fleet(20260809-trigger-fixes/coderabbit-fixes): trabalho do executor …

…(round 1)

brainiall-diarized-transcription/last_message.md

@@ -0,0 +1,145 @@
+> brainiall-diarized-transcription@0.1.0 test
+> tsx --test tests/**/*.test.ts
+
+TAP version 13
+# Subtest: sends the fixed BRAINIALL multipart contract without returning the key
+ok 1 - sends the fixed BRAINIALL multipart contract without returning the key
+  ---
+  duration_ms: 8.930875
+  type: 'test'
+  ...
+# Subtest: maps authorization failures without returning the response body
+ok 2 - maps authorization failures without returning the response body
+  ---
+  duration_ms: 0.514667
+  type: 'test'
+  ...
+# Subtest: rejects empty keys before making a request
+ok 3 - rejects empty keys before making a request
+  ---
+  duration_ms: 0.075167
+  type: 'test'
+  ...
+# Subtest: redacts details from network errors
+ok 4 - redacts details from network errors
+  ---
+  duration_ms: 0.214458
+  type: 'test'
+  ...
+# Subtest: parses word timestamps and renders speaker-labelled SRT and VTT
+ok 5 - parses word timestamps and renders speaker-labelled SRT and VTT
+  ---
+  duration_ms: 0.707208
+  type: 'test'
+  ...
+# Subtest: joins punctuation without introducing spaces
+ok 6 - joins punctuation without introducing spaces
+  ---
+  duration_ms: 0.053875
+  type: 'test'
+  ...
+# Subtest: reconstructs text when the API text field is blank
+ok 7 - reconstructs text when the API text field is blank
+  ---
+  duration_ms: 0.062917
+  type: 'test'
+  ...
+# Subtest: splits a cue after a long silence even for the same speaker
+ok 8 - splits a cue after a long silence even for the same speaker
+  ---
+  duration_ms: 0.130958
+  type: 'test'
+  ...
+# Subtest: rejects responses without valid timestamped words
+ok 9 - rejects responses without valid timestamped words
+  ---
+  duration_ms: 0.210834
+  type: 'test'
+  ...
+# Subtest: accepts only exact allowlisted public HTTPS hosts
+ok 10 - accepts only exact allowlisted public HTTPS hosts
+  ---
+  duration_ms: 3.545167
+  type: 'test'
+  ...
+# Subtest: downloads allowed audio without exposing the query in its result
+ok 11 - downloads allowed audio without exposing the query in its result
+  ---
+  duration_ms: 9.536125
+  type: 'test'
+  ...
+# Subtest: redacts source URLs from network errors
+ok 12 - redacts source URLs from network errors
+  ---
+  duration_ms: 0.216417
+  type: 'test'
+  ...
+# Subtest: redacts source URLs from response body read errors
+ok 13 - redacts source URLs from response body read errors
+  ---
+  duration_ms: 0.428917
+  type: 'test'
+  ...
+# Subtest: redacts source URLs from reader cancellation errors
+ok 14 - redacts source URLs from reader cancellation errors
+  ---
+  duration_ms: 0.272125
+  type: 'test'
+  ...
+# Subtest: revalidates every redirect against the hostname allowlist
+ok 15 - revalidates every redirect against the hostname allowlist
+  ---
+  duration_ms: 0.420375
+  type: 'test'
+  ...
+# Subtest: rejects oversized audio before reading a declared body
+ok 16 - rejects oversized audio before reading a declared body
+  ---
+  duration_ms: 0.205709
+  type: 'test'
+  ...
+# Subtest: rejects malformed declared content lengths
+ok 17 - rejects malformed declared content lengths
+  ---
+  duration_ms: 0.447542
+  type: 'test'
+  ...
+# Subtest: enforces the size limit while streaming when content-length is absent
+ok 18 - enforces the size limit while streaming when content-length is absent
+  ---
+  duration_ms: 0.781958
+  type: 'test'
+  ...
+# Subtest: rejects HTML or a generic response without an audio extension
+ok 19 - rejects HTML or a generic response without an audio extension
+  ---
+  duration_ms: 0.740709
+  type: 'test'
+  ...
+# Subtest: requires an explicit rights and consent confirmation before network access
+ok 20 - requires an explicit rights and consent confirmation before network access
+  ---
+  duration_ms: 0.503834
+  type: 'test'
+  ...
+# Subtest: rejects unsupported languages before network access
+ok 21 - rejects unsupported languages before network access
+  ---
+  duration_ms: 0.0655
+  type: 'test'
+  ...
+# Subtest: requires a server-side API key before network access
+ok 22 - requires a server-side API key before network access
+  ---
+  duration_ms: 0.057375
+  type: 'test'
+  ...
+1..22
+# tests 22
+# suites 0
+# pass 22
+# fail 0
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 183.320208

brainiall-diarized-transcription/src/lib/captions.ts

@@ -106,7 +106,7 @@ export function joinTokens(tokens: string[]): string {
     if (
       !result ||
       /^[,.;:!?%…\)\]\}]/u.test(token) ||
-      /[\(\[\{]$/u.test(result)
+      /[\(\[\{¿¡]$/u.test(result)
     ) {
       result += token;
     } else {

brainiall-diarized-transcription/src/lib/source.ts

@@ -119,6 +119,16 @@ function safeFilename(url: URL): string {
   return sanitized || "audio.bin";
 }
 
+async function safeCancel(
+  target: { cancel: () => Promise<unknown> } | null | undefined,
+): Promise<void> {
+  try {
+    await target?.cancel();
+  } catch {
+    // Ignore cancellation failures to preserve primary errors and prevent credential leakage
+  }
+}
+
 async function readWithLimit(response: Response): Promise<Uint8Array> {
   if (!response.body) {
     throw new Error("Audio source returned an empty response.");
@@ -128,13 +138,21 @@ async function readWithLimit(response: Response): Promise<Uint8Array> {
   const chunks: Uint8Array[] = [];
   let total = 0;
   while (true) {
-    const { value, done } = await reader.read();
+    let readResult: ReadableStreamReadResult<Uint8Array>;
+    try {
+      readResult = await reader.read();
+    } catch {
+      await safeCancel(reader);
+      throw new Error("Could not download audio from the configured source.");
+    }
+
+    const { value, done } = readResult;
     if (done) {
       break;
     }
     total += value.byteLength;
     if (total > MAX_AUDIO_BYTES) {
-      await reader.cancel();
+      await safeCancel(reader);
       throw new Error("Audio exceeds the 25 MB example limit.");
     }
     chunks.push(value);
@@ -176,10 +194,10 @@ export async function downloadAllowedAudio(
     if (response.status >= 300 && response.status < 400) {
       const location = response.headers.get("location");
       if (!location || redirectCount === MAX_REDIRECTS) {
-        await response.body?.cancel();
+        await safeCancel(response.body);
         throw new Error("Audio source redirect could not be followed safely.");
       }
-      await response.body?.cancel();
+      await safeCancel(response.body);
       currentUrl = validateAudioSourceUrl(
         new URL(location, currentUrl).toString(),
         allowedHosts,
@@ -188,7 +206,7 @@ export async function downloadAllowedAudio(
     }
 
     if (!response.ok) {
-      await response.body?.cancel();
+      await safeCancel(response.body);
       throw new Error(`Audio source returned HTTP ${response.status}.`);
     }
 
@@ -198,11 +216,11 @@ export async function downloadAllowedAudio(
       contentLength !== undefined &&
       (!Number.isFinite(contentLength) || contentLength < 0)
     ) {
-      await response.body?.cancel();
+      await safeCancel(response.body);
       throw new Error("Audio source returned an invalid content length.");
     }
     if (contentLength !== undefined && contentLength > MAX_AUDIO_BYTES) {
-      await response.body?.cancel();
+      await safeCancel(response.body);
       throw new Error("Audio exceeds the 25 MB example limit.");
     }
 
@@ -214,15 +232,28 @@ export async function downloadAllowedAudio(
       !ALLOWED_CONTENT_TYPES.has(contentType) ||
       (contentType === "application/octet-stream" && !ALLOWED_EXTENSIONS.has(extension))
     ) {
-      await response.body?.cancel();
+      await safeCancel(response.body);
       throw new Error("Audio source returned an unsupported media type.");
     }
 
-    return {
-      bytes: await readWithLimit(response),
-      contentType,
-      filename: safeFilename(currentUrl),
-    };
+    try {
+      return {
+        bytes: await readWithLimit(response),
+        contentType,
+        filename: safeFilename(currentUrl),
+      };
+    } catch (error) {
+      if (
+        error instanceof Error &&
+        (error.message === "Audio exceeds the 25 MB example limit." ||
+          error.message === "Audio source returned an empty response." ||
+          error.message === "Audio source returned an empty file." ||
+          error.message === "Could not download audio from the configured source.")
+      ) {
+        throw error;
+      }
+      throw new Error("Could not download audio from the configured source.");
+    }
   }
 
   throw new Error("Audio source redirect could not be followed safely.");

brainiall-diarized-transcription/tests/captions.test.ts

@@ -39,6 +39,8 @@ test("parses word timestamps and renders speaker-labelled SRT and VTT", () => {
 
 test("joins punctuation without introducing spaces", () => {
   assert.equal(joinTokens(["Bom", "dia", ",", "mundo", "!"]), "Bom dia, mundo!");
+  assert.equal(joinTokens(["¿", "Cómo", "estás", "?"]), "¿Cómo estás?");
+  assert.equal(joinTokens(["¡", "Hola", ",", "mundo", "!"]), "¡Hola, mundo!");
 });
 
 test("reconstructs text when the API text field is blank", () => {

brainiall-diarized-transcription/tests/source.test.ts

@@ -72,6 +72,67 @@ test("redacts source URLs from network errors", async () => {
   );
 });
 
+test("redacts source URLs from response body read errors", async () => {
+  const hosts = parseAllowedSourceHosts("media.example.com");
+  const body = new ReadableStream<Uint8Array>({
+    pull(controller) {
+      controller.error(
+        new Error("stream read error at https://media.example.com/file.wav?sig=SUPERSECRET"),
+      );
+    },
+  });
+  const fetcher: FetchLike = async () =>
+    new Response(body, {
+      status: 200,
+      headers: { "content-type": "audio/wav" },
+    });
+
+  await assert.rejects(
+    downloadAllowedAudio(
+      "https://media.example.com/file.wav?sig=SUPERSECRET",
+      hosts,
+      fetcher,
+    ),
+    (error: Error) => {
+      assert.equal(error.message, "Could not download audio from the configured source.");
+      assert.equal(error.message.includes("SUPERSECRET"), false);
+      return true;
+    },
+  );
+});
+
+test("redacts source URLs from reader cancellation errors", async () => {
+  const hosts = parseAllowedSourceHosts("media.example.com");
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(new Uint8Array(MAX_AUDIO_BYTES + 1));
+    },
+    cancel() {
+      throw new Error(
+        "cancellation error at https://media.example.com/file.wav?sig=SUPERSECRET",
+      );
+    },
+  });
+  const fetcher: FetchLike = async () =>
+    new Response(body, {
+      status: 200,
+      headers: { "content-type": "audio/wav" },
+    });
+
+  await assert.rejects(
+    downloadAllowedAudio(
+      "https://media.example.com/file.wav?sig=SUPERSECRET",
+      hosts,
+      fetcher,
+    ),
+    (error: Error) => {
+      assert.equal(error.message, "Audio exceeds the 25 MB example limit.");
+      assert.equal(error.message.includes("SUPERSECRET"), false);
+      return true;
+    },
+  );
+});
+
 test("revalidates every redirect against the hostname allowlist", async () => {
   const hosts = parseAllowedSourceHosts("media.example.com,cdn.example.com");
   const seen: string[] = [];