Merge main into #811

.github/dependabot.yml

@@ -0,0 +1,32 @@
+version: 2
+updates:
+  # Maintain Rust / Cargo dependencies
+  - package-ecosystem: "cargo"
+    directories:
+      - "/"
+      - "/plugins"
+    schedule:
+      interval: "daily"
+      time: "06:00"
+      timezone: "America/New_York"
+    # Consolidate updates into a single PR rather than one PR per crate
+    groups:
+      cargo-dependencies:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # Maintain GitHub Actions workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+      time: "06:00"
+      timezone: "America/New_York"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "ci(deps)"

README.md

@@ -10,7 +10,7 @@
 <h1 align="center">FigCraft</h1>
 
 <p align="center">
-  <b>Interface design; an open-source, clean-room reimplementation of Figma, rebuilt in pure Rust.</b><br>
+  <b>Interface design and prototyping: open source, collaborative and built in pure Rust.</b><br>
   Frames, auto layout, components and variants, vector networks, styles, variables and prototypes,<br>
   in a native app that opens instantly and works offline. Open source, and yours.
 </p>
@@ -62,7 +62,7 @@
   <tr>
     <td width="25%" valign="top">
       <h3>🎛️ Familiar by design</h3>
-      The toolbar, layers panel, Design panel, menus and shortcuts sit where your hands expect them. If you know Figma, you already know FigCraft.
+      The toolbar, layers panel, Design panel, menus and shortcuts sit right where your hands expect them.
     </td>
     <td width="25%" valign="top">
       <h3>⚡ Native and fast</h3>
@@ -262,7 +262,7 @@ New contributors and AI agents: start with [`AGENTS.md`](AGENTS.md), then [`docs
 Installers for macOS (universal, signed and notarized), Windows (x64, x86 and arm64), Linux (AppImage, `.deb`, `.rpm`, Flatpak and tarball), FreeBSD and the web are attached to each [GitHub release](https://github.com/storytold/figcraft/releases). Maintainers: [`docs/releasing.md`](docs/releasing.md) explains how releases are built, signed and published.
 
 > [!IMPORTANT]
-> **Status:** FigCraft is in **alpha**: about 49% of the way to replacing Figma for real work, by our own estimate. Nearly all of Figma's main menu is wired ([`docs/parity-checklist.md`](docs/parity-checklist.md)) and the core editor works end to end, but FigCraft opens `.fig` files only best effort, has only a first preview of multiplayer (live sessions hosted from the app or a self-hosted server, with per-person undo and share links to edit or to view; no accounts, teams or cloud yet), runs its own WebAssembly plugins rather than Figma's, and hasn't been checked against real Figma documents. The honest, area-by-area picture is in the [roadmap](ROADMAP.md) and [`docs/target-app-parity.md`](docs/target-app-parity.md). Expect rough edges and please file issues, or tell us what broke on [Discord](https://discord.gg/artcraft).
+> **Status:** FigCraft is in **alpha**: about 49% of the way to replacing proprietary tools for real work, by our own estimate. Nearly all tracked interface design actions in the menu checklist are wired ([`docs/parity-checklist.md`](docs/parity-checklist.md)) and the core editor works end to end, but FigCraft opens `.fig` files only best effort, has only a first preview of multiplayer (live sessions hosted from the app or a self-hosted server, with per-person undo and share links to edit or to view; no accounts, teams or cloud yet), runs its own WebAssembly plugins, and hasn't been checked against real design documents. The honest, area-by-area picture is in the [roadmap](ROADMAP.md) and [`docs/target-app-parity.md`](docs/target-app-parity.md). Expect rough edges and please file issues, or tell us what broke on [Discord](https://discord.gg/artcraft).
 
 ## Privacy and online sharing
 
@@ -348,8 +348,6 @@ ArtCraft Team and are not covered by this license. They may be used only unmodif
 part of this repository and FigCraft, under [`docs/brand/LICENSE-brand.txt`](docs/brand/LICENSE-brand.txt).
 Forks and modified versions must remove them.
 
-<sub>Figma is a trademark of Figma, Inc. FigCraft is an independent, open-source project and is not affiliated with, sponsored by or endorsed by Figma, Inc.; the name is used only to describe the workflows FigCraft is compatible with.</sub>
-
 <p align="center">
   <a href="https://getartcraft.com/"><img alt="ArtCraft" src="https://raw.githubusercontent.com/storytold/vectorcraft/main/docs/brand/artcraft-mark.png" width="28"></a><br>
   <sub>Made by the <a href="https://getartcraft.com/">ArtCraft</a> team and community.</sub>

apps/figcraft/src/args.rs

@@ -2,7 +2,9 @@
 //! [--automation-write-root <dir>]… [files…] [figcraft://join?…]`. An invite link
 //! (what the system passes when a `figcraft://` link is opened) joins that session once the window
 //! is up; everything else that isn't a flag is a file to open, as a path or a `file://` URL (the
-//! Linux desktop entry passes URLs, `%U`, so that it can also hand over invite links).
+//! Linux desktop entry passes URLs, `%U`, so that it can also hand over invite links). Any other
+//! `--flag` is unknown and stops the app at startup (#836): a mistyped root flag must never leave
+//! the app running unconfined. After a bare `--`, every argument is a file.
 
 /// What the app was started with.
 #[derive(Debug, Default, PartialEq, Eq)]
@@ -17,6 +19,8 @@ pub struct Args {
     /// which is refused at startup.
     pub read_roots: Vec<String>,
     pub write_roots: Vec<String>,
+    /// `--flags` the app doesn't know, as given.
+    pub unknown: Vec<String>,
 }
 
 /// An invite link rather than a file (`figcraft:` links, in any case).
@@ -55,6 +59,10 @@ pub fn parse(args: &[String]) -> Args {
     let mut out = Args::default();
     let mut it = args.iter();
     while let Some(a) = it.next() {
+        if a == "--" {
+            out.files.extend(it.by_ref().cloned());
+            break;
+        }
         let (flag, inline) = a.split_once('=').map_or((a.as_str(), None), |(f, v)| (f, Some(v.to_string())));
         let roots = match flag {
             "--automation-read-root" => Some(&mut out.read_roots),
@@ -69,7 +77,9 @@ pub fn parse(args: &[String]) -> Args {
             out.join = Some(a.clone());
         } else if let Some(path) = file_url_path(a) {
             out.files.push(path);
-        } else if !a.starts_with("--") {
+        } else if a.starts_with("--") {
+            out.unknown.push(a.clone());
+        } else {
             out.files.push(a.clone());
         }
     }

apps/figcraft/src/args_tests.rs

@@ -9,7 +9,7 @@ fn args(a: &[&str]) -> Vec<String> {
 #[test]
 fn files_and_the_control_port() {
     assert_eq!(parse(&args(&[])), Args::default());
-    let a = parse(&args(&["--control", "4242", "a.figcraft", "--verbose", "b.svg"]));
+    let a = parse(&args(&["--control", "4242", "a.figcraft", "b.svg"]));
     assert_eq!(a, Args { control: Some(4242), files: args(&["a.figcraft", "b.svg"]), ..Args::default() });
     // A missing or bad port is ignored, not taken as a file.
     assert_eq!(parse(&args(&["--control"])), Args::default());
@@ -26,6 +26,19 @@ fn automation_roots_repeat_and_are_never_files() {
     assert_eq!(parse(&args(&["--automation-write-root"])).write_roots, args(&[""]));
 }
 
+#[test]
+fn unknown_flags_are_refused_never_ignored() {
+    // #836: a mistyped root flag (or one an older release lacks) must stop the app, not start it
+    // unconfined. Both forms, with and without `=`.
+    let a = parse(&args(&["--automation-write-roots", "out", "--automation-write-dir=out", "--verbose", "a.figcraft"]));
+    assert_eq!(a.unknown, args(&["--automation-write-roots", "--automation-write-dir=out", "--verbose"]));
+    assert!(a.write_roots.is_empty());
+    // Single-dash arguments are left as they were (files); after `--` everything is a file.
+    let a = parse(&args(&["--control", "1", "--", "--odd.figcraft", "--automation-write-root=x"]));
+    assert_eq!(a.files, args(&["--odd.figcraft", "--automation-write-root=x"]));
+    assert!(a.unknown.is_empty() && a.write_roots.is_empty());
+}
+
 #[test]
 fn invite_links_join_instead_of_opening() {
     let link = "figcraft://join?host=192.168.1.20:47900&file=abc&token=AbCdEfGhIjKlMnOpQrStUv";

apps/figcraft/src/main.rs

@@ -10,7 +10,8 @@
 //! `--automation-read-root <dir>` / `--automation-write-root <dir>` (each repeatable) confine the
 //! files the window and the control channel read and write (`figcraft_engine::file_access`); the
 //! app's own folders (settings, recovery copies, installed plugins) and opening the files given on
-//! the command line are not. A root that isn't an existing folder stops the app at startup.
+//! the command line are not. A root that isn't an existing folder stops the app at startup, and so
+//! does any flag the app doesn't know (a mistyped root flag must not start the app unconfined).
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 #![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
 
@@ -129,6 +130,12 @@ fn main() -> eframe::Result {
         return Ok(());
     }
     let args = args::parse(&args);
+    if let Some(flag) = args.unknown.first() {
+        eprintln!(
+            "FigCraft: unknown option {flag}\nUsage: figcraft [--control PORT] [--automation-read-root DIR]... [--automation-write-root DIR]... [FILE | figcraft://join?...]..."
+        );
+        std::process::exit(2);
+    }
     let roots = match (
         args.read_roots.is_empty() && args.write_roots.is_empty(),
         figcraft_engine::file_access::Roots::new(&args.read_roots, &args.write_roots),

crates/ui-egui/src/control_roots_tests.rs

@@ -57,6 +57,24 @@ fn a_confined_app_writes_only_inside_its_write_root() {
     assert!(app.session.execute("file.export", &json!({"format": "svg", "path": p("outside/own.svg")})).is_ok());
 }
 
+#[test]
+fn a_confined_app_saves_only_inside_its_write_root() {
+    // #836: saving over the control channel, both as a new file and to the current one.
+    let (mut app, d) = confined_app("save");
+    let p = |rel: &str| d.0.join(rel).to_string_lossy().into_owned();
+    for cmd in ["file.saveAs", "file.save"] {
+        let e = handle(&mut app, "engine.execute", json!({"command": cmd, "params": {"path": p("outside/a.figcraft")}})).unwrap_err();
+        assert!(e.contains("automation path rejected"), "{cmd}: {e}");
+        let e = handle(&mut app, "engine.execute", json!({"command": cmd, "params": {"path": p("out/../outside/b.figcraft")}})).unwrap_err();
+        assert!(e.contains("automation path rejected"), "{cmd}: {e}");
+    }
+    assert_eq!(std::fs::read_dir(d.0.join("outside")).unwrap().count(), 0, "nothing written outside the root");
+    handle(&mut app, "engine.execute", json!({"command": "file.saveAs", "params": {"path": p("out/in.figcraft")}})).unwrap();
+    assert!(d.0.join("out/in.figcraft").is_file());
+    // Saving again goes to the same file, inside the root.
+    handle(&mut app, "engine.execute", json!({"command": "file.save", "params": {}})).unwrap();
+}
+
 #[test]
 fn window_captures_are_written_through_the_roots_or_returned() {
     let (app, d) = confined_app("capture");

docs/control-protocol.md

@@ -71,7 +71,10 @@ and what a person does in the window are held to the same folders. Files are rea
 read or write root and written only inside a write root; anything else is an ordinary error reply
 (`automation path rejected: …`), and recent files outside the roots aren't listed. Paths are
 resolved as `docs/mcp.md` › Confining file access describes. A root that isn't an existing folder
-stops the app before its window opens. Without the flags nothing changes.
+stops the app before its window opens, and so does any option the app doesn't know (a mistyped
+flag such as `--automation-write-roots` exits with `unknown option`, never starts unconfined).
+Without the flags nothing changes. The flags arrived in FigCraft 0.7.0: 0.6.0 and earlier ignore
+them and confine nothing.
 
 Not confined: opening the files given on the command line when the app starts and the documents
 the system hands over (Finder, Open With; saving them later is confined like any write), and the