5 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 5	f3119e3dc2	fix(security): validate avatar-decoration slugs from remote profiles ... The MSC4133 io.lotus.avatar_decoration value was interpolated into the CDN URL verbatim, letting a room member steer the path/query of a request every viewer's browser makes. Accept only slugs present in the catalog; anything else is treated as no decoration. Unit-tested. Fixes #64 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-12 14:48:35 -04:00
jaredandClaude Opus 4.8	eafa353364	feat(decorations): allow VITE_DECORATION_CDN override; close N127 ... - avatarDecorations: resolve the decoration CDN base from VITE_DECORATION_CDN at runtime, falling back to the DECORATION_CDN literal (kept intact so the sync script + tests still parse it). Lets a deploy repoint the CDN without a code edit. Guarded for the tsx test runner (import.meta.env undefined there). - LOTUS_BUGS: close N127 — the denoise dev-injection gap dissolved with the A7 cutover (no getUserMedia shim is injected anymore; denoise is in-source in the EC fork), so there is nothing to inject in dev. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 19:18:09 -04:00
jaredandClaude Opus 4.8	ce8a03ab16	fix(build,denoise): gate node leak, postMessage origin, fail-hard patch, CDN dedup (N124/N125/N128/N120) ... - N124: denoise shim cleanup() now disconnects the noise gate AudioWorkletNode (var-scoped, guarded), releasing the gate processor thread instead of leaking it on every getUserMedia within a session. - N125: denoise-status postMessage now targets the parent origin (derived from the parentUrl widget param via new URL(...).origin, falling back to this frame's origin) instead of broadcasting with '*'. - N128: patch-folds.mjs fails hard (process.exit(1)) when the patch target is missing, so an unpatched folds can't silently ship. The idempotent "already applied" path still exits 0 (verified by re-run). - N120: the avatar-decoration CDN URL is now single-sourced in avatarDecorations.ts (DECORATION_CDN); syncDecorations.mjs extracts it by regex (can't import across the build/app boundary) and fails hard if renamed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-28 10:55:19 -04:00
jaredandClaude Sonnet 4.6	2a545b8b3e	feat: avatar decorations follow-up — Nextcloud CDN, sync script, docs ... - Point DECORATION_CDN at Lotus Nextcloud WebDAV share instead of external avatardecoration.com; all 99 APNG files are self-hosted and served via direct DAV URL (no CORS issue for <img> elements) - Add onError handler to AvatarDecoration.tsx to silently hide the overlay if a file is missing or the CDN is unreachable - Rewrite scripts/syncDecorations.mjs: now sends HTTP HEAD requests to the live Nextcloud CDN (batches of 16 in parallel) and removes catalog entries for files that return non-2xx; empty categories are pruned automatically. Workflow: delete files from Nextcloud → run `npm run sync:decorations` → commit the updated avatarDecorations.ts. No local files needed. - Add public/decorations/ to .gitignore; delete the 85 MB local APNG cache that was downloaded during development (files live on Nextcloud now) - Add sync:decorations script to package.json - Update LOTUS_FEATURES.md, LOTUS_TODO.md (P5-13 + P5-14 ✓), README.md with avatar decoration documentation and catalog sync workflow Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-14 12:02:50 -04:00
jaredandClaude Sonnet 4.6	bf1308dd55	feat: avatar decorations (P5-13) ... 256×256 APNG overlays from avatardecoration.com (open CORS CDN). Stored in the user's Matrix profile as io.lotus.avatar_decoration via MSC4133 so all Lotus Chat users see each other's decorations. - avatarDecorations.ts: curated catalog of 110 original-IP decorations across 9 categories (Gaming, Cyber, Space, Fantasy, Elements, Japanese, Nature, Spooky, Cozy) - useAvatarDecoration: per-user profile fetch with module-level cache and in-flight deduplication so concurrent renders for the same userId share one HTTP request - AvatarDecoration: position:relative wrapper that overlays the APNG 8px beyond the avatar on all sides; renders nothing when no decoration is set (zero cost for undecorated users) - ProfileDecoration: scrollable grid picker in Settings → Profile, grouped by category with live preview; Save button appears only when the selection differs from what's saved - Applied at all five avatar display sites: message timeline, members drawer, knock list, @mention autocomplete, notifications inbox Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-14 11:24:04 -04:00