fix: harden macOS GPUI crash paths

[richiemcilroy]

Summary

• Fix recursive macOS occlusion callbacks by forwarding to the saved native implementations, with nine Objective-C subclass regression tests.
• Retain Core Video textures until GPU completion, skip invalid frames with bounded logging, and propagate renderer initialization errors without unwinding through native callbacks.
• Parse camera IDs without slicing through UTF-8 characters.
• Embed the already-referenced muted volume icon, fixing the Linux and Windows CI asset test failure.
• Restart after permission changes through normal shutdown, waiting for the previous process to exit and preserving the session on spawn failure.
• Keep the GPUI recovery marker until clean shutdown, including recording finalization, so crashes after the old ten-second window can restore classic Cap on the next launch.

Verification

• macOS 26.2: GPUI check and rebuilt debug app passed; actual camera crate tests passed (3).
• Native Metal helper tests passed (4), including real GPU completion and missing shader-function handling.
• Rebuilt app: normal recorder/settings startup, clean quit, forced termination, and 300-frame synthetic camera run passed.
• Fault injection: no Metal device exited normally with a recovery marker; rejecting every preview texture still completed 300 frames without crashing, with errors logged at five-second intervals.
• Local GPUI binary suite: 598 passed, zero failed. The pre-existing missing volume-x icon embedding is now repaired and its focused test passes.
• Formatting and patch reconstruction passed. The dependency patch reproduces the tested macOS source from its pinned revision.
• Exact PR source snapshot with the pinned dependency patch passes the GPUI check. All ten permission tests pass, including parent-exit ordering, literal executable paths, failed-spawn retry, and duplicate-relaunch suppression.
• Interactive permission relaunch passed in a self-contained test bundle: the old process exited, the replacement opened the permission UI with its own marker, and a subsequent normal quit removed that marker. The fixture used simulated permission states and isolated app data.
• Final local cargo +1.95.0 check -p cap-camera -p cap-desktop --locked -j 2 passed.

Scope and limits

The PR contains eleven changed files relative to main: the crash fixes and the one-line icon repair. Main at aa93b22 was merged without conflicts; all ten crash-fix files are unchanged by that merge. Unrelated local work is excluded, and the shared checkout/index remain unchanged. The merged source snapshot passes the GPUI check and formatting. The customer macOS 27 beta and complete updater-to-classic round trip still need runtime retesting.

Greptile Summary

The PR hardens several macOS GPUI crash and recovery paths.

• Preserves native occlusion implementations while preventing recursive callbacks.
• Retains Core Video textures through Metal command completion and propagates renderer initialization failures.
• Makes camera-ID parsing UTF-8-safe.
• Routes permission relaunches through recording-aware shutdown and keeps the recovery marker for the full GPUI session.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains established in the current evidence.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/desktop-gpui/src/main.rs	Registers full-session recovery-marker cleanup on application shutdown and handles main-window initialization failure without unwinding.
apps/desktop-gpui/src/permissions.rs	Replaces immediate process exit with a duplicate-safe relaunch helper that waits for orderly shutdown and permits retry after spawn failure.
apps/desktop-gpui/src/store.rs	Changes the GPUI handoff marker into a full-session crash-recovery marker with explicit creation and clean-shutdown removal.
apps/desktop/src-tauri/src/gpui_app.rs	Updates classic-app recovery behavior and messaging for the full-session marker lifecycle.
apps/desktop-gpui/src/platform/macos_occlusion.rs	Introduces per-class saved native occlusion implementations and regression coverage for inherited and overridden Objective-C subclasses.
apps/desktop-gpui/patches/zed-gpui.patch	Hardens Metal renderer initialization, frame validation, and Core Video texture lifetime management.
crates/camera/src/macos.rs	Parses camera model suffixes using checked UTF-8 boundaries instead of unchecked byte slicing.

_{Reviews (3): Last reviewed commit: "fix: embed the muted volume icon" | Re-trigger Greptile}

Context used:

• Knowledge Base — GPUI desktop client
• Knowledge Base — Desktop application and recording experience

[superagent-security]

Manage your Superagent protection

Superagent has paused scans for this repository because this unlinked GitHub App installation has used all three included PR scans.

You have 0 of 3 included PR scans remaining.

Create a free account to continue protection, manage scan settings, review security history, and control which repositories are protected.

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR