init

README.md

@@ -0,0 +1,31 @@
+# Convertoor
+
+A small web app that lets a user upload audio, video, or image files, describe an edit in plain English, and have a Zen-powered agent complete it using only `ffmpeg` and ImageMagick (`magick`) commands.
+
+## Requirements
+
+- Node.js 22+
+- `ffmpeg`
+- ImageMagick (`magick`)
+- `ZEN_API_KEY`
+
+## Run
+
+```bash
+npm install
+ZEN_API_KEY=your_key_here npm start
+```
+
+Then open `http://localhost:3000`.
+
+Optionally set `ZEN_MODEL` if you want a different Zen model and `ZEN_BASE_URL` if you need a non-default endpoint.
+
+## Notes
+
+- Uploaded files and generated outputs are stored in `data/<session-id>/`.
+- The backend never shells out through bash. It only spawns `ffmpeg` and `magick` directly.
+- Command arguments are restricted to the per-job workspace so the agent cannot read or write outside the upload session.
+- Uploads are validated server-side to only accept audio, video, and image MIME types.
+- FFmpeg is run with a restricted protocol allowlist and blocked file-driven/script-like flags.
+- ImageMagick is run with a local restrictive `policy.xml` in [config/imagemagick/policy.xml](/home/pavel/convertoor/config/imagemagick/policy.xml).
+- Commands are killed after 60 seconds and final outputs larger than 250 MB are rejected.