100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	37b3ae1ad7	fix(desktop): without a tray, the first-close dialog defaults to Quit (cinny-desktop #37) ... On desktops with no tray host (stock GNOME), "Keep running in the tray" hid the window with no icon to bring it back. Ask the desktop app (has_tray_host); without a tray, say so, focus "Quit when I close the window", and offer "Keep running in the background" as the secondary choice. Older desktop builds keep the current dialog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 02:41:04 -04:00
Lotus CIandClaude Opus 5.5	3e11a6fc0b	fix(translate): say why Translate did nothing (#287) ... When a message was already in the target language, or its language could not be detected, Translate switched itself back off with no chip, no "Translating…" and no error. Show a short toast instead: "This message is already in English." or "Couldn't tell what language this message is in, so it wasn't translated." Fixes #287 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:17:04 -04:00
Lotus CIandClaude Opus 5.5	5ce4692a7b	fix(consent): a retry that fails again reopens the terms prompt (#311) ... Closing the dialog via "I've accepted — retry" also deactivated its focus trap, whose onDeactivate is "Later": every close set the 10 s snooze, so a retry made before the terms were really accepted failed silently. Retry now closes without snoozing (and clears any earlier snooze). Fixes #311 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:11:34 -04:00
Lotus CIandClaude Opus 5.5	4486f02bc6	fix(privacy): "Remove Photo Metadata" also covers emoji/sticker packs and badges (#332) ... Custom emoji and sticker images, pack avatars and power-level badge images were uploaded with their EXIF intact (GPS location, timestamp), although they are published to every member of the room or space. Route those three pickers through a new useStrippedFilePicker, which applies the same stripImageMetadata as attachments and avatars. Fixes #332 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:09:14 -04:00
Lotus CIandClaude Opus 5.5	7b3d1bad8f	fix(previews): no genuine preview card for a site a deceptive link only pretends to be (#286) ... Previews are built from the plain body, clicks follow formatted_body's hrefs, and a sender controls both: text "https://paypal.com" linked to evil.example showed a real PayPal card. Drop body URLs whose site is only claimed by the visible text of a mismatched link (linkSafety). Fixes #286 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-18 00:05:06 -04:00
Lotus CIandClaude Opus 5.5	2c11bd3b8e	fix(previews): a page can no longer pose as a YouTube (etc.) player via its og:url (#326) ... The embed fallback used the preview's og:url whatever site was posted. og:url is set by the page, so evil.example could render as a playable YouTube card (attacker's video) whose links go to evil.example. Only use an og:url on the same provider as the posted link, including the provider's own short-link domains (youtu.be, spotify.link, redd.it, …). Fixes #326 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 23:54:50 -04:00
Lotus CIandClaude Opus 5.5	6f7a8f64e2	fix(settings): valid HTML in setting tiles; start uploads in an effect (#291) ... SettingTile rendered its description in a <p>, and many tiles pass blocks (badges, Box, Text), so Settings had <div>/<p> inside <p> and React warned on every page. Render it as a <div>. UploadCardRenderer called startUpload() during render, which now updates the desktop taskbar-progress hook mid-render; start it from an effect instead. Refs #291 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 23:51:19 -04:00
Lotus CIandClaude Opus 5.5	4969ef9b6d	fix(a11y): the keyboard shortcuts dialog lists every shortcut (#334) ... The ? dialog showed 7 shortcuts and left out Ctrl+K, ↑ to edit, all composer formatting keys and the push-to-talk / deafen keys. Add them: formatting rows are generated from the editor's INLINE_HOTKEYS / BLOCK_HOTKEYS so they can't drift, and the call keys show the user's own bindings. Fixes #334 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 23:43:49 -04:00
Lotus CIandClaude Opus 5.5	be71931a81	fix(forward): warn when forwarding out of an encrypted room into one that is not (#330) ... Forwarding from an encrypted room into an unencrypted one posts the text (and a re-uploaded plaintext attachment) where the server can read it, with the original author attached, and the dialog said nothing. Show a note above Send naming the unencrypted destination(s). Refs #330 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 23:40:58 -04:00
Lotus CIandClaude Opus 5.5	3a74699fef	fix(media): "Compress image" no longer blackens transparent images or freezes animations (#331) ... Compression re-encodes through a canvas to JPEG. Only PNG was skipped, so a transparent WebP came out on a black background, and an animated GIF or WebP became one still frame. GIF and APNG are no longer offered; an animated WebP (VP8X animation flag) or any image with a transparent pixel is kept as the original. Fixes #331 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:57:33 -04:00
Lotus CIandClaude Opus 5.5	7fc42b32d4	fix(calls): no "the shared window was closed" toast when an admin turns sharing off (#297) ... When a room admin turned off Allow Screen Sharing, the sharer got two toasts: the correct "turned off by a room admin" and the fork's "ended" notice, "the shared window was closed", which was wrong. Skip the ended notice while the room policy forbids sharing. Fixes #297 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:55:05 -04:00
Lotus CIandClaude Opus 5.5	005fc9e768	fix(notifications): notification replies re-check encryption at send time and use the right account (#299) ... The service worker posts inline notification replies in the clear (it cannot encrypt). The Reply action was only withheld for rooms that were encrypted when the notification was shown, so a reply typed hours later into a room that has since turned on encryption went out unencrypted. It also posted with the newest session the worker knew, not the notification's account. The worker now GETs the room's m.room.encryption state first and only sends on a definite 404; notifications carry the user id and the worker uses that account's session (or refuses). "Reply not sent" says why. Fixes #299 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:52:12 -04:00
Lotus CIandClaude Opus 5.5	33cc0de97c	fix(calls): the call PiP no longer opens on top of the composer (#323) ... The first-use PiP position was bottom-right, 72px from the bottom: on desktop over Send, on phones over Send, Emoji and the message box, so the first thing you typed or tapped in the text room hit the call. Default to top-right under the room header instead. A dragged position is still remembered. Refs #323 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:47:34 -04:00
Lotus CIandClaude Opus 5.5	3bf040f17a	fix(notifications): in-app toasts no longer need browser notification permission (#324) ... notify() shows an in-page toast while the window is focused and only falls back to an OS notification otherwise, but both message and invite notifications were gated on Notification.permission === granted. Anyone who declined (or was never asked) heard the ping with nothing on screen. Gate only the OS path on the permission. Fixes #324 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:41:48 -04:00
Lotus CIandClaude Opus 5.5	69e05bbf8d	fix(notifications): timed mutes are lifted by any Lotus device, not just the one that set them (#333) ... A timed mute writes a server-side push rule (muted everywhere), but the unmute timer lived in one browser's localStorage: close that laptop and the room stayed muted on the phone until it was reopened, and forever after a logout there. Timers now live in account data (io.lotus.mute_timers: { timers: { [roomId]: unmuteAt } }). Every client schedules from it, reschedules when it changes, and the first one online after expiry unmutes. An indefinite mute clears a pending timer. Local timers from before are migrated once. Fixes #333 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:33:32 -04:00
Lotus CIandClaude Opus 5.5	15f2fcc4d1	fix(moderation): policy viewer lists a stable rule and its legacy twin once (#321) ... dedupePolicyEntries keyed on the raw recommendation, so m.ban and org.matrix.mjolnir.ban for the same entity never matched and the rule showed twice (both labelled "Ban"). Key on the normalised value; move the pure helpers to policyEntries.ts with unit tests. Fixes #321 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:28:34 -04:00
Lotus CIandClaude Opus 5.5	8e7127a350	fix(security): a dismissed status announcement no longer hides the security nudge (#307) ... SecurityBanner asked pickBanner whether another strip would show without the dismissed set, so a dismissed Kuma announcement (often pinned for weeks) still counted and suppressed the verify / backup nudge on every device that had dismissed it. The dismissed set is now a shared jotai atom (still persisted to localStorage) used by both banners. Adds a Playwright regression. Fixes #307 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:26:54 -04:00
Lotus CIandClaude Opus 5.5	f30a65eb74	fix(status): banner Details strips Markdown syntax, not every #, _, >, * (#308) ... plain() deleted those characters everywhere, so "join #lotus-general" lost its #, snake_case and @some_user lost underscores, "->" became "-", "5 * 3" became "5 3", and "<b>" became "<b". Strip only syntax: heading / quote / list markers at line start, paired **x** *x* _x_ `x`, and HTML tags. Fixes #308 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:22:12 -04:00
Lotus CIandClaude Opus 5.5	0a2f18e3d5	fix(calls): DM-aware rejoin toast, and no rejoining a DM call that ended (#302) ... After a reload during a DM call the toast said "You were in the call in Bob Builder"; it now says "You were in a call with Bob Builder". DM calls are never auto-rejoined (it could ring the other person), and if they have left by the time you tap, the toast says "Call ended" instead of starting a new, ringing call. Fixes #302 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:20:12 -04:00
Lotus CIandClaude Opus 5.5	0d08ba0a55	fix(search): an edited message shows once, with its latest text (#288) ... Server search also returns the m.replace events, so one message edited twice came back as three rows. Fold edits into their message: one row at the best-ranked position, showing the latest m.new_content and pointing at the original event so Open jumps to the real message. Fixes #288 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:14:09 -04:00
Lotus CIandClaude Opus 5.5	6ae4d7adc0	fix(sidebar): the room filter hides empty sections and says when nothing matches (#289) ... A filter matching nothing left Favorites / Projects / Rooms / Low Priority headers with nothing under them. While filtering, sections without a match are hidden, and with no match at all the list shows "No rooms match “…”" with a Clear filter button. Fixes #289 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:08:56 -04:00
Lotus CIandClaude Opus 5.5	f7bdd2855a	fix(composer): Escape closes the emoji and sticker boards (#304) ... The board opens with focus in its search field, and its FocusTrap used the shared stopPropagation helper, which ignores Escape while an input is focused, so Escape never closed it (Chromium, Firefox, WebKit). Always close on Escape here, still stopping the key from closing the room or modal underneath. The GIF picker already uses the default. Fixes #304 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:06:41 -04:00
Lotus CIandClaude Opus 5.5	26cf1204b5	fix(calls): the call-failed screen gets a Try again button (#301) ... "The call failed to load… try again" only offered Back, so the user had to back out and press Join again. Try again starts a fresh embed for the same room with the same mic/camera/sound (which disposes the hung one); Back stays as the secondary action. Fixes #301 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 20:03:40 -04:00
Lotus CIandClaude Opus 5.5	e16c923bea	fix(share): room share and invite links open Lotus Chat, not matrix.to (#285) ... matrix.to can't send anyone to this deployment (its Cinny adapter is app.cinny.in, web-instance[] is Element-only), so a friend scanning a room QR or clicking an invite link was offered Element or app.cinny.in. Share Room (link + QR) and the Invite dialog (link + QR) now use the Lotus permalink (correct on desktop via webAppUrl). The space menus keep both "Copy Link" (matrix.to, for other clients) and "Copy Lotus Link". Fixes #285 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 19:59:57 -04:00
Lotus CIandClaude Opus 5.5	f9172cc339	fix(polls): you can vote on a poll you just created (#284) ... PollContent read mEvent.getId() once at render. For your own new poll that is the local echo id (~!room:txn), and nothing re-rendered it when the SDK swapped in the real $id, so the vote related to the local id and the SDK threw synchronously (getPendingEvents under chronological ordering): no vote was ever sent. Track the id via LocalEventIdReplaced and Status, block voting while it is still local, and catch synchronous throws. Adds the Playwright regression the issue asks for. Fixes #284 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 19:54:01 -04:00
Lotus CIandClaude Opus 5.5	8bbb436ca7	fix(schedule): load scheduled messages from the server; offer to cancel them at logout (#322) ... The tray only knew what this browser had scheduled (localStorage), but Synapse lists every pending one via MSC4140 GET /delayed_events. Load it when the tray mounts and on window focus (localStorage stays as a first- paint cache), keeping only non-state m.room.message events. Logout now says "N scheduled messages still send after you log out" and offers to cancel them. Fixes #322 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 19:40:03 -04:00
Lotus CIandClaude Opus 5.5	4ddcda122a	fix(calls): one delayed-event restart in flight per id, with a timeout (#318) ... During a homeserver stall Element Call retries update_delayed_event every 2 s, and the host opened a new HTTP request each time: 12 pending in a 60 s stall, all landing together on recovery (404 x5, 429 x7). Share the in-flight restart per delay id and abort it after 5 s. Refs #318 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 19:35:06 -04:00
Lotus CIandClaude Opus 5.5	e8fd0a1112	fix(status): show a strip when the homeserver hangs, not 110 s later (#317) ... A hung Synapse (accepts connections, never answers) kept sync SYNCING for up to 110 s (pollTimeout 30 s + the SDK's 80 s buffer), so no strip showed and Kuma was never asked. A watchdog now notices a /sync overdue by 45 s, confirms with a 5 s GET /_matrix/client/versions, then shows "Lotus Chat's server isn't responding…" and polls Kuma at once. Fixes #317 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 19:29:01 -04:00
Lotus CIandClaude Opus 5.5	46d6570df3	fix(calls): lift CallControl's listener limit so ended calls can be freed (#316) ... More than 10 call features subscribe to CallControl's state_update at once (call bar, controls, hotkeys, AFK, muted-talk, join/leave sounds, announcements, rejoin, policy toast, glance, desktop thumbbar/SMTC). At the default limit Node's events logged a MaxListenersExceededWarning, and the console kept the warning's emitter (this CallControl, and through it the whole Element Call document) alive: ~11 MB per call per the audit. setMaxListeners(100); these are real, unsubscribed-on-cleanup listeners. Not reproduced in this environment (headless web logs no warning: fewer subscribers without the desktop hooks); this is the fix the issue measured (swallowing the warning freed all CallControls). Fixes #316 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 18:57:22 -04:00
Lotus CIandClaude Opus 5.5	d7ea408fd0	chore(call): pin element-call-embedded 0.25.0-lotus.23 (sendNotificationType=none, #295) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 18:42:52 -04:00
Lotus CI	d3f01b5116	Merge remote-tracking branch 'origin/lotus' into fix/voice-room-no-room-ping	2026-10-17 18:40:48 -04:00
Lotus CIandClaude Opus 5.5	1c62fb4722	fix(reactions): the reactions row no longer flickers or loses its spacing (#305) ... Two bugs in the one-row "+N" collapse: - measure() used the border box, which grows by 4 px while collapsed (margin -2 / padding 2), so a row within 4 px of fitting flipped collapsed↔expanded every frame (flicker, layout shifts, ~11 % of a core per looping message). It now measures the content box. - The collapsed style used the `margin` shorthand, which overrode the timeline's marginTop and, when removed, cleared it; the row then stuck to the message text. Longhand margins keep marginTop (minus 2 px). Verified headless (12 reactions, viewport sweep 1300–1400 px): before, 90 style flips in 1.5 s at 1344 px and margin-top 0px after a cycle; now 0 flips at every width and margin-top stays 8px. Fixes #305 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 18:26:16 -04:00
Lotus CIandClaude Opus 5.5	a6c7333ea3	fix(rooms): members can start and join calls in new private rooms (#328) ... createRoom granted org.matrix.msc3401.call.member at user level only for voice rooms. Every other room fell back to Synapse's state_default (50), so in a private group room (where Lotus shows the call button and rings) only admins could start a call; members saw "1 Live · Join" and then "You don't have permission to join!". All new non-space rooms now get call.member: 0 (spaces keep their own override). Verified headless through Create Room → Private: before, no call.member entry (state_default 50); now 0. Existing rooms are unchanged; an admin can set it in room permissions. Fixes #328 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 18:09:33 -04:00
Lotus CIandClaude Opus 5.5	a425aa3572	fix(calls): Reject sends the decline to the ring notification (#313) ... handleReject related the MSC4310 decline to the caller's call.member event (the notification's reference), but MSC4310 and Element Call match a decline against the rtc.notification event itself, so the caller kept "Calling…" for the full 90 s after being told "Declined", and declines from other clients (correctly referencing the notification) didn't stop Lotus ringing on other devices. - The incoming call keeps the notification's own event id; Reject relates the decline to it. - The "declined on another device" dismissal and declinedRing accept either id (older Lotus builds referenced the membership). - The missed-call line is skipped for a call we declined. Verified headless (DM, Bob rings, Reject): the decline used to reference the membership; it now references the notification. Unit test added. Fixes #313 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-17 18:01:06 -04:00
Lotus CI	d1270956ea	Merge remote-tracking branch 'origin/lotus' into fix/filtered-timeline-double-count ... # Conflicts: # src/app/components/CallEmbedProvider.tsx	2026-10-17 17:52:35 -04:00
Lotus CIandClaude Opus 5.5	36e697613b	fix(messages): the delivery indicator updates when a send completes (#306) ... DeliveryStatus showed whatever mEvent.status was at the last timeline re-render, and a local echo's status changes (SENDING → SENT → confirmed, NOT_SENT → retried) only emit event-level events, so the last message in a quiet room kept "Sending..." (or a stale "Failed to send. Click to retry" after an outbox retry) indefinitely. It now re-renders on MatrixEventEvent.Status / LocalEventIdReplaced. Not browser-verified in this change (checks: tsc, unit tests, eslint). Fixes #306 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 22:25:41 -04:00
Lotus CIandClaude Opus 5.5	57036bb6a4	fix(rooms): upgrading a room keeps its Lotus settings (#327) ... POST /rooms/{id}/upgrade copies only Synapse's fixed list of state, so an upgrade silently dropped everything Lotus keeps in room state: an audio-only voice channel became camera/screenshare-allowed, user limits and bitrate caps vanished, the soundboard pack was lost, and a room set to delete messages after 7 days kept new ones forever. RoomUpgrade now reads the client-owned state first (utils/roomUpgradeState, unit-tested: io.lotus.*, m.room.retention, role tags, room emoji packs) and re-creates it in the replacement room; a partial copy is reported in the dialog instead of closing silently. Verified headless through the UI (v10 room with voice limit, quality policy, a soundboard pack and retention → upgrade): before, none survived; now all four are in the new room. Follow-up (not here): for spaces, the children's m.space.parent still point at the old space. Fixes #327 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 22:23:15 -04:00
Lotus CIandClaude Opus 5.5	c6419044cb	fix(notifications): quiet hours start and end while the app stays open (#325) ... useNotificationsQuiet evaluated the quiet-hours window (and the "Pause notifications" expiry) only at render time, and the long-lived message/invite notifiers rarely re-render, so someone leaving Lotus open overnight with quiet hours 22:00–07:00 got every sound all night (and a 30-minute pause could outlast itself). The hook now re-evaluates every 30 s. Verified headless (notifications granted, window unfocused): quiet hours set to start ~75 s after the app opened; a DM before the window notified; one inside the window, with the app left alone: before it still notified, now it's silent. Fixes #325 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 22:19:24 -04:00
Lotus CIandClaude Opus 5.5	78691f1fff	fix(logout): no draft or search opt-in left behind after logout (#319, #296) ... - #319: logout wiped the drafts, then reloaded, and the reload's pagehide made RoomInput flush the open composer's (decrypted) draft straight back to localStorage. clearPlaintextCaches now sets a module flag and persistDraft stops writing once it's set (resets with the new page). - #296: the device-wide encrypted-search opt-in (searchCacheEnabled) survived logout, so the next account started indexing decrypted text without opting in. It's now cleared, along with the SDK's per-user filter key. Verified headless with a throwaway account (search opt-in on, "SECRET half-typed reply" in the composer, Settings → Log out): before, the draft and searchCacheEnabled=true remained; now neither does. Unit test added. Fixes #319 Fixes #296 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 22:12:19 -04:00
Lotus CIandClaude Opus 5.5	a86947be48	fix(calls): starting a call in a voice channel no longer @room-pings everyone (#295) ... CallEmbed asked Element Call to send a call-start notification for every non-DM call. In persistent voice channels and space rooms it carries an @room mention: every member got a highlighted ping (and phone push) whenever a moderator or admin joined first, and other clients showed it as a missed call. Now only rooms that can ring (isRingableRoom: DMs and invite-only groups outside a space) get ring/notification; everything else passes sendNotificationType=none (element-call-embedded 0.25.0-lotus.23). Verified with a local build of the fork: an admin joining the Voice Lounge sends none, and Bob gets no new notification (before: +1 highlighted). Fixes #295 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 22:08:22 -04:00
Lotus CIandClaude Opus 5.5	37372b215a	fix(fonts): the app uses Inter again (#320) ... Since the switch to @fontsource-variable/inter 5 (May), the package registers the family 'Inter Variable', but the app still asked for the 4.x name 'InterVariable', so every user got their platform's default sans-serif (Arial / Helvetica / DejaVu) and Settings → Appearance → font "Inter" did nothing. --font-secondary (index.css) and the App font map now ask for 'Inter Variable' first, keeping 'InterVariable' as a fallback for a locally installed old version. Verified headless: before, 0 Inter faces loaded and document.fonts.check('16px "Inter Variable"') false; now the face loads and the check is true. Fixes #320 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 22:01:05 -04:00
Lotus CIandClaude Opus 5.5	b6f9af3f58	fix(dialogs): Enter in Poll, Schedule, Report dialogs no longer discards input (#315) ... Several dialogs are <Box as="form"> with the header ✕ (folds IconButton, no type attribute, so a submit button) as the form's first button. On implicit submission, Enter in a text field "clicked" ✕, closing the dialog and throwing away what was typed (a poll's question and answers, a schedule, a report reason). The header close/cancel IconButtons now have type="button": Create Poll, Schedule Message, Report User, Report Room, Account Data editor, State Event editor, device verification setup, and the message delete/report dialogs. Verified headless: in Create Poll, typing a question and pressing Enter used to close the dialog; now it stays open with the question kept. Fixes #315 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 21:58:05 -04:00
Lotus CIandClaude Opus 5.5	5b5fbdb7b7	fix(timeline): media gallery / activity log no longer make the timeline drop messages (#259) ... The media gallery and activity log register filtered timeline sets on the room (getOrCreateFilteredTimelineSet); the room re-emits their events as live RoomEvent.Timeline, so every matching event reached "new event in the room" listeners twice for the rest of the session. The timeline window shifted by an extra message per event (loaded messages vanished), and notifications, unread counts, widget feeds and ring handling saw duplicates. isFromFilteredTimelineSet() (unit-tested) identifies emits from a filtered set; the room timeline, roomToUnread, message notifications, clock-skew sampling, call ring/decline handling and widget event feeds ignore them. Verified headless (40 messages, every 5th a file; gallery opened; Bob sends 3 files + 1 text): before, the first rendered message drifted from the room start to "file15"; now it stays put. Fixes #259 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 21:42:47 -04:00
Lotus CIandClaude Opus 5.5	8b2322f751	fix(retention): a tiny or brand-new retention value can't wipe a room (#298) ... m.room.retention can be set to anything by anyone with state power. A fat-fingered `max_lifetime: 1000` blanked the timeline for every Lotus user and, for members with "Enforce Message Retention" on, the sweeper redacted all their messages within a minute. The RETENTION_MIN_MS floor existed but was never applied. - effectiveRetentionMs(): anything under 10 min counts as off; used by getRoomRetentionMs (sweeper) and the timeline's hiding. - The sweeper never deletes under a policy less than 24 h old, so a mistake or a malicious change can be reverted before anything is lost. (Local hiding of expired messages still applies at once.) Verified headless (the issue's repro, enforcement on): after max_lifetime 1000, all 4 messages stay visible and none are redacted after 45 s (before: timeline blank, all 4 redacted). Unit tests for the floor and the grace window. Fixes #298 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 21:37:16 -04:00
Lotus CIandClaude Opus 5.5	02950499ea	fix(startup): Firefox no longer hangs on "Heating up" after login (#303) ... initClient awaited navigator.storage.persist() before creating the client. Chromium and WebKit answer at once, but Firefox shows a permission prompt and leaves the promise pending until it's answered, so the app sat on "Heating up" (no sync, no crypto, no IndexedDB) for every Firefox user who didn't notice the prompt. The request is still made (KE-1 only needs that), but startup waits at most 1.5 s for the answer. The comment claiming persist() never prompts is corrected. Verified in Playwright Firefox with the prompt left unanswered (persist() still pending): before, still "Heating up" after 20 s; now the room list after 12 s. Fixes #303 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 21:31:55 -04:00
Lotus CIandClaude Opus 5.5	05d7e87d26	fix(calls): a finished call no longer rings again after a reload (#312) ... After a reload/restart within a ring's lifetime, the catch-up sync replays the ring together with the caller's hang-up and our own decline, and the MatrixRTC session can keep the stale join. The client rang again for up to 90 s and showed "1 Live" (call screen instead of chat) for minutes. - Before ringing, check the room STATE (utils/callRing.ts, unit-tested): no ring if we already declined that ring or are in the call; if the caller has no active membership yet, re-check after 4 s (a real call's membership can land just after its ring) and ring only if they joined. - The "caller gone" dismissal also consults room state, not only the possibly stale session. - When sync becomes live (startup or reconnect), recompute every active RTC session from the current state, clearing a stale "Live". Verified headless (Bob's membership + ring in an invite-only room): live ring rings; hang-up stops it; reload within the window: before rang again + "1 Live", now no ring and no "Live"; a ring that arrives just before the membership still rings. Fixes #312 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 21:28:33 -04:00
Lotus CIandClaude Opus 5.5	bbb2034080	fix(rooms): "Rename for me" names in search results, inbox and threads (#336) ... Follow-up to #359: the personal room name now also shows in message-search result groups and the search room filter (whose room search matches it too), Inbox → Notifications, the threads list and the thread panel header. Verified headless with general renamed to "Zebra Lounge": a global message search and Inbox → Notifications both show "Zebra Lounge". Fixes #336 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 21:19:47 -04:00
Lotus CIandClaude Opus 5.5	4650796120	fix(calls): no "Missed call" in voice rooms or space channels ... Joining a voice channel alone sends a call notification (m.rtc.notification) to the room, and the timeline rendered every unanswered one as "Missed call from X", so everyone in the channel saw a missed call from someone who had just joined it. Ringing already excluded these rooms; the missed-call line didn't. utils/callRing.ts (unit-tested) holds the one rule for both: only DMs and invite-only groups outside any space ring or show "Missed call"; voice rooms, space channels, restricted and public rooms don't. Verified headless with the same two notifications from Bob: the Voice Lounge chat showed 2 "Missed call" lines before, 0 after; a small invite-only group still shows its missed call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 20:29:50 -04:00
Lotus CIandClaude Opus 5.5	f22f9f07a3	test(e2e): allow the register probe's 403 now that sign-up is closed ... matrix.lotusguild.org turned off open registration (2026-10-16; accounts come from SSO/LLDAP), so the login page's registration probe (POST /_matrix/client/v3/register) now answers 403 "Registration has been disabled" instead of 401 + UIA flows. The boot smoke test treated that console line as unexpected and failed on every branch (seen on #360). collectConsole now skips a 403 only when its source URL is the register endpoint; any other 403 still fails the test. Verified: boot.spec passes locally in chromium, webkit and iphone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 19:12:15 -04:00
Lotus CIandClaude Opus 5.5	2700aad209	perf(backgrounds): animated chat backgrounds cost ~5% CPU instead of 50 to 70% (#337) ... background-position can't run on the compositor, so every frame of the animated chat backgrounds repainted the whole chat area: 51 to 72% main-thread busy while idle in a room at 60 fps. The drifts are slow (3 to 22 px/s, under a pixel per frame), so each animation now uses steps(): about 12 updates/s for fireflies, stars and aurora and about 24/s for rain and pulse. Measured headless (20 s idle in a room, CDP TaskDuration): none 0.7% → 0.9%; rain 50.7 → 5.9; stars 71.2 → 4.5; pulse 64.9 → 5.8; aurora 58.9 → 4.2; fireflies 71.7 → 3.8. Aurora and pulse used ease-in-out; with steps() their motion is now even-paced. Pause animations / reduced motion still strip the animation. Fixes #337 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 19:05:52 -04:00
Lotus CIandClaude Opus 5.5	a8a7e639a9	fix(security): link warning no longer bypassed by a sentence or shared hosting (#335) ... Two easy bypasses of the "this link goes somewhere else" check: - Any whitespace in the link text disabled it, so "Log in at chat.lotusguild.org" → evil.example wasn't flagged. hostsFromText now scans each word for host-shaped tokens; a link is flagged if any named host is a different site. Bare file names (main.py, report.pdf) and version numbers are skipped inside sentences so ordinary links aren't flagged. - Shared-hosting suffixes counted as one site (alice.github.io vs evil.github.io, *.pages.dev, netlify.app, vercel.app, …). registrableDomain now treats a curated list of them as public suffixes (longest match, incl. s3.amazonaws.com). Curated rather than the full PSL to stay inside the bundle budget. Verified with unit tests and headless on real messages: the four bypass cases are flagged; the honest sentence, file/version text and "click here" are not. Fixes #335 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-16 18:56:01 -04:00
Lotus CIandClaude Opus 5.5	a4a163df3d	fix(rooms): "Rename for me" names in Ctrl+K, forward/share pickers and notifications (#336) ... The personal room name (io.lotus.room_names) was only used by the sidebar, header, intro and call bar; the quick switcher couldn't find a room by it ("No match found") and showed the server name, as did the forward/share pickers, toasts, OS notifications and reminders. useRoomMeta gains useLocalRoomNames() / getLocalRoomName(); the quick switcher matches both names and shows the personal one, the forward and share pickers show and filter by it, and message/reminder notifications use it for the room title. Verified headless with general renamed to "Zebra Lounge": Ctrl+K "Zebra" and "general" both list "Zebra Lounge"; the forward picker filtered by "zebra" lists "Zebra Lounge". Not covered here (follow-up): message-search result headers, the inbox notifications page and the threads list still use the server name. Refs #336 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-12 15:40:56 -04:00
Lotus CIandClaude Opus 5.5	70f1d640ed	fix(messages): collapsed long messages work with the keyboard and on any background (#343) ... - Tab into a link in the hidden part used to scroll the overflow:hidden box itself (top cut off, and it stayed that way); focus inside now expands the message, and collapsing resets the scroll. - "Read more" / "Show less" is announced as a toggle (aria-expanded, aria-controls); the arrows are aria-hidden. - The fade is a mask on the content instead of a gradient in a fixed surface colour, so there's no band in bubble layout, on highlights or over chat backgrounds. - The cap is 20rem instead of 320px, so a larger font shows as many lines. Verified headless on a 41-line message with a link on the last line: aria-expanded false → focusing the link expands it (aria-expanded true, no clipping); bubble layout fades into the bubble with no band. Fixes #343 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-12 15:31:50 -04:00
Lotus CIandClaude Opus 5.5	85a2abc46a	fix(logout): clear the call-volume list and settings-sync stamp (#347) ... Logout left lotus-per-user-volume (Element Call's per-person volume map: whom the previous user called and turned up/down; same origin on the web) and settings-sync-meta:<userId> (a key naming the account) in localStorage. clearPlaintextCaches now removes both; device preferences (`settings`) are kept as before. Verified: after joining/leaving a call and logging out via Settings, both keys are gone (unit test added). Fixes #347 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-12 15:28:41 -04:00
Lotus CIandClaude Opus 5.5	5130dfc9c8	fix(settings): "ENTER for Newline" stays per device (#348) ... Settings sync mirrored enterForNewline to io.lotus.settings, so turning it on for a phone keyboard switched the desktop to Ctrl+Enter-to-send (and vice versa). It is now in DEVICE_LOCAL_KEYS. Verified with one account on a phone and a desktop profile: toggling it on the phone leaves the desktop at Enter-to-send, and it is no longer in the synced account data. Fixes #348 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-12 15:27:01 -04:00
Lotus CIandClaude Opus 5.5	d9c797f3f5	fix(presence): leaving Do Not Disturb restores your status instead of "dnd" (#283) ... Lotus encodes DND as status_msg "dnd". After switching back to Auto, the heartbeat read the server's status, adopted "dnd" as the user's own and kept re-sending it, so the custom status was lost and other clients kept showing "dnd"; the Settings status field showed "dnd" too. pickHeartbeatStatus (unit-tested) never adopts the "dnd" sentinel and falls back to the device's real status; Profile neither mirrors it into the local status nor shows it in the field. Verified on the local Synapse: "🎮 Gaming" → DND (unavailable/dnd) → Auto → online/"🎮 Gaming" (before: online/"dnd"). Still open in #283: while in DND other clients show the literal "dnd"; that needs MSC3026 busy presence on the homeserver (matrix#19). Refs #283 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-12 12:39:38 -04:00
Lotus CIandClaude Opus 5.5	9b2ec91dd6	fix(presence): Invisible, Hide Online Status, Idle and DND stick (#282) ... usePresenceUpdater sent a one-off PUT /presence, but the SDK kept long-polling /sync with the default set_presence=online and Synapse treats every sync as "online", so Invisible / Hide Online Status / Idle / DND flipped back within seconds — a privacy setting that silently didn't work. The presence helpers now also call mx.setSyncPresence(): offline for Invisible / Hide Online Status, unavailable for Idle / DND (and auto-mode idle / hidden tab), online otherwise. The PUT stays for the immediate change. Verified on the local Synapse, another account polling every 5 s for 60 s after a reload in each mode: invisible → offline ×12, hidePresence → offline ×12, idle → unavailable ×12, dnd → unavailable ×12, online → online (currently_active) ×12; /sync carries set_presence=offline / unavailable / online accordingly (before: online* throughout). Fixes #282 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-12 12:35:26 -04:00
Lotus CIandClaude Opus 5.5	cf22fd8501	fix(location): confirm before sharing, with accuracy and an approximate option (#340) ... The composer's location button sent the exact position (6 decimals) from a single click once the browser permission had been granted, discarding the fix's accuracy, so a ±3.5 km Wi-Fi/IP fix was shown as exact. - ShareLocationDialog: "Share your location?" with the coordinates and ±accuracy, a "Check on OpenStreetMap" link, and Cancel / Send approximate (~1 km) / Send. Focus starts on Cancel; Esc cancels. - utils/geoShare.ts (unit-tested): RFC 5870 geo URI with `;u=` accuracy; approximate shares round to 2 decimals and never claim better than 1 km. - Location cards show the ± when the event carries `u=`. - The toolbar icon is a pin instead of the globe. Verified headless (fix 40.748817,-73.985428 ±3500 m): the click opens the dialog and sends nothing; Cancel/Esc send nothing; Send approximate → geo:40.75,-73.99;u=3500; Send → geo:40.748817,-73.985428;u=3500; the card reads "40.74882, -73.98543 (±3.5 km)". Fixes #340 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-11 22:16:05 -04:00
Lotus CIandClaude Opus 5.5	ddf9da1a55	fix(reminders): a reminder stays until you've seen it (#338) ... ReminderMonitor pushed an ordinary toast (auto-dismissed after 4 s) and deleted the reminder at once, with no OS notification — one that came due while the app was in the background or the user was away was lost. Now the reminder toast is sticky; clicking it opens the message and dismissing it closes it, and only then is the reminder deleted (an unseen one returns on the next start). When the window isn't focused it also raises an OS notification (respecting "show notifications" and quiet hours; no decrypted E2EE text, per N106). Verified headless (notifications granted, window unfocused): due at t+24 s, the toast stayed up for the remaining 51 s, one OS notification "Reminder :: call the dentist before 5", the reminder stayed in io.lotus.reminders until dismissed, then was removed. Fixes #338 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-11 22:11:31 -04:00
Lotus CIandClaude Opus 5.5	861293243c	fix(calls): "Channel Full" counts people, not devices (#342) ... useVoiceChannelFull compared the number of MatrixRTC memberships (one per device) with io.lotus.voice_limit, so one person on desktop + phone, or a crashed tab whose membership hadn't expired, filled two slots and locked others out, while the server-side guard (which counts distinct users) would have admitted them. utils/voiceChannelFull.ts (unit-tested) counts distinct senders; the header/sidebar counter shows people too. Verified on the local stack: limit 2, @aud_main in the call on two devices; @aud_bob's prescreen now shows 1/2 with Join enabled (was "Channel Full (2/2)"), matching the guard's 200. Fixes #342 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-11 22:07:18 -04:00
Lotus CIandClaude Opus 5.5	e50bd677d6	fix(presence): closing a tab no longer erases your custom status (#339) ... The pagehide keepalive write sent { presence: 'offline' } with no status_msg, which Synapse treats as clearing it, so closing or reloading any Lotus tab wiped the user's status for everyone (intermittently, as the 10 s presence rate limit sometimes 429'd the write). It now sends the current status along with the offline state. Verified against the local Synapse: with a status set from another device, two reloads and a tab close keep it (server shows offline/"Gone fishing" after the close; before, the first reload wiped it). Fixes #339 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-11 22:04:57 -04:00
Lotus CIandClaude Opus 5.5	747714b2f3	Merge branch 'deps/npm-audit-fixes' into fix/gif-card-aspect ... Brings in #346 (npm audit fixes) so this PR's CI audit step passes; the shared commit drops out of this PR's diff once #346 is merged into lotus. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-10-10 22:45:04 -04:00
Lotus CIandClaude Opus 5.5	c9d276d2a5	deps: fix the npm audit advisories that turned CI red (#345) ... `npm audit --audit-level=high --omit=dev` (Build & Quality Checks) started failing on every branch after new advisories were published: - source-map-js 1.2.1 → 1.2.2 (high, GHSA-68fv-2mgg-jv7q; transitive via sanitize-html → postcss, in range — lockfile only) - i18next-http-backend 4.0.0 → 4.0.2 (low, GHSA-xvq9-wjp8-hwqf) - katex 0.16.47 → 0.18.11 (low, GHSA-238p-pmpm-9mq7; fixed in 0.18.2). 0.17/0.18's breaking changes are an internal __defineFunction API and prefixed internal CSS classes; Lotus uses neither (KaTeX.tsx calls renderToString and imports the package's own stylesheet). Only these four lockfile entries change (plus katex's own CLI dependency commander 8 → 15). npm audit --omit=dev: 0 vulnerabilities. Verified headless against Vite with a fresh dep cache (katex 0.18.11 served): inline and display math render (\frac, \sqrt, \sum with limits), KaTeX fonts load, no page errors; translations still load (en strings, no raw keys). tsc clean, 1319 unit tests pass, eslint 0 errors (36 warnings, unchanged), prettier clean, production build OK. Fixes #345 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-10-10 22:28:30 -04:00
Lotus CIandClaude Opus 5.5	68f44f0f1c	fix(embeds): GIF previews keep their own size and shape (#341) ... Giphy and Tenor link previews forced every GIF into the same box — full card width, max 200px tall, object-fit: cover — whatever its shape: a square GIF lost half its height, a portrait one three quarters (only the middle band showed, so captions and faces at the top/bottom were cut), and a 100×80 GIF was blown up 4×. utils/gifPreviewSize.ts (unit-tested) fits the GIF inside 400×320 from og:image:width/height, keeping its aspect ratio and enlarging small GIFs at most 2×. The card centres the GIF on the surface colour with object-fit: contain, reserves the box before it loads, and the GIF badge sits on the GIF's corner. Without dimensions it shows at natural size, capped by the card. The >10 MB thumbnail fallback is requested at 2× the box (800×640) so it isn't upscaled. Verified headless (fixture previews, desktop / Pixel 7 / 320px phone): 480×200 → 398×166, 300×300 → 320×320 (292×292 on 320px), 240×480 → 160×320, 100×80 → 200×160, all 100% visible; the no-dimension fallback and narrow cards keep the ratio. tsc clean, 1325 unit tests pass, eslint 0 errors (36 warnings, unchanged), prettier clean. Fixes #341 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-10-10 22:15:56 -04:00
Lotus CIandClaude Opus 5.5	6a7627fa26	feat: device-security nudge — verify this device / key backup (#110, #123) ... One "security" strip, in the same top slot and style as the status banner (#124), for this device, in priority order: - "Verify this device" — cross-signing exists but this device isn't verified (can't unlock backed-up history, untrusted to others). First, because verifying with the recovery key also connects the backup. - "Connect this device to your key backup" — a backup exists, this device isn't using it. - "Set up key backup" — no backup at all (includes accounts without cross-signing; the setup flow does both). The button opens Settings → Devices (existing flows); "Not now" snoozes. Rules: nothing in a device's first 24 h; "Not now" snoozes that nudge 7 days; 3 dismissals stop it; never on a healthy device; waits until sync has settled (never under "Connecting…"); outage/maintenance/connection strips win. Per-device record in localStorage, wiped on logout. Mounted inside the Matrix client context and an error boundary (an early version outside the context crashed the app on load — caught before pushing). Also: the status strip wraps its text on phones instead of truncating it when there's no Details button (benefits #124's strips too). Design approved on #123 (real-client screenshots there). Tests: 4 unit (the #123 state table, loading, timing, stored record); e2e: nothing during the grace period, "Set up key backup" → Settings → Devices, "Not now" holds across a reload. Unit 1319, Playwright 29 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-30 20:28:32 -04:00
Lotus CIandClaude Opus 5.5	6acdd439d5	fix(desktop updates): pacman command downloads first, installs the local file ... `sudo pacman -U <url>` also fetches `<url>.sig` and failed (404) on CachyOS: remote packages fall under RemoteFileSigLevel (signature required) and we don't sign the package. A downloaded file installs under LocalFileSigLevel (optional): `curl -LO <url> && sudo pacman -U ./…`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-30 19:57:12 -04:00
Lotus CI	9aec3691ac	Merge remote-tracking branch 'origin/lotus' into linux-package-updates	2026-09-30 19:41:39 -04:00
Lotus CIandClaude Opus 5.5	fbdac30d18	deps: brace-expansion 1.1.18 → 1.1.21 (GHSA-q2hr-2g5m-vwhr and two related DoS advisories) ... npm audit --omit=dev started failing every PR: brace-expansion <=1.1.20 (via @eslint/eslintrc → minimatch 3) has three high-severity DoS advisories. Lockfile-only patch bump; nothing else changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-30 19:04:47 -04:00
Lotus CIandClaude Opus 5.5	27d659118f	fix(desktop updates): Linux package installs update via their package manager ... Reported on CachyOS: "Check for Updates → The update downloaded but couldn't be installed … Permission denied (os error 13) at path /usr/bin/tauri_current_app…". The app was installed from the Arch package; Tauri's Linux updater can only replace an AppImage. With cinny-desktop's new update_install_kind command: - pacman / deb installs: the toast says the update is available and opens Settings → General → App Updates, which shows the package-manager command (`sudo pacman -U …pkg.tar.zst`, or the .deb + `sudo apt install`) with Copy command and Download package — no Install & Restart that can't work. "Copied" only when the clipboard write actually succeeded. - other distros: a link to the downloads page. - Windows, AppImage, and desktop builds without the command: unchanged in-app update. - a native "package-managed" refusal shows the same help. Tests: unit (kinds, commands, refusal detection); in the real client with a simulated desktop bridge: pacman → toast + Settings command/buttons, install never attempted; older desktop → in-app flow as before. Unit 1321, Playwright 26 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-30 19:00:10 -04:00
Lotus CIandClaude Opus 5.5	6ae0087213	feat: homeserver status banner from Uptime Kuma (#124) ... When the homeserver, voice calls or sign-in break, or maintenance is under way, say so in the app — driven by the Kuma status page (isitup.lotusguild.org/status/matrix), managed from Kuma's UI. The client asks Kuma directly (not via our servers) so it still hears "the server is down" when our servers can't tell it. - config.json `statusPages`, keyed by homeserver: users of other servers never contact Kuma. - utils/kumaStatus.ts (pure, unit-tested): parse Kuma 2.x's public JSON; a group is down when any monitor fails two checks in a row (down+down or pending+down); maintenance = windows under way; announcements = incidents. One strip at a time: server down (connection lost AND Kuma confirms) > server having problems > maintenance > calls down > announcement; sign-in problems on the login screen only. - Wording about the user's own connection: "Connection lost … our status checks say the server is up, so it may be your internet connection" ONLY when Kuma checked the server after this client's connection dropped and it passed; a stale "up" (Kuma needs a minute or two to notice an outage) keeps the plain "Connection Lost!". - useServerStatus: polls only while visible; 5 min, 60 s while something is wrong or the connection is lost, at once when it drops; backoff; any failure = no banner (Kuma being unreachable never looks like Matrix being down); GET only, no cookies. - UI in the existing banner slot and style (ContainerColor/Line like the sync and clock banners); Details expands; dismiss for calls-down and announcements (an edited announcement comes back); calls-down note above Join; phone: one line + Details. Needs the CSP connect-src to allow https://isitup.lotusguild.org (matrix repo) before it can fetch in production; until then it fails quiet. Tests: 15 unit tests (live page layout, two-check rule, any-monitor rule, unknown/garbage, UTC beat times, stale-vs-fresh "up", priorities, login vs client, maintenance, announcements + dismiss/edit); e2e (fixtures for Kuma): calls-down strip + dismiss across reload, other homeservers make no requests, Kuma 500 → nothing, lost connection + Kuma down → critical strip instead of "Connection Lost", + fresh "up" → "may be your connection", + stale "up" → plain "Connection Lost". Unit 1315, Playwright 26 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 12:08:08 -04:00
Lotus CIandClaude Opus 5.5	9b9f33b270	feat(desktop): mirror the login tokens into the OS keychain (#105, step 1) ... Step 1 of moving the desktop app's login out of the webview's plaintext localStorage: keep a verified copy of the tokens in the OS keychain (Windows Credential Manager, via cinny-desktop's new secure_session_* commands). The session is still read from localStorage exactly as before, so nothing about login changes and a keychain problem can't log anyone out. Step 2 (a later release, once this has run on real installs) switches reads to the keychain and drops the tokens from localStorage. - sessions.ts: onSessionPersisted — listeners told about every session write (login, token rotation) and removal (logout); a throwing listener can't break the write. - keychainMirror.ts: desktop only. Mirrors userId/deviceId/accessToken/ refreshToken (not the rest of the session); reads first and writes only when the copy differs, then verifies by reading back; serialized, 5 s timeouts; no session → clear (also covers a logout whose reload beat the clear). Every failure is a status, never an exception. A desktop build without the commands reads as "unsupported", so this can ship before the desktop side. - Settings → General (desktop): "Login in the system keychain" status. Tested: unit tests (fake keychain: store, no rewrite when current, rotation, clear, unsupported, missing commands, denied write, read-back mismatch, timeout); a simulated desktop app with a fake keychain, 14/14 (login mirrors only the secrets, Settings status, reload verifies without rewriting, logout clears, an existing session is mirrored after upgrade, Linux/denied show an honest status and stay logged in); the real Linux desktop binary (commands answer "unsupported", login unaffected, Settings says so). Unit 1295 pass, Playwright 20 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 00:24:46 -04:00
Lotus CIandClaude Opus 5.5	7d7a379ce0	feat(desktop): call page on its own loopback origin, opt-in (#43) ... The desktop app loads the bundled Element Call page from its own origin (http://localhost:<port>), so the call frame can read the app's storage (login token) and DOM — the hole #43 closed on the web by moving the page to call.chat.lotusguild.org. The desktop's local server can also answer on http://127.0.0.1:<port>: the same server and bundle, but a different origin (and still a secure context). resolveDesktopCallPageUrl loads the bundled page from there when the desktop config sets `desktopCallOrigin`: - only a loopback http origin on the SAME port as the app, no path, query or credentials; - only when the app itself runs on http://localhost (release builds; debug builds on tauri:// keep the same-origin page); - unset (every desktop build until cinny-desktop opts in, together with the server bind, CSP and permission changes it needs): unchanged. The web app is unchanged (elementCallUrl as before). Tested in a simulated desktop app (Tauri bridge stub + the desktop config.json, served on localhost and 127.0.0.1) against a local Synapse + LiveKit, two users: call page from http://127.0.0.1:<port>, parentUrl = the app origin; the frame gets SecurityError on parent.localStorage and parent.document (same-origin control: readable); join, speaking indicator, mic off/on, screenshare start/stop, layout switch and hang-up all work, no page errors — 12/12 in 5 of 6 runs, like the same-origin control (3 of 4; the misses on both sides were the local LiveKit connection). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-29 00:09:27 -04:00
Lotus CI	f0865115a4	Merge remote-tracking branch 'origin/lotus' into clock-skew-lag	2026-09-28 22:11:31 -04:00
Lotus CIandClaude Opus 5.5	3e5fdd0dab	test(e2e): clock-ahead warning needs a minute of samples (#158) ... "Ahead" is now reported only once it has held for a minute of fresh samples (a stalled server delivers late and reads as ahead). The test sends its ticks, checks nothing is shown yet, fast-forwards the page clock past a minute and sends two more. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 22:08:13 -04:00
Lotus CIandClaude Opus 5.5	bb569d69a2	fix: a stalled server no longer reads as "your clock is ahead" ... Incident 2026-09-29: the homeserver's host ran out of memory and stalled for ~2 minutes. The /sync that finally went out carried events whose `age` was computed ~30 s before it arrived, so every client showed "Your computer's clock is 30 seconds ahead of the server" while the real problem was the server (all host clocks were within 0.25 s the whole evening). The skew estimate was the median of the last 5 samples, and a sample is local skew + delivery delay, so one late /sync with a handful of events tripped it. - Estimate = the LOWEST sample of the last 5 minutes: delay only ever adds, so the fastest-delivered event is the truest. - "Behind" (which a delay can't cause) is reported as soon as there are 3 samples, like before. "Ahead" must hold across samples received at least a minute apart, so a single late burst never trips it. - Samples are aged on the monotonic clock, and a change of the local clock (someone fixing it) resets the measurement, so the warning clears at once. - Only events stamped by our own homeserver are sampled: a federated event's origin_server_ts is the other server's clock. - Wording: "This device's clock is … Voice calls and encrypted messages can fail until it's corrected." / call bar "Device clock … : calls may fail" (was "will fail"). Unit tests: the incident (late burst after normal traffic, and a fresh client whose first samples are all late), mixed slow/fast deliveries, ahead only after a minute, behind at once, hysteresis, clock fixed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 21:40:02 -04:00
Lotus CIandClaude Opus 5.5	02d86caeb0	feat: offline outbox — unsent messages survive reload and retry (#112) ... Until now a send that failed (offline, homeserver down, a blip) went straight to "Failed to send": nothing retried it, and a reload dropped it without trace (chronological pending ordering keeps local echoes in memory only). - Outbox (utils/outbox.ts + features/outbox/OutboxFeature): own message sends (text, stickers, reactions, polls; not call signalling or redactions) are mirrored to localStorage from their first local echo until the server confirms them or the user cancels. - After a reload they come back as local echoes via room.addPendingEvent, same shape as the SDK's own. Recent ones (< 1 h) are sent again with the same txnId; older ones come back as "Failed to send" for the user to retry or cancel. Ones the server already has (transaction id seen in /sync) are dropped, so no duplicates. - Retries: network failures (ConnectionError, 408/429/5xx) are re-sent when the connection returns (sync recovers or the browser goes back online), and after a blip while online (5 s, backing off, max 10 per message). Oldest first, in order per room. 4xx / consent / encryption failures are left to the user. - UI: a network failure while offline shows a clock, "Queued. Will send when you're back online" (thread view too), not the red ✕. The ✕ is now a button: click to retry. - Logout wipes the outbox with the other plaintext caches (the content is decrypted, like drafts). Tested end to end against a local Synapse (Chromium): offline → queued → sent once on reconnect; homeserver unreachable → queued → sent once; failed send → reload → sent once and shown once; server accepted but response lost → reload → no duplicate; 2 h old entry → failed, not sent, click ✕ → sent; cancel → gone after reload; encrypted room → restored message goes out as m.room.encrypted with no plaintext and decrypts; one-off failure retried by itself in ~5 s; no page errors. Unit tests for the pure parts; Playwright 20 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 21:02:45 -04:00
Lotus CIandClaude Opus 5.5	1ea6987083	fix(desktop): Lotus links use the public web app, and open in-app (#248) ... Lotus permalinks (#130) were built from window.location.origin. In the desktop app that's the local tauri-plugin-localhost server (hash-routed), so "Copy Lotus Link" copied e.g. http://localhost:…/#/home/!room…, which works for nobody else. And the link recogniser only knew that local base, so a real https://chat.lotusguild.org/home/… link in a message opened the browser instead of the room. - useLotusShareBase: in the desktop app, links for other people use config `webAppUrl` (https only, set by cinny-desktop #23) in web path-routing form; otherwise the origin, as before. Used by "Copy Lotus Link" on messages, the space menu and space tabs. - The recogniser accepts several bases: the origin, plus `webAppUrl` in the desktop app. - The web app is unchanged. Verified with a simulated desktop (Tauri bridge + webAppUrl) against a local Synapse. Copied links are https://chat.lotusguild.org/home/<room>/<event> and https://chat.lotusguild.org/<space>. A public link in a message renders as the room pill and clicking it opens the room in-app, with nothing sent to the system browser. The web app still copies origin links. Unit tests for the base selection; Playwright 20 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-28 19:39:48 -04:00
Lotus CIandClaude Opus 5.5	1e217592fc	fix(polls): readable poll card: counts, visible bars/indicators, no chip overflow (#246) ... Rendering only; the vote logic (tally, optimistic votes, end poll, keyboard radiogroup, voters) is unchanged. - Every row shows "N votes · P%". Multiple choice looked broken as "100% / 100%" with no counts; the footer now says "voters" there. - Results are a thin progress bar under each answer: accent for your pick, success for the winner, neutral otherwise. The old full-row fill was the same grey as the row, so a 100% answer just looked disabled. - Radio and checkbox indicators are 18px with a 2px border in a colour mixed from the theme's text colour. Primary.ContainerLine was nearly invisible, especially in dark themes. - The winner shows a star and "Winner" instead of a second check mark. - Bordered card, 460px wide (max 100%, same width for every poll). The header is now "Poll · Single choice | Pick up to N | Results hidden until the end | Final results", replacing the letter-spaced "◉ POLL · …" line. - Footer: plain muted text that wraps, and chips ("Who voted", "End poll") that never wrap. Previously the chip label broke onto two lines inside a one-line chip and spilled out of it. Reproduced before/after in Lotus Terminal at 150% zoom, a 360px phone, and dark at 125%. - Lotus Terminal theme: data-winner gets its own green border rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-27 23:18:25 -04:00
Lotus CIandClaude Opus 5.5	fff583fca5	feat(call): desktop without WebRTC offers "Open in browser" instead of a dead end ... The Linux desktop app runs on WebKitGTK, which ships without WebRTC (2.52 has no RTCPeerConnection; 2.54 disables it outright pending a libwebrtc backend around 2.56), so calls can't work there. Until now the call button just disappeared, the call room said "Your browser does not support WebRTC" with Join disabled, and an incoming call couldn't be answered. In the desktop app (isTauri) without WebRTC: - call rooms: "Calls aren't available in the desktop app on Linux yet: its web engine has no WebRTC" + an "Open in browser" button; - incoming-call overlay: the same, with "Answer in browser"; - room header: the call button stays, and opens the room in the browser. The link is the room in the web app (config.json `webAppUrl`, https only, new key); the user presses Join there. Deliberately not an auto-join link: a crafted URL must not be able to join a call and open someone's mic. It opens through the desktop's new-window handler (web/mail schemes only → the system browser). Without `webAppUrl` the explanation shows with no button; browsers without WebRTC keep the old message. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-27 16:54:29 -04:00
Lotus CIandClaude Opus 5.5	b929cbf74b	chore(call): pin element-call-embedded 0.25.0-lotus.22 (#43) ... lotus.22 draws the "Share your screen?" prompt inside the call frame on request and drops the corner button. Verified against the published package: no-delegation (Firefox path) cross- and same-origin — bar button, in-frame prompt, Cancel, Share → screenshare tracks, bar Stop; Chromium unchanged; picture-in-picture prompt fits and Share works; room policy hides the button and refuses the prompt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-27 13:32:45 -04:00
Lotus CIandClaude Opus 5.5	8520de232d	feat(call): screenshare stays on the call bar in Firefox/Safari via the in-frame prompt (#43) ... With a fork that reports `screensharePrompt` (element-call lotus-screenshare- prompt), the call bar and status bar keep their screenshare button on every engine. Where the click can't be delegated, starting asks the fork to show "Share your screen?" inside the call frame (io.lotus.prompt_screenshare) instead of our own confirm; its Share click starts the share. Stopping works from the bar as before (no click needed in the frame). Chromium is unchanged. - useScreenshareMode: hidden (older fork's corner button) | prompt | direct. - The room's call policy is also pushed to the fork in prompt mode, so the prompt never opens where sharing is forbidden. - Picture-in-picture: the "Return to call" overlay covers the frame; while the fork reports the prompt open it lets clicks through to it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-27 12:48:12 -04:00
Lotus CIandClaude Opus 5.5	da78bff316	chore(call): pin element-call-embedded 0.25.0-lotus.21 (#43) ... lotus.21 checks widget messages against the host's origin (works same- and cross-origin) and accepts soundboard clip bytes. Same-origin behaviour is unchanged; verified against the published package: join, both screenshare paths, PTT/deafen in the frame, layout/reactions/settings, speaking and mic level, soundboard, avatars, muted-speech warning, per-person volume, and the foreign-frame spoof stays blocked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-27 02:05:18 -04:00
Lotus CIandClaude Opus 5.5	4dcc5176e2	feat(call): optional Element Call origin via config.json elementCallUrl (#43) ... Groundwork for serving the call page from its own origin (call.chat.lotusguild.org). Inert until config.json sets `elementCallUrl`: without it the bundled same-origin page is used exactly as today. - callPageUrl: resolves `elementCallUrl` — absolute https only (http only on localhost for development); anything else, and the desktop app, fall back to the bundled page so a bad value can't break calls. Set once from the loaded client config. - CallEmbed builds the widget URL from it; the widget origin (used by the message guard and Capability Delegation) follows automatically. - Soundboard: a host blob: URL can't be fetched from another origin, so io.lotus.inject_audio now also carries the clip's bytes (`audio`). Forks that predate it ignore the field and use `url`, so this is safe on the released fork. Needs element-call's lotus-call-origin branch (host-origin message check + inject_audio bytes) released and pinned before `elementCallUrl` is set. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 23:24:24 -04:00
Lotus CIandClaude Opus 5.5	df395776b4	fix(security): widget API only accepts messages from the widget's own frame ... matrix-widget-api's host transport handled a message from ANY window on the page as long as it carried the widget's id; its strictOriginCheck only compares with the host's own origin and is off by default. The call's id is the fixed 'call-embed', so any other frame (a room widget, a URL-preview embed) could post fromWidget actions as the call. Reproduced locally: an opaque-origin frame posting one io.lotus.hotkey keydown for the PTT key turned a push-to-talk user's mic on ("● Live"). restrictWidgetMessages() swaps each ClientWidgetApi transport's listener for one that requires ev.source === the widget iframe's window and ev.origin === the widget's origin. Applied to the call and to room widgets (so one widget can't impersonate another). Verified: the spoof no longer opens the mic; PTT/deafen from inside the call, screenshare, speaking indicator and room widgets (capability prompt, send, live events) unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 22:22:57 -04:00
Lotus CIandClaude Opus 5.5	49dec686f1	feat(call): screenshare from inside the frame where delegation is missing; host stops reading the call frame (#43) ... Firefox, Safari and the WebKitGTK desktop app can't hand the user's click to the call frame (no Capability Delegation), and getDisplayMedia needs it. The host used to click EC's hidden footer button through the DOM instead, which dies with same-origin. Now (pins element-call-embedded 0.25.0-lotus.20): - those engines get `lotusFrameScreenshare`, the fork shows EC's own screenshare button in the frame, and the call bar and status bar hide theirs once controls_state reports `frameScreenshare`; the screenshare-audio mute stays; - the room's call policy is pushed with io.lotus.set_frame_screenshare, so the frame button hides where the server would refuse a share, like ours; - Chromium keeps the delegated io.lotus.set_screenshare from the host bar. Removed the fallbacks for forks older than lotus.14, which read or clicked EC's DOM: the screenshare/layout/settings/reactions/leave button lookups and their MutationObservers, the frame-window hotkey binding, and the speaking/muted tile scrape in useCallSpeakers (io.lotus.call_state is the only source now). getCallDocument is gone; the host's only handle on the frame is postMessage. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 22:04:54 -04:00
Lotus CIandClaude Opus 5.5	ba48e95993	feat(media): Media Gallery includes media posted in threads (#165) ... The SDK routes thread replies out of every room timeline set, the gallery's detached one included, into the room's Thread objects, so photos posted in a thread never reached the gallery. The gallery now merges media from the loaded threads (deduped, newest first) and refreshes on ThreadEvent.NewReply, waiting for decryption in encrypted rooms. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 19:31:10 -04:00
Lotus CIandClaude Opus 5.5	a8db61f79f	fix(threads): viewing a room no longer marks threads you follow read (#217) ... markAsRead ran on every room visit (timeline at the bottom and focused) and sent a threaded receipt for every unread thread, so a reply in a thread you started or replied in lost its unread badge the moment you glanced at the room, without opening the thread. Reads from just viewing the timeline are now "passive": - threads you follow (started, replied in, or were mentioned in) stay unread until their panel is opened; other threads are still cleared so they don't keep the room dot lit forever; - while a followed thread has an unread reply, the main receipt is scoped to the main timeline instead of unthreaded, because an unthreaded receipt also reads every older thread reply (the next main message would clear the thread anyway). The check also asks whether the latest reply is read, since the thread's count lags when the reply and a main message share a sync; - the thread open in the panel is skipped, as the panel sends its own receipt (was two identical receipts per reply). Explicit "mark as read" (room menu, Escape, bulk actions) still clears everything. Unit tests for each rule plus a local-homeserver e2e that checks the server's per-thread count survives a reply + newer main message. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 19:31:00 -04:00
Lotus CIandClaude Opus 5.5	f5d3c43b6c	fix(viewer): thread media steps through the thread; add Copy image (#164) ... Thread images opened the room media lightbox, which looks the event up in the room's detached media timeline. Thread replies never reach that timeline, so a thread image always showed "1 / 1" with no prev/next, after paging the room's media up to six times. The thread panel now builds the viewer's items from its own root + loaded replies, and "Go to message" scrolls the thread panel instead of the room. The viewer gains a "Copy image" button: fetches the displayed media (blob URL for E2EE, authenticated URL otherwise), re-encodes to PNG when needed, and writes it via ClipboardItem with a promise so Safari keeps the click's user activation. Hidden where ClipboardItem is missing. No "open in new tab": an E2EE blob URL is revoked when the viewer closes and authenticated media 401s in a bare tab. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 19:02:49 -04:00
Lotus CIandClaude Opus 5.5	502b9dfd83	feat(call): stop injecting CSS and key listeners into the call frame (#43) ... Pins @lotusguild/element-call-embedded 0.25.0-lotus.19. - Styles: the fork now hides its own footer (`lotusHostControls=1`) and sets its root color-scheme from the theme, so the host no longer injects `#lotus-ec-styles` or sets inline styles on EC's DOM. The two other injected rules matched nothing in EC 0.25 (dead). The transparent background was already the fork's (`lotusTransparent`). - Hotkeys: PTT / deafen keys pressed with focus inside the call frame now arrive as `io.lotus.hotkey` (the host sends the codes via `io.lotus.set_hotkeys`), instead of listeners on the frame's window. The window binding stays only for a fork that doesn't report `hotkeys`. - Fixes (with lotus.19): pressing the deafen key M with focus in the call also hit EC's own "M = toggle mic" shortcut, so the first press turned the mic ON instead of deafening — even in push-to-talk mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 14:35:44 -04:00
Lotus CIandClaude Opus 5.5	024edbf546	feat(call): screenshare over the widget API with Capability Delegation (#43) ... The call bar's Start/Stop Screenshare no longer clicks EC's hidden button on Chromium (incl. WebView2): it sends io.lotus.set_screenshare with postMessage `{ delegate: "display-capture" }` inside the user's click, so the frame can call getDisplayMedia on engines that require the click. matrix-widget-api has no postMessage options, so its sendInternal is swapped for that one synchronous send; delegation needs the frame's real origin, not `*`. Firefox, Safari and WebKitGTK (Linux desktop) have no delegation and still click EC's button (needs same-origin, which is still on). Gated on the fork reporting `screenshareAction` in controls_state. Pins @lotusguild/element-call-embedded 0.25.0-lotus.17. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 13:27:42 -04:00
Lotus CIandClaude Opus 5.5	ba5b1ffe7d	feat(embeds): fallback for hung embeds and deleted X posts (#200) ... Probed how real providers fail before picking signals: - X renders an EMPTY frame for a deleted/private/suspended post and says so only via postMessage `twttr.private.no_results`. The post embed now swaps to "This post isn't available…" with an "Open on X" link. - A hung frame never fires `load`. After 20 s every player (media, rich posts, TikTok, Steam widget, X) overlays "This embed is taking too long to load" with Retry (remounts the iframe) and "Open on <site>". A late `load` clears it. - Instagram and Bluesky show their own "removed / not found" page, and a refused request still fires `load` (browser error page), so neither needs or can use a guess. A missing height message is not treated as failure. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 11:54:16 -04:00
Lotus CIandClaude Opus 5.5	1b5e6a37f5	fix(a11y): stable reaction labels — emoji glyph, custom emoji shortcode (#179) ... The reaction button's aria-label used getShortcodeFor(), which returns undefined until the lazily loaded emoji data arrives. The same button read "🎉 reaction, 1 person" on first render and "tada reaction, 2 people" after any later re-render. It now always uses the emoji itself (screen readers speak it by its proper name, e.g. "party popper"). Custom (mxc) emoji were labelled just "custom emoji"; they now use the shortcode carried on the reaction event (":lotus_blob: reaction"). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 11:34:03 -04:00
Lotus CIandClaude Opus 5.5	52d94058cf	fix(decorations): drop clyde_invaders (Discord Clyde artwork) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 00:21:19 -04:00
Lotus CIandClaude Opus 5.5	e6388fe294	fix(decorations): drop warp_helmet (Clyde-visor design) ... Same Discord Clyde-visor artwork as the helmets excluded in 78b1a2ff. Anyone who had it equipped now shows no decoration: the slug no longer passes isValidDecorationSlug. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-26 00:10:45 -04:00
Lotus CIandClaude Opus 5.5	78b1a2ff6f	feat(decorations): 530 new avatar decorations, thumbnail-first picker ... Adds 530 decorations in 19 new categories (631 total). Decorations that contain Discord branding (the Clyde-visor helmets) are excluded. The decorations are ~1 MB animated PNGs, so a picker that rendered every one would pull ~590 MB while scrolling. The picker now: - shows static 144px WebP thumbnails (~9.5 KB each, `thumbs/` on the CDN) and loads the animated file only on hover, focus or selection, with a fallback to the full file if a thumbnail is missing; - mounts one category at a time behind tabs, plus a name search across all categories. scripts/makeDecorationThumbs.py builds the thumbnails from the busiest frame of each animation (many start on an empty frame). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 23:50:12 -04:00
Lotus CIandClaude Opus 5.5	4323babfb9	fix(composer): a fully typed user ID + Enter sends as typed ... d2503332 made Enter pick the mention suggestion, which also caught "/kick @alice:server" + Enter (the e2e "/kick failure is reported" test): typing a complete ID opens the mention list too, and Enter picked it instead of running the command. Enter now picks only while a partial name is being typed (no ':' in the query); a complete @user:server or #alias:server sends as typed, like before. Chromium e2e 19 passed; "@bo" + Enter still picks, ":smi" + Enter still sends. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 18:20:04 -04:00
Lotus CIandClaude Opus 5.5	d250333290	fix(composer): Enter picks the @-mention / #room / command suggestion ... With the mention list open, pressing Enter sent the half-typed text ("hey @bo") instead of inserting the highlighted person — found while investigating the "composer hit a snag" report; only Tab picked. Enter now picks the top suggestion for people, rooms and commands, as in Discord, Slack and Element. useAutocompleteEnter listens in the window capture phase (so it runs before the composer's submit handler) and only while the list has suggestions — with no command match Enter still sends. Emoji suggestions are deliberately left on Tab only, so "lol :p" + Enter still sends rather than inserting an emoji. IME composition and Shift/Ctrl+Enter are untouched. Tab now inserts the member's display name, same as a click. Verified: "@bo" + Enter inserts the mention and sends nothing; the next Enter sends "hey @bob hi" with m.mentions; ":smi" + Enter still sends. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 18:13:47 -04:00
Lotus CIandClaude Opus 5.5	4c9af57a97	fix(composer): recover silently from a composer render error; capture details ... Reported on chat.lotusguild.org: picking a name from the @-mention list showed "The message composer hit a snag." — clicking OK continued with the draft intact. The composer's known failure mode is a transient render error right after an autocomplete insert (slate-react's DOM selection sync racing the model; 477df4ae fixed one such path). It did not reproduce locally in 60 attempts (click / Enter / Tab, fast and slow, display names with spaces and emoji, Chromium and WebKit), so this makes it harmless and diagnosable: - ComposerErrorBoundary: the first failure clears the selection and remounts the composer immediately, with no notice (the draft is intact). A second failure within 5 s shows the notice, now saying the draft is safe, with "Reload composer" and "Copy details" (time, error, stack, component stack, browser). Every failure is logged to the console as "[composer] render error". - Used for the room composer and, newly, the thread panel composer (which had no boundary, so the same error took the whole panel down). Verified with a temporary injected crash (not committed): one crash recovers with the draft kept and no notice; two within 5 s show the notice, Copy details copies the report, Reload composer restores the full draft. Chromium e2e 19 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 18:08:33 -04:00
Lotus CIandClaude Opus 5.5	afd14719ef	fix(settings): say when GIF search isn't set up instead of a dead switch ... The GIF button needs a Giphy key in the client config. Without one (the desktop app until now), switching "GIF Picker" on did nothing and nothing said why. With no key the tile now explains it and the switch is disabled; with a key it is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 15:50:22 -04:00
Lotus CIandClaude Opus 5.5	fda6e0f74e	feat(seasonal): Halloween — more going on: wisps, a witch, a swarm (#239) ... Jared felt the first redesign was too sparse for a full theme: most of the time only two webs and a spider were on screen. - Will-o'-the-wisps: six soft green/orange glows wandering and pulsing, always present while animating (not in the still scene, where static glows would sit on text). - A witch on a broom crosses just below the header about once a minute (redrawn so she reads as a seated figure, not a blob). - Bats every 20 s (was 30), plus a faster swarm of eight every 60 s. - The big spider now climbs up its thread and drops back with a bounce. - A second, small spider on the left web; a tiny jack-o'-lantern with a flickering candle hangs by the right web (desktop). Rendered and inspected at the witch/swarm moments in light, dark and phone, plus reduced; still 60 fps on vs off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-25 15:17:33 -04:00