Call hotkeys: rebind has no denylist, modifiers ignored, Space swallowed on buttons, duplicate bindings allowed #23

New Issue

2026-09-12T01:50:56-04:00

jared commented

2026-09-12 01:50:56 -04:00

Severity: high · Type: a11y · Confidence: high

Location: src/app/features/settings/general/General.tsx:1477-1500 (useKeyBind — only excludes Escape); runtime consumer src/app/features/call/CallControls.tsx:172-188 (onKeyDown calls e.preventDefault() unconditionally whenever e.code === pttKey and the focus target isn't editable)
src/app/features/call/CallControls.tsx:172-195,256-262, src/app/features/settings/general/General.tsx:1477-1500

Problem

useKeyBind captures literally any KeyboardEvent.code from Settings → General → Calls and stores it verbatim as pttKey/deafenKey, denylisting only Escape. The runtime PTT listener in CallControls.tsx then calls preventDefault() on every matching keydown outside an editable field. If a keyboard-only user (deliberately, or by mis-click while trying to rebind) sets the PTT or deafen key to Tab, ArrowUp/Down/Left/Right, Space outside a field, or Enter, that key stops moving focus / activating controls anywhere in the app for the duration of the call — a full keyboard trap that can only be escaped by ending the call or reloading. There is also no check that pttKey !== deafenKey, so a user can silently bind both actions to the same key.

Second mechanism (related finding): both key handlers match on e.code only — no check of ctrlKey / metaKey / altKey / shiftKey. With the default deafenKey: 'KeyM', Ctrl+M, Alt+M and macOS Cmd+M (minimise window) all toggle deafen and get preventDefault()ed. With the default pttKey: 'Space', PTT preventDefault()s every Space press outside an input — which is how keyboard users activate <button>s, so during a call in PTT mode Space no longer activates the mic/deafen/hangup buttons or scrolls the page. useKeyBind also accepts any key without validation or conflict detection, so PTT and deafen can be bound to the same key.

How to trigger

Settings → General → Calls → click the Push-to-talk key field → press Tab. Join/start a call; pressing Tab anywhere non-editable in the app now toggles the mic and is swallowed instead of moving focus.

Also: join a call with PTT on, Tab to the End button, press Space — nothing happens. Or press Cmd+M / Ctrl+M during any call.

Suggested fix

Denylist Tab, ShiftLeft/Right (already a modifier concern), arrow keys, and other navigation-critical codes in useKeyBind, and warn/reject when the new binding equals the other call-shortcut key.

Also: ignore events with any modifier held in both handlers; only preventDefault() the PTT key when the event target is not an interactive control; reject duplicate/reserved bindings in useKeyBind.

Filed from the September 2026 client audit (branch lotus @ 4bea4895).

**Severity:** high · **Type:** a11y · **Confidence:** high **Location:** `src/app/features/settings/general/General.tsx:1477-1500` (`useKeyBind` — only excludes `Escape`); runtime consumer `src/app/features/call/CallControls.tsx:172-188` (`onKeyDown` calls `e.preventDefault()` unconditionally whenever `e.code === pttKey` and the focus target isn't editable) `src/app/features/call/CallControls.tsx:172-195,256-262`, `src/app/features/settings/general/General.tsx:1477-1500` ### Problem `useKeyBind` captures literally any `KeyboardEvent.code` from Settings → General → Calls and stores it verbatim as `pttKey`/`deafenKey`, denylisting only `Escape`. The runtime PTT listener in `CallControls.tsx` then calls `preventDefault()` on every matching keydown outside an editable field. If a keyboard-only user (deliberately, or by mis-click while trying to rebind) sets the PTT or deafen key to `Tab`, `ArrowUp/Down/Left/Right`, `Space` outside a field, or `Enter`, that key stops moving focus / activating controls anywhere in the app for the duration of the call — a full keyboard trap that can only be escaped by ending the call or reloading. There is also no check that `pttKey !== deafenKey`, so a user can silently bind both actions to the same key. **Second mechanism (related finding):** both key handlers match on `e.code` only — no check of `ctrlKey` / `metaKey` / `altKey` / `shiftKey`. With the default `deafenKey: 'KeyM'`, `Ctrl+M`, `Alt+M` and macOS `Cmd+M` (minimise window) all toggle deafen *and* get `preventDefault()`ed. With the default `pttKey: 'Space'`, PTT `preventDefault()`s every Space press outside an input — which is how keyboard users activate `<button>`s, so during a call in PTT mode Space no longer activates the mic/deafen/hangup buttons or scrolls the page. `useKeyBind` also accepts any key without validation or conflict detection, so PTT and deafen can be bound to the same key. ### How to trigger Settings → General → Calls → click the Push-to-talk key field → press `Tab`. Join/start a call; pressing Tab anywhere non-editable in the app now toggles the mic and is swallowed instead of moving focus. Also: join a call with PTT on, Tab to the End button, press Space — nothing happens. Or press Cmd+M / Ctrl+M during any call. ### Suggested fix Denylist `Tab`, `ShiftLeft/Right` (already a modifier concern), arrow keys, and other navigation-critical codes in `useKeyBind`, and warn/reject when the new binding equals the other call-shortcut key. Also: ignore events with any modifier held in both handlers; only `preventDefault()` the PTT key when the event target is not an interactive control; reject duplicate/reserved bindings in `useKeyBind`. --- _Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._

jared added this to the Audit 2026-09 · High milestone 2026-09-12 01:50:56 -04:00

jared added the priority: high a11y area: calls labels 2026-09-12 01:50:56 -04:00

jared self-assigned this 2026-09-12 01:50:56 -04:00

jared referenced this issue

2026-09-12 01:52:08 -04:00

Client audit 2026-09 — tracking index #89

jared referenced this issue from a commit

2026-09-12 14:59:48 -04:00

fix(calls): hotkey rebind denylist; ignore modifiers; keep Space on buttons

jared closed this issue

2026-09-12 14:59:48 -04:00

jared referenced this issue from a commit