Fall back on invalid remote transcripts (V-675)

The owner explicitly requested direct commits on master; --no-verify bypasses the branch-only workflow hook for that instruction.

internal/stt/http.go

@@ -6,8 +6,11 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
+	"math"
 	"net/http"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/kami/maven/internal/audio"
@@ -46,9 +49,19 @@ func NewHTTPTranscriber(url, token, lang string, timeout time.Duration) *HTTPTra
 // rather than sent to a model that expects something else.
 var ErrFormat = errors.New("stt: audio is not 16kHz mono pcm_s16le")
 
+// ErrInvalidTranscript means a peer returned HTTP success without a usable
+// transcript contract. It is an error so Pair can fall back to mavsttd rather
+// than dropping the turn on a valid-looking 200 response.
+var ErrInvalidTranscript = errors.New("stt: invalid transcript response")
+
+// MaxTranscriptResponseBytes bounds the JSON envelope returned by remote STT.
+// A transcript is plain text for one utterance, so 64 KiB is already far above
+// useful output and keeps a malformed LAN peer from allocating without bound.
+const MaxTranscriptResponseBytes int64 = 64 << 10
+
 type httpTranscript struct {
-	Text       string  `json:"text"`
-	Confidence float64 `json:"confidence"`
+	Text       *string  `json:"text"`
+	Confidence *float64 `json:"confidence"`
 }
 
 // Transcribe posts the raw PCM and reads back the text.
@@ -82,11 +95,35 @@ func (t *HTTPTranscriber) Transcribe(ctx context.Context, a audio.Audio) (string
 		return "", 0, fmt.Errorf("stt: remote returned %d", resp.StatusCode)
 	}
 
+	raw, err := io.ReadAll(io.LimitReader(resp.Body, MaxTranscriptResponseBytes+1))
+	if err != nil {
+		return "", 0, fmt.Errorf("stt: read transcript: %w", err)
+	}
+	if int64(len(raw)) > MaxTranscriptResponseBytes {
+		return "", 0, fmt.Errorf("%w: response exceeds %d bytes", ErrInvalidTranscript, MaxTranscriptResponseBytes)
+	}
 	var out httpTranscript
-	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+	if err := json.Unmarshal(raw, &out); err != nil {
 		return "", 0, fmt.Errorf("stt: decode transcript: %w", err)
 	}
-	return out.Text, out.Confidence, nil
+	if out.Text == nil || out.Confidence == nil {
+		return "", 0, fmt.Errorf("%w: text and confidence are required", ErrInvalidTranscript)
+	}
+	text := strings.TrimSpace(*out.Text)
+	if err := validateTranscript(text, *out.Confidence); err != nil {
+		return "", 0, err
+	}
+	return text, *out.Confidence, nil
+}
+
+func validateTranscript(text string, confidence float64) error {
+	if strings.TrimSpace(text) == "" {
+		return fmt.Errorf("%w: text is blank", ErrInvalidTranscript)
+	}
+	if math.IsNaN(confidence) || math.IsInf(confidence, 0) || confidence < 0 || confidence > 1 {
+		return fmt.Errorf("%w: confidence %v is outside [0,1]", ErrInvalidTranscript, confidence)
+	}
+	return nil
 }
 
 var _ Transcriber = (*HTTPTranscriber)(nil)