chore(deps): bump actions/setup-node from 6.3.0 to 7.0.0

.github/workflows/release.yml

@@ -76,7 +76,7 @@ jobs:
             zstd
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/*
           cache: npm

.github/workflows/tests.yml

@@ -59,7 +59,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/*
           cache: npm
@@ -82,6 +82,47 @@ jobs:
         working-directory: packages/server
         run: npx vitest run
 
+  # ──────────────────────────────────────────────────────────────────
+  # Worker: ffmpeg segment pipeline. Proves the clip-compile contract —
+  # every capture unit (JPEG still, VP8 webm clip, H.264 mp4 clip, any
+  # resolution) normalizes to exactly one second of 30fps video with
+  # pinned parameters, and the segments stream-copy concatenate into a
+  # decodable MP4. Runs real ffmpeg on synthetic inputs; no DB/R2.
+  # ──────────────────────────────────────────────────────────────────
+  worker:
+    name: Worker tests
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install ffmpeg
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ffmpeg
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: lts/*
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build shared package
+        run: npm run build -w packages/shared
+
+      - name: Type-check worker
+        working-directory: packages/worker
+        run: npx tsc --noEmit
+
+      - name: Vitest (segment pipeline)
+        run: npm test -w packages/worker
+
+      # Shared package: pure units — cut math, clock-offset estimation.
+      - name: Vitest (shared)
+        run: npm test -w packages/shared
+
   # ──────────────────────────────────────────────────────────────────
   # Desktop client: Rust unit + serde compat tests.
   # The 4-way matrix (legacy/new struct × legacy/new JSON) here is the
@@ -111,6 +152,25 @@ jobs:
             libgstreamer-plugins-base1.0-dev \
             libgbm-dev
 
+      # RUNTIME GStreamer plugins, not just the dev headers above. The Linux
+      # clip encoder builds `appsrc ! videoconvert ! x264enc ! h264parse !
+      # mp4mux ! filesink`, and those elements live in four different packages:
+      # videoconvert in -base, mp4mux in -good, h264parse in -bad, x264enc in
+      # -ugly. Without them ClipRecorder::new fails with "no H.264 encoder
+      # element available" and every clip test that touches a real encoder dies
+      # — which is exactly how this job has been failing.
+      #
+      # This is also the only place the Linux encoder path is executed at all
+      # (macOS runs it locally, Windows is check-only), so installing them is
+      # what makes that path tested rather than merely compiled.
+      - name: Install GStreamer runtime plugins
+        run: |
+          sudo apt-get install -y \
+            gstreamer1.0-plugins-base \
+            gstreamer1.0-plugins-good \
+            gstreamer1.0-plugins-bad \
+            gstreamer1.0-plugins-ugly
+
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
 
@@ -126,9 +186,42 @@ jobs:
           workspaces: "./clients/desktop/src-tauri -> target"
           shared-key: rust-ubuntu-24.04-native
 
-      - name: cargo test --lib
+      # Release, not debug. The clip encoders are unsafe FFI against
+      # VideoToolbox / Media Foundation / GStreamer, and that is exactly the
+      # code whose behaviour differs under optimisation — the kind of bug this
+      # project has already been bitten by once (a datatype-misalignment crash
+      # that only showed up in a release build). Testing debug binaries proves
+      # the wrong artifact.
+      - name: cargo test --lib --release
+        working-directory: clients/desktop/src-tauri
+        run: cargo test --lib --release
+
+  # ──────────────────────────────────────────────────────────────────
+  # Windows type-check: the Media Foundation clip encoder is Windows-only
+  # cfg code that no other job compiles. A check (not full test run)
+  # catches API drift in the `windows` crate bindings.
+  # ──────────────────────────────────────────────────────────────────
+  desktop-rust-windows:
+    name: Desktop Rust check (Windows)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+
+      - name: Rust cache
+        uses: swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: "./clients/desktop/src-tauri -> target"
+          shared-key: rust-windows-check
+
+      # Release profile, matching what actually ships (see the Linux job).
+      # This is the only job that compiles the Windows-only Media Foundation
+      # encoder at all, so it should compile it the way users get it.
+      - name: cargo check --release
         working-directory: clients/desktop/src-tauri
-        run: cargo test --lib
+        run: cargo check --release
 
   # ──────────────────────────────────────────────────────────────────
   # Type-check the rest of the workspace (React/web clients). Catches
@@ -141,7 +234,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/*
           cache: npm

.gitignore

@@ -12,6 +12,15 @@ dist/
 # Rust / Tauri
 clients/desktop/src-tauri/target/
 clients/desktop/src-tauri/gen/
+# SwiftPM build output for the native tray. Its index database is a 64MB file
+# that was committed once already; keep it out for good.
+clients/desktop/src-tauri/swift/*/.build/
+
+# Env files, including the editor/tooling backups that are easy to commit by
+# accident (.env itself is covered above).
+.env.bak
+.env.*.bak
+*.env.bak
 
 # Drizzle generated migrations are committed, but the meta folder is not needed
 # (optional — remove this line if you want to commit migration metadata)

clients/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lookout/desktop",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "license": "AGPL-3.0-or-later",
   "private": true,
   "type": "module",
@@ -12,7 +12,8 @@
   "dependencies": {
     "@lookout/react": "*",
     "@lookout/shared": "*",
-    "@number-flow/react": "^0.6.0",
+    "@number-flow/react": "^0.6.2",
+    "@phosphor-icons/react": "^2.1.10",
     "@sentry/react": "^10.45.0",
     "@tauri-apps/api": "^2.0.0",
     "@tauri-apps/plugin-deep-link": "^2.4.7",

clients/desktop/src-tauri/Cargo.toml

@@ -12,7 +12,7 @@ debug = true
 
 [package]
 name = "lookout-desktop"
-version = "0.3.5"
+version = "0.3.7"
 edition = "2021"
 
 [lib]
@@ -21,6 +21,9 @@ crate-type = ["staticlib", "cdylib", "rlib"]
 
 [build-dependencies]
 tauri-build = { version = "2", features = [] }
+# Compiles swift/lookout-tray (SwiftUI menu-bar item with numericText digit
+# animation) and links it into the macOS binary; no-op on other targets.
+swift-rs = { version = "1.0.7", features = ["build"] }
 
 [dependencies]
 tauri = { version = "2", features = ["macos-private-api", "devtools", "tray-icon", "image-png"] }
@@ -29,10 +32,17 @@ tauri-plugin-dialog = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 xcap = "0.9"
-image = { version = "0.25", default-features = false, features = ["jpeg"] }
+image = { version = "0.25", default-features = false, features = ["jpeg", "png"] }
+# SIMD resizing (SSE4/AVX2/NEON) for the capture downscale — ~4x faster than
+# the `image` crate's scalar filters at screen sizes (29ms → 7ms, 5K→1080p).
+fast_image_resize = "5"
 reqwest = { version = "0.12", default-features = false, features = ["json", "multipart", "rustls-tls"] }
 tokio = { version = "1", features = ["full"] }
 base64 = "0.22"
+# Refcounted byte buffers for the upload pipeline — retrying an R2 PUT clones
+# the request body, and `Bytes` makes that clone a refcount bump instead of a
+# full JPEG copy. Already in the dependency tree via tokio/reqwest.
+bytes = "1"
 tauri-plugin-deep-link = "2.4.7"
 tauri-plugin-http = "2.5.7"
 tauri-plugin-macos-permissions = "2.3.0"
@@ -53,12 +63,30 @@ sentry = "0.38"
 tokio = { version = "1", features = ["test-util"] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
+objc2 = "0.6"
 objc2-core-foundation = "0.3.2"
 objc2-core-graphics = "0.3.2"
-objc2-foundation = { version = "0.3.2", features = ["NSProcessInfo", "NSString"] }
+objc2-foundation = { version = "0.3.2", features = ["NSProcessInfo", "NSString", "NSArray", "NSData", "NSDictionary", "NSEnumerator", "NSBundle", "NSURL"] }
+objc2-app-kit = { version = "0.3.2", features = ["NSWorkspace", "NSRunningApplication", "NSImage", "NSImageRep", "NSBitmapImageRep", "NSGraphicsContext", "objc2-core-graphics"] }
+# Clip encoding: hardware H.264 via AVAssetWriter (VideoToolbox under the
+# hood) writing MP4 directly. All already in the tree transitively via xcap.
+objc2-av-foundation = { version = "0.3.2", features = ["AVAssetWriter", "AVAssetWriterInput", "AVMediaFormat", "AVVideoSettings", "objc2-core-media", "objc2-core-video"] }
+objc2-core-media = { version = "0.3.2", features = ["CMTime"] }
+objc2-core-video = { version = "0.3.2", features = ["CVPixelBuffer", "CVBuffer", "CVReturn", "CVImageBuffer"] }
+block2 = "0.6"
 
 [target.'cfg(target_os = "windows")'.dependencies]
 webview2-com = "0.38"
+windows = { version = "0.62", features = [
+    "Win32_Foundation",
+    "Win32_Graphics_Gdi",
+    # Clip encoding: hardware H.264 via the Media Foundation sink writer.
+    "Win32_Media_MediaFoundation",
+    "Win32_Storage_FileSystem",
+    "Win32_System_Com",
+    "Win32_UI_Shell",
+    "Win32_UI_WindowsAndMessaging",
+] }
 
 [target."cfg(target_os = \"linux\")".dependencies]
 ashpd = { version = "0.9", default-features = false, features = ["tokio"] }

clients/desktop/src-tauri/build.rs

@@ -1,7 +1,14 @@
 fn main() {
     // Link CoreGraphics on macOS for screen capture permission APIs
     #[cfg(target_os = "macos")]
-    println!("cargo:rustc-link-lib=framework=CoreGraphics");
+    {
+        println!("cargo:rustc-link-lib=framework=CoreGraphics");
+        // Native menu-bar item: compiles swift/lookout-tray (SwiftUI with the
+        // numericText digit-roll animation) and links it into the binary.
+        swift_rs::SwiftLinker::new("10.15")
+            .with_package("lookout-tray", "./swift/lookout-tray")
+            .link();
+    }
 
     tauri_build::build()
 }