feat(commands): add /util download (yt-dlp + ffmpeg 2-pass) and group utility commands

Adds /util download <url> [start] [end] that pulls media via yt-dlp, trims
with ffmpeg if a range is given, and 2-pass compresses to an 8MB budget
(mirroring compress_video.py from
https://github.com/1Git2Clone/dotfiles/blob/main/dot-config/programs/py_scripts/compress_video.py:
bitrate = target_size / duration, pass 1 analysis, pass 2 encode with
audio, ~0.94 muxing margin, 64 kbps sanity floor, skip-if-already-small).
Uploads the result as a Discord attachment — no S3/CDN.

Groups existing utility commands under /util parent (per #34):
- /util avatar (was /avatar)
- /util uptime (was /uptime)
- /util age (was /age)

Old standalone commands remain registered for backward compatibility.

Gated behind new util-download Cargo feature
(util-download = ["dep:ffmpeg-sidecar", "dep:tempfile", "dep:url"])
matching the existing ai-* / redis style.

Security and operational hardening:
- Input validation: validate_url() rejects non-http/https schemes,
  userinfo, private/loopback/link-local IPs (SSRF defense), and
  flag-like -- content in path/query. Domain allowlist restricts to
  yt-dlp-supported social media platforms (YouTube, Facebook,
  Instagram, TikTok, Twitter/X, Reddit, Vimeo).
- validate_timecode() rejects shell metacharacters, spaces, and only
  allows pure digits (seconds) or HH:MM:SS / MM:SS format.
- Async subprocesses: tokio::process::Command + .await so the tokio
  worker thread isn't blocked during ffmpeg encodes.
- Per-subprocess timeouts (yt-dlp: 3m, ffprobe: 30s, trim: 1m, each
  encode pass: 4m) fitting within Discord's 15-min interaction token
  lifetime. Child processes are killed on timeout.
- --no-playlist guard on yt-dlp to reject playlist URLs upfront.
- User-facing error messages via ctx.say() instead of silent ? propagation.
- Cross-platform: /dev/null replaced with a temp file inside temp_dir.
- ffmpeg2pass log paths via -passlogfile pointing inside temp_dir.

5-minute max source duration guard.

Co-authored-by: DeepSeek V4 Pro <service@deepseek.com>

Author: 1Git2Clone

CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- `util-download` Cargo feature — `/util download <url> [start] [end]` downloads media via `yt-dlp`, optionally trims with `ffmpeg`, then 2-pass encodes targeting 8 MB for Discord attachment upload. Requires `yt-dlp` and `ffmpeg` (with `ffprobe`) on `PATH`
+- `/util` parent command group — groups `/avatar`, `/uptime`, `/age`, and `/util download` (when `util-download` is enabled) under a single `/util` parent. The old standalone `/avatar`, `/uptime`, and `/age` commands remain registered for backward compatibility
 - `ai-openrouter` Cargo feature — adds OpenRouter as a persona-chat backend alongside `ai-deepseek`, `ai-ollama`, `ai-anthropic`, `ai-openai`, `ai-google`, and `ai-groq`. Set `AI_API_KEY` to an OpenRouter key and `AI_MODEL` to an OpenRouter model id (e.g. `deepseek/deepseek-chat`)
 
 ### Fixed

Cargo.lock

@@ -49,6 +49,8 @@ redis = { version = "1.2.2", features = [
   "connection-manager",
 ], optional = true }
 jsonwebtoken = { version = "9", optional = true }
+ffmpeg-sidecar = { version = "2.5", optional = true }
+url = { version = "2.5", optional = true }
 
 [features]
 serde = ["dep:serde"]
@@ -73,3 +75,6 @@ ai-openai    = ["ai", "llm/openai"]
 ai-google    = ["ai", "llm/google"]
 ai-groq      = ["ai", "llm/groq"]
 ai-openrouter = ["ai", "llm/openrouter"]
+
+# Download & compress media from URLs (yt-dlp + ffmpeg-sidecar)
+util-download = ["dep:ffmpeg-sidecar", "dep:tempfile", "dep:url"]

Cargo.toml

@@ -63,6 +63,7 @@ configuration, deployment, AI features, and observability.
 - Embed interaction commands: tieup, pat, hug, kiss, slap, punch, bonk, nom, kill, kick, bury, selfbury, peek, avatar, drive, chair, boom, quote
 - XP levelling with a 60-second cooldown, stored in PostgreSQL — `/level` for a member's level, `/toplevels` for the server leaderboard
 - `/reminder` — schedule a DM for later (`create`/`list`/`search`/`delete`), with a saveable default timezone (`/reminder timezone`, per-server or global) and browsable, paginated history
+- `/util` — utility commands: `/util avatar`, `/util uptime`, `/util age`, and `/util download` (when `util-download` feature is enabled)
 - `/age` — your or another member's account creation date
 - `/cookie` — give someone a cookie
 - `/uptime` — bot uptime
@@ -83,6 +84,7 @@ also enables `redis` — and it requires picking exactly one `ai-<backend>`.
 | `ai` | The AI persona and `/ai-review` | Meta-feature: also enables `redis`. Needs a backend (below). |
 | `ai-<backend>` | The AI provider | Exactly one of `ai-deepseek`, `ai-ollama`, `ai-anthropic`, `ai-openai`, `ai-google`, `ai-groq`, `ai-openrouter`. Mandatory when `ai` is on. |
 | `opentelemetry` | OTLP trace export | Point at any OTLP collector; compose ships Tempo + Grafana. |
+| `util-download` | `/util download` — yt-dlp + ffmpeg 2-pass encode targeting 8 MB | Needs `yt-dlp` and `ffmpeg` (with `ffprobe`) on `PATH`. |
 | `tokio_console` | Tokio Console runtime inspection | Needs `RUSTFLAGS="--cfg tokio_unstable"`. |
 
 Building with `--features ai` and no backend stops at a `compile_error!` by

README.md

@@ -45,6 +45,8 @@ the full inventory and handling.
 - `ai` is a meta-feature: enabling it also enables `redis`. It does not pick a
   provider — you must enable exactly one `ai-<backend>`. See the
   [README feature matrix](../README.md#features) and [docs/ai.md](./ai.md).
+- `util-download` needs `yt-dlp` and `ffmpeg` (with `ffprobe`) on `PATH` at
+  runtime. No additional environment variables.
 - `tokio_console` additionally needs `RUSTFLAGS="--cfg tokio_unstable"` at
   build time. See [docs/observability.md](./observability.md).
 - Sharding is opt-in: set all three of `TOTAL_SHARDS`, `SHARD_START`, and

docs/configuration.md

@@ -3,3 +3,4 @@ pub mod embed_commands;
 pub mod general_commands;
 pub mod level_cmds;
 pub mod level_logic;
+pub mod util;

src/commands/mod.rs

@@ -0,0 +1,29 @@
+use crate::prelude::*;
+
+/// Displays your or another user's account creation date
+#[poise::command(discard_spare_arguments, slash_command, prefix_command)]
+#[tracing::instrument(
+    skip(ctx),
+    fields(
+        category = "discord_command",
+        command.name = %ctx.command().name,
+        author = %ctx.author().id,
+        target_user = %user.as_ref().map(|u| u.id.get()).unwrap_or(0),
+        guild_id = %ctx.guild_id().map(GuildId::get).unwrap_or(0),
+    )
+)]
+pub async fn age(
+    ctx: Context<'_>,
+    #[description = "Selected user"] user: Option<serenity::User>,
+) -> Result<(), Error> {
+    let target_replied_user = user
+        .as_ref()
+        .unwrap_or(cmd_utils::get_replied_user(ctx).await);
+    let response = format!(
+        "**{}**'s account was created at {}",
+        target_replied_user.name,
+        target_replied_user.created_at()
+    );
+    ctx.say(response).await?;
+    Ok(())
+}

src/commands/util/age.rs

@@ -0,0 +1,30 @@
+use crate::prelude::*;
+
+/// Get the avatar for someone.
+#[poise::command(discard_spare_arguments, slash_command, prefix_command)]
+#[tracing::instrument(
+    skip(ctx),
+    fields(
+        category = "discord_command",
+        command.name = %ctx.command().name,
+        author = %ctx.author().id,
+        target_user = %user.as_ref().map(|u| u.id.get()).unwrap_or(0),
+        guild_id = %ctx.guild_id().map(GuildId::get).unwrap_or(0),
+    )
+)]
+pub async fn avatar(
+    ctx: Context<'_>,
+    #[description = "Selected user"] user: Option<serenity::User>,
+) -> Result<(), Error> {
+    let target = user
+        .as_ref()
+        .unwrap_or(cmd_utils::get_replied_user(ctx).await);
+
+    let embed = serenity::CreateEmbed::new()
+        .title(format!("**{}**'s avatar:", target.name))
+        .color((255, 0, 0))
+        .image(target.face().replace(".webp", ".png"));
+    ctx.send(poise::CreateReply::default().embed(embed)).await?;
+
+    Ok(())
+}