fix: harden desktop recording and rendering for v0.6 by richiemcilroy · Pull Request #2172 · CapSoftware/Cap

richiemcilroy · 2026-08-30T12:31:37Z

Recording failures must preserve local media and requested tracks, and Stop, Quit, editor close and upload completion must not report success before their work is settled. This PR hardens those boundaries for v0.6 while retaining the existing capture engine, codecs and media layout. Ambiguous upload completion keeps the local recording and retry information; confirmed track failures keep the media and show an error instead of opening an incomplete recording.

GPUI and Tauri now share persisted device preferences and feed reconfiguration rules. Preferred formats remain distinct from negotiated formats, stale readiness results are rejected, and device changes are blocked while recording owns the inputs. Camera preview restoration, camera-only preview, window/area placement, microphone warnings and meters, zoom creation, Scene hover, and record-new-clip navigation are corrected. The main recorder, onboarding, settings menus, labels, tooltips, pause/resume feedback and teleprompter follow the existing Tauri behavior. Temporary camera sizes update the preview mask without changing saved sizes or recording geometry. Area selection gains drag guidance and snapping; macOS retains a capture-excluded passive area outline while recording. Windows/Linux keep their existing close-before-capture behavior until a passive overlay is qualified. GPUI automation compatibility now explicitly reports that shared rules can be saved but are not executed by the experimental app.

Startup recovers malformed camera preferences at the camera field, retaining microphone, target, mode and device settings. Tauri hydration replaces camera enum variants instead of merging them. Editor titles support text selection without moving the window, repaint while typing, and save on close and Quit. Failed saves retain the draft and keep the editor open; Tauri waits for editor title-save acknowledgements before admitting Quit. Windows deletion accepts canonical extended-length paths while retaining traversal, symlink-escape and recordings-root protection.

Both editors now offer optional text backgrounds. They default to absent for existing projects, persist with the text layer, and share preview/export rendering. Backdrops cover wrapped and multiline text, follow opacity and animation, preserve segment order, and draw only within their own bounds. The GPUI export page retains Windows caption controls above progress and file-selection overlays. The timeline minimap supports panning, click-to-center and edge resizing with release, Escape and focus-loss cleanup. Minimap presses are captured before timeline seeking, and window drag listeners are installed before the press so fast gestures cannot outrun the next redraw. Editor buttons gain hover feedback, source/chevron icons specify theme colors, and compact device-row spacing follows Tauri. GPUI applies the saved countdown before constructing a recording actor and permits cancellation during the countdown.

GPUI copies exported files and screenshot images through native clipboard formats on macOS, Windows, X11 and Wayland. Failed clipboard copies retain the completed export and offer Retry Copy without encoding again. Screenshot copying uses the rendered image bytes directly; copy failures are surfaced without opening modal dialogs inside a GPUI update. Wayland transfers use nonblocking pipes, and X11 retains valid empty-text clipboard support. SVG cursor textures now use filtered, premultiplied-alpha mip levels so thin details survive minification; recorded PNG cursors and cursor hotspots are unchanged. Native cross-platform paste and the reported Windows cursor appearance still need verification.

macOS uses the correct native panel class at construction and releases accessibility/glass ownership during teardown. Main windows stay within usable screen bounds; mixed-DPI hit testing preserves recording-control input. GPUI Dock hides are delayed after a show, matching Tao's workaround, and Tauri retires its Dock presence only after admitting the handoff. Dock reopen uses bounded authenticated IPC and falls back to the main recorder when an editor is gone. Quit waits for recording, export cancellation and Wayland window-restoration acknowledgements; uncertainty, failure or timeout leaves the app open. Windows uses an opaque rectangular client surface inside its native frame, avoiding a second rounded client edge.

Release packaging adds independent DMG notarization/stapling/Gatekeeper gates and signs all five Windows executables before rebundling the NSIS installer. The extracted final installer must contain the exact signed payload hashes and valid signatures. Both SignPath actions are pinned to a commit. These are package-integrity gates, not a guarantee that antivirus reputation services will immediately trust a new binary. GPUI dependency patches retain LF line endings on Windows checkouts, with an isolated real-checkout regression before compilation. macOS retries packaging at most twice only for recognized secure-timestamp signing failures; the first build, credentials, timestamp requirement, notarization and final verification remain unchanged. Historical nightly promotion retains its original command when the new wrapper is absent.

Release HOLD at b02cf38a813223ff9a150c837d035989cd3007ad. Public release remains disabled. The comparison baseline is official cap-v0.5.9 (c6b83804d2e9fa8757b75268e573b8ff113141bb); compilation and review do not establish the complete native acceptance matrix.

Validation:

This build-only repair passes 15 Node regression tests locally and in the actual Windows, macOS and Linux CI preparation steps, plus scoped Biome checks and release-workflow validation. The Windows checkout test fails without the LF attribute and passes with it. All three patches still reproduce the previously compiled GPUI source tree. No Rust source changed or local application was launched. CI workflow lint reports only the same three legacy action-version warnings present at the parent commit.
The preceding application-source batch passed the macOS-hosted GPUI check, shared-renderer check, formatting, 820 GPUI tests and 13 cursor tests. The full GPUI test run preceded the final two screenshot error-dialog dispatch corrections; a fresh GPUI check includes those corrections. Canonical dependency patches reproduce the exact compiled GPUI source tree. Windows/Linux compilation and native clipboard paste remain separate checks.
Earlier unchanged checks passed 43 focused frontend tests, 11 shared text-rendering tests, the GPU text-background readback test, text-background serde compatibility and 9 Tauri title/deletion tests, plus desktop TypeScript checking. Generated TypeScript bindings come from the Rust exporter. These historical results are not a new native acceptance run.
Earlier isolated macOS checks confirm six consecutive minimap pan/edge-resize/track-click gestures, ordinary ruler scrubbing, responsive title editing/save and clean Quit. The minimap gestures produce no preview-frame decode requests. Multiline text backgrounds were visually checked in the native editor and export preview on unchanged renderer sources; no file export is claimed for that preview. The referenced successful previews closed normally and verified the synthetic media and original app/store were unchanged. Private synthetic fixtures do not qualify signed packages or live camera/microphone behavior. Unchanged popup/list/onboarding checks remain historical evidence only.
The previous production candidate failed at Windows GPUI patch parsing and Intel macOS secure-timestamp signing; its Linux and Apple Silicon jobs passed. The fresh production candidate was dispatched at b02cf38a813223ff9a150c837d035989cd3007ad and remains unpublished; build success is still pending. Fresh Greptile review completed at this head with 5/5, 276 files reviewed, no new comments and no unresolved review threads. Neither build success nor review clears the native release gates. The separate contributor-trust check requires maintainer review.
The recording/sync workflow previously passed on macOS, Windows and Linux at 6560beb6a; recording-library tests run serially after a parallel native queue-recovery timeout. No production deadline or assertion was relaxed. This head needs its own CI result.
A hosted muxer fault diagnostic reproduced the former defect at 290dafcbee: Stop returned success for 244 submitted frames while only 180 decoded. The terminal-error and capture-acknowledgement contract passes focused tests; the same native diagnostic remains required on this head.

Remaining release gates:

Reproduce the separately reported Windows dotted recording-edge line, comparing raw capture, editor preview and exported MP4. Its cause is unproven; this batch does not claim to fix it.
Reproduce the Windows border-only window with the affected build, GPU and logs. The screenshot alone does not identify an orphan recording overlay, and the frame-style correction is not claimed to fix that separate report.
Qualify current signed packages across GPUI/Tauri, Studio/Instant, camera/microphone combinations and display/window/area capture. Check repeated start/stop, pause, editor opening, playback, editing, import/export, recovery and 0.5.9 performance parity. CLI and Wayland limitations remain explicit.
Verify live camera resizing, parked-camera dragging, overlay meters and capture-excluded area bounds. Windows/Linux passive outlines and GPUI automation execution remain unavailable.
Verify installed macOS Delete → Dock reopen, duplicate-icon transitions, fullscreen handoffs and repeated switching. The inherited detached export-preview decoder settlement boundary before deletion remains unresolved; editor cleanup alone does not prove those readers have stopped.
Rerun muxer fault injection, process settlement and retained-media checks on this head, alongside a successful control recording. Verify authenticated Instant upload retry/completion and independent remote playback against isolated matching services.

Earlier native Linux recording/edit/export results apply only to their recorded packages and device configurations. Temporary Windows/Linux compute is stopped with evidence disks retained; final resource cleanup remains required. Recording research and scenario contract.

Greptile Summary

This PR hardens desktop recording settlement, device handling, editor persistence, rendering, clipboard integration, and release-package verification.

Preserves local media and retry state when recording or upload completion is uncertain.
Aligns GPUI and Tauri device preferences, shutdown behavior, editor title persistence, and rendering features.
Adds native clipboard support and strengthens macOS and Windows release-package integrity checks.

Confidence Score: 5/5

The PR appears safe to merge from the eligible follow-up findings reviewed here.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/recording/src/output_pipeline/core.rs	Strengthens recording pipeline completion and terminal-error settlement without an eligible follow-up defect identified.
apps/desktop/src-tauri/src/exit_shutdown.rs	Coordinates recording, export, editor-save, and window-restoration acknowledgements before exit.
apps/desktop/src/routes/editor/recording-title-save.ts	Adds serialized title-save flushing so close and Quit wait for the current draft.
apps/desktop-gpui/src/recording.rs	Hardens GPUI recording ownership, countdown cancellation, and completion behavior.
crates/rendering/src/layers/text.rs	Adds shared text-background rendering behavior for editor previews and exports.
scripts/windows-release-signing.ps1	Stages, restores, and verifies signed Windows payloads against installer contents.
scripts/build-macos-packages.mjs	Adds bounded retries for recognized transient macOS timestamp-signing failures.
.github/workflows/desktop-release.yml	Adds independent notarization, signing, payload-integrity, and retained-package validation gates.

_{Reviews (34): Last reviewed commit: "fix: retry transient macOS package times..." | Re-trigger Greptile}

superagent-security · 2026-08-30T12:35:49Z

Manage your Superagent protection

Superagent has paused scans for this repository because this unlinked GitHub App installation has used all three included PR scans.

You have 0 of 3 included PR scans remaining.

Create a free account to continue protection, manage scan settings, review security history, and control which repositories are protected.

richiemcilroy · 2026-08-30T12:35:55Z

@greptileai please review the PR

richiemcilroy · 2026-08-30T15:10:35Z