# Contributor handoff — harry0703/MoneyPrinterTurbo

> Canonical page: https://codevetter.com/unpack/moneyprinterturbo/agent-handoff

# Contributor handoff — harry0703/MoneyPrinterTurbo

Scanned commit 3d5f4e421927d61f3eac729cf4b711ac0b69d688 (2026-09-21). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Start at app/services/task.py (_run_pipeline is the shared spine), app/models/schema.py (VideoParams), and app/config/config.py (global config + locking). All three frontends must stay behaviorally identical — comments throughout document past drift bugs where a value list or check existed in only one entrypoint. Tests run via uv + pytest with a 70% branch-coverage floor; ruff lints the same file set as coverage. Preserve the security invariants: path confinement, optional auth, no secrets in logs, and never resurrecting deleted task records.
- Read first: app/services/task.py (pipeline + failure semantics), app/models/schema.py (VideoParams and request models), app/config/config.py (config load/save/locks), cli.py's top constant block, and the relevant section of webui/Main.py before editing any pipeline-adjacent code. — [app/services/task.py](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/services/task.py) [app/models/schema.py](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/models/schema.py) [app/config/config.py](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/config/config.py)
- Test commands: `uv sync --frozen` then `uv run python -X utf8 -m pytest -q test`; coverage parity with CI is `coverage run -m pytest -q test` + `coverage report` (fail_under=70, branch mode); lint with `ruff check app cli.py main.py webui test docs/skill`. — [test/README.md#L14-38](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/test/README.md#L14-L38) [pyproject.toml#L58-72](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/pyproject.toml#L58-L72) [.github/workflows/ci.yml](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/.github/workflows/ci.yml)
- Keep value lists synchronized across cli.py constants (_CLI_VIDEO_SOURCES, _SUBTITLE_POSITION_VALUES, _CLI_MUSIC_BGM_TYPES), app/models/schema.py enums, app/services/video.py render branches, webui/Main.py dropdowns, and docs/skill/mpt_agent.py SUPPORTED_SOURCES — inline comments explicitly cite past bugs caused by drift. — [cli.py#L33-51](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/cli.py#L33-L51) [cli.py#L176-202](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/cli.py#L176-L202) [docs/skill/mpt_agent.py](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/docs/skill/mpt_agent.py)
- Any new file-serving or file-accepting endpoint must go through file_security.resolve_path_within_directory and _sanitize_upload_filename-style normalization — never join user paths directly; the /tasks StaticFiles mount is guarded by middleware, not router dependencies. — [app/utils/file_security.py](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/utils/file_security.py) [app/controllers/v1/video.py#L72-97](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/controllers/v1/video.py#L72-L97) [app/asgi.py#L258-275](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/asgi.py#L258-L275)
- Task state writes must use sm.state.update_task (create/overwrite) vs patch_task (merge-only, safe against deleted tasks) correctly — redis_manager and cross-post code rely on patch_task's Lua atomicity to avoid resurrecting deleted tasks. — [app/services/state.py#L81-90](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/services/state.py#L81-L90) [app/services/state.py#L185-202](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/services/state.py#L185-L202) [app/controllers/manager/redis_manager.py#L89-128](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/controllers/manager/redis_manager.py#L89-L128)
- WebUI config writes must use update_config_nonblocking/delete_config_nonblocking/try_save_config — direct config.toml or config.<section> writes bypass the pending-update queue and can deadlock a page against runtime_config_lock held by a running task. — [app/config/config.py#L91-308](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/config/config.py#L91-L308) [webui/Main.py#L309-341](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/webui/Main.py#L309-L341)
- Never log credentials: material.py's _redact_secret/_redact_request_error, llm.py's _sanitize_error_message, and the asgi lifespan's 'log only that auth is enabled' pattern are deliberate conventions to extend, not bypass. — [app/services/material.py#L193-226](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/services/material.py#L193-L226) [app/services/llm.py#L187-201](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/services/llm.py#L187-L201) [app/asgi.py#L26-37](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/asgi.py#L26-L37)
- Custom audio file paths are intentionally asymmetric: HTTP/WebUI callers are confined to the task directory; only the CLI passes allow_server_file_input=True — do not widen this for API callers. — [app/services/task.py#L364-420](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/services/task.py#L364-L420) [cli.py](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/cli.py)
- VideoParams defaults that read config.ui are frozen at import time; changing [ui] handling must account for the fact that cli.py deliberately duplicates these defaults to keep CLI behavior stable under invalid saved values. — [app/models/schema.py#L140-149](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/models/schema.py#L140-L149) [cli.py#L24-32](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/cli.py#L24-L32)
- Edge subtitle failures must NOT auto-fallback to Whisper (would trigger a multi-GB model download); Whisper loads only on explicit subtitle_provider='whisper' — preserve this when touching subtitle logic. — [app/services/task.py#L600-635](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/services/task.py#L600-L635) [config.example.toml#L426-429](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/config.example.toml#L426-L429)
- Code comments are predominantly Chinese (with some English); docstrings and comments carry unusually detailed rationale for past fixes — match this style and keep the explanations when editing. (inferred) — [app/services/task.py](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/services/task.py) [app/config/config.py](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/config/config.py) [app/controllers/v1/video.py](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/controllers/v1/video.py)
- Dependencies: pyproject.toml is the source of truth pinned by uv.lock, but requirements.txt must be manually kept in sync for Dockerfile/legacy pip builds — check both when bumping. — [pyproject.toml#L1-3](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/pyproject.toml#L1-L3) [requirements.txt#L1](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/requirements.txt#L1) [Dockerfile#L83-92](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/Dockerfile#L83-L92)
- Edge cases documented in code that are easy to regress: config.toml may be a directory (load_config rmtree's it), TOML may have repeated UTF-8 BOMs, queue limits may arrive as TOML strings/floats (handled by _coerce_task_limit), and dequeue must never throw inside the task_done→check_queue chain. — [app/config/config.py#L423-473](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/config/config.py#L423-L473) [app/controllers/manager/base_manager.py#L12-38](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/controllers/manager/base_manager.py#L12-L38) [app/controllers/manager/redis_manager.py#L50-104](https://github.com/harry0703/MoneyPrinterTurbo/blob/3d5f4e421927d61f3eac729cf4b711ac0b69d688/app/controllers/manager/redis_manager.py#L50-L104)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)