Linux dev builds: huddle mic still fails with NotAllowedError — trusted dev origin hardcoded to Vite default port 1420

Start in desktop/src-tauri/src/linux_media.rs, then read scripts/instance-env.sh and the just dev/desktop-standalone entrypoints to trace how VITE_PORT reaches the app. Reproduce with just desktop-standalone on Linux and verify that the trusted origin follows the exported port, retains the fallback and exact matching, and allows huddle microphone access without changing packaged builds.

Summary

Huddles still fail on Linux dev builds with NotAllowedError, even though the
getUserMedia/WebKitGTK permission handling shipped in #3607 (which closed
#3495). The permission handler is installed and reachable, but its trusted
dev origin is hardcoded to Vite's default port 1420, while every
just-based entrypoint serves the dev URL on a per-worktree hashed port.
The two never match, so the handler denies the mic request on every
just dev / just desktop-standalone launch.

The production origin (tauri://localhost) is unaffected — only the dev
build path is broken.

Exact error

The request is not allowed by the user agent or the platform in the current
context, possibly because the user denied permission.

No OS permission prompt is shown (correct for Linux — WebKitGTK relies on the
embedding app's permission-request handler). The huddle companion window
opens, the mic getUserMedia rejects with NotAllowedError, and the huddle
tears down (TTS warmup → cancellation reason=shutdown, DeviceSink drops).

Root cause

desktop/src-tauri/src/linux_media.rs trusts the dev origin as a compile-time
constant:

// linux_media.rs:34 (pre-fix)
#[cfg(debug_assertions)]
const DEV_ORIGIN: &str = "http://localhost:1420";

But 1420 is only the default in vite.config.ts
(parseInt(process.env.VITE_PORT || "1420")). The just-based entrypoints
always override it. scripts/instance-env.sh:15 computes a stable per-worktree
port in the range 10000–64999 and exports it:

# scripts/instance-env.sh
BASE_PORT=$(python3 -c "import hashlib,sys; h=int(hashlib.sha256(sys.argv[1].encode()).hexdigest(),16); print(10000 + h % 55000)" "$WORKTREE_ROOT")
export BUZZ_VITE_PORT=$BASE_PORT
export VITE_PORT="$BUZZ_VITE_PORT"
DEV_URL="http://localhost:${BUZZ_VITE_PORT}"
# ...
BUZZ_TAURI_CONFIG="{\"build\":{\"devUrl\":\"${DEV_URL}\",\"beforeDevCommand\":\"exec ./node_modules/.bin/vite --port ${BUZZ_VITE_PORT} --strictPort\"}, ...}"

just dev, just desktop-standalone, just staging, and just production
all source ../scripts/instance-env.sh and pass --config "$BUZZ_TAURI_CONFIG",
so the webview loads from http://localhost:<hashed-port> — never 1420.

is_trusted_media_origin() therefore returns false for the actual dev
origin, the handler calls request.deny(), and getUserMedia rejects with
NotAllowedError. The 1420 check is dead in practice because the just tasks
always set VITE_PORT.

Repro

1. just desktop-standalone (or just dev) on Linux (WebKitGTK).
2. Start a huddle.
3. Mic getUserMedia rejects with the error above; huddle tears down.

Verified the same pubkey/identity and a working audio input device (mic is fine
in other apps); the failure is purely the origin check.

Suggested fix

Derive the trusted dev origin from the actual dev port instead of hardcoding
1420. In debug builds only, read VITE_PORT (already exported by
instance-env.sh and inherited by the app) and build
http://localhost:<port>, falling back to http://localhost:1420 when the
variable is missing or invalid (a raw pnpm tauri dev without instance-env).
Keep the scheme + host hardcoded to http://localhost (only the port is
env-derived), keep exact-origin / path-prefix matching, keep deny-by-default,
and gate the whole dev path behind #[cfg(debug_assertions)] so packaged
builds remain unchanged.

Environment

• Linux (Arch), WebKitGTK, native (non-AppImage) debug build via just desktop-standalone
• Introduced by: #3607 (merged 2026-07-30, "desktop: enable getUserMedia in the Linux WebKitGTK webview")
• Regresses: #3495