both key effects attach listeners to callEmbed.iframe.contentWindow captured once at effect setup, and the effects only re-run on [pttMode, pttKey, callEmbed] / [callEmbed, deafenKey]. Listeners registered on a window are discarded when that window navigates to a new document, so after any EC-side reload (crash recovery, an in-widget navigation) the PTT and deafen keys stop working while focus is inside the iframe — which is most of the time during a call — with no error. The host-window bindings keep working, so it fails silently and inconsistently.
How to trigger
join a call, confirm PTT works with focus in the video area, force the EC iframe to reload, then try PTT with focus in the iframe.
Suggested fix
re-attach the iframe listeners from an iframe.onload/load listener (or subscribe via the widget transport instead of raw DOM events). Marked medium confidence because forcing an EC reload requires a live call.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** low · **Type:** bug · **Confidence:** medium
**Location:** `src/app/features/call/CallControls.tsx:170,220-232,265-267`
### Problem
both key effects attach listeners to `callEmbed.iframe.contentWindow` captured once at effect setup, and the effects only re-run on `[pttMode, pttKey, callEmbed]` / `[callEmbed, deafenKey]`. Listeners registered on a window are discarded when that window navigates to a new document, so after any EC-side reload (crash recovery, an in-widget navigation) the PTT and deafen keys stop working *while focus is inside the iframe* — which is most of the time during a call — with no error. The host-window bindings keep working, so it fails silently and inconsistently.
### How to trigger
join a call, confirm PTT works with focus in the video area, force the EC iframe to reload, then try PTT with focus in the iframe.
### Suggested fix
re-attach the iframe listeners from an `iframe.onload`/`load` listener (or subscribe via the widget transport instead of raw DOM events). Marked medium confidence because forcing an EC reload requires a live call.
---
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:20 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: bug · Confidence: medium
Location:
src/app/features/call/CallControls.tsx:170,220-232,265-267Problem
both key effects attach listeners to
callEmbed.iframe.contentWindowcaptured once at effect setup, and the effects only re-run on[pttMode, pttKey, callEmbed]/[callEmbed, deafenKey]. Listeners registered on a window are discarded when that window navigates to a new document, so after any EC-side reload (crash recovery, an in-widget navigation) the PTT and deafen keys stop working while focus is inside the iframe — which is most of the time during a call — with no error. The host-window bindings keep working, so it fails silently and inconsistently.How to trigger
join a call, confirm PTT works with focus in the video area, force the EC iframe to reload, then try PTT with focus in the iframe.
Suggested fix
re-attach the iframe listeners from an
iframe.onload/loadlistener (or subscribe via the widget transport instead of raw DOM events). Marked medium confidence because forcing an EC reload requires a live call.Filed from the September 2026 client audit (branch
lotus@4bea4895).