2.8 KiB
Bounded native media previews
Structural tests passed; published Windows 0.1.2 still uses the earlier asset protocol. Native playback and other OS checks remain open.
The replacement searchi-media protocol uses random opaque capabilities instead
of returning filesystem paths. The registry retains at most sixteen grants;
older addresses expire as new previews are prepared. At most two requests are
admitted before scheduling work. Audio/video responses use bounded 1-MiB byte
ranges instead of allocating an entire recording. Images retain a 64-MiB input
limit and format-specific pixel ceilings. Ordinary opening/revealing uses the
separate index-validated native opener.
Each grant is bound to an opened file, canonical path, size, timestamp, platform file identity and durable indexed media-change revision. Requests revalidate these properties and reject expired, deleted, replaced or invalidated sources. The frontend accepts only 32 lowercase hexadecimal capability identifiers. Arbitrary paths, remote URLs, query strings and traversal are not preview grants. The generic Tauri asset protocol is disabled in the new configuration. Index-change notifications also advance the preview selection identity, so a same-path image/recording reloads rather than retaining previously decoded media.
This does not hash every recording on every request. A same-size/mtime in-place write may remain undetected until a filesystem hint or byte-verifying rescan advances the indexed revision. Source reads and filesystem/index changes are not one atomic transaction. Do not claim complete byte freshness or native playback compatibility from these structural checks.
Required validation includes capability eviction, missing/unindexed/replaced files, durable same-stat invalidation, byte-range edge cases, large recordings, request admission, MIME behavior, native image/audio/video playback and seeking, and preview reload after index changes. Record executed checks before closing the corresponding roadmap item.
Windows CPU validation: all 45 native tests passed, including nine actual temporary-file/protocol cases covering 8-MiB no-range recordings with 1-MiB responses, full HEAD metadata, seek byte equality, grant eviction, admission, invalid paths, deletion, unindexed files, same-size/time replacement identity, durable same-stat hint invalidation and actual renamed PNG format/MIME. All 59 frontend tests passed, including opaque-token rejection and same-path index-refresh invalidation. Format checking and production frontend build passed. These checks do not prove WebView playback or macOS/Linux protocol behavior. The locked native suite, strict all-target Clippy and Rust formatting checks passed after the final native edits. No model inference or GPU test was needed for these protocol regressions.