Skip to content

fix(control): stop a stuck mouse button swallowing every click - #37

Merged
ralyodio merged 1 commit into
masterfrom
fix/input-injection-order
Aug 6, 2026
Merged

fix(control): stop a stuck mouse button swallowing every click#37
ralyodio merged 1 commit into
masterfrom
fix/input-injection-order

Conversation

@ralyodio

@ralyodio ralyodio commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

A guest could move the pointer but neither side could click anything, and the host stayed locked out until pairux was killed.

injectEvent awaited the pending mouse-move batch before handing the button event to the main process. Because those IPC calls run concurrently, a mouseup could overtake the mousedown still waiting behind a slow move batch. The OS then saw a button press with no release and held the virtual button down, so the whole desktop behaved as if it were mid-drag and ate every subsequent click.

Serialize all OS injections through a single promise chain so move -> down -> up always reach the backend in the order they arrived. Each operation swallows its own error so later input is never blocked behind a rejected promise.

A guest could move the pointer but neither side could click anything,
and the host stayed locked out until pairux was killed.

injectEvent awaited the pending mouse-move batch before handing the
button event to the main process. Because those IPC calls run
concurrently, a mouseup could overtake the mousedown still waiting
behind a slow move batch. The OS then saw a button press with no
release and held the virtual button down, so the whole desktop behaved
as if it were mid-drag and ate every subsequent click.

Serialize all OS injections through a single promise chain so
move -> down -> up always reach the backend in the order they arrived.
Each operation swallows its own error so later input is never blocked
behind a rejected promise.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

159 finding(s)

HIGH/CRITICAL: 111 | MEDIUM: 48

Severity Rule Location
HIGH secret-generic-credential apps/desktop/src/main/ipc/auth.test.ts:18
HIGH secret-generic-credential apps/desktop/src/main/ipc/auth.test.ts:19
HIGH secret-generic-credential apps/desktop/src/main/ipc/auth.test.ts:51
HIGH secret-generic-credential apps/desktop/src/main/ipc/auth.test.ts:52
HIGH secret-generic-credential apps/desktop/src/main/ipc/auth.test.ts:66
HIGH secret-generic-credential apps/desktop/src/main/ipc/auth.test.ts:170
HIGH secret-generic-credential apps/desktop/src/main/ipc/chat.test.ts:16
HIGH secret-generic-credential apps/desktop/src/main/ipc/chat.test.ts:17
HIGH secret-generic-credential apps/desktop/src/main/ipc/session.test.ts:16
HIGH secret-generic-credential apps/desktop/src/main/ipc/session.test.ts:17
HIGH secret-generic-credential apps/desktop/src/renderer/hooks/useRTMPStreaming.test.ts:159
HIGH secret-generic-credential apps/desktop/src/renderer/hooks/useWebRTCHostAPI.test.ts:14
HIGH secret-generic-credential apps/desktop/src/renderer/hooks/useWebRTCHostSFUAPI.test.ts:42
HIGH secret-generic-credential apps/desktop/src/renderer/hooks/useWebRTCHostSFUAPI.test.ts:137
HIGH secret-generic-credential apps/desktop/src/renderer/hooks/useWebRTCViewerAPI.test.ts:13
HIGH secret-generic-credential apps/desktop/src/renderer/hooks/useWebRTCViewerSFUAPI.test.ts:37
HIGH secret-generic-credential apps/desktop/src/renderer/hooks/useWebRTCViewerSFUAPI.test.ts:127
HIGH secret-generic-credential apps/livekit/fly.toml:12
HIGH manifest-typosquat apps/mobile/package.json:43
HIGH secret-generic-credential apps/mobile/src/hooks/useWebRTCHost.test.ts:13
HIGH secret-generic-credential apps/mobile/src/hooks/useWebRTCViewer.test.ts:13
HIGH secret-generic-credential apps/mobile/src/lib/api.test.ts:11
HIGH secret-generic-credential apps/mobile/src/lib/api.test.ts:12
HIGH secret-generic-credential apps/mobile/src/lib/api/auth.test.ts:18
HIGH secret-generic-credential apps/mobile/src/lib/api/auth.test.ts:19
HIGH secret-generic-credential apps/mobile/src/lib/api/auth.test.ts:34
HIGH secret-generic-credential apps/mobile/src/lib/api/auth.test.ts:37
HIGH secret-generic-credential apps/mobile/src/lib/api/auth.test.ts:38
HIGH secret-generic-credential apps/mobile/src/lib/api/auth.test.ts:42
HIGH secret-generic-credential apps/mobile/src/lib/api/auth.test.ts:73
HIGH secret-generic-credential apps/mobile/src/lib/api/auth.test.ts:83
HIGH secret-generic-credential apps/mobile/src/lib/api/auth.test.ts:99
HIGH secret-generic-credential apps/mobile/src/lib/api/chat.test.ts:11
HIGH secret-generic-credential apps/mobile/src/lib/api/sessions.test.ts:11
HIGH secret-generic-credential apps/mobile/src/lib/secure-storage.test.ts:12
HIGH secret-generic-credential apps/mobile/src/lib/secure-storage.test.ts:13
HIGH secret-generic-credential apps/turn/fly.toml:11
HIGH secret-generic-credential apps/web/src/app/api/auth/login/route.test.ts:26
HIGH secret-generic-credential apps/web/src/app/api/auth/login/route.test.ts:54
HIGH secret-generic-credential apps/web/src/app/api/auth/login/route.test.ts:74
HIGH secret-generic-credential apps/web/src/app/api/auth/login/route.test.ts:121
HIGH secret-generic-credential apps/web/src/app/api/auth/reset-password/route.test.ts:44
HIGH secret-generic-credential apps/web/src/app/api/auth/reset-password/route.test.ts:45
HIGH secret-generic-credential apps/web/src/app/api/auth/reset-password/route.test.ts:56
HIGH secret-generic-credential apps/web/src/app/api/auth/reset-password/route.test.ts:65
HIGH secret-generic-credential apps/web/src/app/api/auth/reset-password/route.test.ts:82
HIGH secret-generic-credential apps/web/src/app/api/auth/reset-password/route.test.ts:83
HIGH secret-generic-credential apps/web/src/app/api/auth/reset-password/route.test.ts:99
HIGH secret-generic-credential apps/web/src/app/api/auth/reset-password/route.test.ts:100
HIGH secret-generic-credential apps/web/src/app/api/auth/reset-password/route.test.ts:117

…and 109 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 12426a0 into master Aug 6, 2026
11 of 12 checks passed
@ralyodio
ralyodio deleted the fix/input-injection-order branch August 6, 2026 10:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant