fix(media): bound the copilot ffmpeg tool's inputs, runtime, and output paths

FFmpeg runs in-process on the request-serving app server, so every
attacker-influenced dimension of a tool call is an instance-wide resource
concern rather than a single failed request.

- Cap input count at 10 in both the tool handler (before any download) and
  runFfmpegOperation. The existing MAX_MEDIA_BYTES budget bounded RAM but
  still permitted hundreds of small clips, and concat re-encodes each one
  serially with libx264.
- Give the whole operation a single 5-minute wall-clock budget shared across
  every spawned process, and SIGKILL on expiry. A per-command timeout would
  still multiply out across concat's per-clip encodes.
- Wire abortSignal and userStopSignal through to that kill, so a cancelled
  copilot turn stops the transcode instead of leaving it running.
- Validate scale_pad width/height as integers in 16..4096 before they reach
  the filter graph, and clamp the probed dimensions concat derives from the
  first clip's container metadata.
- Restrict the convert/extract_audio `format` to known muxers with safe file
  names. It was interpolated into path.join(dir, `out.${ext}`) unsanitized,
  so a format of "../../x.mp4" escaped the temp dir and wrote there.
- Spawn ffprobe directly rather than through fluent-ffmpeg, which exposes no
  handle on the child and so cannot be killed.

Validation runs before any temp dir or binary resolution, so a rejected
request costs nothing and reports the real reason.

Author: waleedlatif1

apps/sim/lib/copilot/tools/server/media/ffmpeg.test.ts

@@ -42,6 +42,7 @@ vi.mock('@/lib/copilot/application/execute-file-use-case', () => ({
 }))
 
 vi.mock('@/lib/media/ffmpeg', () => ({
+  MAX_FFMPEG_INPUTS: 10,
   runFfmpegOperation: runFfmpegOperationMock,
 }))
 
@@ -308,4 +309,37 @@ describe('ffmpeg server tool secret provenance', () => {
       message: 'ffmpeg convert failed: The media operation failed safely',
     })
   })
+
+  it('rejects more inputs than the cap before downloading any of them', async () => {
+    const result = await ffmpegServerTool.execute(
+      {
+        operation: 'concat',
+        inputs: {
+          files: Array.from({ length: 11 }, () => ({ path: 'files/input.mp4' })),
+        },
+      },
+      context
+    )
+
+    expect(result.success).toBe(false)
+    expect(result.message).toContain('At most 10 input files')
+    expect(resolveWorkspaceFileReferenceMock).not.toHaveBeenCalled()
+    expect(runFfmpegOperationMock).not.toHaveBeenCalled()
+  })
+
+  it('forwards the abort signal so a cancelled turn can kill the transcode', async () => {
+    const abortSignal = new AbortController().signal
+
+    await ffmpegServerTool.execute(
+      { operation: 'convert', inputs: { files: [{ path: 'files/input.mp4' }] } },
+      { ...context, abortSignal }
+    )
+
+    expect(runFfmpegOperationMock).toHaveBeenCalledWith(
+      'convert',
+      expect.anything(),
+      expect.anything(),
+      { signal: abortSignal }
+    )
+  })
 })

apps/sim/lib/copilot/tools/server/media/ffmpeg.ts

@@ -12,7 +12,12 @@ import {
 } from '@/lib/copilot/tools/server/base-tool'
 import { writeCopilotWorkspaceFileByPath } from '@/lib/copilot/vfs/resource-writer'
 import { MAX_MEDIA_BYTES } from '@/lib/media/falai'
-import { type FfmpegOperation, type MediaFile, runFfmpegOperation } from '@/lib/media/ffmpeg'
+import {
+  type FfmpegOperation,
+  MAX_FFMPEG_INPUTS,
+  type MediaFile,
+  runFfmpegOperation,
+} from '@/lib/media/ffmpeg'
 import {
   createWorkspaceFileSecretProvenanceFromRegistry,
   getBoundWorkspaceFileSecretProvenance,
@@ -71,6 +76,19 @@ interface FfmpegResult {
   probe?: unknown
 }
 
+/**
+ * A transcode outlives its request unless the child process is killed, so both
+ * the transport abort and the explicit user stop must reach FFmpeg — checking
+ * them only between steps leaves a cancelled turn burning cores.
+ */
+function resolveFfmpegAbortSignal(context: ServerToolContext): AbortSignal | undefined {
+  const signals = [context.abortSignal, context.userStopSignal].filter(
+    (signal): signal is AbortSignal => Boolean(signal)
+  )
+  if (signals.length === 0) return undefined
+  return signals.length === 1 ? signals[0] : AbortSignal.any(signals)
+}
+
 export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
   name: Ffmpeg.id,
 
@@ -90,6 +108,14 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
     if (inputPaths.length === 0) {
       return { success: false, message: 'At least one input file is required in inputs.files' }
     }
+    // Bounded before any download: the byte budget alone still permits hundreds
+    // of small clips, and concat re-encodes every one of them serially.
+    if (inputPaths.length > MAX_FFMPEG_INPUTS) {
+      return {
+        success: false,
+        message: `At most ${MAX_FFMPEG_INPUTS} input files are allowed per ffmpeg operation (got ${inputPaths.length}).`,
+      }
+    }
 
     let inputRequiresOpaqueError = false
     try {
@@ -138,19 +164,24 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
       inputRequiresOpaqueError ||=
         inputProvenance.status === 'unknown' || inputProvenance.entries.length > 0
       assertServerToolNotAborted(context)
-      const result = await runFfmpegOperation(params.operation, mediaFiles, {
-        text: params.text,
-        position: params.position,
-        start: params.start,
-        end: params.end,
-        width: params.width,
-        height: params.height,
-        aspectRatio: params.aspectRatio,
-        volume: params.volume,
-        musicVolume: params.musicVolume,
-        loopToVideo: params.loopToVideo,
-        format: params.format,
-      })
+      const result = await runFfmpegOperation(
+        params.operation,
+        mediaFiles,
+        {
+          text: params.text,
+          position: params.position,
+          start: params.start,
+          end: params.end,
+          width: params.width,
+          height: params.height,
+          aspectRatio: params.aspectRatio,
+          volume: params.volume,
+          musicVolume: params.musicVolume,
+          loopToVideo: params.loopToVideo,
+          format: params.format,
+        },
+        { signal: resolveFfmpegAbortSignal(context) }
+      )
 
       // probe reports metadata only — no file written.
       if (params.operation === 'probe') {

apps/sim/lib/media/ffmpeg.test.ts

@@ -0,0 +1,75 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { MAX_FFMPEG_INPUTS, type MediaFile, runFfmpegOperation } from '@/lib/media/ffmpeg'
+
+function mediaFile(mimeType = 'video/mp4'): MediaFile {
+  return { buffer: Buffer.from('media'), mimeType, name: 'clip.mp4' }
+}
+
+describe('runFfmpegOperation input bounds', () => {
+  it('rejects more inputs than the cap before touching the filesystem', async () => {
+    const inputs = Array.from({ length: MAX_FFMPEG_INPUTS + 1 }, () => mediaFile())
+
+    await expect(runFfmpegOperation('concat', inputs)).rejects.toThrow(
+      `At most ${MAX_FFMPEG_INPUTS} input files`
+    )
+  })
+
+  it('still requires at least one input', async () => {
+    await expect(runFfmpegOperation('convert', [], { format: 'mp3' })).rejects.toThrow(
+      'At least one input file is required'
+    )
+  })
+})
+
+describe('runFfmpegOperation output format validation', () => {
+  it.each([
+    ['../../escape.mp4', 'traversal'],
+    ['../pwned.mp3', 'parent segment'],
+    ['/etc/cron.d/x.mp4', 'absolute path'],
+    ['mp4/../../x', 'embedded separator'],
+  ])('rejects %s as an output format (%s)', async (format) => {
+    await expect(runFfmpegOperation('convert', [mediaFile()], { format })).rejects.toThrow(
+      'Unsupported output format'
+    )
+  })
+
+  it('rejects a format with no known muxer', async () => {
+    await expect(runFfmpegOperation('convert', [mediaFile()], { format: 'exe' })).rejects.toThrow(
+      'Unsupported output format'
+    )
+  })
+
+  it('rejects a traversal format on extract_audio too', async () => {
+    await expect(
+      runFfmpegOperation('extract_audio', [mediaFile()], { format: '../../escape.mp3' })
+    ).rejects.toThrow('Unsupported output format')
+  })
+})
+
+describe('runFfmpegOperation scale bounds', () => {
+  it.each([
+    [30000, 30000],
+    [1, 1],
+    [4097, 1080],
+    [1920, 0],
+    [1920.5, 1080],
+  ])('rejects scale_pad at %sx%s', async (width, height) => {
+    await expect(runFfmpegOperation('scale_pad', [mediaFile()], { width, height })).rejects.toThrow(
+      /must be an integer between 16 and 4096|requires width\+height/
+    )
+  })
+})
+
+describe('runFfmpegOperation abort handling', () => {
+  it('refuses to start once the signal is already aborted', async () => {
+    const controller = new AbortController()
+    controller.abort()
+
+    await expect(
+      runFfmpegOperation('convert', [mediaFile()], { format: 'mp3' }, { signal: controller.signal })
+    ).rejects.toThrow(/aborted/i)
+  })
+})