fix(transcribe): normalize www.-prefixed URLs before validation

graphify/transcribe.py

@@ -47,13 +47,21 @@ def is_url(path: str) -> bool:
     return any(path.startswith(p) for p in URL_PREFIXES)
 
 
+def _normalize_url(url: str) -> str:
+    """Add an HTTPS scheme to URLs that start with ``www.``."""
+    if url.startswith('www.'):
+        return f'https://{url}'
+    return url
+
+
 def download_audio(url: str, output_dir: Path) -> Path:
     """Download audio-only stream from a URL using yt-dlp.
 
     Returns the path to the downloaded audio file (.m4a or .opus).
     Uses cached file if already downloaded.
     """
     from graphify.security import validate_url
+    url = _normalize_url(url)
     validate_url(url)  # blocks private IPs, bad schemes before yt-dlp runs
     yt_dlp = _get_yt_dlp()
     output_dir.mkdir(parents=True, exist_ok=True)

tests/test_transcribe.py

@@ -9,7 +9,9 @@
 
 from graphify.transcribe import (
     VIDEO_EXTENSIONS,
+    _normalize_url,
     build_whisper_prompt,
+    is_url,
     transcribe,
     transcribe_all,
 )
@@ -27,6 +29,33 @@ def test_video_extensions_set():
     assert ".py" not in VIDEO_EXTENSIONS
 
 
+# ---------------------------------------------------------------------------
+# URL handling
+# ---------------------------------------------------------------------------
+
+def test_normalize_url_adds_https_to_www_url():
+    assert _normalize_url("www.youtube.com/watch?v=xyz") == "https://www.youtube.com/watch?v=xyz"
+
+
+@pytest.mark.parametrize("url", [
+    "https://www.youtube.com/watch?v=xyz",
+    "http://www.youtube.com/watch?v=xyz",
+    "videos/lecture.mp4",
+])
+def test_normalize_url_preserves_other_inputs(url):
+    assert _normalize_url(url) == url
+
+
+@pytest.mark.parametrize("value, expected", [
+    ("www.youtube.com/watch?v=xyz", True),
+    ("http://youtube.com/watch?v=xyz", True),
+    ("https://youtube.com/watch?v=xyz", True),
+    ("videos/lecture.mp4", False),
+])
+def test_is_url_preserves_prefix_detection(value, expected):
+    assert is_url(value) is expected
+
+
 # ---------------------------------------------------------------------------
 # build_whisper_prompt
 # ---------------------------------------------------------------------------