Two things tied EC to the host's origin:
- Widget message check: matrix-widget-api's strictOriginCheck compares
ev.origin with THIS frame's origin, so on call.chat.lotusguild.org every
message from chat.lotusguild.org would be dropped and calls would not
start. restrictToHost() instead requires ev.source === window.parent and
ev.origin === parentUrl's origin. Same-origin deployments keep working
(the host origin is our own origin there), and it is stricter than
before: the sender must also be our parent window.
- Soundboard: the host's blob: clip URL is origin-bound. io.lotus.inject_audio
now accepts the clip's bytes (`audio`, ArrayBuffer, <= 8 MiB) and prefers
them over `url`; hosts that only send `url` are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
