feat: import X post videos with Xquik

[kriptoburak]

Problem

video-use documents optional yt-dlp support and reserves edit/downloads/, but it does not provide a source-import command. Agents must invent the download step before transcription. That creates inconsistent filenames, playlist behavior, and validation.

Solution

• Add helpers/import_sources.py as one entry point for online video.
• Import X post video through Xquik's Get Tweet response and choose the highest-bitrate MP4 rendition.
• Route other HTTPS sources through bounded, no-playlist yt-dlp behavior.
• Reject lookalike X and media hosts, embedded credentials, and local IP literals.
• Keep the API key on the Xquik lookup only. Never send it to the media host.
• Stream X media through a 500 MiB default limit, validate with ffprobe, then publish atomically.
• Document setup, first-use behavior, and untrusted remote metadata handling.

Validation

• python3 -m unittest discover -s tests -v (10 passed)
• Python 3.10 isolated environment (10 passed)
• Python 3.13 isolated environment (10 passed)
• python3 -m compileall -q helpers tests
• ruff check helpers/import_sources.py tests/test_import_sources.py
• ruff format --check helpers/import_sources.py tests/test_import_sources.py
• Real synthetic MP4 passed the helper's ffprobe check

I did not make a live Xquik request because no API credential was available. The lookup, rendition selection, media-host boundary, size limits, cleanup, and publication path use offline regression tests.

---

Summary by cubic

Imports online videos into edit sessions with verified filenames and safety checks. Previously agents downloaded manually; now X posts use Xquik for the highest‑bitrate MP4 and other HTTPS URLs use bounded yt-dlp, with strict limits, reuse, and fail‑closed behavior when hard file-size limits aren’t available.

• Adds helpers/import_sources.py; writes to edit/downloads/ and publishes atomically after ffprobe confirms a video stream.
• X posts: parse status ID; call Xquik with X_TWITTER_SCRAPER_API_KEY; accept MP4 only from video.twimg.com; block redirects; stream‑enforce a 500 MiB default cap; never send the API key to the media host.
• Non‑X URLs: preflight rejects x.com/twitter.com lookalikes, embedded credentials, and localhost/non‑global IPs; run yt-dlp with --no-playlist and restricted filenames; stage to a temp dir, enforce a hard child file‑size limit, validate the reported output path/size, and publish atomically; reuse a verified destination if it already exists.
• Fail closed without POSIX file‑size limits: generic imports are unavailable when RLIMIT_FSIZE cannot be set; the helper exits before invoking yt-dlp.
• Failure handling: count bytes when Content‑Length is missing and remove partial files on error. Docs updated; tests cover ID parsing, host checks, redirect/size enforcement, destination reuse, path/size validation, and ffprobe verification.

Rollout

• Export X_TWITTER_SCRAPER_API_KEY to import X posts; not required for other URLs.
• Install yt-dlp for non‑X sources.
• Optional: adjust the size cap with --max-size-mb.

^{Written for commit 0ea7dcd. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>