cinny/LOTUS_BUGS.md

Lotus Chat — Bug Report & Technical Audit

Date: June 2026

This document tracks identified bugs, edge cases, and architectural discrepancies.

---

✅ Resolved Issues (Recently Fixed)

• GIF Sending Bypasses E2EE: Fixed in RoomInput.tsx.
• Scheduled Messages Bypass E2EE: Fixed in scheduledMessages.ts.
• Drag-and-Drop Overlay Persistence: Fixed in useFileDrop.ts.
• Stale Member List in Verification Banner: Fixed in useDeviceVerificationStatus.ts.
• Incomplete Python Comment Highlighting: Fixed in syntaxHighlight.ts.
• Search Button Hidden in E2EE Rooms: Fixed in RoomViewHeader.tsx.
• TDS Design Law Violations (Hardcoded Hex): Fixed in GifPicker.tsx and VoiceMessageRecorder.tsx.
• Recent Emoji Sort Order: Fixed in recent-emoji.ts (recency order, not frequency).
• Encrypted Search Misses Historic Events: Fixed in useLocalMessageSearch.ts.
• Presence Updater Base URL Hack: Fixed in usePresenceUpdater.ts.
• Presence Badge Accessibility: Fixed in Presence.tsx (aria-label on badge).

---

🛡️ Critical Security & Logic

1. Edit History Broken for E2EE

File: src/app/features/room/message/EditHistoryModal.tsx Status: OPEN

• Issue: The modal fetches edit history via raw fetch. The returned events are not decrypted.
• Impact: In encrypted rooms, the edit history shows ciphertext or "(no text)" for all previous versions.
• Recommended Fix: After fetching raw events, check if they are encrypted. Use mx.decryptEventIfNeeded(event) for each event in the chunk before rendering.

2. Presence Updater Wipes Custom Status

File: src/app/hooks/usePresenceUpdater.ts Status: OPEN

• Issue: setOnline and setUnavailable still send status_msg: ''.
• Impact: Custom status messages are wiped when the user goes idle/active.
• Recommended Fix: Remove status_msg from the setPresence payload in the updater hook.

3. Service Worker Ephemeral Sessions

File: src/sw.ts Status: OPEN

• Issue: Access tokens are stored in an in-memory sessions Map within the SW.
• Impact: Closing all app tabs wipes the sessions. Background tasks (like future push notification handling or media pre-fetching) will fail.
• Recommended Fix: Persist the session info (accessToken/baseUrl) in IndexedDB within the Service Worker so it survives app restarts.

---

📱 PWA & Mobile Issues

1. No PWA Precaching (Offline Mode Broken)

File: src/sw.ts, vite.config.js Status: OPEN

• Issue: The Service Worker is missing the self.__WB_MANIFEST injection point and precacheAndRoute call.
• Impact: The app does not work offline and fails PWA installation requirements in most browsers.
• Recommended Fix: Add precacheAndRoute(self.__WB_MANIFEST) to sw.ts and ensure vite.config.js has a valid injectionPoint.

2. PiP Resize Impossible on Mobile

File: src/app/components/CallEmbedProvider.tsx Status: OPEN

• Issue: Resizing the PiP window uses onMouseDown handlers which do not trigger on touch devices.
• Impact: Mobile users cannot resize the PiP window.
• Recommended Fix: Implement onTouchStart handlers for the resize corners, mapping touch coordinates to the same resize logic.

3. Double Background Animation (GPU Waste)

File: src/app/pages/client/SidebarNav.tsx, src/app/features/room/RoomView.tsx Status: OPEN

• Issue: When Glassmorphism is enabled, the chat background is mirrored to document.body while the RoomView also renders it.
• Impact: Two identical animations (e.g., Digital Rain) run simultaneously, doubling GPU usage on mobile.
• Recommended Fix: When Glassmorphism is active, make the RoomView background transparent and rely on the document.body background.

4. Manifest Shortcut Icon 404

File: public/manifest.json Status: OPEN

• Issue: The shortcut icon path is res/android/... but the file is copied to public/android/....
• Recommended Fix: Change the path to ./public/android/android-chrome-96x96.png in manifest.json.

---

🎨 UI/UX Consistency

1. Night Light Overlay Coverage

File: src/app/pages/App.tsx Status: OPEN

• Issue: Overlay is inside #root, bypasses #portalContainer (modals/tooltips).
• Recommended Fix: Move to end of document.body.