fix(desktop): upload videos without ffmpeg on macOS

[wesbillman]

Summary

• Preserve actionable string errors from deferred Tauri media uploads instead of displaying Unknown error.
• Fall back to macOS's built-in avconvert when ffmpeg is unavailable, while keeping the existing ffmpeg path on configured systems.
• Handle extensionless deferred-upload temp files and validate every converted MP4 with the relay's production validator before upload, catching preserved metadata tracks and other unsupported output locally.

Related issue

N/A. No matching open issue or PR found.

Testing

• Always-running macOS regression uses a checked-in 1.1 KiB synthetic H.264 QuickTime fixture, copies it to an extensionless path matching deferred uploads, converts it with avconvert, and runs the result through validate_video_file.
• Wes's exact 7,090,680-byte recording separately converted and passed the same relay validator; the converted MP4 also succeeded against the live relay.
• Focused desktop JavaScript error-mapping tests: 5 passed.
• Pre-push hooks passed at 896768fbf0f387d4cf092927b88f7a1e46321bd5: file-size gate plus Tauri clippy and full Tauri Rust tests. The prior push at ec68dccf3379363bd31d1b729730fc7e27bfec18 also passed desktop Biome, typecheck, and JavaScript tests.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Reviewed base f7942167372501576c9f0f589cf2c166882668bb through exact head d10c1b5352c1370d6006810bd577205563740d80.

No blocking correctness finding. I traced both picker and deferred raw-byte upload paths through video detection, ffmpeg/avconvert selection, extensionless source staging, process cancellation/timeout, temp-file cleanup, relay-format validation, upload, composer recovery, and raw Tauri error presentation.

The macOS fallback uses the absolute system binary with a cleared environment, preserves the existing ffmpeg path where available, cleans staged/output files on failure and cancellation, and validates avconvert output with the relay's actual video validator before upload. The checked-in extensionless QuickTime fixture exercises avconvert and that validator. The frontend change correctly preserves non-empty raw string rejections while retaining the fallback for empty or non-text values.

git diff --check passed and the review worktree was clean at the exact head. The PR's focused macOS fixture/live-relay evidence and pre-push results cover the changed behavior. GitHub CI was still running when this review completed, so I am not claiming a final CI result and did not duplicate its broad suites locally.

[jedwards27]

:bot: Jude’s code review agent

Verdict: COMMENT — no blocking correctness finding

Reviewed: f7942167372501576c9f0f589cf2c166882668bb..d10c1b5352c1370d6006810bd577205563740d80 (exact head d10c1b5352c1370d6006810bd577205563740d80)

Risk: high — this changes macOS native process/filesystem handling, cancellation and cleanup, media-format enforcement, a production dependency edge, and user-visible upload failure reporting.

Behavior/contracts traced: picker and deferred paste/drop paths through detection, fd lifetime, staging, ffmpeg/avconvert selection, cancellation/timeout, process reaping, relay-format validation, upload, cleanup, and raw Tauri error presentation. I also checked the platform fence, dependency target gate, and the change against VISION.md / TESTING.md; I found no conflicting product or test-policy expansion.

Findings: no blocking issue.

• The fallback invokes absolute /usr/bin/avconvert with a cleared environment and no shell/PATH lookup, a finite 600s timeout, kill-and-reap cancellation, UUID temporary names, and cleanup across success/error/cancellation (desktop/src-tauri/src/commands/media_transcode.rs:450-577). Extensionless deferred sources are staged with a magic-derived extension using hard-link then bounded copy fallback; the original picker fd remains pinned.
• Converted output is passed through the relay's production validator before upload (media_transcode.rs:489-516,568-569; crates/buzz-media/src/validation.rs:290-416,847-943), enforcing size, MP4/H.264/AAC, duration/resolution, fast-start, track shape, and metadata constraints. Existing ffmpeg selection remains first, while non-macOS retains the prior ffmpeg-required error (media_transcode.rs:589-600).
• Non-empty raw string rejections now remain actionable instead of becoming Unknown error (desktop/src/features/messages/ui/useMentionSendFlow.helpers.ts:84-91).
• Native macOS probes normalized Apple-generated HEVC MOV/M4V/MP4 and ProRes MOV to H.264 MP4. VP9 WebM and one ffmpeg-authored HEVC MOV were rejected with actionable stderr rather than uploading unsupported bytes. A separate generated HEVC QuickTime source produced H.264/avc1 output verified with ffprobe. Temp residue scans found no buzz-avconvert-*, buzz-avconvert-source-*, or buzz-drop-* files.

Validation at matching clean head:

• just desktop-tauri-test — pass; primary Tauri target 2744 passed, 0 failed, 18 ignored, plus integration/workspace targets and both new avconvert tests.
• cd desktop && pnpm test / repository just desktop-test path — pass; 5354 passed, 0 failed.
• git diff --check — pass.
• GitHub CI at submission: macOS Desktop Build, Rust Lint, all Desktop smoke/integration lanes, release-candidate contract, and DCO pass. Desktop Core and Windows Rust remain in progress, so this review does not claim final CI clearance.

Non-blocking risk / residual evidence limits:

1. The macOS-target-gated normal buzz-media dependency adds roughly 23 production graph packages versus base, including storage/XML/system-information dependencies, solely to reuse the validator (desktop/src-tauri/Cargo.toml:61). This is packaging weight and coupling rather than a demonstrated functional defect; a validator-only feature or crate would be a useful follow-up.
2. The new avconvert regression test invokes validate_avconvert_output separately after conversion (media_transcode.rs:659-675), so it would not fail if the production validation call at line 568 were removed. The production call is correct, but the test is not mutation-grade coverage of that wiring.
3. The fallback intentionally returns no generated poster (media_transcode.rs:596). Stock macOS users without ffmpeg get a playable, validated upload with dimensions/duration but no BlobDescriptor.image; that is a visible quality degradation, not data loss or a blocker for the stated fix.
4. I did not independently exercise an installed/signed DMG upload or repeat the author-reported live-relay upload. The native conversion boundary was exercised directly on macOS with codec probes and the full Tauri suite; installed-artifact handoff remains residual risk.

Because the PR author's GitHub identity is also the review identity available here, this is filed as a comment rather than a self-approval. Final merge remains gated on the two running CI jobs.