feat: capture platform views in session replay screenshots

[turnipdabeets]

💡 Motivation and Context

Platform views (WebView, Google Maps, etc.) rendered by Flutter are composited outside the Flutter layer tree. Without explicit handling, session replay either silently skips them (leaving blank gaps) or could inadvertently capture sensitive content. This PR adds first-class support: views are masked by default (black box), with opt-in capture on a per-view or global basis.

Closes #393.
Addresses only part 1 of #151

Note I'll address fully native views in a separate PR, that will require iOS and android SDK work as well.

💚 How did you test it?

• iOS simulator (iPhone 17, iOS 26.4): ran all 8 example app test flows — masked views appear as black boxes in PostHog replay, captured WebViews show actual content
• Android device (Pixel 4, Android 13): same flows verified
• flutter test in posthog_flutter/ — all tests pass
• Confirmed 5-second timeout fires correctly when native channel does not respond

See videos:

Android: https://us.posthog.com/shared/AYnlFG5M-DGczYUYyn27g1EC55HvDg?t=1
https://us.posthog.com/shared/kWlqsDn5LUynHgynC0Mp1t_wnAfK5w?t=2

iOS: https://us.posthog.com/shared/2G_GNlw70uTOwJQOdVcZFY_uiDasTA?t=5

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran pnpm changeset to generate a changeset file

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Authored with Claude Code (claude-sonnet-4-6). Anna Garcia directed the work throughout.

Key decisions made during the session:

• iOS: no drawHierarchy fallback — when no WKWebView is found for the captured rect, we return nil rather than falling back to drawHierarchy over the full window. The fallback would composite any masked CALayer-backed platform view in the crop region and leak it into replay, defeating the privacy guarantee.
• Android: async bitmap compression — PixelCopy runs on the main thread; bitmap compression was moved to a single-thread executor to avoid blocking the UI thread during screenshot capture.
• 5-second timeout on captureNativeScreenshot — if the native side never calls result(), the Dart _isCapturing flag would stay true permanently and silently kill replay. The timeout degrades gracefully to null (frame skipped) rather than freezing.
• hasCapturedPlatformViews gate — scheduleFrame() is only forced when at least one platform view was actually captured, avoiding unnecessary redraws on screens with only masked views.

[greptile-apps]

Comments Outside Diff (2)

1. posthog_flutter/test/posthog_test.dart, line 2193-2207 (link)

   Broken test references non-existent property

   This test accesses config.sessionReplayConfig.capturePlatformViews, but PostHogSessionReplayConfig has no such property — the field added in this PR is maskAllPlatformViews. Dart will reject this at compile time, and the test cannot be one of the "47 passing tests" without this being caught. The final assertion also checks for a 'capturePlatformViews' key in the serialised map, but the config serialises under 'maskAllPlatformViews'. The test needs to be rewritten against the actual API: check that maskAllPlatformViews defaults to true, that it appears in the serialised map, and that setting it to false removes the masking.

2. example/ios/Runner.xcodeproj/project.pbxproj, line 208-218 (link)

   Personal developer credentials committed to a public repository

   DEVELOPMENT_TEAM = QU5XHRZES9 and PRODUCT_BUNDLE_IDENTIFIER = com.annagarcia.posthogFlutterExample appear to be personal Apple Developer credentials. Any contributor who clones this repo and tries to build the iOS example app will immediately hit a signing error (Xcode can't use someone else's team ID), and the personal name in the bundle identifier is clearly not intended to be canonical. These should revert to DEVELOPMENT_TEAM = "" (or the original value) and PRODUCT_BUNDLE_IDENTIFIER = com.example.posthogFlutterExample. The same values appear in the Release and profile build configurations in this file.

_{Reviews (1): Last reviewed commit: "feat: capture platform views in session ..." | Re-trigger Greptile}

[greptile-apps]

Security Review

• PostHogPlatformView(privacy: .mask) silently ignored when maskAllPlatformViews = false (screenshot_capturer.dart line 390): When the global flag is false, _collectPlatformViewRects() is never called, so per-view mask overrides are dropped. A developer who opts out of global masking but wraps a specific sensitive WebView in PostHogPlatformView(privacy: .mask) will find that view captured unmasked in replay. Fix: always traverse the element tree; pass the default privacy based on the global flag so undecorated views default to capture while explicit mask wrappers still apply.

_{Reviews (2): Last reviewed commit: "feat: capture platform views in session ..." | Re-trigger Greptile}