🤖 fix: stat local audio files before reading import payloads

---

_Generated with `mux` • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh` • Cost: `3.03`_

<!-- mux-attribution: model=openai:gpt-5.3-codex thinking=xhigh costs=53.03 -->

Author: jaaydenh

src/node/services/eventSoundAssetService.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { afterEach, beforeEach, describe, expect, it, spyOn } from "bun:test";
 import * as fsPromises from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -69,6 +69,23 @@ describe("EventSoundAssetService", () => {
     );
   });
 
+  it("checks file size metadata before reading oversized local imports", async () => {
+    const sourcePath = path.join(tempMuxHome, "oversize-by-metadata.wav");
+    await fsPromises.writeFile(sourcePath, "");
+    await fsPromises.truncate(sourcePath, MAX_AUDIO_FILE_SIZE_BYTES + 1);
+
+    const readFileSpy = spyOn(fsPromises, "readFile");
+    try {
+      await expectRejects(
+        service.importFromLocalPath(sourcePath),
+        "Audio file exceeds maximum allowed size"
+      );
+      expect(readFileSpy).not.toHaveBeenCalled();
+    } finally {
+      readFileSpy.mockRestore();
+    }
+  });
+
   it("rejects local imports with unsupported extensions", async () => {
     const sourcePath = path.join(tempMuxHome, "not-audio.txt");
     await fsPromises.writeFile(sourcePath, "not audio");

src/node/services/eventSoundAssetService.ts

@@ -321,7 +321,11 @@ export class EventSoundAssetService {
         throw new Error("Unsupported audio file extension");
       }
 
+      const stat = await fsPromises.stat(localPath);
+      this.validateSize(stat.size);
+
       const bytes = await fsPromises.readFile(localPath);
+      // Re-validate after reading in case the file grew between stat + read.
       this.validateSize(bytes.byteLength);
 
       return this.storeAsset({