fix: XSS sanitization, per-request audio files, soundfile-based ASR

- HTML-escape LLM output and user input before rendering in gr.HTML
- Use UUID-based filenames for Q&A audio to prevent concurrent overwrites
- Load audio via soundfile instead of ffmpeg for cross-platform ASR support

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

app.py

@@ -1,4 +1,5 @@
 import os
+import html
 import math
 import struct
 import wave
@@ -907,6 +908,7 @@ with gr.Blocks(css=css_code, title="VoiceBook Gradio Hub") as demo:
             from tts import split_into_chunks as _split, generate_audio_stream as _gen_stream
             import soundfile as sf
             import numpy as np
+            import uuid
 
             chunks = _split(answer_text)
             audio_segments = []
@@ -917,20 +919,22 @@ with gr.Blocks(css=css_code, title="VoiceBook Gradio Hub") as demo:
                     sample_rate = sr
             if audio_segments:
                 full_audio = np.concatenate(audio_segments)
-                answer_audio_path = "sample_sounds/qa_answer.wav"
+                answer_audio_path = f"sample_sounds/qa_answer_{uuid.uuid4().hex[:8]}.wav"
                 sf.write(answer_audio_path, full_audio, sample_rate)
         except Exception:
             # Fall back to no audio if TTS fails
             pass
 
+        safe_answer = html.escape(answer_text)
+        safe_question = html.escape(q_text)
         answer_html = f"""
             <div style="margin-top: 12px; padding: 16px; background: rgba(240,253,244,0.1); border: 1px solid rgba(187,247,208,0.3); border-radius: 14px;">
                 <div style="font-size: 10px; font-weight: 700; text-transform: uppercase; color: #4ade80; margin-bottom: 6px;">Answer in Narrator's Voice</div>
                 <div style="font-family: 'Playfair Display', Georgia, serif; font-style: italic; color: #FAF7F2; font-size: 13px; line-height: 1.6;">
-                    &ldquo;{answer_text}&rdquo;
+                    &ldquo;{safe_answer}&rdquo;
                 </div>
                 <div style="margin-top: 8px; font-size: 10px; color: #94a3b8;">
-                    Q: <em>{q_text}</em>
+                    Q: <em>{safe_question}</em>
                 </div>
             </div>
         """

inference.py

@@ -35,8 +35,16 @@ def transcribe_audio(audio_path: str) -> str:
     """Transcribe an audio file to text using Whisper-small."""
     if not audio_path:
         return ""
+    import soundfile as sf
+    import numpy as np
+
+    audio_data, sample_rate = sf.read(audio_path, dtype="float32")
+    # Convert stereo to mono if needed
+    if len(audio_data.shape) > 1:
+        audio_data = audio_data.mean(axis=1)
+
     pipe = get_asr_pipeline()
-    result = pipe(audio_path, generate_kwargs={"language": "en"})
+    result = pipe({"raw": audio_data, "sampling_rate": sample_rate}, generate_kwargs={"language": "en"})
     return result.get("text", "").strip()