fix: batch 28 — 40+ audit fixes for v1.5.0 new code

Core modules:
- chapter_gen: non-greedy JSON regex truncated LLM arrays (same class
  as highlights batch 5 fix), input validation on max_chapters
- nlp_command: greedy JSON regex for nested params, route allowlist
  validation on LLM output, word-boundary keyword matching (prevents
  "um" matching "volume"), confidence float coercion safety
- color_match: VideoWriter.isOpened() check, on_progress(100) at end,
  use consolidated run_ffmpeg helper, fix YCrCb channel label order
- auto_zoom: VideoCapture try/finally for resource safety, fix easing
  no-op (_ease(1.0) always returned 1.0), negative fps guard
- loudness_match: use consolidated helper, pass 1 returncode check,
  validate measured values as floats, clamp target_lufs/true_peak
- footage_search: Windows LK_LOCK (was LK_NBLCK), explicit unlock
- multicam: float coercion on start/end, .get() for safe access
- deliverables: round(fps) instead of int(fps) for fractional FPS

Routes:
- nlp: guard parse_command() returning None, LLM provider allowlist
- timeline: safe_float instead of float() on SRT segment pass-through
- captions: import sort fix for ruff compliance

Infrastructure:
- checks.py: consistent bool return types (was Tuple breaking callers)
- user_data.py: remove lock eviction (thread-safety violation)
- cli.py: fix chapters dict access (.get not .attribute), fix
  repeat-detect dict result handling, fix search index/query imports
  (footage_search.index_file not search.index_files)

UXP Panel (5 P0 crash fixes — panel was completely non-functional):
- CSRF header: X-CSRF-Token -> X-OpenCut-Token
- CSRF acquisition: /csrf endpoint -> /health csrf_token field
- Job polling: /jobs/{id} -> /status/{id}
- Job cancel: DELETE /jobs/{id} -> POST /cancel/{id}
- LLM settings: BackendClient.fetch() -> BackendClient.get()
- Version sync to v1.5.1, whisper model selector updated

ExtendScript:
- Smart bins "video" type now matches AV files (was excluding them)
- Temp SRT file cleanup after caption import

Author: SysAdminDoc

Install.ps1

@@ -155,7 +155,7 @@ Write-Host "  \___/| .__/ \___|_| |_|\____\__,_|\__|" -ForegroundColor Cyan
 Write-Host "       |_|                               " -ForegroundColor Cyan
 Write-Host ""
 Write-Host "  Open Source Video Editing Automation" -ForegroundColor DarkGray
-Write-Host "  Installer v1.4.0" -ForegroundColor DarkGray
+Write-Host "  Installer v1.5.1" -ForegroundColor DarkGray
 
 $isAdmin = Test-IsAdmin
 if ($isAdmin) {

OpenCut.iss

@@ -2,7 +2,7 @@
 ; Fully self-contained installer — bundles server exe, ffmpeg, and CEP extension
 
 #define MyAppName "OpenCut"
-#define MyAppVersion "1.4.0"
+#define MyAppVersion "1.5.1"
 #define MyAppPublisher "SysAdminDoc"
 #define MyAppURL "https://github.com/SysAdminDoc/OpenCut"
 

extension/com.opencut.panel/CSXS/manifest.xml

@@ -2,11 +2,11 @@
 <ExtensionManifest xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                    Version="7.0"
                    ExtensionBundleId="com.opencut.panel"
-                   ExtensionBundleVersion="1.5.0"
+                   ExtensionBundleVersion="1.5.1"
                    ExtensionBundleName="OpenCut">
 
     <ExtensionList>
-        <Extension Id="com.opencut.panel.main" Version="1.5.0" />
+        <Extension Id="com.opencut.panel.main" Version="1.5.1" />
     </ExtensionList>
 
     <ExecutionEnvironment>

extension/com.opencut.panel/client/index.html

@@ -2943,7 +2943,7 @@ <h1 class="content-title" id="contentTitle">Cut & Clean</h1>
                     <div class="card-header"><div class="card-title">About OpenCut</div></div>
                     <div class="settings-row">
                         <span class="settings-label">Version</span>
-                        <span class="settings-value">1.5.0</span>
+                        <span class="settings-value">1.5.1</span>
                     </div>
                     <div class="about-links">
                         <a href="https://github.com/SysAdminDoc/opencut" class="about-link" target="_blank">GitHub</a>

extension/com.opencut.panel/client/main.js

@@ -1,5 +1,5 @@
 /* ============================================================
-   OpenCut CEP Panel - Main Controller v1.4.0
+   OpenCut CEP Panel - Main Controller v1.5.1
    6-Tab Professional Toolkit
    ============================================================ */
 (function () {

extension/com.opencut.panel/client/style.css

@@ -1,5 +1,5 @@
 /* ============================================================
-   OpenCut CEP Panel v1.4.0 - ULTRA PREMIUM EDITION
+   OpenCut CEP Panel v1.5.1 - ULTRA PREMIUM EDITION
    Next-Generation AI Editing Suite for Adobe Premiere Pro
    ============================================================ */
 

extension/com.opencut.panel/host/index.jsx

@@ -1939,9 +1939,9 @@ function ocCreateSmartBins(rulesJSON) {
                         try { hasVid = mediaItem.hasVideo(); } catch (e) {}
                         try { hasAud = mediaItem.hasAudio(); } catch (e) {}
                         if (ruleValue === "video") {
-                            matches = hasVid && !hasAud;
+                            matches = hasVid;
                         } else if (ruleValue === "audio") {
-                            matches = !hasVid && hasAud;
+                            matches = hasAud && !hasVid;
                         } else if (ruleValue === "av") {
                             matches = hasVid && hasAud;
                         }
@@ -2070,6 +2070,8 @@ function ocAddNativeCaptionTrack(srtJSON) {
             app.project.importFiles([tempFile.fsName], false, targetBin, false);
         } catch (e) {
             return JSON.stringify({ error: "SRT import failed: " + e.toString() });
+        } finally {
+            try { tempFile.remove(); } catch (e2) {}
         }
 
         return JSON.stringify({ success: true, captions_added: segments.length });

extension/com.opencut.uxp/index.html

@@ -16,7 +16,7 @@
           <path d="M4 2.5a3 3 0 00-1.76 5.43L7.33 11l-5.09 3.07A3 3 0 104.8 19.5a3 3 0 001.76-5.43L8.93 12.6 16.5 17V5L8.93 9.4 6.56 7.93A3 3 0 004 2.5z" fill="var(--accent)"/>
         </svg>
         <span class="oc-logo">OpenCut</span>
-        <span class="oc-version">v1.4.0</span>
+        <span class="oc-version">v1.5.1</span>
       </div>
       <div class="oc-header-right">
         <div class="oc-connection" id="connectionStatus" title="Backend connection status">
@@ -175,7 +175,10 @@
                 <option value="tiny">tiny (fastest)</option>
                 <option value="base">base</option>
                 <option value="small">small</option>
-                <option value="medium" selected>medium (recommended)</option>
+                <option value="medium">medium</option>
+                <option value="turbo" selected>turbo (recommended)</option>
+                <option value="distil-large-v3.5">distil-large-v3.5 (fast+accurate)</option>
+                <option value="distil-large-v3">distil-large-v3</option>
                 <option value="large-v2">large-v2</option>
                 <option value="large-v3">large-v3 (best)</option>
               </select>

extension/com.opencut.uxp/main.js

@@ -23,7 +23,7 @@ const BACKEND_DEFAULT  = "http://127.0.0.1:5679";
 const BACKEND_MAX_PORT = 5689;
 const POLL_INTERVAL_MS = 1200;
 const HEALTH_CHECK_MS  = 8000;
-const VERSION          = "1.5.0";
+const VERSION          = "1.5.1";
 
 async function detectBackend() {
   // Try ports 5679-5689 like CEP panel does
@@ -185,7 +185,7 @@ const BackendClient = (() => {
   async function call(method, endpoint, body = null) {
     const url = BACKEND + endpoint;
     const headers = { "Content-Type": "application/json" };
-    if (csrfToken) headers["X-CSRF-Token"] = csrfToken;
+    if (csrfToken) headers["X-OpenCut-Token"] = csrfToken;
 
     const opts = { method, headers };
     if (body && method !== "GET") opts.body = JSON.stringify(body);
@@ -232,13 +232,13 @@ const BackendClient = (() => {
    * Fetch CSRF token from /csrf or /api/csrf.
    */
   async function fetchCsrf() {
-    const r = await get("/csrf");
-    if (r.ok && r.data && r.data.token) {
-      csrfToken = r.data.token;
+    const r = await get("/health");
+    if (r.ok && r.data && r.data.csrf_token) {
+      csrfToken = r.data.csrf_token;
     }
   }
 
-  return { call, get, post, del, checkHealth, fetchCsrf };
+  return { call, get, post, del: del, checkHealth, fetchCsrf };
 })();
 
 // ─────────────────────────────────────────────────────────────
@@ -273,7 +273,7 @@ const JobPoller = (() => {
   }
 
   async function pollJob(jobId, onProgress, onComplete, onError) {
-    const r = await BackendClient.get(`/jobs/${jobId}`);
+    const r = await BackendClient.get(`/status/${jobId}`);
     if (!r.ok) {
       onError(r.error ?? "Polling error");
       activeJobId = null;
@@ -309,7 +309,7 @@ const JobPoller = (() => {
 
   async function cancel() {
     if (!activeJobId) return;
-    await BackendClient.del(`/jobs/${activeJobId}`);
+    await BackendClient.post(`/cancel/${activeJobId}`, {});
     activeJobId = null;
   }
 
@@ -1372,7 +1372,9 @@ function pad(n) { return String(n).padStart(2, "0"); }
 // ─────────────────────────────────────────────────────────────
 async function checkConnection() {
   UIController.setConnection("connecting");
-  const alive = await BackendClient.checkHealth();
+  const r = await BackendClient.get("/health");
+  const alive = r.ok;
+  if (alive && r.data?.csrf_token) csrfToken = r.data.csrf_token;
   UIController.setConnection(alive ? "connected" : "disconnected");
   if (alive) {
     UIController.setStatus("Server online");
@@ -1507,15 +1509,15 @@ function bindSliders() {
 // ─────────────────────────────────────────────────────────────
 async function loadLlmSettings() {
   try {
-    const resp = await BackendClient.fetch("GET", "/settings/llm");
-    if (resp && !resp.error) {
+    const resp = await BackendClient.get("/settings/llm");
+    if (resp.ok && resp.data) {
       // Store globally for use in feature functions
-      window._llmSettings = resp;
+      window._llmSettings = resp.data;
       // If there's a provider select in settings tab, populate it
       const provSel = document.getElementById("llmProvider");
-      if (provSel && resp.provider) provSel.value = resp.provider;
+      if (provSel && resp.data.provider) provSel.value = resp.data.provider;
       const modInp = document.getElementById("llmModel");
-      if (modInp && resp.model) modInp.value = resp.model;
+      if (modInp && resp.data.model) modInp.value = resp.data.model;
     }
   } catch (e) {
     console.warn("Could not load LLM settings:", e);

extension/com.opencut.uxp/manifest.json

@@ -1,7 +1,7 @@
 {
   "id": "com.opencut.uxp",
   "name": "OpenCut UXP",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "main": "index.html",
   "host": [
     {