fix(cli): capture writes inline SVG logos whole and parakeet takes long audio

[miguel-heygen]

What

• hyperframes capture writes inline SVGs whole. Before, any inline SVG over 10,000 characters (often a site's logo) landed in assets/svgs cut mid-tag and did not parse, while the full SVG sat in extracted/page.html.
• transcribe -e parakeet no longer fails on long audio with The value of "timeout" is out of range.

Why

• The in-page token extraction returned each inline SVG as svg.outerHTML.slice(0, 10000), and the asset pass wrote that string as it was.
• The parakeet decode timeout was audioSeconds * 2000. For audio whose length is not a whole number of milliseconds that is a fraction (1851.245 s gave 3702490.25), and execFile only takes a whole number.

How

• The extraction keeps the whole outerHTML. The asset pass, the one place that writes assets/svgs, skips an SVG over 2 MB and counts it under a new size-ceiling drop reason (shown in the capture's dropped summary and the --json dropped field) instead of writing part of it.
• The decode timeout is rounded up to whole milliseconds and capped at the largest value Node's timers accept.

Verification

• New tests, all red on main (5 failed):
  • the real extraction script, run in happy-dom on a page with a 100 KB logo SVG: expected 10000 to be 100935;
  • the asset pass writes an over-10 KB logo whole and skips (and counts) a 3 MB SVG instead of cutting it;
  • decodeTimeoutMs for 1851.245125 s and for 10,000,000 s of audio gives a timeout execFileSync accepts.
• A real hyperframes capture --json of a local page whose header holds a 41 KB inline logo, through the built CLI on Linux: on main assets/svgs/logo-*.svg is exactly 10000 bytes and does not parse as XML; with this change it is 50005 bytes and parses.
• packages/cli: the three test files green 3 runs in a row (75 tests), tsc clean, oxlint and oxfmt clean on the changed files.

[terencecho]

Source review at e45921e65f192657074b0414ee6a4e6280ad61f8: no introduced, reachable blocker found in the audited scope.

• packages/cli/src/capture/assetDownloader.ts:346–363 checks the post-namespace UTF-8 bytes, skips oversized SVGs whole, and hashes/writes the same normalized string. The new drop reason flows through the dynamic counters and output paths.
• packages/cli/src/whisper/sherpa.ts:85–87 rounds upward and saturates the timeout without changing worker segmentation, timestamp merging, fallback or cancellation. The actual duration producer is prepared-WAV file size, not an arbitrary numeric input.

Audited: all six changed files, legacy then HEAD where present; capture extraction, normal/partial persistence, drop summaries and disk-driven consumers; transcription duration, worker, fallback, cancellation and cleanup paths. A separate independent adversarial-user pass found no blocker, including interactions within and between the two fixes.

Trusting / limits: source-only review, not whole-repository semantic coverage. No tests, compiler, browser, native tools or CI commands were run; author execution receipts remain unverified. Browser transfer occurs before the SVG writer ceiling, and actual transport/rasterization/native behavior was not exercised. The media-use wrapper's separate preexisting 30-minute timeout is unchanged; this is not an unlimited-duration guarantee for every entry point.

Verdict: APPROVE
Reasoning: Both fixes preserve the inspected producer/consumer contracts, and the source and adversarial audits found no introduced reachable defect.

— tai