feat(desktop): record system audio + mic (ScreenCaptureKit) so calls capture both sides

[alonmuroch]

What & why

The recorder captured the microphone only, so on a call the other person's voice — which comes out of the speakers as system audio — was never recorded; conversations came out as near-silence (only the local half). This adds system-output audio capture via ScreenCaptureKit (macOS 13+) and mixes it with the mic into the single mono WAV, so a two-way call records both sides.

The recently-fixed mic selection / permission logic, the silence guard (recording-guard.ts), and the native pill are untouched — this is purely additive.

How

• system_audio.rs — SCStream audio tap via raw objc (same ClassDecl/msg_send! path as overlay_native.rs; no new deps). SCShareableContent → SCContentFilter (first display, all apps) → SCStreamConfiguration.capturesAudio = YES (+ excludesCurrentProcessAudio). A BrainsSCAudioDelegate bridges the async stream:didOutputSampleBuffer:ofType: callback → a mono-f32 ring buffer; PCM is pulled via CMSampleBufferGetAudioBufferListWithRetainedBlockBuffer (planar + interleaved float32), downmixed + resampled to the WAV rate. The delegate points at a heap SinkCtx via an ivar, owned by SystemAudioCapture for the stream's whole life so the callback can't touch freed memory. ScreenCaptureKit/CoreMedia force-linked.
• Permission gate — ensure_screen_permission() mirrors ensure_mic_permission() (CGPreflight/CGRequestScreenCaptureAccess). Non-fatal: on deny / <macOS 13 / SCStream start failure → degrade to mic-only, recording why.
• audio_mix.rs — pure, unit-tested DSP: downmix_to_mono, resample_linear, mix_sum_limit (sum + soft-clip so simultaneous speech can't wrap), to_i16_with_peak.
• recorder.rs — mic callback now pushes into a ring; a mixer/writer loop drains both rings, mixes, writes the mono WAV, and feeds CAPTURE_PEAK from the mixed signal (so the silence guard now means "neither side has sound"). Ordered teardown: stop SCStream → stop mic → finalize WAV.
• Capture-mode signal — recorder_capture_mode() → mic+system | mic-only-denied | mic-only-unsupported, surfaced as a subtle "Mic only ⓘ" note in the toolbar.

Verified here

• cargo check clean; cargo clippy — no new findings on the changed files (only the shared cocoa-crate deprecation + msg_send! cargo-clippy cfg warnings that the pre-existing overlay_native.rs already emits); cargo fmt --check OK.
• npm run check — 0 errors (140 pre-existing warnings, unchanged).
• New DSP unit tests (9) + existing recorder tests (9) pass. (One flaky diagnostics latency test is pre-existing and unrelated.)

Needs a live run (can't be tested here)

• The actual SCStream Screen-Recording permission prompt + grant flow.
• Real two-way call capture and mix quality (levels, resample artifacts).
• SCStream teardown under load (no leaked stream/threads across many start/stop cycles).
• The mic-only fallback actually triggering on a denied grant.

Safety caveats

• The delegate→mixer bridge is the riskiest part. stop() waits (bounded) on stopCaptureWithCompletionHandler before freeing the SinkCtx, and clears the ivar first — mitigating but not 100% eliminating a theoretical in-flight-callback race. Worth a careful live soak before merging past stage.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V2pJsw7KBLViKjXGGo4Nwg

[Chris-ssvlabs]

🟡 stop() frees SinkCtx via Box::from_raw even when stopCaptureWithCompletionHandler times out after 5s, and the brains_ctx ivar clear is not synchronized with the sample-handler queue — an in-flight on_sample_buffer that loaded the pointer before the clear dereferences freed memory (use-after-free). Synchronize by dispatch_sync-ing an empty block on the sample queue before freeing, and leak the ctx instead of freeing it on the timeout path.

[Chris-ssvlabs]

🟡 Mixer loop writes nothing when mic_ring is empty (if !mic.is_empty()), and drain_ring_up_to(&sys_ring, mic.len()) ties far-end consumption to mic delivery — if the mic stream stalls or errors mid-recording (err_fn only logs), captured system audio is silently discarded, sys_ring backlogs to its 30s cap and drops far-end samples, and the WAV stops growing. On mic underrun, pad the mic slice with silence and keep draining/writing sys_ring.

[Chris-ssvlabs]

🟡 refreshCaptureMode() is invoked once, immediately after recorder_start resolves, but CAPTURE_MODE is reset to MODE_UNKNOWN in recorder_start and only finalized on the capture thread after device probing plus SCStream startup (up to two 10s timeouts) — the one-shot fetch almost always reads "unknown", so the Mic only note effectively never renders. Poll until the mode is not "unknown" (or emit an event from the capture thread).

[Chris-ssvlabs]

🟡 New user-facing UI text ("Mic only ⓘ" plus both tooltip strings) is hardcoded; CONTRIBUTING.md i18n section requires new UI text to be added to both messages/en.json and messages/zh-CN.json, and neither file is touched by this PR.

[Chris-ssvlabs]

🟡 The queue from dispatch_queue_create is never released — not in stop(), not on the addStreamOutput/startCapture failure paths — leaking one dispatch queue per capture start/stop cycle (auto-record cycles these per meeting). Store it in SystemAudioCapture and dispatch_release it during teardown.