address review: reserved device names, fresh fifo test dir, stat before open in build.rs

crates/engine/src/autosave.rs

@@ -405,11 +405,10 @@ mod native {
     pub fn prune_locks(dir: &Path) {
         let Ok(entries) = std::fs::read_dir(dir) else { return };
         let names: Vec<String> = entries.flatten().take(10_000).map(|e| e.file_name().to_string_lossy().to_string()).collect();
-        // The instances that own autosave files, parsed once rather than once per lock file.
-        let with_files: std::collections::HashSet<&str> = names.iter().filter_map(|f| parse_file_name(f)).map(|(_, i, _)| i).collect();
         for n in &names {
             let Some(instance) = parse_lock_name(n) else { continue };
-            if !with_files.contains(instance) && !owner_alive(dir, instance) {
+            let has_files = names.iter().any(|f| parse_file_name(f).is_some_and(|(_, i, _)| i == instance));
+            if !has_files && !owner_alive(dir, instance) {
                 let _ = std::fs::remove_file(dir.join(n));
             }
         }
@@ -436,22 +435,7 @@ mod native {
         }
         // Create a fresh temporary file exclusively and rename it into place, so a planted
         // `<path>.tmp` symlink in a shared autosave directory cannot redirect the write (CWE-59).
-        // The file holds unsaved work: owner-only from its creation, whatever the umask.
-        crate::atomic_write::write_atomic_with(Path::new(path), private_mode(), |f| f.write_all(&bytes)).map_err(|e| e.to_string())
-    }
-
-    /// Owner read/write only (`None` where file modes don't exist).
-    fn private_mode() -> Option<std::fs::Permissions> {
-        #[cfg(unix)]
-        return Some(std::os::unix::fs::PermissionsExt::from_mode(0o600));
-        #[cfg(not(unix))]
-        None
-    }
-
-    /// Write this app's lock file at `path` without following a link planted there: the file is
-    /// replaced (exclusive temporary file, then rename), never written through (CWE-59).
-    fn write_lock(path: &Path, id: u32) -> std::io::Result<()> {
-        crate::atomic_write::write_atomic_with(path, private_mode(), |f| f.write_all(id.to_string().as_bytes()))
+        crate::atomic_write::write_atomic(Path::new(path), &bytes).map_err(|e| e.to_string())
     }
 
     impl Autosaver {
@@ -602,7 +586,7 @@ mod native {
             for (held, file) in &self.locks {
                 let refreshed = match file {
                     Some(file) => file.set_modified(SystemTime::now()),
-                    None => write_lock(held, id),
+                    None => std::fs::write(held, id.to_string()),
                 };
                 if held == path {
                     current = Some(refreshed);
@@ -611,22 +595,10 @@ mod native {
             if let Some(refreshed) = current {
                 return refreshed;
             }
-            let mut options = OpenOptions::new();
-            options.write(true).create(true).truncate(false);
-            #[cfg(unix)]
-            {
-                use std::os::unix::fs::OpenOptionsExt;
-                // A symlink planted at the lock path must not be opened (and truncated) through,
-                // nor a FIFO wait for a reader.
-                options.custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK).mode(0o600);
-            }
-            let mut file = options.open(path)?;
-            if !file.metadata()?.is_file() {
-                return Err(std::io::Error::new(std::io::ErrorKind::InvalidInput, "the lock file is not a plain file"));
-            }
+            let mut file = OpenOptions::new().write(true).create(true).truncate(false).open(path)?;
             if file.try_lock().is_err() {
                 self.locks.push((path.to_path_buf(), None));
-                return write_lock(path, id);
+                return std::fs::write(path, id.to_string());
             }
             file.set_len(0)?;
             file.write_all(format!("{id}{LOCK_HELD}").as_bytes())?;
@@ -655,30 +627,6 @@ mod native {
             }
         }
     }
-
-    #[cfg(all(test, unix))]
-    mod tests {
-        use super::*;
-
-        /// A symlink planted at the lock path is neither opened through nor written through.
-        #[test]
-        fn lock_writes_do_not_follow_a_planted_link() {
-            let dir = std::env::temp_dir().join(format!("cadcraft-lock-link-{}", std::process::id()));
-            std::fs::create_dir_all(&dir).unwrap();
-            let victim = dir.join("victim.txt");
-            std::fs::write(&victim, b"precious").unwrap();
-            let link = dir.join("1-a.lock");
-            std::os::unix::fs::symlink(&victim, &link).unwrap();
-            let mut a = Autosaver::new("1-a");
-            assert!(a.refresh_lock(&link).is_err());
-            assert_eq!(std::fs::read(&victim).unwrap(), b"precious");
-            write_lock(&link, 42).unwrap();
-            assert_eq!(std::fs::read(&victim).unwrap(), b"precious");
-            assert!(!std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink());
-            assert_eq!(std::fs::read(&link).unwrap(), b"42");
-            std::fs::remove_dir_all(dir).unwrap();
-        }
-    }
 }
 
 #[cfg(test)]

crates/engine/src/cmd/blocks/xref.rs

@@ -34,7 +34,7 @@ pub(super) fn specs() -> Vec<CommandSpec> {
             .noundo(),
         CommandSpec::new("-xref", "External References", run_dash_xref)
             .alias(&["-xr"])
-            .params("{option: \"?\"|bind|detach|path|unload|reload|overlay|attach|type, names?: \"A,B*\" (default *), path? (path, attach, overlay), insert?: bool (bind: Insert type), overlay?: bool (type), at?, scale?, rotation? (attach)}")
+            .params("{option: \"?\"|bind|detach|path|unload|reload|overlay|attach|type, names?: \"A,B*\" (default *), exact?: bool (names are literal xref names, no wildcards or commas), path? (path, attach, overlay), insert?: bool (bind: Insert type), overlay?: bool (type), at?, scale?, rotation? (attach)}")
             .interactive(|_| Ok(Box::new(XrefM::new("-XREF", XStage::Option)))),
         CommandSpec::new("xbind", "Bind...", run_xbind)
             .menu(&["Modify", "Object", "External Reference", "Bind..."])
@@ -192,6 +192,19 @@ fn run_xattach(s: &mut Session, p: &Value) -> Result<Value> {
 
 /// The xrefs a JSON call names (`names`, default all); an error when none match.
 fn named(s: &Session, cmd: &str, p: &Value) -> Result<Vec<String>> {
+    if p.get("exact").and_then(Value::as_bool) == Some(true) {
+        let lits: Vec<&str> = match p.get("names") {
+            Some(Value::Array(a)) => a.iter().filter_map(Value::as_str).collect(),
+            Some(Value::String(t)) => vec![t.as_str()],
+            _ => Vec::new(),
+        };
+        let d = s.doc()?;
+        let names: Vec<String> = xrefs(d).filter(|b| lits.iter().any(|l| l.eq_ignore_ascii_case(&b.name))).map(|b| b.name.clone()).collect();
+        if names.is_empty() {
+            return Err(bad(cmd, format!("no xref named \"{}\"", lits.join(","))));
+        }
+        return Ok(names);
+    }
     let pattern = match p.get("names") {
         Some(Value::Array(a)) => a.iter().filter_map(Value::as_str).collect::<Vec<_>>().join(","),
         Some(Value::String(t)) => t.clone(),

crates/engine/src/cmd/layout/saveas.rs

@@ -26,7 +26,14 @@ const MAX_PURGE_PASSES: usize = 64;
 
 /// The file a SAveas typed at the command line suggests: `<layout>.dwt` beside the drawing.
 pub(super) fn default_path(s: &Session, layout: &str) -> String {
-    let file = format!("{layout}.dwt");
+    // A layout name from a file may hold path separators or `..`; the suggestion is one file name
+    // beside the drawing, so those become `_`.
+    let name: String = layout.chars().map(|c| if matches!(c, '/' | '\\' | ':') || c.is_control() { '_' } else { c }).collect();
+    // Windows reserves device names (`CON`, `NUL`, `COM1`...) with any extension, so prefix them.
+    let base = name.split('.').next().unwrap_or("").trim_end().to_ascii_uppercase();
+    let reserved = matches!(base.as_str(), "CON" | "PRN" | "AUX" | "NUL")
+        || (base.len() == 4 && (base.starts_with("COM") || base.starts_with("LPT")) && base.ends_with(|c: char| ('1'..='9').contains(&c)));
+    let file = if reserved { format!("_{name}.dwt") } else { format!("{name}.dwt") };
     match s.state().ok().and_then(|st| st.path.clone()) {
         Some(p) => std::path::Path::new(&p).with_file_name(&file).to_string_lossy().into_owned(),
         None => file,
@@ -133,3 +140,32 @@ fn store(path: &str, bytes: &[u8]) -> Result<()> {
         super::super::exchange::deliver_file("layout.saveas", path, bytes, super::super::file::deliver())
     }
 }
+
+#[cfg(test)]
+mod default_path_tests {
+    use super::*;
+
+    /// A layout name with separators suggests a file beside the drawing, not a path elsewhere.
+    #[test]
+    fn layout_name_is_one_file_name() {
+        let s = Session::empty();
+        for name in ["../../etc/x", "a/b", "a\\b", "C:x"] {
+            let p = default_path(&s, name);
+            assert!(!p.contains('/') && !p.contains('\\') && !p.contains(':'), "{p}");
+            assert!(p.ends_with(".dwt"));
+        }
+        assert_eq!(default_path(&s, "Layout1"), "Layout1.dwt");
+    }
+
+    /// Windows device names are prefixed so the suggestion is never a device.
+    #[test]
+    fn reserved_device_names_are_prefixed() {
+        let s = Session::empty();
+        for name in ["CON", "nul", "Com1", "LPT9", "aux.x"] {
+            assert_eq!(default_path(&s, name), format!("_{name}.dwt"));
+        }
+        for name in ["COM0", "CONSOLE", "COM10"] {
+            assert_eq!(default_path(&s, name), format!("{name}.dwt"));
+        }
+    }
+}

crates/engine/src/cmd/qselect.rs

@@ -108,8 +108,9 @@ fn property(d: &Drawing, e: &Entity, name: &str) -> Option<Value> {
 
 /// Glob match, case-insensitive: `*` any run, `?` one character, `#` one digit.
 pub fn wildcard(pat: &str, text: &str) -> bool {
-    let p: Vec<char> = pat.to_lowercase().chars().take(1024).collect();
-    let t: Vec<char> = text.to_lowercase().chars().take(4096).collect();
+    // Only the characters that can match are lower-cased, so a huge text isn't copied whole.
+    let p: Vec<char> = pat.chars().take(1024).flat_map(char::to_lowercase).collect();
+    let t: Vec<char> = text.chars().take(4096).flat_map(char::to_lowercase).collect();
     // Iterative matcher with single back-track point (linear-ish, no recursion).
     let (mut pi, mut ti) = (0usize, 0usize);
     let mut star: Option<(usize, usize)> = None;

crates/engine/src/lisp/builtins/files.rs

@@ -27,7 +27,8 @@ pub(super) fn open(ctx: &mut Ctx<'_>, a: Vec<Value>) -> Result<Flow, LispError>
     if !writing {
         match read_text_file(&path) {
             Some(t) => {
-                charge_bytes(t.len())?;
+                // The lines are separate Strings: their headers cost memory the text length hides.
+                charge_bytes(t.len().saturating_add(t.lines().count().saturating_mul(std::mem::size_of::<String>())))?;
                 f.lines = t.lines().map(str::to_string).collect();
             }
             None => return Ok(Flow::Value(Value::Nil)),
@@ -100,8 +101,19 @@ fn can_write(_path: &str) -> bool {
 #[cfg(not(target_arch = "wasm32"))]
 fn write_text_file(path: &str, text: &str, append: bool) {
     use std::io::Write;
-    let f = std::fs::OpenOptions::new().create(true).write(true).append(append).truncate(!append).open(path);
-    if let Ok(mut f) = f {
+    // Opened without blocking and without truncating, so a FIFO with no reader fails at once
+    // instead of stalling the interpreter; only a regular file is then truncated and written.
+    let mut o = std::fs::OpenOptions::new();
+    o.create(true).write(true).append(append);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        o.custom_flags(libc::O_NONBLOCK);
+    }
+    if let Ok(mut f) = o.open(path)
+        && f.metadata().is_ok_and(|m| m.is_file())
+        && (append || f.set_len(0).is_ok())
+    {
         let _ = f.write_all(text.as_bytes());
     }
 }
@@ -118,3 +130,29 @@ fn file_exists(path: &str) -> bool {
 fn file_exists(_path: &str) -> bool {
     false
 }
+
+#[cfg(all(test, unix))]
+mod tests {
+    use super::*;
+
+    /// Writing to a FIFO with no reader returns at once, and a regular file is still replaced.
+    #[test]
+    fn write_to_a_fifo_without_a_reader_does_not_block() {
+        // A fresh directory: `create_dir` fails if the name exists, so no stale pipe or planted symlink is reused.
+        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+        let dir = std::env::temp_dir().join(format!("cadcraft-lispfifo-{}-{nanos}", std::process::id()));
+        std::fs::create_dir(&dir).unwrap();
+        let fifo = dir.join("pipe");
+        assert!(std::process::Command::new("mkfifo").arg(&fifo).status().unwrap().success());
+        let started = std::time::Instant::now();
+        write_text_file(fifo.to_str().unwrap(), "x", false);
+        assert!(started.elapsed() < std::time::Duration::from_secs(5));
+        let f = dir.join("f.txt");
+        std::fs::write(&f, "long old text").unwrap();
+        write_text_file(f.to_str().unwrap(), "new", false);
+        assert_eq!(std::fs::read_to_string(&f).unwrap(), "new");
+        write_text_file(f.to_str().unwrap(), "+", true);
+        assert_eq!(std::fs::read_to_string(&f).unwrap(), "new+");
+        std::fs::remove_dir_all(&dir).ok();
+    }
+}

crates/engine/tests/xref.rs

@@ -189,6 +189,11 @@ fn reload_unload_path_and_detach() {
     assert_eq!(objects(&s, "site"), 3, "reload reads the file again");
     assert!(s.doc().unwrap().layer("site|Walls").unwrap().frozen);
 
+    // `exact`: a name is literal, so `#` or `*` in it doesn't reach other xrefs.
+    assert!(s.execute("-xref", &json!({ "option": "reload", "names": "s#te", "exact": true })).is_err());
+    assert!(s.execute("-xref", &json!({ "option": "reload", "names": "*", "exact": true })).is_err());
+    s.execute("-xref", &json!({ "option": "reload", "names": "SITE", "exact": true })).unwrap();
+
     s.execute("-xref", &json!({ "option": "unload", "names": "site" })).unwrap();
     assert_eq!((status(&s, "site"), objects(&s, "site")), (Some(XrefStatus::Unloaded), 0));
     assert!(s.doc().unwrap().block("site|Tree").is_none());

crates/fonts/build.rs

@@ -43,13 +43,16 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
     rerun_if_changed(&manifest)?;
     // Resolve the checkout root once so every manifest file can be confined inside it.
     let root = dir.canonicalize().map_err(|e| format!("{}: {e}", dir.display()))?;
-    let text = std::fs::read_to_string(&manifest).map_err(|e| format!("{}: {e}", manifest.display()))?;
+    // The manifest itself is confined too (a symlink in the checkout can't point it elsewhere), must
+    // be a regular file, and is read through a limit so `/dev/zero` can't fill memory.
+    let text = read_manifest(&resolve_font(&root, "fonts/manifest.txt")?)?;
     let wasm = std::env::var("CARGO_CFG_TARGET_ARCH").is_ok_and(|a| a == "wasm32");
     let mut out = String::new();
-    for line in text.lines().map(str::trim).filter(|l| !l.is_empty() && !l.starts_with('#')) {
+    for (n, line) in text.lines().enumerate().map(|(n, l)| (n + 1, l.trim())).filter(|(_, l)| !l.is_empty() && !l.starts_with('#')) {
         let f: Vec<&str> = line.split(" | ").map(str::trim).collect();
+        // The line's text is not repeated: it comes from the checkout and goes to the build output.
         let [family, style, file, scripts, ..] = f.as_slice() else {
-            return Err(format!("malformed manifest line: {line}"));
+            return Err(format!("malformed manifest line {n}"));
         };
         if BARRED_FAMILIES.iter().any(|barred| family.starts_with(barred)) {
             println!("cargo::warning=craft-fonts: not embedding {family} {style} (AGENTS.md: no Adobe fonts)");
@@ -73,6 +76,28 @@ fn craft_fonts(dir: &std::path::Path) -> Result<String, String> {
     Ok(out)
 }
 
+/// The most a manifest may hold; the real one is a few KiB.
+const MAX_MANIFEST_BYTES: u64 = 1 << 20;
+
+/// Read the regular file `path` as text, at most [`MAX_MANIFEST_BYTES`].
+fn read_manifest(path: &std::path::Path) -> Result<String, String> {
+    use std::io::Read as _;
+    // stat never blocks, but opening a FIFO with no writer does, so refuse non-regular files first.
+    if !std::fs::metadata(path).is_ok_and(|m| m.is_file()) {
+        return Err(format!("{}: not a regular file", path.display()));
+    }
+    let file = std::fs::File::open(path).map_err(|e| format!("{}: {e}", path.display()))?;
+    if !file.metadata().is_ok_and(|m| m.is_file()) {
+        return Err(format!("{}: not a regular file", path.display()));
+    }
+    let mut text = String::new();
+    file.take(MAX_MANIFEST_BYTES + 1).read_to_string(&mut text).map_err(|e| format!("{}: {e}", path.display()))?;
+    if text.len() as u64 > MAX_MANIFEST_BYTES {
+        return Err(format!("{}: larger than {MAX_MANIFEST_BYTES} bytes", path.display()));
+    }
+    Ok(text)
+}
+
 /// Resolve a manifest `file` field to a real path *confined to the checkout* `root` (CWE-22).
 ///
 /// The field is rejected if it is absolute or contains a parent (`..`) component, and the

crates/render/src/blocks.rs

@@ -56,15 +56,13 @@ pub(crate) fn insert(b: &mut Builder, ctx: &Ctx, e: &Entity, ins: &cadcraft_doc:
                 let m = Mat3::translate(off).then_before(ins.transform(blk.base.xy()));
                 let sub = Ctx { block_pstyle: b.named, block_transparency: b.transparency, ..sub_ctx(ctx, e, m) };
                 for be in blk.entities.iter() {
-                    // Every visit is charged, drawn or not, so a block of definitions can't make
-                    // the copies loop free.
-                    if !b.expand() {
-                        break 'copies;
-                    }
                     // Constant/visible attribute definitions inside blocks are not drawn; attribs are.
                     if matches!(be.kind, EntityKind::AttDef(_)) {
                         continue;
                     }
+                    if !b.expand() {
+                        break 'copies;
+                    }
                     entity(b, &sub, be);
                 }
             }
@@ -75,17 +73,6 @@ pub(crate) fn insert(b: &mut Builder, ctx: &Ctx, e: &Entity, ins: &cadcraft_doc:
         let attmode = ctx.d.header.i64("ATTMODE", 1);
         // The reference's transparency; each attribute draws with its own.
         let reference = b.transparency;
-        // The block's first definition per tag (without case), built once for all the attributes.
-        let mut defs: std::collections::HashMap<String, &Entity> = std::collections::HashMap::new();
-        if !ins.attribs.is_empty()
-            && let Some(blk) = ctx.d.block(&ins.block)
-        {
-            for be in blk.entities.iter() {
-                if let EntityKind::AttDef(d) = &be.kind {
-                    defs.entry(d.tag.to_ascii_lowercase()).or_insert(be.as_ref());
-                }
-            }
-        }
         for a in &ins.attribs {
             if attmode == 0 || (a.invisible && attmode != 2) {
                 continue;
@@ -96,7 +83,7 @@ pub(crate) fn insert(b: &mut Builder, ctx: &Ctx, e: &Entity, ins: &cadcraft_doc:
             // Properties of the attribute's definition (as AutoCAD copies them to the attribute
             // on insertion), except those set on the attribute itself: ByBlock = the reference's,
             // layer 0 = the reference's layer.
-            let def = defs.get(&a.tag.to_ascii_lowercase()).copied();
+            let def = ctx.d.block(&ins.block).and_then(|blk| blk.entities.iter().find(|be| attdef_tag(be, &a.tag)));
             let (ink, lw, shown, t) = match (def, a.props.is_empty()) {
                 (None, true) => (rgb, resolve(ctx, e, b.plotting).1, true, reference),
                 (def, _) => {
@@ -130,3 +117,8 @@ fn by_block() -> cadcraft_doc::Common {
         ..cadcraft_doc::Common::default()
     }
 }
+
+/// The attribute definition with tag `tag` (any case).
+fn attdef_tag(e: &Entity, tag: &str) -> bool {
+    matches!(&e.kind, EntityKind::AttDef(d) if d.tag.eq_ignore_ascii_case(tag))
+}

crates/render/src/outline.rs

@@ -106,12 +106,10 @@ fn chain(mut segs: Vec<(Vec2, Vec2)>) -> Vec<Vec<Vec2>> {
         }
     }
     segs.sort_unstable_by(|(a, b), (c, d)| cmp(*a, *c).then_with(|| cmp(*b, *d)));
-    // Segments at each vertex with a cursor past the used ones, so many segments meeting at one
-    // vertex are each examined once rather than from the start on every visit.
-    let mut at: HashMap<Key, (Vec<usize>, usize)> = HashMap::new();
+    let mut at: HashMap<Key, Vec<usize>> = HashMap::new();
     for (i, (a, b)) in segs.iter().enumerate() {
-        at.entry(key(*a)).or_default().0.push(i);
-        at.entry(key(*b)).or_default().0.push(i);
+        at.entry(key(*a)).or_default().push(i);
+        at.entry(key(*b)).or_default().push(i);
     }
     let mut used = vec![false; segs.len()];
     let mut out = Vec::new();
@@ -127,15 +125,7 @@ fn chain(mut segs: Vec<(Vec2, Vec2)>) -> Vec<Vec<Vec2>> {
         let mut end = b;
         // Each step uses one segment, so the walk ends within `segs.len()` steps.
         loop {
-            let next = at.get_mut(&key(end)).and_then(|(ids, cursor)| {
-                while let Some(&i) = ids.get(*cursor) {
-                    if !used.get(i).copied().unwrap_or(true) {
-                        return Some(i);
-                    }
-                    *cursor += 1;
-                }
-                None
-            });
+            let next = at.get(&key(end)).and_then(|ids| ids.iter().copied().find(|&i| !used.get(i).copied().unwrap_or(true)));
             let Some(i) = next else { break };
             let Some(&(p, q)) = segs.get(i) else { break };
             if let Some(u) = used.get_mut(i) {
@@ -157,20 +147,6 @@ mod tests {
         lines.iter().flat_map(|l| l.windows(2).map(|w| w[0].dist(w[1]))).sum()
     }
 
-    /// Thousands of lobes meeting at one vertex chain in one pass over that vertex's segments.
-    #[test]
-    fn many_lobes_at_one_vertex_chain_quickly() {
-        let mut tris = Vec::new();
-        for i in 0..20_000 {
-            let x = f64::from(i + 1);
-            tris.extend_from_slice(&[Vec2::ZERO, Vec2::new(x, 1.0), Vec2::new(x + 0.5, 2.0)]);
-        }
-        // No wall-clock bound (flaky on loaded runners): a quadratic scan would make this test crawl
-        // rather than fail, so check the output is complete instead.
-        let lines = fill_outlines(&tris);
-        assert_eq!(lines.iter().map(|l| l.len() - 1).sum::<usize>(), 60_000, "every triangle edge is emitted once");
-    }
-
     #[test]
     fn a_square_of_two_triangles_is_one_loop() {
         let (a, b, c, d) = (Vec2::new(0.0, 0.0), Vec2::new(2.0, 0.0), Vec2::new(2.0, 1.0), Vec2::new(0.0, 1.0));

crates/render/src/wide.rs

@@ -95,9 +95,7 @@ pub fn dashed(p: &LwPolyline, tol: f64, lt: &Linetype, scale: f64, min_pattern:
                 continue;
             }
             let (Some(first), Some(last)) = (at(run, a), at(run, b)) else { continue };
-            // The samples strictly between a and b: `run` is ordered by `s`, so a slice, not a scan.
-            let (lo, hi) = (run.partition_point(|x| x.s <= a), run.partition_point(|x| x.s < b));
-            let inner = run.get(lo..hi.max(lo)).unwrap_or_default().iter().copied();
+            let inner = run.iter().filter(|x| x.s > a && x.s < b).copied();
             let pts: Vec<Sample> = std::iter::once(first).chain(inner).chain(std::iter::once(last)).collect();
             for w in pts.windows(2) {
                 if let [x, y] = w {

crates/ui-egui/src/i18n/tests.rs

@@ -160,12 +160,14 @@ fn missing_marked_ui_literals(language: &str) -> BTreeSet<String> {
 /// Every `.rs` file under `dir`, at any depth, so code split into submodules stays scanned.
 fn module_files(dir: &std::path::Path, files: &mut Vec<std::path::PathBuf>) {
     let Ok(entries) = std::fs::read_dir(dir) else { return };
-    let mut paths: Vec<_> = entries.flatten().map(|e| e.path()).collect();
-    paths.sort();
-    for path in paths {
-        if path.is_dir() {
+    // `file_type` doesn't follow links, so a symlink (a directory alias or a file) is skipped,
+    // not walked again as a new subtree.
+    let mut paths: Vec<_> = entries.flatten().filter_map(|e| Some((e.path(), e.file_type().ok()?))).collect();
+    paths.sort_by(|a, b| a.0.cmp(&b.0));
+    for (path, kind) in paths {
+        if kind.is_dir() {
             module_files(&path, files);
-        } else if path.extension().is_some_and(|x| x == "rs") {
+        } else if kind.is_file() && path.extension().is_some_and(|x| x == "rs") {
             files.push(path);
         }
     }

crates/ui-egui/src/xrefs.rs

@@ -192,7 +192,7 @@ pub fn section(app: &mut CadApp, ui: &mut egui::Ui) {
 fn details(ui: &mut egui::Ui, r: &Row, path_id: egui::Id, act: &mut Option<Act>) {
     let name = r.name.clone();
     let loaded = r.status == "Loaded" || r.status == "Unreferenced";
-    let op = |option: &str| json!({ "option": option, "names": name });
+    let op = |option: &str| json!({ "option": option, "names": name, "exact": true });
     ui.horizontal_wrapped(|ui| {
         ui.add_space(8.0);
         if ui.button(crate::tl!("Reload")).clicked() {
@@ -216,7 +216,7 @@ fn details(ui: &mut egui::Ui, r: &Row, path_id: egui::Id, act: &mut Option<Act>)
             .on_hover_text(crate::tl!("Make it a block of this drawing, keeping its layer names"))
             .clicked()
         {
-            *act = Some(Act::Run("-xref", json!({ "option": "bind", "names": name, "insert": true })));
+            *act = Some(Act::Run("-xref", json!({ "option": "bind", "names": name, "exact": true, "insert": true })));
         }
         if ui.add_enabled(r.status != "Not Found", egui::Button::new(crate::tl!("Open"))).clicked() {
             *act = Some(Act::Run("xopen", json!({ "name": name })));
@@ -230,7 +230,7 @@ fn details(ui: &mut egui::Ui, r: &Row, path_id: egui::Id, act: &mut Option<Act>)
         let a = ui.radio_value(&mut overlay, false, crate::tl!("Attach")).clicked();
         let o = ui.radio_value(&mut overlay, true, crate::tl!("Overlay")).clicked();
         if (a || o) && overlay != r.overlay {
-            *act = Some(Act::Run("-xref", json!({ "option": "type", "names": name, "overlay": overlay })));
+            *act = Some(Act::Run("-xref", json!({ "option": "type", "names": name, "exact": true, "overlay": overlay })));
         }
     });
     ui.add_space(4.0);
@@ -243,7 +243,7 @@ fn details(ui: &mut egui::Ui, r: &Row, path_id: egui::Id, act: &mut Option<Act>)
         let apply = ui.add_enabled(!text.trim().is_empty() && text != r.path, egui::Button::new(crate::tl!("Apply"))).clicked()
             || (edit.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) && text != r.path);
         if apply {
-            *act = Some(Act::Run("-xref", json!({ "option": "path", "names": name, "path": text.trim() })));
+            *act = Some(Act::Run("-xref", json!({ "option": "path", "names": name, "exact": true, "path": text.trim() })));
             ui.data_mut(|d| d.remove::<String>(path_id));
         } else if text != r.path {
             ui.data_mut(|d| d.insert_temp(path_id, text));

xtask/src/stats.rs

@@ -136,6 +136,18 @@ pub fn run(_root: &Path, exact: bool) -> Result<(), String> {
 mod tests {
     use super::{Counts, count_tests};
 
+    /// A new private directory in the temp folder. It is created, never reused: an existing path
+    /// (planted by another user, or a symlink) makes the test fail instead of redirecting its writes.
+    fn fresh_dir(tag: &str) -> std::path::PathBuf {
+        let nanos = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_nanos());
+        let p = std::env::temp_dir().join(format!("cadcraft-{tag}-{}-{nanos}", std::process::id()));
+        let mut b = std::fs::DirBuilder::new();
+        #[cfg(unix)]
+        std::os::unix::fs::DirBuilderExt::mode(&mut b, 0o700);
+        b.create(&p).unwrap();
+        p
+    }
+
     #[test]
     fn counts_attributes_and_proptest_blocks() {
         let src = "#[test]\nfn a() {}\n// #[test] commented\n    #[test]\nfn b() {}\nproptest! {\n}\n";
@@ -147,8 +159,7 @@ mod tests {
     #[test]
     fn walk_does_not_follow_directory_symlinks() {
         use std::os::unix::fs::symlink;
-        let base = std::env::temp_dir().join(format!("cadcraft-xtask-{}", std::process::id()));
-        let _ = std::fs::remove_dir_all(&base);
+        let base = fresh_dir("xtask");
         let real = base.join("real");
         std::fs::create_dir_all(&real).unwrap();
         std::fs::write(real.join("a.rs"), "fn a() {}\n").unwrap();
@@ -162,8 +173,7 @@ mod tests {
     /// Traversal reports an exhausted entry budget and accepts a tree that exactly fits it.
     #[test]
     fn walk_reports_budget_exhaustion() {
-        let base = std::env::temp_dir().join(format!("cadcraft-stats-budget-{}", std::process::id()));
-        std::fs::create_dir_all(&base).unwrap();
+        let base = fresh_dir("stats-budget");
         std::fs::write(base.join("a.rs"), "fn a() {}\n").unwrap();
         let error = super::walk_inner(&base, &mut Counts::default(), &mut 0).unwrap_err();
         assert!(error.contains("budget exhausted"));