mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 16:13:15 +00:00
Input inside an iframe never reaches the host window, so the idle timeout signed users out while they worked in a plugin page, dialog or panel. The sandbox runtime now reports trusted input in its frame (the guard's own events, focus left out) through a MessagePort it hands the host with sandbox-ready, before any plugin code runs, at most once per 15 s. The host bridge passes it to a small notifier the session timeout guard counts like its own window's input, so it reaches the other tabs too.