fix: review findings — clone-route audio sniffing, zip caps, filename sanitization, WAV response caps

- speakWithReference now validates the response IS audio via the same
  audioResultMIME sniff the sfx/enhance surfaces use — a 2xx JSON soft
  error or HTML proxy page was previously wrapped up as audio/wav bytes.
- audioResultMIME moves to audio.go (next to speechMIME; it was defined
  in sfx.go but shared by enhance/clone) and learns the Ogg container
  normalization (application/ogg -> audio/ogg).
- Stems zip unpack gains entry-count (16) and total-decompressed (1GB)
  caps on top of the existing per-entry cap — the per-entry bound alone
  still let a many-entry bomb multiply up.
- sanitizeFilename drops NUL and both path separators too, so upload
  metadata can never smuggle directory structure to a file-writing shim.
- New maxAudioResponseBytes (256MB) for bodies that ARE one audio clip
  (clone, enhance, sfx): a long WAV legitimately passes the 64MB JSON
  cap.
- speakWithReference local renamed path -> upPath (naming parity with
  stems/enhance).

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WWCQcYStWXBYUy5sZWnbLT

provider/llamaswap/audio.go

@@ -83,12 +83,12 @@ func (m *speechModel) Speak(ctx context.Context, req audio.SpeechRequest, opts .
 // speakWithReference performs zero-shot voice cloning via the upstream
 // passthrough clone route. The reference sample rides as the `voice_file`
 // part and the text as an `input` field; voice/format/speed still go on the
-// wire when set (upstreams ignore fields they don't understand). The route's
-// default container is WAV, so MIME resolution falls back to audio/wav (not
-// the JSON route's mp3) when neither the response header nor the requested
-// format decides.
+// wire when set (upstreams ignore fields they don't understand). The result
+// MIME comes from the response header or content sniffing (audioResultMIME,
+// same validation as the sfx/enhance surfaces) — a JSON soft error or an
+// HTML proxy page must never be wrapped up as audio bytes.
 func (m *speechModel) speakWithReference(ctx context.Context, req audio.SpeechRequest) (*audio.SpeechResult, error) {
-	path, err := upstreamPath(m.id, "/v1/audio/speech/upload")
+	upPath, err := upstreamPath(m.id, "/v1/audio/speech/upload")
 	if err != nil {
 		return nil, err
 	}
@@ -107,18 +107,17 @@ func (m *speechModel) speakWithReference(ctx context.Context, req audio.SpeechRe
 	if err != nil {
 		return nil, err
 	}
-	audioBytes, contentType, err := m.p.doRaw(ctx, http.MethodPost, path, m.id, formType, body, maxResponseBytes)
+	audioBytes, contentType, err := m.p.doRaw(ctx, http.MethodPost, upPath, m.id, formType, body, maxAudioResponseBytes)
 	if err != nil {
 		return nil, err
 	}
 	if len(audioBytes) == 0 {
 		return nil, &llm.APIError{Provider: m.p.name, Model: m.id, Message: "speech clone response contained no audio"}
 	}
-	mimeType := "audio/wav"
-	if mt := mimeFromContentType(contentType, "audio/"); mt != "" {
-		mimeType = mt
-	} else if req.Format != "" {
-		mimeType = speechMIME("", req.Format)
+	mimeType := audioResultMIME(contentType, audioBytes)
+	if mimeType == "" {
+		return nil, &llm.APIError{Provider: m.p.name, Model: m.id,
+			Message: fmt.Sprintf("speech clone response is not audio (Content-Type %q): %s", contentType, truncateForError(audioBytes))}
 	}
 	return &audio.SpeechResult{Audio: audioBytes, MIME: mimeType}, nil
 }
@@ -144,6 +143,28 @@ func speechMIME(contentType, format string) string {
 	}
 }
 
+// audioResultMIME resolves an audio body's MIME type: the response
+// Content-Type when it is a concrete audio type, else content sniffing
+// (RIFF/WAVE, Ogg and friends), else "" — the caller treats undetectable as
+// an upstream error, mirroring videoMIME. Sniffed "audio/wave" is normalized
+// to the conventional "audio/wav", and Ogg's container type
+// "application/ogg" to "audio/ogg". Shared by the clone, sfx, and enhance
+// surfaces, which all answer raw audio bodies.
+func audioResultMIME(contentType string, data []byte) string {
+	if mt := mimeFromContentType(contentType, "audio/"); mt != "" {
+		return mt
+	}
+	switch mt := http.DetectContentType(data); {
+	case mt == "audio/wave":
+		return "audio/wav"
+	case mt == "application/ogg":
+		return "audio/ogg"
+	case strings.HasPrefix(mt, "audio/"):
+		return mt
+	}
+	return ""
+}
+
 // TranscriptionModel implements audio.TranscriptionProvider, binding a
 // speech-to-text model served by llama-swap (routed to a whisper.cpp-style
 // upstream).
@@ -241,10 +262,13 @@ func transcriptionFilename(filename, mimeType string) string {
 }
 
 // sanitizeFilename strips characters that would corrupt or inject into the
-// multipart Content-Disposition header. Quotes and backslashes are escaped
-// by mime/multipart itself; CR/LF are not — they must go.
+// multipart Content-Disposition header, or smuggle directory structure to
+// the receiving side. Quotes and backslashes are escaped by mime/multipart
+// itself, but a file-writing shim decodes them right back — so CR/LF/NUL
+// and both path separators are dropped: an upload-metadata filename must
+// never traverse ("../x", "a/b", "C:\x").
 func sanitizeFilename(name string) string {
-	name = strings.NewReplacer("\r", "", "\n", "").Replace(name)
+	name = strings.NewReplacer("\r", "", "\n", "", "\x00", "", "/", "", "\\", "").Replace(name)
 	return strings.TrimSpace(name)
 }