three tasks on the right-click menu, and a skill for the agents

Convert Audio, Extract Audio, Convert Video. ported from the versions that ran on
alpha for months, which is where the rules come from — they are not invented:

  skip a file already in the target format (re-encoding mp3 to mp3 loses quality
    for nothing)
  never overwrite an existing output (the file there may be one somebody made)
  delete the source only AFTER the output exists, and only when asked

`inline: ask`, so the modal offers running it now or as a job — a few files inline,
a discography as a job. that was the affordance the old ones had and the reason the
choice exists.

THIN CLIENTS. every one calls /v1/ffmpeg; none of them runs ffmpeg. what to tell
ffmpeg lives once in av-club rather than three times in bash, which is the whole
point of the plugin existing. the three files nevertheless repeat their walk and
their reporting, because the task runner materialises ONLY index.ts and a script
task cannot import a sibling — that duplication is the platform's shape, not a
choice, and each file says so.

CONVERT VIDEO PROBES BEFORE IT DECIDES. if the codecs already fit the container it
asks for `c:v copy, c:a copy` — a remux, lossless, roughly a hundred times faster
than re-encoding. guessing from the extension is how a "fast remux" silently
re-encodes, since plenty of .avi holds h264. that needed a path probe, so
/v1/probe?path= is added beside it, same containment, read-only.

EXTRACT AUDIO HAS NO delete_source, deliberately. extracting is additive; offering
to delete would be offering to trade a video for its soundtrack. a video with no
audio track is reported as a skip rather than a failure — in a folder of screen
recordings that is most of them.

what is NOT here: track selection, subtitle handling, downmixing, per-file
percentage. those belong with jellyfin rather than with basic conversion and are
left where they are rather than half-ported. convert-video's TASK.md says so.

VERIFIED by running each task the way the runner does — temp dir, env vars, argv:
flac→mp3 on a folder; the re-run skipping both files for the two different reasons;
extraction skipping the silent clip and converting the other; mp4→mkv copying h264
and aac through untouched; mp4→webm re-encoding to vp9/opus; delete_source removing
a source after success and LEAVING it after a failure.

the skill tells an agent to use the endpoint and never to shell out to ffmpeg —
everything that makes this safe is on the far side of it — and to offer the
right-click tasks first when somebody is at a screen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

sidecar/index.ts

@@ -5,6 +5,7 @@ import { contentPath, deleteAsset, putAsset, readAsset } from "./assets/store";
 import { ffprobe } from "./probe/ffprobe";
 import { runSharp, type SharpRequest } from "./sharp/run";
 import { runFfmpeg, type FfmpegRequest } from "./ffmpeg/run";
+import { safeInputPath } from "./paths";
 import sharp from "sharp";
 import { createSidecarConnector } from "@@/sidecar/connect";
 import { API_URL } from "@@/officer-url.mjs";
@@ -148,6 +149,20 @@ async function route(request: Request): Promise<Response> {
 
   if (path === "/v1/assets" && request.method === "POST") return handleUpload(request);
 
+  /*
+    What is inside a file already on disk.
+
+    The same answer as `/v1/assets/:id/probe`, for the same reason the ffmpeg endpoint grew a path
+    mode: a caller deciding whether a conversion can be a lossless remux has to know the codecs, and
+    uploading a two-hour film to ask is not a way to find out. Confined by the same `safeInputPath`.
+
+    Read-only, so there is no output path to check — ffprobe is told a file and prints what it sees.
+  */
+  if (path === "/v1/probe" && request.method === "GET") {
+    const target = await safeInputPath(url.searchParams.get("path"), "path");
+    return Response.json(await withSlot(() => ffprobe(target)));
+  }
+
   const asset = path.match(/^\/v1\/assets\/([^/]+)(\/content|\/probe)?$/);
   if (asset) {
     const [, id, suffix] = asset;