45 lines
2.8 KiB
Markdown
45 lines
2.8 KiB
Markdown
|
# Bounded native media previews
|
||
|
|
|
||
|
|
Structural tests passed; published Windows 0.1.2 still uses the
|
||
|
|
earlier asset protocol. Native playback and other OS checks remain open.
|
||
|
|
|
||
|
|
The replacement `searchi-media` protocol uses random opaque capabilities instead
|
||
|
|
of returning filesystem paths. The registry retains at most sixteen grants;
|
||
|
|
older addresses expire as new previews are prepared. At most two requests are
|
||
|
|
admitted before scheduling work. Audio/video responses use bounded 1-MiB byte
|
||
|
|
ranges instead of allocating an entire recording. Images retain a 64-MiB input
|
||
|
|
limit and format-specific pixel ceilings. Ordinary opening/revealing uses the
|
||
|
|
separate index-validated native opener.
|
||
|
|
|
||
|
|
Each grant is bound to an opened file, canonical path, size, timestamp, platform
|
||
|
|
file identity and durable indexed media-change revision. Requests revalidate
|
||
|
|
these properties and reject expired, deleted, replaced or invalidated sources.
|
||
|
|
The frontend accepts only 32 lowercase hexadecimal capability identifiers.
|
||
|
|
Arbitrary paths, remote URLs, query strings and traversal are not preview grants.
|
||
|
|
The generic Tauri asset protocol is disabled in the new configuration.
|
||
|
|
Index-change notifications also advance the preview selection identity, so a
|
||
|
|
same-path image/recording reloads rather than retaining previously decoded media.
|
||
|
|
|
||
|
|
This does not hash every recording on every request. A same-size/mtime in-place
|
||
|
|
write may remain undetected until a filesystem hint or byte-verifying rescan
|
||
|
|
advances the indexed revision. Source reads and filesystem/index changes are
|
||
|
|
not one atomic transaction. Do not claim complete byte freshness or native
|
||
|
|
playback compatibility from these structural checks.
|
||
|
|
|
||
|
|
Required validation includes capability eviction, missing/unindexed/replaced
|
||
|
|
files, durable same-stat invalidation, byte-range edge cases, large recordings,
|
||
|
|
request admission, MIME behavior, native image/audio/video playback and seeking,
|
||
|
|
and preview reload after index changes. Record executed checks before closing
|
||
|
|
the corresponding roadmap item.
|
||
|
|
|
||
|
|
Windows CPU validation: all 45 native tests passed, including nine actual
|
||
|
|
temporary-file/protocol cases covering 8-MiB no-range recordings with 1-MiB
|
||
|
|
responses, full HEAD metadata, seek byte equality, grant eviction, admission,
|
||
|
|
invalid paths, deletion, unindexed files, same-size/time replacement identity,
|
||
|
|
durable same-stat hint invalidation and actual renamed PNG format/MIME.
|
||
|
|
All 59 frontend tests passed, including opaque-token rejection and same-path
|
||
|
|
index-refresh invalidation. Format checking and production frontend build passed.
|
||
|
|
These checks do not prove WebView playback or macOS/Linux protocol behavior.
|
||
|
|
The locked native suite, strict all-target Clippy and Rust formatting checks
|
||
|
|
passed after the final native edits. No model inference or GPU test was needed
|
||
|
|
for these protocol regressions.
|