A project can name /dev/zero, a FIFO or a folder as footage; reading those whole
never ended (or ran out of memory). The media layer's whole-file reads (probe,
pool, model side files) and the engine's FsServices::read_file now open the file,
refuse a non-regular one, and reserve its length fallibly, so a sparse file that
claims more than memory is an error too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
file.import without the flag (scripts, agents, files opened from the command line,
the CLI's templates) turned `lockin_line1.png` into a one-frame image sequence.
ImportOptions.sequence defaults to false in After Effects, so picked and dropped files
now import as stills unless `sequence: true`; folders' numbered runs still import as
sequences, and the Import dialog's Sequence checkbox is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Settings ▸ Project ▸ Project Files ▸ Save Compact Project Files (off by
default) saves .ecproj files as compact JSON: smaller, faster to save and
open. Off, they stay indented, one value per line, so they read and diff
cleanly in version control. XML copies are not affected; auto-saves were
already compact. The project.ecproj inside exported template and Motion
Graphics template packages is written compact.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fill holds every frame as float RGBA, its hole mask and the filled copy until it
finishes, so a long or large range ran out of memory partway through (22-33 % on the
reports). Planning the fill now compares that lower bound with the system's available
memory and refuses with what it needs and how to shorten the range.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Services::full_path now returns None when the working directory can't be
read, instead of the relative path. file.runScript still runs the script
but does not add it to the list, so a later working directory can't make
the entry open a different file.
File > Scripts lists a bundled script even when an installed ScriptUI
panel has the same name, but running it by name opened the panel. A
script now runs before a panel of the same name, and it enters Recent
Script Files.
- Default disk cache size 20 GB (was 100 GB); settings version 3 migrates the stored old
default and keeps a size the user chose.
- The cache keeps max(2 GB, 5% of the disk) free: sysinfo::disk_space (df -Pk / PowerShell
DriveInfo) is read in the background from memory_tick and caps the limit
(DiskCache::set_disk_space); cache.diskStats reports limitBytes.
- Eviction goes down to 90% of the limit, so the LRU sort runs once per tenth of the limit
written instead of on every write at the limit.
- Failed writes are counted (cache.diskStats failed) and the first is logged.
Also fixes#2063.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
effect.cryptomatteAt rendered the effect's input on every call to learn its pixel grid (up
to ~1 s per hover on a 3D precomp). The aux channels and that grid are now kept in a
CryptoProbe on the Session, keyed by the project revision, layer, effect, frame, scale and
render prefs (nested switches, draft shadows). On footage with nothing animated before the
Cryptomatte effect the frame is the source frame, so a still or a held frame keeps one
probe for every comp time. The effect's own Selection doesn't count: the probe never reads
it, so an animated Selection keeps the probe too.
Session::crypto_probe_ready says whether a query answers from the kept probe and changes
nothing. Session::crypto_probe_job builds it on another thread for the viewer; asking for a
job is starting it. Each started job has a generation: it stores its result only while it
is the newest, a newer job or an edit cancels it, and a panic in the build becomes the
probe's error. A cancelled build checks its generation between its stages (reading the IDs,
rendering the effect's input), so it stops early and lets go of what it read. `probeOnly`
makes cryptomatteAt / pickCryptomatte answer {pending} instead of building on the caller.
A pick re-keys the probe (it only edits the Selection), and undo, redo and history jumps
over picks keep it too (each pick is labelled "Pick Cryptomatte"). Any other edit, footage
changes, Open / New and Session::drop_crypto_probe (the eyedropper disarmed) let it go. The
slot's type is crate-private (the Session field stays public, doc(hidden), so other crates
can still build a Session); crypto_probe_stats and crypto_probe_jobs (jobs run, cancelled
ones included) are doc(hidden), for tests.
Found while testing crates/engine/src/cmd/align_data.rs:75 (parse_stamp)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Two names that differ only in case are one file on Windows and on macOS as they
come, and Win32 drops a trailing dot or space, so `clip.png` with `CLIP.png`,
and `a.png` with `a.png.`, still landed on each other: ten entries extracted to
nine files on APFS, one footage item holding the other's picture. Collisions are
now looked up by a key with the case folded and those characters off the end,
while the name written stays as the entry asked.
Found by CodeRabbit on the pull request.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The fallback name was never checked against the names already taken, so an
entry called exactly what the fallback produces took the same file: `media/1/a:b.png`,
`media/2/a_b.png` and `media/3/2-a_b.png` extracted to five files for six
entries, the third overwriting the second, and both items' footage pointing at
it. Deduplication now runs on the name actually written and counts up until it
is free.
The collision predates making the names safe (two entries named `a_b.png` and
`2-a_b.png` collide on their own), but sanitising gives more ways in, so it
belongs with it.
Found by CodeRabbit on the pull request.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Green, Alt (red) over part of the object, then green there again, as the
Layer panel sends them through roto.stroke: the render follows the last
stroke, and Undo / Redo step between the two results.
EffectCraft writes its own templates as `media/<item id>/<file>` entries, and
extraction trusted both halves. `base_name` splits on `/` and `\`, but the item
id was taken with `split('/')` alone, and it is pasted in front of a base name
another item already used. So a second `media/..\..\..\Startup\x/clip.mp4`
entry became `<dir>/..\..\..\Startup\x-clip.mp4`, which on Windows is three
folders up, with the attacker choosing how the name ends.
The id is now used only when it is one, and the name goes through
`safe_file_name`: separators, drive colons and NUL become `_`, and `.` / `..`
become `footage`. Reached from `templates.create` with `path`, from File ▸ New
from Template, and from a template dropped in the user Templates folder.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The CLI installed no logger, so GPU warnings (a declined frame, out of
memory, fallback to the CPU) were dropped and an export silently rendered
on the CPU. Install the engine logger with a `warn` default (RUST_LOG
still overrides). Split out of #1415.
bflatastic