# Convertoor

A small web app that lets a user upload audio, video, or image files, describe an edit in plain English, and have a Zen-powered agent complete it using only `ffmpeg` and ImageMagick (`magick`) commands.

## Requirements

- Node.js 22+
- `ffmpeg`
- ImageMagick (`magick`)
- `ZEN_API_KEY`

## Run

```bash
npm install
ZEN_API_KEY=your_key_here npm start
```

Then open `http://localhost:3000`.

Optionally set `ZEN_MODEL` if you want a different Zen model and `ZEN_BASE_URL` if you need a non-default endpoint.

## Notes

- Uploaded files and generated outputs are stored in `data/<session-id>/`.
- The backend never shells out through bash. It only spawns `ffmpeg` and `magick` directly.
- Command arguments are restricted to the per-job workspace so the agent cannot read or write outside the upload session.
- Uploads are validated server-side to only accept audio, video, and image MIME types.
- FFmpeg is run with a restricted protocol allowlist and blocked file-driven/script-like flags.
- ImageMagick is run with a local restrictive `policy.xml` in [config/imagemagick/policy.xml](/home/pavel/convertoor/config/imagemagick/policy.xml).
- Commands are killed after 60 seconds and final outputs larger than 250 MB are rejected.