Lotus CIandClaude Opus 5.5
5c3ac68328
The bundled Element Call page ran on the app's own origin (http://localhost:44548), so the call frame could read the app's storage (login token) and DOM. Serve it from http://127.0.0.1:44548 instead: the same local server and bundle, a different origin. - The local server binds 127.0.0.1 explicitly. The app is still loaded as http://localhost:44548 (its storage stays where it is; the engines try 127.0.0.1 for `localhost`). Binding the name `localhost` could pick ::1 only (Windows lists it first), and then 127.0.0.1 wouldn't answer. - config.json: desktopCallOrigin = http://127.0.0.1:44548. cinny loads the call page from there only when this is set (cinny #43 PR). - CSP frame-src allows http://127.0.0.1:44548. - Permissions (on top of #22): the call page's origin gets microphone/ camera/screen only; nothing else. - The call page gets no IPC: the capability only matches http://localhost:44548. Tested (Linux release build): the server listens on 127.0.0.1:44548 and the app loads as http://localhost:44548; the call page loads from 127.0.0.1 inside the app under its CSP; from that frame parent.localStorage and parent.document are SecurityError, while a same-origin frame (the old setup) reads the app's storage. The call itself was tested in a simulated desktop (Chromium, the WebView2 engine) against a local Synapse + LiveKit; see the cinny PR. Rust tests 17 passed; Windows code type-checked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA