Commit Graph

1611 Commits

Author SHA1 Message Date
Lotus Bot a77929de8b Bug fixes, security hardening, and performance improvements
- BUG-16: Fixed pagination deadlock (fetching flag stuck on error path)
- BUG-17: Fixed absoluteIndex===0 falsy check skipping unread jump
- BUG-19: Fixed mEvt.getRoomId()! non-null assertion crash
- BUG-20: Wrapped getSettings()/setSettings() in try/catch for corrupt localStorage
- SEC: Replaced randomStr() Math.random() with crypto.getRandomValues() CSPRNG
- SEC: Fixed afterLoginRedirectPath open redirect validation
- SEC: Narrowed OSM iframe sandbox to scripts-only (removed allow-same-origin)
- Perf-2: Memoized selectAtom in useSetting (prevented new atom ref per render)
- Perf-4: Fixed typingMembers setTimeout leak (tracked timers per user/room)
- Perf-8: Memoized getChatBg() result in RoomView (not inline in JSX)
- Perf-12: Replaced body.class * font-family with body.class (inherited)
- Perf-15: Memoized typingNames array chain in RoomViewTyping
- Perf-9: Added blob URL cleanup useEffect in AudioContent
- BUG: Fixed forEach(async) -> Promise.all in useCommands join handler
- BUG: Fixed useCompositionEndTracking missing dependency array
- A11y: Fixed spoiler button aria-pressed + keyboard handler
- A11y: Added aria-label to Send message button
- Build: Set sourcemap:false, removed netlify.toml from copyFiles

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-20 21:11:38 -04:00
Lotus Bot 2b2619145c PTT fixes, TDS expansions, performance hooks, state event renderers
PTT fixes (BUG-7/8/9):
- BUG-7: Fix isEditable to use ownerDocument.body (works in EC iframe context)
- BUG-8: Release mic if callEmbed changes during active PTT (cleanup fn)
- BUG-9: Wire iframe blur/focus listeners for stuck-mic prevention

PiP bug fix (BUG-11):
- Track prevPipMode ref so position only resets when first entering pip mode,
  not on every callVisible change (user drag position preserved)

GIF improvements (BUG-15):
- Show user-visible error text in toolbar on GIF send failure
- Also surface size-limit rejection with a 4-second auto-clearing message

Performance:
- useInterval: replace useMemo with useEffect for setInterval (React StrictMode safe)
- usePan: add unmount cleanup effect to remove document mousemove/mouseup listeners

Feature: timeline state event renderers (low effort, high value):
- Added renderers for RoomEncryption, RoomJoinRules, RoomGuestAccess, RoomCanonicalAlias
- These were silently falling through to the hidden-events fallback

TDS (Lotus Terminal Design System):
- Fix: correct 8 escaped template literals in GIF picker light-mode block
- Add data-emoji-board attribute to EmojiBoardLayout for stable CSS targeting
- Add Tooltip panel styles (dark + light mode)
- Add Switch toggle styles (dark + light mode)
- Add Spinner stroke colors (dark + light mode)
- Add EmojiBoard panel styles (dark + light mode)
- Add PopOut/Menu/floating panel styles (dark + light mode)
2026-05-19 16:45:02 -04:00
Lotus Bot 63e1085984 Security, performance, bug fixes, and TDS improvements
Security:
- HIGH-1: Validate hex color format before CSS interpolation in sanitize.ts
- HIGH-5: Add sandbox attribute to OpenStreetMap iframe
- MED-1: Fix permissive URL scheme regex in LINKIFY_OPTS
- MED-3/HIGH-4: Add .js.map blocking + CSP header to nginx config
- LOW-2: Validate OIDC authUrl scheme before window.open
- Accessibility: Remove maximum-scale=1.0 from viewport meta (WCAG 1.4.4)

Performance:
- O(1) Map index in computePositions (was O(M×T) findIndex per member)
- Add RoomMemberEvent.Membership subscription so positions update on join/leave
- Fix uncleaned 2000ms setTimeout in RoomTimeline useLayoutEffect

Bug fixes:
- BUG-5: Add QUEUED/CANCELLED cases to DeliveryStatus component
- BUG-6: Guard DeliveryStatus against state events via isState() check
- BUG-10: Clamp PiP position on window resize
- BUG-14: Separate runLotusBootSequence into dedicated useEffect([lotusTerminal])
- Fix aria-live on typing indicator (WCAG 4.1.3)
- Add aria-label + aria-multiline to message editor

TDS (Lotus Terminal Design System):
- Add reaction chip styles (dark + light mode)
- Add GIF picker CSS via globalStyle instead of runtime injection
- Add URL preview styles (dark + light mode)
- Add complete GIF picker light-mode TDS block (was missing)
2026-05-19 16:26:25 -04:00
root 20ee28b423 docs: update README for session 2 improvements
- Delivery status indicators for own messages
- URL preview card TDS styling
- Reaction chip TDS styling (dark + light)
- GIF picker CSS moved to lotus-terminal.css.ts
- PTT mic state save/restore
- Boot animation Escape-to-skip
- Read receipt debounce (150ms)
- Chat background count updated
2026-05-16 02:14:17 -04:00
root 9b62b1cb6f feat: URL preview TDS styling, settings description update
- UrlPreview.tsx: add data-url-preview attribute for CSS targeting
- lotus-terminal.css.ts: dark cyan border-left accent + transparent bg
  for URL preview cards in TDS mode (dark + light variants)
- General.tsx: mention Escape-to-skip in boot animation description
2026-05-16 02:11:52 -04:00
root 948ed39d69 fix: save/restore mic state on PTT mode toggle (I-4)
When enabling PTT mode, save current mic state before muting.
When disabling PTT, restore saved state instead of unconditionally unmuting.
Prevents surprising unmute if user had manually muted before switching to PTT.
2026-05-16 01:59:42 -04:00
root b14575fa0a feat: delivery status indicator, GIF picker CSS to TDS file (M-6, M-7)
- Message.tsx: show delivery status (sending/sent/failed) on own messages when
  no read receipts yet; hidden once server confirms (status null); TDS-styled
- GifPicker.tsx: move terminal CSS from runtime <style> tag into lotus-terminal.css.ts
  eliminating flash of unstyled content (M-6)
- lotus-terminal.css.ts: add [data-gif-terminal] selector rules for GIF picker
2026-05-16 01:49:25 -04:00
root 4249150100 feat: reaction TDS styling, debounce read receipts, Escape to skip boot, type fixes
- lotus-terminal.css.ts: add reaction chip styles for dark + light TDS modes
  (cyan border/bg for unselected, orange accent for own/pressed reactions)
- useRoomReadPositions: debounce receipt handler at 150ms (M-3)
- lotus-boot.ts: Escape key skips boot animation (I-3)
- RoomInput.tsx: replace (uploadRes as any) with typed assertion (M-7)
- CallEmbedProvider: call mention detection, audio cleanup, display name (C-1, C-2, M-5)
- EventReaders: timestamps in seen-by modal, filter self, TDS styling
- ReadReceiptAvatars: StackedAvatar pill, TDS visual treatment
- chatBackground: add waves/neon/aurora backgrounds
- RoomView: auto-apply tactical bg when TDS active and bg is none
- settings: extend ChatBackground union type
2026-05-16 01:34:20 -04:00
root 6648ec68a2 docs: add per-message read receipts, GIF picker, DM calls, infra sections to README 2026-05-16 00:54:33 -04:00
root 12541cf987 fix: suppress uncaught promise rejections from fire-and-forget useAsync calls in useEffect 2026-05-15 19:07:13 -04:00
root 74963b6bf2 feat: per-message read receipt avatars showing each user s last-read position 2026-05-15 18:56:17 -04:00
root bf544ebc84 fix: incoming call auto-dismiss, deleted message text, PiP drag cleanup 2026-05-15 16:00:17 -04:00
root 1ab38281f3 fix: location NaN guard, PiP drag unmount cleanup, README v4.12.1 2026-05-15 15:56:43 -04:00
root 0d5ba83f40 fix: use space-parent check to exclude text channels from call button 2026-05-15 15:47:28 -04:00
root b2d36d79e6 fix: restrict call button to DMs and invite-only rooms only 2026-05-15 15:44:51 -04:00
root 549634dca0 fix: VideoButton disabled state, PTT listener leak, TS prop errors
- VideoButton now accepts disabled prop with tooltip and visual feedback;
  PrescreenControls passes disabled=true when cameraOnJoin=false
- PTT key listener in settings tracked via ref, cleaned up on unmount,
  guarded against stacking on double-click; useCallback + useRef
- CallControls screenshare cancel button: variant Surface -> Secondary
- General.tsx Box align prop: align -> alignItems (TS2322 fix)
2026-05-15 15:38:02 -04:00
root a2331eab1f feat: poll vote counting — show tallies, persist vote across refreshes
PollContent now:
- Reads existing m.poll.response / org.matrix.msc3381.poll.response events
  from the room timeline on mount to restore vote state across refreshes
- Counts votes per answer (per-sender latest-wins deduplication)
- Shows percentage bars and vote totals in real time
- Subscribes to RelationsEvent.Add/Remove/Redaction so counts update live
  when other users vote without requiring a page reload
- Optimistic local update keeps the UI snappy while the send request flies
2026-05-15 15:21:20 -04:00
root e30212f409 fix: call system bugs and security hardening
- CallEmbed: fix memory leak — mx event listeners were never removed
  because dispose() called .bind(this) again, creating new function
  objects. Now uses arrow class fields so start()/dispose() share the
  exact same reference.
- callPreferences: toggleVideo is a no-op when cameraOnJoin=false,
  preventing internal state drift from the returned value.
- CallControls: PTT key guard now blocks on SELECT elements and walks
  the DOM for inherited contentEditable to prevent key interception
  inside dropdowns and custom editors.
- RoomInput: GIF fetch validates Giphy CDN domain allow-list,
  HTTP Content-Type header, and enforces 20 MB size cap.
2026-05-15 15:08:55 -04:00
root 0d28f10c95 chore: remove dead code — IncomingCallNotification and useIncomingDmCall
These are superseded by IncomingCallListener in CallEmbedProvider (merged from v4.12.1). IncomingCallNotification was already removed from Router.tsx in a previous commit.
2026-05-15 14:57:51 -04:00
root 0a2ba171b9 fix: remove debug console.log from UserChips.tsx 2026-05-15 14:57:35 -04:00
root 8e9936b829 fix: post-merge bugs — webRTCSupported call, duplicate imports 2026-05-15 14:56:30 -04:00
root 0a29e42b49 fix: correct event type in ForwardMessageDialog and poll response format
- ForwardMessageDialog: use sendEvent instead of sendMessage to preserve
  the original event type (stickers, polls, etc.)
- PollContent: use m.selections for stable m.poll.response (per spec),
  was incorrectly using m.responses
2026-05-15 14:43:31 -04:00
root 977b45f6da fix: show deletion reason as primary text on redacted messages 2026-05-15 14:39:16 -04:00
root 0afd77deaa Post-merge fixes: remove duplicate IncomingCallNotification, restore PiP touch drag + grip dots, show redacted message content
- Router.tsx: remove IncomingCallNotification (CallEmbedProvider.IncomingCallListener now handles all calls)
- CallEmbedProvider: restore touch drag (handlePipTouchStart), grip dots on resize handles, fix normaliseToTopLeft width/height
- FallbackContent/MsgTypeRenderers: add originalBody prop to show struck-through original text on deleted messages
- RoomTimeline: cache text message bodies so they can be shown after redaction
2026-05-15 14:13:41 -04:00
root c8d9906788 chore: merge v4.12.1 — security, calling, editor, media fixes
Key v4.12.1 changes merged:
- Security: sanitize-html updated to v2.17.4
- Calling: video calls in DMs/rooms, user avatars during calls, right-click to start
- Calling: IncomingCallListener with ring sound and answer/reject UI
- Editor: list crash fixes (Firefox + empty headings), codeblock filename support
- Media: URL preview hover state, keyboard nav, click-to-open, OGG audio support
- Date: ISO 8601 (YYYY-MM-DD) date format option
- Misc: stable mutual rooms endpoint, Android notification crash fix

Lotus customisations preserved:
- PiP drag/resize, DM call ring notification, PTT, GIF picker, noise suppression
- Poll voting, message forwarding, image captions, location sharing
- Lotus Terminal design theme
2026-05-15 13:43:04 -04:00
root 5bba52e315 feat: poll voting, location sharing, image captions, message forwarding
- Poll voting: PollContent sends m.poll.response on answer click
- Location: MLocation shows OSM map embed + share-location button in toolbar
- Image captions: caption field on media uploads sets message body
- Message forwarding: ForwardMessageDialog with searchable room picker
- Also includes ring timeout fix and earlier session patches
2026-05-15 13:37:03 -04:00
kfiven e89b8f7d12 chore(release): 4.12.1 [skip ci] 2026-05-15 07:20:54 +00:00
Krishan 9bc1e7e9ff fix: null edit for another release (#2942) 2026-05-15 17:19:08 +10:00
kfiven c05a6be6f2 chore(release): 4.12.0 [skip ci] 2026-05-15 07:02:05 +00:00
Krishan f7f4a41d61 Revert "chore: Update GITHUB_TOKEN to CLA_PAT in prod workflow" (#2941)
Revert "chore: Update GITHUB_TOKEN to CLA_PAT in prod workflow (#2940)"

This reverts commit 81327678b1.
2026-05-15 16:59:52 +10:00
Krishan 81327678b1 chore: Update GITHUB_TOKEN to CLA_PAT in prod workflow (#2940)
Changed GITHUB_TOKEN secret to CLA_PAT for semantic release due to branch protection.
2026-05-15 16:57:38 +10:00
renovate[bot] bad1fb609a fix(deps): update dependency sanitize-html to v2.17.4 (#2937)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-15 16:33:13 +10:00
Ajay Bura bef267257a fix: support for stable mutual rooms endpoint (#2939)
* add support for stable mutual rooms endpoint

* add stable mutual room feature check
2026-05-15 16:31:47 +10:00
Ajay Bura 909aa430b8 fix: notification cause crash on android (#2938)
fix notification cause crash on android
2026-05-15 16:30:23 +10:00
root e89ba95c08 docs: add poll display and deleted message placeholder to README 2026-05-15 00:49:44 -04:00
root 2958ae9321 fix+feat: bug fixes, deleted message placeholder, poll display
Bug fixes:
- IncomingCallNotification: track ring setTimeout ID and clear it on
  cleanup/dismiss — prevents orphaned callbacks after unmount
- RoomTimeline: allow redacted m.room.message, m.room.encrypted and
  m.sticker events past the early-return filter so they hit the
  existing RedactedContent renderer showing the trash-icon placeholder

New features:
- PollContent component: read-only display of m.poll.start and
  org.matrix.msc3381.poll.start events (both stable Matrix 1.7 and
  MSC3381 unstable content keys); renders poll question + answer
  options inside the standard Message bubble; registered both as
  top-level event renderers and inside EncryptedContent callback
  so encrypted polls also render after decryption
- Deleted message placeholder: m.room.message and m.room.encrypted
  redacted events now show the existing MessageDeletedContent
  component (trash icon + italic notice) instead of disappearing
  entirely — matches Element, FluffyChat, Commet, Nheko behaviour
2026-05-15 00:47:21 -04:00
root a7aa2751a6 docs: add incoming DM call notification to README 2026-05-14 23:37:45 -04:00
root a986eaa1ea feat: incoming DM call notification with ring tone
When another user starts a call in a DM room, show a fixed-position
notification with caller avatar, name, and Answer/Decline buttons.
A Web Audio API double-pulse ring tone plays until answered, declined,
or the 30-second auto-dismiss fires.

- useIncomingDmCall hook: listens to MatrixRTC SessionStarted/SessionEnded,
  filters DM rooms (encrypted, ≤2 members), auto-dismisses after 30s,
  stops if caller leaves or user joins another call
- IncomingCallNotification component: ring tone, caller info, themed UI
  for LotusGuild Terminal TDS (navy bg, orange border, neon-green Answer)
  and standard Cinny dark/light (CSS vars, folds Button Success/Critical)
- Router.tsx: mount IncomingCallNotification inside CallEmbedProvider
2026-05-14 23:37:07 -04:00
root 9253fc33fd feat: resizable PiP call window
Add 4 corner resize handles to the PiP window (SE/SW/NE/NW).
Each handle shows a 3-dot grip indicator and sets the appropriate
resize cursor. Resize handles sit above the drag overlay (zIndex 2)
and stop propagation so they do not trigger drag-to-move.

On resize start the element is normalised to top/left positioning
so math is consistent regardless of whether bottom/right was active.
Minimum size 200x112px. Viewport clamped.
2026-05-14 23:07:29 -04:00
root bd9dbb5e83 fix: correct settings and reactions button selectors for EC 0.19.3
EC 0.19.3 changed the toolbar layout. The old previousElementSibling
traversal from the leave button pointed at wrong elements:
- settingsButton was finding the raise-hand button
- reactionsButton was finding the screenshare button

Fix: use stable selectors instead:
- settingsButton: data-testid=settings-bottom-center (new in EC 0.19.3)
- reactionsButton: [class*=raiseHand] (CSS module class, consistent in 0.19.x)
2026-05-14 23:00:05 -04:00
root 70eb0edc47 fix: pass room to startCall in DM call button
onClick={startCall} was passing the MouseEvent as the room argument,
causing getLiveTimeline is not a function crash in getRoomSession.
2026-05-14 22:51:36 -04:00
root 75a05cf83d feat: draggable PiP call window
Drag the PiP window anywhere on screen to move it out of the way.
Click (without dragging) still navigates back to the call room.
5px movement threshold distinguishes drag from click.
Mouse and touch both supported. Cursor shows grab/grabbing cues.
2026-05-14 22:50:20 -04:00
root 44b48b05b4 docs: update README with recent feature additions
- EC upgraded to 0.19.3
- Auto-revert spotlight on screenshare
- DM calls (phone button + Room.tsx layout switch)
- Picture-in-picture call window
- PTT badge terminal theming
- GIF picker (Giphy SDK, FocusTrap close, terminal theme)
- Technical notes for CallEmbedProvider, GifPicker, useClientConfig
2026-05-14 22:45:04 -04:00
root 9f6220b1bb fix: PTT input guard, listener stability, focus restore mute, single badge 2026-05-14 20:14:06 -04:00
root 20abfc0342 fix: PTT iframe focus, folds-native PTT badge styling 2026-05-14 19:37:19 -04:00
root 94722c8a97 fix: PTT blur/unmute, EC button hiding robustness, PTT status indicator 2026-05-14 19:29:45 -04:00
root 69091bc055 fix: re-apply desired device state after EC joins, support mid-call PTT 2026-05-14 19:14:29 -04:00
root c37220eb21 fix: pass audio/video URL params to EC for correct initial device state
- Camera no longer starts enabled when user disables it in prescreen
- When PTT mode is enabled, call starts muted so PTT works immediately
  without requiring a manual mute first
- CallControlState also updated to match the forced-off audio for PTT

EC 0.16.x ignores io.element.device_mute for initial state at startup,
so audio= and video= URL params are the only reliable way to set the
initial device state before the call begins.
2026-05-14 18:54:09 -04:00
root f3c2babd4b fix(call): show mic-denied error before joining instead of crashing
Check navigator.permissions for microphone state before the call starts.
If the user has blocked microphone access, disable the Join button and
show an inline message explaining how to fix it in browser settings.
Subscribes to permission change events so the UI updates if they grant
access without refreshing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-14 11:56:38 -04:00
root 7b5fbb7e3b fix: set config.json to matrix.lotusguild.org by default
Remove upstream Cinny homeserver list and set Lotus Guild homeserver
as the only default. Prevents deploying with wrong homeserver on fresh builds.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-14 11:47:22 -04:00