From ca584e16927ad120c2f83d4f9c8abb5c902370f7 Mon Sep 17 00:00:00 2001
From: Florian <52180080+florianjs@users.noreply.github.com>
Date: Mon, 9 Nov 2026 16:02:01 +0100
Subject: [PATCH 1/3] feat(upload): upload assistant in the browser and as a
 cli

One file or folder in, a published torrent out: private .torrent with the
personal announce URL (info hash kept by the tracker, so the uploader seeds
the local file), MediaInfo, screenshots hosted on Pixhost (adult flag),
and a BBCode description in one of 8 languages.

- shared core: isomorphic torrent builder, MediaInfo summary, release name
  parser, BBCode description builder
- web page /upload/assistant: mediainfo.js, screenshots with the browser
  decoder and an ffmpeg.wasm fallback (WORKERFS, PNG then JPEG), WebCrypto
  hashing, edit, preview, publish
- CLI tools/upload-cli bundled by esbuild at build time and served at
  /tools/trackarr-upload.mjs (Node 20+, ffmpeg, mediainfo)
- descriptions render BBCode (escaped, whitelisted tags, http(s) only) or
  Markdown; limit raised to 50,000 characters
- server: API key auth (Bearer) for uploads, assistant config endpoint,
  screenshot relay to Pixhost; CSP allows wasm and blob: media/images

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .gitignore                                    |   3 +
 README.md                                     |   1 +
 app/components/EditTorrentModal.vue           |   2 +-
 app/components/StepLine.vue                   |  46 ++
 app/components/UploadTorrentModal.vue         |   9 +-
 app/pages/index.vue                           |   3 +
 app/pages/torrents/[hash].vue                 |  33 +-
 app/pages/upload/assistant.vue                | 575 ++++++++++++++++++
 app/utils/markdown.ts                         |  13 +
 app/utils/uploadAssistant/files.ts            |  86 +++
 app/utils/uploadAssistant/hash.ts             |  29 +
 app/utils/uploadAssistant/media.ts            | 202 ++++++
 doc/.vitepress/config.ts                      |   1 +
 doc/guide/getting-started.md                  |   1 +
 doc/guide/upload-assistant.md                 |  56 ++
 doc/reference/env.md                          |   8 +
 i18n/locales/de/assistant.json                |  59 ++
 i18n/locales/en/assistant.json                |  59 ++
 i18n/locales/es/assistant.json                |  59 ++
 i18n/locales/fr/assistant.json                |  59 ++
 i18n/locales/it/assistant.json                |  59 ++
 i18n/locales/ja/assistant.json                |  59 ++
 i18n/locales/ru/assistant.json                |  59 ++
 i18n/locales/zh/assistant.json                |  59 ++
 nuxt.config.ts                                |   8 +-
 package-lock.json                             |  59 ++
 package.json                                  |   7 +
 scripts/build-cli.mjs                         |  18 +
 server/api/torrents/[hash]/index.patch.ts     |   2 +-
 server/api/torrents/index.post.ts             |   8 +-
 server/api/upload-assistant/config.get.ts     |  36 ++
 .../api/upload-assistant/screenshot.post.ts   |  43 ++
 server/utils/csp.ts                           |  10 +-
 server/utils/pixhost.ts                       |  48 ++
 server/utils/schemas.ts                       |   2 +-
 server/utils/uploaderAuth.ts                  |  57 ++
 shared/utils/bbcode.ts                        | 220 +++++++
 shared/utils/release/description.ts           | 190 ++++++
 shared/utils/release/labels.ts                |  97 +++
 shared/utils/release/mediainfo.ts             | 167 +++++
 shared/utils/release/releaseName.ts           |  63 ++
 shared/utils/release/torrent.ts               | 150 +++++
 tests/csp.test.ts                             |   5 +-
 tests/upload-assistant.test.ts                | 270 ++++++++
 tools/upload-cli/main.ts                      | 359 +++++++++++
 45 files changed, 3345 insertions(+), 14 deletions(-)
 create mode 100644 app/components/StepLine.vue
 create mode 100644 app/pages/upload/assistant.vue
 create mode 100644 app/utils/uploadAssistant/files.ts
 create mode 100644 app/utils/uploadAssistant/hash.ts
 create mode 100644 app/utils/uploadAssistant/media.ts
 create mode 100644 doc/guide/upload-assistant.md
 create mode 100644 i18n/locales/de/assistant.json
 create mode 100644 i18n/locales/en/assistant.json
 create mode 100644 i18n/locales/es/assistant.json
 create mode 100644 i18n/locales/fr/assistant.json
 create mode 100644 i18n/locales/it/assistant.json
 create mode 100644 i18n/locales/ja/assistant.json
 create mode 100644 i18n/locales/ru/assistant.json
 create mode 100644 i18n/locales/zh/assistant.json
 create mode 100644 scripts/build-cli.mjs
 create mode 100644 server/api/upload-assistant/config.get.ts
 create mode 100644 server/api/upload-assistant/screenshot.post.ts
 create mode 100644 server/utils/pixhost.ts
 create mode 100644 server/utils/uploaderAuth.ts
 create mode 100644 shared/utils/bbcode.ts
 create mode 100644 shared/utils/release/description.ts
 create mode 100644 shared/utils/release/labels.ts
 create mode 100644 shared/utils/release/mediainfo.ts
 create mode 100644 shared/utils/release/releaseName.ts
 create mode 100644 shared/utils/release/torrent.ts
 create mode 100644 tests/upload-assistant.test.ts
 create mode 100644 tools/upload-cli/main.ts

diff --git a/.gitignore b/.gitignore
index 3618abae..fb865be0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -59,3 +59,6 @@ documentation/
 # Test output
 coverage/
 .vitest/
+
+# Upload CLI, bundled at build (scripts/build-cli.mjs)
+public/tools/trackarr-upload.mjs
diff --git a/README.md b/README.md
index 39a9052a..21c6bf24 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,7 @@ Built with Nuxt 4 • Rust • PostgreSQL • Redis
 | Forum, comments, reports, invitations, H&R    | UI in 8 languages (EN, FR, ES, DE, IT, ZH, JA, RU)  |
 | Private messages between members, with blocks | Light & dark themes, ⌘K command palette             |
 | Paid sign-up in Bitcoin, Monero or Solana     | On-chain payment checks, no processor, no spend key |
+| Upload assistant: .torrent, MediaInfo, screens, BBCode | Web or CLI, one file or folder in, published torrent out |
 
 | **Security**                     | **Emergency**                                |
 | -------------------------------- | -------------------------------------------- |
diff --git a/app/components/EditTorrentModal.vue b/app/components/EditTorrentModal.vue
index b0d8dbaa..e4ec9af9 100644
--- a/app/components/EditTorrentModal.vue
+++ b/app/components/EditTorrentModal.vue
@@ -267,7 +267,7 @@ const error = ref<string | null>(null);
 const { data: categories } = await useFetch<Category[]>('/api/categories');
 
 const renderedDescription = computed(() => {
-  return renderMarkdown(description.value);
+  return renderDescription(description.value);
 });
 
 // Initialize form data when torrent prop changes
diff --git a/app/components/StepLine.vue b/app/components/StepLine.vue
new file mode 100644
index 00000000..ee5a857a
--- /dev/null
+++ b/app/components/StepLine.vue
@@ -0,0 +1,46 @@
+<template>
+  <div class="flex items-center gap-3">
+    <Icon :name="icon" class="shrink-0" :class="[iconClass, state === 'running' ? 'animate-spin' : '']" />
+    <div class="flex-1 min-w-0">
+      <div class="flex items-center justify-between gap-3">
+        <span :class="state === 'skipped' ? 'text-text-muted' : 'text-text-primary'">{{ label }}</span>
+        <span v-if="detail" class="text-xs text-text-muted truncate">{{ detail }}</span>
+      </div>
+      <div v-if="progress !== undefined && state === 'running'" class="mt-1 w-full bg-bg-tertiary rounded-full h-1">
+        <div class="bg-text-primary h-1 rounded-full transition-all" :style="{ width: `${progress}%` }" />
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+/** One line of a multi-step task: icon for its state, optional detail and progress */
+const props = defineProps<{
+  label: string;
+  state: 'idle' | 'running' | 'done' | 'skipped' | 'error';
+  detail?: string;
+  progress?: number;
+}>();
+
+const icon = computed(
+  () =>
+    ({
+      idle: 'ph:circle',
+      running: 'ph:spinner',
+      done: 'ph:check-circle',
+      skipped: 'ph:minus-circle',
+      error: 'ph:warning-circle',
+    })[props.state]
+);
+
+const iconClass = computed(
+  () =>
+    ({
+      idle: 'text-text-muted',
+      running: 'text-text-primary',
+      done: 'text-success',
+      skipped: 'text-text-muted',
+      error: 'text-red-400',
+    })[props.state]
+);
+</script>
diff --git a/app/components/UploadTorrentModal.vue b/app/components/UploadTorrentModal.vue
index fd2e6861..23390c3e 100644
--- a/app/components/UploadTorrentModal.vue
+++ b/app/components/UploadTorrentModal.vue
@@ -20,6 +20,13 @@
               {{ t('upload.title') }}
             </h3>
           </div>
+          <NuxtLink
+            to="/upload/assistant"
+            class="ml-auto mr-3 text-xs text-text-muted hover:text-text-primary underline underline-offset-2"
+            @click="close"
+          >
+            {{ t('assistant.entry') }}
+          </NuxtLink>
           <button
             class="text-text-muted hover:text-white transition-colors"
             :aria-label="t('common.close')"
@@ -422,7 +429,7 @@ async function copyAnnounce() {
 const { data: categories } = await useFetch('/api/categories');
 
 const renderedDescription = computed(() => {
-  return renderMarkdown(description.value);
+  return renderDescription(description.value);
 });
 
 function getFlattenedCategories(
diff --git a/app/pages/index.vue b/app/pages/index.vue
index 57b0b9c0..59f5ad86 100644
--- a/app/pages/index.vue
+++ b/app/pages/index.vue
@@ -20,6 +20,9 @@
         <NuxtLink to="/torrents" class="btn btn-secondary">
           <Icon name="ph:files" aria-hidden="true" />{{ t('dashboard.browse') }}
         </NuxtLink>
+        <NuxtLink to="/upload/assistant" class="btn btn-secondary">
+          <Icon name="ph:magic-wand" aria-hidden="true" />{{ t('assistant.entry') }}
+        </NuxtLink>
         <button type="button" class="btn btn-primary" @click="showUpload = true">
           <Icon name="ph:upload-simple" aria-hidden="true" />{{ t('dashboard.upload') }}
         </button>
diff --git a/app/pages/torrents/[hash].vue b/app/pages/torrents/[hash].vue
index 0c8390df..cc3635ef 100644
--- a/app/pages/torrents/[hash].vue
+++ b/app/pages/torrents/[hash].vue
@@ -307,7 +307,7 @@ const externalLinks = computed(() => {
   return links;
 });
 
-const renderedDescription = computed(() => renderMarkdown(torrent.value?.description));
+const renderedDescription = computed(() => renderDescription(torrent.value?.description));
 
 async function copyHash() {
   await navigator.clipboard.writeText(torrent.value!.infoHash).catch(() => {});
@@ -406,4 +406,35 @@ async function deleteTorrent() {
   border-left: 2px solid rgb(var(--line-strong));
   padding-left: 0.75rem;
 }
+/* BBCode: screenshots side by side, spoilers, MediaInfo report */
+.description-content :deep(a > img) {
+  display: inline-block;
+  margin: 0.25rem;
+  vertical-align: middle;
+}
+.description-content :deep(details) {
+  margin-bottom: 0.75rem;
+  border: 1px solid rgb(var(--line));
+  border-radius: 4px;
+  padding: 0.5rem 0.75rem;
+}
+.description-content :deep(summary) {
+  cursor: pointer;
+  font-weight: 600;
+  color: rgb(var(--ink));
+}
+.description-content :deep(details[open] > summary) {
+  margin-bottom: 0.5rem;
+}
+.description-content :deep(pre) {
+  overflow-x: auto;
+  white-space: pre;
+  font-size: 0.8em;
+  line-height: 1.4;
+}
+.description-content :deep(cite) {
+  display: block;
+  font-style: normal;
+  font-weight: 600;
+}
 </style>
diff --git a/app/pages/upload/assistant.vue b/app/pages/upload/assistant.vue
new file mode 100644
index 00000000..69be9bb1
--- /dev/null
+++ b/app/pages/upload/assistant.vue
@@ -0,0 +1,575 @@
+<template>
+  <div class="max-w-5xl mx-auto">
+    <div class="mb-6">
+      <h2 class="text-2xl font-semibold tracking-tight text-text-primary">{{ t('assistant.title') }}</h2>
+      <p class="text-sm text-text-muted mt-0.5">{{ t('assistant.subtitle') }}</p>
+    </div>
+
+    <!-- 1. Files -->
+    <div
+      v-if="!picked"
+      class="card mb-6 border-dashed transition-colors"
+      :class="dragging ? 'border-text-primary bg-bg-secondary' : ''"
+      @dragover.prevent="dragging = true"
+      @dragleave.prevent="dragging = false"
+      @drop.prevent="onDrop"
+    >
+      <div class="card-body py-12 text-center space-y-4">
+        <Icon name="ph:upload-simple" class="text-4xl text-text-muted mx-auto" />
+        <p class="text-sm text-text-primary">{{ t('assistant.drop') }}</p>
+        <div class="flex flex-wrap justify-center gap-3">
+          <label class="btn btn-primary cursor-pointer">
+            <Icon name="ph:file-video" aria-hidden="true" />{{ t('assistant.pickFile') }}
+            <input type="file" class="sr-only" @change="onPick($event)" />
+          </label>
+          <label class="btn cursor-pointer">
+            <Icon name="ph:folder-simple" aria-hidden="true" />{{ t('assistant.pickFolder') }}
+            <input type="file" class="sr-only" webkitdirectory multiple @change="onPick($event)" />
+          </label>
+        </div>
+        <label class="inline-flex items-center gap-2 text-xs text-text-muted">
+          <input v-model="form.adult" type="checkbox" />
+          {{ t('assistant.adult') }}
+        </label>
+        <p class="text-xs text-text-muted">{{ t('assistant.private') }}</p>
+      </div>
+    </div>
+
+    <template v-else>
+      <!-- Release overview and progress -->
+      <div class="card mb-6">
+        <div class="card-header flex items-center justify-between gap-3">
+          <div class="flex items-center gap-2 min-w-0">
+            <Icon :name="picked.folder ? 'ph:folder-simple' : 'ph:file-video'" class="text-text-muted shrink-0" />
+            <h3 class="text-sm font-medium text-text-primary truncate">{{ picked.name }}</h3>
+          </div>
+          <button type="button" class="btn-ghost text-xs px-2 py-1 rounded" :disabled="publishing" @click="reset">
+            {{ t('assistant.change') }}
+          </button>
+        </div>
+        <div class="card-body space-y-3 text-sm">
+          <p class="text-text-muted">
+            {{ t('assistant.fileCount', { count: picked.files.length, size: formatSize(picked.totalSize, sizeLang) }, picked.files.length) }}
+          </p>
+          <StepLine :label="t('assistant.steps.mediainfo')" :state="steps.mediainfo" :detail="mediaError" />
+          <StepLine
+            :label="t('assistant.steps.screenshots')"
+            :state="steps.screenshots"
+            :detail="shotsDetail"
+          />
+          <StepLine
+            :label="t('assistant.steps.hash')"
+            :state="steps.hash"
+            :progress="hashProgress"
+            :detail="hashError"
+          />
+        </div>
+      </div>
+
+      <!-- Screenshots -->
+      <div v-if="shots.length" class="card mb-6">
+        <div class="card-header">
+          <h3 class="text-sm font-medium text-text-primary">{{ t('assistant.screenshots') }}</h3>
+        </div>
+        <div class="card-body">
+          <p class="text-xs text-text-muted mb-3">{{ t('assistant.screenshotsHint') }}</p>
+          <div class="grid grid-cols-2 md:grid-cols-3 gap-3">
+            <label
+              v-for="(shot, i) in shots"
+              :key="shot.url"
+              class="relative block rounded overflow-hidden border cursor-pointer"
+              :class="shot.selected ? 'border-text-primary' : 'border-border opacity-40'"
+            >
+              <img :src="shot.url" alt="" class="w-full aspect-video object-cover" />
+              <input v-model="shot.selected" type="checkbox" class="absolute top-2 left-2" :aria-label="t('assistant.useShot', { n: i + 1 })" />
+              <span class="absolute bottom-1 right-1 text-[10px] px-1.5 py-0.5 rounded bg-scrim/70 text-paper">
+                <Icon v-if="shot.state === 'uploading'" name="ph:spinner" class="animate-spin align-[-1px]" />
+                <Icon v-else-if="shot.state === 'hosted'" name="ph:cloud-check" class="align-[-1px]" />
+                <Icon v-else-if="shot.state === 'error'" name="ph:warning" class="align-[-1px]" />
+              </span>
+            </label>
+          </div>
+        </div>
+      </div>
+
+      <!-- Details -->
+      <div class="card mb-6">
+        <div class="card-header">
+          <h3 class="text-sm font-medium text-text-primary">{{ t('assistant.details') }}</h3>
+        </div>
+        <div class="card-body grid gap-4 md:grid-cols-2">
+          <label class="block md:col-span-2">
+            <span :class="labelClass">{{ t('assistant.name') }}</span>
+            <input v-model="form.name" type="text" maxlength="255" :class="inputClass" />
+          </label>
+          <label class="block">
+            <span :class="labelClass">{{ t('assistant.category') }}</span>
+            <select v-model="form.categoryId" :class="inputClass">
+              <option value="">{{ t('assistant.noCategory') }}</option>
+              <option v-for="c in categoryOptions" :key="c.id" :value="c.id">{{ c.label }}</option>
+            </select>
+          </label>
+          <label class="block">
+            <span :class="labelClass">{{ t('assistant.language') }}</span>
+            <select v-model="form.lang" :class="inputClass">
+              <option v-for="l in DESCRIPTION_LANGUAGES" :key="l" :value="l">{{ languageLabel(l) }}</option>
+            </select>
+          </label>
+          <label class="block">
+            <span :class="labelClass">{{ t('assistant.releaseTitle') }}</span>
+            <input v-model="form.title" type="text" :class="inputClass" />
+          </label>
+          <div class="grid grid-cols-3 gap-2">
+            <label v-for="id in (['imdbId', 'tmdbId', 'tvdbId'] as const)" :key="id" class="block">
+              <span :class="labelClass">{{ t(`assistant.ids.${id}`) }}</span>
+              <input v-model="form[id]" type="text" :class="inputClass" />
+            </label>
+          </div>
+          <div v-if="config?.tags.length" class="md:col-span-2">
+            <span :class="labelClass">{{ t('assistant.tags') }}</span>
+            <div class="flex flex-wrap gap-2">
+              <label
+                v-for="tag in config.tags"
+                :key="tag.id"
+                class="text-xs px-2 py-1 rounded border cursor-pointer"
+                :class="form.tagIds.includes(tag.id) ? 'border-text-primary text-text-primary' : 'border-border text-text-muted'"
+              >
+                <input v-model="form.tagIds" type="checkbox" :value="tag.id" class="sr-only" />
+                {{ tag.name }}
+              </label>
+            </div>
+          </div>
+          <label class="block md:col-span-2">
+            <span :class="labelClass">{{ t('assistant.notes') }}</span>
+            <textarea v-model="form.notes" rows="2" :class="inputClass" />
+          </label>
+        </div>
+      </div>
+
+      <!-- Description -->
+      <div class="card mb-6">
+        <div class="card-header flex items-center justify-between gap-3">
+          <h3 class="text-sm font-medium text-text-primary">{{ t('assistant.description') }}</h3>
+          <div class="flex items-center gap-2">
+            <button v-if="descriptionEdited" type="button" class="btn-ghost text-xs px-2 py-1 rounded" @click="regenerate">
+              {{ t('assistant.regenerate') }}
+            </button>
+            <button type="button" class="btn-ghost text-xs px-2 py-1 rounded" @click="copyDescription">
+              <Icon :name="copied ? 'ph:check' : 'ph:copy'" class="align-[-2px]" />
+              {{ t('assistant.copyBbcode') }}
+            </button>
+          </div>
+        </div>
+        <div class="card-body grid gap-4 lg:grid-cols-2">
+          <textarea
+            :value="description"
+            rows="18"
+            spellcheck="false"
+            :class="inputClass"
+            class="font-mono text-xs"
+            @input="onDescriptionInput"
+          />
+          <ClientOnly>
+            <div class="description-preview text-sm text-text-secondary border border-border rounded p-3 overflow-auto max-h-[28rem]" v-html="preview" />
+          </ClientOnly>
+        </div>
+      </div>
+
+      <!-- Publish -->
+      <div class="card mb-6">
+        <div class="card-body space-y-3">
+          <div v-if="published" class="p-3 rounded border border-success/30 bg-success/10 text-sm space-y-2">
+            <p class="text-success font-medium">
+              <Icon name="ph:check-circle" class="align-[-2px]" />
+              {{ published.existing ? t('assistant.alreadyExists') : t('assistant.published') }}
+            </p>
+            <p class="text-text-muted">{{ t('assistant.seedHint') }}</p>
+            <div class="flex flex-wrap gap-3">
+              <button type="button" class="btn btn-primary" @click="downloadTorrent">
+                <Icon name="ph:download-simple" aria-hidden="true" />{{ t('assistant.download') }}
+              </button>
+              <NuxtLink :to="`/torrents/${published.infoHash}`" class="btn">{{ t('assistant.open') }}</NuxtLink>
+            </div>
+          </div>
+          <template v-else>
+            <p v-if="publishError" class="text-sm text-red-400">{{ publishError }}</p>
+            <div class="flex flex-wrap items-center gap-3">
+              <button type="button" class="btn btn-primary" :disabled="!canPublish" @click="publish">
+                <Icon v-if="publishing" name="ph:spinner" class="animate-spin" aria-hidden="true" />
+                <Icon v-else name="ph:paper-plane-tilt" aria-hidden="true" />
+                {{ t('assistant.publish') }}
+              </button>
+              <button type="button" class="btn" :disabled="!built" @click="downloadTorrent">
+                <Icon name="ph:download-simple" aria-hidden="true" />{{ t('assistant.downloadOnly') }}
+              </button>
+              <span v-if="!built" class="text-xs text-text-muted">{{ t('assistant.waitHash') }}</span>
+            </div>
+          </template>
+        </div>
+      </div>
+    </template>
+
+    <!-- CLI -->
+    <div class="card mb-6">
+      <div class="card-header flex items-center gap-2">
+        <Icon name="ph:terminal-window" class="text-text-muted" />
+        <h3 class="text-sm font-medium text-text-primary">{{ t('assistant.cli.title') }}</h3>
+      </div>
+      <div class="card-body space-y-3 text-sm">
+        <p class="text-text-muted">{{ t('assistant.cli.intro') }}</p>
+        <pre class="bg-bg-tertiary border border-border rounded p-3 text-xs overflow-x-auto">{{ cliCommand }}</pre>
+        <p class="text-xs text-text-muted">
+          {{ t('assistant.cli.requirements') }}
+          <NuxtLink to="/integrations" class="underline underline-offset-2">{{ t('assistant.cli.apiKey') }}</NuxtLink>
+        </p>
+        <a href="/tools/trackarr-upload.mjs" download class="btn inline-flex">
+          <Icon name="ph:download-simple" aria-hidden="true" />{{ t('assistant.cli.download') }}
+        </a>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { buildDescription, formatSize, type Screenshot } from '~~/shared/utils/release/description';
+import { DESCRIPTION_LANGUAGES, isDescriptionLanguage, type DescriptionLanguage } from '~~/shared/utils/release/labels';
+import { summarizeMediaInfo, type MediaSummary } from '~~/shared/utils/release/mediainfo';
+import { parseReleaseName, stripVideoExtension } from '~~/shared/utils/release/releaseName';
+import type { BuiltTorrent } from '~~/shared/utils/release/torrent';
+import { mainVideo, releaseFromDrop, releaseFromFileList, type PickedRelease } from '~/utils/uploadAssistant/files';
+import { analyzeMedia, captureScreenshots, type MediaInfoResult } from '~/utils/uploadAssistant/media';
+import { hashRelease } from '~/utils/uploadAssistant/hash';
+
+type StepState = 'idle' | 'running' | 'done' | 'skipped' | 'error';
+
+interface AssistantConfig {
+  siteName: string;
+  announceUrl: string;
+  source: string;
+  categories: { id: string; name: string; parentId: string | null }[];
+  tags: { id: string; name: string }[];
+  screenshots: { host: string; maxPerUpload: number };
+}
+
+interface Shot {
+  blob: Blob;
+  url: string;
+  selected: boolean;
+  state: 'local' | 'uploading' | 'hosted' | 'error';
+  hosted: Screenshot | null;
+}
+
+const SCREENSHOT_COUNT = 6;
+
+const { t, locale } = useI18n();
+const requestUrl = useRequestURL();
+
+const inputClass =
+  'w-full bg-bg-tertiary border border-border rounded px-3 py-2 text-sm text-text-primary focus:outline-none focus:border-white/20';
+const labelClass = 'block text-xs font-medium text-text-muted mb-1';
+
+const { data: config } = await useFetch<AssistantConfig>('/api/upload-assistant/config');
+
+const dragging = ref(false);
+const picked = shallowRef<PickedRelease | null>(null);
+const steps = reactive<Record<'mediainfo' | 'screenshots' | 'hash', StepState>>({
+  mediainfo: 'idle',
+  screenshots: 'idle',
+  hash: 'idle',
+});
+const mediaInfo = shallowRef<MediaInfoResult | null>(null);
+const summary = computed<MediaSummary | null>(() =>
+  mediaInfo.value ? summarizeMediaInfo(mediaInfo.value.json) : null
+);
+const mediaError = ref('');
+const shots = ref<Shot[]>([]);
+const shotsDetail = ref('');
+const hashProgress = ref(0);
+const hashError = ref('');
+const built = shallowRef<BuiltTorrent | null>(null);
+
+const form = reactive({
+  name: '',
+  title: '',
+  categoryId: '',
+  tagIds: [] as string[],
+  imdbId: '',
+  tmdbId: '',
+  tvdbId: '',
+  lang: (isDescriptionLanguage(locale.value) ? locale.value : 'en') as DescriptionLanguage,
+  notes: '',
+  adult: false,
+});
+
+const description = ref('');
+const descriptionEdited = ref(false);
+const copied = ref(false);
+const publishing = ref(false);
+const publishError = ref('');
+const published = ref<{ infoHash: string; existing: boolean } | null>(null);
+
+const sizeLang = computed<DescriptionLanguage>(() => (isDescriptionLanguage(locale.value) ? locale.value : 'en'));
+
+const categoryOptions = computed(() => {
+  const all = config.value?.categories ?? [];
+  const byId = new Map(all.map((c) => [c.id, c]));
+  return all
+    .map((c) => ({ id: c.id, label: c.parentId ? `${byId.get(c.parentId)?.name ?? ''} › ${c.name}` : c.name }))
+    .sort((a, b) => a.label.localeCompare(b.label));
+});
+
+function languageLabel(code: string) {
+  try {
+    return new Intl.DisplayNames([code], { type: 'language' }).of(code) ?? code;
+  } catch {
+    return code;
+  }
+}
+
+const preview = computed(() => renderDescription(description.value));
+
+const cliCommand = computed(
+  () =>
+    `node trackarr-upload.mjs "/path/to/release" --url ${requestUrl.origin} --key YOUR_API_KEY --lang ${form.lang}${form.adult ? ' --adult' : ''}`
+);
+
+const canPublish = computed(
+  () => Boolean(built.value) && !publishing.value && form.name.trim().length > 0 && steps.screenshots !== 'running'
+);
+
+// Description follows the inputs until edited by hand
+function generate(): string {
+  if (!picked.value) return '';
+  const release = parseReleaseName(picked.value.name);
+  return buildDescription({
+    lang: form.lang,
+    title: form.title || release.title,
+    release,
+    summary: summary.value,
+    mediaInfoText: mediaInfo.value?.text,
+    screenshots: shots.value.filter((s) => s.selected && s.hosted).map((s) => s.hosted!),
+    files: picked.value.folder
+      ? picked.value.files.map((f) => ({ path: f.path.join('/'), size: f.file.size }))
+      : [],
+    notes: form.notes,
+  });
+}
+
+watchEffect(() => {
+  const next = generate();
+  if (!descriptionEdited.value) description.value = next;
+});
+
+function onDescriptionInput(event: Event) {
+  description.value = (event.target as HTMLTextAreaElement).value;
+  descriptionEdited.value = true;
+}
+
+function regenerate() {
+  descriptionEdited.value = false;
+  description.value = generate();
+}
+
+async function copyDescription() {
+  try {
+    await navigator.clipboard.writeText(description.value);
+    copied.value = true;
+    setTimeout(() => (copied.value = false), 1500);
+  } catch {
+    // Clipboard refused: the text stays selectable
+  }
+}
+
+async function onPick(event: Event) {
+  const input = event.target as HTMLInputElement;
+  if (input.files?.length) start(releaseFromFileList(input.files));
+  input.value = '';
+}
+
+async function onDrop(event: DragEvent) {
+  dragging.value = false;
+  if (event.dataTransfer) start(await releaseFromDrop(event.dataTransfer));
+}
+
+function reset() {
+  for (const s of shots.value) URL.revokeObjectURL(s.url);
+  picked.value = null;
+  mediaInfo.value = null;
+  shots.value = [];
+  built.value = null;
+  published.value = null;
+  publishError.value = '';
+  mediaError.value = '';
+  hashError.value = '';
+  shotsDetail.value = '';
+  hashProgress.value = 0;
+  descriptionEdited.value = false;
+  Object.assign(steps, { mediainfo: 'idle', screenshots: 'idle', hash: 'idle' });
+}
+
+function start(release: PickedRelease | null) {
+  if (!release || !config.value) return;
+  reset();
+  picked.value = release;
+  const parsed = parseReleaseName(release.name);
+  form.name = release.folder ? release.name : stripVideoExtension(release.name);
+  form.title = parsed.title;
+  void runMedia(release).finally(() => runHash(release));
+}
+
+async function runMedia(release: PickedRelease) {
+  const video = mainVideo(release);
+  if (!video) {
+    steps.mediainfo = 'skipped';
+    steps.screenshots = 'skipped';
+    return;
+  }
+  steps.mediainfo = 'running';
+  try {
+    mediaInfo.value = await analyzeMedia(video);
+    steps.mediainfo = 'done';
+  } catch (err) {
+    steps.mediainfo = 'error';
+    mediaError.value = errorText(err);
+    console.error('[Upload assistant] MediaInfo failed:', err);
+  }
+
+  const duration = summary.value?.duration;
+  if (!duration) {
+    steps.screenshots = 'skipped';
+    return;
+  }
+  steps.screenshots = 'running';
+  try {
+    const result = await captureScreenshots(video, duration, SCREENSHOT_COUNT, (done, engine) => {
+      shotsDetail.value = t(`assistant.engine.${engine}`, { done, total: SCREENSHOT_COUNT });
+    });
+    shots.value = result.shots.map((blob) => ({
+      blob,
+      url: URL.createObjectURL(blob),
+      selected: true,
+      state: 'local',
+      hosted: null,
+    }));
+    shotsDetail.value = t(`assistant.engine.${result.engine}`, { done: result.shots.length, total: SCREENSHOT_COUNT });
+    await hostShots();
+    steps.screenshots = shots.value.some((s) => s.state === 'error') ? 'error' : 'done';
+  } catch (err) {
+    steps.screenshots = 'error';
+    shotsDetail.value = errorText(err);
+    console.error('[Upload assistant] Screenshots failed:', err);
+  }
+}
+
+/** Send the screenshots to the image host, through this site */
+async function hostShots() {
+  for (const shot of shots.value) {
+    if (shot.hosted || !shot.selected) continue;
+    shot.state = 'uploading';
+    try {
+      const body = new FormData();
+      body.append('image', shot.blob, 'screenshot.jpg');
+      body.append('adult', form.adult ? '1' : '0');
+      shot.hosted = await $fetch<Screenshot>('/api/upload-assistant/screenshot', { method: 'POST', body });
+      shot.state = 'hosted';
+    } catch (err) {
+      shot.state = 'error';
+      console.error('[Upload assistant] Screenshot upload failed:', err);
+    }
+  }
+}
+
+async function runHash(release: PickedRelease) {
+  if (!config.value) return;
+  steps.hash = 'running';
+  try {
+    built.value = await hashRelease(release, {
+      announce: config.value.announceUrl,
+      source: config.value.source,
+      onProgress: (done, total) => (hashProgress.value = Math.floor((done / total) * 100)),
+    });
+    steps.hash = 'done';
+  } catch (err) {
+    steps.hash = 'error';
+    hashError.value = errorText(err);
+    console.error('[Upload assistant] Hashing failed:', err);
+  }
+}
+
+/** ffmpeg.wasm and workers do not always throw Error objects */
+function errorText(err: unknown): string {
+  const message = err instanceof Error ? err.message : typeof err === 'string' ? err : (err as { message?: unknown })?.message;
+  return typeof message === 'string' && message ? message : t('assistant.unknownError');
+}
+
+function torrentFileName() {
+  return `${(form.name || picked.value?.name || 'release').replace(/[\\/:*?"<>|]+/g, '_')}.torrent`;
+}
+
+function downloadTorrent() {
+  if (!built.value) return;
+  const url = URL.createObjectURL(new Blob([built.value.torrent as Uint8Array<ArrayBuffer>], { type: 'application/x-bittorrent' }));
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = torrentFileName();
+  a.click();
+  setTimeout(() => URL.revokeObjectURL(url), 1000);
+}
+
+async function publish() {
+  if (!built.value) return;
+  publishing.value = true;
+  publishError.value = '';
+  try {
+    // Screenshots selected after a failed upload get another try
+    if (shots.value.some((s) => s.selected && !s.hosted)) await hostShots();
+    const body = new FormData();
+    body.append('torrent', new Blob([built.value.torrent as Uint8Array<ArrayBuffer>]), torrentFileName());
+    body.append('name', form.name.trim());
+    body.append('description', description.value);
+    if (form.categoryId) body.append('categoryId', form.categoryId);
+    if (form.tagIds.length) body.append('tags', JSON.stringify(form.tagIds));
+    for (const id of ['imdbId', 'tmdbId', 'tvdbId'] as const) if (form[id].trim()) body.append(id, form[id].trim());
+    const result = await $fetch<{ message?: string; data: { infoHash: string } }>('/api/torrents', {
+      method: 'POST',
+      body,
+    });
+    published.value = { infoHash: result.data.infoHash, existing: result.message === 'Torrent already exists' };
+  } catch (err: any) {
+    publishError.value = err.data?.message || t('assistant.publishFailed');
+  } finally {
+    publishing.value = false;
+  }
+}
+
+onBeforeUnmount(() => {
+  for (const s of shots.value) URL.revokeObjectURL(s.url);
+});
+</script>
+
+<style scoped>
+.description-preview :deep(img) {
+  max-width: 100%;
+  display: inline-block;
+  margin: 0.25rem;
+  border-radius: 4px;
+}
+.description-preview :deep(ul) {
+  list-style: revert;
+  padding-left: 1.25rem;
+}
+.description-preview :deep(details) {
+  border: 1px solid rgb(var(--line));
+  border-radius: 4px;
+  padding: 0.5rem 0.75rem;
+  margin-bottom: 0.5rem;
+}
+.description-preview :deep(summary) {
+  cursor: pointer;
+  font-weight: 600;
+}
+.description-preview :deep(pre) {
+  overflow-x: auto;
+  font-size: 0.75em;
+}
+</style>
diff --git a/app/utils/markdown.ts b/app/utils/markdown.ts
index 0d3648f5..d0e98d87 100644
--- a/app/utils/markdown.ts
+++ b/app/utils/markdown.ts
@@ -1,5 +1,6 @@
 import { marked } from 'marked';
 import DOMPurify from 'dompurify';
+import { bbcodeToHtml, looksLikeBbcode } from '~~/shared/utils/bbcode';
 
 /**
  * Render user-supplied markdown to sanitized HTML.
@@ -12,3 +13,15 @@ export function renderMarkdown(source: string | null | undefined): string {
   const html = marked.parse(source, { async: false });
   return DOMPurify.sanitize(html, { USE_PROFILES: { html: true } });
 }
+
+/**
+ * Render a torrent description: BBCode (upload assistant, forum habits) when
+ * it uses BBCode tags, Markdown otherwise. Same sanitizing either way.
+ */
+export function renderDescription(source: string | null | undefined): string {
+  if (!source || import.meta.server) return '';
+  if (looksLikeBbcode(source)) {
+    return DOMPurify.sanitize(bbcodeToHtml(source), { USE_PROFILES: { html: true } });
+  }
+  return renderMarkdown(source);
+}
diff --git a/app/utils/uploadAssistant/files.ts b/app/utils/uploadAssistant/files.ts
new file mode 100644
index 00000000..fa8d8342
--- /dev/null
+++ b/app/utils/uploadAssistant/files.ts
@@ -0,0 +1,86 @@
+/**
+ * Files picked for a release: from an <input> (file or webkitdirectory) or a
+ * drag and drop of files and folders. Junk files are left out.
+ */
+
+import { isJunkFile } from '~~/shared/utils/release/torrent';
+
+export interface PickedFile {
+  file: File;
+  /** Path relative to the release root folder ([name] for a single file) */
+  path: string[];
+}
+
+export interface PickedRelease {
+  /** File name, or the folder name */
+  name: string;
+  folder: boolean;
+  files: PickedFile[];
+  totalSize: number;
+}
+
+const VIDEO = /\.(mkv|mp4|m4v|avi|mov|wmv|ts|m2ts|webm|mpg|mpeg)$/i;
+
+export function isVideoName(name: string): boolean {
+  return VIDEO.test(name);
+}
+
+function release(entries: { file: File; parts: string[] }[]): PickedRelease | null {
+  const kept = entries.filter((e) => !e.parts.some(isJunkFile) && e.file.size > 0);
+  if (kept.length === 0) return null;
+  const roots = new Set(kept.map((e) => (e.parts.length > 1 ? e.parts[0] : '')));
+  const folder = kept.length > 1 || kept[0]!.parts.length > 1;
+  // One top-level folder: it becomes the torrent root
+  const singleRoot = roots.size === 1 && !roots.has('');
+  const name = folder ? (singleRoot ? [...roots][0]! : 'Release') : kept[0]!.file.name;
+  const files = kept
+    .map((e) => ({ file: e.file, path: folder && singleRoot ? e.parts.slice(1) : e.parts }))
+    .sort((a, b) => a.path.join('/').localeCompare(b.path.join('/')));
+  return { name, folder, files, totalSize: files.reduce((s, f) => s + f.file.size, 0) };
+}
+
+/** From <input type="file"> (multiple or webkitdirectory) */
+export function releaseFromFileList(list: FileList | File[]): PickedRelease | null {
+  return release(
+    Array.from(list, (file) => ({
+      file,
+      parts: (file.webkitRelativePath || file.name).split('/').filter(Boolean),
+    }))
+  );
+}
+
+async function readEntry(entry: FileSystemEntry, prefix: string[]): Promise<{ file: File; parts: string[] }[]> {
+  if (entry.isFile) {
+    const file = await new Promise<File>((resolve, reject) => (entry as FileSystemFileEntry).file(resolve, reject));
+    return [{ file, parts: [...prefix, entry.name] }];
+  }
+  const reader = (entry as FileSystemDirectoryEntry).createReader();
+  const children: FileSystemEntry[] = [];
+  // readEntries returns batches until an empty one
+  for (;;) {
+    const batch = await new Promise<FileSystemEntry[]>((resolve, reject) => reader.readEntries(resolve, reject));
+    if (batch.length === 0) break;
+    children.push(...batch);
+  }
+  const nested = await Promise.all(children.map((c) => readEntry(c, [...prefix, entry.name])));
+  return nested.flat();
+}
+
+/** From a drop: files and whole folders */
+export async function releaseFromDrop(transfer: DataTransfer): Promise<PickedRelease | null> {
+  const entries = Array.from(transfer.items)
+    .map((item) => item.webkitGetAsEntry?.())
+    .filter((e): e is FileSystemEntry => Boolean(e));
+  if (entries.length === 0) return releaseFromFileList(transfer.files);
+  const all = await Promise.all(entries.map((e) => readEntry(e, [])));
+  return release(all.flat());
+}
+
+/** The file the screenshots and MediaInfo come from: the largest video */
+export function mainVideo(picked: PickedRelease): File | null {
+  return (
+    picked.files
+      .filter((f) => isVideoName(f.file.name))
+      .sort((a, b) => b.file.size - a.file.size)[0]?.file ?? null
+  );
+}
diff --git a/app/utils/uploadAssistant/hash.ts b/app/utils/uploadAssistant/hash.ts
new file mode 100644
index 00000000..70f17a8e
--- /dev/null
+++ b/app/utils/uploadAssistant/hash.ts
@@ -0,0 +1,29 @@
+/**
+ * Build the .torrent in the browser: files are read slice by slice and
+ * hashed with WebCrypto, so a large release never sits in memory.
+ */
+
+import { buildTorrent, type BuiltTorrent } from '~~/shared/utils/release/torrent';
+import type { PickedRelease } from './files';
+
+const sha1 = async (data: Uint8Array) =>
+  new Uint8Array(await crypto.subtle.digest('SHA-1', data as Uint8Array<ArrayBuffer>));
+
+export function hashRelease(
+  picked: PickedRelease,
+  options: { announce: string; source: string; onProgress?: (done: number, total: number) => void }
+): Promise<BuiltTorrent> {
+  return buildTorrent({
+    name: picked.name,
+    folder: picked.folder,
+    announce: options.announce,
+    source: options.source,
+    sha1,
+    onProgress: options.onProgress,
+    files: picked.files.map(({ file, path }) => ({
+      path,
+      length: file.size,
+      read: async (offset, length) => new Uint8Array(await file.slice(offset, offset + length).arrayBuffer()),
+    })),
+  });
+}
diff --git a/app/utils/uploadAssistant/media.ts b/app/utils/uploadAssistant/media.ts
new file mode 100644
index 00000000..a810609a
--- /dev/null
+++ b/app/utils/uploadAssistant/media.ts
@@ -0,0 +1,202 @@
+/**
+ * In-browser media analysis for the upload assistant. Heavy WebAssembly
+ * modules are loaded on demand, from this site (no CDN):
+ * - mediainfo.js for the MediaInfo report
+ * - screenshots with the browser's own decoder (<video> + canvas), falling
+ *   back to ffmpeg.wasm for what it cannot play (HEVC in MKV, AVI...). ffmpeg
+ *   reads the file in place through WORKERFS: nothing is copied in memory.
+ */
+
+import { cleanMediaInfoText } from '~~/shared/utils/release/mediainfo';
+
+export interface MediaInfoResult {
+  json: string;
+  text: string;
+}
+
+export async function analyzeMedia(file: File): Promise<MediaInfoResult> {
+  const [{ default: mediaInfoFactory }, { default: wasmUrl }] = await Promise.all([
+    import('mediainfo.js'),
+    import('mediainfo.js/MediaInfoModule.wasm?url'),
+  ]);
+  const locateFile = (path: string, prefix: string) =>
+    path === 'MediaInfoModule.wasm' ? wasmUrl : `${prefix}${path}`;
+  const readChunk = async (size: number, offset: number) =>
+    new Uint8Array(await file.slice(offset, offset + size).arrayBuffer());
+  const getSize = () => file.size;
+
+  const json = await mediaInfoFactory({ format: 'JSON', locateFile });
+  const text = await mediaInfoFactory({ format: 'text', locateFile });
+  try {
+    return {
+      json: await json.analyzeData(getSize, readChunk),
+      // The text report names the file: give it the real name
+      text: cleanMediaInfoText((await text.analyzeData(getSize, readChunk)).replace(
+        /^(Complete name\s*:\s*).*$/m,
+        `$1${file.name}`
+      )),
+    };
+  } finally {
+    json.close();
+    text.close();
+  }
+}
+
+/** Timestamps spread over the video, skipping intro and credits */
+export function screenshotTimes(duration: number, count: number): number[] {
+  const start = duration * 0.08;
+  const span = duration * 0.84;
+  return Array.from({ length: count }, (_, i) => start + (span * (i + 0.5)) / count);
+}
+
+const MAX_WIDTH = 1920;
+
+function canvasToJpeg(canvas: HTMLCanvasElement): Promise<Blob> {
+  return new Promise((resolve, reject) =>
+    canvas.toBlob((b) => (b ? resolve(b) : reject(new Error('Encoding failed'))), 'image/jpeg', 0.9)
+  );
+}
+
+function once(target: EventTarget, ok: string, timeoutMs: number): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => cleanup(new Error('timeout')), timeoutMs);
+    const onOk = () => cleanup();
+    const onError = () => cleanup(new Error('media error'));
+    function cleanup(err?: Error) {
+      clearTimeout(timer);
+      target.removeEventListener(ok, onOk);
+      target.removeEventListener('error', onError);
+      if (err) reject(err);
+      else resolve();
+    }
+    target.addEventListener(ok, onOk);
+    target.addEventListener('error', onError);
+  });
+}
+
+/** With the browser's decoder; null when it cannot show this video */
+async function nativeScreenshots(file: File, times: number[]): Promise<Blob[] | null> {
+  const video = document.createElement('video');
+  video.muted = true;
+  video.preload = 'auto';
+  const url = URL.createObjectURL(file);
+  try {
+    video.src = url;
+    await once(video, 'loadeddata', 15_000);
+    if (!video.videoWidth || !video.videoHeight) return null;
+    const scale = Math.min(1, MAX_WIDTH / video.videoWidth);
+    const canvas = document.createElement('canvas');
+    canvas.width = Math.round(video.videoWidth * scale);
+    canvas.height = Math.round(video.videoHeight * scale);
+    const ctx = canvas.getContext('2d');
+    if (!ctx) return null;
+    const shots: Blob[] = [];
+    for (const time of times) {
+      video.currentTime = Math.min(time, Math.max(0, video.duration - 1));
+      await once(video, 'seeked', 15_000);
+      ctx.drawImage(video, 0, 0, canvas.width, canvas.height);
+      // Audio decoded but no picture: the frame is uniformly black
+      const sample = ctx.getImageData(0, 0, canvas.width, canvas.height).data;
+      let lit = 0;
+      for (let i = 0; i < sample.length; i += 4 * 97) lit += sample[i]! + sample[i + 1]! + sample[i + 2]!;
+      if (lit === 0 && shots.length === 0) return null;
+      shots.push(await canvasToJpeg(canvas));
+    }
+    return shots;
+  } catch (err) {
+    console.warn('[Upload assistant] Browser decoder unavailable, using ffmpeg:', err);
+    return null;
+  } finally {
+    video.removeAttribute('src');
+    video.load();
+    URL.revokeObjectURL(url);
+  }
+}
+
+function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('ffmpeg stopped answering')), ms);
+    promise.then(
+      (value) => (clearTimeout(timer), resolve(value)),
+      (err) => (clearTimeout(timer), reject(err))
+    );
+  });
+}
+
+/** JPEG keeps screenshots well under the image host's 10 MB limit */
+async function pngToJpeg(png: Blob): Promise<Blob> {
+  const bitmap = await createImageBitmap(png);
+  const canvas = document.createElement('canvas');
+  canvas.width = bitmap.width;
+  canvas.height = bitmap.height;
+  canvas.getContext('2d')!.drawImage(bitmap, 0, 0);
+  bitmap.close();
+  return canvasToJpeg(canvas);
+}
+
+async function ffmpegScreenshots(file: File, times: number[], onStep?: (done: number) => void): Promise<Blob[]> {
+  const [{ FFmpeg, FFFSType }, { default: coreURL }, { default: wasmURL }] = await Promise.all([
+    import('@ffmpeg/ffmpeg'),
+    import('@ffmpeg/core?url'),
+    import('@ffmpeg/core/wasm?url'),
+  ]);
+  const ffmpeg = new FFmpeg();
+  // ffmpeg's own output, for bug reports (DevTools > Console > Verbose)
+  ffmpeg.on('log', ({ message }) => console.debug('[ffmpeg]', message));
+  await withTimeout(ffmpeg.load({ coreURL, wasmURL }), 120_000);
+  console.debug('[Upload assistant] ffmpeg loaded');
+  try {
+    await ffmpeg.createDir('/in');
+    await ffmpeg.mount(FFFSType.WORKERFS, { files: [file] }, '/in');
+    const shots: Blob[] = [];
+    for (const [i, time] of times.entries()) {
+      // PNG, not JPEG: the MJPEG encoder of @ffmpeg/core 0.12 crashes
+      // ("memory access out of bounds"); the browser converts to JPEG below
+      const out = `shot${i}.png`;
+      // -ss before -i: fast seek on the nearest keyframe, then exact decode.
+      // -nostdin: no keyboard input in a worker. ffmpeg's timeout (ms) bounds a
+      // file that decodes forever, withTimeout a worker that stops answering.
+      const code = await withTimeout(
+        ffmpeg.exec(
+          [
+            '-nostdin', '-ss', time.toFixed(2), '-i', `/in/${file.name}`,
+            '-map', '0:v:0', '-an', '-sn', '-dn',
+            '-frames:v', '1', '-update', '1', '-vf', `scale='min(${MAX_WIDTH},iw)':-2`, out,
+          ],
+          90_000
+        ),
+        120_000
+      );
+      if (code !== 0) throw new Error(`ffmpeg could not decode this video (code ${code})`);
+      const data = await ffmpeg.readFile(out);
+      if (!(data instanceof Uint8Array) || data.length === 0) throw new Error('No frame decoded');
+      shots.push(await pngToJpeg(new Blob([data as Uint8Array<ArrayBuffer>], { type: 'image/png' })));
+      await ffmpeg.deleteFile(out);
+      onStep?.(i + 1);
+    }
+    return shots;
+  } finally {
+    ffmpeg.terminate();
+  }
+}
+
+export interface ScreenshotResult {
+  shots: Blob[];
+  engine: 'browser' | 'ffmpeg';
+}
+
+export async function captureScreenshots(
+  file: File,
+  duration: number,
+  count: number,
+  onStep?: (done: number, engine: ScreenshotResult['engine']) => void
+): Promise<ScreenshotResult> {
+  const times = screenshotTimes(duration, count);
+  const native = await nativeScreenshots(file, times);
+  if (native) {
+    onStep?.(native.length, 'browser');
+    return { shots: native, engine: 'browser' };
+  }
+  const shots = await ffmpegScreenshots(file, times, (done) => onStep?.(done, 'ffmpeg'));
+  return { shots, engine: 'ffmpeg' };
+}
diff --git a/doc/.vitepress/config.ts b/doc/.vitepress/config.ts
index 6c7e2f14..c88ae009 100644
--- a/doc/.vitepress/config.ts
+++ b/doc/.vitepress/config.ts
@@ -49,6 +49,7 @@ export default defineConfig({
             { text: 'Configuration', link: '/guide/configuration' },
             { text: 'Appearance', link: '/guide/appearance' },
             { text: 'Paid Registration', link: '/guide/paid-registration' },
+            { text: 'Upload Assistant', link: '/guide/upload-assistant' },
             { text: 'Monitoring', link: '/guide/monitoring' },
             { text: 'Backup & Restore', link: '/guide/backup-restore' },
             { text: 'High Availability', link: '/guide/high-availability' },
diff --git a/doc/guide/getting-started.md b/doc/guide/getting-started.md
index 45a9028d..73b853db 100644
--- a/doc/guide/getting-started.md
+++ b/doc/guide/getting-started.md
@@ -135,6 +135,7 @@ Open `https://your-domain.com` to access your tracker.
 3. **Configure site settings** — Set your tracker name, description, and rules
 4. **Invite users** — Use the invitation system to add trusted members
 5. **Charge for sign-up (optional)**: Bitcoin, Monero or Solana, verified on-chain: see [Paid Registration](/guide/paid-registration)
+6. **Upload releases**: the [Upload Assistant](/guide/upload-assistant) builds the `.torrent`, MediaInfo, screenshots and BBCode description for you (web or CLI)
 
 ## Updating
 
diff --git a/doc/guide/upload-assistant.md b/doc/guide/upload-assistant.md
new file mode 100644
index 00000000..0115e73c
--- /dev/null
+++ b/doc/guide/upload-assistant.md
@@ -0,0 +1,56 @@
+# Upload Assistant
+
+Creating a good torrent takes many steps: build the `.torrent`, run MediaInfo, take screenshots, host them, write the description. The upload assistant does all of it from one file or folder, in the browser or from a terminal.
+
+| Step | What happens |
+| --- | --- |
+| `.torrent` | Private, with your personal announce URL, and a `source` tag (the tracker's host) so the same files shared elsewhere get another info hash. The tracker keeps the same info hash: you seed the file you just created. |
+| MediaInfo | Read from the largest video: container, duration, size, every video, audio and subtitle track. The full report goes in a spoiler, without your local path. |
+| Screenshots | Spread over the video (intro and credits skipped), hosted on [Pixhost](https://pixhost.to). Tick **Adult content** to file them as NSFW there. |
+| Description | BBCode, in the language you pick (8 languages): title, release details read from the name (source, group), tracks, screenshots, file list. Editable before publishing. |
+| Publish | Name, category, tags, IMDb/TMDb/TVDB IDs, and the torrent goes to the tracker (moderation rules apply as usual). |
+
+## In the browser
+
+**Home → Upload assistant** (also linked from the upload window), or `/upload/assistant`.
+
+Drop a file or a folder, or pick one. Everything runs in your browser: the files are never sent to the tracker, only the screenshots (relayed to Pixhost) and the `.torrent`.
+
+- MediaInfo comes from [mediainfo.js](https://github.com/buzz/mediainfo.js) (WebAssembly).
+- Screenshots use the browser's own decoder. For what it cannot play (HEVC in MKV, AVI, old codecs...), the assistant loads [ffmpeg.wasm](https://ffmpegwasm.netlify.app) (about 30 MB, once) and reads the file in place: nothing is copied into memory.
+- Hashing reads the files piece by piece: a 50 GB release works, at the speed of your disk and browser (slower than a native client).
+
+Once published, **Download the .torrent** and add it to your client, saving to the folder that holds the files: it checks them and starts seeding at once.
+
+## From a terminal
+
+For large releases or batches, `trackarr-upload.mjs` does the same, faster. Download it from the assistant page (`/tools/trackarr-upload.mjs`). It needs **Node.js 20+**, **ffmpeg** and **mediainfo** in the `PATH` (without mediainfo it still works, with a shorter description).
+
+```bash
+# macOS: brew install ffmpeg mediainfo   Debian/Ubuntu: apt install ffmpeg mediainfo
+node trackarr-upload.mjs "/data/Movie.2024.1080p.WEB-DL-GROUP" \
+  --url https://tracker.example --key tk_... --save \
+  --category "Movies/HD" --lang fr --adult
+```
+
+The key is the API key of the **Integrations** page. `--save` remembers the address and key in `~/.config/trackarr-upload.json`; the next runs only need the path. `--dry-run` builds everything and writes `<name>.torrent` and `<name>.bbcode.txt` without publishing. `node trackarr-upload.mjs --help` lists every option.
+
+With ffmpeg built with zimg (most builds), HDR screenshots are tone-mapped so they do not look washed out.
+
+::: tip API key and uploads
+The CLI publishes with the same API key as Prowlarr or Sonarr (`Authorization: Bearer`). Anyone holding that key can upload in your name: if it leaks, regenerate it on the Integrations page.
+:::
+
+## Descriptions in BBCode
+
+Torrent descriptions accept BBCode as well as Markdown: a description using BBCode tags (`[b]`, `[url]`, `[img]`, `[spoiler]`...) is rendered as BBCode, any other as Markdown. Supported: `b i u s`, `center left right`, `size=1-7`, `color`, `url`, `img`, `quote`, `code`, `spoiler`, `list` / `[*]`, `hr`. Everything is escaped and sanitized; links and images must be `http(s)`.
+
+Descriptions can hold up to 50,000 characters, room for a full MediaInfo report.
+
+## Server side
+
+| Variable          | Description                                                     | Default                          |
+| ----------------- | --------------------------------------------------------------- | -------------------------------- |
+| `PIXHOST_API_URL` | Image upload endpoint, for a proxy or tests                     | `https://api.pixhost.to/images`  |
+
+The tracker relays screenshots to Pixhost for the browser (`POST /api/upload-assistant/screenshot`, 30 per minute, 10 MB each, JPEG/PNG/WebP checked by content): the page's security policy lets it talk to the tracker only. The page needs `'wasm-unsafe-eval'` in the Content Security Policy for WebAssembly (it allows compiling WebAssembly, not `eval()` of JavaScript); the tracker sets it.
diff --git a/doc/reference/env.md b/doc/reference/env.md
index 09485f86..1cff49b5 100644
--- a/doc/reference/env.md
+++ b/doc/reference/env.md
@@ -109,6 +109,14 @@ See [Paid Registration](/guide/paid-registration).
 
 The installer sets the Monero variables and adds `monero` to `COMPOSE_PROFILES` when you accept Monero.
 
+## Upload Assistant
+
+See [Upload Assistant](/guide/upload-assistant).
+
+| Variable          | Description                                 | Default                         |
+| ----------------- | ------------------------------------------- | ------------------------------- |
+| `PIXHOST_API_URL` | Image upload endpoint, for a proxy or tests | `https://api.pixhost.to/images` |
+
 ## Monitoring
 
 Production only. See [Monitoring](/guide/monitoring).
diff --git a/i18n/locales/de/assistant.json b/i18n/locales/de/assistant.json
new file mode 100644
index 00000000..9d1629bd
--- /dev/null
+++ b/i18n/locales/de/assistant.json
@@ -0,0 +1,59 @@
+{
+  "assistant": {
+    "entry": "Upload-Assistent",
+    "title": "Upload-Assistent",
+    "subtitle": "Lege ein Video oder einen Ordner ab: Torrent, MediaInfo, Screenshots und Beschreibung entstehen automatisch.",
+    "drop": "Datei oder Ordner hier ablegen",
+    "pickFile": "Datei wählen",
+    "pickFolder": "Ordner wählen",
+    "adult": "Inhalte für Erwachsene (Screenshots beim Bildhoster als NSFW markiert)",
+    "private": "Die Dateien werden in deinem Browser gelesen: nur die Screenshots und die .torrent verlassen deinen Computer.",
+    "change": "Ändern",
+    "fileCount": "{count} Datei, {size} | {count} Dateien, {size}",
+    "steps": {
+      "mediainfo": "MediaInfo wird gelesen",
+      "screenshots": "Screenshots werden erstellt",
+      "hash": ".torrent wird erstellt"
+    },
+    "screenshots": "Screenshots",
+    "screenshotsHint": "Entferne den Haken bei denen, die nicht in die Beschreibung sollen.",
+    "useShot": "Screenshot {n} verwenden",
+    "details": "Details",
+    "name": "Torrent-Name",
+    "category": "Kategorie",
+    "noCategory": "Keine Kategorie",
+    "language": "Sprache der Beschreibung",
+    "releaseTitle": "Titel",
+    "ids": {
+      "imdbId": "IMDb",
+      "tmdbId": "TMDb",
+      "tvdbId": "TVDB"
+    },
+    "tags": "Tags",
+    "notes": "Hinweise (optional)",
+    "description": "Beschreibung (BBCode)",
+    "regenerate": "Neu erzeugen",
+    "copyBbcode": "BBCode kopieren",
+    "published": "Torrent veröffentlicht",
+    "alreadyExists": "Dieser Torrent ist bereits auf dem Tracker",
+    "seedHint": "Lade die .torrent herunter und füge sie deinem Client hinzu, mit dem Ordner, der die Dateien enthält: Das Seeden beginnt sofort.",
+    "download": ".torrent herunterladen",
+    "open": "Torrent-Seite öffnen",
+    "publishFailed": "Veröffentlichung fehlgeschlagen",
+    "publish": "Veröffentlichen",
+    "downloadOnly": "Nur die .torrent herunterladen",
+    "waitHash": ".torrent wird erstellt...",
+    "engine": {
+      "browser": "{done}/{total} mit dem Browser",
+      "ffmpeg": "{done}/{total} mit ffmpeg (langsamer)"
+    },
+    "cli": {
+      "title": "Kommandozeilen-Tool",
+      "intro": "Für große Releases oder Stapel: dasselbe Ergebnis im Terminal, schneller bei großen Dateien.",
+      "requirements": "Benötigt Node.js 20+, ffmpeg und mediainfo. Deinen API-Schlüssel findest du auf der",
+      "apiKey": "Seite Integrationen",
+      "download": "trackarr-upload.mjs herunterladen"
+    },
+    "unknownError": "Unbekannter Fehler"
+  }
+}
diff --git a/i18n/locales/en/assistant.json b/i18n/locales/en/assistant.json
new file mode 100644
index 00000000..84ced4aa
--- /dev/null
+++ b/i18n/locales/en/assistant.json
@@ -0,0 +1,59 @@
+{
+  "assistant": {
+    "entry": "Upload assistant",
+    "title": "Upload assistant",
+    "subtitle": "Drop a video or a folder: the torrent, MediaInfo, screenshots and description are made for you.",
+    "drop": "Drop a file or a folder here",
+    "pickFile": "Choose a file",
+    "pickFolder": "Choose a folder",
+    "adult": "Adult content (screenshots filed as NSFW on the image host)",
+    "private": "Files are read in your browser: only the screenshots and the .torrent leave your computer.",
+    "change": "Change",
+    "fileCount": "{count} file, {size} | {count} files, {size}",
+    "steps": {
+      "mediainfo": "Reading MediaInfo",
+      "screenshots": "Taking screenshots",
+      "hash": "Building the .torrent"
+    },
+    "screenshots": "Screenshots",
+    "screenshotsHint": "Untick the ones you do not want in the description.",
+    "useShot": "Use screenshot {n}",
+    "details": "Details",
+    "name": "Torrent name",
+    "category": "Category",
+    "noCategory": "No category",
+    "language": "Description language",
+    "releaseTitle": "Title",
+    "ids": {
+      "imdbId": "IMDb",
+      "tmdbId": "TMDb",
+      "tvdbId": "TVDB"
+    },
+    "tags": "Tags",
+    "notes": "Notes (optional)",
+    "description": "Description (BBCode)",
+    "regenerate": "Regenerate",
+    "copyBbcode": "Copy BBCode",
+    "published": "Torrent published",
+    "alreadyExists": "This torrent is already on the tracker",
+    "seedHint": "Download the .torrent and add it to your client, pointing to the folder that holds the files: it starts seeding at once.",
+    "download": "Download the .torrent",
+    "open": "Open the torrent page",
+    "publishFailed": "Publishing failed",
+    "publish": "Publish",
+    "downloadOnly": "Download the .torrent only",
+    "waitHash": "Waiting for the .torrent to be built...",
+    "engine": {
+      "browser": "{done}/{total} with the browser",
+      "ffmpeg": "{done}/{total} with ffmpeg (slower)"
+    },
+    "cli": {
+      "title": "Command-line tool",
+      "intro": "For large releases or batches: the same result from a terminal, faster on big files.",
+      "requirements": "Needs Node.js 20+, ffmpeg and mediainfo. Your API key is on the",
+      "apiKey": "Integrations page",
+      "download": "Download trackarr-upload.mjs"
+    },
+    "unknownError": "Unknown error"
+  }
+}
diff --git a/i18n/locales/es/assistant.json b/i18n/locales/es/assistant.json
new file mode 100644
index 00000000..0d706da8
--- /dev/null
+++ b/i18n/locales/es/assistant.json
@@ -0,0 +1,59 @@
+{
+  "assistant": {
+    "entry": "Asistente de subida",
+    "title": "Asistente de subida",
+    "subtitle": "Suelta un vídeo o una carpeta: el torrent, el MediaInfo, las capturas y la descripción se hacen solos.",
+    "drop": "Suelta aquí un archivo o una carpeta",
+    "pickFile": "Elegir un archivo",
+    "pickFolder": "Elegir una carpeta",
+    "adult": "Contenido adulto (capturas marcadas NSFW en el alojamiento)",
+    "private": "Los archivos se leen en tu navegador: solo las capturas y el .torrent salen de tu ordenador.",
+    "change": "Cambiar",
+    "fileCount": "{count} archivo, {size} | {count} archivos, {size}",
+    "steps": {
+      "mediainfo": "Leyendo el MediaInfo",
+      "screenshots": "Tomando capturas",
+      "hash": "Creando el .torrent"
+    },
+    "screenshots": "Capturas",
+    "screenshotsHint": "Desmarca las que no quieras en la descripción.",
+    "useShot": "Usar la captura {n}",
+    "details": "Detalles",
+    "name": "Nombre del torrent",
+    "category": "Categoría",
+    "noCategory": "Sin categoría",
+    "language": "Idioma de la descripción",
+    "releaseTitle": "Título",
+    "ids": {
+      "imdbId": "IMDb",
+      "tmdbId": "TMDb",
+      "tvdbId": "TVDB"
+    },
+    "tags": "Etiquetas",
+    "notes": "Notas (opcional)",
+    "description": "Descripción (BBCode)",
+    "regenerate": "Regenerar",
+    "copyBbcode": "Copiar el BBCode",
+    "published": "Torrent publicado",
+    "alreadyExists": "Este torrent ya está en el tracker",
+    "seedHint": "Descarga el .torrent y añádelo a tu cliente apuntando a la carpeta que contiene los archivos: empieza a sembrar enseguida.",
+    "download": "Descargar el .torrent",
+    "open": "Abrir la ficha del torrent",
+    "publishFailed": "La publicación falló",
+    "publish": "Publicar",
+    "downloadOnly": "Descargar solo el .torrent",
+    "waitHash": "Creando el .torrent...",
+    "engine": {
+      "browser": "{done}/{total} con el navegador",
+      "ffmpeg": "{done}/{total} con ffmpeg (más lento)"
+    },
+    "cli": {
+      "title": "Herramienta de línea de comandos",
+      "intro": "Para releases grandes o lotes: el mismo resultado desde una terminal, más rápido con archivos grandes.",
+      "requirements": "Necesita Node.js 20+, ffmpeg y mediainfo. Tu clave API está en la",
+      "apiKey": "página Integraciones",
+      "download": "Descargar trackarr-upload.mjs"
+    },
+    "unknownError": "Error desconocido"
+  }
+}
diff --git a/i18n/locales/fr/assistant.json b/i18n/locales/fr/assistant.json
new file mode 100644
index 00000000..8058c25d
--- /dev/null
+++ b/i18n/locales/fr/assistant.json
@@ -0,0 +1,59 @@
+{
+  "assistant": {
+    "entry": "Assistant d'upload",
+    "title": "Assistant d'upload",
+    "subtitle": "Déposez une vidéo ou un dossier : le torrent, le MediaInfo, les captures et la description sont faits pour vous.",
+    "drop": "Déposez un fichier ou un dossier ici",
+    "pickFile": "Choisir un fichier",
+    "pickFolder": "Choisir un dossier",
+    "adult": "Contenu adulte (captures classées NSFW chez l'hébergeur)",
+    "private": "Les fichiers sont lus dans votre navigateur : seuls les captures et le .torrent quittent votre ordinateur.",
+    "change": "Changer",
+    "fileCount": "{count} fichier, {size} | {count} fichiers, {size}",
+    "steps": {
+      "mediainfo": "Lecture du MediaInfo",
+      "screenshots": "Captures d'écran",
+      "hash": "Création du .torrent"
+    },
+    "screenshots": "Captures",
+    "screenshotsHint": "Décochez celles que vous ne voulez pas dans la description.",
+    "useShot": "Utiliser la capture {n}",
+    "details": "Détails",
+    "name": "Nom du torrent",
+    "category": "Catégorie",
+    "noCategory": "Sans catégorie",
+    "language": "Langue de la description",
+    "releaseTitle": "Titre",
+    "ids": {
+      "imdbId": "IMDb",
+      "tmdbId": "TMDb",
+      "tvdbId": "TVDB"
+    },
+    "tags": "Tags",
+    "notes": "Notes (facultatif)",
+    "description": "Description (BBCode)",
+    "regenerate": "Régénérer",
+    "copyBbcode": "Copier le BBCode",
+    "published": "Torrent publié",
+    "alreadyExists": "Ce torrent est déjà sur le tracker",
+    "seedHint": "Téléchargez le .torrent et ajoutez-le à votre client en pointant vers le dossier qui contient les fichiers : il passe en seed tout de suite.",
+    "download": "Télécharger le .torrent",
+    "open": "Ouvrir la fiche du torrent",
+    "publishFailed": "La publication a échoué",
+    "publish": "Publier",
+    "downloadOnly": "Télécharger seulement le .torrent",
+    "waitHash": "Création du .torrent en cours...",
+    "engine": {
+      "browser": "{done}/{total} avec le navigateur",
+      "ffmpeg": "{done}/{total} avec ffmpeg (plus lent)"
+    },
+    "cli": {
+      "title": "Outil en ligne de commande",
+      "intro": "Pour les grosses releases ou les lots : le même résultat depuis un terminal, plus rapide sur les gros fichiers.",
+      "requirements": "Nécessite Node.js 20+, ffmpeg et mediainfo. Votre clé API est sur la",
+      "apiKey": "page Intégrations",
+      "download": "Télécharger trackarr-upload.mjs"
+    },
+    "unknownError": "Erreur inconnue"
+  }
+}
diff --git a/i18n/locales/it/assistant.json b/i18n/locales/it/assistant.json
new file mode 100644
index 00000000..afcae7d2
--- /dev/null
+++ b/i18n/locales/it/assistant.json
@@ -0,0 +1,59 @@
+{
+  "assistant": {
+    "entry": "Assistente di upload",
+    "title": "Assistente di upload",
+    "subtitle": "Trascina un video o una cartella: torrent, MediaInfo, screenshot e descrizione vengono creati per te.",
+    "drop": "Trascina qui un file o una cartella",
+    "pickFile": "Scegli un file",
+    "pickFolder": "Scegli una cartella",
+    "adult": "Contenuti per adulti (screenshot classificati NSFW sull'host)",
+    "private": "I file vengono letti nel browser: solo gli screenshot e il .torrent lasciano il tuo computer.",
+    "change": "Cambia",
+    "fileCount": "{count} file, {size} | {count} file, {size}",
+    "steps": {
+      "mediainfo": "Lettura del MediaInfo",
+      "screenshots": "Creazione degli screenshot",
+      "hash": "Creazione del .torrent"
+    },
+    "screenshots": "Screenshot",
+    "screenshotsHint": "Deseleziona quelli che non vuoi nella descrizione.",
+    "useShot": "Usa lo screenshot {n}",
+    "details": "Dettagli",
+    "name": "Nome del torrent",
+    "category": "Categoria",
+    "noCategory": "Nessuna categoria",
+    "language": "Lingua della descrizione",
+    "releaseTitle": "Titolo",
+    "ids": {
+      "imdbId": "IMDb",
+      "tmdbId": "TMDb",
+      "tvdbId": "TVDB"
+    },
+    "tags": "Tag",
+    "notes": "Note (facoltative)",
+    "description": "Descrizione (BBCode)",
+    "regenerate": "Rigenera",
+    "copyBbcode": "Copia il BBCode",
+    "published": "Torrent pubblicato",
+    "alreadyExists": "Questo torrent è già sul tracker",
+    "seedHint": "Scarica il .torrent e aggiungilo al client indicando la cartella che contiene i file: inizia subito il seed.",
+    "download": "Scarica il .torrent",
+    "open": "Apri la pagina del torrent",
+    "publishFailed": "Pubblicazione non riuscita",
+    "publish": "Pubblica",
+    "downloadOnly": "Scarica solo il .torrent",
+    "waitHash": "Creazione del .torrent in corso...",
+    "engine": {
+      "browser": "{done}/{total} con il browser",
+      "ffmpeg": "{done}/{total} con ffmpeg (più lento)"
+    },
+    "cli": {
+      "title": "Strumento a riga di comando",
+      "intro": "Per release grandi o in serie: lo stesso risultato dal terminale, più veloce sui file grandi.",
+      "requirements": "Richiede Node.js 20+, ffmpeg e mediainfo. La tua chiave API è nella",
+      "apiKey": "pagina Integrazioni",
+      "download": "Scarica trackarr-upload.mjs"
+    },
+    "unknownError": "Errore sconosciuto"
+  }
+}
diff --git a/i18n/locales/ja/assistant.json b/i18n/locales/ja/assistant.json
new file mode 100644
index 00000000..fea0b1aa
--- /dev/null
+++ b/i18n/locales/ja/assistant.json
@@ -0,0 +1,59 @@
+{
+  "assistant": {
+    "entry": "アップロードアシスタント",
+    "title": "アップロードアシスタント",
+    "subtitle": "動画またはフォルダをドロップすると、トレント、MediaInfo、スクリーンショット、説明文が自動で作られます。",
+    "drop": "ここにファイルまたはフォルダをドロップ",
+    "pickFile": "ファイルを選択",
+    "pickFolder": "フォルダを選択",
+    "adult": "成人向けコンテンツ（画像ホストで NSFW として登録）",
+    "private": "ファイルはブラウザ内で読み込まれます。外部に出るのはスクリーンショットと .torrent だけです。",
+    "change": "変更",
+    "fileCount": "{count} 個のファイル、{size} | {count} 個のファイル、{size}",
+    "steps": {
+      "mediainfo": "MediaInfo を読み込み中",
+      "screenshots": "スクリーンショットを作成中",
+      "hash": ".torrent を作成中"
+    },
+    "screenshots": "スクリーンショット",
+    "screenshotsHint": "説明文に入れないものはチェックを外してください。",
+    "useShot": "スクリーンショット {n} を使う",
+    "details": "詳細",
+    "name": "トレント名",
+    "category": "カテゴリ",
+    "noCategory": "カテゴリなし",
+    "language": "説明文の言語",
+    "releaseTitle": "タイトル",
+    "ids": {
+      "imdbId": "IMDb",
+      "tmdbId": "TMDb",
+      "tvdbId": "TVDB"
+    },
+    "tags": "タグ",
+    "notes": "備考（任意）",
+    "description": "説明文（BBCode）",
+    "regenerate": "再生成",
+    "copyBbcode": "BBCode をコピー",
+    "published": "トレントを公開しました",
+    "alreadyExists": "このトレントは既にトラッカーにあります",
+    "seedHint": ".torrent をダウンロードし、ファイルがあるフォルダを指定してクライアントに追加すると、すぐにシードが始まります。",
+    "download": ".torrent をダウンロード",
+    "open": "トレントのページを開く",
+    "publishFailed": "公開に失敗しました",
+    "publish": "公開",
+    "downloadOnly": ".torrent のみダウンロード",
+    "waitHash": ".torrent を作成中...",
+    "engine": {
+      "browser": "{done}/{total}（ブラウザ）",
+      "ffmpeg": "{done}/{total}（ffmpeg、低速）"
+    },
+    "cli": {
+      "title": "コマンドラインツール",
+      "intro": "大きなリリースや一括処理向け。ターミナルから同じ結果を、大きなファイルでも高速に。",
+      "requirements": "Node.js 20+、ffmpeg、mediainfo が必要です。API キーは",
+      "apiKey": "連携ページ",
+      "download": "trackarr-upload.mjs をダウンロード"
+    },
+    "unknownError": "不明なエラー"
+  }
+}
diff --git a/i18n/locales/ru/assistant.json b/i18n/locales/ru/assistant.json
new file mode 100644
index 00000000..af766e66
--- /dev/null
+++ b/i18n/locales/ru/assistant.json
@@ -0,0 +1,59 @@
+{
+  "assistant": {
+    "entry": "Помощник загрузки",
+    "title": "Помощник загрузки",
+    "subtitle": "Перетащите видео или папку: торрент, MediaInfo, скриншоты и описание создаются автоматически.",
+    "drop": "Перетащите сюда файл или папку",
+    "pickFile": "Выбрать файл",
+    "pickFolder": "Выбрать папку",
+    "adult": "Контент для взрослых (скриншоты помечаются как NSFW на хостинге)",
+    "private": "Файлы читаются в браузере: ваш компьютер покидают только скриншоты и .torrent.",
+    "change": "Изменить",
+    "fileCount": "{count} файл, {size} | {count} файла, {size} | {count} файлов, {size}",
+    "steps": {
+      "mediainfo": "Чтение MediaInfo",
+      "screenshots": "Создание скриншотов",
+      "hash": "Создание .torrent"
+    },
+    "screenshots": "Скриншоты",
+    "screenshotsHint": "Снимите отметку с тех, что не нужны в описании.",
+    "useShot": "Использовать скриншот {n}",
+    "details": "Подробности",
+    "name": "Название торрента",
+    "category": "Категория",
+    "noCategory": "Без категории",
+    "language": "Язык описания",
+    "releaseTitle": "Название",
+    "ids": {
+      "imdbId": "IMDb",
+      "tmdbId": "TMDb",
+      "tvdbId": "TVDB"
+    },
+    "tags": "Теги",
+    "notes": "Примечания (необязательно)",
+    "description": "Описание (BBCode)",
+    "regenerate": "Создать заново",
+    "copyBbcode": "Копировать BBCode",
+    "published": "Торрент опубликован",
+    "alreadyExists": "Этот торрент уже есть на трекере",
+    "seedHint": "Скачайте .torrent и добавьте его в клиент, указав папку с файлами: раздача начнётся сразу.",
+    "download": "Скачать .torrent",
+    "open": "Открыть страницу торрента",
+    "publishFailed": "Не удалось опубликовать",
+    "publish": "Опубликовать",
+    "downloadOnly": "Только скачать .torrent",
+    "waitHash": "Создание .torrent...",
+    "engine": {
+      "browser": "{done}/{total} браузером",
+      "ffmpeg": "{done}/{total} через ffmpeg (медленнее)"
+    },
+    "cli": {
+      "title": "Инструмент командной строки",
+      "intro": "Для больших релизов или пакетов: тот же результат в терминале, быстрее на больших файлах.",
+      "requirements": "Нужны Node.js 20+, ffmpeg и mediainfo. Ваш API-ключ на",
+      "apiKey": "странице «Интеграции»",
+      "download": "Скачать trackarr-upload.mjs"
+    },
+    "unknownError": "Неизвестная ошибка"
+  }
+}
diff --git a/i18n/locales/zh/assistant.json b/i18n/locales/zh/assistant.json
new file mode 100644
index 00000000..7f668c3a
--- /dev/null
+++ b/i18n/locales/zh/assistant.json
@@ -0,0 +1,59 @@
+{
+  "assistant": {
+    "entry": "上传助手",
+    "title": "上传助手",
+    "subtitle": "拖入视频或文件夹：自动生成种子、MediaInfo、截图和描述。",
+    "drop": "将文件或文件夹拖到这里",
+    "pickFile": "选择文件",
+    "pickFolder": "选择文件夹",
+    "adult": "成人内容（截图在图床标记为 NSFW）",
+    "private": "文件在浏览器中读取：只有截图和 .torrent 会离开你的电脑。",
+    "change": "更换",
+    "fileCount": "{count} 个文件，{size} | {count} 个文件，{size}",
+    "steps": {
+      "mediainfo": "读取 MediaInfo",
+      "screenshots": "生成截图",
+      "hash": "创建 .torrent"
+    },
+    "screenshots": "截图",
+    "screenshotsHint": "取消勾选不想放进描述的截图。",
+    "useShot": "使用截图 {n}",
+    "details": "详情",
+    "name": "种子名称",
+    "category": "分类",
+    "noCategory": "无分类",
+    "language": "描述语言",
+    "releaseTitle": "标题",
+    "ids": {
+      "imdbId": "IMDb",
+      "tmdbId": "TMDb",
+      "tvdbId": "TVDB"
+    },
+    "tags": "标签",
+    "notes": "备注（可选）",
+    "description": "描述（BBCode）",
+    "regenerate": "重新生成",
+    "copyBbcode": "复制 BBCode",
+    "published": "种子已发布",
+    "alreadyExists": "该种子已在 tracker 上",
+    "seedHint": "下载 .torrent 并添加到客户端，保存位置指向包含这些文件的文件夹：即可立即做种。",
+    "download": "下载 .torrent",
+    "open": "打开种子页面",
+    "publishFailed": "发布失败",
+    "publish": "发布",
+    "downloadOnly": "仅下载 .torrent",
+    "waitHash": "正在创建 .torrent...",
+    "engine": {
+      "browser": "{done}/{total}（浏览器）",
+      "ffmpeg": "{done}/{total}（ffmpeg，较慢）"
+    },
+    "cli": {
+      "title": "命令行工具",
+      "intro": "适合大文件或批量发布：在终端中得到相同结果，大文件更快。",
+      "requirements": "需要 Node.js 20+、ffmpeg 和 mediainfo。API 密钥在",
+      "apiKey": "集成页面",
+      "download": "下载 trackarr-upload.mjs"
+    },
+    "unknownError": "未知错误"
+  }
+}
diff --git a/nuxt.config.ts b/nuxt.config.ts
index fe709fea..f2c0fe3b 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -1,7 +1,7 @@
 import pkg from './package.json';
 
 // One translation file per area, in i18n/locales/<code>/ (issue #43)
-const LOCALE_FILES = ['app.json', 'shop.json', 'messages.json', 'shoutbox.json', 'integrations.json', 'appearance.json', 'payments.json'];
+const LOCALE_FILES = ['app.json', 'shop.json', 'messages.json', 'shoutbox.json', 'integrations.json', 'appearance.json', 'payments.json', 'assistant.json'];
 
 // https://nuxt.com/docs/api/configuration/nuxt-config
 export default defineNuxtConfig({
@@ -81,6 +81,12 @@ export default defineNuxtConfig({
     transpile: ['chart.js', 'vue-chartjs'],
   },
 
+  vite: {
+    // ffmpeg.wasm starts its worker from new URL('./worker.js', import.meta.url):
+    // pre-bundling would break that path
+    optimizeDeps: { exclude: ['@ffmpeg/ffmpeg', '@ffmpeg/util'] },
+  },
+
   nitro: {
     // Source strings for the admin text editor (server/utils/localeSource.ts)
     serverAssets: [{ baseName: 'locales', dir: '../i18n/locales' }],
diff --git a/package-lock.json b/package-lock.json
index c8751761..9044c6e9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,6 +9,9 @@
       "version": "1.1.0",
       "hasInstallScript": true,
       "dependencies": {
+        "@ffmpeg/core": "^0.12.10",
+        "@ffmpeg/ffmpeg": "^0.12.15",
+        "@ffmpeg/util": "^0.12.2",
         "@fontsource/ibm-plex-mono": "^5.3.0",
         "@fontsource/ibm-plex-sans": "^5.3.0",
         "@fontsource/inter": "^5.3.0",
@@ -37,6 +40,7 @@
         "drizzle-orm": "^0.45.1",
         "ioredis": "^6.0.0",
         "marked": "^18.1.1",
+        "mediainfo.js": "^0.3.8",
         "nuxt": "^4.2.2",
         "nuxt-auth-utils": "^0.5.26",
         "parse-torrent": "^11.0.19",
@@ -57,6 +61,7 @@
         "@types/sanitize-html": "^2.16.2",
         "@vitest/coverage-v8": "^5.0.5",
         "drizzle-kit": "^0.31.8",
+        "esbuild": "^0.28.2",
         "pino": "^10.1.0",
         "pino-pretty": "^13.1.3",
         "tsx": "^4.21.0",
@@ -1555,6 +1560,45 @@
         "node": ">=18"
       }
     },
+    "node_modules/@ffmpeg/core": {
+      "version": "0.12.10",
+      "resolved": "https://registry.npmjs.org/@ffmpeg/core/-/core-0.12.10.tgz",
+      "integrity": "sha512-dzNplnn2Nxle2c2i2rrDhqcB19q9cglCkWnoMTDN9Q9l3PvdjZWd1HfSPjCNWc/p8Q3CT+Es9fWOR0UhAeYQZA==",
+      "license": "GPL-2.0-or-later",
+      "engines": {
+        "node": ">=16.x"
+      }
+    },
+    "node_modules/@ffmpeg/ffmpeg": {
+      "version": "0.12.15",
+      "resolved": "https://registry.npmjs.org/@ffmpeg/ffmpeg/-/ffmpeg-0.12.15.tgz",
+      "integrity": "sha512-1C8Obr4GsN3xw+/1Ww6PFM84wSQAGsdoTuTWPOj2OizsRDLT4CXTaVjPhkw6ARyDus1B9X/L2LiXHqYYsGnRFw==",
+      "license": "MIT",
+      "dependencies": {
+        "@ffmpeg/types": "^0.12.4"
+      },
+      "engines": {
+        "node": ">=18.x"
+      }
+    },
+    "node_modules/@ffmpeg/types": {
+      "version": "0.12.4",
+      "resolved": "https://registry.npmjs.org/@ffmpeg/types/-/types-0.12.4.tgz",
+      "integrity": "sha512-k9vJQNBGTxE5AhYDtOYR5rO5fKsspbg51gbcwtbkw2lCdoIILzklulcjJfIDwrtn7XhDeF2M+THwJ2FGrLeV6A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.x"
+      }
+    },
+    "node_modules/@ffmpeg/util": {
+      "version": "0.12.2",
+      "resolved": "https://registry.npmjs.org/@ffmpeg/util/-/util-0.12.2.tgz",
+      "integrity": "sha512-ouyoW+4JB7WxjeZ2y6KpRvB+dLp7Cp4ro8z0HIVpZVCM7AwFlHa0c4R8Y/a4M3wMqATpYKhC7lSFHQ0T11MEDw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.x"
+      }
+    },
     "node_modules/@floating-ui/core": {
       "version": "1.8.0",
       "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.8.0.tgz",
@@ -11557,6 +11601,21 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/mediainfo.js": {
+      "version": "0.3.8",
+      "resolved": "https://registry.npmjs.org/mediainfo.js/-/mediainfo.js-0.3.8.tgz",
+      "integrity": "sha512-34ruGC47ytdp5IE9lXx4Yj8XMxESbzqLxDGfnYXimnokxH+aavC/YqubakOKm0vwrC5ZisL55WMmud6R6TmjBw==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "yargs": "^18.1.0"
+      },
+      "bin": {
+        "mediainfo.js": "dist/esm/cli.js"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/merge-stream": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
diff --git a/package.json b/package.json
index ed93cd06..939d0000 100644
--- a/package.json
+++ b/package.json
@@ -4,6 +4,8 @@
   "type": "module",
   "private": true,
   "scripts": {
+    "prebuild": "node scripts/build-cli.mjs",
+    "build:cli": "node scripts/build-cli.mjs",
     "build": "nuxt build",
     "dev": "nuxt dev",
     "generate": "nuxt generate",
@@ -19,6 +21,9 @@
     "publish:public": "./scripts/publish-public.sh"
   },
   "dependencies": {
+    "@ffmpeg/core": "^0.12.10",
+    "@ffmpeg/ffmpeg": "^0.12.15",
+    "@ffmpeg/util": "^0.12.2",
     "@fontsource/ibm-plex-mono": "^5.3.0",
     "@fontsource/ibm-plex-sans": "^5.3.0",
     "@fontsource/inter": "^5.3.0",
@@ -47,6 +52,7 @@
     "drizzle-orm": "^0.45.1",
     "ioredis": "^6.0.0",
     "marked": "^18.1.1",
+    "mediainfo.js": "^0.3.8",
     "nuxt": "^4.2.2",
     "nuxt-auth-utils": "^0.5.26",
     "parse-torrent": "^11.0.19",
@@ -67,6 +73,7 @@
     "@types/sanitize-html": "^2.16.2",
     "@vitest/coverage-v8": "^5.0.5",
     "drizzle-kit": "^0.31.8",
+    "esbuild": "^0.28.2",
     "pino": "^10.1.0",
     "pino-pretty": "^13.1.3",
     "tsx": "^4.21.0",
diff --git a/scripts/build-cli.mjs b/scripts/build-cli.mjs
new file mode 100644
index 00000000..a2426b24
--- /dev/null
+++ b/scripts/build-cli.mjs
@@ -0,0 +1,18 @@
+/**
+ * Bundle the upload CLI (tools/upload-cli) into one file the tracker serves
+ * at /tools/trackarr-upload.mjs. Runs before `nuxt build` (npm prebuild).
+ */
+import { build } from 'esbuild';
+
+await build({
+  entryPoints: ['tools/upload-cli/main.ts'],
+  outfile: 'public/tools/trackarr-upload.mjs',
+  bundle: true,
+  platform: 'node',
+  format: 'esm',
+  target: 'node20',
+  banner: { js: '#!/usr/bin/env node' },
+  legalComments: 'none',
+  logLevel: 'warning',
+});
+console.log('Built public/tools/trackarr-upload.mjs');
diff --git a/server/api/torrents/[hash]/index.patch.ts b/server/api/torrents/[hash]/index.patch.ts
index 0f3f619a..c6b95e00 100644
--- a/server/api/torrents/[hash]/index.patch.ts
+++ b/server/api/torrents/[hash]/index.patch.ts
@@ -18,7 +18,7 @@ const patchSchema = z.object({
   imdbId: mediaIdSchema,
   tmdbId: mediaIdSchema,
   tvdbId: mediaIdSchema,
-  description: z.string().max(10000).nullable().optional(),
+  description: z.string().max(50000).nullable().optional(),
   categoryId: z.union([z.uuid(), z.literal('')]).nullable().optional(),
 });
 
diff --git a/server/api/torrents/index.post.ts b/server/api/torrents/index.post.ts
index 3404698e..1a810660 100644
--- a/server/api/torrents/index.post.ts
+++ b/server/api/torrents/index.post.ts
@@ -6,16 +6,18 @@ import { rateLimit, RATE_LIMITS } from '../../utils/rateLimit';
 import { normalizeTorrent, type NormalizedTorrent } from '../../utils/torrentFile';
 import { parseMediaIds } from '../../../shared/utils/mediaIds';
 import { awardUploadBonus } from '../../utils/bonus';
+import { requireUploader } from '../../utils/uploaderAuth';
 
 // readMultipartFormData buffers the whole body: reject oversized requests first
 const MAX_UPLOAD_BYTES = 5 * 1024 * 1024;
-const MAX_DESCRIPTION_LENGTH = 10000;
+// Room for a full MediaInfo report (upload assistant)
+const MAX_DESCRIPTION_LENGTH = 50000;
 const MAX_NAME_LENGTH = 255;
 const tagIdsSchema = z.array(z.uuid()).max(20);
 
 export default defineEventHandler(async (event) => {
-  // Require authentication
-  const { user } = await requireAuthSession(event);
+  // Signed-in user, or API key for the upload CLI
+  const user = await requireUploader(event);
 
   // Rate limit uploads
   await rateLimit(event, RATE_LIMITS.mutation);
diff --git a/server/api/upload-assistant/config.get.ts b/server/api/upload-assistant/config.get.ts
new file mode 100644
index 00000000..7a90a591
--- /dev/null
+++ b/server/api/upload-assistant/config.get.ts
@@ -0,0 +1,36 @@
+import { asc } from 'drizzle-orm';
+import { db, schema } from '../../db';
+import { requireUploader } from '../../utils/uploaderAuth';
+import { getSiteName } from '../../utils/settings';
+
+/**
+ * GET /api/upload-assistant/config
+ * What the web assistant and the CLI need to build and publish a torrent:
+ * the personal announce URL, the source tag, categories and tags.
+ * Session or `Authorization: Bearer <API key>`.
+ */
+export default defineEventHandler(async (event) => {
+  const user = await requireUploader(event);
+
+  const announce = new URL(useRuntimeConfig().public.trackerHttpUrl as string);
+  announce.searchParams.set('passkey', user.passkey);
+
+  const [categories, tags, siteName] = await Promise.all([
+    db
+      .select({ id: schema.categories.id, name: schema.categories.name, parentId: schema.categories.parentId })
+      .from(schema.categories)
+      .orderBy(asc(schema.categories.name)),
+    db.select({ id: schema.tags.id, name: schema.tags.name }).from(schema.tags).orderBy(asc(schema.tags.name)),
+    getSiteName(),
+  ]);
+
+  return {
+    siteName,
+    announceUrl: announce.toString(),
+    // info.source: the same files shared elsewhere get another info hash here
+    source: getRequestURL(event).hostname,
+    categories,
+    tags,
+    screenshots: { host: 'pixhost', maxPerUpload: 12 },
+  };
+});
diff --git a/server/api/upload-assistant/screenshot.post.ts b/server/api/upload-assistant/screenshot.post.ts
new file mode 100644
index 00000000..7c9db9a3
--- /dev/null
+++ b/server/api/upload-assistant/screenshot.post.ts
@@ -0,0 +1,43 @@
+import { requireUploader } from '../../utils/uploaderAuth';
+import { rateLimit } from '../../utils/rateLimit';
+import { detectImage } from '../../utils/imageType';
+import { uploadToPixhost } from '../../utils/pixhost';
+
+// Pixhost refuses images over 10 MB
+const MAX_IMAGE_BYTES = 10 * 1024 * 1024;
+
+/**
+ * POST /api/upload-assistant/screenshot
+ * Relay one screenshot to Pixhost for the web assistant: the page's CSP only
+ * lets the browser talk to this site. Multipart: `image` (JPEG/PNG/WebP) and
+ * `adult` ("1" for NSFW content, so Pixhost files it accordingly).
+ */
+export default defineEventHandler(async (event) => {
+  await requireUploader(event);
+  await rateLimit(event, { windowSec: 60, maxRequests: 30, prefix: 'shot' });
+
+  const contentLength = Number(getHeader(event, 'content-length') || 0);
+  if (!contentLength) throw createError({ statusCode: 411, message: 'Content-Length required' });
+  if (contentLength > MAX_IMAGE_BYTES + 64 * 1024) {
+    throw createError({ statusCode: 413, message: 'Screenshot too large (max 10 MB)' });
+  }
+
+  const form = await readMultipartFormData(event);
+  const image = form?.find((f) => f.name === 'image');
+  if (!image?.data?.length) throw createError({ statusCode: 400, message: 'No image' });
+  if (image.data.length > MAX_IMAGE_BYTES) {
+    throw createError({ statusCode: 413, message: 'Screenshot too large (max 10 MB)' });
+  }
+  const kind = detectImage(image.data);
+  if (!kind || !['jpeg', 'png', 'webp'].includes(kind.kind)) {
+    throw createError({ statusCode: 400, message: 'Screenshots must be JPEG, PNG or WebP' });
+  }
+  const adult = form?.find((f) => f.name === 'adult')?.data.toString() === '1';
+
+  try {
+    return await uploadToPixhost(image.data, `screenshot.${kind.ext}`, adult);
+  } catch (err) {
+    console.error('[Upload assistant] Pixhost upload failed:', (err as Error).message);
+    throw createError({ statusCode: 502, message: 'The image host refused the screenshot, try again' });
+  }
+});
diff --git a/server/utils/csp.ts b/server/utils/csp.ts
index 2f261137..38804caa 100644
--- a/server/utils/csp.ts
+++ b/server/utils/csp.ts
@@ -12,9 +12,11 @@ export function createCspNonce(): string {
 }
 
 export function buildCsp(nonce?: string, dev = import.meta.dev): string {
+  // 'wasm-unsafe-eval': WebAssembly for the upload assistant (MediaInfo,
+  // ffmpeg). It allows compiling wasm, not eval() of JavaScript
   const scriptSrc = dev
-    ? "script-src 'self' 'unsafe-inline'" // Vite HMR and devtools in development
-    : `script-src 'self'${nonce ? ` 'nonce-${nonce}'` : ''}`;
+    ? "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'" // Vite HMR and devtools in development
+    : `script-src 'self' 'wasm-unsafe-eval'${nonce ? ` 'nonce-${nonce}'` : ''}`;
 
   return [
     "default-src 'self'",
@@ -22,7 +24,9 @@ export function buildCsp(nonce?: string, dev = import.meta.dev): string {
     // Style attributes from Vue :style bindings rendered on the server,
     // and styles injected at runtime (icons, editor), need it
     "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data: https:",
+    // blob: the upload assistant previews the local video and its screenshots
+    "img-src 'self' data: blob: https:",
+    "media-src 'self' blob:",
     "font-src 'self' data:",
     "connect-src 'self'",
     "frame-ancestors 'none'",
diff --git a/server/utils/pixhost.ts b/server/utils/pixhost.ts
new file mode 100644
index 00000000..833ad3e6
--- /dev/null
+++ b/server/utils/pixhost.ts
@@ -0,0 +1,48 @@
+/**
+ * Pixhost API v2 (no key): POST https://api.pixhost.to/images with `img`,
+ * `content_type` (0 safe, 1 adult) and `max_th_size`. Answers the image page
+ * and a thumbnail; trackers show the thumbnail linking to the page.
+ */
+
+// PIXHOST_API_URL: tests point it at a local stand-in
+const endpoint = () => process.env.PIXHOST_API_URL || 'https://api.pixhost.to/images';
+const THUMB_SIZE = 350;
+
+export interface HostedImage {
+  page: string;
+  thumb: string;
+}
+
+/** Only links on Pixhost domains are accepted back */
+export function isPixhostUrl(value: unknown): value is string {
+  if (typeof value !== 'string') return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === 'https:' && /(^|\.)pixhost\.(to|cc)$|(^|\.)pixho\.st$/.test(url.hostname);
+  } catch {
+    return false;
+  }
+}
+
+export async function uploadToPixhost(
+  data: Uint8Array,
+  filename: string,
+  adult: boolean
+): Promise<HostedImage> {
+  const form = new FormData();
+  form.append('img', new Blob([data as Uint8Array<ArrayBuffer>]), filename);
+  form.append('content_type', adult ? '1' : '0');
+  form.append('max_th_size', String(THUMB_SIZE));
+  const res = await fetch(endpoint(), {
+    method: 'POST',
+    headers: { Accept: 'application/json' },
+    body: form,
+    signal: AbortSignal.timeout(60_000),
+  });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const body = (await res.json()) as { show_url?: unknown; th_url?: unknown };
+  if (!isPixhostUrl(body.show_url) || !isPixhostUrl(body.th_url)) {
+    throw new Error('Unexpected response');
+  }
+  return { page: body.show_url, thumb: body.th_url };
+}
diff --git a/server/utils/schemas.ts b/server/utils/schemas.ts
index 83751564..ba368f48 100644
--- a/server/utils/schemas.ts
+++ b/server/utils/schemas.ts
@@ -83,7 +83,7 @@ export const registerSchema = z.object({
 
 export const torrentUploadSchema = z.object({
   categoryId: z.uuid('Invalid category ID').optional(),
-  description: z.string().max(10000, 'Description too long').optional(),
+  description: z.string().max(50000, 'Description too long').optional(),
 });
 
 export const torrentQuerySchema = z.object({
diff --git a/server/utils/uploaderAuth.ts b/server/utils/uploaderAuth.ts
new file mode 100644
index 00000000..c4af1579
--- /dev/null
+++ b/server/utils/uploaderAuth.ts
@@ -0,0 +1,57 @@
+import type { H3Event } from 'h3';
+import { eq } from 'drizzle-orm';
+import { db } from '../db';
+import { users } from '../db/schema';
+import { requireAuthSession, type AuthUserState } from './adminAuth';
+import { parseTorznabCredential } from './apiKey';
+
+export interface Uploader {
+  id: string;
+  isAdmin: boolean;
+  isModerator: boolean;
+  passkey: string;
+}
+
+/**
+ * Who uploads: the signed-in user, or the owner of the API key sent as
+ * `Authorization: Bearer tk_...` (upload CLI). The key is the one of the
+ * Integrations page; a header is never sent by a browser on its own, so this
+ * opens no CSRF path. Banned and unpaid accounts are refused either way.
+ */
+export async function requireUploader(event: H3Event): Promise<Uploader> {
+  const header = getHeader(event, 'authorization');
+  if (header) {
+    const match = /^Bearer\s+(\S+)$/i.exec(header.trim());
+    const credential = match ? parseTorznabCredential(match[1]) : null;
+    if (!credential || credential.kind !== 'apiKey') {
+      throw createError({ statusCode: 401, message: 'Invalid API key' });
+    }
+    const [user] = await db
+      .select({
+        id: users.id,
+        isAdmin: users.isAdmin,
+        isModerator: users.isModerator,
+        isBanned: users.isBanned,
+        paymentPending: users.paymentPending,
+        passkey: users.passkey,
+      })
+      .from(users)
+      .where(eq(users.apiKey, credential.value))
+      .limit(1);
+    if (!user) throw createError({ statusCode: 401, message: 'Invalid API key' });
+    if (user.isBanned) throw createError({ statusCode: 403, message: 'Your account has been banned' });
+    if (user.paymentPending) {
+      throw createError({ statusCode: 402, message: 'Payment required to activate your account' });
+    }
+    return { id: user.id, isAdmin: user.isAdmin, isModerator: user.isModerator, passkey: user.passkey };
+  }
+
+  const session = await requireAuthSession(event);
+  const state = event.context.authUser as AuthUserState;
+  return {
+    id: session.user.id,
+    isAdmin: state.isAdmin,
+    isModerator: state.isModerator,
+    passkey: state.passkey,
+  };
+}
diff --git a/shared/utils/bbcode.ts b/shared/utils/bbcode.ts
new file mode 100644
index 00000000..091a0257
--- /dev/null
+++ b/shared/utils/bbcode.ts
@@ -0,0 +1,220 @@
+/**
+ * BBCode to HTML for torrent descriptions. Every text node is escaped and only
+ * whitelisted tags produce markup; links and images must be http(s). The
+ * result still goes through DOMPurify before reaching v-html (app/utils/markdown.ts).
+ *
+ * Supported: b i u s, center left right, size=1-7, color, url, url=, img,
+ * quote, quote=, code, spoiler, spoiler=, list, list=1, [*], hr.
+ * Unknown or unbalanced tags stay as plain text.
+ */
+
+const ESCAPES: Record<string, string> = {
+  '&': '&amp;',
+  '<': '&lt;',
+  '>': '&gt;',
+  '"': '&quot;',
+  "'": '&#39;',
+};
+
+export function escapeHtml(text: string): string {
+  return text.replace(/[&<>"']/g, (c) => ESCAPES[c]!);
+}
+
+const PAIRED = new Set([
+  'b', 'i', 'u', 's', 'center', 'left', 'right', 'size', 'color',
+  'url', 'img', 'quote', 'code', 'spoiler', 'list',
+]);
+/** Tags whose surrounding line breaks are layout, not content */
+const BLOCK = new Set(['center', 'left', 'right', 'quote', 'code', 'spoiler', 'list']);
+
+const SIZES = ['0.75em', '0.875em', '1em', '1.125em', '1.375em', '1.75em', '2.25em'];
+
+/** True when the text uses BBCode (a known tag opened and closed) */
+export function looksLikeBbcode(text: string): boolean {
+  return /\[(b|i|u|s|center|size|color|url|img|quote|code|spoiler|list)(=[^\]]*)?\][\s\S]*?\[\/\1\]/i.test(text);
+}
+
+function safeUrl(raw: string): string | null {
+  const url = raw.trim();
+  if (!/^https?:\/\/[^\s"'<>]+$/i.test(url)) return null;
+  try {
+    return new URL(url).href;
+  } catch {
+    return null;
+  }
+}
+
+function safeColor(raw: string): string | null {
+  const color = raw.trim();
+  return /^(#[0-9a-f]{3}|#[0-9a-f]{6}|[a-z]{3,20})$/i.test(color) ? color : null;
+}
+
+interface Node {
+  tag: string;
+  arg: string | null;
+  children: (Node | string)[];
+  /** Source text of the opening tag, to restore it when never closed */
+  raw: string;
+}
+
+const TOKEN = /\[(\/?)([a-z]+|\*)(?:=([^\]\n]{0,500}))?\]/gi;
+
+function parse(source: string): Node {
+  const root: Node = { tag: '', arg: null, children: [], raw: '' };
+  const stack: Node[] = [root];
+  let last = 0;
+  const top = () => stack[stack.length - 1]!;
+  const text = (t: string) => t && top().children.push(t);
+
+  for (const match of source.matchAll(TOKEN)) {
+    const [raw, closing, rawName, arg] = match;
+    const name = rawName!.toLowerCase();
+    const index = match.index!;
+    const current = top();
+
+    // Inside [code], everything but its closing tag is text
+    if (current.tag === 'code' && !(closing && name === 'code')) continue;
+
+    text(source.slice(last, index));
+    last = index + raw.length;
+
+    if (name === '*') {
+      if (closing) {
+        text(raw);
+        continue;
+      }
+      // A list item runs until the next [*] or the end of the list
+      if (current.tag === '*') stack.pop();
+      if (top().tag !== 'list') {
+        text(raw);
+        continue;
+      }
+      const item: Node = { tag: '*', arg: null, children: [], raw };
+      top().children.push(item);
+      stack.push(item);
+      continue;
+    }
+    if (name === 'hr' && !closing) {
+      top().children.push({ tag: 'hr', arg: null, children: [], raw });
+      continue;
+    }
+    if (!PAIRED.has(name)) {
+      text(raw);
+      continue;
+    }
+    if (!closing) {
+      const node: Node = { tag: name, arg: arg ?? null, children: [], raw };
+      current.children.push(node);
+      stack.push(node);
+      continue;
+    }
+    // Closing tag: close up to the matching opener (list items close with their list)
+    const at = stack.map((n) => n.tag).lastIndexOf(name);
+    if (at <= 0) {
+      text(raw);
+      continue;
+    }
+    stack.length = at;
+  }
+  // [code] swallowed the rest as text
+  if (top().tag === 'code') {
+    top().children.push(source.slice(last));
+  } else {
+    text(source.slice(last));
+  }
+  // Never closed: back to text, children kept
+  for (let i = stack.length - 1; i > 0; i--) {
+    const node = stack[i]!;
+    if (node.tag === '*') continue;
+    node.tag = `unclosed:${node.raw}`;
+  }
+  return root;
+}
+
+function textOf(node: Node): string {
+  return node.children.map((c) => (typeof c === 'string' ? c : textOf(c))).join('');
+}
+
+/** Escape text; line breaks become <br>, except next to block tags */
+function renderText(text: string, trimStart: boolean, trimEnd: boolean): string {
+  let t = text;
+  if (trimStart) t = t.replace(/^[ \t]*\r?\n/, '');
+  if (trimEnd) t = t.replace(/\r?\n[ \t]*$/, '');
+  return escapeHtml(t).replace(/\r?\n/g, '<br>');
+}
+
+function renderChildren(node: Node): string {
+  const kids = node.children;
+  return kids
+    .map((child, i) => {
+      if (typeof child !== 'string') return renderNode(child);
+      const prev = kids[i - 1];
+      const next = kids[i + 1];
+      const isBlock = (n: Node | string | undefined) =>
+        typeof n === 'object' && (BLOCK.has(n.tag) || n.tag === 'hr' || n.tag === '*');
+      // Inside a list, text between items is layout
+      if (node.tag === 'list') return child.trim() ? escapeHtml(child.trim()) : '';
+      return renderText(
+        child,
+        i === 0 ? BLOCK.has(node.tag) || node.tag === '*' : isBlock(prev),
+        i === kids.length - 1 ? BLOCK.has(node.tag) || node.tag === '*' : isBlock(next)
+      );
+    })
+    .join('');
+}
+
+function renderNode(node: Node): string {
+  if (node.tag.startsWith('unclosed:')) {
+    return escapeHtml(node.tag.slice('unclosed:'.length)) + renderChildren(node);
+  }
+  const inner = () => renderChildren(node);
+  switch (node.tag) {
+    case 'b':
+      return `<strong>${inner()}</strong>`;
+    case 'i':
+      return `<em>${inner()}</em>`;
+    case 'u':
+      return `<u>${inner()}</u>`;
+    case 's':
+      return `<s>${inner()}</s>`;
+    case 'center':
+    case 'left':
+    case 'right':
+      return `<div style="text-align:${node.tag}">${inner()}</div>`;
+    case 'size': {
+      const size = SIZES[Number(node.arg) - 1];
+      return size ? `<span style="font-size:${size}">${inner()}</span>` : inner();
+    }
+    case 'color': {
+      const color = node.arg ? safeColor(node.arg) : null;
+      return color ? `<span style="color:${color}">${inner()}</span>` : inner();
+    }
+    case 'url': {
+      const href = safeUrl(node.arg ?? textOf(node));
+      if (!href) return inner();
+      return `<a href="${escapeHtml(href)}" rel="nofollow noopener noreferrer">${inner()}</a>`;
+    }
+    case 'img': {
+      const src = safeUrl(textOf(node));
+      return src ? `<img src="${escapeHtml(src)}" alt="" loading="lazy">` : escapeHtml(textOf(node));
+    }
+    case 'quote':
+      return `<blockquote>${node.arg ? `<cite>${escapeHtml(node.arg)}</cite>` : ''}${inner()}</blockquote>`;
+    case 'code':
+      return `<pre><code>${escapeHtml(textOf(node).replace(/^\r?\n|\r?\n$/g, ''))}</code></pre>`;
+    case 'spoiler':
+      return `<details><summary>${escapeHtml(node.arg?.trim() || 'Spoiler')}</summary>${inner()}</details>`;
+    case 'list':
+      return node.arg === '1' ? `<ol>${inner()}</ol>` : `<ul>${inner()}</ul>`;
+    case '*':
+      return `<li>${inner()}</li>`;
+    case 'hr':
+      return '<hr>';
+    default:
+      return inner();
+  }
+}
+
+export function bbcodeToHtml(source: string): string {
+  return renderChildren(parse(source));
+}
diff --git a/shared/utils/release/description.ts b/shared/utils/release/description.ts
new file mode 100644
index 00000000..b2c7732d
--- /dev/null
+++ b/shared/utils/release/description.ts
@@ -0,0 +1,190 @@
+/**
+ * BBCode description of a release, in the chosen language: title, release
+ * details, video/audio/subtitle tracks, screenshots (thumbnail linking to the
+ * full image), file list and the full MediaInfo report in spoilers.
+ * Rendered by the site (shared/utils/bbcode.ts) and reusable elsewhere.
+ */
+
+import { DESCRIPTION_LABELS, type DescriptionLanguage } from './labels';
+import { resolutionLabel, type MediaSummary } from './mediainfo';
+import type { ReleaseName } from './releaseName';
+
+export interface Screenshot {
+  /** Full-size image page (pixhost show page) */
+  page: string;
+  /** Thumbnail URL */
+  thumb: string;
+}
+
+export interface DescriptionInput {
+  lang: DescriptionLanguage;
+  title: string;
+  release?: Partial<ReleaseName>;
+  summary?: MediaSummary | null;
+  mediaInfoText?: string | null;
+  screenshots?: Screenshot[];
+  files?: { path: string; size: number }[];
+  notes?: string | null;
+}
+
+/** BBCode closes on "[/": keep user text from opening or closing tags */
+export function escapeBbcode(text: string): string {
+  return text.replace(/\[/g, '(').replace(/\]/g, ')');
+}
+
+export function formatSize(bytes: number, lang: DescriptionLanguage): string {
+  const units = DESCRIPTION_LABELS[lang].units;
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  const digits = unit === 0 ? 0 : value < 10 ? 2 : value < 100 ? 1 : 0;
+  return `${new Intl.NumberFormat(lang, { maximumFractionDigits: digits }).format(value)} ${units[unit]}`;
+}
+
+export function formatDuration(seconds: number, lang: DescriptionLanguage): string {
+  const { hours, minutes } = DESCRIPTION_LABELS[lang];
+  const total = Math.round(seconds / 60);
+  const h = Math.floor(total / 60);
+  const m = total % 60;
+  if (h === 0) return `${Math.max(m, seconds > 0 ? 1 : 0)} ${minutes}`;
+  return `${h} ${hours} ${String(m).padStart(2, '0')} ${minutes}`;
+}
+
+export function formatBitrate(bps: number, lang: DescriptionLanguage): string {
+  const nf = (n: number, d: number) =>
+    new Intl.NumberFormat(lang, { maximumFractionDigits: d }).format(n);
+  return bps >= 1_000_000 ? `${nf(bps / 1_000_000, 1)} Mb/s` : `${nf(bps / 1000, 0)} kb/s`;
+}
+
+/** "fr" -> "Français" in the description language; unknown codes as given */
+export function languageName(code: string | null, lang: DescriptionLanguage): string | null {
+  if (!code) return null;
+  try {
+    const name = new Intl.DisplayNames([lang], { type: 'language' }).of(code);
+    if (name && name !== code) return name.charAt(0).toLocaleUpperCase(lang) + name.slice(1);
+  } catch {
+    // Not a language tag: MediaInfo sometimes gives a full name
+  }
+  return code;
+}
+
+const join = (parts: (string | null | undefined | false)[]) =>
+  parts.filter((p): p is string => Boolean(p)).join(' · ');
+
+export function buildDescription(input: DescriptionInput): string {
+  const { lang } = input;
+  const l = DESCRIPTION_LABELS[lang];
+  const nf = (n: number, d = 3) => new Intl.NumberFormat(lang, { maximumFractionDigits: d }).format(n);
+  const out: string[] = [];
+  const release = input.release ?? {};
+  const summary = input.summary;
+
+  // Title
+  const heading = `${escapeBbcode(input.title)}${release.year ? ` (${release.year})` : ''}`;
+  const episode =
+    release.season !== null && release.season !== undefined
+      ? join([`${l.season} ${release.season}`, release.episode ? `${l.episode} ${release.episode}` : null])
+      : null;
+  out.push(`[center][size=6][b]${heading}[/b][/size]${episode ? `\n[size=4]${episode}[/size]` : ''}[/center]`);
+
+  if (input.notes?.trim()) {
+    out.push(`[b]${l.notes}[/b]\n${escapeBbcode(input.notes.trim())}`);
+  }
+
+  // Release
+  const video = summary?.video[0];
+  const releaseItems = [
+    release.source ? `[b]${l.source}:[/b] ${escapeBbcode(release.source)}` : null,
+    release.resolution || resolutionLabel(video)
+      ? `[b]${l.video}:[/b] ${release.resolution ?? resolutionLabel(video)}`
+      : null,
+    release.group ? `[b]${l.group}:[/b] ${escapeBbcode(release.group)}` : null,
+  ].filter(Boolean);
+  if (releaseItems.length) {
+    out.push(`[b][size=4]${l.release}[/size][/b]\n${releaseItems.join('\n')}`);
+  }
+
+  if (summary) {
+    // General
+    out.push(
+      `[b][size=4]${l.general}[/size][/b]\n` +
+        [
+          summary.container ? `[b]${l.container}:[/b] ${escapeBbcode(summary.container)}` : null,
+          summary.duration ? `[b]${l.duration}:[/b] ${formatDuration(summary.duration, lang)}` : null,
+          summary.size ? `[b]${l.size}:[/b] ${formatSize(summary.size, lang)}` : null,
+          summary.bitrate ? `[b]${l.bitrate}:[/b] ${formatBitrate(summary.bitrate, lang)}` : null,
+        ]
+          .filter(Boolean)
+          .join('\n')
+    );
+
+    const list = (title: string, items: string[]) =>
+      items.length ? `[b][size=4]${title}[/size][/b]\n[list]\n${items.map((i) => `[*]${i}`).join('\n')}\n[/list]` : null;
+
+    const videoBlock = list(
+      l.video,
+      summary.video.map((v) =>
+        join([
+          escapeBbcode(v.codec),
+          v.width && v.height ? `${v.width}×${v.height}${resolutionLabel(v) ? ` (${resolutionLabel(v)})` : ''}` : null,
+          v.fps ? `${nf(v.fps)} fps` : null,
+          v.bitrate ? formatBitrate(v.bitrate, lang) : null,
+          v.bitDepth ? `${v.bitDepth} ${l.bits}` : null,
+          v.hdr,
+        ])
+      )
+    );
+    const audioBlock = list(
+      l.audio,
+      summary.audio.map((a) =>
+        join([
+          languageName(a.language, lang),
+          escapeBbcode(a.codec),
+          a.channels,
+          a.bitrate ? formatBitrate(a.bitrate, lang) : null,
+          a.title ? `"${escapeBbcode(a.title)}"` : null,
+        ])
+      )
+    );
+    const subtitleBlock = list(
+      l.subtitles,
+      summary.subtitles.map((s) =>
+        join([
+          `${languageName(s.language, lang) ?? '?'}${s.forced ? ` (${l.forced})` : ''}`,
+          escapeBbcode(s.format),
+          s.title ? `"${escapeBbcode(s.title)}"` : null,
+        ])
+      )
+    );
+    for (const block of [videoBlock, audioBlock, subtitleBlock]) if (block) out.push(block);
+  }
+
+  // Screenshots: two per line, thumbnail linking to the full image
+  const shots = (input.screenshots ?? []).filter((s) => /^https:\/\//.test(s.page) && /^https:\/\//.test(s.thumb));
+  if (shots.length) {
+    const rows: string[] = [];
+    for (let i = 0; i < shots.length; i += 2) {
+      rows.push(shots.slice(i, i + 2).map((s) => `[url=${s.page}][img]${s.thumb}[/img][/url]`).join(' '));
+    }
+    out.push(`[b][size=4]${l.screenshots}[/size][/b]\n[center]${rows.join('\n')}[/center]`);
+  }
+
+  const files = input.files ?? [];
+  if (files.length > 1) {
+    out.push(
+      `[spoiler=${l.files} (${files.length})][list]\n` +
+        files.map((f) => `[*]${escapeBbcode(f.path)} (${formatSize(f.size, lang)})`).join('\n') +
+        '\n[/list][/spoiler]'
+    );
+  }
+
+  if (input.mediaInfoText?.trim()) {
+    // Inside [code] nothing is parsed: only a literal closing tag must go
+    out.push(`[spoiler=MediaInfo][code]${input.mediaInfoText.trim().replace(/\[\/code\]/gi, '[/c0de]')}[/code][/spoiler]`);
+  }
+
+  return out.join('\n\n');
+}
diff --git a/shared/utils/release/labels.ts b/shared/utils/release/labels.ts
new file mode 100644
index 00000000..e61bd13a
--- /dev/null
+++ b/shared/utils/release/labels.ts
@@ -0,0 +1,97 @@
+/**
+ * Words of the generated description, per language. Not in i18n/locales: the
+ * CLI renders descriptions too, without the app's i18n. Typed so every
+ * language has every key.
+ */
+
+export const DESCRIPTION_LANGUAGES = ['en', 'fr', 'es', 'de', 'it', 'zh', 'ja', 'ru'] as const;
+export type DescriptionLanguage = (typeof DESCRIPTION_LANGUAGES)[number];
+
+export interface DescriptionLabels {
+  release: string;
+  source: string;
+  group: string;
+  season: string;
+  episode: string;
+  video: string;
+  audio: string;
+  subtitles: string;
+  general: string;
+  container: string;
+  duration: string;
+  size: string;
+  bitrate: string;
+  bits: string;
+  forced: string;
+  screenshots: string;
+  files: string;
+  notes: string;
+  hours: string;
+  minutes: string;
+  units: [string, string, string, string, string];
+}
+
+const EN_UNITS: DescriptionLabels['units'] = ['B', 'KB', 'MB', 'GB', 'TB'];
+
+export const DESCRIPTION_LABELS: Record<DescriptionLanguage, DescriptionLabels> = {
+  en: {
+    release: 'Release', source: 'Source', group: 'Group', season: 'Season', episode: 'Episode',
+    video: 'Video', audio: 'Audio', subtitles: 'Subtitles', general: 'General',
+    container: 'Container', duration: 'Duration', size: 'Size', bitrate: 'Bitrate', bits: 'bits',
+    forced: 'forced', screenshots: 'Screenshots', files: 'Files', notes: 'Notes',
+    hours: 'h', minutes: 'min', units: EN_UNITS,
+  },
+  fr: {
+    release: 'Release', source: 'Source', group: 'Team', season: 'Saison', episode: 'Épisode',
+    video: 'Vidéo', audio: 'Audio', subtitles: 'Sous-titres', general: 'Général',
+    container: 'Conteneur', duration: 'Durée', size: 'Taille', bitrate: 'Débit', bits: 'bits',
+    forced: 'forcés', screenshots: 'Captures', files: 'Fichiers', notes: 'Notes',
+    hours: 'h', minutes: 'min', units: ['o', 'Ko', 'Mo', 'Go', 'To'],
+  },
+  es: {
+    release: 'Release', source: 'Fuente', group: 'Grupo', season: 'Temporada', episode: 'Episodio',
+    video: 'Vídeo', audio: 'Audio', subtitles: 'Subtítulos', general: 'General',
+    container: 'Contenedor', duration: 'Duración', size: 'Tamaño', bitrate: 'Tasa de bits', bits: 'bits',
+    forced: 'forzados', screenshots: 'Capturas', files: 'Archivos', notes: 'Notas',
+    hours: 'h', minutes: 'min', units: EN_UNITS,
+  },
+  de: {
+    release: 'Release', source: 'Quelle', group: 'Gruppe', season: 'Staffel', episode: 'Folge',
+    video: 'Video', audio: 'Audio', subtitles: 'Untertitel', general: 'Allgemein',
+    container: 'Container', duration: 'Laufzeit', size: 'Größe', bitrate: 'Bitrate', bits: 'Bit',
+    forced: 'erzwungen', screenshots: 'Screenshots', files: 'Dateien', notes: 'Hinweise',
+    hours: 'Std.', minutes: 'Min.', units: EN_UNITS,
+  },
+  it: {
+    release: 'Release', source: 'Sorgente', group: 'Gruppo', season: 'Stagione', episode: 'Episodio',
+    video: 'Video', audio: 'Audio', subtitles: 'Sottotitoli', general: 'Generale',
+    container: 'Contenitore', duration: 'Durata', size: 'Dimensione', bitrate: 'Bitrate', bits: 'bit',
+    forced: 'forzati', screenshots: 'Screenshot', files: 'File', notes: 'Note',
+    hours: 'h', minutes: 'min', units: EN_UNITS,
+  },
+  zh: {
+    release: '发布', source: '来源', group: '小组', season: '季', episode: '集',
+    video: '视频', audio: '音频', subtitles: '字幕', general: '概要',
+    container: '容器', duration: '时长', size: '大小', bitrate: '码率', bits: '位',
+    forced: '强制', screenshots: '截图', files: '文件', notes: '备注',
+    hours: '小时', minutes: '分钟', units: EN_UNITS,
+  },
+  ja: {
+    release: 'リリース', source: 'ソース', group: 'グループ', season: 'シーズン', episode: 'エピソード',
+    video: '映像', audio: '音声', subtitles: '字幕', general: '概要',
+    container: 'コンテナ', duration: '再生時間', size: 'サイズ', bitrate: 'ビットレート', bits: 'ビット',
+    forced: '強制', screenshots: 'スクリーンショット', files: 'ファイル', notes: '備考',
+    hours: '時間', minutes: '分', units: EN_UNITS,
+  },
+  ru: {
+    release: 'Релиз', source: 'Источник', group: 'Группа', season: 'Сезон', episode: 'Серия',
+    video: 'Видео', audio: 'Аудио', subtitles: 'Субтитры', general: 'Общее',
+    container: 'Контейнер', duration: 'Длительность', size: 'Размер', bitrate: 'Битрейт', bits: 'бит',
+    forced: 'форсированные', screenshots: 'Скриншоты', files: 'Файлы', notes: 'Примечания',
+    hours: 'ч', minutes: 'мин', units: ['Б', 'КБ', 'МБ', 'ГБ', 'ТБ'],
+  },
+};
+
+export function isDescriptionLanguage(value: unknown): value is DescriptionLanguage {
+  return typeof value === 'string' && (DESCRIPTION_LANGUAGES as readonly string[]).includes(value);
+}
diff --git a/shared/utils/release/mediainfo.ts b/shared/utils/release/mediainfo.ts
new file mode 100644
index 00000000..969d16af
--- /dev/null
+++ b/shared/utils/release/mediainfo.ts
@@ -0,0 +1,167 @@
+/**
+ * MediaInfo JSON (mediainfo.js in the browser, `mediainfo --Output=JSON` in
+ * the CLI: same library, same shape) reduced to what a release description
+ * shows. Values come as strings or numbers depending on the build.
+ */
+
+type Raw = Record<string, unknown>;
+
+export interface VideoTrack {
+  codec: string;
+  width: number | null;
+  height: number | null;
+  fps: number | null;
+  bitrate: number | null;
+  bitDepth: number | null;
+  hdr: string | null;
+}
+
+export interface AudioTrack {
+  codec: string;
+  channels: string | null;
+  bitrate: number | null;
+  language: string | null;
+  title: string | null;
+}
+
+export interface SubtitleTrack {
+  format: string;
+  language: string | null;
+  title: string | null;
+  forced: boolean;
+}
+
+export interface MediaSummary {
+  container: string | null;
+  /** Seconds */
+  duration: number | null;
+  size: number | null;
+  /** Bits per second */
+  bitrate: number | null;
+  video: VideoTrack[];
+  audio: AudioTrack[];
+  subtitles: SubtitleTrack[];
+}
+
+const str = (v: unknown): string | null => {
+  if (typeof v === 'number') return String(v);
+  if (typeof v !== 'string') return null;
+  const s = v.trim();
+  return s ? s : null;
+};
+
+const num = (v: unknown): number | null => {
+  const s = str(v);
+  if (s === null) return null;
+  const n = Number(s.split(' / ')[0]);
+  return Number.isFinite(n) ? n : null;
+};
+
+const yes = (v: unknown) => str(v)?.toLowerCase() === 'yes';
+
+/** 6 channels -> 5.1, 8 -> 7.1, 2 -> 2.0 */
+export function channelLayout(count: number | null): string | null {
+  if (!count) return null;
+  if (count >= 3 && count !== 4) return `${count - 1}.1`;
+  return `${count}.0`;
+}
+
+function hdrLabel(track: Raw): string | null {
+  const formats = [track.HDR_Format, track.HDR_Format_Compatibility, track.HDR_Format_Commercial]
+    .map(str)
+    .filter(Boolean)
+    .join(' / ');
+  const labels: string[] = [];
+  if (/dolby vision/i.test(formats)) labels.push('Dolby Vision');
+  if (/2094 app 4|hdr10\+/i.test(formats)) labels.push('HDR10+');
+  else if (/2086|hdr10/i.test(formats)) labels.push('HDR10');
+  if (/hlg/i.test(`${formats} ${str(track.transfer_characteristics) ?? ''}`)) labels.push('HLG');
+  if (labels.length === 0 && /pq|2084/i.test(str(track.transfer_characteristics) ?? '')) labels.push('HDR');
+  return labels.length ? labels.join(' + ') : null;
+}
+
+function videoCodec(track: Raw): string {
+  const format = str(track.Format) ?? '?';
+  const name = format === 'AVC' ? 'H.264' : format === 'HEVC' ? 'H.265 (HEVC)' : format;
+  const profile = str(track.Format_Profile);
+  return profile && format !== 'AV1' ? `${name} ${profile.split('@')[0]}` : name;
+}
+
+function audioCodec(track: Raw): string {
+  const commercial = str(track.Format_Commercial_IfAny);
+  const format = str(track.Format) ?? '?';
+  let name = commercial ?? format;
+  const features = `${str(track.Format_AdditionalFeatures) ?? ''} ${commercial ?? ''}`;
+  if (/JOC|Atmos/i.test(features) && !/Atmos/i.test(name)) name += ' Atmos';
+  return name;
+}
+
+/** Parse the JSON (string or object) of one file */
+export function summarizeMediaInfo(raw: unknown): MediaSummary {
+  let data: unknown = raw;
+  if (typeof raw === 'string') data = JSON.parse(raw);
+  const media = (data as { media?: { track?: Raw[] } } | null)?.media;
+  const tracks = Array.isArray(media?.track) ? media!.track! : [];
+  const general = tracks.find((t) => t['@type'] === 'General') ?? {};
+
+  return {
+    container: str(general.Format),
+    duration: num(general.Duration),
+    size: num(general.FileSize),
+    bitrate: num(general.OverallBitRate),
+    video: tracks
+      .filter((t) => t['@type'] === 'Video')
+      .map((t) => ({
+        codec: videoCodec(t),
+        width: num(t.Width),
+        height: num(t.Height),
+        fps: num(t.FrameRate),
+        bitrate: num(t.BitRate) ?? num(t.BitRate_Nominal),
+        bitDepth: num(t.BitDepth),
+        hdr: hdrLabel(t),
+      })),
+    audio: tracks
+      .filter((t) => t['@type'] === 'Audio')
+      .map((t) => ({
+        codec: audioCodec(t),
+        channels: channelLayout(num(t.Channels)),
+        bitrate: num(t.BitRate) ?? num(t.BitRate_Maximum),
+        language: str(t.Language),
+        title: str(t.Title),
+      })),
+    subtitles: tracks
+      .filter((t) => t['@type'] === 'Text')
+      .map((t) => ({
+        format: str(t.Format) ?? '?',
+        language: str(t.Language),
+        title: str(t.Title),
+        forced: yes(t.Forced),
+      })),
+  };
+}
+
+/** 2160p, 1080p... from the frame size (cropped widescreen still counts) */
+export function resolutionLabel(video: VideoTrack | undefined): string | null {
+  if (!video?.width || !video.height) return null;
+  const { width, height } = video;
+  if (width >= 3800 || height >= 2100) return '2160p';
+  if (width >= 2500 || height >= 1400) return '1440p';
+  if (width >= 1900 || height >= 1000) return '1080p';
+  if (width >= 1200 || height >= 700) return '720p';
+  if (height >= 560) return '576p';
+  return `${height}p`;
+}
+
+/**
+ * The text report starts with "Complete name : /home/alice/Downloads/...":
+ * keep only the file name, the local path tells about the uploader
+ */
+export function cleanMediaInfoText(text: string): string {
+  return text
+    .replace(/^(Complete name\s*:\s*)(.+)$/gim, (_, label: string, path: string) => {
+      const name = path.trim().split(/[\\/]/).pop() ?? path;
+      return `${label}${name}`;
+    })
+    .replace(/\r\n/g, '\n')
+    .trim();
+}
diff --git a/shared/utils/release/releaseName.ts b/shared/utils/release/releaseName.ts
new file mode 100644
index 00000000..a46b0058
--- /dev/null
+++ b/shared/utils/release/releaseName.ts
@@ -0,0 +1,63 @@
+/**
+ * Best-effort reading of a scene/P2P release name
+ * ("Movie.Title.2021.1080p.BluRay.x264-GROUP"): enough to prefill the title
+ * and spot what MediaInfo cannot tell (source, group). Never authoritative:
+ * every value stays editable.
+ */
+
+export interface ReleaseName {
+  title: string;
+  year: number | null;
+  season: number | null;
+  episode: number | null;
+  resolution: string | null;
+  source: string | null;
+  group: string | null;
+}
+
+const VIDEO_EXT = /\.(mkv|mp4|m4v|avi|mov|wmv|ts|m2ts|webm|mpg|mpeg)$/i;
+
+const SOURCES: [RegExp, string][] = [
+  [/\bremux\b/i, 'Remux'],
+  [/\bblu-?ray\b|\bbd-?rip\b|\bbrrip\b/i, 'BluRay'],
+  [/\bweb-?dl\b/i, 'WEB-DL'],
+  [/\bweb-?rip\b/i, 'WEBRip'],
+  [/\bweb\b/i, 'WEB'],
+  [/\bhdtv\b/i, 'HDTV'],
+  [/\bdvd-?rip\b/i, 'DVDRip'],
+  [/\bdvd\b/i, 'DVD'],
+];
+
+export function stripVideoExtension(name: string): string {
+  return name.replace(VIDEO_EXT, '');
+}
+
+export function parseReleaseName(input: string): ReleaseName {
+  const name = stripVideoExtension(input.split('/').pop() ?? input).trim();
+  const spaced = name.replace(/[._]+/g, ' ');
+
+  const groupMatch = name.match(/-([A-Za-z0-9]+)(?:\[[^\]]*\])?$/);
+  const group = groupMatch && !/^\d+p$/i.test(groupMatch[1]!) ? groupMatch[1]! : null;
+
+  const se = spaced.match(/\bS(\d{1,2})(?:E(\d{1,3}))?\b/i);
+  const year = spaced.match(/\b(19[2-9]\d|20\d\d)\b/);
+  const resolution = spaced.match(/\b(2160|1440|1080|720|576|480)[pi]\b/i);
+  const source = SOURCES.find(([re]) => re.test(spaced))?.[1] ?? null;
+
+  // The title ends where the first technical token starts
+  const markers = [se?.index, year?.index, resolution?.index].filter(
+    (i): i is number => typeof i === 'number' && i > 0
+  );
+  const cut = markers.length ? Math.min(...markers) : spaced.length;
+  const title = spaced.slice(0, cut).replace(/[\s\-()[\]]+$/, '').trim() || spaced.trim();
+
+  return {
+    title,
+    year: year ? Number(year[1]) : null,
+    season: se ? Number(se[1]) : null,
+    episode: se?.[2] ? Number(se[2]) : null,
+    resolution: resolution ? `${resolution[1]}p` : null,
+    source,
+    group,
+  };
+}
diff --git a/shared/utils/release/torrent.ts b/shared/utils/release/torrent.ts
new file mode 100644
index 00000000..6db7b819
--- /dev/null
+++ b/shared/utils/release/torrent.ts
@@ -0,0 +1,150 @@
+/**
+ * .torrent creation shared by the web upload assistant (File.slice + WebCrypto)
+ * and the CLI (fs + node:crypto). Always private, with the uploader's personal
+ * announce URL: the tracker stores a copy without it and, the info dict being
+ * unchanged, with the same info hash, so the uploader seeds this very file.
+ */
+
+import bencode from 'bencode';
+
+export interface TorrentInputFile {
+  /** Path inside the torrent, relative to its root folder: [file] or [dir, ..., file] */
+  path: string[];
+  length: number;
+  /** Read `length` bytes at `offset` of this file */
+  read(offset: number, length: number): Promise<Uint8Array>;
+}
+
+export interface BuildTorrentOptions {
+  /** Torrent name: the file name (single file) or the folder name */
+  name: string;
+  /** Shared as a folder (multi-file torrent), even with a single file inside */
+  folder?: boolean;
+  files: TorrentInputFile[];
+  announce: string;
+  /** Stored in info.source: makes the hash unique to this tracker (cross-seeding) */
+  source?: string;
+  comment?: string;
+  createdBy?: string;
+  pieceLength?: number;
+  sha1(data: Uint8Array): Promise<Uint8Array>;
+  /** Hashed bytes so far, out of the total */
+  onProgress?(done: number, total: number): void;
+  /** Pieces hashed at once (WebCrypto is asynchronous) */
+  concurrency?: number;
+  /** Creation date in seconds (tests) */
+  creationDate?: number;
+}
+
+export interface BuiltTorrent {
+  torrent: Uint8Array;
+  infoHash: string;
+  pieceLength: number;
+  totalSize: number;
+}
+
+const MIN_PIECE = 16 * 1024;
+const MAX_PIECE = 16 * 1024 * 1024;
+const TARGET_PIECES = 1500;
+
+/** Power of two between 16 KiB and 16 MiB giving about 1500 pieces */
+export function pickPieceLength(totalSize: number): number {
+  let size = MIN_PIECE;
+  while (size < MAX_PIECE && totalSize / size > TARGET_PIECES) size *= 2;
+  return size;
+}
+
+/** Files nobody wants in a release */
+export function isJunkFile(name: string): boolean {
+  const base = name.toLowerCase();
+  return (
+    base === '.ds_store' ||
+    base === 'thumbs.db' ||
+    base === 'desktop.ini' ||
+    base.startsWith('._') ||
+    base.endsWith('.part') ||
+    base.endsWith('.!qb') ||
+    base.endsWith('.torrent')
+  );
+}
+
+export function toHex(bytes: Uint8Array): string {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+}
+
+/**
+ * Read the files as one continuous stream cut into pieces (BitTorrent v1:
+ * pieces cross file boundaries)
+ */
+async function readPiece(
+  files: TorrentInputFile[],
+  starts: number[],
+  start: number,
+  length: number
+): Promise<Uint8Array> {
+  const piece = new Uint8Array(length);
+  let filled = 0;
+  let i = starts.findIndex((s, idx) => start < s + files[idx]!.length);
+  while (filled < length && i >= 0 && i < files.length) {
+    const file = files[i]!;
+    const offset = start + filled - starts[i]!;
+    const take = Math.min(file.length - offset, length - filled);
+    if (take > 0) {
+      const chunk = await file.read(offset, take);
+      if (chunk.length !== take) throw new Error(`Short read in ${file.path.join('/')}`);
+      piece.set(chunk, filled);
+      filled += take;
+    }
+    i++;
+  }
+  return piece;
+}
+
+export async function buildTorrent(options: BuildTorrentOptions): Promise<BuiltTorrent> {
+  const files = options.files.filter((f) => f.length > 0);
+  if (files.length === 0) throw new Error('Nothing to share: every file is empty');
+  const totalSize = files.reduce((sum, f) => sum + f.length, 0);
+  const pieceLength = options.pieceLength ?? pickPieceLength(totalSize);
+  const pieceCount = Math.ceil(totalSize / pieceLength);
+  const starts: number[] = [];
+  files.reduce((offset, f) => (starts.push(offset), offset + f.length), 0);
+
+  const hashes = new Uint8Array(pieceCount * 20);
+  let next = 0;
+  let done = 0;
+  const worker = async () => {
+    while (next < pieceCount) {
+      const index = next++;
+      const start = index * pieceLength;
+      const length = Math.min(pieceLength, totalSize - start);
+      const piece = await readPiece(files, starts, start, length);
+      hashes.set(await options.sha1(piece), index * 20);
+      done += length;
+      options.onProgress?.(done, totalSize);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.max(1, options.concurrency ?? 4) }, worker));
+
+  const single = !options.folder && files.length === 1;
+  const info: Record<string, unknown> = {
+    name: options.name,
+    'piece length': pieceLength,
+    pieces: hashes,
+    private: 1,
+    ...(options.source ? { source: options.source } : {}),
+    ...(single
+      ? { length: files[0]!.length }
+      : { files: files.map((f) => ({ length: f.length, path: f.path })) }),
+  };
+
+  const torrent: Record<string, unknown> = {
+    announce: options.announce,
+    'created by': options.createdBy ?? 'Trackarr upload assistant',
+    'creation date': options.creationDate ?? Math.floor(Date.now() / 1000),
+    info,
+    ...(options.comment ? { comment: options.comment } : {}),
+  };
+
+  const infoHash = toHex(await options.sha1(bencode.encode(info)));
+  return { torrent: bencode.encode(torrent), infoHash, pieceLength, totalSize };
+}
diff --git a/tests/csp.test.ts b/tests/csp.test.ts
index 2ca12c15..d5319f28 100644
--- a/tests/csp.test.ts
+++ b/tests/csp.test.ts
@@ -5,8 +5,9 @@ const scriptSrc = (csp: string) => csp.split('; ').find((d) => d.startsWith('scr
 
 describe('buildCsp', () => {
   it('allows inline scripts only through the nonce in production', () => {
-    expect(scriptSrc(buildCsp(undefined, false))).toBe("script-src 'self'");
-    expect(scriptSrc(buildCsp('abc', false))).toBe("script-src 'self' 'nonce-abc'");
+    expect(scriptSrc(buildCsp(undefined, false))).toBe("script-src 'self' 'wasm-unsafe-eval'");
+    expect(scriptSrc(buildCsp('abc', false))).toBe("script-src 'self' 'wasm-unsafe-eval' 'nonce-abc'");
+    expect(buildCsp('abc', false)).not.toContain("'unsafe-eval'");
   });
 
   it('keeps unsafe-inline in development for Vite', () => {
diff --git a/tests/upload-assistant.test.ts b/tests/upload-assistant.test.ts
new file mode 100644
index 00000000..2daf0d1f
--- /dev/null
+++ b/tests/upload-assistant.test.ts
@@ -0,0 +1,270 @@
+import { describe, it, expect } from 'vitest';
+import { createHash } from 'node:crypto';
+import bencode from 'bencode';
+import parseTorrent from 'parse-torrent';
+import { buildTorrent, isJunkFile, pickPieceLength } from '../shared/utils/release/torrent';
+import {
+  channelLayout,
+  cleanMediaInfoText,
+  resolutionLabel,
+  summarizeMediaInfo,
+} from '../shared/utils/release/mediainfo';
+import { parseReleaseName } from '../shared/utils/release/releaseName';
+import {
+  buildDescription,
+  escapeBbcode,
+  formatDuration,
+  formatSize,
+  languageName,
+} from '../shared/utils/release/description';
+import { DESCRIPTION_LABELS, DESCRIPTION_LANGUAGES } from '../shared/utils/release/labels';
+import { bbcodeToHtml, looksLikeBbcode } from '../shared/utils/bbcode';
+import { normalizeTorrent } from '../server/utils/torrentFile';
+
+const sha1 = async (data: Uint8Array) => new Uint8Array(createHash('sha1').update(data).digest());
+
+function memoryFile(path: string[], bytes: Uint8Array) {
+  return {
+    path,
+    length: bytes.length,
+    read: async (offset: number, length: number) => bytes.slice(offset, offset + length),
+  };
+}
+
+const bytes = (n: number, seed: number) => Uint8Array.from({ length: n }, (_, i) => (i * 31 + seed) % 251);
+
+describe('torrent builder', () => {
+  it('picks a power-of-two piece size within bounds', () => {
+    expect(pickPieceLength(1)).toBe(16 * 1024);
+    expect(pickPieceLength(700 * 1024 ** 2)).toBe(512 * 1024);
+    expect(pickPieceLength(50 * 1024 ** 3)).toBe(16 * 1024 ** 2);
+    expect(pickPieceLength(5 * 1024 ** 4)).toBe(16 * 1024 ** 2);
+  });
+
+  it('hashes pieces across file boundaries like other clients', async () => {
+    const a = bytes(40_000, 1);
+    const b = bytes(30_000, 7);
+    const built = await buildTorrent({
+      name: 'Release',
+      folder: true,
+      files: [memoryFile(['a.mkv'], a), memoryFile(['sub', 'b.srt'], b)],
+      announce: 'https://tracker.example/announce?passkey=abc',
+      source: 'tracker.example',
+      pieceLength: 16 * 1024,
+      sha1,
+      concurrency: 3,
+      creationDate: 1_700_000_000,
+    });
+
+    // Expected pieces: SHA-1 of the concatenated stream cut every 16 KiB
+    const all = new Uint8Array([...a, ...b]);
+    const expected: Buffer[] = [];
+    for (let i = 0; i < all.length; i += 16 * 1024) {
+      expected.push(createHash('sha1').update(all.slice(i, i + 16 * 1024)).digest());
+    }
+    const decoded = bencode.decode(built.torrent);
+    expect(Buffer.from(decoded.info.pieces)).toEqual(Buffer.concat(expected));
+    expect(decoded.info.private).toBe(1);
+    expect(Buffer.from(decoded.info.source).toString()).toBe('tracker.example');
+    expect(decoded.info.files.map((f: { path: Uint8Array[] }) => f.path.map((p) => Buffer.from(p).toString()))).toEqual([
+      ['a.mkv'],
+      ['sub', 'b.srt'],
+    ]);
+    expect(built.totalSize).toBe(70_000);
+
+    const parsed = await parseTorrent(Buffer.from(built.torrent));
+    expect(parsed.infoHash).toBe(built.infoHash);
+  });
+
+  it('keeps its info hash once the tracker stores it', async () => {
+    const built = await buildTorrent({
+      name: 'movie.mkv',
+      files: [memoryFile(['movie.mkv'], bytes(100_000, 3))],
+      announce: 'https://tracker.example/announce?passkey=abc',
+      sha1,
+    });
+    const stored = normalizeTorrent(built.torrent);
+    expect(stored.madePrivate).toBe(false);
+    expect(stored.infoHash).toBe(built.infoHash);
+    expect(bencode.decode(built.torrent).info.length).toBe(100_000);
+  });
+
+  it('skips empty files and refuses an empty release', async () => {
+    await expect(
+      buildTorrent({ name: 'x', files: [memoryFile(['x'], new Uint8Array())], announce: 'a', sha1 })
+    ).rejects.toThrow(/empty/);
+    expect(isJunkFile('.DS_Store')).toBe(true);
+    expect(isJunkFile('._movie.mkv')).toBe(true);
+    expect(isJunkFile('movie.mkv')).toBe(false);
+  });
+});
+
+const MEDIAINFO = {
+  media: {
+    track: [
+      { '@type': 'General', Format: 'Matroska', Duration: '7922.112', FileSize: '25123456789', OverallBitRate: '25372000' },
+      {
+        '@type': 'Video', Format: 'HEVC', Format_Profile: 'Main 10@L5.1@High', Width: '3840', Height: '1600',
+        FrameRate: '23.976', BitRate: '22000000', BitDepth: '10',
+        HDR_Format: 'Dolby Vision / SMPTE ST 2086', HDR_Format_Compatibility: 'HDR10',
+      },
+      { '@type': 'Audio', Format: 'E-AC-3', Format_AdditionalFeatures: 'JOC', Format_Commercial_IfAny: 'Dolby Digital Plus', Channels: '6', BitRate: '768000', Language: 'fr', Title: 'VFF' },
+      { '@type': 'Audio', Format: 'AAC', Channels: '2', BitRate: '128000', Language: 'en' },
+      { '@type': 'Text', Format: 'UTF-8', Language: 'fr', Forced: 'Yes' },
+      { '@type': 'Text', Format: 'PGS', Language: 'en' },
+    ],
+  },
+};
+
+describe('mediainfo', () => {
+  it('summarizes tracks', () => {
+    const s = summarizeMediaInfo(JSON.stringify(MEDIAINFO));
+    expect(s.container).toBe('Matroska');
+    expect(s.video[0]).toMatchObject({ codec: 'H.265 (HEVC) Main 10', width: 3840, hdr: 'Dolby Vision + HDR10', bitDepth: 10 });
+    expect(resolutionLabel(s.video[0])).toBe('2160p');
+    expect(s.audio[0]).toMatchObject({ codec: 'Dolby Digital Plus Atmos', channels: '5.1', language: 'fr', title: 'VFF' });
+    expect(s.subtitles).toEqual([
+      { format: 'UTF-8', language: 'fr', title: null, forced: true },
+      { format: 'PGS', language: 'en', title: null, forced: false },
+    ]);
+    expect(channelLayout(8)).toBe('7.1');
+    expect(channelLayout(2)).toBe('2.0');
+  });
+
+  it('copes with garbage', () => {
+    expect(summarizeMediaInfo({})).toMatchObject({ container: null, video: [], audio: [] });
+  });
+
+  it('removes the local path from the text report', () => {
+    const text = 'General\nComplete name                            : /home/alice/Downloads/Movie.mkv\r\nFormat : Matroska';
+    expect(cleanMediaInfoText(text)).toBe('General\nComplete name                            : Movie.mkv\nFormat : Matroska');
+    expect(cleanMediaInfoText('Complete name : C:\\Users\\bob\\x.mkv')).toBe('Complete name : x.mkv');
+  });
+});
+
+describe('release names', () => {
+  it('reads movies and episodes', () => {
+    expect(parseReleaseName('The.Movie.Title.2021.2160p.UHD.BluRay.REMUX.HDR.HEVC.Atmos-GROUP.mkv')).toEqual({
+      title: 'The Movie Title', year: 2021, season: null, episode: null, resolution: '2160p', source: 'Remux', group: 'GROUP',
+    });
+    expect(parseReleaseName('Show.Name.S02E05.1080p.WEB-DL.DDP5.1.H.264-NTb')).toMatchObject({
+      title: 'Show Name', season: 2, episode: 5, resolution: '1080p', source: 'WEB-DL', group: 'NTb',
+    });
+    expect(parseReleaseName('Holiday photos')).toMatchObject({ title: 'Holiday photos', year: null, group: null });
+  });
+});
+
+describe('description', () => {
+  it('has every label in every language', () => {
+    const keys = Object.keys(DESCRIPTION_LABELS.en).sort();
+    for (const lang of DESCRIPTION_LANGUAGES) {
+      expect(Object.keys(DESCRIPTION_LABELS[lang]).sort()).toEqual(keys);
+    }
+  });
+
+  it('formats in the chosen language', () => {
+    expect(formatSize(25_123_456_789, 'fr')).toBe('23,4 Go');
+    expect(formatSize(25_123_456_789, 'en')).toBe('23.4 GB');
+    expect(formatDuration(7922, 'fr')).toBe('2 h 12 min');
+    expect(languageName('fr', 'fr')).toBe('Français');
+    expect(languageName('fr', 'en')).toBe('French');
+    expect(languageName('not a code', 'en')).toBe('not a code');
+  });
+
+  it('builds a BBCode description that renders', () => {
+    const text = buildDescription({
+      lang: 'fr',
+      title: 'The Movie [Director cut]',
+      release: parseReleaseName('The.Movie.2021.2160p.BluRay.REMUX-GROUP'),
+      summary: summarizeMediaInfo(MEDIAINFO),
+      mediaInfoText: 'General\nFormat : Matroska [/code] tricky',
+      screenshots: [
+        { page: 'https://pixhost.to/show/1/a.jpg', thumb: 'https://t1.pixhost.to/thumbs/1/a.jpg' },
+        { page: 'javascript:alert(1)', thumb: 'https://t1.pixhost.to/thumbs/1/b.jpg' },
+      ],
+      files: [
+        { path: 'The.Movie/movie.mkv', size: 1000 },
+        { path: 'The.Movie/subs/fr.srt', size: 2000 },
+      ],
+    });
+    expect(text).toContain('[b]The Movie (Director cut) (2021)[/b]');
+    expect(text).toContain('[b]Team:[/b] GROUP');
+    expect(text).toContain('[*]Français · Dolby Digital Plus Atmos · 5.1 · 768 kb/s · "VFF"');
+    expect(text).toContain('[*]Français (forcés) · UTF-8');
+    expect(text).toContain('[url=https://pixhost.to/show/1/a.jpg][img]https://t1.pixhost.to/thumbs/1/a.jpg[/img][/url]');
+    expect(text).not.toContain('javascript:');
+    expect(text).toContain('[spoiler=Fichiers (2)]');
+    expect(looksLikeBbcode(text)).toBe(true);
+
+    const html = bbcodeToHtml(text);
+    expect(html).toContain('<details><summary>MediaInfo</summary><pre><code>General\nFormat : Matroska [/c0de] tricky</code></pre></details>');
+    expect(html).toContain('<a href="https://pixhost.to/show/1/a.jpg" rel="nofollow noopener noreferrer"><img src="https://t1.pixhost.to/thumbs/1/a.jpg" alt="" loading="lazy"></a>');
+    expect(html).toContain('<li>Français (forcés) · UTF-8</li>');
+    expect(html).not.toMatch(/\[\/?(b|list|center|spoiler|size)/);
+    expect(escapeBbcode('[b]x[/b]')).toBe('(b)x(/b)');
+  });
+});
+
+describe('bbcode rendering', () => {
+  it('renders the supported tags', () => {
+    expect(bbcodeToHtml('[b]bold[/b] [i]it[/i] [u]u[/u] [s]s[/s]')).toBe(
+      '<strong>bold</strong> <em>it</em> <u>u</u> <s>s</s>'
+    );
+    expect(bbcodeToHtml('[center][size=6]Big[/size][/center]')).toBe(
+      '<div style="text-align:center"><span style="font-size:1.75em">Big</span></div>'
+    );
+    expect(bbcodeToHtml('[color=#ff0000]red[/color][color=red]r[/color]')).toBe(
+      '<span style="color:#ff0000">red</span><span style="color:red">r</span>'
+    );
+    expect(bbcodeToHtml('[list]\n[*]one\n[*]two\n[/list]')).toBe('<ul><li>one</li><li>two</li></ul>');
+    expect(bbcodeToHtml('[list=1][*]a[/list]')).toBe('<ol><li>a</li></ol>');
+    expect(bbcodeToHtml('[quote=Bob]hi[/quote]')).toBe('<blockquote><cite>Bob</cite>hi</blockquote>');
+    expect(bbcodeToHtml('[url]https://a.example/x[/url]')).toBe(
+      '<a href="https://a.example/x" rel="nofollow noopener noreferrer">https://a.example/x</a>'
+    );
+    expect(bbcodeToHtml('line1\nline2')).toBe('line1<br>line2');
+    expect(bbcodeToHtml('[spoiler]x[/spoiler]')).toBe('<details><summary>Spoiler</summary>x</details>');
+    expect(bbcodeToHtml('a[hr]b')).toBe('a<hr>b');
+  });
+
+  it('never lets markup or unsafe URLs through', () => {
+    expect(bbcodeToHtml('<script>alert(1)</script>')).toBe('&lt;script&gt;alert(1)&lt;/script&gt;');
+    expect(bbcodeToHtml('[url=javascript:alert(1)]x[/url]')).toBe('x');
+    expect(bbcodeToHtml('[url="onmouseover=alert(1)]x[/url]')).toBe('x');
+    expect(bbcodeToHtml('[img]javascript:alert(1)[/img]')).toBe('javascript:alert(1)');
+    expect(bbcodeToHtml('[img]https://a.example/x.png" onerror="alert(1)[/img]')).toBe(
+      'https://a.example/x.png&quot; onerror=&quot;alert(1)'
+    );
+    expect(bbcodeToHtml('[color=red;background:url(x)]x[/color]')).toBe('x');
+    expect(bbcodeToHtml('[size=99]x[/size]')).toBe('x');
+    expect(bbcodeToHtml('[quote=<b>]x[/quote]')).toBe('<blockquote><cite>&lt;b&gt;</cite>x</blockquote>');
+    expect(bbcodeToHtml('[code][b]raw[/b] <i>[/code]')).toBe('<pre><code>[b]raw[/b] &lt;i&gt;</code></pre>');
+  });
+
+  it('keeps broken BBCode as text', () => {
+    expect(bbcodeToHtml('[b]open')).toBe('[b]open');
+    expect(bbcodeToHtml('close[/b]')).toBe('close[/b]');
+    expect(bbcodeToHtml('[foo]x[/foo]')).toBe('[foo]x[/foo]');
+    // An inner tag closed by its parent still renders (forgiving, like forums)
+    expect(bbcodeToHtml('[b][i]x[/b]')).toBe('<strong><em>x</em></strong>');
+  });
+
+  it('tells BBCode from Markdown', () => {
+    expect(looksLikeBbcode('**bold** and [link](https://x.example)')).toBe(false);
+    expect(looksLikeBbcode('[b]x[/b]')).toBe(true);
+    expect(looksLikeBbcode('array[i] = x[0]')).toBe(false);
+  });
+});
+
+describe('pixhost answers', () => {
+  it('accepts only https links on Pixhost domains', async () => {
+    const { isPixhostUrl } = await import('../server/utils/pixhost');
+    expect(isPixhostUrl('https://pixhost.to/show/1/a.jpg')).toBe(true);
+    expect(isPixhostUrl('https://t3.pixhost.to/thumbs/1/a.jpg')).toBe(true);
+    expect(isPixhostUrl('https://img1.pixho.st/images/1/a.jpg')).toBe(true);
+    expect(isPixhostUrl('http://pixhost.to/show/1/a.jpg')).toBe(false);
+    expect(isPixhostUrl('https://pixhost.to.evil.example/a.jpg')).toBe(false);
+    expect(isPixhostUrl('javascript:alert(1)')).toBe(false);
+    expect(isPixhostUrl(42)).toBe(false);
+  });
+});
diff --git a/tools/upload-cli/main.ts b/tools/upload-cli/main.ts
new file mode 100644
index 00000000..321d3a5e
--- /dev/null
+++ b/tools/upload-cli/main.ts
@@ -0,0 +1,359 @@
+/**
+ * trackarr-upload: the upload assistant from a terminal.
+ *   node trackarr-upload.mjs <file-or-folder> --url https://tracker.example --key tk_...
+ * Builds the private .torrent, reads MediaInfo, takes screenshots with ffmpeg,
+ * hosts them on Pixhost, writes the BBCode description and publishes, using
+ * the API key of the Integrations page. Bundled into a single file served by
+ * the tracker at /tools/trackarr-upload.mjs (scripts/build-cli.mjs).
+ * Needs Node.js 20+, ffmpeg and mediainfo in the PATH.
+ */
+
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdtemp, open, readFile, readdir, rm, stat, writeFile, mkdir } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { basename, join, relative, resolve, sep } from 'node:path';
+import { createInterface } from 'node:readline/promises';
+import { parseArgs, promisify } from 'node:util';
+import { buildTorrent, isJunkFile } from '../../shared/utils/release/torrent';
+import { cleanMediaInfoText, summarizeMediaInfo, type MediaSummary } from '../../shared/utils/release/mediainfo';
+import { parseReleaseName, stripVideoExtension } from '../../shared/utils/release/releaseName';
+import { buildDescription, formatSize, type Screenshot } from '../../shared/utils/release/description';
+import { DESCRIPTION_LANGUAGES, isDescriptionLanguage } from '../../shared/utils/release/labels';
+import { uploadToPixhost } from '../../server/utils/pixhost';
+
+const run = promisify(execFile);
+const CONFIG_FILE = join(homedir(), '.config', 'trackarr-upload.json');
+const VIDEO = /\.(mkv|mp4|m4v|avi|mov|wmv|ts|m2ts|webm|mpg|mpeg)$/i;
+
+const HELP = `Usage: node trackarr-upload.mjs <file-or-folder> [options]
+
+Connection (or TRACKARR_URL / TRACKARR_API_KEY, or saved with --save)
+  --url <url>            Tracker address, e.g. https://tracker.example
+  --key <api key>        API key from the Integrations page (tk_...)
+  --save                 Remember --url and --key in ${CONFIG_FILE}
+
+Release
+  --name <name>          Torrent name (default: the file or folder name)
+  --title <title>        Title shown in the description
+  --category <name|id>   Category, by name ("Movies", "Movies/HD") or id
+  --tags <a,b>           Tags, by name
+  --imdb <id> --tmdb <id> --tvdb <id>
+  --notes <text>         Notes added to the description
+  --lang <code>          Description language: ${DESCRIPTION_LANGUAGES.join(' ')} (default: en)
+  --screens <n>          Screenshots (default: 6, 0 for none)
+  --adult                Adult content: screenshots filed as NSFW on Pixhost
+
+Output
+  --out <dir>            Where to write the .torrent and the description (default: .)
+  --dry-run              Build everything, publish nothing
+  -y, --yes              Publish without asking
+  -h, --help             Show this help`;
+
+function fail(message: string): never {
+  console.error(`\n✗ ${message}`);
+  process.exit(1);
+}
+
+const step = (message: string) => console.error(`• ${message}`);
+
+interface SavedConfig {
+  url?: string;
+  key?: string;
+}
+
+async function loadSaved(): Promise<SavedConfig> {
+  try {
+    return JSON.parse(await readFile(CONFIG_FILE, 'utf8')) as SavedConfig;
+  } catch {
+    return {};
+  }
+}
+
+async function has(command: string): Promise<boolean> {
+  try {
+    await run(command, ['-version'], { timeout: 10_000 });
+    return true;
+  } catch (err) {
+    // mediainfo answers --version, ffmpeg -version
+    if (command === 'mediainfo') {
+      try {
+        await run(command, ['--version'], { timeout: 10_000 });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    return (err as NodeJS.ErrnoException).code !== 'ENOENT';
+  }
+}
+
+interface LocalFile {
+  absolute: string;
+  path: string[];
+  size: number;
+}
+
+async function scan(root: string): Promise<{ name: string; folder: boolean; files: LocalFile[] }> {
+  const info = await stat(root).catch(() => fail(`Not found: ${root}`));
+  if (info.isFile()) {
+    return { name: basename(root), folder: false, files: [{ absolute: root, path: [basename(root)], size: info.size }] };
+  }
+  const files: LocalFile[] = [];
+  const walk = async (dir: string) => {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+      const full = join(dir, entry.name);
+      if (isJunkFile(entry.name)) continue;
+      if (entry.isDirectory()) await walk(full);
+      else if (entry.isFile()) {
+        const size = (await stat(full)).size;
+        if (size > 0) files.push({ absolute: full, path: relative(root, full).split(sep), size });
+      }
+    }
+  };
+  await walk(root);
+  files.sort((a, b) => a.path.join('/').localeCompare(b.path.join('/')));
+  if (files.length === 0) fail('The folder holds no file to share');
+  return { name: basename(resolve(root)), folder: true, files };
+}
+
+async function api<T>(base: string, key: string, path: string, init: RequestInit = {}): Promise<T> {
+  const res = await fetch(`${base}${path}`, {
+    ...init,
+    headers: { Authorization: `Bearer ${key}`, Accept: 'application/json', ...(init.headers ?? {}) },
+    signal: AbortSignal.timeout(120_000),
+  }).catch((err: Error) => fail(`Cannot reach ${base}: ${err.message}`));
+  const body = (await res.json().catch(() => null)) as { message?: string } | null;
+  if (!res.ok) fail(`${path}: ${body?.message ?? `HTTP ${res.status}`}`);
+  return body as T;
+}
+
+async function screenshot(file: string, time: number, out: string, hdr: boolean): Promise<void> {
+  const scale = "scale='min(1920,iw)':-2";
+  // HDR to SDR, when ffmpeg has zimg; otherwise plain (washed-out colors)
+  const tonemap =
+    'zscale=t=linear:npl=100,format=gbrpf32le,zscale=p=bt709,tonemap=hable:desat=0,zscale=t=bt709:m=bt709:r=tv,format=yuv420p';
+  const args = (vf: string) => ['-v', 'error', '-y', '-ss', time.toFixed(2), '-i', file, '-frames:v', '1', '-vf', vf, '-q:v', '3', out];
+  if (hdr) {
+    try {
+      await run('ffmpeg', args(`${tonemap},${scale}`), { timeout: 120_000 });
+      return;
+    } catch {
+      // No zimg in this build
+    }
+  }
+  await run('ffmpeg', args(scale), { timeout: 120_000 });
+}
+
+let lastPct = -1;
+function progressBar(done: number, total: number) {
+  const pct = Math.floor((done / total) * 100);
+  // Redraw once per percent, and only on a terminal (logs get one line)
+  if (pct === lastPct || !process.stderr.isTTY) return;
+  lastPct = pct;
+  const width = 30;
+  const filled = Math.round((pct / 100) * width);
+  process.stderr.write(`\r  [${'#'.repeat(filled)}${'.'.repeat(width - filled)}] ${pct}%`);
+}
+
+async function main() {
+  const { values, positionals } = parseArgs({
+    allowPositionals: true,
+    options: {
+      url: { type: 'string' }, key: { type: 'string' }, save: { type: 'boolean' },
+      name: { type: 'string' }, title: { type: 'string' }, category: { type: 'string' },
+      tags: { type: 'string' }, imdb: { type: 'string' }, tmdb: { type: 'string' }, tvdb: { type: 'string' },
+      notes: { type: 'string' }, lang: { type: 'string' }, screens: { type: 'string' },
+      adult: { type: 'boolean' }, out: { type: 'string' }, 'dry-run': { type: 'boolean' },
+      yes: { type: 'boolean', short: 'y' }, help: { type: 'boolean', short: 'h' },
+    },
+  });
+  if (values.help || positionals.length !== 1) {
+    console.log(HELP);
+    process.exit(values.help ? 0 : 1);
+  }
+
+  const saved = await loadSaved();
+  const base = (values.url ?? process.env.TRACKARR_URL ?? saved.url ?? '').replace(/\/+$/, '');
+  const key = values.key ?? process.env.TRACKARR_API_KEY ?? saved.key ?? '';
+  if (!/^https?:\/\//.test(base)) fail('Tracker address missing: --url https://tracker.example');
+  if (!/^tk_[a-f0-9]{40}$/i.test(key)) fail('API key missing or malformed: --key tk_... (Integrations page)');
+  if (values.save) {
+    await mkdir(join(homedir(), '.config'), { recursive: true });
+    await writeFile(CONFIG_FILE, JSON.stringify({ url: base, key }, null, 2), { mode: 0o600 });
+    step(`Saved the address and key in ${CONFIG_FILE}`);
+  }
+  const lang = values.lang ?? 'en';
+  if (!isDescriptionLanguage(lang)) fail(`Unknown language "${lang}": ${DESCRIPTION_LANGUAGES.join(', ')}`);
+  const count = values.screens === undefined ? 6 : Number(values.screens);
+  if (!Number.isInteger(count) || count < 0 || count > 12) fail('--screens takes 0 to 12');
+
+  const config = await api<{
+    siteName: string;
+    announceUrl: string;
+    source: string;
+    categories: { id: string; name: string; parentId: string | null }[];
+    tags: { id: string; name: string }[];
+  }>(base, key, '/api/upload-assistant/config');
+  step(`Connected to ${config.siteName}`);
+
+  // Category and tags by name
+  let categoryId: string | undefined;
+  if (values.category) {
+    const wanted = values.category.toLowerCase();
+    const byId = new Map(config.categories.map((c) => [c.id, c]));
+    const full = (c: { name: string; parentId: string | null }) =>
+      (c.parentId ? `${byId.get(c.parentId)?.name ?? ''}/${c.name}` : c.name).toLowerCase();
+    const match = config.categories.find((c) => c.id === values.category || full(c) === wanted || c.name.toLowerCase() === wanted);
+    if (!match) fail(`Unknown category "${values.category}". Known: ${config.categories.map((c) => full(c)).join(', ')}`);
+    categoryId = match.id;
+  }
+  const tagIds = (values.tags ?? '')
+    .split(',')
+    .map((t) => t.trim().toLowerCase())
+    .filter(Boolean)
+    .map((name) => config.tags.find((t) => t.name.toLowerCase() === name)?.id ?? fail(`Unknown tag "${name}"`));
+
+  const release = await scan(resolve(positionals[0]!));
+  const totalSize = release.files.reduce((s, f) => s + f.size, 0);
+  step(`${release.name}: ${release.files.length} file(s), ${formatSize(totalSize, lang)}`);
+
+  // MediaInfo and screenshots of the largest video
+  const video = release.files.filter((f) => VIDEO.test(f.absolute)).sort((a, b) => b.size - a.size)[0];
+  let summary: MediaSummary | null = null;
+  let mediaInfoText: string | null = null;
+  const screenshots: Screenshot[] = [];
+  if (video) {
+    if (await has('mediainfo')) {
+      step('Reading MediaInfo');
+      const [json, text] = await Promise.all([
+        run('mediainfo', ['--Output=JSON', video.absolute], { maxBuffer: 64 * 1024 * 1024 }),
+        run('mediainfo', [video.absolute], { maxBuffer: 64 * 1024 * 1024 }),
+      ]);
+      summary = summarizeMediaInfo(json.stdout);
+      mediaInfoText = cleanMediaInfoText(text.stdout);
+    } else {
+      step('mediainfo not found: no MediaInfo report (install it for a full description)');
+    }
+
+    // Without mediainfo, ffprobe (shipped with ffmpeg) still gives the duration
+    let duration = summary?.duration ?? null;
+    if (!duration && count > 0) {
+      try {
+        const probe = await run('ffprobe', [
+          '-v', 'error', '-show_entries', 'format=duration', '-of', 'default=nw=1:nk=1', video.absolute,
+        ]);
+        duration = Number(probe.stdout.trim()) || null;
+      } catch {
+        duration = null;
+      }
+    }
+
+    if (count > 0 && duration) {
+      if (!(await has('ffmpeg'))) {
+        step('ffmpeg not found: no screenshots');
+      } else {
+        const dir = await mkdtemp(join(tmpdir(), 'trackarr-'));
+        try {
+          const hdr = Boolean(summary?.video[0]?.hdr);
+          for (let i = 0; i < count; i++) {
+            const time = duration * 0.08 + (duration * 0.84 * (i + 0.5)) / count;
+            const out = join(dir, `shot${i}.jpg`);
+            process.stderr.write(
+              process.stderr.isTTY ? `\r• Screenshot ${i + 1}/${count}` : `• Screenshot ${i + 1}/${count}\n`
+            );
+            await screenshot(video.absolute, time, out, hdr);
+            screenshots.push(await uploadToPixhost(await readFile(out), `shot${i}.jpg`, Boolean(values.adult)));
+          }
+          process.stderr.write('\n');
+        } catch (err) {
+          process.stderr.write('\n');
+          step(`Screenshots stopped: ${(err as Error).message}`);
+        } finally {
+          await rm(dir, { recursive: true, force: true });
+        }
+      }
+    }
+  }
+
+  step('Building the .torrent');
+  const handles = await Promise.all(release.files.map((f) => open(f.absolute, 'r')));
+  let built;
+  try {
+    built = await buildTorrent({
+      name: release.name,
+      folder: release.folder,
+      announce: config.announceUrl,
+      source: config.source,
+      sha1: async (data) => new Uint8Array(createHash('sha1').update(data).digest()),
+      onProgress: progressBar,
+      files: release.files.map((f, i) => ({
+        path: f.path,
+        length: f.size,
+        read: async (offset, length) => {
+          const buffer = new Uint8Array(length);
+          let read = 0;
+          while (read < length) {
+            const { bytesRead } = await handles[i]!.read(buffer, read, length - read, offset + read);
+            if (bytesRead === 0) break;
+            read += bytesRead;
+          }
+          return buffer.subarray(0, read);
+        },
+      })),
+    });
+  } finally {
+    process.stderr.write('\n');
+    await Promise.all(handles.map((h) => h.close()));
+  }
+
+  const name = values.name ?? (release.folder ? release.name : stripVideoExtension(release.name));
+  const parsed = parseReleaseName(release.name);
+  const description = buildDescription({
+    lang,
+    title: values.title ?? parsed.title,
+    release: parsed,
+    summary,
+    mediaInfoText,
+    screenshots,
+    files: release.folder ? release.files.map((f) => ({ path: f.path.join('/'), size: f.size })) : [],
+    notes: values.notes,
+  });
+
+  const outDir = resolve(values.out ?? '.');
+  await mkdir(outDir, { recursive: true });
+  const safe = name.replace(/[\\/:*?"<>|]+/g, '_');
+  const torrentPath = join(outDir, `${safe}.torrent`);
+  await writeFile(torrentPath, built.torrent);
+  await writeFile(join(outDir, `${safe}.bbcode.txt`), description);
+  step(`Written: ${torrentPath} (+ .bbcode.txt), info hash ${built.infoHash}`);
+
+  if (values['dry-run']) {
+    step('Dry run: nothing published');
+    return;
+  }
+  if (!values.yes) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    const answer = await rl.question(`Publish "${name}" on ${config.siteName}? [Y/n] `);
+    rl.close();
+    if (/^n/i.test(answer.trim())) return step('Not published');
+  }
+
+  const form = new FormData();
+  form.append('torrent', new Blob([built.torrent as Uint8Array<ArrayBuffer>]), `${safe}.torrent`);
+  form.append('name', name);
+  form.append('description', description);
+  if (categoryId) form.append('categoryId', categoryId);
+  if (tagIds.length) form.append('tags', JSON.stringify(tagIds));
+  if (values.imdb) form.append('imdbId', values.imdb);
+  if (values.tmdb) form.append('tmdbId', values.tmdb);
+  if (values.tvdb) form.append('tvdbId', values.tvdb);
+  const result = await api<{ message?: string; data: { infoHash: string } }>(base, key, '/api/torrents', {
+    method: 'POST',
+    body: form,
+  });
+  console.log(`\n✓ ${result.message === 'Torrent already exists' ? 'Already on the tracker' : 'Published'}: ${base}/torrents/${result.data.infoHash}`);
+  console.log(`  Seed it: add ${torrentPath} to your client, saving to ${resolve(positionals[0]!, '..')}`);
+}
+
+main().catch((err: Error) => fail(err.message));

From da0058ac7cdf8de3ca2076eed8afcd8296474f99 Mon Sep 17 00:00:00 2001
From: Florian <52180080+florianjs@users.noreply.github.com>
Date: Mon, 9 Nov 2026 16:19:48 +0100
Subject: [PATCH 2/3] fix(upload): review fixes for the upload assistant

- assistant page: work for a replaced release ("Change") no longer writes
  into the page, and its hashing is aborted
- BBCode: linear detection (no scan per unclosed tag), nesting capped at 32
  levels (no stack overflow on hostile descriptions)
- MediaInfo code block closes only on our own tag, whatever form a file uses
- channel layouts: LFE only from 6 channels (5 -> 5.0, 3 -> 3.0)
- CLI: files opened per read, no EMFILE on large packs
- fr: grammar of the privacy notice
- docs: a leaked API key also exposes the passkey (already true through
  Torznab downloads): regenerate the key and reset the passkey

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 app/pages/upload/assistant.vue      | 40 +++++++++++++++++++++++------
 app/utils/uploadAssistant/hash.ts   | 13 ++++++++--
 doc/guide/upload-assistant.md       |  4 +--
 i18n/locales/fr/assistant.json      |  2 +-
 shared/utils/bbcode.ts              | 30 +++++++++++++++++++---
 shared/utils/release/description.ts |  5 ++--
 shared/utils/release/mediainfo.ts   |  4 +--
 tests/upload-assistant.test.ts      | 35 +++++++++++++++++++++++++
 tools/upload-cli/main.ts            | 25 ++++++++++--------
 9 files changed, 128 insertions(+), 30 deletions(-)

diff --git a/app/pages/upload/assistant.vue b/app/pages/upload/assistant.vue
index 69be9bb1..d36ebe2a 100644
--- a/app/pages/upload/assistant.vue
+++ b/app/pages/upload/assistant.vue
@@ -392,6 +392,9 @@ async function onDrop(event: DragEvent) {
 }
 
 function reset() {
+  // Stop reading the files of the release being replaced
+  hashAbort?.abort();
+  hashAbort = null;
   for (const s of shots.value) URL.revokeObjectURL(s.url);
   picked.value = null;
   mediaInfo.value = null;
@@ -417,6 +420,10 @@ function start(release: PickedRelease | null) {
   void runMedia(release).finally(() => runHash(release));
 }
 
+// Work for a release the user replaced ("Change") must not touch the page:
+// every write after an await checks the release is still the one shown
+const isCurrent = (release: PickedRelease) => picked.value === release;
+
 async function runMedia(release: PickedRelease) {
   const video = mainVideo(release);
   if (!video) {
@@ -426,9 +433,12 @@ async function runMedia(release: PickedRelease) {
   }
   steps.mediainfo = 'running';
   try {
-    mediaInfo.value = await analyzeMedia(video);
+    const result = await analyzeMedia(video);
+    if (!isCurrent(release)) return;
+    mediaInfo.value = result;
     steps.mediainfo = 'done';
   } catch (err) {
+    if (!isCurrent(release)) return;
     steps.mediainfo = 'error';
     mediaError.value = errorText(err);
     console.error('[Upload assistant] MediaInfo failed:', err);
@@ -442,8 +452,9 @@ async function runMedia(release: PickedRelease) {
   steps.screenshots = 'running';
   try {
     const result = await captureScreenshots(video, duration, SCREENSHOT_COUNT, (done, engine) => {
-      shotsDetail.value = t(`assistant.engine.${engine}`, { done, total: SCREENSHOT_COUNT });
+      if (isCurrent(release)) shotsDetail.value = t(`assistant.engine.${engine}`, { done, total: SCREENSHOT_COUNT });
     });
+    if (!isCurrent(release)) return;
     shots.value = result.shots.map((blob) => ({
       blob,
       url: URL.createObjectURL(blob),
@@ -452,9 +463,11 @@ async function runMedia(release: PickedRelease) {
       hosted: null,
     }));
     shotsDetail.value = t(`assistant.engine.${result.engine}`, { done: result.shots.length, total: SCREENSHOT_COUNT });
-    await hostShots();
+    await hostShots(release);
+    if (!isCurrent(release)) return;
     steps.screenshots = shots.value.some((s) => s.state === 'error') ? 'error' : 'done';
   } catch (err) {
+    if (!isCurrent(release)) return;
     steps.screenshots = 'error';
     shotsDetail.value = errorText(err);
     console.error('[Upload assistant] Screenshots failed:', err);
@@ -462,8 +475,9 @@ async function runMedia(release: PickedRelease) {
 }
 
 /** Send the screenshots to the image host, through this site */
-async function hostShots() {
+async function hostShots(release: PickedRelease) {
   for (const shot of shots.value) {
+    if (!isCurrent(release)) return;
     if (shot.hosted || !shot.selected) continue;
     shot.state = 'uploading';
     try {
@@ -479,17 +493,27 @@ async function hostShots() {
   }
 }
 
+let hashAbort: AbortController | null = null;
+
 async function runHash(release: PickedRelease) {
-  if (!config.value) return;
+  if (!config.value || !isCurrent(release)) return;
+  hashAbort = new AbortController();
+  const { signal } = hashAbort;
   steps.hash = 'running';
   try {
-    built.value = await hashRelease(release, {
+    const result = await hashRelease(release, {
       announce: config.value.announceUrl,
       source: config.value.source,
-      onProgress: (done, total) => (hashProgress.value = Math.floor((done / total) * 100)),
+      signal,
+      onProgress: (done, total) => {
+        if (isCurrent(release)) hashProgress.value = Math.floor((done / total) * 100);
+      },
     });
+    if (!isCurrent(release)) return;
+    built.value = result;
     steps.hash = 'done';
   } catch (err) {
+    if (!isCurrent(release) || signal.aborted) return;
     steps.hash = 'error';
     hashError.value = errorText(err);
     console.error('[Upload assistant] Hashing failed:', err);
@@ -522,7 +546,7 @@ async function publish() {
   publishError.value = '';
   try {
     // Screenshots selected after a failed upload get another try
-    if (shots.value.some((s) => s.selected && !s.hosted)) await hostShots();
+    if (picked.value && shots.value.some((s) => s.selected && !s.hosted)) await hostShots(picked.value);
     const body = new FormData();
     body.append('torrent', new Blob([built.value.torrent as Uint8Array<ArrayBuffer>]), torrentFileName());
     body.append('name', form.name.trim());
diff --git a/app/utils/uploadAssistant/hash.ts b/app/utils/uploadAssistant/hash.ts
index 70f17a8e..a0aa2ad6 100644
--- a/app/utils/uploadAssistant/hash.ts
+++ b/app/utils/uploadAssistant/hash.ts
@@ -11,7 +11,13 @@ const sha1 = async (data: Uint8Array) =>
 
 export function hashRelease(
   picked: PickedRelease,
-  options: { announce: string; source: string; onProgress?: (done: number, total: number) => void }
+  options: {
+    announce: string;
+    source: string;
+    /** Aborting stops reading the files (the release was replaced) */
+    signal?: AbortSignal;
+    onProgress?: (done: number, total: number) => void;
+  }
 ): Promise<BuiltTorrent> {
   return buildTorrent({
     name: picked.name,
@@ -23,7 +29,10 @@ export function hashRelease(
     files: picked.files.map(({ file, path }) => ({
       path,
       length: file.size,
-      read: async (offset, length) => new Uint8Array(await file.slice(offset, offset + length).arrayBuffer()),
+      read: async (offset, length) => {
+        options.signal?.throwIfAborted();
+        return new Uint8Array(await file.slice(offset, offset + length).arrayBuffer());
+      },
     })),
   });
 }
diff --git a/doc/guide/upload-assistant.md b/doc/guide/upload-assistant.md
index 0115e73c..588733ee 100644
--- a/doc/guide/upload-assistant.md
+++ b/doc/guide/upload-assistant.md
@@ -37,8 +37,8 @@ The key is the API key of the **Integrations** page. `--save` remembers the addr
 
 With ffmpeg built with zimg (most builds), HDR screenshots are tone-mapped so they do not look washed out.
 
-::: tip API key and uploads
-The CLI publishes with the same API key as Prowlarr or Sonarr (`Authorization: Bearer`). Anyone holding that key can upload in your name: if it leaks, regenerate it on the Integrations page.
+::: warning API key, uploads and passkey
+The CLI publishes with the same API key as Prowlarr or Sonarr (`Authorization: Bearer`). Anyone holding that key can upload in your name, and can read your passkey: it is in the announce URL of every `.torrent` the key downloads (Torznab) and in the assistant settings. If the key leaks, **regenerate it and reset your passkey**, both on the Integrations page, then download your seeding torrents again.
 :::
 
 ## Descriptions in BBCode
diff --git a/i18n/locales/fr/assistant.json b/i18n/locales/fr/assistant.json
index 8058c25d..7b43d0cc 100644
--- a/i18n/locales/fr/assistant.json
+++ b/i18n/locales/fr/assistant.json
@@ -7,7 +7,7 @@
     "pickFile": "Choisir un fichier",
     "pickFolder": "Choisir un dossier",
     "adult": "Contenu adulte (captures classées NSFW chez l'hébergeur)",
-    "private": "Les fichiers sont lus dans votre navigateur : seuls les captures et le .torrent quittent votre ordinateur.",
+    "private": "Les fichiers sont lus dans votre navigateur : seules les captures et le .torrent quittent votre ordinateur.",
     "change": "Changer",
     "fileCount": "{count} fichier, {size} | {count} fichiers, {size}",
     "steps": {
diff --git a/shared/utils/bbcode.ts b/shared/utils/bbcode.ts
index 091a0257..21b26b00 100644
--- a/shared/utils/bbcode.ts
+++ b/shared/utils/bbcode.ts
@@ -29,9 +29,26 @@ const BLOCK = new Set(['center', 'left', 'right', 'quote', 'code', 'spoiler', 'l
 
 const SIZES = ['0.75em', '0.875em', '1em', '1.125em', '1.375em', '1.75em', '2.25em'];
 
-/** True when the text uses BBCode (a known tag opened and closed) */
+const OPEN_TAG = /\[(b|i|u|s|center|size|color|url|img|quote|code|spoiler|list)(?:=[^\]\n]{0,500})?\]/gi;
+
+/**
+ * True when the text uses BBCode (a known tag opened, then closed). Linear:
+ * one lastIndexOf per tag name, never a scan per opening tag (a description
+ * full of unclosed tags must not freeze the page)
+ */
 export function looksLikeBbcode(text: string): boolean {
-  return /\[(b|i|u|s|center|size|color|url|img|quote|code|spoiler|list)(=[^\]]*)?\][\s\S]*?\[\/\1\]/i.test(text);
+  const lower = text.toLowerCase();
+  const lastClose = new Map<string, number>();
+  for (const match of text.matchAll(OPEN_TAG)) {
+    const tag = match[1]!.toLowerCase();
+    let close = lastClose.get(tag);
+    if (close === undefined) {
+      close = lower.lastIndexOf(`[/${tag}]`);
+      lastClose.set(tag, close);
+    }
+    if (close >= match.index! + match[0].length) return true;
+  }
+  return false;
 }
 
 function safeUrl(raw: string): string | null {
@@ -57,6 +74,9 @@ interface Node {
   raw: string;
 }
 
+/** Deeper tags stay text: rendering recurses once per level */
+const MAX_DEPTH = 32;
+
 const TOKEN = /\[(\/?)([a-z]+|\*)(?:=([^\]\n]{0,500}))?\]/gi;
 
 function parse(source: string): Node {
@@ -85,7 +105,7 @@ function parse(source: string): Node {
       }
       // A list item runs until the next [*] or the end of the list
       if (current.tag === '*') stack.pop();
-      if (top().tag !== 'list') {
+      if (top().tag !== 'list' || stack.length > MAX_DEPTH) {
         text(raw);
         continue;
       }
@@ -103,6 +123,10 @@ function parse(source: string): Node {
       continue;
     }
     if (!closing) {
+      if (stack.length > MAX_DEPTH) {
+        text(raw);
+        continue;
+      }
       const node: Node = { tag: name, arg: arg ?? null, children: [], raw };
       current.children.push(node);
       stack.push(node);
diff --git a/shared/utils/release/description.ts b/shared/utils/release/description.ts
index b2c7732d..8e1b9ff7 100644
--- a/shared/utils/release/description.ts
+++ b/shared/utils/release/description.ts
@@ -182,8 +182,9 @@ export function buildDescription(input: DescriptionInput): string {
   }
 
   if (input.mediaInfoText?.trim()) {
-    // Inside [code] nothing is parsed: only a literal closing tag must go
-    out.push(`[spoiler=MediaInfo][code]${input.mediaInfoText.trim().replace(/\[\/code\]/gi, '[/c0de]')}[/code][/spoiler]`);
+    // Inside [code] nothing is parsed but its closing tag, in any form the
+    // parser accepts ([/code], [/CODE], [/code=x])
+    out.push(`[spoiler=MediaInfo][code]${input.mediaInfoText.trim().replace(/\[\/code(?![a-z])/gi, '[/c0de')}[/code][/spoiler]`);
   }
 
   return out.join('\n\n');
diff --git a/shared/utils/release/mediainfo.ts b/shared/utils/release/mediainfo.ts
index 969d16af..3dd208e0 100644
--- a/shared/utils/release/mediainfo.ts
+++ b/shared/utils/release/mediainfo.ts
@@ -59,10 +59,10 @@ const num = (v: unknown): number | null => {
 
 const yes = (v: unknown) => str(v)?.toLowerCase() === 'yes';
 
-/** 6 channels -> 5.1, 8 -> 7.1, 2 -> 2.0 */
+/** 6 channels -> 5.1, 8 -> 7.1; fewer than 6 have no LFE: 2 -> 2.0, 5 -> 5.0 */
 export function channelLayout(count: number | null): string | null {
   if (!count) return null;
-  if (count >= 3 && count !== 4) return `${count - 1}.1`;
+  if (count >= 6) return `${count - 1}.1`;
   return `${count}.0`;
 }
 
diff --git a/tests/upload-assistant.test.ts b/tests/upload-assistant.test.ts
index 2daf0d1f..4491f08f 100644
--- a/tests/upload-assistant.test.ts
+++ b/tests/upload-assistant.test.ts
@@ -268,3 +268,38 @@ describe('pixhost answers', () => {
     expect(isPixhostUrl(42)).toBe(false);
   });
 });
+
+describe('review fixes', () => {
+  it('detects BBCode in linear time on hostile input', () => {
+    const hostile = '[b]'.repeat(16_000);
+    const start = performance.now();
+    expect(looksLikeBbcode(hostile)).toBe(false);
+    expect(looksLikeBbcode(`${hostile}[/b]`)).toBe(true);
+    expect(performance.now() - start).toBeLessThan(200);
+    expect(looksLikeBbcode('[/b] then [b]')).toBe(false);
+  });
+
+  it('renders deep nesting without overflowing the stack', () => {
+    const html = bbcodeToHtml(`${'[b]'.repeat(16_000)}x${'[/b]'.repeat(16_000)}`);
+    expect(html.match(/<strong>/g)?.length).toBeLessThanOrEqual(33);
+    expect(html).toContain('[b]');
+  });
+
+  it('keeps MediaInfo inside its code block, whatever the closing form', () => {
+    const text = buildDescription({
+      lang: 'en',
+      title: 'x',
+      mediaInfoText: 'a [/code=x] [img]https://evil.example/p.png[/img] [/CODE] end',
+    });
+    const html = bbcodeToHtml(text);
+    expect(html).not.toContain('<img');
+    expect(html).toMatch(/<pre><code>[^<]*end<\/code><\/pre><\/details>$/);
+  });
+
+  it('gives an LFE channel only from 6 channels', () => {
+    expect(channelLayout(1)).toBe('1.0');
+    expect(channelLayout(3)).toBe('3.0');
+    expect(channelLayout(5)).toBe('5.0');
+    expect(channelLayout(6)).toBe('5.1');
+  });
+});
diff --git a/tools/upload-cli/main.ts b/tools/upload-cli/main.ts
index 321d3a5e..2ad378a4 100644
--- a/tools/upload-cli/main.ts
+++ b/tools/upload-cli/main.ts
@@ -277,7 +277,6 @@ async function main() {
   }
 
   step('Building the .torrent');
-  const handles = await Promise.all(release.files.map((f) => open(f.absolute, 'r')));
   let built;
   try {
     built = await buildTorrent({
@@ -287,24 +286,30 @@ async function main() {
       source: config.source,
       sha1: async (data) => new Uint8Array(createHash('sha1').update(data).digest()),
       onProgress: progressBar,
-      files: release.files.map((f, i) => ({
+      // Opened per read: a pack of thousands of files stays under the
+      // descriptor limit (4 reads at once at most)
+      files: release.files.map((f) => ({
         path: f.path,
         length: f.size,
         read: async (offset, length) => {
-          const buffer = new Uint8Array(length);
-          let read = 0;
-          while (read < length) {
-            const { bytesRead } = await handles[i]!.read(buffer, read, length - read, offset + read);
-            if (bytesRead === 0) break;
-            read += bytesRead;
+          const handle = await open(f.absolute, 'r');
+          try {
+            const buffer = new Uint8Array(length);
+            let read = 0;
+            while (read < length) {
+              const { bytesRead } = await handle.read(buffer, read, length - read, offset + read);
+              if (bytesRead === 0) break;
+              read += bytesRead;
+            }
+            return buffer.subarray(0, read);
+          } finally {
+            await handle.close();
           }
-          return buffer.subarray(0, read);
         },
       })),
     });
   } finally {
     process.stderr.write('\n');
-    await Promise.all(handles.map((h) => h.close()));
   }
 
   const name = values.name ?? (release.folder ? release.name : stripVideoExtension(release.name));

From 740dfe6949ddf11b692696a8ea05ca9e6b36d099 Mon Sep 17 00:00:00 2001
From: Florian <52180080+florianjs@users.noreply.github.com>
Date: Mon, 9 Nov 2026 16:30:27 +0100
Subject: [PATCH 3/3] fix(upload): ignore a dropped folder read after another
 choice

Reading a dropped folder is asynchronous: a file picked meanwhile, or a
release already in progress, is no longer replaced when it completes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 app/pages/upload/assistant.vue | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/app/pages/upload/assistant.vue b/app/pages/upload/assistant.vue
index d36ebe2a..fa422afe 100644
--- a/app/pages/upload/assistant.vue
+++ b/app/pages/upload/assistant.vue
@@ -380,7 +380,11 @@ async function copyDescription() {
   }
 }
 
+// A dropped folder is read asynchronously: any later choice makes it stale
+let pickToken = 0;
+
 async function onPick(event: Event) {
+  pickToken++;
   const input = event.target as HTMLInputElement;
   if (input.files?.length) start(releaseFromFileList(input.files));
   input.value = '';
@@ -388,7 +392,12 @@ async function onPick(event: Event) {
 
 async function onDrop(event: DragEvent) {
   dragging.value = false;
-  if (event.dataTransfer) start(await releaseFromDrop(event.dataTransfer));
+  if (!event.dataTransfer) return;
+  const token = ++pickToken;
+  const release = await releaseFromDrop(event.dataTransfer);
+  // Another file was picked meanwhile, or a release is already in progress
+  if (token !== pickToken || picked.value) return;
+  start(release);
 }
 
 function reset() {