#524 fix(capture): bump screenpipe-fork to disable sck-rs on every macOS version

[Anonymous]

Originally created by: Akarsh-Hegde

Summary

Follow-up to #(the macOS 26 sck-abort fix, commit 64198590, fix/macos26-sck-abort),
which disabled sck-rs only on macOS 26+ after SCShareableContent's
completion block turned out to be released once too often — a double-free
inside ScreenCaptureKit's own XPC reply teardown, on the
com.apple.NSXPCConnection.m-user.com.apple.replayd thread. Deterministic
there: aborted on the very first call, every time.

An independent field report against a production DMG install (macOS 14.7.4,
8GB RAM, heavy swap pressure) collected 14 crash reports whose faulting
thread queue is, in every single one, exactly
com.apple.NSXPCConnection.m-user.com.apple.replayd — confirmed by parsing
the .ips files directly, not by inference from the truncated backtrace the
reporter's own analysis included. Same use-after-free/double-free as the
26+ case; below 26 it reproduces as a probabilistic race under memory
pressure (launch-time, idle, and click-triggered — consistent with a race
reachable from more than one call site into the same buggy binding) instead
of a guaranteed one. The version-scoped gate left every pre-26 install still
exposed.

Ruled out before landing on this diagnosis: WKWebView/webview IPC, the
notifications plugin, and the open_external_url/Tauri opener command (all
initially plausible given the report's own — incorrect — guess that this was
webview-related; the opener just spawns /usr/bin/open, no NSWorkspace/XPC
call happens in-process). The queue name is the same across all 14 reports
regardless of which of the two observed triggers (a UI click vs. idle
background activity) produced it, which is what points at the shared
capture engine rather than either specific call site.

Change

Bumps screenpipe-screen/screenpipe-a11y's pinned rev to
Meridiona/screenpipe-fork's fix/disable-sck-rs-universally
(Meridiona/screenpipe-fork#3), which widens use_sck_rs() to return
false unconditionally instead of only on macOS 26+ — same
xcap/CoreGraphics fallback already proven safe there.
SCREENPIPE_FORCE_SCK=1 still re-enables ScreenCaptureKit for testing
whether a newer sck-rs/cidre has actually fixed the binding.

Cargo.lock diff is scoped to only the 9 screenpipe-* crates sourced from
the fork. The unrelated, unpinned cidre transitive dependency briefly
floated to its upstream HEAD as a side effect of a multi-package
cargo update; re-pinned it back to its previously locked commit before
committing, so this PR carries no incidental dependency drift.

Per repo convention (see 64198590), this pins to the fork's fix branch tip
commit ahead of that PR merging — Meridiona/screenpipe-fork#3 is open but
not yet merged.

Test plan

• [x] cargo build --release --bin meridian (daemon, needed by the tray build in a fresh worktree)
• [x] cargo check --features capture (tray) — clean, pulls the new pinned rev
• [x] cargo clippy --features capture -- -D warnings (tray) — clean
• [x] cargo test --features capture (tray) — 131 passed
• [x] cargo fmt --check — clean
• [x] Full pre-push suite (fmt, ui build, ui tests, clippy, security audit, cargo test) passed on push
• [ ] Manual repro on the reporter's machine (or a memory-capped VM): confirm the tray no longer aborts under the same conditions once this + Meridiona/screenpipe-fork#3 both land

🤖 Generated with Claude Code

[Anonymous]

Originally posted by: coderabbitai[bot]

[!IMPORTANT]

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0f5d4603-3c97-474e-8688-3b38abe77570

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:
- [ ] 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `fix/bump-screenpipe-fork-sck-universal-disable`

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

_{Comment @coderabbitai help to get the list of available commands.}

[Anonymous]

Ticket changed by: Akarsh-Hegde

• status: open --> closed