fix(packaging): bound helper probe capture

tools/embedded-mpv/README.md

@@ -239,12 +239,14 @@ application diagnostic retains `helper-probe-failed` as the top-level reason
 for nonzero helper exits and adds `helperReason` only when the helper emitted
 one exact protocol-v1 line with a fixed allowlisted reason. Its optional
 `helperDetail` is restricted to 1–1024 printable ASCII characters; invalid
-detail suppresses both helper fields. With `IPTVNATOR_TRACE_PLAYER=1`, non-empty
-captured helper stderr is written separately as one JSON-escaped stderr line:
-its `stderr` field contains at most the first 16,384 characters and its
-`truncated` boolean is always explicit. Empty captures, disabled tracing, and
-trace-writer failures do not emit a record or alter availability. The
-installed-Snap probe therefore tests the private shared-memory confinement
+detail suppresses both helper fields. Every probe has the same explicit 16 MiB
+per-stream child-capture ceiling, regardless of tracing. With
+`IPTVNATOR_TRACE_PLAYER=1`, non-empty captured helper stderr is written
+separately as one JSON-escaped stderr line: its `stderr` field contains at most
+the first 16,384 characters and its `truncated` boolean is always explicit.
+Empty captures, disabled tracing, and trace-writer failures do not emit a
+record or alter availability. The installed-Snap probe therefore tests the
+private shared-memory confinement
 needed by playback rather than only loader and graphics startup.
 Packaging CI invokes the same gate through
 `snap run iptvnator --embedded-mpv-runtime-probe`. This packaging-only

tools/embedded-mpv/runtime-probe-contract.cjs

@@ -1,4 +1,5 @@
 const RUNTIME_PROBE_CONTRACT = Object.freeze({
+    RUNTIME_PROBE_MAX_BUFFER_BYTES: 16 * 1024 * 1024,
     RUNTIME_PROBE_TIMEOUT_MS: 3000,
 });
 

tools/embedded-mpv/runtime-probe-contract.d.cts

@@ -1,4 +1,5 @@
 declare const RUNTIME_PROBE_CONTRACT: Readonly<{
+    readonly RUNTIME_PROBE_MAX_BUFFER_BYTES: 16777216;
     readonly RUNTIME_PROBE_TIMEOUT_MS: 3000;
 }>;
 

tools/packaging/verify-linux-frame-copy-runtime.mjs

@@ -23,6 +23,7 @@ const {
     resolveLinuxFrameCopyProfile,
 } = require('./linux-frame-copy-profile.cjs');
 const {
+    RUNTIME_PROBE_MAX_BUFFER_BYTES,
     RUNTIME_PROBE_TIMEOUT_MS,
 } = require('../embedded-mpv/runtime-probe-contract.cjs');
 
@@ -71,6 +72,7 @@ function defaultRunCommand(command, args, options = {}) {
         stdio: 'pipe',
         timeout: options.timeout,
         killSignal: options.killSignal,
+        maxBuffer: options.maxBuffer,
         windowsHide: true,
     });
 }
@@ -1611,6 +1613,7 @@ export function verifyExtractedLinuxFrameCopyRuntime({
             encoding: 'utf8',
             env: probeEnvironment,
             killSignal: 'SIGKILL',
+            maxBuffer: RUNTIME_PROBE_MAX_BUFFER_BYTES,
             timeout: RUNTIME_PROBE_TIMEOUT_MS,
             windowsHide: true,
         }

tools/packaging/verify-linux-frame-copy-runtime.test.mjs

@@ -91,7 +91,7 @@ const DEB_SYSTEM_PACKAGE_DEPENDENCIES = [
     'libgbm1',
 ];
 
-test('uses the shared frozen 3000 ms runtime probe timeout contract', async () => {
+test('uses the shared frozen runtime probe resource contract', async () => {
     assert.equal(
         fs.existsSync(runtimeProbeContractUrl),
         true,
@@ -108,10 +108,18 @@ test('uses the shared frozen 3000 ms runtime probe timeout contract', async () =
     );
     assert.equal(Object.isFrozen(runtimeProbeContract), true);
     assert.equal(runtimeProbeContract.RUNTIME_PROBE_TIMEOUT_MS, 3000);
+    assert.equal(
+        runtimeProbeContract.RUNTIME_PROBE_MAX_BUFFER_BYTES,
+        16 * 1024 * 1024
+    );
     assert.match(
         fs.readFileSync(runtimeProbeContractTypesUrl, 'utf8'),
         /readonly RUNTIME_PROBE_TIMEOUT_MS: 3000/
     );
+    assert.match(
+        fs.readFileSync(runtimeProbeContractTypesUrl, 'utf8'),
+        /readonly RUNTIME_PROBE_MAX_BUFFER_BYTES: 16777216/
+    );
 
     const verifierSource = fs.readFileSync(verifierUrl, 'utf8');
     assert.match(
@@ -133,7 +141,7 @@ test('uses the shared frozen 3000 ms runtime probe timeout contract', async () =
     );
     assert.match(
         backendContractsSource,
-        /export const \{ RUNTIME_PROBE_TIMEOUT_MS \} = runtimeProbeContract/
+        /export const \{\s*RUNTIME_PROBE_MAX_BUFFER_BYTES,\s*RUNTIME_PROBE_TIMEOUT_MS,?\s*\}\s*=\s*runtimeProbeContract/
     );
     assert.doesNotMatch(
         backendContractsSource,
@@ -784,6 +792,7 @@ test('validates an x64 system payload and executes one bounded helper probe', ()
             encoding: 'utf8',
             env: { PATH: '/usr/bin' },
             killSignal: 'SIGKILL',
+            maxBuffer: 16 * 1024 * 1024,
             timeout: 3000,
             windowsHide: true,
         });