fix(linux): enable WebRTC in WebKitGTK; add Arch package build

WebKitGTK ships enable-media-stream/enable-webrtc off by default
(unlike WebView2/WKWebView), leaving navigator.mediaDevices undefined
and Element Call reporting "browser does not support WebRTC" on every
Linux build. Enable both settings and auto-grant the resulting
camera/mic permission request, mirroring the existing WebView2 handling.

Also add a build-arch CI job that repackages the existing .deb into a
real .pkg.tar.zst and uploads it to the Gitea release alongside the
Windows/Linux artifacts, for Arch/CachyOS users who'd rather use pacman
than an AppImage.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -281,6 +281,55 @@ jobs:
           upload "LotusChat-x86_64.AppImage.tar.gz.sig" "$APPIMAGE_DIR/Lotus Chat_${VERSION}_amd64.AppImage.tar.gz.sig"
           upload "LotusChat-x86_64.deb"                 "$DEB_DIR/Lotus Chat_${VERSION}_amd64.deb"
 
+  build-arch:
+    # Needs build-linux's .deb to already be on the release (this job
+    # downloads it from the fixed "latest" asset URL, same as update-manifest
+    # does for signatures) rather than recompiling from source.
+    needs: [prepare, build-linux]
+    runs-on: ubuntu-latest
+    container:
+      image: archlinux:base-devel
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build tools
+        run: pacman -Syu --noconfirm --needed curl python
+
+      - name: Set package version
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: sed -i "s/^pkgver=.*/pkgver=$VERSION/" packaging/pacman/PKGBUILD
+
+      - name: Build .pkg.tar.zst
+        run: |
+          # makepkg refuses to run as root. --nodeps: the package() step just
+          # extracts the .deb payload, so the runtime `depends` (webkit2gtk,
+          # gstreamer, ...) don't need to be installed on the build container.
+          useradd -m builder
+          chown -R builder:builder packaging/pacman
+          su builder -c 'cd packaging/pacman && makepkg -f --noconfirm --nodeps'
+
+      - name: Upload to release
+        env:
+          TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          RELEASE_ID: ${{ needs.prepare.outputs.release_id }}
+        run: |
+          PKG=$(ls packaging/pacman/*.pkg.tar.zst)
+          NAME="LotusChat-x86_64.pkg.tar.zst"
+
+          existing_id=$(curl -sf "$GITEA_URL/api/v1/repos/$REPO/releases/$RELEASE_ID/assets" \
+            -H "Authorization: token $TOKEN" \
+            | python3 -c "import sys,json; assets=json.load(sys.stdin); print(next((str(a['id']) for a in assets if a['name']=='$NAME'), ''))" 2>/dev/null || true)
+          if [ -n "$existing_id" ]; then
+            curl -sf -X DELETE "$GITEA_URL/api/v1/repos/$REPO/releases/$RELEASE_ID/assets/$existing_id" \
+              -H "Authorization: token $TOKEN" || true
+          fi
+          curl -sf -X POST \
+            "$GITEA_URL/api/v1/repos/$REPO/releases/$RELEASE_ID/assets?name=$NAME" \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary @"$PKG"
+
   update-manifest:
     needs: [prepare, build-windows, build-linux]
     runs-on: ubuntu-latest

packaging/pacman/PKGBUILD

@@ -0,0 +1,39 @@
+# Built and published by CI (.gitea/workflows/release.yml, build-arch job) —
+# not published to AUR, just a real .pkg.tar.zst uploaded to the Gitea
+# release alongside the .deb/AppImage/exe. CI sed-patches pkgver below to the
+# release version before building.
+#
+# Repackages the .deb the same CI already builds (build-linux) rather than
+# recompiling from source: the web client needs the private @lotusguild/*
+# npm registry, and build-linux already produced a working Linux binary —
+# no reason to build it twice.
+pkgname=lotus-chat
+pkgver=0.0.0
+pkgrel=1
+pkgdesc="Matrix chat client for Lotus Guild (desktop app)"
+arch=('x86_64')
+url="https://chat.lotusguild.org"
+license=('AGPL-3.0-only')
+depends=(
+  'webkit2gtk-4.1'
+  'gtk3'
+  'libayatana-appindicator'
+  # WebRTC calling: WebKitGTK's media pipeline is backed by GStreamer, and
+  # these are the plugin sets that actually carry audio/video codecs.
+  'gst-plugins-good'
+  'gst-plugins-bad'
+  'gst-plugins-ugly'
+  'gst-libav'
+)
+provides=('lotus-chat')
+conflicts=('lotus-chat')
+options=('!strip')
+source=("LotusChat-x86_64.deb::https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/download/latest/LotusChat-x86_64.deb")
+sha256sums=('SKIP')
+
+package() {
+  bsdtar -O -xf "$srcdir/LotusChat-x86_64.deb" data.tar.zst 2>/dev/null \
+    || bsdtar -O -xf "$srcdir/LotusChat-x86_64.deb" data.tar.xz 2>/dev/null \
+    || bsdtar -O -xf "$srcdir/LotusChat-x86_64.deb" data.tar.gz \
+    | bsdtar -C "$pkgdir" -xf -
+}

src-tauri/Cargo.toml

@@ -43,6 +43,9 @@ tauri-plugin-autostart = "2" # P6-1 launch-on-login
 # default `blocking-api` feature and the default `async-io` runtime, so plain
 # default features suffice (no tokio integration needed here).
 zbus = "5"
+# Same version wry/tauri already pull in transitively (see Cargo.lock) — pinning
+# it directly lets us reach WebKitSettings/permission APIs wry doesn't expose.
+webkit2gtk = "2.0"
 
 [target.'cfg(target_os = "windows")'.dependencies]
 webview2-com = "0.38"

src-tauri/src/lib.rs

@@ -782,6 +782,27 @@ pub fn run() {
                 }
             })?;
 
+            // WebKitGTK ships `enable-media-stream`/`enable-webrtc` OFF by
+            // default (unlike WebView2/WKWebView), which leaves
+            // `navigator.mediaDevices` undefined and makes Element Call
+            // report "browser does not support WebRTC". Turn them on and
+            // auto-grant the resulting camera/mic permission prompt, mirroring
+            // the WebView2 handling above.
+            #[cfg(target_os = "linux")]
+            window.with_webview(|webview| {
+                use webkit2gtk::{PermissionRequestExt, SettingsExt, WebViewExt};
+
+                let wv = webview.inner();
+                if let Some(settings) = WebViewExt::settings(&wv) {
+                    settings.set_enable_media_stream(true);
+                    settings.set_enable_webrtc(true);
+                }
+                wv.connect_permission_request(|_webview, request| {
+                    request.allow();
+                    true
+                });
+            })?;
+
             // Native desktop feature modules (power/call-continuity, etc.).
             native::setup(app.handle())?;