refactor(media): reuse shared execution limits and give each rule one home

Quality pass over the ffmpeg hardening, from a four-angle review.

Reuse:
- Replace the hand-rolled OperationBudget with createTimeoutAbortController
  from @/lib/core/execution-limits, which already models "one deadline plus a
  parent signal, and tell me which fired". This also removes the per-command
  setTimeout: the controller's single deadline covers the whole operation, so
  probeFile now takes its cap from getRemainingExecutionMs.
- Combine the tool's cancellation signals with combineExecutionAbortSignals,
  and move that helper to base-tool.ts next to assertServerToolNotAborted,
  where the shared "how does a tool consume cancellation" concern lives.

Altitude:
- Delete assertOptionsWithinBounds. Every rule in it also lived in the
  operation that consumes it, and the two copies had already diverged:
  extract_audio's allowlist existed only in the preflight, and the end >= start
  check only there. Each rule now has exactly one home, at its point of use.
- Stop resolving the ffmpeg binary in withTempDir, so a validation failure no
  longer surfaces as "FFmpeg not found" on a host without it. runCommand and
  probeFile resolve it, being the only things that need it.
- Add tempPath(), which resolves a name inside the temp dir and refuses
  anything that escapes. All 14 path sites go through it, so the containment
  invariant is structural rather than dependent on remembering to sanitize
  every filename source.
- Declare OUTPUT_EXTS explicitly instead of deriving the allowlist from
  EXT_TO_MIME, so widening a content-type map cannot widen what may be written.

Also: a supplied width/height of 0 now reaches the bounds check rather than
being treated as absent, memoize the resolved ffprobe path, and settle() on a
synchronous throw from .save() so no listener outlives the command.

Tests: replace two assertions that could not fail (`rejects.not.toThrow` passes
on any rejection, including "FFmpeg not found") with deterministic ones, which
also removes every real ffmpeg spawn from the suite — 293ms of test time to
21ms. Verified hermetic with ffmpeg off PATH, and verified against real ffmpeg
out-of-band that probe, convert, scale_pad, budget expiry, and external abort
all still behave.

Author: waleedlatif1

apps/sim/lib/copilot/tools/server/base-tool.ts

@@ -1,5 +1,6 @@
 import type { z } from 'zod'
 import type { BillingAttributionSnapshot } from '@/lib/billing/core/billing-attribution'
+import { combineExecutionAbortSignals } from '@/lib/core/execution-limits'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 export interface ServerToolContext {
@@ -28,6 +29,18 @@ export interface ServerToolContext {
   resolvedSecretTraceRegistry?: ResolvedSecretTraceRegistry
 }
 
+/**
+ * One signal covering every way a tool call can be cancelled, for tools that
+ * hold a killable resource (a child process, a long stream) rather than merely
+ * checking between steps as {@link assertServerToolNotAborted} does.
+ */
+export function resolveServerToolAbortSignal(context?: ServerToolContext): AbortSignal | undefined {
+  const signals = [context?.abortSignal, context?.userStopSignal].filter(
+    (signal): signal is AbortSignal => Boolean(signal)
+  )
+  return signals.length > 0 ? combineExecutionAbortSignals(signals) : undefined
+}
+
 export function assertServerToolNotAborted(
   context?: ServerToolContext,
   message = 'Request aborted before tool mutation could be applied.'

apps/sim/lib/copilot/tools/server/media/ffmpeg.ts

@@ -8,6 +8,7 @@ import { Ffmpeg } from '@/lib/copilot/generated/tool-catalog-v1'
 import {
   assertServerToolNotAborted,
   type BaseServerTool,
+  resolveServerToolAbortSignal,
   type ServerToolContext,
 } from '@/lib/copilot/tools/server/base-tool'
 import { writeCopilotWorkspaceFileByPath } from '@/lib/copilot/vfs/resource-writer'
@@ -76,19 +77,6 @@ interface FfmpegResult {
   probe?: unknown
 }
 
-/**
- * A transcode outlives its request unless the child process is killed, so both
- * the transport abort and the explicit user stop must reach FFmpeg — checking
- * them only between steps leaves a cancelled turn burning cores.
- */
-function resolveFfmpegAbortSignal(context: ServerToolContext): AbortSignal | undefined {
-  const signals = [context.abortSignal, context.userStopSignal].filter(
-    (signal): signal is AbortSignal => Boolean(signal)
-  )
-  if (signals.length === 0) return undefined
-  return signals.length === 1 ? signals[0] : AbortSignal.any(signals)
-}
-
 export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
   name: Ffmpeg.id,
 
@@ -180,7 +168,9 @@ export const ffmpegServerTool: BaseServerTool<FfmpegArgs, FfmpegResult> = {
           loopToVideo: params.loopToVideo,
           format: params.format,
         },
-        { signal: resolveFfmpegAbortSignal(context) }
+        // A transcode outlives its request unless the child is killed, so the
+        // cancellation signal must reach FFmpeg itself, not just the steps around it.
+        { signal: resolveServerToolAbortSignal(context) }
       )
 
       // probe reports metadata only — no file written.

apps/sim/lib/media/ffmpeg.test.ts

@@ -49,14 +49,18 @@ describe('runFfmpegOperation output format validation', () => {
     ).rejects.toThrow('Unsupported output format')
   })
 
-  it.each(['webp', 'weba', 'mp4', 'gif'])(
-    'still accepts %s, which the input MIME map already supported',
-    async (format) => {
-      await expect(runFfmpegOperation('convert', [mediaFile()], { format })).rejects.not.toThrow(
-        'Unsupported output format'
-      )
+  it('keeps the formats the input MIME map already supported', async () => {
+    // Asserted through the rejection's own "Supported:" list rather than by
+    // converting for real: a `not.toThrow` on a live transcode passes on any
+    // rejection, including "FFmpeg not found".
+    const error = await runFfmpegOperation('convert', [mediaFile()], { format: 'exe' }).catch(
+      (e: Error) => e
+    )
+
+    for (const format of ['mp4', 'mov', 'webm', 'mp3', 'wav', 'gif', 'webp', 'weba']) {
+      expect(error.message).toContain(format)
     }
-  )
+  })
 })
 
 describe('runFfmpegOperation scale bounds', () => {
@@ -75,12 +79,15 @@ describe('runFfmpegOperation scale bounds', () => {
 })
 
 describe('runFfmpegOperation per-operation validation', () => {
-  it('ignores options the operation never consumes', async () => {
-    // overlay_audio does not read `volume`; an out-of-range surplus value from
-    // the model must not fail the whole call.
+  // Each rule is asserted at the operation that owns it. The complementary
+  // property — that an operation ignores options it never reads — cannot be
+  // asserted without running a real transcode, so it is left to review.
+  it('rejects an out-of-range volume on mix_audio, which consumes it', async () => {
     await expect(
-      runFfmpegOperation('overlay_audio', [mediaFile(), mediaFile('audio/mpeg')], { volume: 15 })
-    ).rejects.not.toThrow(/volume/)
+      runFfmpegOperation('mix_audio', [mediaFile('audio/mpeg'), mediaFile('audio/mpeg')], {
+        volume: 15,
+      })
+    ).rejects.toThrow('volume must be a number between 0 and 10')
   })
 
   it('rejects a trim whose end precedes its start', async () => {