Summary
Huddles still fail on Linux dev builds with NotAllowedError, even though the
getUserMedia/WebKitGTK permission handling shipped in #3607 (which closed
#3495). The permission handler is installed and reachable, but its trusted
dev origin is hardcoded to Vite's default port 1420, while every
just-based entrypoint serves the dev URL on a per-worktree hashed port.
The two never match, so the handler denies the mic request on every
just dev / just desktop-standalone launch.
The production origin (tauri://localhost) is unaffected — only the dev
build path is broken.
Exact error
The request is not allowed by the user agent or the platform in the current
context, possibly because the user denied permission.
No OS permission prompt is shown (correct for Linux — WebKitGTK relies on the
embedding app's permission-request handler). The huddle companion window
opens, the mic getUserMedia rejects with NotAllowedError, and the huddle
tears down (TTS warmup → cancellation reason=shutdown, DeviceSink drops).
Root cause
desktop/src-tauri/src/linux_media.rs trusts the dev origin as a compile-time
constant:
// linux_media.rs:34 (pre-fix)
#[cfg(debug_assertions)]
const DEV_ORIGIN: &str = "http://localhost:1420";
But 1420 is only the default in vite.config.ts
(parseInt(process.env.VITE_PORT || "1420")). The just-based entrypoints
always override it. scripts/instance-env.sh:15 computes a stable per-worktree
port in the range 10000–64999 and exports it:
# scripts/instance-env.sh
BASE_PORT=$(python3 -c "import hashlib,sys; h=int(hashlib.sha256(sys.argv[1].encode()).hexdigest(),16); print(10000 + h % 55000)" "$WORKTREE_ROOT")
export BUZZ_VITE_PORT=$BASE_PORT
export VITE_PORT="$BUZZ_VITE_PORT"
DEV_URL="http://localhost:${BUZZ_VITE_PORT}"
# ...
BUZZ_TAURI_CONFIG="{\"build\":{\"devUrl\":\"${DEV_URL}\",\"beforeDevCommand\":\"exec ./node_modules/.bin/vite --port ${BUZZ_VITE_PORT} --strictPort\"}, ...}"just dev, just desktop-standalone, just staging, and just production
all source ../scripts/instance-env.sh and pass --config "$BUZZ_TAURI_CONFIG",
so the webview loads from http://localhost:<hashed-port> — never 1420.
is_trusted_media_origin() therefore returns false for the actual dev
origin, the handler calls request.deny(), and getUserMedia rejects with
NotAllowedError. The 1420 check is dead in practice because the just tasks
always set VITE_PORT.
Repro
just desktop-standalone (or just dev) on Linux (WebKitGTK).- Start a huddle.
- Mic
getUserMedia rejects with the error above; huddle tears down.
Verified the same pubkey/identity and a working audio input device (mic is fine
in other apps); the failure is purely the origin check.
Suggested fix
Derive the trusted dev origin from the actual dev port instead of hardcoding
1420. In debug builds only, read VITE_PORT (already exported by
instance-env.sh and inherited by the app) and build
http://localhost:<port>, falling back to http://localhost:1420 when the
variable is missing or invalid (a raw pnpm tauri dev without instance-env).
Keep the scheme + host hardcoded to http://localhost (only the port is
env-derived), keep exact-origin / path-prefix matching, keep deny-by-default,
and gate the whole dev path behind #[cfg(debug_assertions)] so packaged
builds remain unchanged.
Environment
Summary
Huddles still fail on Linux dev builds with
NotAllowedError, even though thegetUserMedia/WebKitGTK permission handling shipped in #3607 (which closed#3495). The permission handler is installed and reachable, but its trusted
dev origin is hardcoded to Vite's default port
1420, while everyjust-based entrypoint serves the dev URL on a per-worktree hashed port.
The two never match, so the handler denies the mic request on every
just dev/just desktop-standalonelaunch.The production origin (
tauri://localhost) is unaffected — only the devbuild path is broken.
Exact error
No OS permission prompt is shown (correct for Linux — WebKitGTK relies on the
embedding app's
permission-requesthandler). The huddle companion windowopens, the mic
getUserMediarejects withNotAllowedError, and the huddletears down (TTS warmup →
cancellation reason=shutdown,DeviceSinkdrops).Root cause
desktop/src-tauri/src/linux_media.rstrusts the dev origin as a compile-timeconstant:
But
1420is only the default invite.config.ts(
parseInt(process.env.VITE_PORT || "1420")). The just-based entrypointsalways override it.
scripts/instance-env.sh:15computes a stable per-worktreeport in the range 10000–64999 and exports it:
just dev,just desktop-standalone,just staging, andjust productionall
source ../scripts/instance-env.shand pass--config "$BUZZ_TAURI_CONFIG",so the webview loads from
http://localhost:<hashed-port>— never1420.is_trusted_media_origin()therefore returnsfalsefor the actual devorigin, the handler calls
request.deny(), andgetUserMediarejects withNotAllowedError. The1420check is dead in practice because the just tasksalways set
VITE_PORT.Repro
just desktop-standalone(orjust dev) on Linux (WebKitGTK).getUserMediarejects with the error above; huddle tears down.Verified the same pubkey/identity and a working audio input device (mic is fine
in other apps); the failure is purely the origin check.
Suggested fix
Derive the trusted dev origin from the actual dev port instead of hardcoding
1420. In debug builds only, readVITE_PORT(already exported byinstance-env.shand inherited by the app) and buildhttp://localhost:<port>, falling back tohttp://localhost:1420when thevariable is missing or invalid (a raw
pnpm tauri devwithout instance-env).Keep the scheme + host hardcoded to
http://localhost(only the port isenv-derived), keep exact-origin / path-prefix matching, keep deny-by-default,
and gate the whole dev path behind
#[cfg(debug_assertions)]so packagedbuilds remain unchanged.
Environment
just desktop-standalone