Release v0.6.0 · zlatkoc/youtube-summarize

Security

Section-header spoofing fixed (#10): transcript text and video metadata (title, channel, description) are author-controlled input, but were interpolated verbatim into the labeled sections of get_transcript / summarize_transcript output — a caption line reading [INSTRUCTIONS] was indistinguishable from the genuine header. Such lines are now escaped (\[INSTRUCTIONS]); timestamp prefixes like [00:12:34] are unaffected.

list_playlist_videos now honors order="desc" with the default sort_by="index" (previously silently ignored), and fetches the full playlist in that case so limit returns the true tail (#10)
youtube.com/live/ and youtube-nocookie.com/embed/ URLs are now recognized (#10)
The transcript client is constructed per call instead of sharing one requests.Session across the thread pool's concurrent tool calls (#12)
yt-dlp failures (metadata, playlist, search) now report their cause instead of a bare "Failed to fetch", so clients can distinguish rate-limits from bad IDs and decide whether to retry (#13)
get_video_metadata truncates the description at 2000 chars instead of returning it unbounded (#13)

New CI workflow runs the new 52-test suite (pure helpers, protobuf sp encoding, playlist sorting, error paths) on every push and PR (#10)
server.json is only bumped on main after the PyPI publish succeeds (#11)
youtube-transcript-api capped at <2 to protect the error handler's exception imports (#13)

No MCP tool names or parameters changed — fully compatible with existing clients.