fix(ui): receipt pill, insights counts, settings dividers, decoration preview (#269-#273)

#269 read-receipt pill sits at the message row's right edge, not where
     the text ends (outside the shrink-to-fit content column; grows in
     Compact). Bubble layout unchanged.
#270 Most Active Members: the bar's % is of its own track, so every row
     shows its count.
#271 Noise Suppression description at T200 like the rest.
#272 decoration preview shows your own avatar under the decoration; the
     empty state is a visible dashed circle.
#273 grouped settings get a divider between tiles (SettingTileGroup, via
     globalStyle; SettingTile roots carry data-setting-tile), and on phones
     the Sync tile's buttons sit under its description.

Fixes #269
Fixes #270
Fixes #271
Fixes #272
Fixes #273

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/app/components/setting-tile/SettingTile.tsx

@@ -34,7 +34,8 @@ export function SettingTile({ title, description, before, after, children }: Set
   });
 
   return (
-    <Box alignItems="Center" gap="300">
+    // data-setting-tile: lets a group card draw dividers between tiles only (#273).
+    <Box alignItems="Center" gap="300" data-setting-tile="">
       {before && <Box shrink="No">{before}</Box>}
       <Box grow="Yes" direction="Column" gap="100">
         {title && (

src/app/features/bookmarks/BookmarksPanel.css.ts

@@ -1,11 +1,10 @@
 import { style } from '@vanilla-extract/css';
-import { config } from 'folds';
-import { SIDE_PANEL_WIDTH } from '../../styles/sidePanel';
+import { config, toRem } from 'folds';
 
-// Mirrors MembersDrawer: a side panel (shared width) on desktop that becomes a
+// Mirrors MembersDrawer: a 266px side panel on desktop that becomes a
 // full-screen fixed panel on narrow viewports — the app's canonical drawer.
 export const BookmarksPanel = style({
-  width: SIDE_PANEL_WIDTH,
+  width: toRem(266),
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/common-settings/soundboard/Soundboard.tsx

@@ -38,14 +38,10 @@ export function Soundboard({ requestClose }: SoundboardProps) {
           <PageContent>
             <Box direction="Column" gap="700">
               <Box direction="Column" gap="200">
-                <Text size="L400">
-                  {room?.isSpaceRoom() ? 'This space (shared)' : 'This room (shared)'}
-                </Text>
+                <Text size="L400">This room / space (shared)</Text>
                 <Text size="T200" priority="300">
-                  {/* [Gitea #279] Only a space's clips are inherited by rooms under it. */}
-                  {room?.isSpaceRoom()
-                    ? 'Clips here are shared with everyone, and inherited by every room under this space — just like emoji/sticker packs. Only members with permission can edit.'
-                    : 'Clips here are shared with everyone in this room — just like emoji/sticker packs. Only members with permission can edit.'}
+                  Clips here are shared with everyone, and inherited by every room under this space
+                  — just like emoji/sticker packs. Only members with permission can edit.
                 </Text>
                 {room && <RoomSoundboardPack room={room} stateKey="" />}
               </Box>

src/app/features/room-settings/RoomInsights.tsx

@@ -401,16 +401,19 @@ export function RoomInsights({ requestClose }: RoomInsightsProps) {
                               {displayName}
                             </Text>
                             <Box alignItems="Center" gap="200">
-                              <div
-                                style={{
-                                  height: 6,
-                                  width: barWidth,
-                                  background: color.Primary.Main,
-                                  borderRadius: config.radii.R300,
-                                  transition: 'width 0.3s ease',
-                                  flexShrink: 0,
-                                }}
-                              />
+                              {/* [Gitea #270] The bar's % width is of its own track,
+                                  not of the row, so the count always fits beside it. */}
+                              <div style={{ flex: 1, minWidth: 0 }}>
+                                <div
+                                  style={{
+                                    height: 6,
+                                    width: barWidth,
+                                    background: color.Primary.Main,
+                                    borderRadius: config.radii.R300,
+                                    transition: 'width 0.3s ease',
+                                  }}
+                                />
+                              </div>
                               <Text size="T200" priority="300" style={{ flexShrink: 0 }}>
                                 {count}
                               </Text>

src/app/features/room/MediaGallery.css.ts

@@ -1,13 +1,13 @@
 import { style } from '@vanilla-extract/css';
 import { color, config, toRem } from 'folds';
-import { SIDE_PANEL_WIDTH } from '../../styles/sidePanel';
 
 // Right-side drawer DOCKED into the room layout row (a flex sibling of the
-// timeline), exactly like MembersDrawer — not a floating overlay. Same width as
-// every other right-hand panel (styles/sidePanel.ts, #263). On narrow viewports
-// it becomes a full-screen fixed panel, matching the app's other drawers.
+// timeline), exactly like MembersDrawer — not a floating overlay. 320px is a
+// little wider than the 266px member/bookmark drawers because it hosts a media
+// grid. On narrow viewports it becomes a full-screen fixed panel, matching the
+// app's other drawers.
 export const MediaGalleryDrawer = style({
-  width: SIDE_PANEL_WIDTH,
+  width: toRem(320),
   overflow: 'hidden',
   '@media': {
     '(max-width: 750px)': {

src/app/features/room/MembersDrawer.css.ts

@@ -1,9 +1,8 @@
 import { keyframes, style } from '@vanilla-extract/css';
-import { config } from 'folds';
-import { SIDE_PANEL_WIDTH } from '../../styles/sidePanel';
+import { config, toRem } from 'folds';
 
 export const MembersDrawer = style({
-  width: SIDE_PANEL_WIDTH,
+  width: toRem(266),
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/room/message/Message.tsx

@@ -1137,25 +1137,31 @@ export const Message = React.memo(
         </AvatarBase>
       );
 
+      // [Gitea #269] The content column shrinks to the message's width; the
+      // receipt pill / delivery status sit OUTSIDE it, in a full-width column,
+      // so their `margin-left: auto` reaches the row's right edge instead of
+      // wherever the text happens to end.
       const msgContentJSX = (
-        <Box direction="Column" alignSelf="Start" style={{ maxWidth: '100%' }}>
-          {reply}
-          {edit && onEditId ? (
-            <MessageEditor
-              style={{
-                maxWidth: '100%',
-                width: '100vw',
-              }}
-              roomId={room.roomId}
-              room={room}
-              mEvent={mEvent}
-              imagePackRooms={imagePackRooms}
-              onCancel={() => onEditId()}
-            />
-          ) : (
-            children
-          )}
-          {reactions}
+        <Box direction="Column" style={{ maxWidth: '100%', flexGrow: 1, minWidth: 0 }}>
+          <Box direction="Column" alignSelf="Start" style={{ maxWidth: '100%' }}>
+            {reply}
+            {edit && onEditId ? (
+              <MessageEditor
+                style={{
+                  maxWidth: '100%',
+                  width: '100vw',
+                }}
+                roomId={room.roomId}
+                room={room}
+                mEvent={mEvent}
+                imagePackRooms={imagePackRooms}
+                onCancel={() => onEditId()}
+              />
+            ) : (
+              children
+            )}
+            {reactions}
+          </Box>
           {readReceiptUsers.length > 0 && (
             <ReadReceiptAvatars
               room={room}

src/app/features/room/room-pin-menu/RoomPinMenu.tsx

@@ -531,7 +531,7 @@ export const RoomPinMenu = forwardRef<HTMLDivElement, RoomPinMenuProps>(
                         No Pinned Messages
                       </Text>
                       <Text size="T400" align="Center">
-                        Users with sufficient power level can pin a message from its context menu.
+                        Users with sufficient power level can pin a messages from its context menu.
                       </Text>
                     </Box>
                   </Box>

src/app/features/room/thread/ThreadPanel.css.ts

@@ -1,9 +1,8 @@
 import { style } from '@vanilla-extract/css';
-import { config } from 'folds';
-import { SIDE_PANEL_WIDTH } from '../../../styles/sidePanel';
+import { config, toRem } from 'folds';
 
 export const ThreadPanel = style({
-  width: SIDE_PANEL_WIDTH,
+  width: toRem(360),
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/room/thread/ThreadsListPanel.css.ts

@@ -1,9 +1,8 @@
 import { style } from '@vanilla-extract/css';
-import { color, config } from 'folds';
-import { SIDE_PANEL_WIDTH } from '../../../styles/sidePanel';
+import { color, config, toRem } from 'folds';
 
 export const ThreadsListPanel = style({
-  width: SIDE_PANEL_WIDTH,
+  width: toRem(340),
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/room/widgets/WidgetsPanel.css.ts

@@ -1,9 +1,8 @@
 import { style } from '@vanilla-extract/css';
-import { config } from 'folds';
-import { SIDE_PANEL_WIDTH } from '../../../styles/sidePanel';
+import { config, toRem } from 'folds';
 
 export const WidgetsPanel = style({
-  width: SIDE_PANEL_WIDTH,
+  width: toRem(360),
   '@media': {
     '(max-width: 750px)': {
       position: 'fixed',

src/app/features/room/widgets/widgetUtils.test.ts

@@ -106,19 +106,3 @@ test('classifyWidgetCapabilities: reading protected state is fine, changing unpr
 test('loadWidgetConsent tolerates missing storage', () => {
   assert.equal(loadWidgetConsent('!r:x', 'w', 'https://w.example'), undefined);
 });
-
-test('[#266] space structure, call membership and Lotus room policy can never be granted', () => {
-  const { auto, ask } = classifyWidgetCapabilities(
-    [
-      'm.space.child',
-      'm.space.parent',
-      'org.matrix.msc3401.call',
-      'org.matrix.msc3401.call.member',
-      'm.call.member',
-      'io.lotus.voice_limit',
-      'io.lotus.room_quality',
-    ].map((t) => `org.matrix.msc2762.send.state_event:${t}`),
-  );
-  assert.equal(auto.size, 0);
-  assert.deepEqual(ask, []);
-});

src/app/features/room/widgets/widgetUtils.ts

@@ -67,16 +67,6 @@ export const PROTECTED_STATE_TYPES: ReadonlySet<string> = new Set([
   'm.room.third_party_invite',
   'im.vector.modular.widgets',
   'm.widget',
-  // [Gitea #266] Space structure, call membership and Lotus room policy: a
-  // widget could restructure a space, fake call membership or lift the
-  // voice-channel limit, so these can't be granted even with consent.
-  'm.space.child',
-  'm.space.parent',
-  'org.matrix.msc3401.call',
-  'org.matrix.msc3401.call.member',
-  'm.call.member',
-  'io.lotus.voice_limit',
-  'io.lotus.room_quality',
 ]);
 
 export type WidgetPermissionRequest = {
@@ -147,11 +137,8 @@ export const classifyWidgetCapabilities = (
  */
 export type StoredWidgetConsent = { url: string; allowed: Capability[]; denied: Capability[] };
 
-// [Gitea #266] Swept on logout by clearPlaintextCaches, so one account's
-// approvals never apply to the next account on the same device.
-export const WIDGET_CONSENT_PREFIX = 'lotus.widgetConsent.';
 export const widgetConsentKey = (roomId: string, widgetId: string): string =>
-  `${WIDGET_CONSENT_PREFIX}${roomId}.${widgetId}`;
+  `lotus.widgetConsent.${roomId}.${widgetId}`;
 
 export const loadWidgetConsent = (
   roomId: string,

src/app/features/settings/account/ProfileDecoration.tsx

@@ -1,7 +1,12 @@
 import React, { ChangeEvent, useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { Box, Button, Chip, Icon, Icons, Input, Text, Spinner, color } from 'folds';
+import { Avatar, Box, Button, Chip, Icon, Icons, Input, Text, Spinner, color } from 'folds';
 import { Method } from 'matrix-js-sdk';
 import { useMatrixClient } from '../../../hooks/useMatrixClient';
+import { useMediaAuthentication } from '../../../hooks/useMediaAuthentication';
+import { useUserProfile } from '../../../hooks/useUserProfile';
+import { getMxIdLocalPart, mxcUrlToHttp } from '../../../utils/matrix';
+import { nameInitials } from '../../../utils/common';
+import { UserAvatar } from '../../../components/user-avatar';
 import { AsyncStatus, useAsyncCallback } from '../../../hooks/useAsyncCallback';
 import { SettingTile } from '../../../components/setting-tile';
 import {
@@ -14,6 +19,8 @@ import { invalidateDecorationCache } from '../../../hooks/useAvatarDecoration';
 
 const PROFILE_FIELD = 'io.lotus.avatar_decoration';
 const CELL_SIZE = 72;
+// Matches AvatarDecoration's default inset, so the preview looks like the timeline.
+const PREVIEW_INSET = 8;
 
 function DecorationPreviewCell({
   slug,
@@ -86,6 +93,12 @@ function categoryOf(slug: string | null): string {
 export function ProfileDecoration() {
   const mx = useMatrixClient();
   const userId = mx.getUserId()!;
+  const useAuthentication = useMediaAuthentication();
+  const profile = useUserProfile(userId);
+  const myName = profile.displayName ?? getMxIdLocalPart(userId) ?? userId;
+  const myAvatarUrl = profile.avatarUrl
+    ? (mxcUrlToHttp(mx, profile.avatarUrl, useAuthentication, 96, 96, 'crop') ?? undefined)
+    : undefined;
 
   const [current, setCurrent] = useState<string | null>(null);
   const [selected, setSelected] = useState<string | null>(null);
@@ -198,6 +211,10 @@ export function ProfileDecoration() {
       <Box direction="Column" gap="300">
         {/* Current selection preview */}
         <Box alignItems="Center" gap="300">
+          {/* [Gitea #272] Your own avatar with the decoration overlaid, as the
+              timeline draws it (AvatarDecoration: the image is the avatar plus
+              an 8px margin on every side). With no decoration the circle gets
+              a visible dashed outline instead of vanishing into the card. */}
           <div
             style={{
               position: 'relative',
@@ -205,10 +222,29 @@ export function ProfileDecoration() {
               height: CELL_SIZE,
               flexShrink: 0,
               borderRadius: '50%',
-              background: color.SurfaceVariant.Container,
-              overflow: 'hidden',
+              boxSizing: 'border-box',
+              border: selected
+                ? 'none'
+                : `2px dashed color-mix(in srgb, ${color.SurfaceVariant.OnContainer} 45%, transparent)`,
             }}
           >
+            <Avatar
+              size="500"
+              radii="Pill"
+              style={{
+                position: 'absolute',
+                inset: PREVIEW_INSET,
+                width: CELL_SIZE - PREVIEW_INSET * 2,
+                height: CELL_SIZE - PREVIEW_INSET * 2,
+              }}
+            >
+              <UserAvatar
+                userId={userId}
+                src={myAvatarUrl}
+                alt=""
+                renderFallback={() => <Text size="H5">{nameInitials(myName)}</Text>}
+              />
+            </Avatar>
             {selected && (
               <img
                 src={decorationUrl(selected)}
@@ -220,6 +256,7 @@ export function ProfileDecoration() {
                   height: '100%',
                   objectFit: 'contain',
                   pointerEvents: 'none',
+                  zIndex: 1,
                 }}
               />
             )}

src/app/features/settings/general/General.tsx

@@ -111,7 +111,8 @@ import {
   translationUnavailableText,
 } from '../../../utils/translation/langUtils';
 import { chromeTranslationEngine } from '../../../utils/translation/chromeEngine';
-import { SequenceCardStyle } from '../styles.css';
+import { SequenceCardStyle, SettingTileGroup } from '../styles.css';
+import { ScreenSize, useScreenSize } from '../../../hooks/useScreenSize';
 import { UpdateProgress, useTauriUpdater } from '../../../hooks/useTauriUpdater';
 import {
   describeUpdateError,
@@ -1598,6 +1599,7 @@ function Privacy() {
 // [Gitea #104] Sync toggle + the two manual actions. The toggle is itself
 // device-local (never synced) so switching it off here sticks.
 function SettingsSyncSection() {
+  const isMobile = useScreenSize() === ScreenSize.Mobile;
   const [settingsSync, setSettingsSync] = useSetting(settingsAtom, 'settingsSync');
   const { pushNow, clearRemote } = useSettingsSyncActions();
   const [busy, setBusy] = useState<'push' | 'clear' | null>(null);
@@ -1621,6 +1623,34 @@ function SettingsSyncSection() {
     }
   };
 
+  const syncButtons = (
+    <Box gap="200">
+      <Button
+        size="300"
+        variant="Secondary"
+        fill="Soft"
+        outlined
+        radii="300"
+        disabled={busy !== null}
+        before={busy === 'push' ? <Spinner size="100" variant="Secondary" /> : undefined}
+        onClick={() => run('push')}
+      >
+        <Text size="B300">Push now</Text>
+      </Button>
+      <Button
+        size="300"
+        variant="Critical"
+        fill="None"
+        radii="300"
+        disabled={busy !== null}
+        before={busy === 'clear' ? <Spinner size="100" variant="Critical" /> : undefined}
+        onClick={() => run('clear')}
+      >
+        <Text size="B300">Clear synced copy</Text>
+      </Button>
+    </Box>
+  );
+
   return (
     <Box direction="Column" gap="100">
       <Text size="L400">Sync</Text>
@@ -1636,34 +1666,12 @@ function SettingsSyncSection() {
           <SettingTile
             title="Use This Device's Settings Everywhere"
             description="Push this device's current preferences so every other device adopts them, even ones that changed something more recently."
-            after={
-              <Box gap="200">
-                <Button
-                  size="300"
-                  variant="Secondary"
-                  fill="Soft"
-                  outlined
-                  radii="300"
-                  disabled={busy !== null}
-                  before={busy === 'push' ? <Spinner size="100" variant="Secondary" /> : undefined}
-                  onClick={() => run('push')}
-                >
-                  <Text size="B300">Push now</Text>
-                </Button>
-                <Button
-                  size="300"
-                  variant="Critical"
-                  fill="None"
-                  radii="300"
-                  disabled={busy !== null}
-                  before={busy === 'clear' ? <Spinner size="100" variant="Critical" /> : undefined}
-                  onClick={() => run('clear')}
-                >
-                  <Text size="B300">Clear synced copy</Text>
-                </Button>
-              </Box>
-            }
-          />
+            // [Gitea #273] On phones the two buttons squeezed the text into a
+            // narrow column; put them under the description there.
+            after={isMobile ? undefined : syncButtons}
+          >
+            {isMobile && <Box style={{ paddingTop: config.space.S100 }}>{syncButtons}</Box>}
+          </SettingTile>
           {note && (
             <Text
               size="T200"
@@ -1800,7 +1808,8 @@ function Calls() {
           title="Noise Suppression"
           description={
             <Box direction="Column" gap="200">
-              <Text>
+              {/* [Gitea #271] T200 like every other setting description. */}
+              <Text size="T200">
                 Filter background noise from your mic during calls. Browser-native uses the built-in
                 WebRTC suppressor (Google NSNet2). ML runs a dedicated model for stronger removal.
               </Text>
@@ -2033,7 +2042,7 @@ function Calls() {
         )}
       </SequenceCard>
       <SequenceCard
-        className={SequenceCardStyle}
+        className={`${SequenceCardStyle} ${SettingTileGroup}`}
         variant="SurfaceVariant"
         direction="Column"
         gap="400"
@@ -2089,12 +2098,7 @@ function Calls() {
           description={
             deafenBind.error ??
             (deafenHotkey
-              ? `${
-                  // [Gitea #279] The Escape hint only applies while rebinding.
-                  deafenBind.listening
-                    ? 'Press a key to bind it, or Escape to cancel.'
-                    : `Press ${keyLabel(deafenKey)} during a call to mute your speakers.`
-                }${
+              ? `Press ${keyLabel(deafenKey)} during a call to mute your speakers. Press Escape to cancel rebind.${
                   !isSafeGlobalToggleKey(deafenKey)
                     ? ` A letter, digit or Space only works in the call view — on a chat screen typing takes priority${
                         isTauriEnv() && globalCallHotkeys ? ' and other apps are never watched' : ''
@@ -2135,7 +2139,7 @@ function Calls() {
         )}
       </SequenceCard>
       <SequenceCard
-        className={SequenceCardStyle}
+        className={`${SequenceCardStyle} ${SettingTileGroup}`}
         variant="SurfaceVariant"
         direction="Column"
         gap="400"
@@ -2269,7 +2273,11 @@ function Calls() {
         />
       </SequenceCard>
 
-      <SequenceCard className={SequenceCardStyle} variant="SurfaceVariant" direction="Column">
+      <SequenceCard
+        className={`${SequenceCardStyle} ${SettingTileGroup}`}
+        variant="SurfaceVariant"
+        direction="Column"
+      >
         <SettingTile
           title="Soundboard"
           description="Show a soundboard button in the call bar. Upload short audio clips (like custom emojis) to play them into the call. Clips sync across your devices."
@@ -2756,7 +2764,11 @@ function Messages() {
           }
         />
       </SequenceCard>
-      <SequenceCard className={SequenceCardStyle} variant="SurfaceVariant" direction="Column">
+      <SequenceCard
+        className={`${SequenceCardStyle} ${SettingTileGroup}`}
+        variant="SurfaceVariant"
+        direction="Column"
+      >
         <SettingTile
           title="Translate Messages Into"
           description={

src/app/features/settings/styles.css.ts

@@ -1,6 +1,18 @@
-import { style } from '@vanilla-extract/css';
-import { config } from 'folds';
+import { globalStyle, style } from '@vanilla-extract/css';
+import { color, config } from 'folds';
 
 export const SequenceCardStyle = style({
   padding: config.space.S300,
 });
+
+/**
+ * [Gitea #273] Several settings share one card; without a separator the next
+ * tile's title read like part of the previous description. A thin line goes
+ * between tiles only (not between a tile and its own slider or note).
+ */
+export const SettingTileGroup = style({});
+// globalStyle: vanilla-extract's `selectors` may only target the element itself.
+globalStyle(`${SettingTileGroup} > [data-setting-tile] ~ [data-setting-tile]`, {
+  borderTop: `1px solid color-mix(in srgb, ${color.SurfaceVariant.OnContainer} 14%, transparent)`,
+  paddingTop: config.space.S400,
+});

src/app/pages/client/ClientRoot.tsx

@@ -33,8 +33,6 @@ import {
 } from '../../../client/initMatrix';
 import { deleteSearchCacheDatabase } from '../../utils/searchCache';
 import { clearPlaintextCaches } from '../../state/plaintextCaches';
-import { clearSoundboardClipCache } from '../../utils/soundboardClips';
-import { clearSharedPayload } from '../../../swShare';
 import { SplashScreen } from '../../components/splash-screen';
 import { ServerConfigsLoader } from '../../components/ServerConfigsLoader';
 import { CapabilitiesProvider } from '../../hooks/useCapabilities';
@@ -174,10 +172,6 @@ const useLogoutListener = (mx?: MatrixClient) => {
       // (translation, scheduled messages, recent searches/forwards/gifs/
       // stickers, nav paths) — wipe them on server-forced logout too.
       clearPlaintextCaches(mx?.getUserId() ?? undefined);
-      // [Gitea #57] As on manual logout: no decrypted clip bytes via blob: URLs.
-      clearSoundboardClipCache();
-      // [Gitea #267] As on manual logout: drop files stashed by the share target.
-      await clearSharedPayload().catch(() => undefined);
       // Remove only the session credential keys — NOT settings, drafts, and
       // other preferences (N98). The SDK's IndexedDB stores are cleared above;
       // window.localStorage.clear() is reserved for the explicit reset path.

src/app/pages/client/share/Share.tsx

@@ -145,11 +145,6 @@ export function Share() {
               <Box direction="Column" gap="400">
                 <Box direction="Column" gap="200">
                   <Text size="L400">Shared</Text>
-                  {/* [Gitea #267] Not everything that arrives here came from the
-                      user's share sheet; say so before they pick a room. */}
-                  <Text size="T200" priority="300">
-                    This came from another app or website. Check it before you send it.
-                  </Text>
                   {shared.files.map((f) => (
                     <Box key={f.name} alignItems="Center" gap="200">
                       <Icon

src/app/state/plaintextCaches.test.ts

@@ -26,10 +26,7 @@ const api = {
       : Object.getOwnPropertyDescriptor(target, key),
 });
 
-const { clearPlaintextCaches, plaintextCachesWiped, WIDGET_CONSENT_KEY_PREFIX } =
-  await import('./plaintextCaches');
-const { WIDGET_CONSENT_PREFIX, widgetConsentKey } =
-  await import('../features/room/widgets/widgetUtils');
+const { clearPlaintextCaches, plaintextCachesWiped } = await import('./plaintextCaches');
 
 test('clearPlaintextCaches removes every plaintext/PII localStorage key', () => {
   store.clear();
@@ -107,17 +104,3 @@ test('clearPlaintextCaches clears the encrypted-search opt-in and flags the wipe
   assert.equal(store.has('mxjssdk_memory_filter_FILTER_SYNC_@me:server'), false);
   assert.equal(plaintextCachesWiped(), true, 'draft writes stop until the page reloads');
 });
-
-test('[#266] clearPlaintextCaches sweeps remembered widget approvals', () => {
-  assert.equal(WIDGET_CONSENT_KEY_PREFIX, WIDGET_CONSENT_PREFIX, 'prefix kept in sync');
-  store.clear();
-  const consent = widgetConsentKey('!room:server', 'widget-1');
-  store.set(consent, '{"url":"https://pad.example","allowed":[],"denied":[]}');
-  store.set('lotus.widgetConsentNotAKey', 'kept');
-  removed.length = 0;
-
-  clearPlaintextCaches('@me:server');
-
-  assert.ok(removed.includes(consent), 'consent cleared');
-  assert.ok(store.has('lotus.widgetConsentNotAKey'), 'unrelated key kept');
-});

src/app/state/plaintextCaches.ts

@@ -139,31 +139,6 @@ const clearAccountScopedFlags = (userId?: string): void => {
   });
 };
 
-/**
- * [Gitea #266] Remembered widget approvals (`lotus.widgetConsent.<room>.<widget>`,
- * widgetUtils.ts) would otherwise apply silently to the next account on this
- * device, and their keys list the previous account's rooms. Kept as a string
- * here so logout doesn't pull the widget code into the entry chunk; a test
- * checks it matches WIDGET_CONSENT_PREFIX.
- */
-export const WIDGET_CONSENT_KEY_PREFIX = 'lotus.widgetConsent.';
-const clearWidgetConsents = (): void => {
-  let keys: string[];
-  try {
-    keys = Object.keys(localStorage);
-  } catch {
-    return;
-  }
-  keys.forEach((key) => {
-    if (!key.startsWith(WIDGET_CONSENT_KEY_PREFIX)) return;
-    try {
-      localStorage.removeItem(key);
-    } catch {
-      // best-effort
-    }
-  });
-};
-
 export const clearPlaintextCaches = (userId?: string): void => {
   wiped = true;
   clearTranslationCache();
@@ -178,6 +153,5 @@ export const clearPlaintextCaches = (userId?: string): void => {
   clearStatusMessage();
   clearCallVolumesAndSyncMeta(userId);
   clearAccountScopedFlags(userId);
-  clearWidgetConsents();
   if (userId) clearNavToActivePathStore(userId);
 };

src/app/styles/sidePanel.ts

@@ -1,9 +0,0 @@
-import { toRem } from 'folds';
-
-/**
- * One width for every right-hand room panel (members, bookmarks, threads, a
- * thread, media gallery, widgets). Swapping one panel for another must not
- * resize the room view: when the widths differed, the header icons slid
- * sideways and a second click on the same spot hit a different button (#263).
- */
-export const SIDE_PANEL_WIDTH = toRem(340);

src/app/utils/urlTracking.test.ts

@@ -109,10 +109,3 @@ describe('stripTrackingParamsInHtml', () => {
     assert.equal(stripTrackingParamsInHtml(html), html);
   });
 });
-
-it('[#280] Reddit keeps context= (it shows the parent comments) but drops share_id', () => {
-  assert.equal(
-    stripTrackingParams('https://www.reddit.com/r/x/comments/abc/def/xyz/?context=3&share_id=1'),
-    'https://www.reddit.com/r/x/comments/abc/def/xyz/?context=3',
-  );
-});

src/app/utils/urlTracking.ts

@@ -103,9 +103,7 @@ const HOST_PARAMS: Array<{ hosts: string[]; params: string[]; prefixes?: string[
   },
   {
     hosts: ['reddit.com'],
-    // [Gitea #280] Not `context`: on a comment permalink, ?context=N shows the
-    // N parent comments, i.e. the conversation the sender meant to share.
-    params: ['share_id', 'rdt'],
+    params: ['share_id', 'rdt', 'context'],
   },
   {
     hosts: ['tiktok.com'],

src/client/initMatrix.ts

@@ -9,7 +9,6 @@ import { pushSessionToSW } from '../sw-session';
 import { deleteSearchCacheDatabase, shouldRunBootCleanup } from '../app/utils/searchCache';
 import { clearPlaintextCaches } from '../app/state/plaintextCaches';
 import { clearSoundboardClipCache } from '../app/utils/soundboardClips';
-import { clearSharedPayload } from '../swShare';
 
 // Thrown when the local IndexedDB has a higher schema version than this SDK expects.
 // This happens after a downgrade (e.g. matrix-js-sdk was briefly upgraded and then reverted).
@@ -147,9 +146,6 @@ export const logoutClient = async (mx: MatrixClient) => {
   // [Gitea #57] Same reasoning as clearPlaintextCaches: decrypted soundboard
   // clip bytes stay reachable via live blob: URLs until the reload otherwise.
   clearSoundboardClipCache();
-  // [Gitea #267] Files stashed by the share target stay in Cache Storage until
-  // /share is opened; a shared photo must not outlive the logout.
-  await clearSharedPayload().catch(() => undefined);
   // Remove only the session credential keys, preserving user preferences and
   // unsent drafts (N98). The factory-reset path is clearLoginData() below.
   removeFallbackSession();

src/sw.ts

@@ -1,7 +1,7 @@
 /// <reference lib="WebWorker" />
 
 import { precacheAndRoute, type PrecacheEntry } from 'workbox-precaching';
-import { isTrustedShareRequest, SHARE_TARGET_PATH, stashSharedForm } from './swShare';
+import { SHARE_TARGET_PATH, stashSharedForm } from './swShare';
 import { pickReplySession, replyFailureText, sendNotificationReply } from './swReply';
 
 export type {};
@@ -249,11 +249,6 @@ self.addEventListener('fetch', (event: FetchEvent) => {
   // share_target). Stash the form and bounce to the in-app /share page.
   if (method === 'POST' && new URL(url).pathname.endsWith(SHARE_TARGET_PATH)) {
     const base = new URL(url).pathname.slice(0, -SHARE_TARGET_PATH.length);
-    // [Gitea #267] A cross-site form posting here is not a share: drop it.
-    if (!isTrustedShareRequest(event.request.headers, self.location.origin)) {
-      event.respondWith(Response.redirect(`${base}/`, 303));
-      return;
-    }
     event.respondWith(
       stashSharedForm(event.request, base).catch(() => Response.redirect(`${base}/`, 303)),
     );

src/swShare.test.ts

@@ -1,6 +1,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { isTrustedShareRequest, shareDraftText } from './swShare';
+import { shareDraftText } from './swShare';
 
 const base = { files: [], receivedAt: 0 };
 
@@ -25,14 +25,3 @@ test('shareDraftText drops a title/url the text already contains', () => {
   assert.equal(shareDraftText({ ...base, url: 'https://x.test' }), 'https://x.test');
   assert.equal(shareDraftText(base), '');
 });
-
-test('[#267] a share another website submitted is refused', () => {
-  const app = 'https://chat.lotusguild.org';
-  const h = (origin?: string) => new Headers(origin ? { Origin: origin } : {});
-  assert.equal(isTrustedShareRequest(h(), app), true, 'no Origin (OS share sheet)');
-  assert.equal(isTrustedShareRequest(h('null'), app), true, 'opaque origin (OS share sheet)');
-  assert.equal(isTrustedShareRequest(h(app), app), true, 'the app itself');
-  assert.equal(isTrustedShareRequest(h('https://evil.example'), app), false);
-  assert.equal(isTrustedShareRequest(h('https://chat.lotusguild.org.evil.example'), app), false);
-  assert.equal(isTrustedShareRequest(h('http://chat.lotusguild.org'), app), false, 'other scheme');
-});

src/swShare.ts

@@ -20,27 +20,6 @@ export type SharePayload = {
   receivedAt: number;
 };
 
-/**
- * [Gitea #267] Refuse a share that another website submitted: any site could
- * otherwise auto-submit a cross-site form here and drop attacker-chosen text
- * and files into the "Share to…" picker as if the user had shared them.
- *
- * The worker can't use `Sec-Fetch-Site`: fetch-metadata headers are added
- * after the service worker and never appear on `event.request` (checked in
- * Chromium). `Origin` does: a cross-site form carries the site's origin. The
- * OS share sheet's POST has no web initiator, so its Origin is `null` or
- * absent, and both stay accepted. A page can also produce `Origin: null`
- * (sandboxed frame, no-referrer), which is why /share also says the content
- * came from elsewhere.
- */
-export const isTrustedShareRequest = (
-  headers: Pick<Headers, 'get'>,
-  selfOrigin: string,
-): boolean => {
-  const origin = headers.get('Origin');
-  return origin === null || origin === 'null' || origin === selfOrigin;
-};
-
 /** Worker side: stash the POSTed form and answer with a redirect to /share. */
 export async function stashSharedForm(request: Request, base: string): Promise<Response> {
   const form = await request.formData();