The app bundle exported ai.storyteller.effectcraft.document with the
`.pcraft` extension, PhotoCraft's document format. Installing EffectCraft
took `.pcraft` over, and since EffectCraft declared no document types,
neither app was offered for PhotoCraft documents in Finder. EffectCraft's
own projects (.ecproj, .ecprojx) had no file type at all.
- Info.plist: the exported type now tags .ecproj and .ecprojx ("EffectCraft
Project", conforming to public.data and public.content rather than
public.image), and CFBundleDocumentTypes makes EffectCraft their owner.
- Finder double-click, Open With, Dock drops and `open -a EffectCraft
x.ecproj` send a kAEOpenDocuments Apple event that winit 0.30 doesn't
handle. Register it with the audited fmv-macos-events crate that
PhotoCraft and PdfCraft use (it keeps the unsafe Objective-C interop out
of this workspace). Opened paths go through the dropped-file handling, so
a project opens after the unsaved-changes prompt and media is imported. A
quit event closes the window.
- The event that launches the app arrives before the UI draws: the first
frames skip the panels until the fonts are installed, which dropped it.
The paths wait for EffectcraftApp::is_ready().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A PDF could abort the process through its colour spaces and functions.
An Indexed hival of 10^12 asked an image for a 24 TB palette. A sampled
function's outputs (one per /Range pair) multiplied its table without a
bound, and copies of the table (one per q, one per reference) multiplied
it again. Self-referencing colour spaces and functions overflowed the
stack, a calculator's copy doubled its operand stack, index, idiv and
mod could panic, and f64::clamp panicked on a reversed /Domain or
/Range. Clamp hival to 255, count samples with checked arithmetic (at
most 32 inputs and outputs, 2^24 samples a table), share the samples,
give one function read a budget of nodes and samples, limit nesting to
8 levels and the calculator stack to 100, and clamp with the bounds in
either order.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Wrap remaining hardcoded UI labels and buttons with tr()/tl!() calls
- Add missing Simplified and Traditional Chinese translations
- Add entries to other language catalogs for consistency
- automation / cli autosave restart tests: the MCP instructions embed the
auto-save state as JSON, so a Windows path's backslashes are escaped there;
look for the JSON form of the path.
- ui_gpu: egui_kittest prefers a CPU adapter, which on Windows is WARP on
DirectX 12, where FXC fails to compile the compositor's `pointwise` kernel
("compilation aborted unexpectedly"), so the viewer stayed on the CPU and
the test failed before comparing anything. Build the harness on the adapter
the headless compositor picked (falling back to egui_kittest's choice).
- ui_audio_scrub (#103 test): with a fixed 2 s comp, a machine with many
render threads cached the whole preview before the first step, so the sound
rightly started at once and no silent frame was counted (3 of 24 runs
failed with 8 copies in parallel). Size the comp to four times the frames
playback requests per step, so caching takes at least four steps (0 of 24).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reload Footage (Cmd+Alt+L) updated an item's metadata but left the media
pool's decoded frames and the layer cache in place, so the old image kept
rendering until Edit > Purge. It also replaced the footage with a probe of
the merged document, so a Photoshop layer item lost its layer and its
Retain Layer Sizes bounds.
Reload now re-reads only what the file decides (size, a movie's duration,
streams and frame rate, codec, a data file's text), keeps the layer or
page and the interpretation, finds a Photoshop layer again by name, and
makes the media layer forget the file (FootageSource::forget, which also
drops the EXR aux-channel cache) and clears the layer cache.
Settings > Import > Reload Footage Changed on Disk (on by default): the
desktop app stamps footage files (size + modification time) on a worker
thread every two seconds and when the window comes back to the front, and
reloads what changed. Not an undo step and it doesn't modify the project;
a file still being written is retried on the next check.
footage.reloadChanged runs one check (CLI, MCP, agents).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every pointer move replaces the comp's content identity, so the frame on
screen takes a new cache key at every step while its render is still in
flight; the viewer only ever showed an exact key, so the picture froze on
the last completed frame until the drag ended. While a drag or a property
scrub is running, show the newest frame of the same comp, frame, scale,
view and render options that is ready — a render behind, as After Effects
does — and go back to exact frames when it stops.
The drag preview was a 1 px axis-aligned rectangle for every shape tool,
which read as no preview at all against most comps. Draw the tool's own
path instead (rectangle, rounded rectangle, ellipse, polygon, star), from
the engine's own geometry, filled with the Tools bar's Fill and outlined
in its Stroke, with a caption saying where the shape lands — a mask on
the selected layer, into the selected shape layer, or a new shape layer.
The ghost and the released shape go through one normalisation, so the
drag shows exactly what it commits: Alt (Option) draws from the press
point and Shift squares the box, both live. The drag also starts at the
press point now, not where the 6 px drag threshold was crossed, so the
shape is drawn from where the button went down, as in After Effects.
GIFs went through the still-image path, so an animated GIF came in as a
single frame with zero duration. A GIF with two or more frames is now
probed as a movie: its frame rate is chosen so every per-frame delay is
a whole number of frames (uneven timing is kept exactly), delays of 0
or 1 hundredths count as 10 like in browsers, and the pool decodes the
frame shown at the requested time. A single-frame GIF stays a still.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
decode_stream_within now bounds the output of each stage of a /Filter
chain, not only FlateDecode. RunLength, LZW, ASCIIHex and ASCII85 stop
when their output would pass the limit, a full LZW table takes no more
entries, PNG predictor rows are sized with checked arithmetic and only
allocated when a whole row fits in the data, and CCITT checks
/Rows x row bytes against the limit before allocating.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
file.uninstallScript and script_code joined the name from the request into
Scripts/<name> and handed it to the settings store, so "../.." reached files
outside the settings folder (uninstall deleted them; run-by-name ran them).
Accept only bare file names (and, on Windows, none of its reserved names),
require a .jsx/.js name, and skip refused names in the script list.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
inflate used the unbounded miniz_oxide functions, and File::parse decodes
every object stream eagerly. Use the limit variants (1 GiB per stream, 256 MiB
for object streams, a quarter of that on 32-bit targets) and bound the
truncated-stream salvage buffer too.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The second pass over the interface below the menu bar: the strings that are technical terms or
proper nouns - `Mercury GPU Acceleration (…)`, `8/16/32 bits per channel`, `OCIO (built-in ACES
config)`, `sRGB IEC61966-2.1 (default)`, `Import Photoshop File`, `Current Settings`, the viewer's
channel and Fast Previews items. Each wording was checked against the installed After Effects
26.5.0 Simplified Chinese, the way the menu bar was in #353. Terms Adobe keeps in English
(`Display P3`, `HDTV (Rec. 709)`, `RGB`, `Alpha`, `H.264`, `ProRes`) need no row: a missing row
falls back to the English source, which is the decision.
The text reaches the catalog through the funnels that draw it, so one change each covers every
call site:
- `forms.rs`: field labels, notes, choice items and info bodies, plus `dialogs::modal`'s title -
the modal id stays keyed on the untranslated source, so changing the language cannot move it;
- `settings.rs`: page titles, sections, notes, buttons, setting labels and choice items (the page
table itself is engine data and cannot reach the catalog);
- `comp_settings.rs` (3D renderer), `key_dialogs.rs::combo` (Current Settings and the roving
items), `properties.rs` + `timeline.rs` (the text animator menu), `dialogs.rs` (About links);
- `render_queue.rs`: the Opus bitrate goes through `tr_args`, so the value is substituted after
the lookup - worth calling out, because building the string with `format!` and translating the
result looks up the assembled text and silently stays English (the same trap as the project
settings' GPU label, which this commit also fixes).
30 rows join the Simplified catalog. The same keys join the Traditional one with the English
source as their value: the tests require the two lists to match, and the Traditional wording is
the translator's call.
Tests: `CONVERTED` gains the three engine files whose strings the interface draws
(`prefs.rs`, `viewer.rs`, `commands/viewer_cmds.rs`); each holds no drawn literals, so the literal
scan stays green and the new rows have a source to be "used" from. `cargo test -p
effectcraft-ui-egui --lib i18n`: 16 passed.
LayerCollection.addSolid dropped its fifth argument, so layer.newSolid
fell back to the composition's pixel aspect. The wrapper now passes
pixelAspect through; layer.newSolid already validates it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Text a helper draws for a panel was handed to that helper as a bare literal, so the catalog lookup
never happened and parts of the interface stayed English with a Chinese language chosen:
- the Composition panel's toolbar tooltips - Choose grid and guide options, Toggle Transparency
Grid, Toggle Mask and Shape Path Visibility, Region of Interest, Show Channel and Color
Management Settings, Reset Exposure, Take Snapshot, Show Snapshot (hold);
- the items of its four popups (grid and guides, resolution, magnification, channel) - Grid,
Guides, Rulers, Proportional Grid, 3D Reference Axes, Full, Half, Third, Quarter, Custom...,
Fit, Fit up to 100%, Colorize;
- the solid dialog's "Affect all layers that use this solid" checkbox and its disabled hint
"Only this layer uses this solid.".
`tog` and `popup` now look the label up themselves, so every current and future call site is
covered by one change each; the automation ids and labels stay English, as the rest of the panels
keep them for scripts and tests. `resolution_label` composes its words from the catalog, so the
closed resolution dropdown reads Chinese too, and the viewer's item now reuses the panel's existing
"Title/action safe" row instead of a second spelling of the same concept.
21 rows join the Simplified catalog. The same keys join the Traditional one with the English source
as their value: the tests require the two lists to match, and the Traditional wording is the
translator's call rather than this change's.
Tests: the row-completeness check now also accepts a row that a helper draws (its English source
appears as a literal there), and a new check refuses a bare `Checkbox::new` / `RadioButton::new`
label - the shape that hid the solid dialog, and the one the literal scan cannot see because the
label is the call's second argument.
This also corrects two Simplified rows #398 left wrong (`Channel` read 色版 in a Simplified
catalog, `Motion Blur: {}` read 动态模糊 while the menu catalog's own Motion Blur is 运动模糊).
Cause: clipboard events carry no modifiers, and the Cut and Copy/Paste
mapping read i.modifiers, egui's state after all of the frame's events.
A Shift+Delete with Shift released in the same frame became Ctrl+X (no
deletion), and a Ctrl+X followed in the same frame by Ctrl up and Shift
down became Shift+Delete: the selected items and the layers using them
deleted without the prompt.
Fix: walk the frame's events in order from the modifiers held when it
began (the state the last pass ended with, recorded each pass), so each
Cut, Copy and Paste uses the modifiers at its place in the stream. When
that state isn't known (a pass was skipped), a Cut is never Shift+Delete.
Only Shift alone counts, not Ctrl/Alt+Shift.
Tests: a_cut_is_read_with_the_modifiers_where_it_is_in_the_frame queues
modifier changes and a Cut in one frame (Shift then Cut and Shift up;
Ctrl, Cut, Ctrl up, Shift down; and the mixed orders); the Windows
Shift+Delete helper now sends Shift, Cut and Shift up as one frame. They
fail on the previous mapping and pass now.
Cause: quantize_px rounded with `(v + 0.5) as u32 as f32`. Converting back
from u32 is several instructions in V8's wasm code on x86 (no unsigned
conversion), so quantising a 1080p layer took about 15 ms in the browser:
every 8/16 bpc layer is quantised after its source and every effect, and
the CPU compositor quantises the comp after every layer.
Fix: round_half_up uses floor in wasm (one instruction there) and keeps the
integer conversion elsewhere (x86-64's baseline has no floor instruction,
where floor is slower). The values are the same: both round non-negative
values half up. About 1.5x faster quantising in the browser (15 -> 10 ms
per 1080p layer in a wasm micro-benchmark), unchanged on the desktop.
Tests: color::tests::rounding_forms_agree: both forms agree on 0..=levels
in sixteenths (exact halves included) and on 100 001 products, at 8 and
16 bpc.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Cause: at Half, Third and Quarter resolution (the viewer's Auto resolution
in most windows) every movie frame was converted from Y'CbCr to f32 RGBA at
full size and then resampled down. In the browser (wasm, one thread) that
was about 8 ms converting a 1080p frame, 6 ms resampling it and 2 ms
zeroing a 33 MB buffer, per layer and frame, for a frame shown at a
quarter or a ninth of its pixels; the footage frame cache held the
full-size frames.
Fix: FootageSource::frame_at_size asks for a frame shown at a given size
(default: the full frame, as before). The renderer asks for it where it
resampled footage (below 3/4 scale; not for proxies, fields or Interpret
Footage's pixel options, which need the full frame). MediaPool makes opaque
4:2:0 movie frames of the footage's own size there: it box-filters them to
half size in Y'CbCr before converting (each 2x2 block of luma, and the
[1 6 1]/8 neighbourhood of its chroma sample, which is the mean of the
upsampled chroma its pixels get), resamples the rest of the way and caches
the result per size. Conversion is linear until colours clip, so this is
the RGB box filter resample starts with, except in blocks where some
colours clip. Other frames convert at full size and resample as before.
In the browser the conversion and resampling take about 4 ms instead of
16. Docs (architecture).
Tests:
- convert::scaled_conversion_matches_resampling_the_converted_frame: half,
third, quarter and odd sizes of an unclipped 4:2:0 frame are within 1e-5
of resampling the converted frame; larger sizes, odd frame sizes and
4:4:4 convert at full size.
- tests_footage_size::reduced_renders_take_footage_resampled_by_the_source:
a source that resamples frames itself renders the same frames as one
that doesn't, at 8 and 32 bpc and every resolution, and is asked only
below 3/4 scale, and not with Invert Alpha.
- footage::h264_frames_at_reduced_sizes (ffmpeg fixture): 1080p H.264
testsrc2 frames, whose saturated colours clip, at 960x540, 640x360,
480x270 and 323x182 are 58-62 dB from the resampled full frames, and
are cached per size.
- convert's ignored 1080p bench also times the conversion at a third.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Cause: the browser build kept the desktop's cache budgets (1 GB layer
cache, 1 GB footage frame cache) inside the page's memory, which wasm32
caps at 4 GiB. FilmCraft's decoders keep up to 384 MB of decoded frames
per open movie beside them, so a comp of eight stacked 1080p H.264 clips
grew the page by about 55 MB/s while playing and ran it out of memory
after about 50 s ("unreachable": a failed allocation).
Fix: in the browser Prefs::cache_budgets keeps the Layer Cache within
512 MB and the Footage Frame Cache within 256 MB (WEB_LAYER_CACHE,
WEB_MEDIA_CACHE); smaller settings and the desktop are unchanged, and
the RAM preview keeps its budget. Docs (web, preferences) say so.
Tests: tests_m145::web_cache_budgets_leave_room_for_the_decoders: with
4 GB settings the web budgets are the caps, the desktop's are the
settings, and smaller settings stay as they are.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
With the Project panel focused, Delete Project Items Without Confirmation
runs project.delete on the selection: items compositions use go without
the prompt, with their layers, in one undo step. In the other panels it
does nothing, and like every shortcut it doesn't fire while typing or
with a dialog open.
On Windows the windowing layer sends Shift+Delete as Cut (the old Cut
key), which was mapped to Ctrl+X: in the Project panel, which has no
clipboard, a Cut with only Shift held is Shift+Delete now. Elsewhere it
still cuts.
Tests (ui_project_delete): Shift+Delete as a key and as Windows' Cut
deletes a comp, a solid in use, footage and a folder without the prompt
and one undo restores them; a multi-selection with a folder holding a
solid in use goes together; an empty selection deletes nothing; the next
Delete still asks after Shift+Delete or an answered prompt; it does
nothing in the Composition panel, while renaming or with a dialog open;
Shift+Backspace, Alt/Ctrl+Delete and Ctrl/Alt+Shift+Delete don't delete.
The deleting tests fail without this change.
The prompt's Delete set a flag that let the next project.delete skip the
prompt. It now runs project.delete directly (delete_items::delete_confirmed),
so the confirmation goes with that request and can't carry over to a later
deletion. Shift+Delete uses the same path.
A frontend command (project.deleteWithoutConfirmation) so the shortcut is
listed and rebindable in Keyboard Shortcuts and runs by id over the
control channel and MCP. The UI runs project.delete for it.
Translate the 396 current panel catalog rows and route Ukrainian Reveal
labels for Finder, Explorer and File Manager. Enforce catalog parity,
placeholder preservation and platform label coverage; update language docs.
Use a fixed-size OCIO row iterator to satisfy the current Clippy gate.
Co-authored-by: Codex <noreply@openai.com>
Convert Position values and spatial tangents into the new parent space.
Preserve supported static Orientation and Scale in constant uniform
parent spaces, and convert spatial Position ease speeds for uniform
transforms. Retain the compensation and Undo/Redo regressions.
Refs #348.
Co-authored-by: Codex <codex@openai.com>
ui.rs gets a Japanese table with the same 396 rows as the Simplified and
Traditional Chinese ones, so Japanese now translates the interface below
the menu bar too (it covered the menus only). The shape test keeps the
three tables listing the same source strings; a new test checks that
Japanese reads its own rows and fills values in order. The existing
"no rows yet" check uses Ukrainian instead.
ROADMAP.md and docs/preferences.md say which catalogs have panel rows.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The freeze and quit during a FLAC preview did not reproduce on current
main (Windows 11): a 4-minute stereo and a 10-minute 24-bit 6-channel
96 kHz FLAC played through a RAM preview with a real-time audio pull,
after trimming and zooming, with no stall, no growing queue and memory
bounded by the RAM preview budget; 150 cpal output start/stop cycles
ran clean. Three defects in that path were found and fixed:
- FilmCraft decodes FLAC, MP3, Ogg and AIFF files whole when they are
opened (8 s and 1.4 GB for the 10-minute 6-channel file). MediaPool
opened a file outside its lock, so every caller asking before the
first open finished decoded the whole file too: a preview's frame
workers, audio feeder, conform and waveform threads at once (8 reads
at once: 8 decodes). Each path now opens once; the others wait for it.
- AudioPlayback::start mixed its first 50 ms on the calling (UI)
thread, so the first read of such a file froze the UI for the whole
decode (audio-only previews start the sound right away). All mixing
is on the feeder thread now; the device plays silence until the first
block arrives, and the clock (frames actually played) waits for it.
- Conforming (Settings > Disk > Conformed Audio Folder, on by default)
held the whole conformed track in memory before writing it, sized by
the footage duration from the file's header: a header claiming a
month of audio aborted the app on a failed 995 GB allocation. The
conformed file is now written a chunk at a time, and footage longer
than 24 hours is read from its decoder instead of conformed.
Tests: media concurrent_first_reads_open_a_file_once (8 threads: 8
opens before, 1 now; PoolStats::opened), pool
a_header_claiming_a_month_of_audio_is_not_conformed (aborted before),
ui-egui audio starting_audio_does_not_wait_for_slow_footage (start took
the footage's 2 s before), conformed_flac_audio_reads_back_like_the_
decoder, and the robustness test flac_audio_of_any_shape_reads_in_
device_blocks (2 minutes of 24-bit 6-channel 96 kHz, mono 8 kHz,
11.025 kHz, 192 kHz and 8-channel FLAC read in 1024-frame blocks at
48 kHz through and past the end: level, silence after the end, opened
once). FLAC fixtures come from ffmpeg (skipped without it).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cause: two things kept Arabic out of a layer name on Windows.
- Windows switches the keyboard layout with Alt+Shift. Releasing Shift
before Alt left Alt held alone, and the in-window menu bar (#279)
counted the release as an Alt tap: it took the keyboard focus, the
rename field closed, and the letters typed next were swallowed by the
menu bar. The Project panel's rename field lost them the same way.
- The UI fonts are Inter plus the CJK system fallbacks, so Arabic,
Hebrew, Indic and Thai names that did arrive (pasted, or from a
project) showed as missing-glyph boxes.
Fix:
- An Alt tap only counts when Alt went down with no other modifier
held, so Alt+Shift in either release order is no tap; a plain Alt tap
still focuses the menu bar.
- The UI registers installed system faces for Arabic, Hebrew, Devanagari,
Bengali, Gurmukhi, Gujarati, Tamil, Telugu, Kannada, Malayalam and Thai
after the CJK ones, the same way (native only; the web build has no
system fonts). A face covering several scripts is registered once
(Segoe UI: Arabic and Hebrew; Nirmala UI: every Indic script).
- The text engine's fallback tries each script's plain platform families
(Segoe UI, Nirmala UI, Leelawadee UI, Geeza Pro, Kohinoor, Noto…)
before any covering face, so neither the UI nor a text layer gets a
calligraphic face that merely sorts first.
- The Timeline's rename field registers `timeline.layer.<id>.nameEdit`.
egui 0.36 shapes each run of one face, so Arabic letters join and a word
reads right to left; it has no bidirectional layout, so the words of a
multi-word Arabic name (and mixed Arabic/Latin) still follow each other
left to right.
Tests: ui_inline_edit a_layout_switch_keeps_the_name_field_and_arabic_
names_are_kept (Alt+Shift both ways in the layer rename, Arabic typed and
stored; Hebrew/Devanagari/Thai in the Project panel; a plain Alt tap
still focuses File; failed before: the field closed), theme
installed_script_fallbacks_draw_arabic_hebrew_indic_and_thai_names
(failed before: replacement glyph for Arabic) and
arabic_words_are_joined_and_read_right_to_left, text
other_scripts_fall_back_to_a_plain_system_family and the script
classification.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A same-named file is used only when kind, size, codec, and for moving pictures the rate and duration agree. Symlinks are not followed, and duplicate names are left alone.
Claude