LotusGuild/cinny
3
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity
1,636 Commits 18 Branches 61 Tags
41899adafa85ac1827f42b246ba3ef9fc121b912
Commit Graph
28 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Lotus BotandClaude Sonnet 4.6 41899adafa feat: add Sentry error tracking with defensive error boundary 
- Initialize Sentry SDK in index.tsx when VITE_SENTRY_DSN env var is set
- Wrap entire App with Sentry.ErrorBoundary (replaces the hard crash with a retry UI)
- 5% trace sample rate, sendDefaultPii disabled, strip events containing accessToken
- Add .env.production template with VITE_SENTRY_DSN placeholder
- Get your DSN from sentry.io -> Project Settings -> Client Keys

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-21 19:44:51 -04:00
Lotus BotandClaude Sonnet 4.6 c1249f3322 fix: guard Icon src against non-function values to prevent crash 
Add defensive check in folds Icon component so that if src is ever
undefined or non-function (root cause unknown, possibly data-dependent),
the SVG renders empty rather than throwing and crashing the whole app.

Also adds postinstall script to re-apply the patch after npm install.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-21 19:26:52 -04:00
Lotus BotandClaude Sonnet 4.6 0ef8dc9baf fix(security): upgrade i18next-http-backend 2.5.2→3.0.6 (path traversal CVE) 
Fixes GHSA-q89c-q3h5-w34g: path traversal & URL injection via unsanitised
lng/ns parameters. Remaining open issues are all in devDependencies
(commitizen/lodash/tmp) or dev-server-only tools (esbuild/vite), with no
runtime impact on the production build.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-21 16:17:08 -04:00
Lotus BotandClaude Sonnet 4.6 ce2e0ef203 perf(router): lazy-load Lobby/Explore/Inbox routes; fix spoiler aria-pressed initial state 
Lobby, Explore/FeaturedRooms/PublicRooms, Inbox/Notifications/Invites are
now lazy-loaded via React.lazy so they only enter the bundle when navigated
to. Main bundle: 2547 kB → 2472 kB (gzip 637 → 618 kB).

Spoiler aria-pressed was initialised to false (revealed); changed to true
so the spoiler starts hidden, matching CSS logic (aria-pressed=true →
color:transparent).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-21 16:14:08 -04:00
Lotus BotandClaude Sonnet 4.6 689805ca6e fix(a11y): semantic headings, htmlFor/id associations, remove duplicate aria-labels 
H-tag: add as=h1/h2 to dialog/UIA/auth headings (21 components)
Label: add htmlFor/id to PasswordRegisterForm (5 pairs) and PasswordResetForm (3 pairs)
Dupe: remove duplicate aria-label from Controls.tsx screenshare button, MembersDrawer, Members, RoomInput

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-21 15:36:59 -04:00
Lotus Bot 09905828ef fix(a11y): replace aria-pressed with aria-expanded on Home/Space/Direct menu triggers\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:51:14 -04:00
Lotus Bot a67f581c52 fix(a11y): add htmlFor/id label associations in login and token input forms\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:49:49 -04:00
Lotus Bot 8fa079c289 fix: add color-scheme meta, og:type, fix fonts.googleapis.com crossorigin\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:48:19 -04:00
Lotus Bot a90169abb9 fix(a11y): add aria-live regions to SyncStatus connection banners\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:43:26 -04:00
Lotus Bot 8e62dec419 fix(a11y): add labels to unlabeled form inputs\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:40:35 -04:00
Lotus Bot d1c49a1738 fix(a11y): add semantic heading hierarchy across settings, modals, and pages\n\nAdd as="h1"/h2/h3 to Text components used as visual headings:\n- Auth pages: h1 brand, h2 section titles\n- Settings panels: h2 for General/Permissions/DeveloperTools/Members/Emojis\n- Modal dialogs: h2 for CreateRoom, CreateSpace, AddServer\n- Explore pages: h2 page heading, h3 subsections\n- Inbox pages: h2 Notifications/Invites, h3 Primary/Public/Spam\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:35:55 -04:00
Lotus Bot 343bb3a496 perf: lazy-load modal renderers and auth pages, split vendor chunks\n\nMain bundle: 3866 kB -> 2547 kB gzip (637 kB, was 997 kB)\nNew cacheable chunks: matrix-sdk, react-dom, router, react-query, linkify\nLazy-loaded: RoomSettings, SpaceSettings, Search, CreateRoom, CreateSpace, Auth\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:32:40 -04:00
Lotus Bot c05b233b3f fix(a11y): label all buttons in Editor.preview.tsx demo component\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:21:34 -04:00
Lotus Bot 9843e8bdf1 fix(a11y): label remaining unlabeled icon buttons across 12 components\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:17:07 -04:00
Lotus Bot 2909aebb1f fix(a11y): replace aria-pressed with aria-expanded on menu-trigger buttons\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:06:40 -04:00
Lotus Bot abd90ab980 fix(a11y): fix remaining unlabeled icon buttons and portaled tooltip issue\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> 2026-05-21 13:04:11 -04:00
Lotus BotandClaude Sonnet 4.6 5e740496c9 fix(perf): hoist lotusTerminal setting out of Message component (Perf-10) 
Previously every visible Message subscribed to settingsAtom via useSetting,
creating O(80) active atom subscriptions. Now RoomTimeline reads it once
and passes it down as a prop, reducing subscriptions to 1.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-21 12:07:42 -04:00
Lotus BotandClaude Sonnet 4.6 d707c4441c feat(a11y): form input labels (H-6), remaining button labels (C-1) 
H-6: aria-label on all form inputs missing accessible names:
  - Login: username, password (already done)
  - Register: username, password, confirm, token, email
  - Password reset: email, new password, confirm password
  - Settings: display name, user ID to ignore, keyword, page zoom,
    date format, device name, backup passwords (new/confirm/restore)
  - Auth: server URL picker input
C-1: additional icon buttons:
  - RoomInput: toolbar toggle (aria-pressed + label)
  - Lobby/Members: scroll to top, toggle member list
  - UIAFlowOverlay: cancel authentication
  - BackupRestore: backup options menu
  - UrlPreview: previous/next preview buttons
  - RoomPacks: undo remove/remove pack buttons
  - RoomViewHeader: start call, member list toggle
  - ServerPicker: change server button

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-21 12:03:26 -04:00
Lotus BotandClaude Sonnet 4.6 df30476b53 feat(a11y): comprehensive icon button label sweep — 60+ remaining buttons labeled 
C-1 complete sweep across all components and features:
- Call controls: mic mute/unmute, deafen/undeafen, video, screenshare, chat
- RoomInput: dismiss reply, attach file, sticker, emoji, GIF, location, toolbar
- Media viewers: close in image/pdf/text viewers and editors
- Settings dialogs: close buttons in all room/space/common settings panels
- Lobby: back, toggle member list, scroll to top, pack add/remove
- Auth: server picker, UIA flow cancel
- Upload cards: cancel uploads
- URL preview: prev/next buttons
- Members drawer: close + scroll to top
- RoomViewHeader: back, start call, toggle member list

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-21 11:58:40 -04:00
Lotus BotandClaude Sonnet 4.6 18b12cfca1 fix(perf,a11y): selectAtom for unread subscriptions, semantic headings, Perf-5 binary search 
Perf-3: Replace raw roomToUnreadAtom subscription in Home, Direct, Space with
  selectAtom-derived Set<string> — components now only re-render when rooms
  gain/lose unread presence, not on every notification count update
Perf-5: RoomTimeline eventRenderer now uses binary search on precomputed
  timelineSegments instead of O(N×T) linear scan per visible message
A11y L-1: Add as=h2 semantic heading to Home, Direct, Inbox, Space page nav
  titles so screen readers announce page sections correctly

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 21:59:09 -04:00
Lotus BotandClaude Sonnet 4.6 4e80c0a0f5 feat(a11y,perf): comprehensive icon button labels, toolbar a11y, timeline binary search 
A11y C-1: aria-label on 30+ remaining icon-only buttons across:
  - settings panels (close, reset, info, expand, remove, undo)
  - editor toolbar (bold, italic, underline, strike, code, spoiler,
    blockquote, code block, ordered/unordered list, headings 1-3)
  - auth stages (cancel buttons in SSO, Password stages)
  - device verification (cancel buttons)
  - password input (show/hide toggle with dynamic label)
  - event readers, account data editor close buttons
  - global emoji packs (add/remove buttons)
Perf-5: Replace O(N×T) getTimelineAndBaseIndex scan with precomputed binary
  search (timelineSegments useMemo) — O(log T) per visible message render

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 21:54:33 -04:00
Lotus BotandClaude Sonnet 4.6 d4705f9235 fix(a11y,sec): remove tabIndex=-1 from interactive buttons, npm audit fix 
H-3: tabIndex=-1 removed from login info, settings reset, settings info buttons
      + aria-label added to each for screen reader discoverability
SEC: npm audit fix - 18 non-breaking dependency updates (34 vulns -> 16 remaining)
     Remaining 16 require --force (breaking changes, deferred)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 21:47:20 -04:00
Lotus BotandClaude Sonnet 4.6 4490993fe7 feat(a11y): landmark regions, skip link, dialog labels, icon button labels 
C-3: nav/main landmark roles in ClientLayout (nav + main areas)
C-4: Skip-to-main-content link in ClientLayout (visually hidden, focusable)
H-2: aria-labelledby on LeaveRoomPrompt and RoomTopicViewer dialogs
C-1: aria-label on ~15 icon-only buttons (back, menu, close, folder, account)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 21:44:41 -04:00
Lotus BotandClaude Sonnet 4.6 ee7eabd2c4 fix(bug,perf): poll first-vote race, stale timeline ref, lazy GifPicker/EmojiBoard, focusItem timer leak, RoomNavItem memo 
BUG-18: clearTimeout cleanup in focusItem useLayoutEffect prevents leaked timers
BUG-24: Room timeline listener catches first poll vote before Relations object exists
BUG-25: Use timelineRef.current in handleOpenEvent to prevent stale index on rapid navigation
Perf-6: React.lazy + Suspense for GifPicker and EmojiBoard (initial bundle -114 kB)
Perf-7: React.memo on RoomNavItem to prevent re-renders on unrelated state

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 21:39:35 -04:00
Lotus BotandClaude Sonnet 4.6 71791e46f6 fix(a11y,bug): aria-labels on dialogs/buttons, useAlive GIF guard, typing timer fix 
A11y:
- Add aria-label Close to RoomTopicViewer, ImagePackView close buttons
- Add aria-label Cancel to LeaveRoomPrompt cancel button
- Add aria-label to Send, Reply, Thread, Edit, React, Search, Mute, Download buttons
- Fix aria-pressed -> aria-expanded + aria-haspopup on menu anchor triggers
- Add aria-label to username/password auth inputs

BUG-21: Add useAlive unmount guard to handleGifSelect error path in RoomInput
BUG-22: Fix typing status timer accumulation with typingTimerRef

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 21:26:18 -04:00
Lotus BotandClaude Sonnet 4.6 ff7c2ed941 Bug fixes, security hardening, and performance improvements 
- BUG-16: Fixed pagination deadlock (fetching flag stuck on error path)
- BUG-17: Fixed absoluteIndex===0 falsy check skipping unread jump
- BUG-19: Fixed mEvt.getRoomId()! non-null assertion crash
- BUG-20: Wrapped getSettings()/setSettings() in try/catch for corrupt localStorage
- SEC: Replaced randomStr() Math.random() with crypto.getRandomValues() CSPRNG
- SEC: Fixed afterLoginRedirectPath open redirect validation
- SEC: Narrowed OSM iframe sandbox to scripts-only (removed allow-same-origin)
- Perf-2: Memoized selectAtom in useSetting (prevented new atom ref per render)
- Perf-4: Fixed typingMembers setTimeout leak (tracked timers per user/room)
- Perf-8: Memoized getChatBg() result in RoomView (not inline in JSX)
- Perf-12: Replaced body.class * font-family with body.class (inherited)
- Perf-15: Memoized typingNames array chain in RoomViewTyping
- Perf-9: Added blob URL cleanup useEffect in AudioContent
- BUG: Fixed forEach(async) -> Promise.all in useCommands join handler
- BUG: Fixed useCompositionEndTracking missing dependency array
- A11y: Fixed spoiler button aria-pressed + keyboard handler
- A11y: Added aria-label to Send message button
- Build: Set sourcemap:false, removed netlify.toml from copyFiles

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-20 21:11:38 -04:00
Lotus Bot 443d8407fc PTT fixes, TDS expansions, performance hooks, state event renderers 
PTT fixes (BUG-7/8/9):
- BUG-7: Fix isEditable to use ownerDocument.body (works in EC iframe context)
- BUG-8: Release mic if callEmbed changes during active PTT (cleanup fn)
- BUG-9: Wire iframe blur/focus listeners for stuck-mic prevention

PiP bug fix (BUG-11):
- Track prevPipMode ref so position only resets when first entering pip mode,
  not on every callVisible change (user drag position preserved)

GIF improvements (BUG-15):
- Show user-visible error text in toolbar on GIF send failure
- Also surface size-limit rejection with a 4-second auto-clearing message

Performance:
- useInterval: replace useMemo with useEffect for setInterval (React StrictMode safe)
- usePan: add unmount cleanup effect to remove document mousemove/mouseup listeners

Feature: timeline state event renderers (low effort, high value):
- Added renderers for RoomEncryption, RoomJoinRules, RoomGuestAccess, RoomCanonicalAlias
- These were silently falling through to the hidden-events fallback

TDS (Lotus Terminal Design System):
- Fix: correct 8 escaped template literals in GIF picker light-mode block
- Add data-emoji-board attribute to EmojiBoardLayout for stable CSS targeting
- Add Tooltip panel styles (dark + light mode)
- Add Switch toggle styles (dark + light mode)
- Add Spinner stroke colors (dark + light mode)
- Add EmojiBoard panel styles (dark + light mode)
- Add PopOut/Menu/floating panel styles (dark + light mode)
 2026-05-19 16:45:02 -04:00
Lotus Bot 8666daaf9d Security, performance, bug fixes, and TDS improvements 
Security:
- HIGH-1: Validate hex color format before CSS interpolation in sanitize.ts
- HIGH-5: Add sandbox attribute to OpenStreetMap iframe
- MED-1: Fix permissive URL scheme regex in LINKIFY_OPTS
- MED-3/HIGH-4: Add .js.map blocking + CSP header to nginx config
- LOW-2: Validate OIDC authUrl scheme before window.open
- Accessibility: Remove maximum-scale=1.0 from viewport meta (WCAG 1.4.4)

Performance:
- O(1) Map index in computePositions (was O(M×T) findIndex per member)
- Add RoomMemberEvent.Membership subscription so positions update on join/leave
- Fix uncleaned 2000ms setTimeout in RoomTimeline useLayoutEffect

Bug fixes:
- BUG-5: Add QUEUED/CANCELLED cases to DeliveryStatus component
- BUG-6: Guard DeliveryStatus against state events via isState() check
- BUG-10: Clamp PiP position on window resize
- BUG-14: Separate runLotusBootSequence into dedicated useEffect([lotusTerminal])
- Fix aria-live on typing indicator (WCAG 4.1.3)
- Add aria-label + aria-multiline to message editor

TDS (Lotus Terminal Design System):
- Add reaction chip styles (dark + light mode)
- Add GIF picker CSS via globalStyle instead of runtime injection
- Add URL preview styles (dark + light mode)
- Add complete GIF picker light-mode TDS block (was missing)
 2026-05-19 16:26:25 -04:00