fix(media): floor the probe timeout and label audio-only webm correctly

Two findings from review:

- Node reads execFile's `timeout: 0` as 'no timeout', so once the shared budget
  was spent the 15s probe cap disappeared entirely — the opposite of what an
  exhausted budget should do. Reachable between the deadline passing and the
  abort timer firing, where assertOperationLive still sees a live signal. Floor
  the computed cap at 1ms.
- extract_audio accepts webm, but mimeFromExt resolves that container to
  video/webm, so an audio-only extract was stored with a video content type.
  Resolve audio-only outputs through a small override map.

Author: waleedlatif1

apps/sim/lib/media/ffmpeg-probe-resolution.test.ts

@@ -52,6 +52,17 @@ describe('probing without a discoverable ffmpeg binary', () => {
     expect(execFileMock.mock.calls[0][0]).toContain('ffprobe')
   })
 
+  it('always hands ffprobe a positive timeout', async () => {
+    // Node reads `timeout: 0` as "no timeout", so the computed cap is floored.
+    // Asserted on a healthy budget rather than an expired one: forcing the
+    // expired window means racing the abort timer, which makes the test flaky.
+    await runFfmpegOperation('probe', [{ buffer: Buffer.from('media'), mimeType: 'video/mp4' }])
+
+    const opts = execFileMock.mock.calls[0][2] as { timeout: number }
+    expect(opts.timeout).toBeGreaterThan(0)
+    expect(opts.timeout).toBeLessThanOrEqual(15_000)
+  })
+
   it('still refuses to transcode, which genuinely needs ffmpeg', async () => {
     await expect(
       runFfmpegOperation('convert', [{ buffer: Buffer.from('m'), mimeType: 'video/mp4' }], {

apps/sim/lib/media/ffmpeg.test.ts

@@ -104,6 +104,15 @@ describe('runFfmpegOperation per-operation validation', () => {
     )
   })
 
+  it('allows webm for extract_audio but not weba', async () => {
+    const error = await runFfmpegOperation('extract_audio', [mediaFile()], {
+      format: 'weba',
+    }).catch((e: Error) => e)
+
+    expect(error.message).toContain('Unsupported output format')
+    expect(error.message).toContain('webm')
+  })
+
   it('restricts extract_audio to audio containers', async () => {
     await expect(
       runFfmpegOperation('extract_audio', [mediaFile()], { format: 'png' })

apps/sim/lib/media/ffmpeg.ts

@@ -246,6 +246,11 @@ const OUTPUT_EXTS = new Set([
  */
 const AUDIO_EXTS = new Set(['mp3', 'm4a', 'wav', 'ogg', 'flac', 'aac', 'opus', 'webm'])
 
+/** Containers shared with video, whose content type differs for an audio-only output. */
+const AUDIO_ONLY_MIME: Record<string, string> = {
+  webm: 'audio/webm',
+}
+
 /**
  * Temp-file names are built as `${prefix}.${ext}` and joined against the temp
  * dir, so an extension carrying `/` or `..` escapes that dir once `path.join`
@@ -493,12 +498,17 @@ function describeProbeFailure(err: Error & { killed?: boolean; code?: unknown },
 function probeFile(filePath: string, limit: TimeoutAbortController): Promise<MediaProbe> {
   assertOperationLive(limit)
   const remaining = getRemainingExecutionMs(limit.signal) ?? PROBE_TIMEOUT_MS
+  // Floored at 1ms: Node reads `timeout: 0` as "no timeout", so an expired
+  // budget would otherwise remove the probe cap entirely — the opposite of what
+  // an exhausted budget should do. Reachable between the deadline passing and
+  // the abort timer firing, where assertOperationLive still sees a live signal.
+  const timeout = Math.max(1, Math.min(PROBE_TIMEOUT_MS, remaining))
   return new Promise((resolve, reject) => {
     execFile(
       resolveFfprobePath(),
       ['-v', 'error', '-print_format', 'json', '-show_format', '-show_streams', '-i', filePath],
       {
-        timeout: Math.min(PROBE_TIMEOUT_MS, remaining),
+        timeout,
         killSignal: 'SIGKILL',
         maxBuffer: PROBE_MAX_OUTPUT_BYTES,
         signal: limit.signal,
@@ -597,9 +607,13 @@ export async function runFfmpegOperation(
   }
 }
 
-async function readOut(outputPath: string, ext: string): Promise<FfmpegResult> {
+async function readOut(
+  outputPath: string,
+  ext: string,
+  contentType = mimeFromExt(ext)
+): Promise<FfmpegResult> {
   const buffer = await fs.readFile(outputPath)
-  return { buffer, ext, contentType: mimeFromExt(ext) }
+  return { buffer, ext, contentType }
 }
 
 async function overlayAudio(
@@ -863,7 +877,9 @@ async function extractAudio(
   const outputPath = tempPath(dir, `out.${ext}`)
   const command = ffmpeg(inputPath).noVideo()
   await runCommand(command, outputPath, limit)
-  return readOut(outputPath, ext)
+  // A container shared with video (webm) resolves to a video content type by
+  // default, but this output has had its video stream dropped.
+  return readOut(outputPath, ext, AUDIO_ONLY_MIME[ext] ?? mimeFromExt(ext))
 }
 
 async function convert(