fix(lisp): charge READ text, EQUAL string bytes, SETVAR and ENTMAKE copies, and nested callbacks against one budget

Cargo.lock

@@ -806,7 +806,6 @@ dependencies = [
  "craft-window",
  "egui",
  "egui-wgpu",
- "egui_extras",
  "egui_kittest",
  "image",
  "log",
@@ -1511,19 +1510,6 @@ dependencies = [
  "winit",
 ]
 
-[[package]]
-name = "egui_extras"
-version = "0.37.0"
-source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
-dependencies = [
- "ahash",
- "egui",
- "enum-map",
- "itertools",
- "log",
- "profiling",
-]
-
 [[package]]
 name = "egui_glow"
 version = "0.37.0"
@@ -1592,26 +1578,6 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
 
-[[package]]
-name = "enum-map"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4532960034c15ba2f55e9eee631040ecc473c32e6c4b200828c759840f13a06"
-dependencies = [
- "enum-map-derive",
-]
-
-[[package]]
-name = "enum-map-derive"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7127272f64b3e098f7d81f350d672081b879bff896d219c42370dc858b1af9ff"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 3.0.9",
-]
-
 [[package]]
 name = "enumflags2"
 version = "0.7.12"
@@ -6284,6 +6250,11 @@ name = "egui_demo_lib"
 version = "0.37.0"
 source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
 
+[[patch.unused]]
+name = "egui_extras"
+version = "0.37.0"
+source = "git+https://github.com/storytold/egui.git?rev=6d518fc799681571963842f95b55a6b68431b15a#6d518fc799681571963842f95b55a6b68431b15a"
+
 [[patch.unused]]
 name = "egui_inspection"
 version = "0.37.0"

Cargo.toml

@@ -63,8 +63,6 @@ quick-xml = "0.42"
 craft-ui = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["serde"] }
 craft-window = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "92d392cff132eaf53e13afff77f38b5c11b73aa0", features = ["egui"] }
 egui = { version = "0.37", default-features = false, features = ["default_fonts", "monochrome_emoji_fonts"] }
-# Resizable table columns (About ▸ Contributors / Models); no image loaders.
-egui_extras = { version = "0.37", default-features = false }
 egui_kittest = "0.37"
 eframe = { version = "0.37", default-features = false }
 egui-wgpu = "0.37"

crates/engine/src/lisp.rs

@@ -123,6 +123,12 @@ pub struct LispState {
     acad_loaded: bool,
     /// Memory caps (lowered by tests).
     pub(crate) limits: Limits,
+    /// Interpreter steps all synchronous callbacks have run, nested ones included. A callback's
+    /// allowance counts what ran since it started, so the callbacks it calls spend its steps.
+    pub(crate) callback_used: u64,
+    /// The `callback_used` value the callback running now (and so every one it calls) must not
+    /// pass: the lowest of its own and its callers' allowances.
+    pub(crate) callback_ceiling: Option<u64>,
 }
 
 /// What U and REDO inside the running routine take back: the commands it ran, each as the drawing

crates/engine/src/lisp/builtins/strings.rs

@@ -1,5 +1,5 @@
 use super::args::{R, arity, int, list_arg, string};
-use super::{LispError, OsStr, Value, check_string_len, read, to_text};
+use super::{LispError, OsStr, Value, charge_bytes, check_string_len, read, to_text};
 
 // ---------------- strings ----------------
 
@@ -114,7 +114,13 @@ pub(super) fn read_fn(a: &[Value]) -> R {
     arity(a, 0, 1)?;
     match a.first() {
         None | Some(Value::Nil) => Ok(Value::Nil),
-        Some(v) => read::read_one(&string(v)?),
+        Some(v) => {
+            // The strings in the list it makes are new, each as long as its text at most: the
+            // text is charged, though a list result isn't inspected by `charge_result`.
+            let text = string(v)?;
+            charge_bytes(text.len())?;
+            read::read_one(&text)
+        }
     }
 }
 

crates/engine/src/lisp/drawing.rs

@@ -179,7 +179,12 @@ fn to_json_bounded(v: &Value, depth: usize, budget: &mut u64) -> Option<serde_js
         Value::Nil => serde_json::Value::Null,
         Value::Int(i) => serde_json::json!(i),
         Value::Real(r) => serde_json::json!(r),
-        Value::Str(s) => serde_json::json!(&**s),
+        Value::Str(s) => {
+            // A string is copied whole each time it occurs: it spends the allowance by its length
+            // (one unit per 16 bytes, so about 32 MB in all), shared or not.
+            *budget = budget.checked_sub(s.len() as u64 / 16)?;
+            serde_json::json!(&**s)
+        }
         Value::Cons(_) => {
             let mut arr = Vec::new();
             for x in v.iter() {
@@ -296,12 +301,16 @@ fn groups_to_list(tags: &[Tag]) -> Vec<Value> {
     out
 }
 
+/// The most string bytes an entity list may hold (counted per occurrence, shared or not).
+const MAX_GROUP_TEXT: usize = 32 << 20;
+
 /// An association list back to DXF groups (points split into x, y, z groups). The type
 /// (`0`), the entity name (`-1`), the handle (`5`), the owner (`330`) and the layout (`410`) are
 /// left out: they aren't the entity's to set.
 fn list_to_groups(list: &Value) -> Result<(String, Vec<Tag>), LispError> {
     let mut kind = None;
     let mut tags = Vec::new();
+    let mut text_left = MAX_GROUP_TEXT;
     for item in list.iter() {
         let Value::Cons(c) = &item else { return Err(LispError::bad_arg("listp", &item)) };
         let Value::Int(code) = c.car else { return Err(LispError::bad_arg("fixnump", &c.car)) };
@@ -323,7 +332,11 @@ fn list_to_groups(list: &Value) -> Result<(String, Vec<Tag>), LispError> {
             _ => tags.push(match &v {
                 Value::Int(i) => Tag::i(code, i64::from(*i)),
                 Value::Real(r) => Tag::f(code, *r),
-                Value::Str(s) => Tag::s(code, &**s),
+                Value::Str(s) => {
+                    // Each occurrence of a shared string becomes its own copy in the tag.
+                    text_left = text_left.checked_sub(s.len()).ok_or_else(|| LispError::new("out of memory: the entity list holds too much text"))?;
+                    Tag::s(code, &**s)
+                }
                 Value::Ename(h) => Tag::s(code, h.hex()),
                 other => return Err(LispError::bad_arg("DXF group value", other)),
             }),
@@ -1125,3 +1138,27 @@ pub fn load_source(s: &Session, name: &str) -> Option<String> {
         s.lisp_support_dir().map(|d| candidates.iter().map(|c| d.join(c).to_string_lossy().into_owned()).collect::<Vec<_>>()).unwrap_or_default();
     candidates.iter().chain(&support).find_map(super::builtins::read_text_file)
 }
+
+#[cfg(test)]
+mod budget_tests {
+    use super::*;
+
+    /// One 64 KB string occurring many times is charged by its length each time.
+    #[test]
+    fn shared_strings_spend_the_conversion_budgets() {
+        let big = Value::str(&"x".repeat(64 << 10));
+        // 600 x 64 KB is over the 32 MiB an entity list may hold; 100 x 64 KB is not.
+        let list = |n: usize| {
+            let mut items = vec![Value::cons(Value::Int(0), Value::str("TEXT"))];
+            items.extend(std::iter::repeat_n(Value::cons(Value::Int(1), big.clone()), n));
+            Value::list(items)
+        };
+        assert!(list_to_groups(&list(600)).is_err());
+        assert!(list_to_groups(&list(100)).is_ok());
+        // 1,000 x 64 KB is 4,096,000 units of the 2,000,000 SETVAR allows; 100 x 64 KB is not.
+        let mut budget = TO_JSON_BUDGET;
+        assert!(to_json_bounded(&Value::list(vec![big.clone(); 1_000]), 0, &mut budget).is_none());
+        let mut budget = TO_JSON_BUDGET;
+        assert!(to_json_bounded(&Value::list(vec![big; 100]), 0, &mut budget).is_some());
+    }
+}

crates/engine/src/lisp/eval.rs

@@ -175,17 +175,19 @@ pub struct Machine {
     stack: Vec<Frame>,
     state: State,
     need: Option<Need>,
+    /// Steps the last [`Machine::run`] took.
+    last_steps: u64,
 }
 
 impl Machine {
     /// A machine evaluating `forms` in turn.
     pub fn forms(forms: Vec<Value>) -> Machine {
-        Machine { stack: vec![Frame::Forms { rest: forms.into_iter().rev().collect() }], state: State::Ret(Value::Nil), need: None }
+        Machine { stack: vec![Frame::Forms { rest: forms.into_iter().rev().collect() }], state: State::Ret(Value::Nil), need: None, last_steps: 0 }
     }
 
     /// A machine calling `f` with `args`.
     pub fn calling(f: Value, args: Vec<Value>) -> Machine {
-        Machine { stack: Vec::new(), state: State::Call(f, args), need: None }
+        Machine { stack: Vec::new(), state: State::Call(f, args), need: None, last_steps: 0 }
     }
 
     /// Give the value a [`Need`] waited for, and carry on.
@@ -196,9 +198,15 @@ impl Machine {
     /// Run until done, waiting, or `budget` steps.
     pub fn run(&mut self, ctx: &mut Ctx<'_>, budget: u64) -> Outcome {
         let mut n = 0u64;
+        let outcome = self.run_counted(ctx, budget, &mut n);
+        self.last_steps = n.min(budget);
+        outcome
+    }
+
+    fn run_counted(&mut self, ctx: &mut Ctx<'_>, budget: u64, n: &mut u64) -> Outcome {
         loop {
-            n += 1;
-            if n > budget {
+            *n += 1;
+            if *n > budget {
                 return Outcome::Wait(Need::Yield);
             }
             let r = match std::mem::replace(&mut self.state, State::Ret(Value::Nil)) {
@@ -646,29 +654,41 @@ impl Ctx<'_> {
             super::value::charge_result(&v)?;
             return Ok(v);
         }
+        let cap = self.s.lisp.limits.callback_steps;
+        let start = self.s.lisp.callback_used;
+        // This callback may run until `callback_used` reaches `ceiling`: `cap` steps from now, or
+        // sooner where a caller's allowance ends, so callbacks nested in callbacks share one
+        // allowance instead of each taking a fresh one (an exponential tree otherwise).
+        let outer = self.s.lisp.callback_ceiling;
+        let ceiling = start.saturating_add(cap).min(outer.unwrap_or(u64::MAX));
+        self.s.lisp.callback_ceiling = Some(ceiling);
+        let r = self.drive_callback(f, args, ceiling);
+        self.s.lisp.callback_ceiling = outer;
+        r
+    }
+
+    /// Run callback `f` in slices until it finishes or `callback_used` reaches `ceiling`.
+    fn drive_callback(&mut self, f: &Value, args: Vec<Value>, ceiling: u64) -> Result<Value, LispError> {
         let cap = self.s.lisp.limits.callback_steps;
         let mut m = Machine::calling(f.clone(), args);
         let mut sub = Ctx { s: &mut *self.s, env: &mut *self.env, depth: self.depth + 1 };
         // Drive the callback in bounded slices instead of granting it `u64::MAX` fuel. A `Yield`
-        // (the step budget ran out) is retried until a hard cap, so a constant-memory infinite
+        // (the step budget ran out) is retried until the ceiling, so a constant-memory infinite
         // loop inside a comparator or predicate terminates with an error rather than hanging the
-        // thread and bypassing the blocking execution cap (CWE-400).
-        let mut spent: u64 = 0;
+        // thread and bypassing the blocking execution cap (CWE-400). The steps of callbacks this
+        // one calls are counted in `callback_used` too.
         loop {
-            let remaining = cap.saturating_sub(spent);
+            let remaining = ceiling.saturating_sub(sub.s.lisp.callback_used);
             if remaining == 0 {
                 return Err(LispError::new(format!("callback stopped after {cap} steps")));
             }
             let slice = remaining.min(SYNC_SLICE);
-            match m.run(&mut sub, slice) {
+            let outcome = m.run(&mut sub, slice);
+            sub.s.lisp.callback_used = sub.s.lisp.callback_used.saturating_add(m.last_steps);
+            match outcome {
                 Outcome::Done(v) => return Ok(v),
                 Outcome::Error(e) => return Err(e),
-                Outcome::Wait(Need::Yield) => {
-                    spent = spent.saturating_add(slice);
-                    if spent >= cap {
-                        return Err(LispError::new(format!("callback stopped after {cap} steps")));
-                    }
-                }
+                Outcome::Wait(Need::Yield) => {}
                 Outcome::Wait(_) => return Err(LispError::new("this function can't ask for input here")),
             }
         }

crates/engine/src/lisp/tests.rs

@@ -286,6 +286,20 @@ fn reaching_a_callback_slice_boundary_does_not_grant_another_slice() {
     assert!(counts[1] >= counts[0] && counts[1] - counts[0] <= 1, "{counts:?}");
 }
 
+/// Callbacks that call callbacks share one allowance: a branching routine can't multiply it.
+#[test]
+fn nested_callbacks_share_one_step_allowance() {
+    let mut s = session();
+    s.lisp.limits.callback_steps = 1_000_000;
+    // 4^14 leaf calls if every callback took a fresh allowance; the whole tree gets one.
+    let started = std::time::Instant::now();
+    let e = eval(&mut s, "(defun f (n) (if (> n 0) (vl-every '(lambda (x) (f (1- n)) t) '(1 2 3 4)) t)) (f 14)").unwrap_err();
+    assert!(e.contains("callback stopped after 1000000 steps"), "{e}");
+    assert!(started.elapsed() < std::time::Duration::from_secs(60));
+    // The next run starts afresh.
+    assert_eq!(ok(&mut s, "(f 1)"), "T");
+}
+
 /// System-variable conversion rejects a shared list whose owned JSON expansion would exceed its budget.
 #[test]
 fn setvar_rejects_an_oversized_shared_structure() {
@@ -977,6 +991,9 @@ fn strings_are_capped() {
     assert!(e.contains("too much text"), "{e}");
     let e = eval(&mut s, "(repeat 200000 (princ \"0123456789\"))").unwrap_err();
     assert!(e.contains("too much text"), "{e}");
+    // READ makes new strings inside the list it returns: they count, though the result is a list.
+    let e = eval(&mut s, "(setq a \"(\\\"0123456789\\\")\") (repeat 100000 (setq b (read a)))").unwrap_err();
+    assert!(e.contains("too much text"), "{e}");
     // The budget is per run: the next one starts afresh.
     assert_eq!(ok(&mut s, "(strcat \"a\" \"b\")"), "\"ab\"");
 }

crates/engine/src/lisp/value.rs

@@ -346,7 +346,11 @@ pub fn equal(a: &Value, b: &Value, fuzz: f64) -> bool {
     // A shared cons DAG can expand into exponentially many node visits when compared as a tree.
     // Bound the total comparisons so `equal` on adversarial shared structure cannot monopolise the
     // thread (CWE-407); exhausting the budget reports "not equal" rather than looping.
-    let mut budget: u64 = EQUAL_BUDGET;
+    equal_within(a, b, fuzz, EQUAL_BUDGET)
+}
+
+/// [`equal`] with its work allowance (node visits plus string bytes / 64) given.
+fn equal_within(a: &Value, b: &Value, fuzz: f64, mut budget: u64) -> bool {
     equal_depth(a, b, fuzz, 0, &mut budget)
 }
 
@@ -373,7 +377,19 @@ fn equal_depth(a: &Value, b: &Value, fuzz: f64, depth: usize, budget: &mut u64)
                 a = na;
                 b = nb;
             }
-            _ => return atom_equal(&a, &b, fuzz),
+            _ => {
+                // Comparing two strings costs their length, not one visit: a shared list of long
+                // equal strings must spend the allowance by the bytes it compares (one unit per 64).
+                if let (Value::Str(x), Value::Str(y)) = (&a, &b) {
+                    let cost = (x.len().min(y.len()) / 64) as u64;
+                    if cost >= *budget {
+                        *budget = 0;
+                        return false;
+                    }
+                    *budget -= cost;
+                }
+                return atom_equal(&a, &b, fuzz);
+            }
         }
     }
 }
@@ -540,6 +556,20 @@ fn write_value(out: &mut String, v: &Value, escape: bool, depth: usize) {
 mod tests {
     use super::*;
 
+    /// `equal` charges the bytes of the strings it compares: a list of long equal strings fits a
+    /// big allowance but not a small one, though it has few nodes.
+    #[test]
+    fn equal_spends_its_allowance_on_string_bytes() {
+        let long = Value::str(&"x".repeat(6_400));
+        let other = Value::str(&"x".repeat(6_400));
+        let list = |v: &Value| Value::list(vec![v.clone(); 100]);
+        let (a, b) = (list(&long), list(&other));
+        // 100 strings x 100 units each, plus about 100 node visits.
+        assert!(equal_within(&a, &b, 0.0, 20_000));
+        assert!(!equal_within(&a, &b, 0.0, 5_000));
+        assert!(equal(&a, &b, 0.0));
+    }
+
     #[test]
     fn reals_print_with_six_significant_digits() {
         assert_eq!(real_text(1.0), "1.0");

crates/ui-egui/Cargo.toml

@@ -19,7 +19,6 @@ cadcraft-engine = { workspace = true }
 cadcraft-fonts = { workspace = true }
 craft-window = { workspace = true }
 egui = { workspace = true }
-egui_extras = { workspace = true }
 # GPU canvas paint callback (same egui-wgpu/wgpu eframe uses with its "wgpu" feature).
 egui-wgpu = { workspace = true }
 serde = { workspace = true }

crates/ui-egui/src/credits.rs

@@ -253,14 +253,12 @@ pub fn contributors_ui(ui: &mut egui::Ui) {
         .weak(),
     );
     ui.separator();
-    if list.is_empty() {
-        ui.label(crate::tl!("No contributor data was built into this copy."));
-    } else if v.table {
-        // The table scrolls vertically itself, under a fixed header; it only scrolls sideways
-        // once its columns are dragged wider than the dialog.
-        egui::ScrollArea::horizontal().auto_shrink([false, false]).show(ui, |ui| table(ui, &list, &mut v));
-    } else {
-        egui::ScrollArea::vertical().auto_shrink([false, false]).show(ui, |ui| {
+    egui::ScrollArea::both().auto_shrink([false, false]).show(ui, |ui| {
+        if list.is_empty() {
+            ui.label(crate::tl!("No contributor data was built into this copy."));
+        } else if v.table {
+            table(ui, &list, &mut v);
+        } else {
             ui.horizontal_wrapped(|ui| {
                 for (i, c) in list.iter().enumerate() {
                     if i > 0 {
@@ -269,154 +267,43 @@ pub fn contributors_ui(ui: &mut egui::Ui) {
                     ui.hyperlink_to(c.name(v.names), format!("https://github.com/{}", c.login)).on_hover_text(c.summary());
                 }
             });
-        });
-    }
+        }
+    });
     ui.data_mut(|d| d.insert_temp(id, v));
 }
 
-/// How the contributor table's spare width is shared out: all of it to Name.
-const CONTRIBUTOR_GROW: [f32; 10] = [1.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0];
-
-/// How the model table's spare width is shared out: to Company and Model, the text columns.
-const MODEL_GROW: [f32; 6] = [1.0, 2.0, 0.0, 0.0, 0.0, 0.0];
-
-/// The narrowest a column can be dragged.
-const MIN_COLUMN: f32 = 28.0;
-
-/// The width a column needs for its header and its widest cell.
-fn natural(ui: &egui::Ui, header: RichText, cells: impl Iterator<Item = String>) -> f32 {
-    let measure = |text: egui::WidgetText| text.into_galley(ui, Some(egui::TextWrapMode::Extend), f32::INFINITY, egui::TextStyle::Body).size().x;
-    let widest = cells.map(|c| measure(c.into())).fold(measure(header.into()), f32::max);
-    widest + 2.0 * ui.spacing().button_padding.x
-}
-
-/// Opening column widths: each column's natural width, with the spare room shared out by `grow`,
-/// so the columns fill `room` exactly. When there is too little room, only the growing columns
-/// give way, each in proportion to its width above [`MIN_COLUMN`], and none goes below that.
-fn fit_widths(natural: &[f32], grow: &[f32], room: f32) -> Vec<f32> {
-    let spare = room - natural.iter().sum::<f32>();
-    let weight = grow.iter().sum::<f32>();
-    let slack = |w: f32| (w - MIN_COLUMN).max(0.0);
-    let flexible: f32 = natural.iter().zip(grow).filter(|(_, g)| **g > 0.0).map(|(w, _)| slack(*w)).sum();
-    natural
-        .iter()
-        .zip(grow)
-        .map(|(w, g)| {
-            if *g > 0.0 && spare >= 0.0 {
-                w + spare * g / weight
-            } else if *g > 0.0 && flexible > 0.0 {
-                w - (-spare).min(flexible) * slack(*w) / flexible
-            } else {
-                *w
-            }
-        })
-        .collect()
-}
-
-/// A striped table whose columns open at [`fit_widths`], so it fills the width and nothing scrolls
-/// sideways. Every column, the last included, can be dragged wider or narrower at its right edge:
-/// only a table dragged wider than the window scrolls sideways. Text too long for its column is
-/// clipped. When a column's natural width or the window changes, the columns go back to a new fit,
-/// dropping any dragged widths.
-fn fitted_table<'a>(ui: &'a mut egui::Ui, id: &str, natural: &[f32], grow: &[f32]) -> egui_extras::TableBuilder<'a> {
-    // Every cell is followed by the item gap, and the vertical scrollbar keeps its margins.
-    let s = ui.spacing();
-    let gaps = s.item_spacing.x * natural.len() as f32;
-    let bar = s.scroll.bar_width + s.scroll.bar_inner_margin + s.scroll.bar_outer_margin;
-    let widths = fit_widths(natural, grow, (ui.available_width() - gaps - bar).max(0.0));
-    // The table keeps its own column widths, so a change in what they were fitted to has to clear
-    // them. A longer name can leave the fit itself unchanged, and scrolling can nudge the available
-    // width, so this compares the natural widths and the clip rect, which scrolling never moves.
-    let fit = egui::Id::unique(("credits_fit", id));
-    let measured = (natural.to_vec(), ui.clip_rect().width());
-    let refit = ui.data_mut(|d| d.get_temp::<(Vec<f32>, f32)>(fit)).as_ref() != Some(&measured);
-    ui.data_mut(|d| d.insert_temp(fit, measured));
-    let mut t =
-        egui_extras::TableBuilder::new(ui).id_salt(id).striped(true).resizable(true).auto_shrink([false, false]).max_scroll_height(f32::INFINITY);
-    if refit {
-        t.reset();
-    }
-    for w in widths {
-        t = t.column(egui_extras::Column::initial(w).at_least(MIN_COLUMN).clip(true));
-    }
-    t
-}
-
-/// Add a cell's widget right-aligned (counts, dates) or left-aligned (names), vertically centred.
-fn aligned<R>(ui: &mut egui::Ui, right: bool, add: impl FnOnce(&mut egui::Ui) -> R) -> R {
-    let layout = if right { egui::Layout::right_to_left(egui::Align::Center) } else { egui::Layout::left_to_right(egui::Align::Center) };
-    ui.with_layout(layout, add).inner
-}
-
-fn row_height(ui: &egui::Ui) -> f32 {
-    ui.text_style_height(&egui::TextStyle::Body) + 6.0
-}
-
-/// One contributor's table cells after the name, in `SortKey::ALL` order.
-fn cells(c: &Contributor) -> [String; 9] {
-    [
-        group(c.prs),
-        group(c.commits),
-        group(c.lines_added),
-        group(c.lines_deleted),
-        signed(c.lines_delta()),
-        group(c.binary_added),
-        group(c.binary_deleted),
-        day(c.first_commit).to_string(),
-        day(c.last_commit).to_string(),
-    ]
-}
-
-/// A contributor-table header. The sorted column is highlighted; its direction shows on the
-/// toolbar's sort-order button, so no arrow widens the column.
-fn header_text(k: SortKey) -> RichText {
-    RichText::new(crate::i18n::t(k.label().1)).strong()
-}
-
 fn table(ui: &mut egui::Ui, list: &[&Contributor], v: &mut View) {
-    let h = row_height(ui);
-    let rows: Vec<[String; 9]> = list.iter().map(|c| cells(c)).collect();
-    let widths: Vec<f32> = SortKey::ALL
-        .iter()
-        .enumerate()
-        .map(|(i, &k)| match i.checked_sub(1) {
-            None => natural(ui, header_text(k), list.iter().map(|c| c.name(v.names))),
-            Some(col) => natural(ui, header_text(k), rows.iter().filter_map(|r| r.get(col).cloned())),
-        })
-        .collect();
-    fitted_table(ui, "credits_table", &widths, &CONTRIBUTOR_GROW)
-        .header(h + 4.0, |mut header| {
-            for k in SortKey::ALL {
-                header.col(|ui| {
-                    let r = aligned(ui, k != SortKey::Name, |ui| ui.selectable_label(v.key == k, header_text(k)))
-                        .on_hover_text(crate::i18n::t(k.label().0));
-
-                    if r.clicked() {
-                        if v.key == k {
-                            v.ascending = !v.ascending;
-                        } else {
-                            v.key = k;
-                            v.ascending = k.default_ascending();
-                        }
-                    }
-                });
+    egui::Grid::new("credits_table").striped(true).num_columns(SortKey::ALL.len()).show(ui, |ui| {
+        for k in SortKey::ALL {
+            let arrow = if v.key == k { if v.ascending { " ▲" } else { " ▼" } } else { "" };
+            if ui
+                .button(RichText::new(format!("{}{arrow}", crate::i18n::t(k.label().1))).strong())
+                .on_hover_text(crate::i18n::t(k.label().0))
+                .clicked()
+            {
+                if v.key == k {
+                    v.ascending = !v.ascending;
+                } else {
+                    v.key = k;
+                    v.ascending = k.default_ascending();
+                }
             }
-        })
-        .body(|mut body| {
-            for (c, cells) in list.iter().zip(rows) {
-                body.row(h, |mut row| {
-                    row.col(|ui| {
-                        aligned(ui, false, |ui| ui.hyperlink_to(c.name(v.names), format!("https://github.com/{}", c.login)))
-                            .on_hover_text(c.summary());
-                    });
-                    for text in cells {
-                        row.col(|ui| {
-                            aligned(ui, true, |ui| ui.label(text));
-                        });
-                    }
-                });
-            }
-        });
+        }
+        ui.end_row();
+        for c in list {
+            ui.hyperlink_to(c.name(v.names), format!("https://github.com/{}", c.login)).on_hover_text(c.summary());
+            ui.label(group(c.prs));
+            ui.label(group(c.commits));
+            ui.label(group(c.lines_added));
+            ui.label(group(c.lines_deleted));
+            ui.label(signed(c.lines_delta()));
+            ui.label(group(c.binary_added));
+            ui.label(group(c.binary_deleted));
+            ui.label(day(c.first_commit));
+            ui.label(day(c.last_commit));
+            ui.end_row();
+        }
+    });
 }
 
 /// About ▸ Models: AI models credited in Co-Authored-By trailers.
@@ -426,48 +313,22 @@ pub fn models_ui(ui: &mut egui::Ui) {
         return;
     }
     let assisted: u64 = MODELS.iter().map(|m| m.commits).max().unwrap_or(0).max(1);
-    let h = row_height(ui);
-    let titles = ["Company", "Model", "Version", "Commits", "% of all commits", "Lines +/−"];
-    // Company, Model and Version read as text; the counts line up on the right.
-    let right = [false, false, false, true, true, true];
-    let rows: Vec<[String; 6]> = MODELS
-        .iter()
-        .map(|m| {
-            [
-                m.company.to_string(),
-                m.model.to_string(),
-                m.version.to_string(),
-                group(m.commits),
-                format!("{:.0}%", 100.0 * m.commits as f64 / TOTAL_COMMITS.max(assisted) as f64),
-                format!("+{} / −{}", group(m.lines_added), group(m.lines_deleted)),
-            ]
-        })
-        .collect();
-    let widths: Vec<f32> = titles
-        .iter()
-        .enumerate()
-        .map(|(i, title)| natural(ui, RichText::new(crate::i18n::t(title)).strong(), rows.iter().filter_map(|r| r.get(i).cloned())))
-        .collect();
-    egui::ScrollArea::horizontal().id_salt("credits_models").auto_shrink([false, false]).show(ui, |ui| {
-        fitted_table(ui, "credits_models", &widths, &MODEL_GROW)
-            .header(h + 4.0, |mut header| {
-                for (title, r) in titles.into_iter().zip(right) {
-                    header.col(|ui| {
-                        aligned(ui, r, |ui| ui.label(RichText::new(crate::i18n::t(title)).strong()));
-                    });
-                }
-            })
-            .body(|mut body| {
-                for cells in rows {
-                    body.row(h, |mut row| {
-                        for (text, r) in cells.into_iter().zip(right) {
-                            row.col(|ui| {
-                                aligned(ui, r, |ui| ui.label(text));
-                            });
-                        }
-                    });
-                }
-            });
+    egui::ScrollArea::both().auto_shrink([false, false]).show(ui, |ui| {
+        egui::Grid::new("credits_models").striped(true).num_columns(6).show(ui, |ui| {
+            for h in ["Company", "Model", "Version", "Commits", "% of all commits", "Lines +/−"] {
+                ui.label(RichText::new(crate::i18n::t(h)).strong());
+            }
+            ui.end_row();
+            for m in MODELS {
+                ui.label(m.company);
+                ui.label(m.model);
+                ui.label(m.version);
+                ui.label(group(m.commits));
+                ui.label(format!("{:.0}%", 100.0 * m.commits as f64 / TOTAL_COMMITS.max(assisted) as f64));
+                ui.label(format!("+{} / −{}", group(m.lines_added), group(m.lines_deleted)));
+                ui.end_row();
+            }
+        });
     });
 }
 
@@ -547,131 +408,4 @@ mod tests {
         assert_eq!(day("2026-10-07T18:45:23Z"), "2026-10-07");
         assert_eq!(day(""), "—");
     }
-
-    #[test]
-    fn columns_fill_the_room_and_spare_width_goes_to_growing_columns() {
-        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 0.0, 0.0], 300.0), [200.0, 40.0, 60.0]);
-        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 2.0, 0.0], 230.0), [110.0, 60.0, 60.0]);
-        let w = fit_widths(&[123.0, 45.5, 67.25], &[1.0, 0.0, 2.0], 512.0);
-        assert!((w.iter().sum::<f32>() - 512.0).abs() < 0.01, "a fitted table neither scrolls nor leaves a gap: {w:?}");
-    }
-
-    #[test]
-    fn too_little_room_shrinks_only_growing_columns() {
-        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 0.0, 0.0], 150.0), [50.0, 40.0, 60.0]);
-        assert_eq!(fit_widths(&[100.0, 40.0, 60.0], &[1.0, 0.0, 0.0], 0.0), [MIN_COLUMN, 40.0, 60.0]);
-        assert_eq!(fit_widths(&[100.0, 40.0], &[0.0, 0.0], 50.0), [100.0, 40.0]);
-    }
-
-    #[test]
-    fn a_column_at_the_minimum_leaves_the_shortfall_to_the_others() {
-        let w = fit_widths(&[100.0, 300.0, 50.0], &[1.0, 1.0, 0.0], 140.0);
-        assert!((w.iter().sum::<f32>() - 140.0).abs() < 0.01, "the columns still fit the room: {w:?}");
-        assert!(w.iter().all(|c| *c >= MIN_COLUMN), "no column goes below the minimum: {w:?}");
-        assert_eq!(fit_widths(&[100.0, 300.0, 50.0], &[1.0, 1.0, 0.0], 0.0), [MIN_COLUMN, MIN_COLUMN, 50.0]);
-    }
-
-    const WINDOW: f32 = 640.5;
-    const NATURAL: [f32; 3] = [120.0, 80.0, 80.0];
-    const GROW: [f32; 3] = [1.0, 0.0, 0.0];
-
-    /// One frame of a table long enough to scroll; the rects of its header cells.
-    fn table_frame(ctx: &egui::Context, width: f32, natural: &[f32], events: Vec<egui::Event>) -> Vec<egui::Rect> {
-        scrolled_frame(ctx, width, natural, 0.0, events)
-    }
-
-    /// [`table_frame`], scrolled `offset` points sideways.
-    fn scrolled_frame(ctx: &egui::Context, width: f32, natural: &[f32], offset: f32, events: Vec<egui::Event>) -> Vec<egui::Rect> {
-        let screen_rect = Some(egui::Rect::from_min_size(egui::Pos2::ZERO, egui::vec2(width, 300.0)));
-        let raw = egui::RawInput { screen_rect, events, ..Default::default() };
-        let mut cells = Vec::new();
-        let out = ctx.run_ui(raw, |ui| {
-            cells.clear();
-            egui::ScrollArea::horizontal().auto_shrink([false, false]).horizontal_scroll_offset(offset).show(ui, |ui| {
-                fitted_table(ui, "test", natural, &GROW)
-                    .header(20.0, |mut header| {
-                        for _ in natural {
-                            header.col(|ui| cells.push(ui.max_rect()));
-                        }
-                    })
-                    .body(|mut body| {
-                        for _ in 0..40 {
-                            body.row(20.0, |mut row| {
-                                for _ in natural {
-                                    row.col(|ui| {
-                                        ui.label("x");
-                                    });
-                                }
-                            });
-                        }
-                    });
-            });
-        });
-        out.drop_without_applying_deltas();
-        cells
-    }
-
-    /// A new context with the table open and settled, and the rects of its header cells.
-    fn opened_table() -> (egui::Context, Vec<egui::Rect>) {
-        let ctx = egui::Context::default();
-        table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-        let cells = table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-        (ctx, cells)
-    }
-
-    /// Drags a column's right edge, which runs midway through the gap after `cell`, then lets go.
-    fn drag_edge(ctx: &egui::Context, cell: egui::Rect, by: f32) {
-        use egui::{Event, Modifiers, PointerButton};
-        let start = egui::pos2(cell.right() + 4.0, cell.center().y);
-        let halfway = start + egui::vec2(by / 2.0, 0.0);
-        let end = start + egui::vec2(by, 0.0);
-        let moved = Event::PointerMoved;
-        let button = |pos, pressed| Event::PointerButton { pos, button: PointerButton::Primary, pressed, modifiers: Modifiers::NONE };
-        for event in [moved(start), button(start, true), moved(halfway), moved(end), button(end, false)] {
-            table_frame(ctx, WINDOW, &NATURAL, vec![event]);
-        }
-    }
-
-    #[test]
-    fn every_column_can_be_dragged_at_its_right_edge_and_stays_there() {
-        let (_, opened) = opened_table();
-        for (dragged, cell) in opened.iter().enumerate() {
-            let (ctx, _) = opened_table();
-            drag_edge(&ctx, *cell, -30.0);
-            table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-            let after = table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-            for (column, (was, now)) in opened.iter().zip(&after).enumerate() {
-                let want = if column == dragged { was.width() - 30.0 } else { was.width() };
-                assert!((now.width() - want).abs() < 1.0, "dragging column {dragged}: column {column} is {now:?}, was {was:?}");
-            }
-        }
-    }
-
-    #[test]
-    fn a_changed_fit_replaces_the_column_widths() {
-        let (ctx, opened) = opened_table();
-        drag_edge(&ctx, opened[0], -30.0);
-        let longer_name = table_frame(&ctx, WINDOW, &[200.0, 80.0, 80.0], Vec::new());
-        assert!((longer_name[0].width() - opened[0].width()).abs() < 1.0, "a longer name drops a dragged width: {longer_name:?}");
-        let wider = table_frame(&ctx, WINDOW, &[120.0, 200.0, 80.0], Vec::new());
-        let widths: Vec<f32> = wider.iter().map(|c| c.width().round()).collect();
-        assert!(widths.ends_with(&[200.0, 80.0]), "a longer cell widens its column: {widths:?}");
-        assert!(wider[2].right() < WINDOW, "the table still fits the window: {wider:?}");
-        let narrower = table_frame(&ctx, 400.0, &NATURAL, Vec::new());
-        assert!(narrower[2].right() < 400.0, "a narrower window refits the table: {narrower:?}");
-    }
-
-    #[test]
-    fn scrolling_sideways_keeps_dragged_widths() {
-        let (ctx, opened) = opened_table();
-        drag_edge(&ctx, opened[0], 100.0);
-        table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-        let dragged = table_frame(&ctx, WINDOW, &NATURAL, Vec::new());
-        assert!((dragged[0].width() - opened[0].width() - 100.0).abs() < 1.0, "the drag took: {dragged:?}");
-        for offset in [13.3, 27.77, 41.1, 0.6] {
-            scrolled_frame(&ctx, WINDOW, &NATURAL, offset, Vec::new());
-            let scrolled = scrolled_frame(&ctx, WINDOW, &NATURAL, offset, Vec::new());
-            assert!((scrolled[0].width() - dragged[0].width()).abs() < 1.0, "scrolled {offset}: {scrolled:?}");
-        }
-    }
 }

crates/ui-egui/src/dialogs.rs

@@ -325,7 +325,7 @@ fn about(ctx: &egui::Context, open: &mut bool) {
     egui::Window::new(crate::tl!("About CADCraft"))
         .id(egui::Id::unique("About CADCraft"))
         .open(open)
-        .default_size(vec2(820.0, 420.0))
+        .default_size(vec2(640.0, 420.0))
         .collapsible(false)
         .show(ctx, |ui| {
             let mut tab = ui.data_mut(|d| d.get_temp::<u8>(tab_id)).unwrap_or(0);