From 97f940f2615a5340b76127eb7fb30ee08a15766c Mon Sep 17 00:00:00 2001
From: Lucas Rayan <lucas.guerra@pop-pe.rnp.br>
Date: Sun, 18 Oct 2026 18:09:28 -0300
Subject: [PATCH] =?UTF-8?q?fix:=20v=C3=ADdeo=20no=20app=20Linux=20travava?=
 =?UTF-8?q?=20a=20janela;=20abrir=20no=20player=20do=20sistema=20(0.3.2)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

O AppImage traz o WebKitGTK sem os plugins de mídia do GStreamer; criar um <video>
derrubava o processo da página. O app Linux não cria mais <video>/<audio>: oferece
"Abrir no player do sistema". Clicar no preview abre a visualização grande.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                         |   8 ++
 Cargo.lock                           |   5 +-
 Cargo.toml                           |   2 +-
 apps/gui/src-tauri/Cargo.toml        |   2 +-
 apps/gui/src-tauri/tauri.conf.json   |   2 +-
 apps/gui/ui/app.css                  |   8 +-
 apps/gui/ui/app.js                   |   2 +-
 apps/gui/ui/explorer.js              |  14 +++-
 apps/gui/ui/preview.js               |  31 +++++++-
 crates/guara-cli/src/serve.rs        |  81 ++------------------
 crates/guara-core/Cargo.toml         |   1 +
 crates/guara-core/src/external.rs    | 110 +++++++++++++++++++++++++++
 crates/guara-core/src/http.rs        | 103 +++++++++++++++++++++++++
 crates/guara-core/src/lib.rs         |   2 +
 crates/guara-core/src/owner.rs       |   2 +
 crates/guara-core/src/service.rs     |  13 ++++
 crates/guara-core/tests/forensics.rs |  46 +++++++++++
 17 files changed, 345 insertions(+), 87 deletions(-)
 create mode 100644 crates/guara-core/src/external.rs
 create mode 100644 crates/guara-core/src/http.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8316f52..d5c9446 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 Formato baseado em [Keep a Changelog](https://keepachangelog.com/pt-BR/1.1.0/); versões seguem SemVer.
 
+## [0.3.2] - 2026-10-18
+
+### Corrigido
+- **Travamento ao clicar em um vídeo no app para Linux.** O AppImage traz o WebKitGTK sem os plugins de mídia do GStreamer: ao criar um `<video>` ou `<audio>` o processo da página morria e a janela ficava congelada. Agora o app para Linux nunca cria esses elementos; vídeo e áudio têm o botão "Abrir no player do sistema", que copia o arquivo para uma pasta temporária do usuário e o abre no player padrão (inclusive quando o Guará roda como administrador). No navegador (`guara ui`) e nos demais sistemas o vídeo continua tocando dentro do app, mas só na tela grande, nunca no painel pequeno.
+
+### Alterado
+- Clicar na pré-visualização do painel de detalhes abre a visualização grande (imagem, PDF, documento e demais tipos), agora maior (até 98% da largura e 95% da altura da janela).
+
 ## [0.3.1] - 2026-10-18
 
 ### Adicionado
diff --git a/Cargo.lock b/Cargo.lock
index 25bf418..d3e529b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -317,7 +317,7 @@ dependencies = [
 
 [[package]]
 name = "guara-cli"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "clap",
  "ctrlc",
@@ -329,7 +329,7 @@ dependencies = [
 
 [[package]]
 name = "guara-core"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "flate2",
  "image",
@@ -343,6 +343,7 @@ dependencies = [
  "sha2",
  "tempfile",
  "thiserror",
+ "tiny_http",
  "windows-sys 0.59.0",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 982cbe1..c6429c7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/guara-core", "crates/guara-cli"]
 
 [workspace.package]
-version = "0.3.1"
+version = "0.3.2"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lucasrguerra/guara"
diff --git a/apps/gui/src-tauri/Cargo.toml b/apps/gui/src-tauri/Cargo.toml
index 95450de..275644b 100644
--- a/apps/gui/src-tauri/Cargo.toml
+++ b/apps/gui/src-tauri/Cargo.toml
@@ -3,7 +3,7 @@
 [package]
 name = "guara-gui"
 description = "Guará: interface gráfica de recuperação de arquivos"
-version = "0.3.1"
+version = "0.3.2"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lucasrguerra/guara"
diff --git a/apps/gui/src-tauri/tauri.conf.json b/apps/gui/src-tauri/tauri.conf.json
index 055a9d5..13478bc 100644
--- a/apps/gui/src-tauri/tauri.conf.json
+++ b/apps/gui/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Guara",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "identifier": "dev.guara.app",
   "build": {
     "frontendDist": "../ui"
diff --git a/apps/gui/ui/app.css b/apps/gui/ui/app.css
index 8684b18..bd87465 100644
--- a/apps/gui/ui/app.css
+++ b/apps/gui/ui/app.css
@@ -323,7 +323,7 @@ code, .mono { overflow-wrap: anywhere; font-family: var(--mono); font-size: .92e
 .pv-pdfbar .pg { font-size: 13px; color: var(--text-2); min-width: 110px; text-align: center; }
 .pv-pdfwrap { padding: 8px; } .pv-canvas { display: block; background: #fff; box-shadow: 0 2px 14px rgba(0, 0, 0, .25); }
 
-dialog.lightbox { width: min(1180px, 96vw); height: min(90vh, 920px); padding: 0; display: none; grid-template-rows: auto minmax(0, 1fr) auto; overflow: hidden; }
+dialog.lightbox { width: min(1760px, 98vw); height: min(95vh, 1100px); padding: 0; display: none; grid-template-rows: auto minmax(0, 1fr) auto; overflow: hidden; }
 dialog.lightbox[open] { display: grid; }
 .lb-head, .lb-foot { display: flex; gap: 12px; align-items: center; padding: 12px 16px; }
 .lb-head { border-bottom: 1px solid var(--line); } .lb-foot { border-top: 1px solid var(--line); flex-wrap: wrap; justify-content: space-between; }
@@ -454,3 +454,9 @@ dialog.lightbox[open] { display: grid; }
 .hit .ctx { font-family: var(--mono); font-size: 12px; overflow-wrap: anywhere; color: var(--text-2); }
 .hit mark { background: var(--accent-soft); color: var(--accent); padding: 0 2px; border-radius: 3px; font-weight: 600; }
 @media (max-width: 860px) { .hit { grid-template-columns: 100px 1fr; } .hit span:nth-child(2), .hit span:nth-child(3) { display: none; } }
+
+.xp-insp #xpPv { cursor: zoom-in; }
+.pv-card { width: 100%; min-height: 220px; display: grid; place-content: center; justify-items: center; gap: 10px; padding: 24px; text-align: center; }
+.pv-card b { overflow-wrap: anywhere; font-size: 15px; }
+.pv-bigicon { font-size: 52px; line-height: 1; }
+.pv-why { max-width: 38ch; font-size: 12.5px; color: var(--text-2); }
diff --git a/apps/gui/ui/app.js b/apps/gui/ui/app.js
index 6ccaa65..023f0b1 100644
--- a/apps/gui/ui/app.js
+++ b/apps/gui/ui/app.js
@@ -431,7 +431,7 @@ function renderScan() {
   </div>`;
   $('#backBtn').onclick = () => (S.device ? openDevice(S.device) : renderHome());
   $('#progressArea').onclick = onProgressClick;
-  EX = createExplorer({ host: $('#xpHost'), job: S.job, rpc, esc, human, fileUrl, thumbUrl, onRecover: recover, toast });
+  EX = createExplorer({ host: $('#xpHost'), job: S.job, rpc, esc, human, fileUrl, thumbUrl, onRecover: recover, toast, noInlineMedia: !!tauri && /Linux/i.test(navigator.userAgent) });
 }
 
 function paintStatus() {
diff --git a/apps/gui/ui/explorer.js b/apps/gui/ui/explorer.js
index 78ebc6c..6d576ca 100644
--- a/apps/gui/ui/explorer.js
+++ b/apps/gui/ui/explorer.js
@@ -31,6 +31,11 @@ const I = {
 
 export function createExplorer(deps) {
   const { host, job, rpc, esc, human, fileUrl, thumbUrl, onRecover, toast } = deps;
+  const inlineMedia = !deps.noInlineMedia;
+  const openExternal = (it) => {
+    toast('Preparando para abrir no player do sistema…');
+    rpc('open_external', { job, id: it.id }).then(() => toast('Aberto no player do sistema')).catch((err) => toast(err.message));
+  };
   const E = {
     filters: { category: null, year: null, month: null, undated: false, folder: null, camera: null, origin: null, minConf: null, gps: false, dedupe: false, bigOnly: false, mp1: false, query: '' },
     sort: 'date',
@@ -570,7 +575,12 @@ export function createExplorer(deps) {
       <dl class="kv"><dt>Pasta</dt><dd>${esc(it.dir || (it.origin === 'carved' ? 'Encontrado por assinatura' : '/'))}</dd>${timesHtml(it)}${it.camera ? `<dt>Câmera</dt><dd>${esc(it.camera)}</dd>` : ''}${it.px ? `<dt>Resolução</dt><dd>${it.px[0]} × ${it.px[1]} px</dd>` : ''}</dl>
       <div class="xp-meta" id="xpMeta"></div>
       <div class="row"><button class="btn sm" data-i="full">Tela cheia</button><button class="btn primary sm" data-i="rec1">Recuperar este arquivo</button></div>`;
-    stopPv = renderPreview($('#xpPv'), it, { url, thumb: kindOf(it) === 'image' });
+    stopPv = renderPreview($('#xpPv'), it, { url, thumb: kindOf(it) === 'image', inlineMedia, onOpen: () => openLightbox(idxOf(it.id)), onExternal: () => openExternal(it) });
+    // clicar na miniatura abre o modal grande
+    $('#xpPv').addEventListener('click', (ev) => {
+      if (ev.target.closest('button, a, .pv-pdfbar')) return;
+      openLightbox(idxOf(it.id));
+    });
     const my = ++metaToken;
     rpc('metadata', { job, id: it.id }).then((m) => {
       if (my !== metaToken || !$('#xpMeta')) return;
@@ -602,7 +612,7 @@ export function createExplorer(deps) {
       <div class="lb-body"><div class="viewer large" id="lbHost"></div></div>
       <div class="lb-foot"><span class="sub">${it.note ? esc(it.note) : '← → para navegar · Esc para fechar'}</span><button class="btn primary sm" id="lbRec">Recuperar este arquivo</button></div>`;
     stopLb?.();
-    stopLb = renderPreview(d.querySelector('#lbHost'), it, { url: fileUrl(job, it.id), large: true });
+    stopLb = renderPreview(d.querySelector('#lbHost'), it, { url: fileUrl(job, it.id), large: true, inlineMedia, onExternal: () => openExternal(it) });
     const go = (n) => { const t = i + n; if (t >= 0 && t < E.items.length) { setCursor(t, { reveal: true }); openLightbox(t); } };
     d.querySelector('#lbPrev').onclick = () => go(-1);
     d.querySelector('#lbNext').onclick = () => go(1);
diff --git a/apps/gui/ui/preview.js b/apps/gui/ui/preview.js
index b6fd798..cbeca89 100644
--- a/apps/gui/ui/preview.js
+++ b/apps/gui/ui/preview.js
@@ -131,8 +131,10 @@ async function image(host, item, url, state, thumb) {
       if (state.dead) return resolve();
       host.innerHTML = '';
       host.appendChild(img);
-      host.classList.add('zoomable');
-      img.onclick = () => host.classList.toggle('actual');
+      if (!thumb) {
+        host.classList.add('zoomable');
+        img.onclick = () => host.classList.toggle('actual');
+      }
       if (!thumb) note(host, `${img.naturalWidth} × ${img.naturalHeight} px. Clique para alternar entre ajustar e tamanho real.`);
       resolve();
     };
@@ -272,12 +274,35 @@ async function zip(host, item, url, state) {
 
 // ------------------------------------------------------------------ API
 /** Desenha a pré-visualização de `item` dentro de `host`. Devolve uma função de limpeza. */
-export function renderPreview(host, item, { url, large = false, thumb = false }) {
+function mediaCard(host, item, kind, { large, inlineMedia, onOpen, onExternal }) {
+  const ico = kind === 'video' ? '🎞' : '🎵';
+  const canInline = inlineMedia && large;
+  host.innerHTML = `<div class="pv-card"><div class="pv-bigicon" aria-hidden="true">${ico}</div>
+    <b>${esc(item.name)}</b><span class="sub">${esc(KIND_LABEL[kind])} · ${human(item.size)}</span>
+    ${inlineMedia
+      ? '<button class="btn primary" data-pv="open">Reproduzir em tela grande</button>'
+      : '<button class="btn primary" data-pv="ext">Abrir no player do sistema</button><span class="pv-why">Neste app o ' + (kind === 'video' ? 'vídeo' : 'áudio') + ' abre no seu player: o navegador embutido do Linux não traz os codecs e travaria a janela.</span>'}
+  </div>`;
+  host.onclick = (e) => {
+    const a = e.target.closest('[data-pv]')?.dataset.pv;
+    if (a === 'open') onOpen?.();
+    else if (a === 'ext') onExternal?.();
+  };
+  void canInline;
+}
+
+export function renderPreview(host, item, { url, large = false, thumb = false, inlineMedia = true, onOpen = null, onExternal = null }) {
   const state = { dead: false, cleanup: [] };
   host.dataset.url = url;
   host.classList.remove('zoomable', 'actual');
   host.innerHTML = '<div class="pv-loading"><i></i></div>';
   const kind = kindOf(item);
+  // Vídeo e áudio: nunca criamos <video>/<audio> no painel pequeno, e no Linux do app desktop
+  // (WebKitGTK sem plugins de mídia) nem na tela grande, pois o processo da página morre.
+  if ((kind === 'video' || kind === 'audio') && (!large || !inlineMedia)) {
+    mediaCard(host, item, kind, { large, inlineMedia, onOpen, onExternal });
+    return () => { state.dead = true; };
+  }
   (async () => {
     try {
       if (!item.size) { host.innerHTML = ''; note(host, 'Arquivo vazio.'); return; }
diff --git a/crates/guara-cli/src/serve.rs b/crates/guara-cli/src/serve.rs
index e67f093..4377d38 100644
--- a/crates/guara-cli/src/serve.rs
+++ b/crates/guara-cli/src/serve.rs
@@ -4,7 +4,7 @@ use guara_core::service::Engine;
 use serde_json::json;
 use std::io::Read;
 use std::sync::Arc;
-use tiny_http::{Header, Method, Request, Response, Server, StatusCode};
+use tiny_http::{Header, Method, Request, Response, Server};
 
 const INDEX: &str = include_str!("../../../apps/gui/ui/index.html");
 const CSS: &str = include_str!("../../../apps/gui/ui/app.css");
@@ -52,7 +52,7 @@ fn header(name: &str, value: &str) -> Header {
     Header::from_bytes(name.as_bytes(), value.as_bytes()).unwrap()
 }
 
-fn handle(mut req: Request, eng: &Engine, token: &str, hosts: &[String]) {
+fn handle(req: Request, eng: &Engine, token: &str, hosts: &[String]) {
     let host_ok = req
         .headers()
         .iter()
@@ -61,8 +61,11 @@ fn handle(mut req: Request, eng: &Engine, token: &str, hosts: &[String]) {
         let _ = req.respond(Response::from_string("host inválido").with_status_code(403));
         return;
     }
+    let Some(mut req) = guara_core::http::handle_media(eng, token, req) else {
+        return;
+    };
     let full = req.url().to_string();
-    let (path, query) = full.split_once('?').unwrap_or((full.as_str(), ""));
+    let (path, _query) = full.split_once('?').unwrap_or((full.as_str(), ""));
     let ct = |v: &str| header("Content-Type", v);
     match (req.method().clone(), path) {
         (Method::Get, "/") | (Method::Get, "/index.html") => {
@@ -105,78 +108,6 @@ fn handle(mut req: Request, eng: &Engine, token: &str, hosts: &[String]) {
                 Response::from_string(PDF_WORKER).with_header(ct("text/javascript; charset=utf-8")),
             );
         }
-        (Method::Get, p) if p.starts_with("/thumb/") => {
-            let tok_ok = query
-                .split('&')
-                .any(|kv| kv.strip_prefix("t=") == Some(token));
-            if !tok_ok {
-                let _ = req.respond(Response::from_string("token inválido").with_status_code(401));
-                return;
-            }
-            let mut it = p.trim_start_matches("/thumb/").split('/');
-            let (job, id) = (
-                it.next().unwrap_or(""),
-                it.next().and_then(|s| s.parse::<u64>().ok()),
-            );
-            let size = query
-                .split('&')
-                .find_map(|kv| kv.strip_prefix("s="))
-                .and_then(|v| v.parse::<u32>().ok())
-                .unwrap_or(256);
-            let Some(id) = id else {
-                let _ = req.respond(Response::from_string("id inválido").with_status_code(400));
-                return;
-            };
-            match eng.thumb(job, id, size) {
-                Ok(bytes) => {
-                    let resp = Response::from_data(bytes.as_ref().clone())
-                        .with_header(ct("image/jpeg"))
-                        .with_header(header("Cache-Control", "private, max-age=3600"));
-                    let _ = req.respond(resp);
-                }
-                Err(code) => {
-                    let _ =
-                        req.respond(Response::from_string("sem miniatura").with_status_code(code));
-                }
-            }
-        }
-        (Method::Get, p) if p.starts_with("/file/") => {
-            let tok_ok = query
-                .split('&')
-                .any(|kv| kv.strip_prefix("t=") == Some(token));
-            if !tok_ok {
-                let _ = req.respond(Response::from_string("token inválido").with_status_code(401));
-                return;
-            }
-            let mut it = p.trim_start_matches("/file/").split('/');
-            let (job, id) = (
-                it.next().unwrap_or(""),
-                it.next().and_then(|s| s.parse::<u64>().ok()),
-            );
-            let range = req
-                .headers()
-                .iter()
-                .find(|h| h.field.equiv("Range"))
-                .map(|h| h.value.as_str().to_string());
-            let Some(id) = id else {
-                let _ = req.respond(Response::from_string("id inválido").with_status_code(400));
-                return;
-            };
-            match eng.file_slice(job, id, range.as_deref()) {
-                Ok(slice) => {
-                    let (status, len) = (slice.status(), slice.len() as usize);
-                    let headers: Vec<Header> =
-                        slice.headers().iter().map(|(k, v)| header(k, v)).collect();
-                    let resp =
-                        Response::new(StatusCode(status), headers, slice.reader(), Some(len), None);
-                    let _ = req.respond(resp);
-                }
-                Err(code) => {
-                    let _ =
-                        req.respond(Response::from_string("indisponível").with_status_code(code));
-                }
-            }
-        }
         (Method::Post, p) if p.starts_with("/rpc/") => {
             let ok = req
                 .headers()
diff --git a/crates/guara-core/Cargo.toml b/crates/guara-core/Cargo.toml
index 86da513..52e2b94 100644
--- a/crates/guara-core/Cargo.toml
+++ b/crates/guara-core/Cargo.toml
@@ -18,6 +18,7 @@ jpeg-encoder = "0.6"
 image = { version = "0.25", default-features = false, features = ["png", "gif", "bmp", "webp"] }
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
 thiserror = "2"
+tiny_http = "0.12"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
diff --git a/crates/guara-core/src/external.rs b/crates/guara-core/src/external.rs
new file mode 100644
index 0000000..388c4c9
--- /dev/null
+++ b/crates/guara-core/src/external.rs
@@ -0,0 +1,110 @@
+//! Abre um arquivo achado no aplicativo padrão do sistema (player de vídeo, leitor
+//! de PDF, etc.). Usado quando o WebView do app não consegue reproduzir a mídia:
+//! o WebKitGTK empacotado no AppImage não traz os plugins de mídia do GStreamer e
+//! o processo da página morre ao criar um `<video>`.
+
+use crate::error::{Error, Result};
+use crate::fs::sanitize_name;
+use crate::types::Found;
+use std::path::{Path, PathBuf};
+
+/// Pasta temporária própria do usuário (nunca compartilhada).
+fn temp_dir() -> PathBuf {
+    let uid = crate::owner::invoking_user()
+        .map(|u| u.uid.to_string())
+        .unwrap_or_else(|| {
+            #[cfg(unix)]
+            {
+                // SAFETY: getuid não tem pré-condições.
+                unsafe { libc::getuid() }.to_string()
+            }
+            #[cfg(not(unix))]
+            {
+                "user".to_string()
+            }
+        });
+    std::env::temp_dir().join(format!("guara-abrir-{uid}"))
+}
+
+/// Remove cópias com mais de um dia.
+fn cleanup(dir: &Path) {
+    let Ok(rd) = std::fs::read_dir(dir) else {
+        return;
+    };
+    let limit = std::time::Duration::from_secs(24 * 3600);
+    for e in rd.flatten() {
+        if let Ok(age) = e
+            .metadata()
+            .and_then(|m| m.modified())
+            .and_then(|t| t.elapsed().map_err(std::io::Error::other))
+        {
+            if age > limit {
+                let _ = std::fs::remove_file(e.path());
+            }
+        }
+    }
+}
+
+/// Copia o arquivo achado para uma pasta temporária do usuário e o abre no aplicativo padrão.
+pub fn open_found(src: &dyn crate::source::Source, f: &Found) -> Result<PathBuf> {
+    const MAX: u64 = 8 * 1024 * 1024 * 1024;
+    if f.size > MAX {
+        return Err(Error::msg("Arquivo grande demais para abrir direto. Recupere-o e abra pelo seu gerenciador de arquivos."));
+    }
+    let dir = temp_dir();
+    crate::owner::create_dir_all_owned(&dir)?;
+    cleanup(&dir);
+    let path = dir.join(format!("{}-{}", f.id, sanitize_name(&f.name)));
+    let _ = std::fs::remove_file(&path);
+    crate::recover::write_file(src, f, &path)?;
+    open_path(&path)
+        .map_err(|e| Error::msg(format!("Não foi possível abrir {}: {e}", path.display())))?;
+    Ok(path)
+}
+
+/// Abre o caminho com o aplicativo padrão, na sessão do usuário real mesmo se formos root.
+pub fn open_path(path: &Path) -> std::io::Result<()> {
+    use std::process::{Command, Stdio};
+    #[cfg(target_os = "linux")]
+    let mut cmd = if let Some(u) = crate::owner::invoking_user() {
+        let mut c = Command::new("runuser");
+        c.args(["-u", &u.name, "--", "env"]);
+        for k in ["DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY"] {
+            if let Ok(v) = std::env::var(k) {
+                c.arg(format!("{k}={v}"));
+            }
+        }
+        c.arg(format!("XDG_RUNTIME_DIR=/run/user/{}", u.uid));
+        c.arg(format!(
+            "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/{}/bus",
+            u.uid
+        ));
+        c.arg("xdg-open").arg(path);
+        c
+    } else {
+        let mut c = Command::new("xdg-open");
+        c.arg(path);
+        c
+    };
+    #[cfg(target_os = "macos")]
+    let mut cmd = {
+        let mut c = Command::new("open");
+        c.arg(path);
+        c
+    };
+    #[cfg(windows)]
+    let mut cmd = {
+        let mut c = Command::new("cmd");
+        c.args(["/C", "start", ""]).arg(path);
+        c
+    };
+    let mut child = cmd
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .spawn()?;
+    std::thread::spawn(move || {
+        let _ = child.wait();
+    });
+    Ok(())
+}
diff --git a/crates/guara-core/src/http.rs b/crates/guara-core/src/http.rs
new file mode 100644
index 0000000..108a8bb
--- /dev/null
+++ b/crates/guara-core/src/http.rs
@@ -0,0 +1,103 @@
+//! Rotas HTTP de mídia (`/file` com Range e `/thumb`) compartilhadas pelo modo `guara ui`.
+
+use crate::service::Engine;
+use tiny_http::{Header, Method, Request, Response, StatusCode};
+
+pub fn header(name: &str, value: &str) -> Header {
+    Header::from_bytes(name.as_bytes(), value.as_bytes()).unwrap()
+}
+
+/// O cabeçalho Host bate com um dos endereços esperados (defesa contra DNS rebinding)?
+pub fn host_ok(req: &Request, hosts: &[String]) -> bool {
+    req.headers()
+        .iter()
+        .any(|h| h.field.equiv("Host") && hosts.iter().any(|x| x == h.value.as_str()))
+}
+
+/// Responde `/file/<job>/<id>` (com Range) e `/thumb/<job>/<id>?s=NNN`.
+/// Devolve a requisição quando ela não é uma rota de mídia.
+pub fn handle_media(eng: &Engine, token: &str, req: Request) -> Option<Request> {
+    let full = req.url().to_string();
+    let (path, query) = full.split_once('?').unwrap_or((full.as_str(), ""));
+    let is_file = path.starts_with("/file/");
+    let is_thumb = path.starts_with("/thumb/");
+    if !(is_file || is_thumb) {
+        return Some(req);
+    }
+    if req.method() == &Method::Options {
+        let r = Response::empty(204)
+            .with_header(header("Access-Control-Allow-Origin", "*"))
+            .with_header(header("Access-Control-Allow-Headers", "Range"))
+            .with_header(header("Access-Control-Allow-Methods", "GET, OPTIONS"));
+        let _ = req.respond(r);
+        return None;
+    }
+    if req.method() != &Method::Get {
+        let _ = req.respond(Response::from_string("método não permitido").with_status_code(405));
+        return None;
+    }
+    if !query
+        .split('&')
+        .any(|kv| kv.strip_prefix("t=") == Some(token))
+    {
+        let _ = req.respond(Response::from_string("token inválido").with_status_code(401));
+        return None;
+    }
+    let mut it = path
+        .trim_start_matches("/file/")
+        .trim_start_matches("/thumb/")
+        .split('/');
+    let (job, id) = (
+        it.next().unwrap_or(""),
+        it.next().and_then(|s| s.parse::<u64>().ok()),
+    );
+    let Some(id) = id else {
+        let _ = req.respond(Response::from_string("id inválido").with_status_code(400));
+        return None;
+    };
+    if is_thumb {
+        let size = query
+            .split('&')
+            .find_map(|kv| kv.strip_prefix("s="))
+            .and_then(|v| v.parse::<u32>().ok())
+            .unwrap_or(256);
+        match eng.thumb(job, id, size) {
+            Ok(bytes) => {
+                let r = Response::from_data(bytes.as_ref().clone())
+                    .with_header(header("Content-Type", "image/jpeg"))
+                    .with_header(header("Cache-Control", "private, max-age=3600"))
+                    .with_header(header("Access-Control-Allow-Origin", "*"));
+                let _ = req.respond(r);
+            }
+            Err(code) => {
+                let _ = req.respond(
+                    Response::from_string("sem miniatura")
+                        .with_status_code(code)
+                        .with_header(header("Access-Control-Allow-Origin", "*")),
+                );
+            }
+        }
+        return None;
+    }
+    let range = req
+        .headers()
+        .iter()
+        .find(|h| h.field.equiv("Range"))
+        .map(|h| h.value.as_str().to_string());
+    match eng.file_slice(job, id, range.as_deref()) {
+        Ok(slice) => {
+            let (status, len) = (slice.status(), slice.len() as usize);
+            let headers: Vec<Header> = slice.headers().iter().map(|(k, v)| header(k, v)).collect();
+            let resp = Response::new(StatusCode(status), headers, slice.reader(), Some(len), None);
+            let _ = req.respond(resp);
+        }
+        Err(code) => {
+            let _ = req.respond(
+                Response::from_string("indisponível")
+                    .with_status_code(code)
+                    .with_header(header("Access-Control-Allow-Origin", "*")),
+            );
+        }
+    }
+    None
+}
diff --git a/crates/guara-core/src/lib.rs b/crates/guara-core/src/lib.rs
index f77020b..56a19e2 100644
--- a/crates/guara-core/src/lib.rs
+++ b/crates/guara-core/src/lib.rs
@@ -7,8 +7,10 @@ pub mod carve;
 pub mod device;
 pub mod error;
 pub mod explorer;
+pub mod external;
 pub mod fs;
 pub mod hashing;
+pub mod http;
 pub mod image;
 pub mod meta;
 pub mod owner;
diff --git a/crates/guara-core/src/owner.rs b/crates/guara-core/src/owner.rs
index ef11ef6..bfeddf7 100644
--- a/crates/guara-core/src/owner.rs
+++ b/crates/guara-core/src/owner.rs
@@ -7,6 +7,7 @@ use std::path::{Path, PathBuf};
 
 #[derive(Debug, Clone)]
 pub struct User {
+    pub name: String,
     pub uid: u32,
     pub gid: u32,
     pub home: PathBuf,
@@ -41,6 +42,7 @@ pub fn lookup_user(passwd: &str, uid: Option<u32>, name: Option<&str>) -> Option
         };
         if uid == Some(fuid) || (uid.is_none() && name == Some(f[0])) {
             return Some(User {
+                name: f[0].to_string(),
                 uid: fuid,
                 gid: fgid,
                 home: PathBuf::from(f[5]),
diff --git a/crates/guara-core/src/service.rs b/crates/guara-core/src/service.rs
index ef665d3..7c61ab0 100644
--- a/crates/guara-core/src/service.rs
+++ b/crates/guara-core/src/service.rs
@@ -736,6 +736,15 @@ impl Engine {
             }
             "status" => self.status(&s("job")?)?,
             "facets" => self.facets(&s("job")?)?,
+            "open_external" => {
+                let id = p
+                    .get("id")
+                    .and_then(|v| v.as_u64())
+                    .ok_or_else(|| Error::msg("id ausente"))?;
+                let (f, src) = self.open_file(&s("job")?, id)?;
+                let path = crate::external::open_found(src.as_ref(), &f)?;
+                json!({ "path": path.to_string_lossy() })
+            }
             "export_csv" => {
                 let q: Option<Query> = p
                     .get("query")
@@ -1051,6 +1060,10 @@ impl FileSlice {
                 "sandbox; default-src 'none'".into(),
             ),
             ("Access-Control-Allow-Origin", "*".into()),
+            (
+                "Access-Control-Expose-Headers",
+                "Content-Range, Content-Length, Accept-Ranges".into(),
+            ),
             ("Content-Disposition", "inline".into()),
         ];
         if self.partial {
diff --git a/crates/guara-core/tests/forensics.rs b/crates/guara-core/tests/forensics.rs
index 6eed391..6d2b7c8 100644
--- a/crates/guara-core/tests/forensics.rs
+++ b/crates/guara-core/tests/forensics.rs
@@ -553,3 +553,49 @@ fn png_truncado_seguido_de_texto_nao_vira_arquivo_gigante() {
     let h = signatures::detect(&MemSource(ok.clone()), 0, &ok[..64], 8 << 30).unwrap();
     assert_eq!((h.len as usize, h.confidence), (n, Confidence::High));
 }
+
+// ------------------------------------------------------------------ abrir no player do sistema
+
+/// O vídeo é copiado para uma pasta temporária e entregue ao aplicativo padrão do sistema
+/// (aqui um `xdg-open`/`open` falso grava o que recebeu).
+#[cfg(any(target_os = "linux", target_os = "macos"))]
+#[test]
+fn abre_no_player_do_sistema() {
+    use std::os::unix::fs::PermissionsExt;
+    let bin = tempfile::tempdir().unwrap();
+    let marker = bin.path().join("recebido");
+    let name = if cfg!(target_os = "linux") {
+        "xdg-open"
+    } else {
+        "open"
+    };
+    let script = bin.path().join(name);
+    std::fs::write(
+        &script,
+        format!("#!/bin/sh\ncp \"$1\" '{}'\n", marker.display()),
+    )
+    .unwrap();
+    std::fs::set_permissions(&script, std::fs::Permissions::from_mode(0o755)).unwrap();
+    let old = std::env::var("PATH").unwrap_or_default();
+    std::env::set_var("PATH", format!("{}:{old}", bin.path().display()));
+    let content: Vec<u8> = (0..5000u32).map(|i| (i * 7) as u8).collect();
+    let mut f = resident("meu video.mp4", content.clone());
+    f.id = 42;
+    let path = external::open_found(&MemSource(vec![]), &f).unwrap();
+    std::env::set_var("PATH", old);
+    assert!(path
+        .file_name()
+        .unwrap()
+        .to_str()
+        .unwrap()
+        .starts_with("42-"));
+    for _ in 0..100 {
+        if marker.exists() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(30));
+    }
+    assert_eq!(std::fs::read(&marker).unwrap(), content);
+    assert_eq!(std::fs::read(&path).unwrap(), content);
+    let _ = std::fs::remove_file(path);
+}