LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Invisible, "Hide Online Status", Idle and DND don't stick: the next /sync sets you back to online #282

New Issue
Closed
opened 2026-10-04 19:50:20 -04:00 by jared · 1 comment
jared commented 2026-10-04 19:50:20 -04:00
Owner
Copy Link
Copy Source

What happens
Choosing Invisible in the status picker, or turning on Settings → Privacy → Hide Online Status, does not make you appear offline. Other users still see you online and currently active. The same goes for Idle and Do Not Disturb: the server keeps reporting online.

Verified (local Synapse, Bob polling GET /presence/@aud_main/status every 5 s after Audit Main chose Invisible):

5s:online* 10s:online* 15s:online* 20s:online* 25s:online* 30s:online* 35s:online* 40s:online*   (* = currently_active)

DND → {"presence":"online","status_msg":"dnd"}.

Why

  • usePresenceUpdater (src/app/hooks/usePresenceUpdater.ts:107-125) sends one PUT /presence with offline or unavailable.
  • The SDK keeps long-polling /sync with the default set_presence=online, and Synapse treats each sync as "this user is online" and flips the state back.
  • Nothing calls mx.setSyncPresence(...): there is no setSyncPresence or set_presence anywhere in src/. That's what Element uses to keep a manual state.

Introduced by bd8e116c (2026-05-30, the Discord-style presence selector).

Why it's high: it's a privacy setting that silently doesn't work. Users who choose Invisible believe they're hidden.

Fix

  • Call mx.setSyncPresence(SetPresence.Offline) for invisible/hidePresence, and Unavailable for idle/dnd.
  • Reset it to Online for auto/online.
  • Keep the one-off PUT for the immediate change.

Acceptance criteria: 60 s after choosing Invisible, another account sees offline; Idle and DND stay unavailable; a Playwright test with two accounts.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

**What happens** Choosing **Invisible** in the status picker, or turning on Settings → Privacy → **Hide Online Status**, does **not** make you appear offline. Other users still see you **online and currently active**. The same goes for **Idle** and **Do Not Disturb**: the server keeps reporting `online`. **Verified** (local Synapse, Bob polling `GET /presence/@aud_main/status` every 5 s after Audit Main chose Invisible): ``` 5s:online* 10s:online* 15s:online* 20s:online* 25s:online* 30s:online* 35s:online* 40s:online* (* = currently_active) ``` DND → `{"presence":"online","status_msg":"dnd"}`. **Why** - `usePresenceUpdater` (src/app/hooks/usePresenceUpdater.ts:107-125) sends **one** `PUT /presence` with `offline` or `unavailable`. - The SDK keeps long-polling `/sync` with the default `set_presence=online`, and Synapse treats each sync as "this user is online" and flips the state back. - Nothing calls `mx.setSyncPresence(...)`: there is no `setSyncPresence` or `set_presence` anywhere in `src/`. That's what Element uses to keep a manual state. **Introduced by** bd8e116c (2026-05-30, the Discord-style presence selector). **Why it's high:** it's a privacy setting that silently doesn't work. Users who choose Invisible believe they're hidden. **Fix** - Call `mx.setSyncPresence(SetPresence.Offline)` for invisible/hidePresence, and `Unavailable` for idle/dnd. - Reset it to `Online` for auto/online. - Keep the one-off PUT for the immediate change. **Acceptance criteria:** 60 s after choosing Invisible, another account sees `offline`; Idle and DND stay `unavailable`; a Playwright test with two accounts. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._
jared added the priority: highsecurityarea: settings labels 2026-10-04 19:50:20 -04:00
jared commented 2026-10-04 20:17:06 -04:00
Author
Owner
Copy Link
Copy Source

Decision (Jared, 2026-10-04): also enable real busy presence server-side (MSC3026), tracked in matrix#19. The client fix here doesn't depend on it.

**Decision (Jared, 2026-10-04):** also enable real busy presence server-side (MSC3026), tracked in matrix#19. The client fix here doesn't depend on it.
jared closed this issue 2026-10-12 12:53:56 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: settings priority: high security
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#282