Add HandDraw desktop app scaffold v1 #2
Conversation
Complete desktop app scaffold for whiteboard/chalkboard hand-draw animation tool: - Tauri + Rust backend with HTML/CSS/TypeScript frontend - SVG stroke reveal animation with hand pointer following - Audio upload and waveform visualization - Timeline with segments and easing - Export to MP4 (H.264/AAC) and WebM (VP9/Opus) at 1080p30 - FFmpeg-kit LGPL dynamic linking for codec compliance - CI workflows for Linux (AppImage/deb), macOS (DMG), Windows (NSIS) - Draft release workflow on push to main - Offline-first with local project storage - MIT licensed with LGPL compliance notes - CC0 placeholder assets Located in public/handdraw/ to keep separate from site.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let mut child = Command::new("ffmpeg") | ||
| .args(&ffmpeg_args) | ||
| .stdin(Stdio::piped()) | ||
| .stdout(Stdio::null()) | ||
| .stderr(Stdio::null()) | ||
| .spawn() | ||
| .map_err(|e| format!("Failed to spawn ffmpeg: {}", e))?; |
There was a problem hiding this comment.
Video export relies on spawning a ffmpeg executable (Command::new("ffmpeg")) but neither the Tauri backend nor the release workflows install or ship this binary with the app. On machines where ffmpeg isn’t already on PATH, export_video will always return “Export started” and then fail immediately with Failed to spawn ffmpeg while the UI never receives an error. Consider bundling the encoder binary or at least surfacing a user-visible failure when it isn’t available.
Useful? React with 👍 / 👎.
| function updateAssetsList() { | ||
| const list = document.getElementById('assets-list'); | ||
| if (!list) return; | ||
|
|
||
| let html = '<ul>'; | ||
| state.svgPaths.forEach(p => { | ||
| html += `<li>Path: ${p.id}</li>`; | ||
| }); | ||
| if (state.audioBuffer) { | ||
| html += `<li>Audio: ${state.audioBuffer.duration.toFixed(2)}s</li>`; | ||
| } | ||
| html += '</ul>'; | ||
| list.innerHTML = html; |
There was a problem hiding this comment.
Asset names come directly from state.svgPaths and are interpolated into innerHTML without escaping. If a loaded SVG contains a path with an id like <img src=x onerror=invokeTauri()>, the updateAssetsList call will execute that HTML/JS in the Tauri window, giving arbitrary code execution with file‑system access. Use textContent/createElement or an HTML sanitizer before rendering user‑supplied IDs.
Useful? React with 👍 / 👎.
Deploying patternripple-pages with
|
| Latest commit: |
167f65f
|
| Status: | 🚫 Build failed. |
Complete desktop app scaffold for whiteboard/chalkboard hand-draw animation tool:
Located in public/handdraw/ to keep separate from site.