4356 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
jared	2815767d47	Merge branch 'lotus' into fix/audio-output-frame-ids	2026-10-18 23:40:49 -04:00
jared	04605f2680	Merge pull request 'ci: re-seed the bundle budget after the October audit fix batch' (#419) from ci/reseed-bundle-budget into lotus	2026-10-18 23:28:45 -04:00
Lotus CIandClaude Opus 5.5	bc7458ac99	ci: re-seed the bundle budget after the October audit fix batch ... The entry chunk on lotus (d7bc6d94) is 360238 bytes gzip, past the 358317 budget seeded in September, so every PR now fails Build & Quality Checks. The growth is ~40 merged fixes (call-state, status, notification, search and settings changes), not one regression. Re-seed per the file's rule: measured sizes +10% (total 1666894 → 1833583, largest 360238 → 396262). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 23:14:50 -04:00
Lotus CIandClaude Opus 5.5	338b24c43f	chore(call): pin element-call-embedded 0.25.0-lotus.24 (frame audio outputs, #310) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 15:26:44 -04:00
Lotus CI	562198860f	Merge remote-tracking branch 'origin/lotus' into fix/audio-output-frame-ids	2026-10-18 15:24:58 -04:00
jared	d7bc6d94bb	Merge pull request 'fix(calls): explain when the soundboard is not allowed in a voice channel (EC #47)' (#415) from fix/soundboard-not-permitted into lotus	2026-10-18 11:24:49 -04:00
jared	9c3fdfff39	Merge pull request 'fix(calls): say when ML noise suppression fails or falls back; drop the spoofable listener (#260)' (#413) from fix/denoise-state-notice into lotus	2026-10-18 10:53:39 -04:00
jared	6191690389	Merge pull request 'docs: document the 55 features missing from LOTUS_FEATURES.md; refresh the Synapse re-check (#294)' (#412) from docs/features-catchup into lotus	2026-10-18 10:34:23 -04:00
jared	3845d2e4a8	Merge pull request 'fix(settings): desktop-only settings get their own Desktop section (#290)' (#411) from fix/desktop-settings-section into lotus	2026-10-18 10:18:09 -04:00
jared	4bfb51c5fe	Merge pull request 'fix(dev): ML noise suppression works on npm start; no lotusTheme warning per call (#293)' (#410) from fix/dev-denoise-theme into lotus	2026-10-18 09:59:52 -04:00
jared	72db4c110e	Merge pull request 'fix(pwa): the installed app can rotate, and "New Message" opens a new DM (#292)' (#408) from fix/pwa-manifest into lotus	2026-10-18 09:23:21 -04:00
jared	a02eda05cb	Merge pull request 'fix(translate): say why Translate did nothing (#287)' (#407) from fix/translate-feedback into lotus	2026-10-18 08:59:30 -04:00
jared	8a2d37b5a1	Merge pull request 'fix(desktop): without a tray, the first-close dialog defaults to Quit (cinny-desktop #37)' (#416) from fix/close-no-tray into lotus	2026-10-18 08:18:30 -04:00
jared	3f94d73c7a	Merge pull request 'fix(media): "Compress image" no longer blackens transparent images or freezes animations (#331)' (#399) from fix/compress-alpha-anim into lotus	2026-10-18 07:23:09 -04:00
jared	1b887de81d	Merge pull request 'fix(consent): a retry that fails again reopens the terms prompt (#311)' (#406) from fix/consent-retry-snooze into lotus	2026-10-18 06:51:24 -04:00
jared	1037d458f4	Merge pull request 'fix(privacy): "Remove Photo Metadata" also covers emoji/sticker packs and badges (#332)' (#405) from fix/strip-metadata-packs into lotus	2026-10-18 06:31:31 -04:00
jared	8a3b2eeb61	Merge pull request 'fix(previews): no genuine preview card for a site a deceptive link only pretends to be (#286)' (#404) from fix/preview-deceptive-links into lotus	2026-10-18 06:15:46 -04:00
jared	099ada5d18	Merge pull request 'fix(previews): a page can no longer pose as a YouTube (etc.) player via its og:url (#326)' (#403) from fix/embed-ogurl-provider into lotus	2026-10-18 05:54:22 -04:00
jared	80ef1179c9	Merge pull request 'fix(settings): valid HTML in setting tiles; start uploads in an effect (#291)' (#402) from fix/settingtile-nesting into lotus	2026-10-18 05:37:06 -04:00
jared	200ef4993c	Merge pull request 'fix(a11y): the keyboard shortcuts dialog lists every shortcut (#334)' (#401) from fix/shortcuts-dialog into lotus	2026-10-18 05:21:22 -04:00
jared	0ebf7f0806	Merge pull request 'fix(forward): warn when forwarding out of an encrypted room into one that is not (#330)' (#400) from fix/forward-encryption-warning into lotus	2026-10-18 05:05:17 -04:00
jared	397eb7da81	Merge pull request 'fix(calls): no "the shared window was closed" toast when an admin turns sharing off (#297)' (#398) from fix/screenshare-double-toast into lotus	2026-10-18 04:23:18 -04:00
jared	a20e68596a	Merge pull request 'fix(notifications): notification replies re-check encryption at send time and use the right account (#299)' (#397) from fix/sw-reply-checks into lotus	2026-10-18 03:55:01 -04:00
jared	df9591c44c	Merge pull request 'fix(calls): the call PiP no longer opens on top of the composer (#323)' (#396) from fix/pip-default-position into lotus	2026-10-18 03:24:13 -04:00
jared	ed24d7f78e	Merge pull request 'fix(notifications): in-app toasts no longer need browser notification permission (#324)' (#395) from fix/inapp-toast-permission into lotus	2026-10-18 03:06:12 -04:00
Lotus CIandClaude Opus 5.5	37b3ae1ad7	fix(desktop): without a tray, the first-close dialog defaults to Quit (cinny-desktop #37) ... On desktops with no tray host (stock GNOME), "Keep running in the tray" hid the window with no icon to bring it back. Ask the desktop app (has_tray_host); without a tray, say so, focus "Quit when I close the window", and offer "Keep running in the background" as the secondary choice. Older desktop builds keep the current dialog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 02:41:04 -04:00
jared	667925733e	Merge pull request 'fix(notifications): timed mutes are lifted by any Lotus device, not just the one that set them (#333)' (#393) from fix/mute-timers-account-data into lotus	2026-10-18 02:22:21 -04:00
jared	ea5a0d4906	Merge pull request 'fix(moderation): policy viewer lists a stable rule and its legacy twin once (#321)' (#392) from fix/policy-dedupe into lotus	2026-10-18 02:05:12 -04:00
jared	a6e90c7bc4	Merge pull request 'fix(security): a dismissed status announcement no longer hides the security nudge (#307)' (#391) from fix/nudge-dismissed-strip into lotus	2026-10-18 01:49:48 -04:00
jared	c87fa4f6d5	Merge pull request 'fix(status): banner Details strips Markdown syntax, not every #, _, >, * (#308)' (#390) from fix/kuma-plain-text into lotus	2026-10-18 01:33:17 -04:00
Lotus CIandClaude Opus 5.5	f8efbfe38b	fix(calls): explain when the soundboard is not allowed in a voice channel (EC #47) ... The fork now refuses a clip it cannot publish (audio-only rooms grant only the microphone source) with reason "not_permitted". Say "The soundboard isn't available in this voice channel" instead of the generic error. Older forks are unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 01:22:50 -04:00
jared	5ecf4132f5	Merge pull request 'fix(calls): DM-aware rejoin toast, and no rejoining a DM call that ended (#302)' (#389) from fix/rejoin-dm into lotus	2026-10-18 01:16:23 -04:00
jared	d412f9c56c	Merge pull request 'fix(search): an edited message shows once, with its latest text (#288)' (#388) from fix/search-edit-dupes into lotus	2026-10-18 00:59:46 -04:00
Lotus CIandClaude Opus 5.5	acc17f422b	fix(calls): say when ML noise suppression fails or falls back; drop the spoofable listener (#260) ... The fork reports what actually runs as io.lotus.denoise_state, but the host never listened ("unsupported action"), so a failed ML denoiser silently published the raw mic. Handle it: toast when ML did not start or fell back to another model. Remove LotusDenoiseFeature, which waited for a postMessage nothing sends any more and accepted it from any frame. Refs #260 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:48:46 -04:00
jared	ad5631819d	Merge pull request 'fix(sidebar): the room filter hides empty sections and says when nothing matches (#289)' (#387) from fix/room-filter-empty into lotus	2026-10-18 00:45:28 -04:00
Lotus CIandClaude Opus 5.5	5feb2184be	docs: document the 55 features missing from LOTUS_FEATURES.md; refresh the Synapse re-check (#294) ... LOTUS_FEATURES.md had not been updated since September and was missing 55 shipped features. Add a "June–October 2026 Additions" section, grouped by area, one line per feature with its commit and issue. LOTUS_REFERENCE.md's blocked-features note is re-checked against production Synapse 1.162.0. Fixes #294 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:29:54 -04:00
Lotus CIandClaude Opus 5.5	86b77ac9f3	fix(settings): desktop-only settings get their own Desktop section (#290) ... Custom Window Chrome, Launch on login / When I close the window and the keychain status sat inside Appearance, between Monochrome Mode and Twitter Emoji. Move them to a Desktop section (above App Updates), rendered only in the desktop app. Fixes #290 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:28:12 -04:00
jared	83933fb5ac	Merge pull request 'fix(composer): Escape closes the emoji and sticker boards (#304)' (#386) from fix/emoji-board-escape into lotus	2026-10-18 00:27:07 -04:00
Lotus CIandClaude Opus 5.5	cd760ebc3c	fix(dev): ML noise suppression works on npm start; no lotusTheme warning per call (#293) ... The denoise worklets/wasm/models were only copied into dist/ by the lotus-denoise closeBundle hook, so on the dev server the call frame got the SPA fallback for them and silently used the raw mic. The asset list is now shared (denoiseSources) between that copy and a dev-server middleware serving the same paths. Also send lotusTheme=true with lotusTransparent, which the fork warned about in every call. Fixes #293 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:24:03 -04:00
Lotus CIandClaude Opus 5.5	1511cb0b97	fix(pwa): the installed app can rotate, and "New Message" opens a new DM (#292) ... manifest.json locked the installed app to portrait (no landscape video, screenshare or call view on Android / tablets) and its "New Message" shortcut pointed at /, the home page. Drop the orientation lock and point the shortcut at ./direct/create/ (Create Chat). Fixes #292 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:18:23 -04:00
Lotus CIandClaude Opus 5.5	3e11a6fc0b	fix(translate): say why Translate did nothing (#287) ... When a message was already in the target language, or its language could not be detected, Translate switched itself back off with no chip, no "Translating…" and no error. Show a short toast instead: "This message is already in English." or "Couldn't tell what language this message is in, so it wasn't translated." Fixes #287 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:17:04 -04:00
Lotus CIandClaude Opus 5.5	5ce4692a7b	fix(consent): a retry that fails again reopens the terms prompt (#311) ... Closing the dialog via "I've accepted — retry" also deactivated its focus trap, whose onDeactivate is "Later": every close set the 10 s snooze, so a retry made before the terms were really accepted failed silently. Retry now closes without snoozing (and clears any earlier snooze). Fixes #311 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:11:34 -04:00
Lotus CIandClaude Opus 5.5	4486f02bc6	fix(privacy): "Remove Photo Metadata" also covers emoji/sticker packs and badges (#332) ... Custom emoji and sticker images, pack avatars and power-level badge images were uploaded with their EXIF intact (GPS location, timestamp), although they are published to every member of the room or space. Route those three pickers through a new useStrippedFilePicker, which applies the same stripImageMetadata as attachments and avatars. Fixes #332 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:09:14 -04:00
jared	a7c9d15824	Merge pull request 'fix(calls): the call-failed screen gets a Try again button (#301)' (#385) from fix/call-failed-retry into lotus	2026-10-18 00:08:25 -04:00
Lotus CIandClaude Opus 5.5	7b3d1bad8f	fix(previews): no genuine preview card for a site a deceptive link only pretends to be (#286) ... Previews are built from the plain body, clicks follow formatted_body's hrefs, and a sender controls both: text "https://paypal.com" linked to evil.example showed a real PayPal card. Drop body URLs whose site is only claimed by the visible text of a mismatched link (linkSafety). Fixes #286 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:05:06 -04:00
Lotus CIandClaude Opus 5.5	2c11bd3b8e	fix(previews): a page can no longer pose as a YouTube (etc.) player via its og:url (#326) ... The embed fallback used the preview's og:url whatever site was posted. og:url is set by the page, so evil.example could render as a playable YouTube card (attacker's video) whose links go to evil.example. Only use an og:url on the same provider as the posted link, including the provider's own short-link domains (youtu.be, spotify.link, redd.it, …). Fixes #326 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 23:54:50 -04:00
Lotus CIandClaude Opus 5.5	6f7a8f64e2	fix(settings): valid HTML in setting tiles; start uploads in an effect (#291) ... SettingTile rendered its description in a <p>, and many tiles pass blocks (badges, Box, Text), so Settings had <div>/<p> inside <p> and React warned on every page. Render it as a <div>. UploadCardRenderer called startUpload() during render, which now updates the desktop taskbar-progress hook mid-render; start it from an effect instead. Refs #291 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 23:51:19 -04:00
jared	e6e52cdc37	Merge pull request 'fix(share): room share and invite links open Lotus Chat, not matrix.to (#285)' (#384) from fix/share-links-lotus into lotus	2026-10-17 23:50:18 -04:00
Lotus CIandClaude Opus 5.5	4969ef9b6d	fix(a11y): the keyboard shortcuts dialog lists every shortcut (#334) ... The ? dialog showed 7 shortcuts and left out Ctrl+K, ↑ to edit, all composer formatting keys and the push-to-talk / deafen keys. Add them: formatting rows are generated from the editor's INLINE_HOTKEYS / BLOCK_HOTKEYS so they can't drift, and the call keys show the user's own bindings. Fixes #334 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 23:43:49 -04:00
Lotus CIandClaude Opus 5.5	be71931a81	fix(forward): warn when forwarding out of an encrypted room into one that is not (#330) ... Forwarding from an encrypted room into an unencrypted one posts the text (and a re-uploaded plaintext attachment) where the server can read it, with the original author attached, and the dialog said nothing. Show a note above Send naming the unencrypted destination(s). Refs #330 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 23:40:58 -04:00