749 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	7fecf72107	fix(ipc): declare the app commands and grant them to the app origin (Tauri 2.11+ ACL) ... With Tauri 2.12 every app command was refused ("Command … not allowed by ACL"): the app is served from http://localhost:44548 (tauri-plugin- localhost), which Tauri treats as a remote origin, and since the GHSA-7gmj-67g7-phm9 fix app commands need an explicit capability. The Windows smoke test caught it (keychain, hotkeys, tray/taskbar/thumbbar, token migration all failed). build.rs now declares the 35 commands as an app manifest, and capabilities/migrated.json (scoped to http://localhost:44548 only) grants allow-<command> for each. The call page (http://127.0.0.1:44548) and any remote frame still get no IPC. gen/schemas regenerated by tauri-build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-26 01:59:33 -04:00
Lotus CIandClaude Opus 5.5	e3bc4e128f	fix(deps): move webview2-com to 0.39 and windows to 0.62 to match wry 0.57 ... The Tauri update brought wry 0.57, which uses webview2-com 0.39 / windows 0.62. Our Windows-only permission handler (lib.rs) still used webview2-com 0.38, so its handler type did not satisfy wry's ICoreWebView2 bound (E0277 on the Windows build). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-26 00:34:36 -04:00
Lotus CIandClaude Opus 5.5	3f7d00a965	chore(deps): Tauri 2.12.5, rustls 0.23.46, rustls-webpki 0.103.16 and other Rust security fixes ... OSV flagged the desktop crates; the ones that ship in the app: - tauri 2.10.3: origin confusion lets remote pages invoke local-only IPC commands (GHSA-7gmj-67g7-phm9, fixed in 2.11.1). The whole Tauri family moves together (2.12.5 / runtime 2.12.2 / macros 2.7.4 / utils 2.10.2). - rustls 0.23.37: TLS 1.3 handshake messages across encryption levels, ServerHello downgrade, secrets in Debug, Brotli cert allocation. - rustls-webpki 0.103.10: name constraints, distrusted intermediates, CRL panic. webpki-root-certs 1.0.11 drops the distrusted emSign roots. - tar 0.4.46 (PAX desync), tokio 1.54.1, anyhow, event-listener, serde_with. Left: zip 4 (build-time only), quick-xml (via plist in tauri-utils, already latest), glib 0.18 (GTK3 bindings Tauri uses), rand (custom-logger only), unmaintained notices. cargo check --locked passes on Linux. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-25 23:46:01 -04:00
Lotus CI	25f852fc34	chore: bump cinny submodule to e4591f66	2026-10-26 02:12:25 +00:00
Lotus CI	2b5c1ae0dd	chore: bump cinny submodule to 222927b5	2026-10-25 23:47:28 +00:00
Lotus CI	c56953ba27	chore: bump cinny submodule to 3b3bf8ab	2026-10-25 17:16:47 +00:00
Lotus CI	e9bacfa7ee	chore: bump cinny submodule to 299da879	2026-10-25 06:54:14 +00:00
Lotus CI	e09356c018	chore: bump cinny submodule to 0d4f2e4a	2026-10-25 04:48:14 +00:00
Lotus CI	89fc57c198	chore: bump cinny submodule to 02c852e1	2026-10-25 03:17:16 +00:00
Lotus CI	dc6038ad19	chore: bump cinny submodule to 5379eb04	2026-10-25 01:34:13 +00:00
Lotus CI	d47e54dad1	chore: bump cinny submodule to a5868495	2026-10-24 20:40:05 +00:00
Lotus CI	0bd0231ea4	chore: bump cinny submodule to 88446e89	2026-10-24 07:06:12 +00:00
Lotus CI	36818ae7ff	chore: bump cinny submodule to 43e166b8	2026-10-24 05:42:29 +00:00
Lotus CI	cb5f0fcffa	chore: bump cinny submodule to bfed37bf	2026-10-24 04:15:18 +00:00
Lotus CI	f01798799c	chore: bump cinny submodule to 45c3b166 (nightly catch-up)	2026-10-24 01:51:10 +00:00
jared	1af299d469	Merge pull request 'ci(windows-smoke): login tokens move to the keychain and stay signed in (cinny #105)' (#45) from ci/smoke-keychain into main	2026-10-23 20:34:17 -04:00
Lotus CIandClaude Opus 5.5	ad8c362854	ci(windows-smoke): login tokens move to the keychain and stay signed in (cinny #105) ... A full session in localStorage (pointed at an unreachable server) must move to Credential Manager on boot, leaving a token-less shell, and the app must still be signed in after a restart. Builds without cinny #105 step 2 report n/a. Cleans up the fake session and keychain entry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-23 20:34:15 -04:00
jared	8cb562841e	Merge pull request 'ci(windows-smoke): tray, badge, taskbar, thumbbar and media-control commands (#4, #7)' (#44) from ci/smoke-native-commands into main	2026-10-22 22:01:15 -04:00
Lotus CIandClaude Opus 5.5	fbb24dfce7	ci(windows-smoke): shell-only commands are n/a without a desktop ... Without Explorer the tray icon, taskbar overlay badge and thumbnail toolbar can't exist (E_FAIL / E_NOTIMPL). On a runner without an interactive desktop only those calls may fail, and the app must still respond. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-22 21:56:26 -04:00
Lotus CIandClaude Opus 5.5	31363e601c	ci(windows-smoke): tray, badge, taskbar, thumbbar and media-control commands (#4, #7) ... Call each with what cinny sends (badge, unread, call state, thumbbar, SMTC, taskbar progress, jump list, update-ready, flash), then reset; every call must succeed and the app must still respond. Refs #4, #7, #19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-22 21:21:47 -04:00
jared	8fe5d29be3	Merge pull request 'ci(windows-smoke): deep links while hidden/minimised, global hotkeys (#8, #2)' (#43) from ci/smoke-deeplink into main	2026-10-22 21:20:08 -04:00
Lotus CIandClaude Opus 5.5	f10a69ad19	ci(windows-smoke): visibility and hotkey checks need an interactive desktop ... The windows runner can't show a hidden window or inject keys (no interactive desktop: even a direct show() leaves it hidden). Check that first; the deep link must still reach the page and un-minimise, but window visibility and the global-hotkey round trip are n/a on such a runner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-22 21:15:10 -04:00
Lotus CIandClaude Opus 5.5	043a44665f	ci(windows-smoke): control check that a hidden window can be shown (#8) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-22 21:07:55 -04:00
Lotus CIandClaude Opus 5.5	0a887c29c4	ci(windows-smoke): system-wide voice hotkeys round trip (#2) ... Register PTT on F9 through set_global_hotkeys, press and release F9 via keybd_event, expect pressed and released lotus-global-hotkey events, and none after clearing the bindings. Refs #2, #19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-22 20:37:44 -04:00
Lotus CIandClaude Opus 5.5	2d3c54490f	ci(windows-smoke): a matrix: link while hidden or minimised (#8) ... Hide the window (then minimise it), open matrix:r/lotus-smoke-*:example.org through Windows (protocol handler -> second cinny.exe -> single-instance), and require the window to come back and the URL to reach the page as lotus-deeplink. Refs #8, #19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-22 20:36:47 -04:00
jared	2ea08f1c7e	Merge pull request 'ci(windows-smoke): update over the running app, as the auto-updater does (#1)' (#42) from ci/smoke-update-over-running into main	2026-10-22 20:31:36 -04:00
Lotus CI	eec6a7f2e9	chore: bump cinny submodule to 4120ccdb	2026-10-21 04:57:37 +00:00
Lotus CIandClaude Opus 5.5	852c67cc12	ci(windows-smoke): update over the running app, as the auto-updater does (#1) ... After the smoke test, start the installed app, run the installer in passive update mode (/P /UPDATE) while it runs, and only stop the app 3 s later. Passes when the installer finishes by itself (no "Error opening file for writing" dialog), exits 0, and has rewritten cinny.exe. Refs #1, #19 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-20 23:27:29 -04:00
Lotus CI	21406dd24f	chore: bump cinny submodule to 878a3471	2026-10-21 02:49:21 +00:00
Lotus CI	573ca6323d	chore: bump cinny submodule to 8784a815	2026-10-21 00:47:03 +00:00
Lotus CI	fb29e7fedc	chore: bump cinny submodule to ccbafdb1 (nightly catch-up)	2026-10-20 04:05:14 +00:00
Lotus CI	6a5f9778dd	chore: bump cinny submodule to 18732853	2026-10-19 22:13:31 +00:00
Lotus CI	bd16e9b62c	chore: bump cinny submodule to 5d2d7ca6	2026-10-19 21:09:34 +00:00
Lotus CI	2b2ce5f8e3	chore: bump cinny submodule to aaf75fe7	2026-10-19 16:52:28 +00:00
Lotus CI	a3eef4d82d	chore: bump cinny submodule to 8459427c	2026-10-19 08:42:05 +00:00
Lotus CI	93ae79fcb7	chore: bump cinny submodule to ef3849eb	2026-10-19 07:40:27 +00:00
Lotus CI	efa9c01cb2	chore: bump cinny submodule to a937831e (nightly catch-up)	2026-10-19 05:33:12 +00:00
jared	04ad8720b8	Merge pull request 'feat(release): signed SHA256SUMS.txt for the Linux downloads (#36)' (#41) from feat/linux-checksums into main	2026-10-19 00:37:44 -04:00
Lotus CIandClaude Opus 5.5	4b9f3c092d	feat(release): signed SHA256SUMS.txt for the Linux downloads (#36) ... The .deb and .pkg.tar.zst are not signed packages, and the in-app update prompt has users install them by hand, so nothing checked them. A new checksums job hashes the Linux downloads into SHA256SUMS.txt, signs it with the updater's minisign key (tauri signer) and uploads SHA256SUMS.txt + SHA256SUMS.txt.minisig. The README shows the verify-then-install command. Refs #36 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-19 00:35:30 -04:00
Lotus CI	4019cbaef1	chore: bump cinny submodule to 04605f26	2026-10-19 03:32:37 +00:00
jared	0d42803fd4	Merge pull request 'feat(tray): has_tray_host command so the first-close dialog can tell when there is no tray (#37)' (#40) from fix/no-tray-host into main	2026-10-18 19:44:55 -04:00
jared	7b8b94b185	Merge pull request 'docs: README for Lotus Chat desktop, not upstream Cinny (#35)' (#39) from docs/readme-lotus into main	2026-10-18 19:44:51 -04:00
jared	50f57bedc8	Merge pull request 'fix(csp): allow https: frames so room widgets load on desktop (#33)' (#38) from fix/csp-widgets into main	2026-10-18 19:44:48 -04:00
Lotus CI	89765d2265	chore: bump cinny submodule to d7bc6d94	2026-10-18 15:31:29 +00:00
Lotus CI	f94ee09c5f	chore: bump cinny submodule to a20e6859 (nightly catch-up)	2026-10-18 07:59:56 +00:00
Lotus CIandClaude Opus 5.5	e78b5b911d	feat(tray): has_tray_host command so the first-close dialog can tell when there is no tray (#37) ... On stock GNOME there is no StatusNotifier host, so choosing "Keep running in the tray" hid the window with no icon to bring it back. Expose whether org.kde.StatusNotifierWatcher has an owner on the session bus (always true off Linux); cinny's dialog then defaults to Quit and words the other option as "running in the background". Refs #37 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 02:41:03 -04:00
Lotus CIandClaude Opus 5.5	bf14f72db2	docs: README for Lotus Chat desktop, not upstream Cinny (#35) ... The README was upstream's: its download buttons and minisign key pointed at cinnyapp releases, so following it installed upstream Cinny and verified it against the wrong key. Point downloads at this repo's releases (NSIS exe, .deb, pacman package, AppImage), publish Lotus' updater key, and list the desktop features. Fixes #35 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 02:36:39 -04:00
Lotus CIandClaude Opus 5.5	5208d3ca33	fix(csp): allow https: frames so room widgets load on desktop (#33) ... The desktop CSP listed only known embed hosts in frame-src, so every room widget that is not one of them (Jitsi, Etherpad, Grafana, bots) showed a blank frame; the web deploy allows https: frames (#205). Match it. Widget frames are sandboxed by cinny and same-origin widget URLs are refused (isWidgetUrlSafe), so this does not widen what a widget can do to the app. Fixes #33 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 02:35:39 -04:00
Lotus CI	f5fc18e571	chore: bump cinny submodule to 3878a853	2026-10-17 22:06:46 +00:00
Lotus CI	8700cff292	chore: bump cinny submodule to 0c5cf410	2026-10-17 05:09:23 +00:00