The effect calls invokeTauri('set_call_active', { active: callEmbed !== undefined }) whenever callEmbed changes, but has no cleanup function. TauriDesktopFeatures (which mounts this hook) is rendered for the lifetime of the logged-in client shell, so in normal use the effect re-runs with active: false when the call ends and this is fine. But if the whole client tree unmounts while callEmbed is still defined (e.g. a crash/HMR reload during development, or a future code path that force-unmounts the shell without first tearing down the call — logout mid-call, session expiry mid-call), the native "keep display awake" state (SetThreadExecutionState / D-Bus inhibit) is never told to release, potentially leaving the OS from sleeping until the next call starts and ends normally.
How to trigger
Hard to trigger from normal UI (calls are torn down before logout), but reachable via a forced reload/unmount while callEmbedAtom is non-empty.
Suggested fix
Add a cleanup callback in the effect that invokes set_call_active with active: false on unmount.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** low · **Type:** bug · **Confidence:** medium
**Location:** `src/app/hooks/useTauriCallPower.ts:13-18`
### Problem
The effect calls `invokeTauri('set_call_active', { active: callEmbed !== undefined })` whenever `callEmbed` changes, but has no cleanup function. `TauriDesktopFeatures` (which mounts this hook) is rendered for the lifetime of the logged-in client shell, so in normal use the effect re-runs with `active: false` when the call ends and this is fine. But if the whole client tree unmounts while `callEmbed` is still defined (e.g. a crash/HMR reload during development, or a future code path that force-unmounts the shell without first tearing down the call — logout mid-call, session expiry mid-call), the native "keep display awake" state (`SetThreadExecutionState` / D-Bus inhibit) is never told to release, potentially leaving the OS from sleeping until the next call starts and ends normally.
### How to trigger
Hard to trigger from normal UI (calls are torn down before logout), but reachable via a forced reload/unmount while `callEmbedAtom` is non-empty.
### Suggested fix
Add a cleanup callback in the effect that invokes `set_call_active` with `active: false` on unmount.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:29 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: bug · Confidence: medium
Location:
src/app/hooks/useTauriCallPower.ts:13-18Problem
The effect calls
invokeTauri('set_call_active', { active: callEmbed !== undefined })whenevercallEmbedchanges, but has no cleanup function.TauriDesktopFeatures(which mounts this hook) is rendered for the lifetime of the logged-in client shell, so in normal use the effect re-runs withactive: falsewhen the call ends and this is fine. But if the whole client tree unmounts whilecallEmbedis still defined (e.g. a crash/HMR reload during development, or a future code path that force-unmounts the shell without first tearing down the call — logout mid-call, session expiry mid-call), the native "keep display awake" state (SetThreadExecutionState/ D-Bus inhibit) is never told to release, potentially leaving the OS from sleeping until the next call starts and ends normally.How to trigger
Hard to trigger from normal UI (calls are torn down before logout), but reachable via a forced reload/unmount while
callEmbedAtomis non-empty.Suggested fix
Add a cleanup callback in the effect that invokes
set_call_activewithactive: falseon unmount.Filed from the September 2026 client audit (branch
lotus@4bea4895).