6 Commits

Include renames

Author	SHA1	Message	Date
Lotus CIandClaude Opus 4.8	0ffe247929	fix(lotus): Wave-1 audit fixes (EC1–EC6) ... - EC1: lotusQuality — track + clearTimeout the 500ms settle re-apply per room (was leaking a timer that fired on torn-down rooms). - EC2/EC3: lotusQuality + lotusAudioInject drive off vm.allConnections$ instead of the remote-gated livekitRoomItems$ (were no-ops when alone), matching lotusDenoise. - EC4: lotusDecorations resets its roster to {} on teardown so a decoration from a previous call can't render on a shared user in the next one. - EC5: hoisted a stable useSyncExternalStore subscribe fn (was re-subscribing every tile render). - EC6: lotusFocus only sets the spotlight when the userId field is present (a partial payload no longer clears the pin). tsc clean. Needs a republish to ship. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-02 20:13:01 -04:00
Lotus CIandClaude Opus 4.8	98fbdbd5cf	fix(lotus-audio-inject): close double-publish window on rapid inject actions ... playInjectedClip only registered its cleanup (and thus became abortable by a later clip's replace-mode loop) AFTER publishing. Two inject actions fired in quick succession could both pass their fetch/decode/publish awaits before either was registered, so both tracks got published. Register a synchronous placeholder abort BEFORE the first await: it aborts the in-flight fetch and flips an `aborted` flag checked after every await, so a newer clip cancels the older one during the vulnerable window. The real cleanup replaces the placeholder once the track is live, and if we were superseded mid-publish we tear the just-published track down immediately. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-01 23:56:13 -04:00
Lotus CIandClaude Fable 5	0aef1c5fe2	feat(lotus-audio-inject): one soundboard clip at a time (replace mode) ... playInjectedClip now stops any in-flight clip (via the existing idempotent cleanup) before starting a new one, so rapid taps replace rather than overlap/stack — no track leak. The host also debounces the button. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-01 23:21:50 -04:00
Lotus CIandClaude Opus 4.8	b8543c3fe1	lotus(security): harden denoise base, audio-inject, decorations ... Holistic security audit findings: - C1 (CRITICAL): force lotusDenoiseBase to same-origin before it reaches audioWorklet.addModule()/fetch — a crafted call-link param could otherwise load attacker JS/WASM as a worklet processing the live mic. Non-same-origin/malformed values fall back to bundled ./denoise/. - H1 (HIGH): gate audio-inject behind explicit lotusAudioInject=1 (still acks the action so no transport hang) — it publishes under the local user's identity, so it must not be silently armed for every call. - M1 (MED): cap the decoration roster at 512 entries. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 00:00:40 -04:00
Lotus CIandClaude Opus 4.8	10e6ba46e2	lotus(#3): harden audio-inject per review ... - resume() the AudioContext (host postMessage isn't a gesture) so the clip isn't silent; warn if it stays suspended (HIGH). - Close the AudioContext on decode failure (no context leak) (MED). - Abort in-flight clips on teardown (unmount/vm-change/leave) so audio doesn't keep blasting to peers (MED). - Stop the cloned MediaStreamTrack when a room publish fails (MED). - Validate url is https/blob and fetch with credentials:omit, mode:cors (MED security). - Guard against NaN clip duration; fix stale enum doc comment. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-29 23:26:45 -04:00
Lotus CIandClaude Opus 4.8	c73eec0781	lotus(#3): soundboard audio injection via widget action ... Adds io.lotus.inject_audio (toWidget): mixes a soundboard clip into the call so other participants hear it. Publishes the clip as a separate Unknown-source LiveKit track (rendered by MatrixAudioRenderer) rather than splicing into the mic track, so the denoise pipeline is untouched; the track is unpublished when the clip ends (with a 30s safety cap). This is the real call-audio injection that was impossible against the prebuilt EC bundle. Additive: no-op unless the host sends the action. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-29 23:18:43 -04:00