LotusGuild/cinny
3
0
Fork 0
Code Issues 45 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Optional Element Call origin via config.json elementCallUrl (#43) #243

Merged
jared merged 2 commits from call-origin-split into lotus 2026-09-27 02:24:48 -04:00
Conversation 0 Commits 2 Files Changed 9
+139 -33
2 Commits
Author SHA1 Message Date
Lotus CIandClaude Opus 5.5 da78bff316 chore(call): pin element-call-embedded 0.25.0-lotus.21 (#43)
CI / Build & Quality Checks (pull_request) Successful in 5m10s
Details
CI / Trigger Desktop Build (pull_request) Skipped
Details
CI / Docker image build & smoke test (pull_request) Skipped
Details
CI / Secret scan (gitleaks) (pull_request) Successful in 24s
Details
CI / Playwright smoke (e2e) (pull_request) Successful in 13m21s
Details 
lotus.21 checks widget messages against the host's origin (works same- and
cross-origin) and accepts soundboard clip bytes. Same-origin behaviour is
unchanged; verified against the published package: join, both screenshare
paths, PTT/deafen in the frame, layout/reactions/settings, speaking and mic
level, soundboard, avatars, muted-speech warning, per-person volume, and the
foreign-frame spoof stays blocked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
 2026-09-27 02:05:18 -04:00
Lotus CIandClaude Opus 5.5 4dcc5176e2 feat(call): optional Element Call origin via config.json elementCallUrl (#43)
CI / Build & Quality Checks (pull_request) Successful in 3m31s
Details
CI / Trigger Desktop Build (pull_request) Skipped
Details
CI / Docker image build & smoke test (pull_request) Skipped
Details
CI / Secret scan (gitleaks) (pull_request) Successful in 12s
Details
CI / Playwright smoke (e2e) (pull_request) Successful in 12m27s
Details 
Groundwork for serving the call page from its own origin
(call.chat.lotusguild.org). Inert until config.json sets `elementCallUrl`:
without it the bundled same-origin page is used exactly as today.

- callPageUrl: resolves `elementCallUrl` — absolute https only (http only on
  localhost for development); anything else, and the desktop app, fall back
  to the bundled page so a bad value can't break calls. Set once from the
  loaded client config.
- CallEmbed builds the widget URL from it; the widget origin (used by the
  message guard and Capability Delegation) follows automatically.
- Soundboard: a host blob: URL can't be fetched from another origin, so
  io.lotus.inject_audio now also carries the clip's bytes (`audio`). Forks
  that predate it ignore the field and use `url`, so this is safe on the
  released fork.

Needs element-call's lotus-call-origin branch (host-origin message check +
inject_audio bytes) released and pinned before `elementCallUrl` is set.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
 2026-09-26 23:24:24 -04:00