4 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 4.8	51d468fbcc	fix(security,notifications): pre class allowlist, notification privacy + icon, sync-script safety (N100/N106/N109/N119) ... - N100: restrict <pre> classes to language-* in sanitize-html allowedClasses; previously `class` was allowed on <pre> with no allowedClasses entry, so a remote sender could inject arbitrary class names that activate site CSS. - N106: OS notifications for E2EE rooms no longer carry decrypted plaintext (which persists in the OS notification center / lock screen). Encrypted rooms show only the sender; the in-page toast still previews while focused. - N109: OS notification icon/badge use the static app logo instead of an authenticated-media avatar URL the OS can't fetch (was 401 / no icon). The in-app toast keeps the real room avatar (it can fetch via the SW). - N119: syncDecorations.mjs distinguishes a confirmed 404 (remove) from a network/5xx failure (abort) so a transient CDN outage can't silently wipe the whole decoration catalog from source control. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-28 12:35:33 -04:00
jaredandClaude Opus 4.8	ce8a03ab16	fix(build,denoise): gate node leak, postMessage origin, fail-hard patch, CDN dedup (N124/N125/N128/N120) ... - N124: denoise shim cleanup() now disconnects the noise gate AudioWorkletNode (var-scoped, guarded), releasing the gate processor thread instead of leaking it on every getUserMedia within a session. - N125: denoise-status postMessage now targets the parent origin (derived from the parentUrl widget param via new URL(...).origin, falling back to this frame's origin) instead of broadcasting with '*'. - N128: patch-folds.mjs fails hard (process.exit(1)) when the patch target is missing, so an unpatched folds can't silently ship. The idempotent "already applied" path still exits 0 (verified by re-run). - N120: the avatar-decoration CDN URL is now single-sourced in avatarDecorations.ts (DECORATION_CDN); syncDecorations.mjs extracts it by regex (can't import across the build/app boundary) and fails hard if renamed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-28 10:55:19 -04:00
jaredandClaude Opus 4.8	4a401cf816	fix(calls): harden ML denoise shim against static; fix lint/format ... ML noise suppression produced loud static on real calls. RNNoise requires mono 48kHz float input; feeding it stereo or wrong-rate data is the classic cause of that static. Harden the shim: - request mono (channelCount:1) + 48kHz capture - run a 48kHz AudioContext and BAIL to the raw mic if the browser won't give a true 48kHz context (wrong-rate data -> static) - force the worklet node to explicit mono in/out - use the non-SIMD rnnoise.wasm (SIMD build artifacts on some GPUs) - share one AudioContext across captures Also fix the two CI-blocking eslint errors (unused vars in UrlPreviewCard and useLocalMessageSearch) and apply repo-wide prettier formatting so check:eslint and check:prettier pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-15 20:50:00 -04:00
jaredandClaude Sonnet 4.6	2a545b8b3e	feat: avatar decorations follow-up — Nextcloud CDN, sync script, docs ... - Point DECORATION_CDN at Lotus Nextcloud WebDAV share instead of external avatardecoration.com; all 99 APNG files are self-hosted and served via direct DAV URL (no CORS issue for <img> elements) - Add onError handler to AvatarDecoration.tsx to silently hide the overlay if a file is missing or the CDN is unreachable - Rewrite scripts/syncDecorations.mjs: now sends HTTP HEAD requests to the live Nextcloud CDN (batches of 16 in parallel) and removes catalog entries for files that return non-2xx; empty categories are pruned automatically. Workflow: delete files from Nextcloud → run `npm run sync:decorations` → commit the updated avatarDecorations.ts. No local files needed. - Add public/decorations/ to .gitignore; delete the 85 MB local APNG cache that was downloaded during development (files live on Nextcloud now) - Add sync:decorations script to package.json - Update LOTUS_FEATURES.md, LOTUS_TODO.md (P5-13 + P5-14 ✓), README.md with avatar decoration documentation and catalog sync workflow Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-14 12:02:50 -04:00