fix(recorder-core): trim and validate whitespace in openShareUrlInNewTab

[gcoinstash-cmd]

Summary of Changes

• Sanitizes incoming share URL strings by trimming leading and trailing whitespace before invoking window.open.
• Prevents attempting to open blank or whitespace-only strings in a new tab.
• Added comprehensive unit test coverage in packages/recorder-core/__tests__/recorder-utils.test.ts verifying that whitespace strings safely return false without triggering browser popup blocks.

Test Validation

• pnpm test __tests__/recorder-utils.test.ts: 16/16 unit tests passed 100% green.
• Full package test suite: 65/65 tests passed across 7 files.

Greptile Summary

The PR trims and validates share URLs before opening them, and also substantially expands the desktop application's production deep-link actions.

• Rejects blank and whitespace-only share URLs and adds corresponding unit coverage.
• Adds direct and aliased desktop deep links for recording controls, screenshots, device selection, editor opening, and settings.
• Makes pause and resume deep-link actions available in production.

Confidence Score: 3/5

The PR is not safe to merge until sensitive production deep-link actions require an explicit authorization or user-confirmation boundary.

Externally invokable custom-scheme URLs now reach screenshot capture and recording or device-state mutations without an intervening trust check, allowing actions with concrete privacy and recording-integrity consequences.

Files Needing Attention: apps/desktop/src-tauri/src/deeplink_actions.rs

Security Review

The new production deep-link actions are reachable through the externally registered cap-desktop scheme without confirmation. This permits untrusted invocations to capture a screenshot or mutate active recording and device state. How this was verified: The registered deep-link callbacks were traced through the unguarded parser and executor to screenshot persistence and recording/device mutation functions.

Important Files Changed

Filename	Overview
apps/desktop/src-tauri/src/deeplink_actions.rs	Broadly expands production deep-link parsing and execution, including sensitive screenshot and recording-state operations without an authorization or confirmation boundary.
packages/recorder-core/src/recorder-utils.ts	Safely trims share URLs, rejects empty results, and opens only the normalized value.
packages/recorder-core/tests/recorder-utils.test.ts	Extends the existing missing-URL test to cover whitespace-only input.

Prompt To Fix All With AI

### Issue 1
apps/desktop/src-tauri/src/deeplink_actions.rs:52-59
**Deep links bypass user consent**

When a webpage or local application invokes a registered URL such as `cap-desktop://take_screenshot`, `cap-desktop://set_camera?device_id=none`, or `cap-desktop://pause`, the unguarded deep-link path immediately captures the cursor's display or mutates recording and input state, causing screenshots to be written or recording settings to change without the user's intent.

**How this was verified:** The registered deep-link callbacks were traced through the unguarded parser and executor to screenshot persistence and recording or device-state mutation functions.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(recorder-core): trim and validate wh..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[superagent-security]

Manage your Superagent protection

Superagent has paused scans for this repository because this unlinked GitHub App installation has used all three included PR scans.

You have 0 of 3 included PR scans remaining.

Create a free account to continue protection, manage scan settings, review security history, and control which repositories are protected.

[greptile-apps]

Deep links bypass user consent

When a webpage or local application invokes a registered URL such as cap-desktop://take_screenshot, cap-desktop://set_camera?device_id=none, or cap-desktop://pause, the unguarded deep-link path immediately captures the cursor's display or mutates recording and input state, causing screenshots to be written or recording settings to change without the user's intent.

How this was verified: The registered deep-link callbacks were traced through the unguarded parser and executor to screenshot persistence and recording or device-state mutation functions.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/desktop/src-tauri/src/deeplink_actions.rs
Line: 52-59

Comment:
**Deep links bypass user consent**

When a webpage or local application invokes a registered URL such as `cap-desktop://take_screenshot`, `cap-desktop://set_camera?device_id=none`, or `cap-desktop://pause`, the unguarded deep-link path immediately captures the cursor's display or mutates recording and input state, causing screenshots to be written or recording settings to change without the user's intent.

**How this was verified:** The registered deep-link callbacks were traced through the unguarded parser and executor to screenshot persistence and recording or device-state mutation functions.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.