4 Commits

Include renames

Author	SHA1	Message	Date
Lotus CIandClaude Fable 5	0aef1c5fe2	feat(lotus-audio-inject): one soundboard clip at a time (replace mode) ... playInjectedClip now stops any in-flight clip (via the existing idempotent cleanup) before starting a new one, so rapid taps replace rather than overlap/stack — no track leak. The host also debounces the button. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-01 23:21:50 -04:00
Lotus CIandClaude Opus 4.8	b8543c3fe1	lotus(security): harden denoise base, audio-inject, decorations ... Holistic security audit findings: - C1 (CRITICAL): force lotusDenoiseBase to same-origin before it reaches audioWorklet.addModule()/fetch — a crafted call-link param could otherwise load attacker JS/WASM as a worklet processing the live mic. Non-same-origin/malformed values fall back to bundled ./denoise/. - H1 (HIGH): gate audio-inject behind explicit lotusAudioInject=1 (still acks the action so no transport hang) — it publishes under the local user's identity, so it must not be silently armed for every call. - M1 (MED): cap the decoration roster at 512 entries. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 00:00:40 -04:00
Lotus CIandClaude Opus 4.8	10e6ba46e2	lotus(#3): harden audio-inject per review ... - resume() the AudioContext (host postMessage isn't a gesture) so the clip isn't silent; warn if it stays suspended (HIGH). - Close the AudioContext on decode failure (no context leak) (MED). - Abort in-flight clips on teardown (unmount/vm-change/leave) so audio doesn't keep blasting to peers (MED). - Stop the cloned MediaStreamTrack when a room publish fails (MED). - Validate url is https/blob and fetch with credentials:omit, mode:cors (MED security). - Guard against NaN clip duration; fix stale enum doc comment. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-29 23:26:45 -04:00
Lotus CIandClaude Opus 4.8	c73eec0781	lotus(#3): soundboard audio injection via widget action ... Adds io.lotus.inject_audio (toWidget): mixes a soundboard clip into the call so other participants hear it. Publishes the clip as a separate Unknown-source LiveKit track (rendered by MatrixAudioRenderer) rather than splicing into the mic track, so the denoise pipeline is untouched; the track is unpublished when the clip ends (with a 30s safety cap). This is the real call-audio injection that was impossible against the prebuilt EC bundle. Additive: no-op unless the host sends the action. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-29 23:18:43 -04:00