feat(web): play video attachments in chat

[Bil0000]

What changed

• Show local video frames as image-style play tiles before and after sending.
• Open videos in the existing expanded-media dialog with native controls.
• Download the original file when the browser cannot decode its video format.
• Serve video assets inline while other attachments remain downloads.
• Load remote videos through local blob URLs on web and desktop so Safari does not depend on byte-range responses.
• Cancel stale video loads after leaving chat, switching threads, or opening other media.
• Infer common video formats when a browser supplies no useful MIME type.
• Match legacy interrupted-upload markers after video MIME normalization.

Why

#8235 and #8236 made generic attachments uploadable and downloadable, but videos still looked like files and opened as downloads. This adds playback without a new attachment type or player dependency.

Verification

• Focused PR, draft, and stash tests: 268 passed
• Production web build passed
• Web typecheck passed
• Targeted lint and formatting passed
• Real Chromium probe played an MP4 from a 200-only response through the blob path and cancelled an aborted request

Limitation

Playback depends on the formats and codecs supported by the client browser. Unsupported codecs keep the original download fallback.

Demo

CleanShot.2026-08-30.at.5.16.14.mp4

Note

Add inline video playback for chat attachments

• Adds video playback to chat. The composer renders live thumbnails for local videos, and ExpandedImageDialog plays uploaded videos fetched into a blob URL with a download fallback.
• Server assets serve videos inline with normalized Content-Type headers. Desktop CSP adds a media-src directive allowing blob: URLs. Composer draft store normalizes MIME types and replaces needs-reattach markers when repicking videos.
• Behavioral Change: Replaces onFileDownload with onFileOpen in TimelineRowSharedState and MessagesTimelineProps. Video assets in AssetAccess.ts are now served inline without download: true and receive a stripped Content-Type.

^{Macroscope summarized 19a2c66.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e49f405-06de-4773-ab1f-0f8eff85380b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can activate Security or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

UI consistency review: two findings in the changed web UI. Both are small and self-contained; the video playback path, play/download affordance split, and blob lifetime handling otherwise look consistent with the existing dialog and timeline contracts.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a substantial cross-layer feature that adds video playback, blob loading, fallback downloads, server MIME/disposition changes, and desktop CSP changes. It also changes how existing video attachments behave, so the runtime and UX impact should receive human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One new finding on the timeline video tile. Two earlier findings (video element accessible name in ExpandedImageDialog.tsx, dropped CSP rationale in PullRequestMarkdown.tsx) are still open on this head and are not re-posted here.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One new finding on the video playback path; the unresolved caption gap from the previous run is noted in the check summary rather than re-commented.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One accessibility finding on the new video play tile in the timeline. Everything else in the web UI scope (composer video tiles, expanded dialog video branch, preview builder) matches the sibling image-tile patterns.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding: the new composer video tile repeats the disable-while-loading pattern, which drops keyboard focus. Same issue as the timeline tile flagged earlier — fixing both keeps the play affordance keyboard-usable.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding in the new composer video tile: the filename caption overlays the tile's upload chrome.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the inline-video path: routing every video/* attachment to the player removes the only download affordance for formats the browser cannot decode.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new unplayable-video fallback in ExpandedImageDialog.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new video download fallback: the object URL is revoked on the next macrotask, which the repo's own download helper documents as unsafe.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

One finding on the new composer video tile: a restored (uploaded, no local bytes) video renders with neither a thumbnail nor its name, unlike its sibling tiles.

^{Posted via Macroscope — UI Consistency}