startLotusCallState gates only on the URL flag, not on widget !== null. Opened standalone with ?lotusCallState=1 (a link a user can be handed, or a leftover param), EC builds the per-member combineLatest graph and runs JSON.stringify over the participant array at up to 8 Hz, then lotusSendToHost returns false immediately because widget?.api is undefined — every byte of that work is discarded. The other lotus features correctly short-circuit on widget first (lotusFocus.ts:24, lotusDecorations.ts:63).
How to trigger
load the EC bundle directly with ?lotusCallState=1 and no widgetId/parentUrl.
Suggested fix
add if (!widget) return () => undefined; at the top of startLotusCallState, mirroring the other modules.
Filed from the September 2026 audit (branch lotus).
**Severity:** low · **Type:** performance · **Confidence:** high
**Location:** `src/lotus/lotusCallState.ts:34-70`, `src/lotus/lotusWidget.ts:56-64`
### Problem
`startLotusCallState` gates only on the URL flag, not on `widget !== null`. Opened standalone with `?lotusCallState=1` (a link a user can be handed, or a leftover param), EC builds the per-member `combineLatest` graph and runs `JSON.stringify` over the participant array at up to 8 Hz, then `lotusSendToHost` returns `false` immediately because `widget?.api` is undefined — every byte of that work is discarded. The other lotus features correctly short-circuit on `widget` first (`lotusFocus.ts:24`, `lotusDecorations.ts:63`).
### How to trigger
load the EC bundle directly with `?lotusCallState=1` and no `widgetId`/`parentUrl`.
### Suggested fix
add `if (!widget) return () => undefined;` at the top of `startLotusCallState`, mirroring the other modules.
---
_Filed from the September 2026 audit (branch `lotus`)._
jared
added this to the EC fork audit 2026-09 · Medium & Low milestone 2026-09-12 02:13:14 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: performance · Confidence: high
Location:
src/lotus/lotusCallState.ts:34-70,src/lotus/lotusWidget.ts:56-64Problem
startLotusCallStategates only on the URL flag, not onwidget !== null. Opened standalone with?lotusCallState=1(a link a user can be handed, or a leftover param), EC builds the per-membercombineLatestgraph and runsJSON.stringifyover the participant array at up to 8 Hz, thenlotusSendToHostreturnsfalseimmediately becausewidget?.apiis undefined — every byte of that work is discarded. The other lotus features correctly short-circuit onwidgetfirst (lotusFocus.ts:24,lotusDecorations.ts:63).How to trigger
load the EC bundle directly with
?lotusCallState=1and nowidgetId/parentUrl.Suggested fix
add
if (!widget) return () => undefined;at the top ofstartLotusCallState, mirroring the other modules.Filed from the September 2026 audit (branch
lotus).Fixed in
fd957bad, shipped in0.25.0-lotus.1(published by CI from tag v0.25.0-lotus.1) and consumed by cinny at 9a85a487.