serve_dir stripped '..' and leading slashes but could still be steered
outside the dist folder ('/..//etc/passwd' left '//etc/passwd', which
join treats as absolute); it now keeps only normal path components. Each
connection's thread blocked forever on a silent client and thread creation
failure panicked; reads now time out and a failed spawn drops the
connection. import-cert.sh wrote the signing bundle to a predictable path
that another user could pre-create; mktemp makes it new and private. The
audio probe test trusted a predictable, possibly pre-existing scratch dir
for executables on PATH; it now creates a fresh private one. Ease Presets
looked up each loaded preset name in the whole list (quadratic); a name
set replaces it.
Reconcile main 991904888a and preserve the reviewed lifecycle, IME, rendering and lockfile changes.
Formatting, strict lint, layers, assets and WASM passed. Full CI retained 3,961 passes, 14 baseline-matching GPU failures and 31 ignored executions. The local review commit has explicit approval to retain these documented failures; native/browser acceptance and paired app performance remain open.
Switch the bash packaging scripts from [ to [[ for conditional tests,
give positional parameters descriptive local names, and end the shared
env.sh helpers with an explicit return. No behaviour change: every
comparison is against a literal, and a bare return keeps the last
command's status.
The 0.11.0 macOS release job failed after notarization with 'resvg not found': the shared
release workflow never installed it, and it was only present before via a warm cargo cache.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
makehybrid -hfs gave every file in the image a com.apple.FinderInfo, so the app in the
DMG, and a copy installed from it, failed codesign --verify --strict --deep ("resource
fork, Finder information, or similar detritus not allowed"), though Gatekeeper accepts
it. Build the image as VectorCraft (#1085) and PdfCraft (#823) do now: hdiutil create
-srcfolder with a few tries for CI's "Resource busy", and verify the mounted app with
--strict --deep so the regression can't ship again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The app bundle exported ai.storyteller.effectcraft.document with the
`.pcraft` extension, PhotoCraft's document format. Installing EffectCraft
took `.pcraft` over, and since EffectCraft declared no document types,
neither app was offered for PhotoCraft documents in Finder. EffectCraft's
own projects (.ecproj, .ecprojx) had no file type at all.
- Info.plist: the exported type now tags .ecproj and .ecprojx ("EffectCraft
Project", conforming to public.data and public.content rather than
public.image), and CFBundleDocumentTypes makes EffectCraft their owner.
- Finder double-click, Open With, Dock drops and `open -a EffectCraft
x.ecproj` send a kAEOpenDocuments Apple event that winit 0.30 doesn't
handle. Register it with the audited fmv-macos-events crate that
PhotoCraft and PdfCraft use (it keeps the unsafe Objective-C interop out
of this workspace). Opened paths go through the dropped-file handling, so
a project opens after the unsaved-changes prompt and media is imported. A
quit event closes the window.
- The event that launches the app arrives before the UI draws: the first
frames skip the panels until the fonts are installed, which dropped it.
The paths wait for EffectcraftApp::is_ready().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The DMG opened as a plain Finder window. It now shows the app icon's figure on
the EffectCraft colour, with EffectCraft.app and the Applications link side by
side.
- packaging/macos/dmg/: background.svg (source; text outlined, the figure an
<image> of assets/app-icon) and dmg-layout.DS_Store (Finder view settings:
window, icon size 128, positions, background), written by generate.py on any
OS, byte-for-byte reproducible, with nothing from the machine that ran it.
- package.sh renders the SVG with resvg (1x + 2x) into a HiDPI TIFF at package
time, so no bitmap is committed; release.yml installs resvg 0.48.1 (pinned,
--locked) on the macOS runner. The image is still built with hdiutil
makehybrid.
- The volume name drops the version: the layout finds the background through
an alias that includes the volume name. The DMG file name keeps the version.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dylan M. Taylor