fix: Linux NVIDIA GBM buffer crash + WebKitGTK microphone access

[ieguiguren]

Summary

• Disable DMABUF renderer for NVIDIA GPUs on Linux to prevent GBM buffer allocation crashes in WebKitGTK
• Enable microphone access on Linux by adding webkit2gtk dependency and configuring WebKitGTK to allow getUserMedia (which is denied by default)

Changes

• Makefile: Set WEBKIT_DISABLE_DMABUF_RENDERER=1 env var for dev mode on Linux
• Cargo.toml / Cargo.lock: Add webkit2gtk = "2.0" as Linux-only dependency
• main.rs: Enable media stream support in WebKitGTK settings and auto-grant UserMediaPermissionRequest for microphone access

Context

WebKitGTK on Linux has two issues affecting Voicebox:

1. NVIDIA proprietary drivers don't properly support GBM buffer allocation used by the DMABUF renderer, causing crashes on startup
2. getUserMedia is denied by default — microphone recording doesn't work without explicitly enabling media streams and granting permission requests

Fixes #163

Test plan

• Verify app launches without crash on Linux with NVIDIA GPU (proprietary drivers)
• Verify app launches on Linux with Intel/AMD GPU (no regression)
• Verify microphone recording works on Linux
• Verify no regression on macOS and Windows builds

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Enabled automatic microphone access on Linux for trusted origins so voice and audio features work without repeated permission prompts.

• Chores

  • Improved Linux WebKit integration for more stable and optimized behavior across distributions.
  • Development startup now conditionally disables a specific renderer on Linux when NVIDIA GPUs are detected to improve local launch reliability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d21c63b and 30ee07c.

📒 Files selected for processing (2)

• Makefile
• tauri/src-tauri/src/main.rs

---

📝 Walkthrough

Walkthrough

Adds Linux-specific WebKit integration: conditional DMABUF renderer disabling in dev, a Linux-only webkit2gtk dependency, and logic to enable media streams and auto-handle UserMediaPermissionRequest (microphone) for trusted origins in the Tauri app.

Changes

Cohort / File(s)	Summary
Build Configuration Makefile	Dev target now conditionally sets WEBKIT_DISABLE_DMABUF_RENDERER=1 when on Linux with an NVIDIA GPU; otherwise starts frontend normally.
Linux Dependencies tauri/src-tauri/Cargo.toml	Adds a target-specific dependency section for Linux: webkit2gtk = "2.0".
WebKit Permission Handling tauri/src-tauri/src/main.rs	Adds #[cfg(target_os = "linux")] setup: enable WebKitGTK media stream setting and auto-grant or deny UserMediaPermissionRequest based on trusted origins. Review signal connection and origin checks.

Sequence Diagram(s)

sequenceDiagram
  participant App as Tauri App
  participant WebView as WebView (WebKitGTK)
  participant PermReq as UserMediaPermissionRequest
  participant WebKit as WebKitGTK

  App->>WebView: initialize (Linux-only) — enable_media_stream = true
  Note right of WebView: WebView settings updated
  WebView->>PermReq: user requests microphone (getUserMedia)
  PermReq->>App: emit permission_request signal
  App->>App: check origin (trusted list)
  alt origin trusted
    App->>PermReq: allow()
    PermReq->>WebKit: grant access
  else origin not trusted
    App->>PermReq: deny()
    PermReq->>WebKit: deny access
  end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A tiny hop to Linux land I go,
I nudge WebKit settings nice and slow,
I listen for a microphone plea,
If the origin's known, I say "come see!"
Pip-pip — code, compile, and flow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: fixing NVIDIA GBM buffer crash and enabling WebKitGTK microphone access on Linux, which are the primary objectives.
Linked Issues check	✅ Passed	The pull request comprehensively addresses issue #163 by enabling Linux build support with proper GPU handling and microphone access through code changes in Makefile, Cargo.toml, and main.rs.
Out of Scope Changes check	✅ Passed	All changes are scoped to the stated objectives: DMABUF renderer workaround for NVIDIA, webkit2gtk dependency addition, and WebKitGTK microphone configuration. No unrelated modifications detected.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Makefile`:
- Line 82: The Makefile currently unconditionally prefixes the dev-frontend
invocation with WEBKIT_DISABLE_DMABUF_RENDERER=1 (the line invoking $(MAKE)
dev-frontend), which should be scoped to Linux + NVIDIA only; update that line
so the environment variable is set only when running on Linux and an NVIDIA GPU
is detected (e.g., check uname -s for "Linux" and probe for NVIDIA via lspci or
/proc/driver/nvidia) and otherwise invoke $(MAKE) dev-frontend without the
variable; locate the invocation that sets WEBKIT_DISABLE_DMABUF_RENDERER=1 and
replace it with a short shell conditional that exports/ prefixes the var only
when both the OS is Linux and NVIDIA is present.

In `@tauri/src-tauri/src/main.rs`:
- Around line 653-660: The permission handler for
wk_webview.connect_permission_request currently auto-allows any
UserMediaPermissionRequest by calling request.allow(); instead, check the
request origin before allowing: inside the closure for
wk_webview.connect_permission_request, detect UserMediaPermissionRequest
(request.is::<webkit2gtk::UserMediaPermissionRequest>()), retrieve the request
origin/URI from the PermissionRequest API (e.g., via request.origin() or
request.get_uri()), and only call request.allow() if that origin matches your
trusted set (e.g., localhost/loopback origins or a configured trusted_origins
list); otherwise call request.deny() or return false—update the closure around
request.allow() to perform this explicit origin validation.

---

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 38bf96f and d21c63b.

⛔ Files ignored due to path filters (1)

• tauri/src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• Makefile
• tauri/src-tauri/Cargo.toml
• tauri/src-tauri/src/main.rs