Lotus CIandClaude Opus 5.5
14f05a3d5c
CI / Build & Quality Checks (pull_request) Successful in 1m53s
CI / Trigger Desktop Build (pull_request) Skipped
CI / Docker image build & smoke test (pull_request) Skipped
CI / Secret scan (gitleaks) (pull_request) Successful in 7s
CI / Playwright smoke (e2e) (pull_request) Successful in 12m51s
#266: remembered widget approvals (lotus.widgetConsent.*) survived logout, so they applied silently to the next account on the device and listed the previous account's rooms; clearPlaintextCaches now sweeps them. Space structure, call membership and Lotus room-policy state join PROTECTED_STATE_TYPES, so no widget can be granted them. #267: any website could auto-submit a form to /share-target and land the user in the share picker with attacker-chosen text and files. The worker now refuses a share whose Origin is another site. (Sec-Fetch-Site, as the issue suggested, never reaches a service worker: checked in Chromium.) Origin null/absent, as the OS share sheet sends, stays accepted, and /share now says the content came from another app or website. Both logout paths await clearSharedPayload(); the server-forced one also clears the soundboard clip cache, as #57 intended. Fixes #266 Fixes #267 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5