fix(preview): stabilize background browser automation

[maria-rcks]

Note

Written by gpt-5.6-sol on behalf of Maria

Background preview webviews now stay inside the compositor viewport while leased, snapshot copy has a 2500ms deadline with replacement recovery outside the debugger semaphore, and broker and overlay budgets reserve response headroom. Recording uses the supported setDisplayMediaRequestHandler and getDisplayMedia path from #8957 with no capturePage warmup, while debugger commands and notifications including screencast-frame acknowledgements drain before guest or window teardown. Verified on Linux x86_64 with 151 desktop, 47 web, and 26 server tests, all four affected typechecks, lint, and git diff --check. The required packaged mac arm64 Electron 43.4.1 and 44.1.0 matrix remains blocked on this host; exact host evidence is Electron 43.4.1 as ELF x86-64 on Linux 6.18.46 x86_64, exiting because libnspr4.so is unavailable, so no mac artifact is attached and maintainer mac validation remains required before merge.

---

Note

High Risk
Touches app quit, window close, update install, CDP lifecycle, and IPC contract changes for snapshots and recording—core desktop preview paths where races or regressions would be user-visible.

Overview
Hardens desktop preview automation around ordered teardown, bounded captures, and sanitized failures so quit, window close, and webview removal do not race in-flight debugger work or leak secrets into logs.

Shutdown and lifecycle now run preparePreviewTeardown / prepareForWindowTeardown before destroying windows or completing app quit; typed teardown errors block quit, reset quitting, and log structured annotations without raw cause payloads. Update install and main-window close follow the same path.

Preview manager gains phased CDP sessions with in-flight command draining, timeouts for snapshot capture and teardown drains, prepareWebviewRemoval, capture-surface recovery events (subscribeCaptureRecoveries), and IPC prepareWebviewRemoval plus preload onCaptureRecovery. Recording switches from getMediaSourceId / capturePage warmup to a single display-media arm per host session (setDisplayMediaRequestHandler), with arm conflicts surfaced as PreviewRecordingArmConflictError.

Automation snapshot over IPC returns a Success / Failure result with filtered native capture messages instead of throwing; the MCP broker subtracts response headroom from the caller timeout when routing to the desktop host.

^{Reviewed by Cursor Bugbot for commit 7a896db. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Stabilize preview background automation with bounded captures and orderly teardown

• Recording now uses getDisplayMedia with an arm-and-claim model instead of getUserMedia with precomputed source dimensions; startRecording returns void and may fail with PreviewRecordingArmConflictError.
• Automation snapshots gain bounded capture/drain timeouts, phase-aware control sessions that reject commands during teardown, and automatic capture-surface recovery on failure.
• Window close, app quit, and update install now wait for prepareForWindowTeardown to drain captures and detach debugger sessions before proceeding; failures block close and log sanitized annotations.
• Renderer keeps retired capture webviews visible during recovery, tracks compositing readiness via data-preview-compositing, and coordinates retirement through new prepareWebviewRemoval and onCaptureRecovery bridge APIs.
• Behavioral Change: automation.snapshot IPC returns a Success/Failure result union instead of rejecting; DesktopPreviewRecordingSource removed; startScreencast returns void; new channels PREVIEW_PREPARE_WEBVIEW_REMOVAL_CHANNEL and PREVIEW_CAPTURE_RECOVERY_CHANNEL added.

^{Macroscope summarized 7a896db.}

[macroscopeapp]

Both findings are the same convention issue at two ends of the same path: raw underlying error text is being promoted from cause into caller-visible message/detail payloads instead of normalized, bounded structural attributes.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two runtime-behavior findings in the changed web UI code, both about readiness/capture paths that only work under conditions the desktop app does not guarantee (background-throttled window; agent-driven automation with no user activation).

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially redesigns preview automation across desktop, renderer, preload, contracts, and server layers, including recording, snapshot recovery, webview replacement, and shutdown behavior. Because existing user paths and IPC contracts change with significant asynchronous lifecycle complexity, human validation is needed.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Three findings, all inline: typed Effect error channels are being erased at Promise/Record boundaries instead of being handled inside Effect with the tagged union. The rest of the service work (new PreviewManager interface members declared inline on the Context.Service, namespace imports, Schema.TaggedErrorClass failures with structural attributes and exported Schema.is predicates) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e0a39f. Configure here.}

[maria-rcks]

Note

Written by gpt-5.6-sol on behalf of Maria

Background preview webviews now stay inside the compositor viewport while leased, snapshot copy has a 2500ms deadline with replacement recovery outside the debugger semaphore, and broker and overlay budgets reserve response headroom. Recording uses the supported setDisplayMediaRequestHandler and getDisplayMedia path from #8957 with no capturePage warmup, while debugger commands and notifications including screencast-frame acknowledgements drain before guest or window teardown. Verified on Linux x86_64 with 151 desktop, 47 web, and 26 server tests, all four affected typechecks, lint, and git diff --check. The required packaged mac arm64 Electron 43.4.1 and 44.1.0 matrix remains blocked on this host; exact host evidence is Electron 43.4.1 as ELF x86-64 on Linux 6.18.46 x86_64, exiting because libnspr4.so is unavailable, so no mac artifact is attached and maintainer mac validation remains required before merge.

---

Note

High Risk
Touches app quit, window close, update install, CDP lifecycle, and IPC contract changes for snapshots and recording—core desktop preview paths where races or regressions would be user-visible.

Overview
Hardens desktop preview automation around ordered teardown, bounded captures, and sanitized failures so quit, window close, and webview removal do not race in-flight debugger work or leak secrets into logs.

Shutdown and lifecycle now run preparePreviewTeardown / prepareForWindowTeardown before destroying windows or completing app quit; typed teardown errors block quit, reset quitting, and log structured annotations without raw cause payloads. Update install and main-window close follow the same path.

Preview manager gains phased CDP sessions with in-flight command draining, timeouts for snapshot capture and teardown drains, prepareWebviewRemoval, capture-surface recovery events (subscribeCaptureRecoveries), and IPC prepareWebviewRemoval plus preload onCaptureRecovery. Recording switches from getMediaSourceId / capturePage warmup to a single display-media arm per host session (setDisplayMediaRequestHandler), with arm conflicts surfaced as PreviewRecordingArmConflictError.

Automation snapshot over IPC returns a Success / Failure result with filtered native capture messages instead of throwing; the MCP broker subtracts response headroom from the caller timeout when routing to the desktop host.

^{Reviewed by Cursor Bugbot for commit 7a896db. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Stabilize preview background automation with bounded captures and orderly teardown

• Recording now uses getDisplayMedia with an arm-and-claim model instead of getUserMedia with precomputed source dimensions; startRecording returns void and may fail with PreviewRecordingArmConflictError.
• Automation snapshots gain bounded capture/drain timeouts, phase-aware control sessions that reject commands during teardown, and automatic capture-surface recovery on failure.
• Window close, app quit, and update install now wait for prepareForWindowTeardown to drain captures and detach debugger sessions before proceeding; failures block close and log sanitized annotations.
• Renderer keeps retired capture webviews visible during recovery, tracks compositing readiness via data-preview-compositing, and coordinates retirement through new prepareWebviewRemoval and onCaptureRecovery bridge APIs.
• Behavioral Change: automation.snapshot IPC returns a Success/Failure result union instead of rejecting; DesktopPreviewRecordingSource removed; startScreencast returns void; new channels PREVIEW_PREPARE_WEBVIEW_REMOVAL_CHANNEL and PREVIEW_CAPTURE_RECOVERY_CHANNEL added.

^{Macroscope summarized 7a896db.}

[macroscopeapp]

Both findings are the same convention issue at two ends of the same path: raw underlying error text is being promoted from cause into caller-visible message/detail payloads instead of normalized, bounded structural attributes.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two runtime-behavior findings in the changed web UI code, both about readiness/capture paths that only work under conditions the desktop app does not guarantee (background-throttled window; agent-driven automation with no user activation).

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially redesigns preview automation across desktop, renderer, preload, contracts, and server layers, including recording, snapshot recovery, webview replacement, and shutdown behavior. Because existing user paths and IPC contracts change with significant asynchronous lifecycle complexity, human validation is needed.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Three findings, all inline: typed Effect error channels are being erased at Promise/Record boundaries instead of being handled inside Effect with the tagged union. The rest of the service work (new PreviewManager interface members declared inline on the Context.Service, namespace imports, Schema.TaggedErrorClass failures with structural attributes and exported Schema.is predicates) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e0a39f. Configure here.}

[maria-rcks]

Note

Written by gpt-5.6-sol on behalf of Maria

Background preview webviews now stay inside the compositor viewport while leased, snapshot copy has a 2500ms deadline with replacement recovery outside the debugger semaphore, and broker and overlay budgets reserve response headroom. Recording uses the supported setDisplayMediaRequestHandler and getDisplayMedia path from #8957 with no capturePage warmup, while debugger commands and notifications including screencast-frame acknowledgements drain before guest or window teardown. Verified on Linux x86_64 with 151 desktop, 47 web, and 26 server tests, all four affected typechecks, lint, and git diff --check. The required packaged mac arm64 Electron 43.4.1 and 44.1.0 matrix remains blocked on this host; exact host evidence is Electron 43.4.1 as ELF x86-64 on Linux 6.18.46 x86_64, exiting because libnspr4.so is unavailable, so no mac artifact is attached and maintainer mac validation remains required before merge.

---

Note

High Risk
Touches app quit, window close, update install, CDP lifecycle, and IPC contract changes for snapshots and recording—core desktop preview paths where races or regressions would be user-visible.

Overview
Hardens desktop preview automation around ordered teardown, bounded captures, and sanitized failures so quit, window close, and webview removal do not race in-flight debugger work or leak secrets into logs.

Shutdown and lifecycle now run preparePreviewTeardown / prepareForWindowTeardown before destroying windows or completing app quit; typed teardown errors block quit, reset quitting, and log structured annotations without raw cause payloads. Update install and main-window close follow the same path.

Preview manager gains phased CDP sessions with in-flight command draining, timeouts for snapshot capture and teardown drains, prepareWebviewRemoval, capture-surface recovery events (subscribeCaptureRecoveries), and IPC prepareWebviewRemoval plus preload onCaptureRecovery. Recording switches from getMediaSourceId / capturePage warmup to a single display-media arm per host session (setDisplayMediaRequestHandler), with arm conflicts surfaced as PreviewRecordingArmConflictError.

Automation snapshot over IPC returns a Success / Failure result with filtered native capture messages instead of throwing; the MCP broker subtracts response headroom from the caller timeout when routing to the desktop host.

^{Reviewed by Cursor Bugbot for commit 7a896db. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Stabilize preview background automation with bounded captures and orderly teardown

• Recording now uses getDisplayMedia with an arm-and-claim model instead of getUserMedia with precomputed source dimensions; startRecording returns void and may fail with PreviewRecordingArmConflictError.
• Automation snapshots gain bounded capture/drain timeouts, phase-aware control sessions that reject commands during teardown, and automatic capture-surface recovery on failure.
• Window close, app quit, and update install now wait for prepareForWindowTeardown to drain captures and detach debugger sessions before proceeding; failures block close and log sanitized annotations.
• Renderer keeps retired capture webviews visible during recovery, tracks compositing readiness via data-preview-compositing, and coordinates retirement through new prepareWebviewRemoval and onCaptureRecovery bridge APIs.
• Behavioral Change: automation.snapshot IPC returns a Success/Failure result union instead of rejecting; DesktopPreviewRecordingSource removed; startScreencast returns void; new channels PREVIEW_PREPARE_WEBVIEW_REMOVAL_CHANNEL and PREVIEW_CAPTURE_RECOVERY_CHANNEL added.

^{Macroscope summarized 7a896db.}

[macroscopeapp]

Both findings are the same convention issue at two ends of the same path: raw underlying error text is being promoted from cause into caller-visible message/detail payloads instead of normalized, bounded structural attributes.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two runtime-behavior findings in the changed web UI code, both about readiness/capture paths that only work under conditions the desktop app does not guarantee (background-throttled window; agent-driven automation with no user activation).

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially redesigns preview automation across desktop, renderer, preload, contracts, and server layers, including recording, snapshot recovery, webview replacement, and shutdown behavior. Because existing user paths and IPC contracts change with significant asynchronous lifecycle complexity, human validation is needed.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Three findings, all inline: typed Effect error channels are being erased at Promise/Record boundaries instead of being handled inside Effect with the tagged union. The rest of the service work (new PreviewManager interface members declared inline on the Context.Service, namespace imports, Schema.TaggedErrorClass failures with structural attributes and exported Schema.is predicates) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e0a39f. Configure here.}

[maria-rcks]

Note

Written by gpt-5.6-sol on behalf of Maria

Background preview webviews now stay inside the compositor viewport while leased, snapshot copy has a 2500ms deadline with replacement recovery outside the debugger semaphore, and broker and overlay budgets reserve response headroom. Recording uses the supported setDisplayMediaRequestHandler and getDisplayMedia path from #8957 with no capturePage warmup, while debugger commands and notifications including screencast-frame acknowledgements drain before guest or window teardown. Verified on Linux x86_64 with 151 desktop, 47 web, and 26 server tests, all four affected typechecks, lint, and git diff --check. The required packaged mac arm64 Electron 43.4.1 and 44.1.0 matrix remains blocked on this host; exact host evidence is Electron 43.4.1 as ELF x86-64 on Linux 6.18.46 x86_64, exiting because libnspr4.so is unavailable, so no mac artifact is attached and maintainer mac validation remains required before merge.

---

Note

High Risk
Touches app quit, window close, update install, CDP lifecycle, and IPC contract changes for snapshots and recording—core desktop preview paths where races or regressions would be user-visible.

Overview
Hardens desktop preview automation around ordered teardown, bounded captures, and sanitized failures so quit, window close, and webview removal do not race in-flight debugger work or leak secrets into logs.

Shutdown and lifecycle now run preparePreviewTeardown / prepareForWindowTeardown before destroying windows or completing app quit; typed teardown errors block quit, reset quitting, and log structured annotations without raw cause payloads. Update install and main-window close follow the same path.

Preview manager gains phased CDP sessions with in-flight command draining, timeouts for snapshot capture and teardown drains, prepareWebviewRemoval, capture-surface recovery events (subscribeCaptureRecoveries), and IPC prepareWebviewRemoval plus preload onCaptureRecovery. Recording switches from getMediaSourceId / capturePage warmup to a single display-media arm per host session (setDisplayMediaRequestHandler), with arm conflicts surfaced as PreviewRecordingArmConflictError.

Automation snapshot over IPC returns a Success / Failure result with filtered native capture messages instead of throwing; the MCP broker subtracts response headroom from the caller timeout when routing to the desktop host.

^{Reviewed by Cursor Bugbot for commit 7a896db. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Stabilize preview background automation with bounded captures and orderly teardown

• Recording now uses getDisplayMedia with an arm-and-claim model instead of getUserMedia with precomputed source dimensions; startRecording returns void and may fail with PreviewRecordingArmConflictError.
• Automation snapshots gain bounded capture/drain timeouts, phase-aware control sessions that reject commands during teardown, and automatic capture-surface recovery on failure.
• Window close, app quit, and update install now wait for prepareForWindowTeardown to drain captures and detach debugger sessions before proceeding; failures block close and log sanitized annotations.
• Renderer keeps retired capture webviews visible during recovery, tracks compositing readiness via data-preview-compositing, and coordinates retirement through new prepareWebviewRemoval and onCaptureRecovery bridge APIs.
• Behavioral Change: automation.snapshot IPC returns a Success/Failure result union instead of rejecting; DesktopPreviewRecordingSource removed; startScreencast returns void; new channels PREVIEW_PREPARE_WEBVIEW_REMOVAL_CHANNEL and PREVIEW_CAPTURE_RECOVERY_CHANNEL added.

^{Macroscope summarized 7a896db.}

[macroscopeapp]

Both findings are the same convention issue at two ends of the same path: raw underlying error text is being promoted from cause into caller-visible message/detail payloads instead of normalized, bounded structural attributes.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two runtime-behavior findings in the changed web UI code, both about readiness/capture paths that only work under conditions the desktop app does not guarantee (background-throttled window; agent-driven automation with no user activation).

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially redesigns preview automation across desktop, renderer, preload, contracts, and server layers, including recording, snapshot recovery, webview replacement, and shutdown behavior. Because existing user paths and IPC contracts change with significant asynchronous lifecycle complexity, human validation is needed.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Three findings, all inline: typed Effect error channels are being erased at Promise/Record boundaries instead of being handled inside Effect with the tagged union. The rest of the service work (new PreviewManager interface members declared inline on the Context.Service, namespace imports, Schema.TaggedErrorClass failures with structural attributes and exported Schema.is predicates) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e0a39f. Configure here.}

[maria-rcks]

Note

Written by gpt-5.6-sol on behalf of Maria

Background preview webviews now stay inside the compositor viewport while leased, snapshot copy has a 2500ms deadline with replacement recovery outside the debugger semaphore, and broker and overlay budgets reserve response headroom. Recording uses the supported setDisplayMediaRequestHandler and getDisplayMedia path from #8957 with no capturePage warmup, while debugger commands and notifications including screencast-frame acknowledgements drain before guest or window teardown. Verified on Linux x86_64 with 151 desktop, 47 web, and 26 server tests, all four affected typechecks, lint, and git diff --check. The required packaged mac arm64 Electron 43.4.1 and 44.1.0 matrix remains blocked on this host; exact host evidence is Electron 43.4.1 as ELF x86-64 on Linux 6.18.46 x86_64, exiting because libnspr4.so is unavailable, so no mac artifact is attached and maintainer mac validation remains required before merge.

---

Note

High Risk
Touches app quit, window close, update install, CDP lifecycle, and IPC contract changes for snapshots and recording—core desktop preview paths where races or regressions would be user-visible.

Overview
Hardens desktop preview automation around ordered teardown, bounded captures, and sanitized failures so quit, window close, and webview removal do not race in-flight debugger work or leak secrets into logs.

Shutdown and lifecycle now run preparePreviewTeardown / prepareForWindowTeardown before destroying windows or completing app quit; typed teardown errors block quit, reset quitting, and log structured annotations without raw cause payloads. Update install and main-window close follow the same path.

Preview manager gains phased CDP sessions with in-flight command draining, timeouts for snapshot capture and teardown drains, prepareWebviewRemoval, capture-surface recovery events (subscribeCaptureRecoveries), and IPC prepareWebviewRemoval plus preload onCaptureRecovery. Recording switches from getMediaSourceId / capturePage warmup to a single display-media arm per host session (setDisplayMediaRequestHandler), with arm conflicts surfaced as PreviewRecordingArmConflictError.

Automation snapshot over IPC returns a Success / Failure result with filtered native capture messages instead of throwing; the MCP broker subtracts response headroom from the caller timeout when routing to the desktop host.

^{Reviewed by Cursor Bugbot for commit 7a896db. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Stabilize preview background automation with bounded captures and orderly teardown

• Recording now uses getDisplayMedia with an arm-and-claim model instead of getUserMedia with precomputed source dimensions; startRecording returns void and may fail with PreviewRecordingArmConflictError.
• Automation snapshots gain bounded capture/drain timeouts, phase-aware control sessions that reject commands during teardown, and automatic capture-surface recovery on failure.
• Window close, app quit, and update install now wait for prepareForWindowTeardown to drain captures and detach debugger sessions before proceeding; failures block close and log sanitized annotations.
• Renderer keeps retired capture webviews visible during recovery, tracks compositing readiness via data-preview-compositing, and coordinates retirement through new prepareWebviewRemoval and onCaptureRecovery bridge APIs.
• Behavioral Change: automation.snapshot IPC returns a Success/Failure result union instead of rejecting; DesktopPreviewRecordingSource removed; startScreencast returns void; new channels PREVIEW_PREPARE_WEBVIEW_REMOVAL_CHANNEL and PREVIEW_CAPTURE_RECOVERY_CHANNEL added.

^{Macroscope summarized 7a896db.}

[macroscopeapp]

Both findings are the same convention issue at two ends of the same path: raw underlying error text is being promoted from cause into caller-visible message/detail payloads instead of normalized, bounded structural attributes.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two runtime-behavior findings in the changed web UI code, both about readiness/capture paths that only work under conditions the desktop app does not guarantee (background-throttled window; agent-driven automation with no user activation).

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially redesigns preview automation across desktop, renderer, preload, contracts, and server layers, including recording, snapshot recovery, webview replacement, and shutdown behavior. Because existing user paths and IPC contracts change with significant asynchronous lifecycle complexity, human validation is needed.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Three findings, all inline: typed Effect error channels are being erased at Promise/Record boundaries instead of being handled inside Effect with the tagged union. The rest of the service work (new PreviewManager interface members declared inline on the Context.Service, namespace imports, Schema.TaggedErrorClass failures with structural attributes and exported Schema.is predicates) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e0a39f. Configure here.}

[maria-rcks]

Note

Written by gpt-5.6-sol on behalf of Maria

Background preview webviews now stay inside the compositor viewport while leased, snapshot copy has a 2500ms deadline with replacement recovery outside the debugger semaphore, and broker and overlay budgets reserve response headroom. Recording uses the supported setDisplayMediaRequestHandler and getDisplayMedia path from #8957 with no capturePage warmup, while debugger commands and notifications including screencast-frame acknowledgements drain before guest or window teardown. Verified on Linux x86_64 with 151 desktop, 47 web, and 26 server tests, all four affected typechecks, lint, and git diff --check. The required packaged mac arm64 Electron 43.4.1 and 44.1.0 matrix remains blocked on this host; exact host evidence is Electron 43.4.1 as ELF x86-64 on Linux 6.18.46 x86_64, exiting because libnspr4.so is unavailable, so no mac artifact is attached and maintainer mac validation remains required before merge.

---

Note

High Risk
Touches app quit, window close, update install, CDP lifecycle, and IPC contract changes for snapshots and recording—core desktop preview paths where races or regressions would be user-visible.

Overview
Hardens desktop preview automation around ordered teardown, bounded captures, and sanitized failures so quit, window close, and webview removal do not race in-flight debugger work or leak secrets into logs.

Shutdown and lifecycle now run preparePreviewTeardown / prepareForWindowTeardown before destroying windows or completing app quit; typed teardown errors block quit, reset quitting, and log structured annotations without raw cause payloads. Update install and main-window close follow the same path.

Preview manager gains phased CDP sessions with in-flight command draining, timeouts for snapshot capture and teardown drains, prepareWebviewRemoval, capture-surface recovery events (subscribeCaptureRecoveries), and IPC prepareWebviewRemoval plus preload onCaptureRecovery. Recording switches from getMediaSourceId / capturePage warmup to a single display-media arm per host session (setDisplayMediaRequestHandler), with arm conflicts surfaced as PreviewRecordingArmConflictError.

Automation snapshot over IPC returns a Success / Failure result with filtered native capture messages instead of throwing; the MCP broker subtracts response headroom from the caller timeout when routing to the desktop host.

^{Reviewed by Cursor Bugbot for commit 7a896db. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Stabilize preview background automation with bounded captures and orderly teardown

• Recording now uses getDisplayMedia with an arm-and-claim model instead of getUserMedia with precomputed source dimensions; startRecording returns void and may fail with PreviewRecordingArmConflictError.
• Automation snapshots gain bounded capture/drain timeouts, phase-aware control sessions that reject commands during teardown, and automatic capture-surface recovery on failure.
• Window close, app quit, and update install now wait for prepareForWindowTeardown to drain captures and detach debugger sessions before proceeding; failures block close and log sanitized annotations.
• Renderer keeps retired capture webviews visible during recovery, tracks compositing readiness via data-preview-compositing, and coordinates retirement through new prepareWebviewRemoval and onCaptureRecovery bridge APIs.
• Behavioral Change: automation.snapshot IPC returns a Success/Failure result union instead of rejecting; DesktopPreviewRecordingSource removed; startScreencast returns void; new channels PREVIEW_PREPARE_WEBVIEW_REMOVAL_CHANNEL and PREVIEW_CAPTURE_RECOVERY_CHANNEL added.

^{Macroscope summarized 7a896db.}

[macroscopeapp]

Both findings are the same convention issue at two ends of the same path: raw underlying error text is being promoted from cause into caller-visible message/detail payloads instead of normalized, bounded structural attributes.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two runtime-behavior findings in the changed web UI code, both about readiness/capture paths that only work under conditions the desktop app does not guarantee (background-throttled window; agent-driven automation with no user activation).

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially redesigns preview automation across desktop, renderer, preload, contracts, and server layers, including recording, snapshot recovery, webview replacement, and shutdown behavior. Because existing user paths and IPC contracts change with significant asynchronous lifecycle complexity, human validation is needed.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Three findings, all inline: typed Effect error channels are being erased at Promise/Record boundaries instead of being handled inside Effect with the tagged union. The rest of the service work (new PreviewManager interface members declared inline on the Context.Service, namespace imports, Schema.TaggedErrorClass failures with structural attributes and exported Schema.is predicates) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e0a39f. Configure here.}

[maria-rcks]

Note

Written by gpt-5.6-sol on behalf of Maria

Background preview webviews now stay inside the compositor viewport while leased, snapshot copy has a 2500ms deadline with replacement recovery outside the debugger semaphore, and broker and overlay budgets reserve response headroom. Recording uses the supported setDisplayMediaRequestHandler and getDisplayMedia path from #8957 with no capturePage warmup, while debugger commands and notifications including screencast-frame acknowledgements drain before guest or window teardown. Verified on Linux x86_64 with 151 desktop, 47 web, and 26 server tests, all four affected typechecks, lint, and git diff --check. The required packaged mac arm64 Electron 43.4.1 and 44.1.0 matrix remains blocked on this host; exact host evidence is Electron 43.4.1 as ELF x86-64 on Linux 6.18.46 x86_64, exiting because libnspr4.so is unavailable, so no mac artifact is attached and maintainer mac validation remains required before merge.

---

Note

High Risk
Touches app quit, window close, update install, CDP lifecycle, and IPC contract changes for snapshots and recording—core desktop preview paths where races or regressions would be user-visible.

Overview
Hardens desktop preview automation around ordered teardown, bounded captures, and sanitized failures so quit, window close, and webview removal do not race in-flight debugger work or leak secrets into logs.

Shutdown and lifecycle now run preparePreviewTeardown / prepareForWindowTeardown before destroying windows or completing app quit; typed teardown errors block quit, reset quitting, and log structured annotations without raw cause payloads. Update install and main-window close follow the same path.

Preview manager gains phased CDP sessions with in-flight command draining, timeouts for snapshot capture and teardown drains, prepareWebviewRemoval, capture-surface recovery events (subscribeCaptureRecoveries), and IPC prepareWebviewRemoval plus preload onCaptureRecovery. Recording switches from getMediaSourceId / capturePage warmup to a single display-media arm per host session (setDisplayMediaRequestHandler), with arm conflicts surfaced as PreviewRecordingArmConflictError.

Automation snapshot over IPC returns a Success / Failure result with filtered native capture messages instead of throwing; the MCP broker subtracts response headroom from the caller timeout when routing to the desktop host.

^{Reviewed by Cursor Bugbot for commit 7a896db. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Stabilize preview background automation with bounded captures and orderly teardown

• Recording now uses getDisplayMedia with an arm-and-claim model instead of getUserMedia with precomputed source dimensions; startRecording returns void and may fail with PreviewRecordingArmConflictError.
• Automation snapshots gain bounded capture/drain timeouts, phase-aware control sessions that reject commands during teardown, and automatic capture-surface recovery on failure.
• Window close, app quit, and update install now wait for prepareForWindowTeardown to drain captures and detach debugger sessions before proceeding; failures block close and log sanitized annotations.
• Renderer keeps retired capture webviews visible during recovery, tracks compositing readiness via data-preview-compositing, and coordinates retirement through new prepareWebviewRemoval and onCaptureRecovery bridge APIs.
• Behavioral Change: automation.snapshot IPC returns a Success/Failure result union instead of rejecting; DesktopPreviewRecordingSource removed; startScreencast returns void; new channels PREVIEW_PREPARE_WEBVIEW_REMOVAL_CHANNEL and PREVIEW_CAPTURE_RECOVERY_CHANNEL added.

^{Macroscope summarized 7a896db.}

[macroscopeapp]

Both findings are the same convention issue at two ends of the same path: raw underlying error text is being promoted from cause into caller-visible message/detail payloads instead of normalized, bounded structural attributes.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two runtime-behavior findings in the changed web UI code, both about readiness/capture paths that only work under conditions the desktop app does not guarantee (background-throttled window; agent-driven automation with no user activation).

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially redesigns preview automation across desktop, renderer, preload, contracts, and server layers, including recording, snapshot recovery, webview replacement, and shutdown behavior. Because existing user paths and IPC contracts change with significant asynchronous lifecycle complexity, human validation is needed.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Three findings, all inline: typed Effect error channels are being erased at Promise/Record boundaries instead of being handled inside Effect with the tagged union. The rest of the service work (new PreviewManager interface members declared inline on the Context.Service, namespace imports, Schema.TaggedErrorClass failures with structural attributes and exported Schema.is predicates) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e0a39f. Configure here.}

[maria-rcks]

Note

Written by gpt-5.6-sol on behalf of Maria

Background preview webviews now stay inside the compositor viewport while leased, snapshot copy has a 2500ms deadline with replacement recovery outside the debugger semaphore, and broker and overlay budgets reserve response headroom. Recording uses the supported setDisplayMediaRequestHandler and getDisplayMedia path from #8957 with no capturePage warmup, while debugger commands and notifications including screencast-frame acknowledgements drain before guest or window teardown. Verified on Linux x86_64 with 151 desktop, 47 web, and 26 server tests, all four affected typechecks, lint, and git diff --check. The required packaged mac arm64 Electron 43.4.1 and 44.1.0 matrix remains blocked on this host; exact host evidence is Electron 43.4.1 as ELF x86-64 on Linux 6.18.46 x86_64, exiting because libnspr4.so is unavailable, so no mac artifact is attached and maintainer mac validation remains required before merge.

---

Note

High Risk
Touches app quit, window close, update install, CDP lifecycle, and IPC contract changes for snapshots and recording—core desktop preview paths where races or regressions would be user-visible.

Overview
Hardens desktop preview automation around ordered teardown, bounded captures, and sanitized failures so quit, window close, and webview removal do not race in-flight debugger work or leak secrets into logs.

Shutdown and lifecycle now run preparePreviewTeardown / prepareForWindowTeardown before destroying windows or completing app quit; typed teardown errors block quit, reset quitting, and log structured annotations without raw cause payloads. Update install and main-window close follow the same path.

Preview manager gains phased CDP sessions with in-flight command draining, timeouts for snapshot capture and teardown drains, prepareWebviewRemoval, capture-surface recovery events (subscribeCaptureRecoveries), and IPC prepareWebviewRemoval plus preload onCaptureRecovery. Recording switches from getMediaSourceId / capturePage warmup to a single display-media arm per host session (setDisplayMediaRequestHandler), with arm conflicts surfaced as PreviewRecordingArmConflictError.

Automation snapshot over IPC returns a Success / Failure result with filtered native capture messages instead of throwing; the MCP broker subtracts response headroom from the caller timeout when routing to the desktop host.

^{Reviewed by Cursor Bugbot for commit 7a896db. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Stabilize preview background automation with bounded captures and orderly teardown

• Recording now uses getDisplayMedia with an arm-and-claim model instead of getUserMedia with precomputed source dimensions; startRecording returns void and may fail with PreviewRecordingArmConflictError.
• Automation snapshots gain bounded capture/drain timeouts, phase-aware control sessions that reject commands during teardown, and automatic capture-surface recovery on failure.
• Window close, app quit, and update install now wait for prepareForWindowTeardown to drain captures and detach debugger sessions before proceeding; failures block close and log sanitized annotations.
• Renderer keeps retired capture webviews visible during recovery, tracks compositing readiness via data-preview-compositing, and coordinates retirement through new prepareWebviewRemoval and onCaptureRecovery bridge APIs.
• Behavioral Change: automation.snapshot IPC returns a Success/Failure result union instead of rejecting; DesktopPreviewRecordingSource removed; startScreencast returns void; new channels PREVIEW_PREPARE_WEBVIEW_REMOVAL_CHANNEL and PREVIEW_CAPTURE_RECOVERY_CHANNEL added.

^{Macroscope summarized 7a896db.}

[macroscopeapp]

Both findings are the same convention issue at two ends of the same path: raw underlying error text is being promoted from cause into caller-visible message/detail payloads instead of normalized, bounded structural attributes.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two runtime-behavior findings in the changed web UI code, both about readiness/capture paths that only work under conditions the desktop app does not guarantee (background-throttled window; agent-driven automation with no user activation).

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR substantially redesigns preview automation across desktop, renderer, preload, contracts, and server layers, including recording, snapshot recovery, webview replacement, and shutdown behavior. Because existing user paths and IPC contracts change with significant asynchronous lifecycle complexity, human validation is needed.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Three findings, all inline: typed Effect error channels are being erased at Promise/Record boundaries instead of being handled inside Effect with the tagged union. The rest of the service work (new PreviewManager interface members declared inline on the Context.Service, namespace imports, Schema.TaggedErrorClass failures with structural attributes and exported Schema.is predicates) follows the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6e0a39f. Configure here.}