Decide camera, microphone and screen-capture requests (Canvas 35)

[shannah]

Summary

This PR lets a host app answer a page's camera, microphone and screen-capture requests. Video calls in XataWorks Builder creations (agentic-app-framework Canvas 392) need it on the desk.

API

• wv.setPermissionHandler(WebViewPermissionHandler).
• The handler receives a WebViewPermissionRequest with origin(), url(), and kinds() (CAMERA / MICROPHONE / DISPLAY). It is called on the EDT.
• The request is answered with allow(), deny(), useDefault(), or answer(PermissionDecision). Any thread can answer, now or later, and only the first answer counts.
• If the handler throws, or the component is disposed with requests still pending, those requests are denied.
• With no handler set, each engine behaves exactly as it does today: WebKitGTK refuses, and WebView2 and WKWebView show their own prompts.
• WebViewComponent.isPermissionHandlerSupported() reports whether the loaded native library has the hook.

Per engine

Engine	Hook	Status
WebKitGTK (Linux, lightweight)	permission-request: user-media, plus display capture on 2.42+. Symbols are loaded optionally through webkit_loader.h. Turns on enable-media-stream / enable-webrtc where the build has them.	Tested (Xvfb, mock capture devices)
WebView2 (Windows)	add_PermissionRequested with GetDeferral for camera and microphone. The SDK in use has no screen-capture kind, so WebView2 keeps its own picker for that.	Compiled by CI only, untested
WKWebView (macOS 12+)	requestMediaCapturePermissionForOrigin… under __builtin_available. Screen capture has no public hook, so WebKit decides it.	Compiled by CI only, untested

Host apps on macOS must declare NSCameraUsageDescription and NSMicrophoneUsageDescription, or the app is killed on first camera access. The README documents this.

SPDD

Story 11, its analysis, and Canvas 35.

Tests

• mvn test passes, including the new PermissionDispatcherTest (12 tests).
• xvfb-run -a ./run-linux-media-smoketest.sh extends the existing smoke test with WebViewMediaPermissionSmokeTest. In lightweight mode it checks:
  • deny results in NotAllowedError, with kinds [CAMERA] and the request's origin;
  • allow results in an audio and video stream;
  • an allow answered 1.5 s later from another thread works, and the EDT stays responsive;
  • with no handler, and with useDefault(), the result is NotAllowedError;
  • getDisplayMedia reaches the handler as [DISPLAY].
• On Ubuntu 24.04, WebKitGTK still has no RTCPeerConnection. Pages must check typeof RTCPeerConnection.
• New demo: WebViewMediaPermissionDemo, with run scripts for each OS.

Needs testing on real hardware

Windows and macOS have not been run yet. On Windows in particular, DEFAULT after a deferral should fall back to WebView2's own prompt, and that is untested.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WxLMiE3sgxfvWqy44xRLDY

---

Generated by Claude Code

[shannah]

native (linux_64) and native (linux_arm64) are red, but the cause isn't in this PR. Both fail in the debian:11 container's apt-get install. archive.debian.org returns 404 Not Found for package files that its own index lists.

• First run (0eb8d7c): libjavascriptcoregtk-4.0-18, libwebkit2gtk-4.0-dev and libsoup2.4-dev failed.
• This run (d711e98): libxcb-shm0, libjavascriptcoregtk-4.0-dev and libwebkit2gtk-4.0-dev failed.

The missing files differ between runs. The same URLs return 200 when fetched from outside the runner, so this looks like a CDN edge serving stale 404s to the GitHub runners. The PR doesn't touch the workflow or the container setup. The last master run (Oct 3) passed this step.

No fix exists yet. A possible hardening for build.yml would be -o Acquire::Retries=5 on the apt-get calls, but I've kept it out of this PR. I'm re-running the failed jobs once.

The Windows compile error from the first run (C3861, win_perm_respond not found) was this PR's. d711e98 fixes it.

---

Generated by Claude Code