fix(publish): report capture refusal and withhold partial broadcasts

[kixelated]

Problem

A refused camera or microphone capture was swallowed and retried without a public failure state. announce="source" could advertise a video-only broadcast while microphone permission remained denied. Browser media QA did not assert the audio gesture gate.

Approach

• Surface terminal getUserMedia errors on the camera and microphone source outputs. Stop retrying a refused capture until a relevant setting, device, enabled state, or browser permission changes.
• Wait for all enabled camera-source tracks before announcing. Render capture failures in the publish UI badge.
• Add a Chromium smoke case that denies both permissions, grants them one at a time, checks the viewer stays offline until both tracks are live, and verifies recovery and encoding without reload. Assert suspended Web Audio graphs before clicks under Chromium's document activation policy.

Impact

• Public JS API: Source.Camera.out.error and Source.Microphone.out.error now expose Signal<Error | undefined>.
• Public JS behavior: <moq-publish announce="source" source="camera"> waits for every enabled track before announcing.
• Wire format: no change.

Alternatives

• An element-level capture error signal was considered; the source outputs already provide public access through el.sources.video and el.sources.audio.

Follow-ups

• The browser case uses a fake device and Playwright permission state; it does not cover physical hardware or a person clicking a permission prompt.

Validation

• nix develop --command just check
• nix develop --command just test
• Full direct browser media run, final capture-denial case, and silent-audio negative control against a local relay. The media suite is in the nightly smoke workflow.

(written by GPT-6 Astra)

[coderabbitai]

Warning

Review limit reached

Next included review available in 5 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9fe63ac4-5fb4-40d6-a827-2fab27983736

📥 Commits

Reviewing files that changed from the base of the PR and between 248054c and 42c7a62.

📒 Files selected for processing (19)

• demo/web/src/publish.html
• doc/lib/js/publish.md
• js/publish/README.md
• js/publish/src/element.ts
• js/publish/src/source/camera.ts
• js/publish/src/source/device.ts
• js/publish/src/source/microphone.ts
• js/publish/src/source/retry.test.ts
• js/publish/src/source/retry.ts
• js/publish/src/ui/components/status-badge.ts
• quest/next/README.md
• quest/next/browser-permission-qa.md
• quest/next/publish-audio-unlock.md
• test/smoke/README.md
• test/smoke/clients/js/harness.ts
• test/smoke/clients/js/media.ts
• test/smoke/clients/js/src/contract.ts
• test/smoke/clients/js/src/probe.ts
• test/smoke/clients/js/src/setup.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[moq-bot]

No issues found.
Verdict: approve
(Written by Muse Spark)

opencode session  |  github run

[kixelated]

Automated review

What this does

Surfaces terminal getUserMedia failures on Source.Camera.out.error / Source.Microphone.out.error, stops retrying a refused capture until permission, device, constraints, or enabled state change, and makes announce="source" wait for every enabled camera track before advertising. The publish UI badge shows the failure, and the smoke suite gains a capture-denial case plus CDP inspect so Chromium probes do not fake user activation.

Strengths

• Fixes a real product bug: video-only announce while mic permission is denied, and silent retry loops that re-prompt.
• Puts the error on the existing source outputs rather than inventing a parallel element-level signal — matches how callers already reach el.sources.*.
• Permission-change refund via navigator.permissions is the right recovery path without forcing a reload.
• Smoke harness work (gesture-safe inspect, staged permission grant) is the hard part of this class of bug and belongs with the fix.

Concerns

• announce="source" for camera still requires (video || audio) && ready; if both tracks are disabled the old “has any media” gate still applies — worth a quick sanity check that muted/invisible combinations match product intent.
• Browser permission API coverage is uneven across engines; the code already falls back when permissions.query is missing, which is fine.

Recommendation rationale

Clear user-visible correctness fix, API surface is additive and documented, and tests cover the regression that previously slipped through. Complexity is justified by the permission/gesture interaction, not accidental abstraction.

MERGE

This is an automated review, not the maintainer's decision
(Written by Grok)