Lotus CIandClaude Opus 5.5
5c3ac68328
The bundled Element Call page ran on the app's own origin (http://localhost:44548), so the call frame could read the app's storage (login token) and DOM. Serve it from http://127.0.0.1:44548 instead: the same local server and bundle, a different origin. - The local server binds 127.0.0.1 explicitly. The app is still loaded as http://localhost:44548 (its storage stays where it is; the engines try 127.0.0.1 for `localhost`). Binding the name `localhost` could pick ::1 only (Windows lists it first), and then 127.0.0.1 wouldn't answer. - config.json: desktopCallOrigin = http://127.0.0.1:44548. cinny loads the call page from there only when this is set (cinny #43 PR). - CSP frame-src allows http://127.0.0.1:44548. - Permissions (on top of #22): the call page's origin gets microphone/ camera/screen only; nothing else. - The call page gets no IPC: the capability only matches http://localhost:44548. Tested (Linux release build): the server listens on 127.0.0.1:44548 and the app loads as http://localhost:44548; the call page loads from 127.0.0.1 inside the app under its CSP; from that frame parent.localStorage and parent.document are SecurityError, while a same-origin frame (the old setup) reads the app's storage. The call itself was tested in a simulated desktop (Chromium, the WebView2 engine) against a local Synapse + LiveKit; see the cinny PR. Rust tests 17 passed; Windows code type-checked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
77 lines
2.9 KiB
JSON
77 lines
2.9 KiB
JSON
{
|
|
"bundle": {
|
|
"active": true,
|
|
"targets": "all",
|
|
"windows": {
|
|
"certificateThumbprint": null,
|
|
"digestAlgorithm": "sha256",
|
|
"timestampUrl": "",
|
|
"webviewInstallMode": {
|
|
"type": "downloadBootstrapper"
|
|
},
|
|
"nsis": {
|
|
"installMode": "currentUser",
|
|
"installerHooks": "./nsis/hooks.nsh"
|
|
},
|
|
"wix": {
|
|
"bannerPath": "wix/banner.bmp",
|
|
"dialogImagePath": "wix/dialogImage.bmp"
|
|
}
|
|
},
|
|
"icon": [
|
|
"icons/32x32.png",
|
|
"icons/128x128.png",
|
|
"icons/128x128@2x.png",
|
|
"icons/icon.icns",
|
|
"icons/icon.ico"
|
|
],
|
|
"resources": [],
|
|
"externalBin": [],
|
|
"copyright": "",
|
|
"category": "SocialNetworking",
|
|
"shortDescription": "Yet another matrix client",
|
|
"longDescription": "",
|
|
"macOS": {
|
|
"frameworks": [],
|
|
"minimumSystemVersion": "",
|
|
"exceptionDomain": "",
|
|
"signingIdentity": null,
|
|
"providerShortName": null,
|
|
"entitlements": null
|
|
},
|
|
"linux": {
|
|
"deb": {
|
|
"depends": []
|
|
}
|
|
},
|
|
"createUpdaterArtifacts": "v1Compatible"
|
|
},
|
|
"build": {
|
|
"beforeBuildCommand": "cd cinny && npm run build",
|
|
"frontendDist": "../cinny/dist",
|
|
"beforeDevCommand": "cd cinny && npm start",
|
|
"devUrl": "http://localhost:8080"
|
|
},
|
|
"productName": "Lotus Chat",
|
|
"mainBinaryName": "cinny",
|
|
"version": "4.12.2",
|
|
"identifier": "org.lotusguild.lotus-chat",
|
|
"plugins": {
|
|
"updater": {
|
|
"pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDM1N0Y0RThCQTJEQzY1NTkKUldSWlpkeWlpMDUvTlVjejMzN0E1U0FiaVpLK05QVkRXdWlMMm1NNUprMXAvTGZSbU5maVovNmwK",
|
|
"endpoints": [
|
|
"https://code.lotusguild.org/LotusGuild/cinny-desktop/releases/download/latest/release.json"
|
|
]
|
|
},
|
|
"deep-link": {
|
|
"desktop": {
|
|
"schemes": ["matrix"]
|
|
}
|
|
}
|
|
},
|
|
"app": {
|
|
"security": {
|
|
"csp": "default-src 'self'; script-src 'self' 'unsafe-eval' 'sha256-dT6noyex1I8o5CS9Sx/y8UOqwpZYIridpGz92gcObIM='; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob: http: https:; media-src 'self' blob: data: mediastream: http: https:; worker-src 'self' blob:; frame-src 'self' blob: http://127.0.0.1:44548 https://www.openstreetmap.org https://www.youtube-nocookie.com https://www.youtube.com https://player.vimeo.com https://www.tiktok.com https://www.dailymotion.com https://geo.dailymotion.com https://streamable.com https://player.twitch.tv https://clips.twitch.tv https://open.spotify.com https://w.soundcloud.com https://embed.music.apple.com https://platform.twitter.com https://www.instagram.com https://embed.tidal.com https://www.redditmedia.com https://embed.reddit.com https://embed.bsky.app https://www.loom.com https://player.kick.com https://www.mixcloud.com https://widget.deezer.com https://store.steampowered.com; connect-src 'self' blob: data: ipc: ws: wss: http: https: http://ipc.localhost; object-src 'none'; base-uri 'self'"
|
|
}
|
|
}
|
|
} |