterate that unique list when calling
ragFetch/DELETE; update the code around perCategory.videoLinks,
ragPurgeStorageIds, ragFetch, and ragDocumentsRemoved to use the deduplicated
IDs and preserve the existing 404 handling.

In `@services/platform/convex/lib/cascades/personalization_cascade.ts`:
- Around line 137-160: The videoLinkJobs sweep can add ~6k deletes on top of the
earlier TTS sweep and exceed the mutation write budget; fix this by introducing
a shared delete budget counter (e.g., deleteBudget or remainingDeletes)
initialized to the max allowed deletes (or max minus what the TTS loop consumes)
and decrement it each time you call ctx.db.delete (and optionally for
ctx.storage.delete if that counts against budget). In the videoLinkJobs loop
(the for loop iterating pages from query('videoLinkJobs')
withIndex('by_organizationId_and_status') and using PAGE_SIZE), check the shared
budget and break out when it reaches zero, and ensure the TTS loop uses the same
shared counter so both sweeps cannot together exceed the budget.

In `@services/platform/convex/lib/untrusted_content.ts`:
- Around line 40-44: The re-export of sanitizeUntrustedField is located
mid-file; move it to the module's export section at the bottom of
services/platform/convex/lib/untrusted_content.ts and replace the named export
with a wildcard re-export: use export * from
'../../lib/shared/sanitize-untrusted-field'; so the file follows the "imports at
top, exports at bottom" guideline and aligns with repo conventions; ensure you
remove the existing export { sanitizeUntrustedField } line and add the export *
line in the file's final export block.

In `@services/platform/convex/threads/cascade_helpers.ts`:
- Around line 382-405: The loop that processes videoLinkJobs (videoLinksPage /
job) must also remove any associated fileMetadata rows and purge related RAG
documents when organizationId is missing; update the cascade_helpers.ts loop
that currently only deletes job._id and optionally job.storageId so that for
each job with job.fileMetadataId you (1) delete the corresponding fileMetadata
row via ctx.db.delete(String(job.fileMetadataId)) (or the appropriate db delete
API), (2) purge any RAG documents linked to that fileMetadata by calling your
existing purge function (e.g. purgeRagDocumentsForFileMetadata(fileMetadataId)
or implement one if absent), and (3) ensure these deletions run inside the same
try/catch pattern used for storage deletion to log and continue on errors; keep
the existing storage.delete and ctx.db.delete(job._id) behavior.

In `@services/platform/convex/video_links/ingest_video_link.ts`:
- Around line 680-724: handleYtDlpError currently hardcodes userLocale:
undefined when rescheduling retries, causing caption locale loss; modify
handleYtDlpError signature to accept a userLocale?: string (or the appropriate
Locale type) and pass that value through to the ctx.scheduler.runAfter call that
enqueues internal.video_links.ingest_video_link.ingestVideoLink so it uses {
jobId, userLocale } instead of undefined; ensure callers that invoke
handleYtDlpError (where retries are initiated) are updated to forward the
current locale, and keep all existing behavior (attempts/error updates)
unchanged.

In `@services/platform/convex/video_links/internal_mutations.ts`:
- Around line 408-409: The watchdog marks 'queued' rows as stuck after 5 minutes
which is shorter than the 15-minute retry cooldown; update the watchdog logic by
either increasing the timeout for the 'queued' status (the array entry
['queued', 5 * 60_000] in
services/platform/convex/video_links/internal_mutations.ts) to at least 15 *
60_000 (or the configured max backoff), or change the recovery filter to
explicitly ignore rows in 'queued' or 'retrying' states so scheduled retries
aren’t flipped to 'failed'; apply the same reasoning to any similar entry like
['fetching_metadata', 5 * 60_000] if it represents intentional backoff.
- Around line 485-514: In the GC loop over candidates (variables: candidates,
row, gcCount) add a call to remove the related RAG document before deleting the
job row: when row.storageId is present, call the existing deleteFromRagBatch (or
equivalent RAG deletion API) for that storageId (in a try/catch and log on
error) prior to deleting fileMetadata and the job row, so the transcript is
removed from the RAG index before its source artifacts are deleted; place this
call inside the same conditional branch where you handle row.storageId and
ensure it runs before ctx.db.delete(row._id).

In `@services/platform/convex/video_links/mutations.ts`:
- Around line 196-227: The current dedup uses a single .first() lookup on the
videoLinkJobs index by_organizationId_and_sourceUrlHash which can return a newer
unrelated job and miss a valid same-thread/same-uploader/unbound candidate;
update the lookup in the mutation that computes existing to iterate the index
results (querying videoLinkJobs with
withIndex('by_organizationId_and_sourceUrlHash', ...) and scanning rows) until
you find a row where messageBoundAt is undefined, threadId === args.threadId,
uploadedBy === userId and status not in ['failed','skipped'] and now -
_creationTime < DEDUP_WINDOW_MS, then use that row (refresh pastedToken if
different) or fall back to inserting a new job—alternatively add/replace with a
narrower index that includes threadId and uploadedBy to avoid scanning.
- Around line 107-163: After the playlist check, run the shared string-level
safety gate (the project's central URL safety/validation helper) on the raw URL
(args.url or serverNormalized) immediately before calling
checkOrganizationRateLimit so unsafe URLs never consume rate-limit/budget; if
the gate fails throw a ConvexError (e.g. code 'unsafeUrl') and abort. Locate
this insertion point near isPlaylistUrl, normalizeUrlForHash, and
checkOrganizationRateLimit in the mutation and ensure the check rejects
credential-bearing/localhost/IP-literal URLs so none get persisted to
videoLinkJobs.sourceUrl or queued for the async action.

In `@services/platform/convex/video_links/queries.ts`:
- Around line 131-132: Wrap the call to authComponent.getAuthUser(ctx) in a
try/catch in the Convex query handlers in queries.ts (the places using
authComponent.getAuthUser(ctx) around the shown block and the second occurrence
at the 188-189 region); on any thrown error, silently treat it as an
unauthenticated user and return [] (i.e., swallow the error without logging and
return the same fallback as when getAuthUser returns falsy) so the query
preserves the soft-fail contract.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: bbdc2e8b-ca4c-45f1-9f30-f8ce8651b9e4

📥 Commits

Reviewing files that changed from the base of the PR and between bfa06cb and 075886c.

⛔ Files ignored due to path filters (1)

• services/platform/convex/_generated/api.d.ts is excluded by !**/_generated/**

📒 Files selected for processing (62)

• README.de.md
• README.fr.md
• README.md
• compose.yml
• docs/de/platform/chat/attachments.md
• docs/en/platform/chat/attachments.md
• docs/fr/platform/chat/attachments.md
• services/convex/Dockerfile
• services/convex/docker-entrypoint.sh
• services/platform/app/components/ui/forms/file-upload.tsx
• services/platform/app/features/chat/components/chat-input.tsx
• services/platform/app/features/chat/components/chat-interface.tsx
• services/platform/app/features/chat/components/video-link-chip.test.tsx
• services/platform/app/features/chat/components/video-link-chip.tsx
• services/platform/app/features/chat/hooks/use-chat-video-links.ts
• services/platform/app/features/chat/hooks/use-send-message.test.ts
• services/platform/app/features/chat/hooks/use-send-message.ts
• services/platform/convex/agent_tools/documents/helpers/retrieve_document.ts
• services/platform/convex/agent_tools/integrations/create_bound_integration_tool.ts
• services/platform/convex/agent_tools/integrations/integration_batch_tool.ts
• services/platform/convex/agent_tools/integrations/integration_tool.ts
• services/platform/convex/agent_tools/rag/rag_search_tool.ts
• services/platform/convex/crons.ts
• services/platform/convex/file_metadata/internal_mutations.ts
• services/platform/convex/file_metadata/internal_queries.ts
• services/platform/convex/file_metadata/paragraphize.test.ts
• services/platform/convex/file_metadata/paragraphize.ts
• services/platform/convex/file_metadata/schema.ts
• services/platform/convex/file_metadata/transcribe_audio.ts
• services/platform/convex/governance/erasure.ts
• services/platform/convex/lib/agent_chat/start_agent_chat.ts
• services/platform/convex/lib/agent_response/build_system_prompt.ts
• services/platform/convex/lib/cascades/personalization_cascade.ts
• services/platform/convex/lib/http/safe_fetch.ts
• services/platform/convex/lib/untrusted_content.ts
• services/platform/convex/schema.ts
• services/platform/convex/threads/cascade_helpers.ts
• services/platform/convex/video_links/captions_parser.test.ts
• services/platform/convex/video_links/captions_parser.ts
• services/platform/convex/video_links/ingest_video_link.ts
• services/platform/convex/video_links/internal_mutations.ts
• services/platform/convex/video_links/internal_queries.ts
• services/platform/convex/video_links/mutations.ts
• services/platform/convex/video_links/queries.ts
• services/platform/convex/video_links/schema.ts
• services/platform/convex/video_links/url_safety.test.ts
• services/platform/convex/video_links/url_safety.ts
• services/platform/convex/video_links/ytdlp.ts
• services/platform/convex/workflow_engine/action_defs/document/document_action.ts
• services/platform/convex/workflow_engine/action_defs/rag/rag_action.ts
• services/platform/convex/workflow_engine/helpers/nodes/llm/execute_agent_with_tools.ts
• services/platform/lib/shared/sanitize-untrusted-field.ts
• services/platform/lib/shared/video-link-markdown.test.ts
• services/platform/lib/shared/video-link-markdown.ts
• services/platform/lib/shared/video-url.test.ts
• services/platform/lib/shared/video-url.ts
• services/platform/messages/de.json
• services/platform/messages/en.json
• services/platform/messages/fr.json
• services/web/app/content/legal/de/terms-of-service.md
• services/web/app/content/legal/en/terms-of-service.md
• services/web/app/content/legal/fr/terms-of-service.md

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy lift

These OUTPUT rejects will break normal Compose networking.

Inside the container namespace, connections to PostgreSQL, Caddy, and other sibling services on Docker bridge addresses still hit OUTPUT. Rejecting all of 10/8, 172.16/12, and 192.168/16 here will block legitimate service-to-service traffic on default Docker networks before the app finishes booting. This needs explicit allow rules for the local service network(s) or a narrower SSRF defense than blanket RFC1918 rejects.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/convex/docker-entrypoint.sh` around lines 59 - 83, The current
iptables OUTPUT rejects for RFC1918 (the iptables -A OUTPUT -d 10.0.0.0/8, -d
172.16.0.0/12, -d 192.168.0.0/16 lines) will block legitimate Compose sibling
service traffic; change the firewall to explicitly allow the container's local
Docker network(s) before the rejects. Concretely, detect or accept
ENV-configured local subnets (or the docker bridge address range) and insert
explicit ALLOW rules for those CIDRs or for the container-facing interface prior
to the REJECT lines (or make TALE_SKIP_SSRF_FIREWALL cover this case), so that
the iptables -A OUTPUT rejects only target external RFC1918 addresses and not
intra-compose service addresses.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

ver="v2.5.4"
asset="deno-x86_64-unknown-linux-gnu.zip"
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT

curl -fsSL "https://github.com/denoland/deno/releases/download/${ver}/${asset}.sha256sum" -o "$tmp/deno.sums"
echo "Checksum file contents:"
cat "$tmp/deno.sums"
echo

touch "$tmp/deno.zip"
echo "Verifying with the current Dockerfile's local filename:"
if (cd "$tmp" && sha256sum -c deno.sums); then
  echo "unexpected success"
else
  echo "expected failure: checksum references ${asset}, not deno.zip"
fi

Repository: tale-project/tale

Length of output: 395

---

🏁 Script executed:

cat -n services/convex/Dockerfile | sed -n '85,100p'

Repository: tale-project/tale

Length of output: 1008

---

🏁 Script executed:

cat -n services/convex/Dockerfile | sed -n '70,87p'

Repository: tale-project/tale

Length of output: 1278

---

Deno checksum verification will fail due to filename mismatch.

The archive is downloaded as /tmp/deno.zip (line 88), but the checksum file references the original asset name ${DENO_ASSET} (e.g., deno-x86_64-unknown-linux-gnu.zip). When sha256sum -c deno.sums runs at line 90, it will look for the filename embedded in the checksum file and fail. Save the archive as /tmp/${DENO_ASSET} instead.

Suggested fix

-    && curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_TAG}/${DENO_ASSET}" -o /tmp/deno.zip \
+    && curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_TAG}/${DENO_ASSET}" -o "/tmp/${DENO_ASSET}" \
     && curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_TAG}/${DENO_ASSET}.sha256sum" -o /tmp/deno.sums \
     && (cd /tmp && sha256sum -c deno.sums) \
-    && unzip -q /tmp/deno.zip -d /usr/local/bin \
+    && unzip -q "/tmp/${DENO_ASSET}" -d /usr/local/bin \
     && chmod 0755 /usr/local/bin/deno \
     && echo "$DENO_TAG" > /etc/deno-version \
-    && rm -f /tmp/deno.zip /tmp/deno.sums \
+    && rm -f "/tmp/${DENO_ASSET}" /tmp/deno.sums \

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	&& curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_TAG}/${DENO_ASSET}" -o /tmp/deno.zip \
	&& curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_TAG}/${DENO_ASSET}.sha256sum" -o /tmp/deno.sums \
	&& (cd /tmp && sha256sum -c deno.sums) \
	&& unzip -q /tmp/deno.zip -d /usr/local/bin \
	&& chmod 0755 /usr/local/bin/deno \
	&& echo "$DENO_TAG" > /etc/deno-version \
	&& rm -f /tmp/deno.zip /tmp/deno.sums \
	&& curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_TAG}/${DENO_ASSET}" -o "/tmp/${DENO_ASSET}" \
	&& curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_TAG}/${DENO_ASSET}.sha256sum" -o /tmp/deno.sums \
	&& (cd /tmp && sha256sum -c deno.sums) \
	&& unzip -q "/tmp/${DENO_ASSET}" -d /usr/local/bin \
	&& chmod 0755 /usr/local/bin/deno \
	&& echo "$DENO_TAG" > /etc/deno-version \
	&& rm -f "/tmp/${DENO_ASSET}" /tmp/deno.sums \

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/convex/Dockerfile` around lines 88 - 94, The checksum verification
fails because the downloaded archive is saved as /tmp/deno.zip while the
checksum file (used by sha256sum -c deno.sums) expects the original filename
${DENO_ASSET}; change the download target to /tmp/${DENO_ASSET} (and adjust
subsequent references like the unzip source and rm targets) so that the filename
in the checksum matches the archive, ensuring sha256sum -c deno.sums succeeds
when run in /tmp with DENO_ASSET used consistently.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Avoid empty completed status text when duration is missing.

When job.displayStatus === 'completed' but videoDurationSec is absent/0, formatDurationLabel(...) returns '', so the status row becomes blank. Add a localized fallback (for example, “Ready”) in the completed branch.

Proposed fix

+  const completedStatus =
+    formatDurationLabel(job.videoDurationSec) ||
+    tChat('videoLink.statuses.completed');
+
   const statusText = isFailed
     ? tChat(`videoLink.errors.${job.errorReasonCode ?? 'generic'}`, {
         defaultValue: tChat('videoLink.errors.generic'),
       })
-    : isCompleted
-      ? formatDurationLabel(job.videoDurationSec)
+    : isCompleted
+      ? completedStatus
       : job.displayStatus === 'retrying' && job.errorReasonCode
         ? `${tChat('videoLink.statuses.retrying')} (${tChat(`videoLink.errors.${job.errorReasonCode}`, { defaultValue: tChat('videoLink.errors.generic') })})`
         : isProcessing && renderedProgress
           ? renderedProgress
           : tChat(`videoLink.statuses.${job.displayStatus}`, {

Also applies to: 181-183

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/platform/app/features/chat/components/video-link-chip.tsx` around
lines 68 - 70, The completed-status branch can render an empty string because
formatDurationLabel(job.videoDurationSec) returns '' when duration is missing;
update the completed branch in the VideoLinkChip component to use the formatted
label if non-empty, otherwise render a localized fallback (e.g.,
t('status.ready') or a passed-in i18n string) instead of ''. Concretely, change
the expression that uses formatDurationLabel(job.videoDurationSec) (and the
identical logic later in the file) to something like: let label =
formatDurationLabel(job.videoDurationSec); render label && label.length ? label
: localizedReadyFallback; and apply this fix for both occurrences referencing
job.displayStatus === 'completed' so the status row never appears blank.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Don't keep sending after a video-link bind failure.

All three catch blocks swallow bindCompletedJobsToMessage errors and then continue into the actual send. That leaves the client and server disagreeing about whether the jobs were attached: the existing-thread branch can show a destructive "send failed" toast even when the message succeeds, while the arena/new-thread branches can send the attachment payload without ever stamping messageBoundAt, so those jobs can resurface and be rebound later. Re-throw here and let the outer rollback path handle the failure, or make bind fully non-fatal and remove the failure toast/rollback side effects.

Also applies to: 589-616, 715-745

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/platform/app/features/chat/hooks/use-send-message.ts` around lines
473 - 494, The catch blocks that handle errors from bindCompletedJobsToMessage
(seen around use-send-message.ts) currently swallow the error, restore UI state
(unmarkJobsSent with snapshotJobIds) and show a failure toast, then allow the
send flow to continue; change this so bindCompletedJobsToMessage failures do not
let the send proceed: either re-throw the caught error to let the outer rollback
handle it (remove the toast/unmark side-effects in these inner catches), or
convert bindCompletedJobsToMessage into a non-fatal operation by explicitly
treating its error as non-blocking (i.e., log the error but do NOT call toast or
unmarkJobsSent and ensure the send flow continues only when safe). Update the
catch blocks that reference bindCompletedJobsToMessage, unmarkJobsSent,
snapshotJobIds, and toast (including the other similar blocks noted) to follow
one consistent approach.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Guard lookupVideoLinkSources before reading .length.

ctx.runQuery(...) can resolve to undefined in current tests, and this now throws at Line 108/Line 119. Default to an empty array before using .length so retrieval doesn’t crash.

Suggested fix

-  const videoSources = await ctx.runQuery(
+  const videoSources =
+    (await ctx.runQuery(
     internal.file_metadata.internal_queries.lookupVideoLinkSources,
     { storageIds: [toId<'_storage'>(args.fileId)] },
-  );
-  if (videoSources.length > 0) {
+  )) ?? [];
+  const hasVideoSources = videoSources.length > 0;
+  if (hasVideoSources) {
     const meta: { tool: string; url?: string } = { tool: 'document_retrieve' };
     if (videoSources[0].sourceUrl) meta.url = videoSources[0].sourceUrl;
     result.content = wrapUntrusted(result.content, meta);
   }
@@
-    wrappedAsUntrusted: videoSources.length > 0,
+    wrappedAsUntrusted: hasVideoSources,

Also applies to: 119-119

🧰 Tools

🪛 GitHub Check: Unit

[failure] 108-108: [server] convex/agent_tools/documents/document_retrieve_tool.test.ts > retrieveDocument helper > does not call getAccessibleDocumentIds on the fileMetadata fallback path
TypeError: Cannot read properties of undefined (reading 'length')
❯ Module.retrieveDocument convex/agent_tools/documents/helpers/retrieve_document.ts:108:20
❯ convex/agent_tools/documents/document_retrieve_tool.test.ts:299:5

---

[failure] 108-108: [server] convex/agent_tools/documents/document_retrieve_tool.test.ts > retrieveDocument helper > falls back to fileMetadata + RAG for chat-uploaded files not in documents hub
TypeError: Cannot read properties of undefined (reading 'length')
❯ Module.retrieveDocument convex/agent_tools/documents/helpers/retrieve_document.ts:108:20
❯ convex/agent_tools/documents/document_retrieve_tool.test.ts:217:20

---

[failure] 108-108: [server] convex/agent_tools/documents/document_retrieve_tool.test.ts > retrieveDocument helper > does not truncate content at exactly 50K chars
TypeError: Cannot read properties of undefined (reading 'length')
❯ Module.retrieveDocument convex/agent_tools/documents/helpers/retrieve_document.ts:108:20
❯ convex/agent_tools/documents/document_retrieve_tool.test.ts:162:20

---

[failure] 108-108: [server] convex/agent_tools/documents/document_retrieve_tool.test.ts > retrieveDocument helper > truncates content exceeding 50K chars
TypeError: Cannot read properties of undefined (reading 'length')
❯ Module.retrieveDocument convex/agent_tools/documents/helpers/retrieve_document.ts:108:20
❯ convex/agent_tools/documents/document_retrieve_tool.test.ts:147:20

---

[failure] 108-108: [server] convex/agent_tools/documents/document_retrieve_tool.test.ts > retrieveDocument helper > uses file storage ID in RAG URL, not document ID
TypeError: Cannot read properties of undefined (reading 'length')
❯ Module.retrieveDocument convex/agent_tools/documents/helpers/retrieve_document.ts:108:20
❯ convex/agent_tools/documents/document_retrieve_tool.test.ts:132:5

---

[failure] 108-108: [server] convex/agent_tools/documents/document_retrieve_tool.test.ts > retrieveDocument helper > omits query params when chunkStart and chunkEnd not provided
TypeError: Cannot read properties of undefined (reading 'length')
❯ Module.retrieveDocument convex/agent_tools/documents/helpers/retrieve_document.ts:108:20
❯ convex/agent_tools/documents/document_retrieve_tool.test.ts:120:5

---

[failure] 108-108: [server] convex/agent_tools/documents/document_retrieve_tool.test.ts > retrieveDocument helper > forwards chunkStart and chunkEnd as query params
TypeError: Cannot read properties of undefined (reading 'length')
❯ Module.retrieveDocument convex/agent_tools/documents/helpers/retrieve_document.ts:108:20
❯ convex/agent_tools/documents/document_retrieve_tool.test.ts:105:5

---

[failure] 108-108: [server] convex/agent_tools/documents/document_retrieve_tool.test.ts > retrieveDocument helper > returns correct result shape on happy path
TypeError: Cannot read properties of undefined (reading 'length')
❯ Module.retrieveDocument convex/agent_tools/documents/helpers/retrieve_document.ts:108:20
❯ convex/agent_tools/documents/document_retrieve_tool.test.ts:87:20

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/platform/convex/agent_tools/documents/helpers/retrieve_document.ts`
around lines 104 - 112, The call to
ctx.runQuery(internal.file_metadata.internal_queries.lookupVideoLinkSources,
...) can return undefined, but the code assumes an array by accessing
videoSources.length; update the code that assigns videoSources (and the second
occurrence) to default to an empty array when undefined (e.g., const
videoSources = (await ctx.runQuery(...)) || []), then proceed to check
videoSources.length and use videoSources[0].sourceUrl before calling
wrapUntrusted(result.content, meta); reference lookupVideoLinkSources,
videoSources, ctx.runQuery, wrapUntrusted, and result.content when making the
change.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

The queued watchdog window is shorter than the retry cooldown.

Retried jobs surface as queued/retrying during the backoff window, and the user-facing contract here is a 15-minute cooldown for throttled sources. With queued treated as stuck after 5 minutes, the watchdog will flip legitimate cooldown rows to failed before their scheduled retry fires. This window needs to be at least the longest intentional backoff, or queued retry rows need to be excluded from recovery.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/platform/convex/video_links/internal_mutations.ts` around lines 408
- 409, The watchdog marks 'queued' rows as stuck after 5 minutes which is
shorter than the 15-minute retry cooldown; update the watchdog logic by either
increasing the timeout for the 'queued' status (the array entry ['queued', 5 *
60_000] in services/platform/convex/video_links/internal_mutations.ts) to at
least 15 * 60_000 (or the configured max backoff), or change the recovery filter
to explicitly ignore rows in 'queued' or 'retrying' states so scheduled retries
aren’t flipped to 'failed'; apply the same reasoning to any similar entry like
['fetching_metadata', 5 * 60_000] if it represents intentional backoff.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

GC needs to purge the matching RAG document before deleting the row.

These unbound draft transcripts are indexed into RAG under storageId, but this sweep only deletes _storage, fileMetadata, and the job row. Without a deleteFromRagBatch call, the transcript stays searchable after its source artifacts are gone.

Suggested fix

     outer: for (const status of gcStatuses) {
       const candidates = await ctx.db
         .query('videoLinkJobs')
         .withIndex('by_status', (q) => q.eq('status', status))
         .take(UNBOUND_GC_BATCH * 4);
+      const ragPurgeStorageIds: string[] = [];
       for (const row of candidates) {
         if (gcCount >= UNBOUND_GC_BATCH) break outer;
         if (row.messageBoundAt !== undefined) continue;
         if (row._creationTime > gcCutoff) continue;
+        if (row.storageId) {
+          ragPurgeStorageIds.push(String(row.storageId));
+        }
         if (row.storageId) {
           try {
             await ctx.storage.delete(row.storageId);
@@
         }
         await ctx.db.delete(row._id);
         gcCount += 1;
       }
+      if (ragPurgeStorageIds.length > 0) {
+        await ctx.scheduler.runAfter(
+          0,
+          internal.workflow_engine.action_defs.rag.helpers.delete_document
+            .deleteFromRagBatch,
+          { fileIds: ragPurgeStorageIds },
+        );
+      }
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/platform/convex/video_links/internal_mutations.ts` around lines 485
- 514, In the GC loop over candidates (variables: candidates, row, gcCount) add
a call to remove the related RAG document before deleting the job row: when
row.storageId is present, call the existing deleteFromRagBatch (or equivalent
RAG deletion API) for that storageId (in a try/catch and log on error) prior to
deleting fileMetadata and the job row, so the transcript is removed from the RAG
index before its source artifacts are deleted; place this call inside the same
conditional branch where you handle row.storageId and ensure it runs before
ctx.db.delete(row._id).

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Reject obviously unsafe URLs before creating the job row.

This mutation only blocks playlist URLs up front. A direct client can still enqueue http://..., credential-bearing, localhost, or IP-literal URLs, which means those raw values get persisted in videoLinkJobs.sourceUrl and consume the org's rate-limit/in-flight budget until the async action rejects them. Please run the shared string-level safety gate here before insert/schedule, not just in the action.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/platform/convex/video_links/mutations.ts` around lines 107 - 163,
After the playlist check, run the shared string-level safety gate (the project's
central URL safety/validation helper) on the raw URL (args.url or
serverNormalized) immediately before calling checkOrganizationRateLimit so
unsafe URLs never consume rate-limit/budget; if the gate fails throw a
ConvexError (e.g. code 'unsafeUrl') and abort. Locate this insertion point near
isPlaylistUrl, normalizeUrlForHash, and checkOrganizationRateLimit in the
mutation and ensure the check rejects credential-bearing/localhost/IP-literal
URLs so none get persisted to videoLinkJobs.sourceUrl or queued for the async
action.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

The dedup lookup only checks the newest hash match.

Using .first() on by_organizationId_and_sourceUrlHash means a newer row from another thread or another uploader can hide the actual matching in-composer job for this user/thread. In that case this path falls through and inserts a duplicate job, even though the draft already has an unbound chip for the same URL. Iterate the hash bucket until you find a same-thread/same-uploader/unbound candidate, or add a narrower index that matches the dedup scope.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/platform/convex/video_links/mutations.ts` around lines 196 - 227,
The current dedup uses a single .first() lookup on the videoLinkJobs index
by_organizationId_and_sourceUrlHash which can return a newer unrelated job and
miss a valid same-thread/same-uploader/unbound candidate; update the lookup in
the mutation that computes existing to iterate the index results (querying
videoLinkJobs with withIndex('by_organizationId_and_sourceUrlHash', ...) and
scanning rows) until you find a row where messageBoundAt is undefined, threadId
=== args.threadId, uploadedBy === userId and status not in ['failed','skipped']
and now - _creationTime < DEDUP_WINDOW_MS, then use that row (refresh
pastedToken if different) or fall back to inserting a new job—alternatively
add/replace with a narrower index that includes threadId and uploadedBy to avoid
scanning.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Preserve the query soft-fail contract when auth lookup throws.

These handlers only return [] when getAuthUser() returns a falsy user. If Better Auth throws, the query errors and the chip subscription drops instead of degrading to “unauthenticated.” Catch that lookup failure here and return [], same as the other Convex query paths.

Based on learnings: In Convex query handlers, if authComponent.getAuthUser(ctx) fails, swallow the error and treat as unauthenticated without logging warnings/errors.

Also applies to: 188-189

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/platform/convex/video_links/queries.ts` around lines 131 - 132, Wrap
the call to authComponent.getAuthUser(ctx) in a try/catch in the Convex query
handlers in queries.ts (the places using authComponent.getAuthUser(ctx) around
the shown block and the second occurrence at the 188-189 region); on any thrown
error, silently treat it as an unauthenticated user and return [] (i.e., swallow
the error without logging and return the same fallback as when getAuthUser
returns falsy) so the query preserves the soft-fail contract.