diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 000000000..2408084cf
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,6 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+ auto_review:
+ # Dependabot bumps are checked by CI; skip CodeRabbit reviews on them.
+ ignore_usernames:
+ - "dependabot[bot]"
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..d39962e1c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,32 @@
+version: 2
+updates:
+ # Maintain Rust / Cargo dependencies
+ - package-ecosystem: "cargo"
+ directories:
+ - "/"
+ - "/plugins"
+ schedule:
+ interval: "daily"
+ time: "06:00"
+ timezone: "America/New_York"
+ # Consolidate updates into a single PR rather than one PR per crate
+ groups:
+ cargo-dependencies:
+ patterns:
+ - "*"
+ commit-message:
+ prefix: "chore(deps)"
+
+ # Maintain GitHub Actions workflows
+ - package-ecosystem: "github-actions"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ time: "06:00"
+ timezone: "America/New_York"
+ groups:
+ actions:
+ patterns:
+ - "*"
+ commit-message:
+ prefix: "ci(deps)"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e613617a1..9700a8e91 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
name: test (ubuntu-latest)
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v7
- name: Install Linux system dependencies (egui/winit/rfd)
run: |
@@ -74,7 +74,7 @@ jobs:
name: wasm32 check
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v7
- uses: dtolnay/rust-toolchain@stable
with:
targets: wasm32-unknown-unknown
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index ca0cd49f6..ff15bfbc4 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -31,6 +31,5 @@ jobs:
# Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
with:
- freebsd-release: "14.3"
run-package-check: true
- craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
+ craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 18392587a..01cb9cd66 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -18,16 +18,6 @@ concurrency:
cancel-in-progress: true
jobs:
- eval:
- runs-on: ubuntu-latest
- timeout-minutes: 15
- steps:
- - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
- - name: nix flake check --no-build
- run: |
- if [ -f flake.nix ]; then
- nix flake check --no-build --all-systems
- else
- echo "No flake.nix present in this repository; skipping check."
- fi
+ nix:
+ # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+ uses: storytold/craft-common-actions/.github/workflows/nix.yml@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 75f7a5fae..dd2aefddb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,8 +24,14 @@ jobs:
with:
app-name: figcraft
app-title: FigCraft
+ # Needs fonts/latin-manifest.txt (Inter): crates/text/build.rs fails a release without it. Only
+ # craft-fonts' pr/latin-presentation-fonts has it; its main has Noto Sans Georgian but no Inter.
+ # Re-pin once one commit has both (storytold/craft-fonts#42).
craft-fonts-ref: 43913056ce82a3fdad0ef69f6b88d1dc922a8104
has-server: true
+ # The browser has no system fonts: without craft-fonts the web build can't draw text (#885).
+ # crates/text/build.rs keeps the web build to Inter.
+ web-craft-fonts: true
version: ${{ inputs.version }}
secrets:
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 1f72aeb7c..96dff6a9e 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -25,6 +25,7 @@ Release builds embed fonts from the optional craft-fonts build input
| Family | Licence | Upstream |
|---|---|---|
| Inter | SIL Open Font License 1.1 | https://github.com/rsms/inter |
+| Archivo | SIL Open Font License 1.1 | [Google Fonts / Archivo](https://github.com/google/fonts/tree/6c70c829f09ea345d3590406693220ea35c6553f/ofl/archivo) |
| Roboto, Montserrat, Lato, Open Sans, Poppins, Nunito Sans, Merriweather, Playfair Display, Source Sans 3, Source Serif 4, Carlito, Caladea | SIL Open Font License 1.1 | Google Fonts / upstream repositories (see craft-fonts) |
| Liberation Sans, Serif, Mono | SIL Open Font License 1.1 | https://github.com/liberationfonts |
| BIZ UDPGothic, BIZ UDMincho, Shippori Mincho, Noto Sans Arabic | SIL Open Font License 1.1 | Google Fonts (see craft-fonts) |
diff --git a/Cargo.lock b/Cargo.lock
index aead39d1f..1d047aa42 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -259,6 +259,7 @@ dependencies = [
"parking_lot",
"percent-encoding",
"windows-sys 0.60.2",
+ "wl-clipboard-rs",
"x11rb",
]
@@ -855,6 +856,11 @@ dependencies = [
"libc",
]
+[[package]]
+name = "craft-docpath"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+
[[package]]
name = "crc32fast"
version = "1.5.2"
@@ -1407,7 +1413,7 @@ checksum = "b97b65636e5b9ef369943878ac74335ba1c55c1cb6adbf1e2c293c624248d693"
[[package]]
name = "figcraft"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"arboard",
"eframe",
@@ -1421,17 +1427,20 @@ dependencies = [
"fmv-macos-events",
"image",
"log",
+ "raw-window-handle",
"rfd",
"serde_json",
"wat",
+ "wayland-client",
"webbrowser",
"windows",
+ "winit",
"winresource",
]
[[package]]
name = "figcraft-cli"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"figcraft-doc",
"figcraft-engine",
@@ -1445,7 +1454,7 @@ dependencies = [
[[package]]
name = "figcraft-collab"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"base64 0.22.1",
"figcraft-color",
@@ -1460,7 +1469,7 @@ dependencies = [
[[package]]
name = "figcraft-collab-net"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"base64 0.22.1",
"figcraft-collab",
@@ -1483,7 +1492,7 @@ dependencies = [
[[package]]
name = "figcraft-color"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"kurbo",
"serde",
@@ -1492,7 +1501,7 @@ dependencies = [
[[package]]
name = "figcraft-doc"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"figcraft-color",
"figcraft-geom",
@@ -1504,9 +1513,10 @@ dependencies = [
[[package]]
name = "figcraft-engine"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"base64 0.22.1",
+ "craft-docpath",
"figcraft-collab",
"figcraft-color",
"figcraft-doc",
@@ -1531,7 +1541,7 @@ dependencies = [
[[package]]
name = "figcraft-format"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"figcraft-doc",
"figcraft-pathops",
@@ -1546,7 +1556,7 @@ dependencies = [
[[package]]
name = "figcraft-geom"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"kurbo",
"serde",
@@ -1554,7 +1564,7 @@ dependencies = [
[[package]]
name = "figcraft-layout"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"figcraft-doc",
"figcraft-geom",
@@ -1562,7 +1572,7 @@ dependencies = [
[[package]]
name = "figcraft-mcp"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"base64 0.22.1",
"figcraft-collab-net",
@@ -1578,7 +1588,7 @@ dependencies = [
[[package]]
name = "figcraft-pathops"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"figcraft-doc",
"figcraft-geom",
@@ -1587,7 +1597,7 @@ dependencies = [
[[package]]
name = "figcraft-pdf"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"figcraft-color",
"figcraft-doc",
@@ -1599,12 +1609,12 @@ dependencies = [
"krilla",
"log",
"thiserror 2.0.21",
- "tiny-skia",
+ "tiny-skia 0.12.0",
]
[[package]]
name = "figcraft-plugin"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"figcraft-color",
"serde",
@@ -1617,7 +1627,7 @@ dependencies = [
[[package]]
name = "figcraft-render"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"crc32fast",
"figcraft-color",
@@ -1630,12 +1640,12 @@ dependencies = [
"moxcms",
"png",
"rayon",
- "tiny-skia",
+ "tiny-skia 0.12.0",
]
[[package]]
name = "figcraft-server"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"crc32fast",
"ctrlc",
@@ -1659,7 +1669,7 @@ dependencies = [
[[package]]
name = "figcraft-svg"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"base64 0.22.1",
"figcraft-color",
@@ -1675,7 +1685,7 @@ dependencies = [
[[package]]
name = "figcraft-text"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"figcraft-doc",
"figcraft-geom",
@@ -1689,7 +1699,7 @@ dependencies = [
[[package]]
name = "figcraft-ui-egui"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"base64 0.22.1",
"egui",
@@ -1714,7 +1724,7 @@ dependencies = [
[[package]]
name = "figcraft-web"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"eframe",
"egui",
@@ -1734,6 +1744,12 @@ version = "0.1.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
[[package]]
name = "flate2"
version = "1.1.10"
@@ -2563,7 +2579,7 @@ dependencies = [
"skrifa 0.42.1",
"smallvec",
"subsetter",
- "tiny-skia-path",
+ "tiny-skia-path 0.12.0",
"xmp-writer",
"yoke",
"zune-jpeg",
@@ -2820,6 +2836,15 @@ version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
[[package]]
name = "num-traits"
version = "0.2.19"
@@ -3204,6 +3229,16 @@ dependencies = [
"pin-project-lite",
]
+[[package]]
+name = "os_pipe"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
[[package]]
name = "parking"
version = "2.2.1"
@@ -3264,6 +3299,17 @@ version = "2.3.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap",
+]
+
[[package]]
name = "phf"
version = "0.13.1"
@@ -3981,6 +4027,17 @@ version = "1.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+[[package]]
+name = "sctk-adwaita"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec"
+dependencies = [
+ "log",
+ "smithay-client-toolkit 0.19.2",
+ "tiny-skia 0.11.4",
+]
+
[[package]]
name = "self_cell"
version = "1.3.0"
@@ -4440,6 +4497,20 @@ dependencies = [
"zune-jpeg",
]
+[[package]]
+name = "tiny-skia"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83d13394d44dae3207b52a326c0c85a8bf87f1541f23b0d143811088497b09ab"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "bytemuck",
+ "cfg-if",
+ "log",
+ "tiny-skia-path 0.11.4",
+]
+
[[package]]
name = "tiny-skia"
version = "0.12.0"
@@ -4452,7 +4523,18 @@ dependencies = [
"cfg-if",
"log",
"png",
- "tiny-skia-path",
+ "tiny-skia-path 0.12.0",
+]
+
+[[package]]
+name = "tiny-skia-path"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c9e7fc0c2e86a30b117d0462aa261b72b7a99b7ebd7deb3a14ceda95c5bdc93"
+dependencies = [
+ "arrayref",
+ "bytemuck",
+ "strict-num",
]
[[package]]
@@ -4574,6 +4656,17 @@ dependencies = [
"once_cell",
]
+[[package]]
+name = "tree_magic_mini"
+version = "3.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8765b90061cba6c22b5831f675da109ae5561588290f9fa2317adab2714d5a6"
+dependencies = [
+ "memchr",
+ "nom",
+ "petgraph",
+]
+
[[package]]
name = "ttf-parser"
version = "0.25.1"
@@ -4730,7 +4823,7 @@ dependencies = [
"skrifa 0.44.0",
"strict-num",
"svgtypes",
- "tiny-skia-path",
+ "tiny-skia-path 0.12.0",
"unicode-bidi",
"unicode-script",
"unicode-vo",
@@ -5683,6 +5776,7 @@ dependencies = [
"raw-window-handle",
"redox_syscall 0.4.1",
"rustix 0.38.44",
+ "sctk-adwaita",
"smithay-client-toolkit 0.19.2",
"smol_str",
"tracing",
@@ -5726,6 +5820,24 @@ version = "0.57.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+[[package]]
+name = "wl-clipboard-rs"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d7888ccd4896447b2d14d3a9350a85df2aeb6f181e2e7a31349d104ac46cac1"
+dependencies = [
+ "libc",
+ "log",
+ "os_pipe",
+ "rustix 1.1.5",
+ "thiserror 2.0.21",
+ "tree_magic_mini",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "wayland-protocols-wlr",
+]
+
[[package]]
name = "write-fonts"
version = "0.48.1"
@@ -5822,7 +5934,7 @@ checksum = "9440ea3e5aeabb0ac63af70daf835274065238cdd0cec83418f417eae38bacee"
[[package]]
name = "xtask"
-version = "0.6.0"
+version = "0.8.0"
dependencies = [
"figcraft-engine",
"serde_json",
diff --git a/Cargo.toml b/Cargo.toml
index 8f125ac3e..1eef32c76 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,7 +6,7 @@ exclude = ["plugins"]
# default-members = ["crates/*", "apps/figcraft", "apps/figcraft-cli", "xtask"]
[workspace.package]
-version = "0.6.0"
+version = "0.8.0"
edition = "2024"
license = "MIT OR Apache-2.0"
rust-version = "1.95"
@@ -32,6 +32,9 @@ figcraft-mcp = { path = "crates/mcp" }
figcraft-collab-net = { path = "crates/collab-net" }
figcraft-plugin = { path = "crates/plugin" }
+# Which paths stored in a document may be followed (craft-libs).
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
+
# foundation
kurbo = { version = "0.13", features = ["serde"] }
thiserror = "2"
diff --git a/NOTICE b/NOTICE
index 9aaba825b..a0baaa279 100644
--- a/NOTICE
+++ b/NOTICE
@@ -20,3 +20,34 @@ licence texts.
Rust crate dependencies keep their own licenses (MIT, Apache-2.0, BSD, ISC, Zlib, OFL for egui's
default fonts, CDLA-Permissive-2.0 for the root certificate list webpki-roots compiles in, and
similar permissive licenses); see each crate's metadata.
+
+Linux Wayland window decorations
+-------------------------------
+sctk-adwaita 0.10.1 (https://github.com/PolyMeilex/sctk-adwaita,
+commit d5f343c45c04d4a026db57f76760819b7325db00) is used by winit on Linux
+for vector window controls. Its title-font features are disabled: no Cantarell
+font is embedded by this dependency and no font file is added to this repo.
+
+sctk-adwaita's MIT licence:
+
+MIT License
+
+Copyright (c) 2022 Bartłomiej Maryńczak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
index 0910bf9e7..63bc739bf 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@
FigCraft
- Interface design; an open-source, clean-room reimplementation of Figma, rebuilt in pure Rust.
+ Interface design and prototyping: open source, collaborative and built in pure Rust.
Frames, auto layout, components and variants, vector networks, styles, variables and prototypes,
in a native app that opens instantly and works offline. Open source, and yours.
@@ -20,6 +20,9 @@
+
+
+
@@ -62,7 +65,7 @@
🎛️ Familiar by design
- The toolbar, layers panel, Design panel, menus and shortcuts sit where your hands expect them. If you know Figma, you already know FigCraft.
+ The toolbar, layers panel, Design panel, menus and shortcuts sit right where your hands expect them.
⚡ Native and fast
@@ -227,8 +230,8 @@ The desktop app also offers a loopback-only control channel (`figcraft --control
- **Its own renderer:** tiny-skia on every core for the canvas and exports, with layer blending, effects and masks; booleans from linesweeper, geometry from kurbo, text from skrifa and HarfRust.
- **Runs in the browser:** the whole engine and UI compile to WebAssembly.
- **Accessible:** screen readers get names, roles, values and states for the tools, layer rows, fields, dropdowns, tabs and menus (AccessKit on desktop), F6 moves the keyboard between the toolbar, layers, canvas and properties (Tab within them, Escape back to the canvas), the system's reduce-motion setting is honoured, and panel text meets WCAG AA contrast in both themes.
-- **Languages:** English, Russian and Turkish (reviewed by native speakers), and Spanish, French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese, Czech and Indonesian drafts, picked in Preferences or taken from the system or browser and switched live; adding a language is one catalog file ([`docs/translating.md`](docs/translating.md)).
-- **Plugins:** sandboxed WebAssembly plugins (a metered, pure-Rust interpreter with a memory cap and no file or network access, in the browser too) that act through the same commands, each run one undo step, within the permissions their manifest asks for. A Rust SDK and two example plugins are in [`plugins/`](plugins); see [`docs/plugins.md`](docs/plugins.md).
+- **Languages:** English, Russian and Turkish (reviewed by native speakers), and Spanish, French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese, Czech, Indonesian and Georgian drafts, picked in Preferences or taken from the system or browser and switched live; adding a language is one catalog file ([`docs/translating.md`](docs/translating.md)).
+- **Plugins:** sandboxed WebAssembly plugins (a metered, pure-Rust interpreter with a memory cap and no file or network access, in the browser too) that act through the same commands, each run one undo step, within the permissions their manifest asks for. A Rust SDK and three example plugins are in [`plugins/`](plugins); see [`docs/plugins.md`](docs/plugins.md).
- **Live sessions (preview):** share the open file from the app (Share ▸ Start sharing: online through a server, or on your local network), give the others the short join code it shows (or the invite link), and edit it together: everyone's changes sync live, with cursors, selections, avatars and follow, and undo takes back only your own changes. Others join from the desktop app (invite links open it) or from the browser build. See [`docs/collab-protocol.md`](docs/collab-protocol.md).
- **A server of your own (preview):** `figcraft-server` keeps a team's files, publishes them from the app (File ▸ Publish to server…, or Share ▸ Online with your server in Preferences) and hands out share links and join codes that let people edit or only view; files survive restarts and apps reconnect where they were. No accounts yet: links are the access. Releases ship it for Linux, and the desktop app joins over `wss://`; [hosting it on a rented Linux server](docs/server.md#deploy-on-a-linux-server) takes a systemd unit and Caddy or nginx (or Docker). See [`docs/server.md`](docs/server.md).
- **Never crashes:** no `unwrap`, `expect` or `panic` in shipped code, enforced by clippy; commands run behind a guard so a bug fails one action, not your session.
@@ -262,7 +265,7 @@ New contributors and AI agents: start with [`AGENTS.md`](AGENTS.md), then [`docs
Installers for macOS (universal, signed and notarized), Windows (x64, x86 and arm64), Linux (AppImage, `.deb`, `.rpm`, Flatpak and tarball), FreeBSD and the web are attached to each [GitHub release](https://github.com/storytold/figcraft/releases). Maintainers: [`docs/releasing.md`](docs/releasing.md) explains how releases are built, signed and published.
> [!IMPORTANT]
-> **Status:** FigCraft is in **alpha**: about 49% of the way to replacing Figma for real work, by our own estimate. Nearly all of Figma's main menu is wired ([`docs/parity-checklist.md`](docs/parity-checklist.md)) and the core editor works end to end, but FigCraft opens `.fig` files only best effort, has only a first preview of multiplayer (live sessions hosted from the app or a self-hosted server, with per-person undo and share links to edit or to view; no accounts, teams or cloud yet), runs its own WebAssembly plugins rather than Figma's, and hasn't been checked against real Figma documents. The honest, area-by-area picture is in the [roadmap](ROADMAP.md) and [`docs/target-app-parity.md`](docs/target-app-parity.md). Expect rough edges and please file issues, or tell us what broke on [Discord](https://discord.gg/artcraft).
+> **Status:** FigCraft is in **alpha**: about 49% of the way to replacing proprietary tools for real work, by our own estimate. Nearly all tracked interface design actions in the menu checklist are wired ([`docs/parity-checklist.md`](docs/parity-checklist.md)) and the core editor works end to end, but FigCraft opens `.fig` files only best effort, has only a first preview of multiplayer (live sessions hosted from the app or a self-hosted server, with per-person undo and share links to edit or to view; no accounts, teams or cloud yet), runs its own WebAssembly plugins, and hasn't been checked against real design documents. The honest, area-by-area picture is in the [roadmap](ROADMAP.md) and [`docs/target-app-parity.md`](docs/target-app-parity.md). Expect rough edges and please file issues, or tell us what broke on [Discord](https://discord.gg/artcraft).
## Privacy and online sharing
@@ -348,8 +351,6 @@ ArtCraft Team and are not covered by this license. They may be used only unmodif
part of this repository and FigCraft, under [`docs/brand/LICENSE-brand.txt`](docs/brand/LICENSE-brand.txt).
Forks and modified versions must remove them.
-Figma is a trademark of Figma, Inc. FigCraft is an independent, open-source project and is not affiliated with, sponsored by or endorsed by Figma, Inc.; the name is used only to describe the workflows FigCraft is compatible with.
-
Made by the ArtCraft team and community.
diff --git a/ROADMAP.md b/ROADMAP.md
index d6159904e..f19153613 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,7 @@
**Stage: alpha** · next: beta, ~26 points and ~162–292 h away (one Opus 5.5 agent; ~33–67 h wall-clock with 5 agents)
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-16 · **Change:** minor (Adobe Fonts found on macOS (#298); bounded canvas pan overscan; community fixes from #478 up and a control-channel fix (#589); bounded canvas pan overscan; Typography spacing icons support scrubbing (#373); font scans skip named pipes; system theme on first run; recent files as cards with thumbnails on the home screen; community fixes: lost images reported on loading (#207), SVG import budgets (#190), Leptos code (#223), full screen (#227), server snapshots readable again (#188), owner-only preferences (#200), ruzstd 0.9.1 (#182), layer cycle repair (#205), batch rollback, Direct3D 12 on Windows, plugin metering (#192); vector edit mode regions: hover hatch, selection and drag; SVG/PDF exports refuse over-depth documents (#208); bounded MCP/control framing, connections and queues (#201); plugin log limits (#191); live-session revert guard (#198); attached MCP no longer replays after a lost reply (#194); repeat command recursion fix; the Layout panel's constrain-proportions link scales the other side, #220; core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; starter templates, a Templates tab and Getting started tips on the home screen; your online files; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages; sharing with a join code; text box sizes measured against documents re-saved by other software; live sessions per document; .fig export checked by opening written files in other software; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; Windows QA pass with eight fixes; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%) · **Target:** Figma Design (desktop app 126.10.7)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-17 · **Change:** minor (Adobe Fonts found on macOS (#298); community batch #753: Selection colors, smart-selection spacing, a Present tab; language table re-measured from the catalogs; community fixes from #524 up (55 PRs: `.fig` import fidelity, paste from other apps, the Actions palette, editor fixes, server limits) and a boolean-op crash guard; number variables in the text content picker (#629); frames and sections convert into each other (#719); bounded canvas pan overscan; community fixes from #478 up and a control-channel fix (#589); bounded canvas pan overscan; Typography spacing icons support scrubbing (#373); font scans skip named pipes; system theme on first run; recent files as cards with thumbnails on the home screen; community fixes: lost images reported on loading (#207), SVG import budgets (#190), Leptos code (#223), full screen (#227), server snapshots readable again (#188), owner-only preferences (#200), ruzstd 0.9.1 (#182), layer cycle repair (#205), batch rollback, Direct3D 12 on Windows, plugin metering (#192); vector edit mode regions: hover hatch, selection and drag; SVG/PDF exports refuse over-depth documents (#208); bounded MCP/control framing, connections and queues (#201); plugin log limits (#191); live-session revert guard (#198); attached MCP no longer replays after a lost reply (#194); repeat command recursion fix; the Layout panel's constrain-proportions link scales the other side, #220; core editor leftovers: component playground, auto gap handles, variables inside styles, inner shadows and background blur on groups, command-made text readable on dark pages, a one-step frame/group convert, delays on mouse triggers and manual overlay offsets, wrapped-line alignment; `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; starter templates, a Templates tab and Getting started tips on the home screen; your online files; everyday editing partials: number fields, outline options, Hide when publishing, cursors, panel widths, dark pages; sharing with a join code; text box sizes measured against documents re-saved by other software; live sessions per document; .fig export checked by opening written files in other software; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; experimental .fig export; keyboard shortcut parity suite and bindings; Simplified Chinese draft catalog; Latin American Spanish overlay; prototyping tail: gamepad triggers, widgets in prototypes, mode lookups; plugin directory on figcraft-server; Japanese and Korean draft catalogs and CJK UI fonts; plugin widgets and the plugin panel tail; French, German and Brazilian Portuguese draft catalogs; cursor chat and spotlight in live sessions; layers and assets panels behaviour suite and fixes; vector multi-edit and edit tail; dev resources links; extended collections tail; branch version history and finer list merges; headline percentages recomputed from the area table: feature breadth ~84%, core ~94%, mainstream ~50%; text lists, hanging punctuation and decoration styles; comments and version history behaviour suite and fixes; canvas navigation, guides and grids behaviour suite and fixes; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; shapes and vector behaviour suite and fixes; paint and effects behaviour suite and fixes; frames, groups, sections and masks behaviour suite and fixes; styles and variables behaviour suite and fixes; prototyping behaviour suite and fixes; components behaviour suite and fixes; embedded image colour profiles; layers panel keyboard: F2 rename, Shift+F10 context menu, keyboard box selection, 10k-layer QA; per-side stroke weight variables; text behaviour suite: CJK line breaking, metrics, vertical trim; selection and transform behaviour suite and fixes; `.fig` import, best effort; Windows QA pass with eight fixes; auto layout behaviour suite and fixes; Display P3: gamut warning and soft-proof (true P3 blocked upstream); several windows; localization layer with a draft Spanish catalog; hosting figcraft-server: wss in the desktop app, server releases, deployment guide; plugin panels and settings; canvas fixes: boolean hit testing on the result, group drags, frame outlines and slices; code connect; stretch and scatter brushes, pen pressure; text on a path and pattern fills; team libraries on the server and swap library; branches: create, update from main, review and merge; animated GIF fills and TIFF images; Open recent, outlines for the selection and mask outlines: menu breadth 100%; extended collections, variables import/export, gradient stop and variant bindings; feature breadth ~80%; ready ~49%) · **Target:** Figma Design (desktop app 126.10.7)
FigCraft is a clean-room, open-source, pure-Rust reimplementation of the Figma design workflow,
native on macOS, Windows, Linux and FreeBSD and in the browser, fully drivable by agents through
@@ -13,7 +13,7 @@ start with [`docs/gaps.md`](docs/gaps.md).
| | Value | Kind |
|---|---|---|
-| Menu/command breadth | **100%** (211 / 211) | measured, [`docs/parity-checklist.md`](docs/parity-checklist.md) (`cargo xtask parity`) |
+| Menu/command breadth | **100%** (212 / 212) | measured, [`docs/parity-checklist.md`](docs/parity-checklist.md) (`cargo xtask parity`) |
| Feature breadth | **~85%** (core editor ~94%) | estimated, [`docs/target-app-parity.md`](docs/target-app-parity.md) |
| Ready for real work | **~53%** | estimated, same doc (written dimension weights and scores) |
| Essentials user | **~59%** | estimated: core features 77.8% × 0.92 launch/stability × 0.94 discoverability × 0.88 opening files people send ([method](docs/target-app-parity.md#essentials-user)) |
@@ -99,25 +99,25 @@ native speakers' reviews of the six language drafts need people.
| Language | Code | Strings | Status |
|---|---|---|---|
| English | en | 100% | full |
-| Simplified Chinese | zh-Hans | 100% | draft (needs native review) |
-| Spanish | es, es-419 | 100% (es-419: an overlay of 98 entries) | draft (needs native review) |
+| Simplified Chinese | zh-Hans | 95% | draft (needs native review) |
+| Spanish | es, es-419 | 100% (es-419: an overlay of 101 entries) | draft (needs native review) |
| Hindi | hi | 0% | none |
| Arabic | ar | 0% | none |
-| French | fr | 100% | draft (needs native review) |
-| Portuguese (Brazil) | pt-BR | 100% | draft (needs native review) |
-| Indonesian | id | 0% | none |
-| Japanese | ja | 100% | draft (needs native review) |
-| German | de | 100% | draft (needs native review) |
-| Korean | ko | 100% | draft (needs native review) |
+| French | fr | 95% | draft (needs native review) |
+| Portuguese (Brazil) | pt-BR | 95% | draft (needs native review) |
+| Indonesian | id | 99% | draft (needs native review) |
+| Japanese | ja | 99% | draft (needs native review) |
+| German | de | 96% | draft (needs native review) |
+| Korean | ko | 95% | draft (needs native review) |
| Vietnamese | vi | 0% | none |
-Also shipped: Swedish (`sv`: every UI string, 120 of 588 command labels and menu wordings; native review welcome). Figma ships English, Japanese, Korean, French, German, Spanish and Portuguese
+Percentages measured 2026-10-17 over 2,272 entries (strings added since a draft show English). Also shipped: Russian (`ru`, 99%, reviewed by VanTan), Swedish (`sv`, 99.6%, command labels since 2026-10-17; native review welcome), Turkish (`tr`, 99%) and Czech (`cs`, 99%, draft). Figma ships English, Japanese, Korean, French, German, Spanish and Portuguese
(Brazil); FigCraft has the localization layer, English and Spanish (Spain and Latin America),
-French, German, Brazilian Portuguese, Japanese, Korean and Simplified Chinese drafts (Preferences ▸
+French, German, Brazilian Portuguese, Japanese, Korean, Simplified Chinese and Indonesian drafts (Preferences ▸
Language; Traditional Chinese has no catalog; CJK UI
text uses an installed CJK font, loaded only when needed; adding a language:
[`docs/translating.md`](docs/translating.md)). Document text in any script (bidi, Arabic shaping,
-IME) already works. Detail: [`docs/localization-parity.md`](docs/localization-parity.md).
+IME) already works (macOS IME composition fixed for #747, not yet checked on a Mac). Detail: [`docs/localization-parity.md`](docs/localization-parity.md).
## Upcoming
@@ -131,6 +131,9 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
## Progress log
+- **2026-10-17** · Control channel while the window is minimised (M8, #720): a minimised or covered window answers every request that acts on the app's state (edits, `ui.inspect`, `ui.pointer`, `ui.key`, `ui.type`, `ui.set`, `app.quit`…) without drawing, and what needs a drawn frame (`ui.screenshot`, `ui.input`, `window.new`) is an error at once; before, those waited up to 60 s and held up every later request on the connection (an attached agent's `inspect_ui` or window screenshot stalled until the window came back). Measured on Windows 11, minimised: requests ~100 ms each (eframe wakes a minimised window at most ten times a second; ~2 ms on screen), a window screenshot fails in ~100 ms instead of 60 s, idle CPU 0. Numbers unchanged.
+- **2026-10-17** · Number variables on text content (M3, #629): the Typography section's variable picker also lists number variables for a text layer's content, as the engine already accepted (the text shows the number, e.g. 42.5, and follows the variable). Other text fields keep their own types. Numbers unchanged.
+- **2026-10-17** · Frames and sections convert into each other (M1, #719): `object.convertToSection` turns a frame on the page or in a section into a section in place (same box, name, fill and layers, which stay where they are; what only a frame has goes: auto layout, clipping, layout grids, guides, scrolling), and `object.convertToFrame` now also turns a section into a frame that keeps its fill and doesn't clip, so the look stays. Nested frames, instances, main components and sections holding sections are refused with the reason; one undo step each. Both are in the canvas context menu (Convert to section / Convert to frame) and in Spanish. Numbers unchanged.
- **2026-10-16** · Adobe Fonts found on macOS (M7, #298): fonts activated through Adobe Fonts rendered in the fallback font without a warning, because Creative Cloud keeps them in its own folder as hidden files named by number, which the font scan never read. The macOS scan now includes `~/Library/Application Support/Adobe/CoreSync/plugins/livetype`, and files without an extension are indexed when they start with a font signature. Fonts are read in place. Regression test in the font database tests; docs/cli.md lists the folder. Numbers unchanged.
- **2026-10-14** · Corner handles win over the corner-radius handles (M1, #292): a press on the inner half of a corner handle's square picked the radius handle 10 px in, so the drag neither resized nor (dragging outward) rounded anything. Inside the drawn square the corner now resizes both sides (in ratio with Shift or the link); further in the radius handle still answers. Regression test in the transform behaviour suite. Numbers unchanged.
- **2026-10-14** · Home screen recent files as cards (M7): each card shows the picture its file carries on its first page's colour, the file's icon, name and "Edited ... ago"; sort by name, creation or last change either way; a table view; a click selects, a double-click or Enter opens, arrow keys move; Open, Show in folder and Remove from recents on right-click. Numbers unchanged.
@@ -314,6 +317,16 @@ Ranked; detail and milestones in [`docs/roadmap.md`](docs/roadmap.md).
| Date | Change | Summary |
|---|---|---|
+| 2026-10-20 | minor | Duplicating a main component makes an instance (#892): Duplicate and Alt-drag copied a main component as a second main; within its file the copy is now an instance of it, as Copy then Paste already was (a variant duplicated in its set stays a variant). Numbers unchanged. |
+| 2026-10-20 | minor | Readable disabled and selected text (#890): the dim text colour (disabled buttons, placeholders, hints) is at least 3:1 against panels, fields and selected rows in both themes (it was 2.1:1 in the light theme), a disabled button is grey with that text instead of fading to 40%, and selected text (renaming a page or layer, any text box) takes the theme's readable green on the highlight (1.4:1 in the dark theme before, now 4.2:1 or more); checked with the colour contrast helper (`theme::tests`). Numbers unchanged |
+| 2026-10-20 | minor | Layer data reads back (#879): `node.get` (the command, the control method and MCP `get_node`) and `document.inspect` report a layer's or page's `pluginData` as `{key: value}` when it has any, so a tool that keeps state in a file with `node.set {props: {pluginData}}` can read it on its next run (`plugin_data_tests`). Numbers unchanged |
+| 2026-10-20 | minor | Measuring while nudging (#894): with Alt held over another layer, the arrows nudge the selection (Shift: the big step) and the distances follow every nudge (Alt+arrows used to do nothing); while measuring, the selection's handles and size label hide and both layers keep their outlines (`measure_nudge_tests`). Numbers unchanged |
+| 2026-10-20 | minor | Release fonts (#885): the web release embeds craft-fonts again (Inter), so the browser version draws text and lists fonts; it had none since releases moved to the shared workflow. The craft-fonts pin goes back to the commit with the Latin manifest (the Georgian change had moved it to one without Inter, which would have failed the next release). Numbers unchanged. |
+| 2026-10-17 | minor | Community batch #753 (10 PRs): Selection colors for mixed selections (#403); smart-selection spacing fields and canvas handles (#402); a Present tab with device and scale controls (#537); adding auto layout to an empty frame keeps its size (#369); `node.set` applies auto layout keys to frames only and warns about font styles a family lacks (#603); canvas images on whole device pixels (#359); Adwaita window controls on Wayland without server decorations (#592, not run on GNOME or KDE by the maintainers); the keyboard shortcuts panel closes on the home screen (#548); macOS paste modifiers in tests (#750); credits column tests (#347). `cargo xtask parity` re-run: 212 / 212 menu items (100%; the catalog gained View ▸ Full screen with #227 on 2026-10-14), 561 commands. Language table re-measured from the catalogs (2,272 entries): the drafts read 95–99% (strings added since 2026-10-12 show English), Indonesian has a draft (99%; it read none), and Russian, Swedish (its command labels from #599), Turkish and Czech are listed with their counts. Per-area parity rows for the day's landings in `docs/gaps.md`, `target-app-parity.md` and the area docs. Numbers unchanged |
+| 2026-10-17 | minor | Control channel while the window is minimised (M8, #720): a minimised or covered window answers every request that acts on the app's state (edits, `ui.inspect`, `ui.pointer`, `ui.key`, `ui.type`, `ui.set`, `app.quit`…) without drawing, and what needs a drawn frame (`ui.screenshot`, `ui.input`, `window.new`) is an error at once; before, those waited up to 60 s and held up every later request on the connection (an attached agent's `inspect_ui` or window screenshot stalled until the window came back). Measured on Windows 11, minimised: requests ~100 ms each (eframe wakes a minimised window at most ten times a second; ~2 ms on screen), a window screenshot fails in ~100 ms instead of 60 s, idle CPU 0. Numbers unchanged. |
+| 2026-10-17 | minor | Community fixes from #524 up (batches #727, #728, #733, #735, #736 and #729; 55 PRs) and a crash guard. `.fig` import: explicit instance identity, overrides by key, text style precedence, grid track sizes, slot content, connector labels, skip ink, paragraph options and hanging lists, list start numbers, vertical trim, per-point stroke joins, text on a path, image adjustments and embedded images; large files open within budgets from the file's own size; an import report after opening; imported bytes stay out of the command journal. Files and paste: save a copy as `.fig`; Cmd/Ctrl+V pastes images copied in other apps and layers copied from another design app (`edit.pasteDesignLayers`); paste over and paste properties; clipboard reads on Linux and the BSDs time out after 2 s. Editor: live font preview on hover; Shift+I and Resources open Assets; Shift-drag moves the selection; thin strokes take a nearby double-click; dropped points merge; Flatten keeps open paths; the Actions palette gets tabs, ranked search, a keyboard highlight and recents; the colour picker opens on a new fill or stroke; text strokes follow their alignment; selection highlights after line breaks; a draggable pages/layers divider; variant properties reorder by drag; submenus keep their hover with a safe triangle; menu actions that need a value ask for it; File ▸ Rename edits the name in place. Engine: bad paint indexes, non-finite geometry and pages in copy/cut are refused; a param naming a layer says so when it isn't one; a CLI script is one undo step and resolves `$step`. Server and collaboration: message limits follow `max_file_mb` (client capped at 1 GiB); a damaged generation field no longer drops flushed edits; the web build joins a session from a `#join=` link. Also Swedish command labels, Nix CI through the shared workflow, paint bounds once per render, and a guard that turns a panic inside the boolean-op library into bad input (the stroke draws unclipped). Numbers unchanged. |
+| 2026-10-17 | minor | Number variables on text content (M3, #629): the Typography section's variable picker also lists number variables for a text layer's content, as the engine already accepted (the text shows the number, e.g. 42.5, and follows the variable). Other text fields keep their own types. Numbers unchanged. |
+| 2026-10-17 | minor | Frames and sections convert into each other (M1, #719): `object.convertToSection` turns a frame on the page or in a section into a section in place (same box, name, fill and layers, which stay where they are; what only a frame has goes: auto layout, clipping, layout grids, guides, scrolling), and `object.convertToFrame` now also turns a section into a frame that keeps its fill and doesn't clip, so the look stays. Nested frames, instances, main components and sections holding sections are refused with the reason; one undo step each. Both are in the canvas context menu (Convert to section / Convert to frame) and in Spanish. Numbers unchanged. |
| 2026-10-16 | minor | Adobe Fonts found on macOS (M7, #298): fonts activated through Adobe Fonts rendered in the fallback font without a warning, because Creative Cloud keeps them in its own folder as hidden files named by number, which the font scan never read. The macOS scan now includes `~/Library/Application Support/Adobe/CoreSync/plugins/livetype`, and files without an extension are indexed when they start with a font signature. Fonts are read in place. Regression test in the font database tests; docs/cli.md lists the folder. Numbers unchanged |
| 2026-10-16 | minor | Community fixes from #478 up (batches #591, #598, #602; 69 PRs) and a control-channel fix: a line that isn't JSON now ends a `--control` connection, so a web page can't drive the app through a browser request (#589). Highlights: page copies keep navigation, flows, prototype settings and guides; Find and Replace keeps line endings and case-insensitive matches; text hyperlinks survive import and export; recent colours record only what was picked; MCP screenshots respect `maxSize`; Swedish catalog (UI strings), Czech plurals; bounded canvas overscan while panning; Korean fallback at the run's weight; many vector-edit, guide, page and .fig round-trip fixes. Numbers unchanged |
| 2026-10-15 | minor | Drop files anywhere to open them (M7): dragging files over the window shows a "Drop to open" (home) or "Drop to import" (canvas) overlay. On the home screen each supported file opens as a document of its own and other files are turned away with a toast; on the canvas the files import at the drop point. Both wait behind a small card that is on screen before a large file blocks the window. A canvas import stays with the document and page that received the drop even if the tab or page changes meanwhile, and is cancelled with a message if that document or page is gone. Numbers unchanged. |
diff --git a/apps/figcraft-cli/src/args.rs b/apps/figcraft-cli/src/args.rs
index 372082c24..4c162dbb5 100644
--- a/apps/figcraft-cli/src/args.rs
+++ b/apps/figcraft-cli/src/args.rs
@@ -1,5 +1,6 @@
//! Minimal std-only argument parsing: positionals, `--key value` / `--key=value` / `-o value`
-//! options, and boolean `--flag`s. Unknown options are usage errors.
+//! options (given again: the last counts, or all with [`Args::values`]), and boolean `--flag`s.
+//! Unknown options are usage errors.
use std::collections::BTreeMap;
@@ -8,7 +9,7 @@ use crate::{CliError, CliResult};
#[derive(Debug, Default)]
pub struct Args {
pub positional: Vec,
- values: BTreeMap,
+ values: BTreeMap>,
flags: Vec,
}
@@ -34,7 +35,7 @@ impl Args {
Some(v) => v,
None => it.next().cloned().ok_or_else(|| CliError::Usage(format!("`{arg}` needs a value")))?,
};
- a.values.insert(name.to_string(), v);
+ a.values.entry(name.to_string()).or_default().push(v);
} else if flags.contains(&name) && inline.is_none() {
a.flags.push(name.to_string());
} else {
@@ -45,7 +46,12 @@ impl Args {
}
pub fn value(&self, k: &str) -> Option {
- self.values.get(k).cloned()
+ self.values.get(k).and_then(|v| v.last()).cloned()
+ }
+
+ /// Every value of an option that may be given more than once, in order.
+ pub fn values(&self, k: &str) -> &[String] {
+ self.values.get(k).map_or(&[], Vec::as_slice)
}
pub fn flag(&self, k: &str) -> bool {
@@ -62,9 +68,9 @@ impl Args {
/// PDF print options: `--bleed LENGTH` (points, or "3mm", "0.125in"), `--crop-marks`,
/// `--bleed-marks`, `--cmyk`.
pub fn print(&self) -> CliResult {
- let bleed = match self.values.get("bleed") {
+ let bleed = match self.value("bleed") {
None => 0.0,
- Some(s) => figcraft_doc::PrintSettings::parse_length(s)
+ Some(s) => figcraft_doc::PrintSettings::parse_length(&s)
.filter(|b| *b <= figcraft_doc::PrintSettings::MAX_BLEED)
.ok_or_else(|| CliError::Usage(format!("--bleed takes points or a length like 3mm or 0.125in (up to 2in), got `{s}`")))?,
};
@@ -72,7 +78,7 @@ impl Args {
}
pub fn scale(&self) -> CliResult {
- match self.values.get("scale") {
+ match self.value("scale") {
None => Ok(1.0),
Some(s) => s
.trim_end_matches('x')
@@ -85,7 +91,7 @@ impl Args {
/// A comma-separated list of whole numbers (`--layers 1000,10_000`).
pub fn usizes(&self, k: &str, default: &[usize]) -> CliResult> {
- match self.values.get(k) {
+ match self.value(k) {
None => Ok(default.to_vec()),
Some(s) => s
.split(',')
@@ -110,6 +116,10 @@ mod tests {
assert_eq!(a.value("o").as_deref(), Some("out"));
assert_eq!(a.scale().unwrap(), 2.0);
assert!(a.flag("json"));
+ let a = Args::parse(&v(&["--root", "a", "--root=b"]), &["root"], &[]).unwrap();
+ assert_eq!(a.values("root"), ["a", "b"]);
+ assert_eq!(a.value("root").as_deref(), Some("b"));
+ assert!(a.values("none").is_empty());
}
#[test]
diff --git a/apps/figcraft-cli/src/files.rs b/apps/figcraft-cli/src/files.rs
index 4fb485e10..462155998 100644
--- a/apps/figcraft-cli/src/files.rs
+++ b/apps/figcraft-cli/src/files.rs
@@ -29,9 +29,20 @@ fn image_format(e: &str) -> Option {
}
}
+/// Writes through [`figcraft_engine::file_access`] when automation roots are in force, so a
+/// confined run can only write inside a write root (#833).
+///
+/// Unconfined it writes with `std::fs::write`, as it always did. `file_access::write` stages the
+/// bytes and renames them into place, which **replaces** a symbolic link at `path` instead of
+/// writing through it to its target -- a change of behaviour for anyone whose output path is a
+/// link, and nothing to do with confinement. Inside a root the staged write is the right one:
+/// `Roots::check` has already refused a link that leads out of the root.
fn write(path: &str, bytes: &[u8]) -> CliResult<()> {
if let Some(dir) = Path::new(path).parent().filter(|d| !d.as_os_str().is_empty()) {
- std::fs::create_dir_all(dir).map_err(|e| CliError::Failed(format!("{}: {e}", dir.display())))?;
+ figcraft_engine::file_access::create_dir_all(dir).map_err(|e| CliError::Failed(e.to_string()))?;
+ }
+ if figcraft_engine::file_access::current().is_some() {
+ return figcraft_engine::file_access::write(path, bytes).map_err(|e| CliError::Failed(e.to_string()));
}
std::fs::write(path, bytes).map_err(|e| CliError::Failed(format!("{path}: {e}")))
}
@@ -155,6 +166,7 @@ pub fn info(path: &str, as_json: bool) -> CliResult {
Some(json!({"id": p, "name": pn.name, "nodes": nodes, "topLevel": pn.children.len(), "frames": frames}))
})
.collect();
+ let missing = figcraft_engine::fonts::missing(&doc);
let v = json!({
"file": path,
"name": doc.name,
@@ -164,6 +176,7 @@ pub fn info(path: &str, as_json: bool) -> CliResult {
"variables": doc.variables.variables.len(),
"images": doc.images.len(),
"notes": notes,
+ "missingFonts": missing.iter().map(|m| json!({"family": m.family, "layers": m.layers})).collect::>(),
});
if as_json {
println!("{}", serde_json::to_string_pretty(&v).unwrap_or_default());
@@ -187,6 +200,10 @@ pub fn info(path: &str, as_json: bool) -> CliResult {
println!(" {} {} \"{}\" {}×{}", f["id"], f["type"].as_str().unwrap_or(""), f["name"].as_str().unwrap_or(""), f["width"], f["height"]);
}
}
+ for m in &missing {
+ let layers = if m.layers == 1 { "text layer" } else { "text layers" };
+ println!("missing font \"{}\": {} {layers} (drawn in a fallback font)", m.family, m.layers);
+ }
Ok(ExitCode::SUCCESS)
}
@@ -238,7 +255,7 @@ pub fn export(file: &str, out: &str, t: &Target) -> CliResult {
println!("{out}");
return Ok(ExitCode::SUCCESS);
}
- std::fs::create_dir_all(out).map_err(|e| CliError::Failed(format!("{out}: {e}")))?;
+ figcraft_engine::file_access::create_dir_all(out).map_err(|e| CliError::Failed(e.to_string()))?;
let ids = match target {
Some(t) => vec![t],
None => {
@@ -323,7 +340,8 @@ pub fn parse_script(text: &str) -> Result, String> {
}
pub fn run_script(script: &str, input: Option<&str>, out: Option<&str>) -> CliResult {
- let text = std::fs::read_to_string(script).map_err(|e| CliError::Failed(format!("{script}: {e}")))?;
+ let bytes = figcraft_engine::file_access::read(script).map_err(|e| CliError::Failed(e.to_string()))?;
+ let text = String::from_utf8(bytes).map_err(|_| CliError::Failed(format!("{script}: not UTF-8")))?;
let steps = parse_script(&text).map_err(|e| CliError::Failed(format!("{script}: {e}")))?;
let mut s = match input {
Some(path) => {
@@ -333,17 +351,32 @@ pub fn run_script(script: &str, input: Option<&str>, out: Option<&str>) -> CliRe
}
None => Session::new(),
};
- for (i, (cmd, params)) in steps.iter().enumerate() {
- let r = s.execute(cmd, params);
- s.ui_requests.clear();
- match r {
- Ok(v) => println!("{}", json!({"step": i, "command": cmd, "ok": true, "result": v})),
- Err(e) => {
- println!("{}", json!({"step": i, "command": cmd, "ok": false, "error": e.to_string()}));
- eprintln!("error: step {i} ({cmd}) failed: {e}");
- return Ok(ExitCode::from(1));
- }
+ // One undo step and all-or-nothing, the way the same commands behave through `command.batch`
+ // (MCP, the control channel, plugins): `{"$step": n}` resolves against the steps before it, and
+ // a step that fails takes the whole script back instead of leaving the earlier steps applied.
+ // The result lines are held back until the script is through, so none of them reports work that
+ // was rolled back.
+ let mut results: Vec = Vec::with_capacity(steps.len());
+ let mut failed_at = 0;
+ let outcome = s.grouped(&format!("run {script}"), |s| {
+ for (i, (cmd, params)) in steps.iter().enumerate() {
+ failed_at = i;
+ let v = s.batch_step(&results, i, cmd, params)?;
+ s.ui_requests.clear();
+ results.push(v);
}
+ Ok(())
+ });
+ if let Err(e) = outcome {
+ let cmd = steps.get(failed_at).map_or("", |(cmd, _)| cmd.as_str());
+ let i = failed_at;
+ println!("{}", json!({"step": i, "command": cmd, "ok": false, "error": e.to_string(), "rolledBack": true}));
+ eprintln!("error: step {i} ({cmd}) failed: {e}");
+ eprintln!("the script's document changes were rolled back");
+ return Ok(ExitCode::from(1));
+ }
+ for (i, ((cmd, _), v)) in steps.iter().zip(&results).enumerate() {
+ println!("{}", json!({"step": i, "command": cmd, "ok": true, "result": v}));
}
if let Some(out) = out {
let ds = s.ds().map_err(|e| CliError::Failed(e.to_string()))?;
@@ -422,4 +455,62 @@ mod tests {
assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 2);
std::fs::remove_dir_all(dir).unwrap();
}
+
+ fn temp_dir(tag: &str) -> std::path::PathBuf {
+ let stamp = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+ let dir = std::env::temp_dir().join(format!("figcraft-cli-{tag}-{}-{stamp}", std::process::id()));
+ std::fs::create_dir(&dir).unwrap();
+ dir
+ }
+
+ /// A script resolves `{"$step": n}` like the same commands through `command.batch`. Each step
+ /// used to run on its own, so the reference reached `parent` unresolved, `node.create` read it
+ /// as "no parent" and the layer landed on the page — with every step reporting success.
+ #[test]
+ fn a_script_puts_a_layer_in_a_layer_an_earlier_step_made() {
+ let dir = temp_dir("run-step");
+ let script = dir.join("script.json");
+ std::fs::write(
+ &script,
+ r#"[
+ {"command": "node.create", "params": {"type": "frame", "name": "Card", "x": 0, "y": 0, "width": 200, "height": 100}},
+ {"command": "node.create", "params": {"type": "rectangle", "name": "child", "parent": {"$step": 0}, "x": 10, "y": 10, "width": 20, "height": 20}}
+ ]"#,
+ )
+ .unwrap();
+ let out = dir.join("out.figcraft");
+ run_script(script.to_str().unwrap(), None, Some(out.to_str().unwrap())).unwrap();
+
+ let mut s = Session::empty();
+ s.execute("file.open", &json!({"path": out.to_str().unwrap()})).unwrap();
+ let doc = s.doc().unwrap();
+ let page = s.page().unwrap();
+ let top = doc.node(page).unwrap().children.clone();
+ assert_eq!(top.len(), 1, "only the frame is top level, not the rectangle too");
+ assert_eq!(doc.node(top[0]).unwrap().name, "Card");
+ let inner = doc.node(top[0]).unwrap().children.clone();
+ assert_eq!(inner.len(), 1, "the rectangle went inside the frame");
+ assert_eq!(doc.node(inner[0]).unwrap().name, "child");
+ std::fs::remove_dir_all(dir).unwrap();
+ }
+
+ /// A step that fails takes the whole script back: nothing is written, and the failure says so.
+ #[test]
+ fn a_failed_step_leaves_no_output() {
+ let dir = temp_dir("run-rollback");
+ let script = dir.join("script.json");
+ std::fs::write(
+ &script,
+ r#"[
+ {"command": "node.create", "params": {"type": "frame", "name": "Card", "x": 0, "y": 0, "width": 200, "height": 100}},
+ {"command": "node.set", "params": {"ids": [99999], "props": {"name": "nope"}}}
+ ]"#,
+ )
+ .unwrap();
+ let out = dir.join("out.figcraft");
+ // The failure is the script's, not the call's: the CLI reports it and exits non-zero.
+ run_script(script.to_str().unwrap(), None, Some(out.to_str().unwrap())).unwrap();
+ assert!(!out.exists(), "a script that failed writes nothing");
+ std::fs::remove_dir_all(dir).unwrap();
+ }
}
diff --git a/apps/figcraft-cli/src/main.rs b/apps/figcraft-cli/src/main.rs
index 590b50f14..badc5bc30 100644
--- a/apps/figcraft-cli/src/main.rs
+++ b/apps/figcraft-cli/src/main.rs
@@ -22,8 +22,9 @@ USAGE:
figcraft-cli convert
figcraft-cli render -o [--scale N] [--page NAME]
figcraft-cli run [--in ] [--out ]
+ (info, export, convert, render and run also take --automation-read-root DIR / --automation-write-root DIR)
figcraft-cli commands [--json] [--filter TEXT]
- figcraft-cli mcp [--attach PORT]
+ figcraft-cli mcp [--attach PORT] [--automation-read-root DIR]... [--automation-write-root DIR]...
figcraft-cli plugin publish --server ws://host:port/[?key=KEY]
figcraft-cli perf [--layers N[,N...]] [--instances N[,N...]]
figcraft-cli help | --help | --version
@@ -42,8 +43,33 @@ crop and bleed marks, CMYK colour). `run` executes a JSON array (or JSON lines)
`plugin publish` sends a plugin folder (figcraft-plugin.json, its module, an optional assets/ folder)
to a figcraft-server's plugin directory as a new version; the server's key comes from the address or
the FIGCRAFT_SERVER_KEY environment variable (which keeps it out of the shell history).
+`--automation-read-root DIR` / `--automation-write-root DIR` (each may be repeated; the folders
+must exist) confine the files a subcommand touches: reads only inside a read or write root, writes
+only inside a write root, everything else refused -- so giving no write root denies writing
+altogether. They are taken by `mcp`, to confine the agent's commands, and by `info`, `export`,
+`convert`, `render` and `run`, to confine that one run; without them a subcommand reads and writes
+as the user who started it, as before. A running app confines itself: start it with
+`figcraft --control PORT` and the same flags (`--attach` refuses them).
See docs/cli.md and docs/mcp.md.";
+/// The automation roots a file subcommand was given, if any. Omitting both leaves the run
+/// unconfined, as before; giving either confines every file the subcommand touches (#833).
+const ROOT_FLAGS: [&str; 2] = ["automation-read-root", "automation-write-root"];
+
+fn roots_of(a: &Args) -> CliResult> {
+ let (read, write) = (a.values("automation-read-root"), a.values("automation-write-root"));
+ if read.is_empty() && write.is_empty() {
+ return Ok(None);
+ }
+ Ok(Some(figcraft_engine::file_access::Roots::new(read, write).map_err(CliError::Failed)?))
+}
+
+/// Runs `f` confined to the roots `a` carries.
+fn confined(a: &Args, f: impl FnOnce() -> CliResult) -> CliResult {
+ let roots = roots_of(a)?.map(std::sync::Arc::new);
+ figcraft_engine::file_access::confined(roots.as_ref(), f)
+}
+
fn main() -> ExitCode {
let argv: Vec = std::env::args().skip(1).collect();
match run(&argv) {
@@ -94,35 +120,38 @@ fn run(argv: &[String]) -> CliResult {
Ok(ExitCode::SUCCESS)
}
"info" => {
- let a = Args::parse(rest, &[], &["json"])?;
+ let a = Args::parse(rest, &ROOT_FLAGS, &["json"])?;
let file = a.one_positional("info ")?;
- files::info(&file, a.flag("json"))
+ confined(&a, || files::info(&file, a.flag("json")))
}
"export" => {
- let a = Args::parse(rest, &["format", "scale", "page", "node", "o", "out", "bleed"], &["crop-marks", "bleed-marks", "cmyk"])?;
+ let valued = [&["format", "scale", "page", "node", "o", "out", "bleed"][..], &ROOT_FLAGS[..]].concat();
+ let a = Args::parse(rest, &valued, &["crop-marks", "bleed-marks", "cmyk"])?;
let file = a.one_positional("export -o ")?;
let out = a.value("o").or_else(|| a.value("out")).ok_or_else(|| CliError::Usage("export needs -o ".into()))?;
let target =
files::Target { format: a.value("format"), scale: a.scale()?, page: a.value("page"), node: a.value("node"), print: a.print()? };
- files::export(&file, &out, &target)
+ confined(&a, || files::export(&file, &out, &target))
}
"convert" => {
- let a = Args::parse(rest, &[], &[])?;
+ let a = Args::parse(rest, &ROOT_FLAGS, &[])?;
match a.positional.as_slice() {
- [i, o] => files::convert(i, o),
+ [i, o] => confined(&a, || files::convert(i, o)),
_ => Err(CliError::Usage("convert ".into())),
}
}
"render" => {
- let a = Args::parse(rest, &["o", "out", "scale", "page"], &[])?;
+ let valued = [&["o", "out", "scale", "page"][..], &ROOT_FLAGS[..]].concat();
+ let a = Args::parse(rest, &valued, &[])?;
let file = a.one_positional("render -o ")?;
let out = a.value("o").or_else(|| a.value("out")).ok_or_else(|| CliError::Usage("render needs -o ".into()))?;
- files::render(&file, &out, a.scale()?, a.value("page").as_deref())
+ confined(&a, || files::render(&file, &out, a.scale()?, a.value("page").as_deref()))
}
"run" => {
- let a = Args::parse(rest, &["in", "out"], &[])?;
+ let valued = [&["in", "out"][..], &ROOT_FLAGS[..]].concat();
+ let a = Args::parse(rest, &valued, &[])?;
let script = a.one_positional("run ")?;
- files::run_script(&script, a.value("in").as_deref(), a.value("out").as_deref())
+ confined(&a, || files::run_script(&script, a.value("in").as_deref(), a.value("out").as_deref()))
}
"commands" => {
let a = Args::parse(rest, &["filter"], &["json"])?;
@@ -133,11 +162,20 @@ fn run(argv: &[String]) -> CliResult {
Ok(ExitCode::SUCCESS)
}
"mcp" => {
- let a = Args::parse(rest, &["attach"], &[])?;
+ let valued = [&["attach"][..], &ROOT_FLAGS[..]].concat();
+ let a = Args::parse(rest, &valued, &[])?;
if !a.positional.is_empty() {
return Err(CliError::Usage("mcp takes no positional arguments".into()));
}
- mcp(a.value("attach").as_deref())
+ let attach = a.value("attach");
+ // The app runs the commands: only its own roots can confine them.
+ if attach.is_some() && ROOT_FLAGS.iter().any(|f| !a.values(f).is_empty()) {
+ return Err(CliError::Usage(
+ "--attach can't take automation roots: start the app with them instead (`figcraft --control PORT --automation-read-root DIR ...`)"
+ .into(),
+ ));
+ }
+ mcp(attach.as_deref(), roots_of(&a)?)
}
"plugin" => {
let a = Args::parse(rest, &["server"], &[])?;
@@ -205,7 +243,7 @@ fn publish_plugin(folder: &str, server: &str) -> CliResult {
Ok(ExitCode::SUCCESS)
}
-fn mcp(attach: Option<&str>) -> CliResult {
+fn mcp(attach: Option<&str>, roots: Option) -> CliResult {
let backend: Box = match attach {
Some(p) => {
let addr = if p.contains(':') {
@@ -220,7 +258,10 @@ fn mcp(attach: Option<&str>) -> CliResult {
None => Box::new(figcraft_mcp::Headless::new()),
};
eprintln!("figcraft MCP server ({}) on stdio", backend.describe());
- let mut server = figcraft_mcp::Server::new(backend);
+ if let Some(r) = &roots {
+ eprintln!("file access confined to {}", r.to_json());
+ }
+ let mut server = figcraft_mcp::Server::new(backend).with_roots(roots);
let stdin = std::io::stdin();
let stdout = std::io::stdout();
server.serve(stdin.lock(), stdout.lock()).map_err(|e| format!("stdio: {e}"))?;
diff --git a/apps/figcraft-cli/tests/cli.rs b/apps/figcraft-cli/tests/cli.rs
index 9dd522031..eb42b8d88 100644
--- a/apps/figcraft-cli/tests/cli.rs
+++ b/apps/figcraft-cli/tests/cli.rs
@@ -25,6 +25,9 @@ fn bad_arguments_exit_2_without_panicking() {
&["render", "a", "-o"],
&["perf", "--shapes", "lots"],
&["mcp", "--attach", "notaport"],
+ // An attached app confines itself: roots go to `figcraft --control`.
+ &["mcp", "--attach", "7979", "--automation-read-root", "."],
+ &["mcp", "--automation-write-root"],
&["convert", "a"],
] {
let out = bin().args(args).output().unwrap();
@@ -120,9 +123,147 @@ fn mcp_over_stdio() {
assert_eq!(lines[2]["result"]["isError"], false);
}
+#[test]
+fn mcp_over_stdio_confined_to_automation_roots() {
+ let d = tmp("roots");
+ for sub in ["in", "out", "outside"] {
+ std::fs::create_dir_all(d.join(sub)).unwrap();
+ }
+ let p = |rel: &str| d.join(rel).to_string_lossy().into_owned();
+ // A root that isn't a folder stops the server before it serves.
+ let out = bin().args(["mcp", "--automation-read-root", &p("missing")]).output().unwrap();
+ assert_eq!(out.status.code(), Some(1));
+ assert!(String::from_utf8_lossy(&out.stderr).contains("--automation-read-root"));
+ let mut child = bin()
+ .args(["mcp", "--automation-read-root", &p("in"), "--automation-write-root", &p("out")])
+ .stdin(Stdio::piped())
+ .stdout(Stdio::piped())
+ .stderr(Stdio::null())
+ .spawn()
+ .unwrap();
+ {
+ let stdin = child.stdin.as_mut().unwrap();
+ let call = |id: u32, tool: &str, args: serde_json::Value| {
+ serde_json::json!({"jsonrpc": "2.0", "id": id, "method": "tools/call", "params": {"name": tool, "arguments": args}}).to_string()
+ };
+ writeln!(stdin, r#"{{"jsonrpc":"2.0","id":1,"method":"initialize","params":{{"protocolVersion":"2025-06-18"}}}}"#).unwrap();
+ writeln!(stdin, "{}", call(2, "create_node", serde_json::json!({"type": "ellipse"}))).unwrap();
+ writeln!(stdin, "{}", call(3, "save_file", serde_json::json!({"path": p("outside/a.figcraft")}))).unwrap();
+ writeln!(stdin, "{}", call(4, "save_file", serde_json::json!({"path": p("out/a.figcraft")}))).unwrap();
+ writeln!(stdin, "{}", call(5, "open_file", serde_json::json!({"path": p("outside/a.figcraft")}))).unwrap();
+ writeln!(stdin, "{}", call(6, "open_file", serde_json::json!({"path": p("out/a.figcraft")}))).unwrap();
+ }
+ drop(child.stdin.take());
+ let out = child.wait_with_output().unwrap();
+ assert!(out.status.success());
+ let lines: Vec = String::from_utf8_lossy(&out.stdout).lines().map(|l| serde_json::from_str(l).unwrap()).collect();
+ assert_eq!(lines.len(), 6);
+ assert!(lines[0]["result"]["instructions"].as_str().unwrap().contains("only these folders may be read"));
+ let error = |i: usize| lines[i]["result"]["isError"] == true;
+ assert!(!error(1) && error(2) && !error(3) && error(4) && !error(5), "{lines:?}");
+ assert!(lines[2]["result"]["content"][0]["text"].as_str().unwrap().contains("automation path rejected"));
+ assert!(d.join("out/a.figcraft").is_file() && !d.join("outside/a.figcraft").exists());
+ let _ = std::fs::remove_dir_all(&d);
+}
+
#[test]
fn commands_json_lists_everything() {
let out = bin().args(["commands", "--json"]).output().unwrap();
let v: serde_json::Value = serde_json::from_slice(&out.stdout).unwrap();
assert!(v.as_array().unwrap().len() > 200);
}
+
+/// The automation roots confine the file subcommands too, not just `mcp` (#833): a read outside a
+/// root, and a write outside a write root, are refused and leave no file behind. Without the flags
+/// the same commands behave as they always did.
+#[test]
+fn file_subcommands_are_confined_to_automation_roots() {
+ let d = tmp("file-roots");
+ let _ = std::fs::remove_dir_all(&d);
+ for sub in ["in", "out"] {
+ std::fs::create_dir_all(d.join(sub)).unwrap();
+ }
+ let p = |rel: &str| d.join(rel).to_string_lossy().into_owned();
+ let out_of = |o: &std::process::Output| String::from_utf8_lossy(&o.stderr).into_owned();
+
+ // A document to work on, made unconfined.
+ std::fs::write(d.join("in/make.json"), br#"[{"command":"shape.rectangle","params":{"x":0,"y":0,"width":40,"height":20}}]"#).unwrap();
+ let made = bin().args(["run", &p("in/make.json"), "--out", &p("in/doc.figcraft")]).output().unwrap();
+ assert!(made.status.success(), "{}", out_of(&made));
+
+ // Inside the roots: renders as usual.
+ let ok = bin()
+ .args(["render", &p("in/doc.figcraft"), "-o", &p("out/ok.png"), "--automation-read-root", &p("in"), "--automation-write-root", &p("out")])
+ .output()
+ .unwrap();
+ assert!(ok.status.success(), "{}", out_of(&ok));
+ assert!(d.join("out/ok.png").is_file());
+
+ // A write outside the write root is refused, and nothing is written.
+ let escaped = d.join("escaped.png");
+ let refused = bin()
+ .args([
+ "render",
+ &p("in/doc.figcraft"),
+ "-o",
+ &escaped.to_string_lossy(),
+ "--automation-read-root",
+ &p("in"),
+ "--automation-write-root",
+ &p("out"),
+ ])
+ .output()
+ .unwrap();
+ assert!(!refused.status.success());
+ assert!(out_of(&refused).contains("may be written"), "{}", out_of(&refused));
+ assert!(!escaped.exists(), "the refused render wrote a file anyway");
+
+ // No write root at all: writing is refused outright, reading still works.
+ let no_write = bin().args(["render", &p("in/doc.figcraft"), "-o", &p("out/no.png"), "--automation-read-root", &p("in")]).output().unwrap();
+ assert!(!no_write.status.success());
+ assert!(out_of(&no_write).contains("no folder may be written"), "{}", out_of(&no_write));
+
+ // A read outside every root is refused: `info` on the document with only `out` readable.
+ let read_refused = bin().args(["info", &p("in/doc.figcraft"), "--automation-read-root", &p("out")]).output().unwrap();
+ assert!(!read_refused.status.success());
+ assert!(out_of(&read_refused).contains("may be read"), "{}", out_of(&read_refused));
+
+ // `convert` and `run` take them as well, and a root that is not a folder is refused.
+ let missing = bin().args(["convert", &p("in/doc.figcraft"), &p("out/c.svg"), "--automation-read-root", &p("missing")]).output().unwrap();
+ assert!(!missing.status.success());
+ assert!(out_of(&missing).contains("automation-read-root"), "{}", out_of(&missing));
+
+ // Unconfined, the same render still writes wherever it is told.
+ let plain = bin().args(["render", &p("in/doc.figcraft"), "-o", &escaped.to_string_lossy()]).output().unwrap();
+ assert!(plain.status.success(), "{}", out_of(&plain));
+ assert!(escaped.is_file());
+ let _ = std::fs::remove_dir_all(&d);
+}
+
+/// An output path that is a symbolic link is written through, to its target, as `std::fs::write`
+/// always did. Routing the CLI's writes through `file_access` for #833 would otherwise have
+/// replaced the link with a regular file, because that write stages the bytes and renames them
+/// into place.
+#[cfg(unix)]
+#[test]
+fn an_unconfined_write_follows_a_symbolic_link() {
+ let d = tmp("symlink-out");
+ let _ = std::fs::remove_dir_all(&d);
+ std::fs::create_dir_all(d.join("real")).unwrap();
+ let p = |rel: &str| d.join(rel).to_string_lossy().into_owned();
+ std::fs::write(d.join("in.json"), br#"[{"command":"shape.rectangle","params":{"x":0,"y":0,"width":40,"height":20}}]"#).unwrap();
+ let made = bin().args(["run", &p("in.json"), "--out", &p("doc.figcraft")]).output().unwrap();
+ assert!(made.status.success(), "{}", String::from_utf8_lossy(&made.stderr));
+
+ let target = d.join("real/target.png");
+ std::fs::write(&target, b"placeholder").unwrap();
+ let link = d.join("link.png");
+ std::os::unix::fs::symlink(&target, &link).unwrap();
+
+ let out = bin().args(["render", &p("doc.figcraft"), "-o", &link.to_string_lossy()]).output().unwrap();
+ assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+ assert!(std::fs::symlink_metadata(&link).unwrap().file_type().is_symlink(), "the link is still a link");
+ let written = std::fs::read(&target).unwrap();
+ assert!(written.starts_with(b"\x89PNG"), "the target holds the render, not the placeholder");
+ let _ = std::fs::remove_dir_all(&d);
+}
diff --git a/apps/figcraft-cli/tests/fonts.rs b/apps/figcraft-cli/tests/fonts.rs
index c5901ac50..ef5c638fa 100644
--- a/apps/figcraft-cli/tests/fonts.rs
+++ b/apps/figcraft-cli/tests/fonts.rs
@@ -45,3 +45,25 @@ fn headless_runs_resolve_installed_families_unless_opted_out() {
assert_eq!(run_one("face", face.clone(), &[], false)["family"], json!(installed), "text uses the installed family");
assert_ne!(run_one("face", face, &["--no-system-fonts"], false)["family"], json!(installed), "opted out, it falls back");
}
+
+#[test]
+fn info_lists_the_fonts_a_file_uses_that_are_missing() {
+ let d = std::env::temp_dir().join(format!("figcraft-cli-missing-{}", std::process::id()));
+ std::fs::create_dir_all(&d).unwrap();
+ let (script, file) = (d.join("make.json"), d.join("doc.figcraft"));
+ let text =
+ |family: &str| json!({"command": "text.create", "params": {"text": "Hamburgefonstiv", "x": 0, "y": 0, "props": {"fontFamily": family}}});
+ std::fs::write(&script, json!([text("FigCraft Missing CLI"), text("FigCraft Missing CLI")]).to_string()).unwrap();
+ let cli = || Command::new(env!("CARGO_BIN_EXE_figcraft-cli"));
+ let made = cli().arg("run").arg(&script).arg("--out").arg(&file).output().unwrap();
+ assert!(made.status.success(), "{}", String::from_utf8_lossy(&made.stderr));
+
+ let out = cli().arg("info").arg(&file).arg("--json").output().unwrap();
+ assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+ let v: Value = serde_json::from_slice(&out.stdout).unwrap();
+ assert_eq!(v["missingFonts"], json!([{"family": "FigCraft Missing CLI", "layers": 2}]));
+
+ let out = cli().arg("info").arg(&file).output().unwrap();
+ let shown = String::from_utf8_lossy(&out.stdout);
+ assert!(shown.contains("missing font \"FigCraft Missing CLI\": 2 text layers"), "{shown}");
+}
diff --git a/apps/figcraft-server/src/config.rs b/apps/figcraft-server/src/config.rs
index bd587b767..d5f4f761e 100644
--- a/apps/figcraft-server/src/config.rs
+++ b/apps/figcraft-server/src/config.rs
@@ -135,9 +135,23 @@ impl Config {
/// abuse contact, or one whose clients would all count as its proxy).
pub fn warnings(&self) -> Vec {
let mut out = Vec::new();
+ let client_max = NetLimits::default().max_server_message >> 20;
+ if usize::try_from(self.file_mb()).is_ok_and(|mb| mb >= client_max) {
+ out.push(format!(
+ "max_file_mb is {}: the app opens files of up to {} MiB, so a file that large can't be opened",
+ self.file_mb(),
+ client_max - 1
+ ));
+ }
if !self.open_publish {
return out;
}
+ if self.file_mb() > 64 {
+ out.push(format!(
+ "open_publish is on with max_file_mb = {}: anyone may send messages that large, and the memory set aside for reading and queueing them grows to eight times it; keep it at 64 or less on a public server",
+ self.file_mb()
+ ));
+ }
if self.operator_contact.trim().is_empty() {
out.push("open_publish is on but operator_contact is empty: people can't reach you about abuse; set it (and terms_url)".into());
}
@@ -168,7 +182,7 @@ impl Config {
return Err("`idle_days` must be from 0 to 3650".into());
}
let terms = self.terms_url.trim();
- if !terms.is_empty() && !(terms.starts_with("https://") || terms.starts_with("http://")) || terms.contains(char::is_whitespace) {
+ if !(terms.is_empty() || terms.starts_with("https://") || terms.starts_with("http://")) || terms.contains(char::is_whitespace) {
return Err("`terms_url` must be a web address (https://…)".into());
}
if self.operator_contact.chars().count() > 120 || self.operator_contact.chars().any(char::is_control) || terms.len() > 500 {
@@ -253,8 +267,9 @@ impl Config {
}
}
- /// Largest message a client may send when open to the public: a whole file (or plugin bundle)
- /// and a margin, not the core's 64 MiB.
+ /// Largest message a client may send: a whole file (or plugin bundle) and a margin. Open to the
+ /// public this is also the cap (strangers' files stay small); a private server never goes below
+ /// the core's 64 MiB, and a `max_file_mb` above it raises the cap with it.
fn open_message(&self) -> usize {
usize::try_from(self.file_mb().max(self.max_plugin_mb).saturating_add(1).saturating_mul(1 << 20)).unwrap_or(usize::MAX)
}
@@ -265,9 +280,9 @@ impl Config {
fn core(&self) -> figcraft_collab::Limits {
let base = figcraft_collab::Limits { max_peers: self.max_people, ..figcraft_collab::Limits::default() };
if !self.open_publish {
- return base;
+ return figcraft_collab::Limits { max_message_bytes: base.max_message_bytes.max(self.open_message()), ..base };
}
- let max = self.open_message().min(base.max_message_bytes);
+ let max = self.open_message();
let file = usize::try_from(self.file_mb().saturating_mul(1 << 20)).unwrap_or(usize::MAX);
figcraft_collab::Limits { max_message_bytes: max, max_log_bytes: (file / 4).max(256 << 10), ..base }
}
@@ -279,21 +294,24 @@ impl Config {
pub fn net(&self) -> NetLimits {
let base = NetLimits { max_connections: self.max_connections, trusted_proxy: self.proxy().ok().flatten(), ..NetLimits::default() };
if !self.open_publish {
- return base;
+ let max = base.max_client_message.max(self.open_message());
+ return NetLimits { max_client_message: max, max_queued_bytes: base.max_queued_bytes.max(max.saturating_add(1 << 20)), ..base };
}
- let max = self.open_message().min(base.max_client_message);
+ let max = self.open_message();
// Shared budgets: one block of addresses (an IPv4 address, an IPv6 /48) gets at most an
- // eighth of each, and its biggest consumers are dropped first.
- let (queued, reading) = (256usize << 20, 192usize << 20);
+ // eighth of each, and its biggest consumers are dropped first. Each still fits one whole
+ // message, or a file as large as `max_file_mb` could never arrive.
+ let one = max.saturating_add(1 << 20);
+ let (queued, reading) = ((256usize << 20).max(one.saturating_mul(8)), (192usize << 20).max(one.saturating_mul(8)));
NetLimits {
max_per_address: self.max_connections_per_ip,
max_client_message: max,
- max_queued_bytes: max.saturating_add(1 << 20),
+ max_queued_bytes: one,
max_queued_block: queued / 8,
max_queued_total: queued,
- max_reading_block: max.saturating_add(1 << 20).min(reading / 8),
+ max_reading_block: one.min(reading / 8),
max_reading_total: reading,
- max_in_flight: 128 << 20,
+ max_in_flight: (128usize << 20).max(one),
reserve_for_sessions: self.max_connections / 8,
request_idle: std::time::Duration::from_secs(20),
..base
diff --git a/apps/figcraft-server/src/disk.rs b/apps/figcraft-server/src/disk.rs
index f58f25b21..af6e0f990 100644
--- a/apps/figcraft-server/src/disk.rs
+++ b/apps/figcraft-server/src/disk.rs
@@ -8,8 +8,10 @@
//! length (u32 LE), CRC-32 (u32 LE), one [`Journal`] entry in the wire encoding.
//!
//! Compaction writes the next generation's snapshot, then an empty log of that generation. A log
-//! whose generation isn't the snapshot's is from before a compaction that was cut short: what it
-//! holds is in the snapshot already. A log ends at its first damaged record (a write cut short).
+//! whose generation isn't the snapshot's is usually from before a compaction that was cut short
+//! (what it holds is in the snapshot already), but no checksum covers either generation, so the
+//! store replays such a log anyway and reports any change the snapshot lacked. A log ends at its
+//! first damaged record (a write cut short).
use std::fs::{self, File};
use std::io::{self, Read, Write};
diff --git a/apps/figcraft-server/src/public_tests.rs b/apps/figcraft-server/src/public_tests.rs
index fea2667e9..978d9e8ee 100644
--- a/apps/figcraft-server/src/public_tests.rs
+++ b/apps/figcraft-server/src/public_tests.rs
@@ -413,7 +413,7 @@ fn open_mode_has_safe_defaults_and_warns_the_operator() {
assert_eq!(open.net().request_idle, Duration::from_secs(20), "idle one-shot requests go quickly");
assert_eq!(open.net().reserve_for_sessions, 512 / 8);
assert_eq!(open.net().max_client_message, 17 << 20);
- assert_eq!(private.net().max_client_message, NetLimits::default().max_client_message, "unchanged when private");
+ assert_eq!(private.net().max_client_message, 65 << 20, "private: a 64 MiB file and a margin");
let w = open.warnings().join("\n");
assert!(w.contains("operator_contact is empty") && w.contains("trusted_proxy"), "{w}");
let set = Config { operator_contact: "abuse@example.com".into(), trusted_proxy: Some("127.0.0.1".into()), max_file_mb: Some(8), ..open };
@@ -493,3 +493,34 @@ fn open_connections_never_reach_what_needs_the_key() {
assert!(!format!("{info:?}").contains(&k));
server.stop();
}
+
+#[test]
+fn files_above_64_mib_fit_every_limit() {
+ // `max_file_mb` may go up to 4096: every cap a whole file's message meets on its way in must
+ // follow it, or the upload is dropped by the transport before the server can say why.
+ for open_publish in [false, true] {
+ let cfg = Config { open_publish, max_file_mb: Some(256), public_url: Some("wss://figcraft.example.com/".into()), ..Config::default() };
+ let (net, core, file) = (cfg.net(), cfg.store().core, 256usize << 20);
+ assert!(net.max_client_message > file, "open={open_publish}: {}", net.max_client_message);
+ assert!(net.max_queued_bytes > file && net.max_reading_block > file && net.max_in_flight > file, "open={open_publish}: {net:?}");
+ assert!(net.max_reading_total >= net.max_reading_block && net.max_queued_total >= net.max_queued_block);
+ assert!(core.max_message_bytes > file, "open={open_publish}: {}", core.max_message_bytes);
+ }
+ // A client takes such a file too, but caps what any server may make it buffer at 1 GiB.
+ assert_eq!(NetLimits::default().max_server_message, 1 << 30);
+}
+
+#[test]
+fn large_files_warn_the_operator() {
+ let public_url = Some("wss://figcraft.example.com/".into());
+ let warns = |open_publish, mb| {
+ Config { open_publish, max_file_mb: Some(mb), public_url: public_url.clone(), ..Config::default() }.warnings().join(
+ "
+",
+ )
+ };
+ assert!(!warns(true, 64).contains("max_file_mb"), "{}", warns(true, 64));
+ assert!(warns(true, 65).contains("open_publish is on with max_file_mb = 65"), "{}", warns(true, 65));
+ assert!(!warns(false, 1023).contains("max_file_mb"), "{}", warns(false, 1023));
+ assert!(warns(false, 1024).contains("can't be opened"), "{}", warns(false, 1024));
+}
diff --git a/apps/figcraft-server/src/store.rs b/apps/figcraft-server/src/store.rs
index 538adefff..ea9bc626c 100644
--- a/apps/figcraft-server/src/store.rs
+++ b/apps/figcraft-server/src/store.rs
@@ -440,7 +440,7 @@ impl Store {
&& let Ok(log) = disk::read_log(&bytes)
&& log.generation != generation
{
- log::info!("file at {}: its log predates the last compaction; it is ignored", path.display());
+ log::info!("file at {}: its log isn't of its snapshot's generation; it is replayed over it when the file opens", path.display());
}
let bytes = [SNAPSHOT, LOG].iter().filter_map(|n| fs::metadata(path.join(n)).ok()).map(|m| m.len()).sum();
Ok(Entry { meta, links, log: None, bytes, forced: 0 })
@@ -1126,8 +1126,32 @@ impl Store {
fresh_log = true;
}
}
- // From before a compaction that was cut short: the snapshot has it all.
- Ok(_) => {}
+ // From before a compaction that was cut short, the snapshot has it all; or a generation
+ // field damaged, which no checksum covers. Replaying tells them apart without trusting
+ // it: entries the snapshot holds are skipped, so only edits it lacks change anything.
+ Ok(log) => {
+ let before = server.seq();
+ let mut stopped = None;
+ for entry in log.entries {
+ if let Err(e) = server.replay(entry) {
+ stopped = Some(e);
+ break;
+ }
+ }
+ let (snap, found, recovered) = (generation, log.generation, server.seq().saturating_sub(before));
+ if recovered > 0 {
+ issues.push(format!(
+ "file {file}: its log's generation ({found}) doesn't match its snapshot's ({snap}), but it held \
+ {recovered} changes the snapshot didn't; they were recovered"
+ ));
+ }
+ if let Some(e) = stopped {
+ issues.push(format!(
+ "file {file}: its log's generation ({found}) doesn't match its snapshot's ({snap}) and it stops \
+ making sense after {recovered} newer changes ({e}); the rest was dropped"
+ ));
+ }
+ }
Err(why) => issues.push(format!("file {file}: {why}; starting a new log")),
}
for i in issues {
diff --git a/apps/figcraft-server/tests/header_recovery.rs b/apps/figcraft-server/tests/header_recovery.rs
new file mode 100644
index 000000000..d728908d1
--- /dev/null
+++ b/apps/figcraft-server/tests/header_recovery.rs
@@ -0,0 +1,139 @@
+//! A generation field damaged after an abrupt stop must not make the server drop a log that still
+//! holds confirmed edits (#408): the log is replayed over the snapshot, which only the changes the
+//! snapshot lacks survive, and the damage is reported. A genuine leftover of a compaction cut short
+//! still restores silently.
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
+use figcraft_collab::message::{Access, ClientMsg};
+use figcraft_collab::{Client, Outgoing, Replica, Server};
+use figcraft_collab_net::hub::Backend;
+use figcraft_doc::Document;
+use figcraft_server::config::Config;
+use figcraft_server::disk::{self, LOG, SNAPSHOT};
+use figcraft_server::store::{FILES, Store};
+use std::fs;
+use std::path::{Path, PathBuf};
+
+struct Fixture(PathBuf);
+
+impl Fixture {
+ fn new() -> Self {
+ let path = std::env::temp_dir().join(format!("figcraft-header-recovery-{}", figcraft_collab_net::token::file_id().unwrap()));
+ fs::create_dir(&path).unwrap();
+ Self(path)
+ }
+}
+
+impl Drop for Fixture {
+ fn drop(&mut self) {
+ let _ = fs::remove_dir_all(&self.0);
+ }
+}
+
+fn page_name(server: &Server) -> String {
+ let doc = server.document();
+ doc.node(doc.first_page().unwrap()).unwrap().name.clone()
+}
+
+/// A published file whose first page was renamed "Kept", flushed to its log (not compacted), then
+/// the store dropped without stopping (an abrupt stop). Returns the file id and the final state.
+fn renamed_and_stopped(data: &Path) -> (String, Server) {
+ let mut store = Store::open(data, Config::default().store()).unwrap();
+ let snapshot = Replica::new(Document::new("Fixture")).snapshot().unwrap();
+ let (info, _, _) = store.publish("Fixture", &snapshot).unwrap();
+ let id = info.id;
+ let mut server = store.open(&id).unwrap();
+ let ClientMsg::Hello(hello) = Client::hello("f", "", "Editor", "#FF8800") else { panic!("not a hello") };
+ let (_, messages) = server.join_as(hello, Access::Edit).unwrap();
+ let Some(Outgoing::To(_, welcome)) = messages.into_iter().next() else { panic!("no welcome") };
+ let mut client = Client::join(welcome).unwrap();
+ store.changed(&id, &mut server);
+ let mut edited = client.document().clone();
+ let page = edited.first_page().unwrap();
+ edited.node_mut(page).unwrap().name = "Kept".into();
+ let change = client.edit(&edited).unwrap().unwrap();
+ assert!(!server.receive(client.id(), change).is_empty());
+ store.changed(&id, &mut server);
+ assert!(store.flush().is_empty(), "the edit must reach disk");
+ assert_eq!(page_name(&server), "Kept");
+ let dir = data.join(FILES).join(&id);
+ assert!(!disk::read_log(&fs::read(dir.join(LOG)).unwrap()).unwrap().entries.is_empty());
+ assert_eq!(disk::decode_snapshot(&fs::read(dir.join(SNAPSHOT)).unwrap()).unwrap().1.seq, 0, "the rename is only in the log");
+ drop(store);
+ (id, server)
+}
+
+/// Reopen the data directory: the file's first page name and the problems reported.
+fn reopen(data: &Path, id: &str) -> (String, Vec) {
+ let mut store = Store::open(data, Config::default().store()).unwrap();
+ let server = store.open(id).unwrap();
+ (page_name(&server), store.problems().to_vec())
+}
+
+fn flip(path: &Path, at: usize) {
+ let mut bytes = fs::read(path).unwrap();
+ bytes[at] ^= 1;
+ fs::write(path, bytes).unwrap();
+}
+
+/// The generation field's first byte in both headers (after the magic and the format byte).
+const GENERATION_AT: usize = 5;
+
+#[test]
+fn an_intact_log_restores_its_edits_without_a_report() {
+ let fixture = Fixture::new();
+ let (id, _) = renamed_and_stopped(&fixture.0);
+ let (name, problems) = reopen(&fixture.0, &id);
+ assert_eq!(name, "Kept");
+ assert!(problems.is_empty(), "{problems:?}");
+}
+
+#[test]
+fn a_damaged_log_generation_keeps_the_edits_and_is_reported() {
+ let fixture = Fixture::new();
+ let (id, _) = renamed_and_stopped(&fixture.0);
+ let log = fixture.0.join(FILES).join(&id).join(LOG);
+ flip(&log, GENERATION_AT);
+ // The records themselves still read: only the header's generation changed.
+ let read = disk::read_log(&fs::read(&log).unwrap()).unwrap();
+ assert!(read.damaged.is_none() && !read.entries.is_empty());
+ let (name, problems) = reopen(&fixture.0, &id);
+ assert_eq!(name, "Kept", "the flushed rename must survive");
+ assert!(problems.iter().any(|p| p.contains(&id) && p.contains("generation")), "{problems:?}");
+ // And it stays: the recovered edit is now in the file's snapshot.
+ assert_eq!(reopen(&fixture.0, &id).0, "Kept");
+}
+
+#[test]
+fn a_damaged_snapshot_generation_keeps_the_edits_and_is_reported() {
+ let fixture = Fixture::new();
+ let (id, _) = renamed_and_stopped(&fixture.0);
+ let snapshot = fixture.0.join(FILES).join(&id).join(SNAPSHOT);
+ flip(&snapshot, GENERATION_AT);
+ assert!(disk::check_snapshot(&fs::read(&snapshot).unwrap()).is_ok(), "the generation is outside the checksum");
+ let (name, problems) = reopen(&fixture.0, &id);
+ assert_eq!(name, "Kept", "the flushed rename must survive");
+ assert!(problems.iter().any(|p| p.contains(&id) && p.contains("generation")), "{problems:?}");
+ assert_eq!(reopen(&fixture.0, &id).0, "Kept");
+}
+
+#[test]
+fn a_damaged_log_format_is_still_reported() {
+ let fixture = Fixture::new();
+ let (id, _) = renamed_and_stopped(&fixture.0);
+ flip(&fixture.0.join(FILES).join(&id).join(LOG), 4);
+ let (_, problems) = reopen(&fixture.0, &id);
+ assert!(problems.iter().any(|p| p.contains(&id) && p.contains("format")), "{problems:?}");
+}
+
+#[test]
+fn a_log_left_by_a_compaction_cut_short_restores_without_a_report() {
+ let fixture = Fixture::new();
+ let (id, server) = renamed_and_stopped(&fixture.0);
+ // The next snapshot was written (it holds the rename); the old log wasn't replaced yet.
+ let bytes = disk::encode_snapshot(2, &server.state().unwrap()).unwrap();
+ fs::write(fixture.0.join(FILES).join(&id).join(SNAPSHOT), bytes).unwrap();
+ let (name, problems) = reopen(&fixture.0, &id);
+ assert_eq!(name, "Kept");
+ assert!(problems.is_empty(), "a leftover log is expected, not damage: {problems:?}");
+}
diff --git a/apps/figcraft-web/Cargo.toml b/apps/figcraft-web/Cargo.toml
index 2f1a8190f..ffd44f3bc 100644
--- a/apps/figcraft-web/Cargo.toml
+++ b/apps/figcraft-web/Cargo.toml
@@ -26,4 +26,4 @@ eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit"] }
wasm-bindgen = "0.2"
js-sys = "0.3"
wasm-bindgen-futures = "0.4"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlCanvasElement", "HtmlElement", "HtmlAnchorElement", "Node", "Blob", "BlobPropertyBag", "File", "FileList", "HtmlInputElement", "EventTarget", "Url", "Location", "MediaQueryList", "Navigator", "Gamepad", "GamepadButton", "GamepadMappingType"] }
diff --git a/apps/figcraft-web/src/main.rs b/apps/figcraft-web/src/main.rs
index 587fd60b8..7eed2ffb3 100644
--- a/apps/figcraft-web/src/main.rs
+++ b/apps/figcraft-web/src/main.rs
@@ -14,7 +14,16 @@
//! join from other machines.
//!
//! URL query flag: `?webgl` forces the WebGL2 backend instead of WebGPU.
+//!
+//! URL fragment: `#join=` joins that live session once the page has
+//! loaded, so a bookmark opens a shared file. `join` takes the rest of the fragment: put it last.
+//! The link carries the session's secret; a fragment is never sent to the web host, but the address
+//! bar and the browser history keep it, so the URL is as private as the link itself.
+#[cfg(any(target_arch = "wasm32", test))]
+mod query;
+#[cfg(test)]
+mod query_tests;
#[cfg(target_arch = "wasm32")]
mod web;
diff --git a/apps/figcraft-web/src/query.rs b/apps/figcraft-web/src/query.rs
new file mode 100644
index 000000000..befeb36b7
--- /dev/null
+++ b/apps/figcraft-web/src/query.rs
@@ -0,0 +1,15 @@
+//! The page's URL: the invite link its fragment names.
+
+/// The invite link in `#join=` (`fragment` is `location.hash`, with or without its `#`), still
+/// escaped. The fragment, unlike the query, never leaves the browser, so the link's secret stays out
+/// of the web host's logs and `Referer` headers. `join` takes the rest of the fragment, so a pasted
+/// `figcraft://join?host=…&file=…&token=…` keeps its own `&`s. Anything longer than an escaped invite
+/// link can be is ignored; what is left is checked by `collab.join` like a link the desktop app is
+/// opened with.
+pub fn join_link(fragment: &str) -> Option<&str> {
+ // An invite link is at most 2 KiB; every byte of it escaped is three.
+ const MAX: usize = 3 * 2048;
+ let fragment = fragment.strip_prefix('#').unwrap_or(fragment);
+ let start = if fragment.starts_with("join=") { 0 } else { fragment.find("&join=")? + 1 };
+ fragment.get(start + "join=".len()..).filter(|link| !link.is_empty() && link.len() <= MAX)
+}
diff --git a/apps/figcraft-web/src/query_tests.rs b/apps/figcraft-web/src/query_tests.rs
new file mode 100644
index 000000000..261ebaeb6
--- /dev/null
+++ b/apps/figcraft-web/src/query_tests.rs
@@ -0,0 +1,29 @@
+//! `#join=` in the page's URL.
+
+use crate::query::join_link;
+
+#[test]
+fn join_takes_the_rest_of_the_fragment() {
+ let link = "figcraft://join?host=192.168.1.20:47900&file=abc&token=AbCdEfGhIjKlMnOpQrStUv";
+ assert_eq!(join_link(&format!("#join={link}")), Some(link), "a pasted link keeps its own &s");
+ assert_eq!(join_link(&format!("#x=1&join={link}")), Some(link), "after other entries");
+ assert_eq!(join_link("#join=figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), Some("figcraft%3A%2F%2Fjoin%3Fhost%3Dh"), "escaped, decoded later");
+ assert_eq!(join_link("join=K7M-2QX-9TD"), Some("K7M-2QX-9TD"), "a join code, no leading #");
+}
+
+#[test]
+fn no_join_without_the_entry() {
+ assert_eq!(join_link(""), None);
+ assert_eq!(join_link("#"), None);
+ assert_eq!(join_link("#join="), None);
+ assert_eq!(join_link("#rejoin=x"), None, "only the whole entry name");
+ assert_eq!(join_link("#xjoin=x&a=1"), None);
+ assert_eq!(join_link("?join=x"), None, "the query isn't read: it goes to the web host");
+}
+
+#[test]
+fn an_overlong_link_is_ignored() {
+ let long = format!("#join=figcraft://join?host=h&file=f&token={}", "a".repeat(7000));
+ assert_eq!(join_link(&long), None);
+ assert_eq!(join_link(&format!("#join={}", "é".repeat(4000))), None, "length counts bytes");
+}
diff --git a/apps/figcraft-web/src/web.rs b/apps/figcraft-web/src/web.rs
index 8cadb0138..f08ca90f2 100644
--- a/apps/figcraft-web/src/web.rs
+++ b/apps/figcraft-web/src/web.rs
@@ -1,7 +1,7 @@
//! The browser shell: web `Services` and the eframe web runner.
use figcraft_engine::Session;
-use figcraft_ui_egui::{FigApp, Services};
+use figcraft_ui_egui::{ContentsFuture, FigApp, Services};
use wasm_bindgen::JsCast as _;
const CANVAS_ID: &str = "figcraft_canvas";
@@ -40,7 +40,13 @@ pub fn start() {
// on the socket wakes the page for a frame.
let ctx = cc.egui_ctx.clone();
session.live.install(Box::new(figcraft_collab_net::NetLink::new(std::sync::Arc::new(move || ctx.request_repaint()))));
- let fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() }));
+ let mut fig = FigApp::new(session, Box::new(WebServices { reduce_motion, ctx: cc.egui_ctx.clone() }));
+ // `#join=`: join that session, as opening an invite link does on the desktop.
+ let hash = web_sys::window().and_then(|w| w.location().hash().ok()).unwrap_or_default();
+ if let Some(link) = crate::query::join_link(&hash) {
+ let link = js_sys::decode_uri_component(link).ok().and_then(|s| s.as_string()).unwrap_or_else(|| link.to_string());
+ figcraft_ui_egui::live::open_invite(&mut fig, &link);
+ }
Ok(Box::new(WebShell { fig }))
}),
)
@@ -69,9 +75,10 @@ impl eframe::App for WebShell {
}
}
-/// Browser services. Open dialogs return nothing for now (the trait's defaults); files are saved
-/// as downloads. Copies go to the system clipboard through egui's output; pastes arrive as paste
-/// events with their text (a page can't read the clipboard when it likes).
+/// Browser services. Files are opened and imported through the browser's file picker, which hands
+/// over their contents (pickers that need a path return nothing, the trait's defaults); files are
+/// saved as downloads. Copies go to the system clipboard through egui's output; pastes arrive as
+/// paste events with their text (a page can't read the clipboard when it likes).
struct WebServices {
/// `prefers-reduced-motion: reduce` (it follows the setting while the page is open).
reduce_motion: Option,
@@ -79,6 +86,16 @@ struct WebServices {
}
impl Services for WebServices {
+ /// An `` taking `exts`, clicked; its file is read once picked.
+ fn pick_open_contents(&mut self, _title: &str, exts: &[&str]) -> Option {
+ let accept = exts.iter().map(|e| format!(".{e}")).collect::>().join(",");
+ Some(Box::pin(async move {
+ pick_file(&accept).await.unwrap_or_else(|e| {
+ log::error!("couldn't open a file: {e:?}");
+ None
+ })
+ }))
+ }
fn downloads(&self) -> bool {
true
}
@@ -130,6 +147,90 @@ impl Services for WebServices {
}
}
+/// The file picked in the browser's file picker (`accept`: the extensions it offers), with its
+/// name; `None` when the picker is cancelled, `Some(Err)` with what to tell the user when the file
+/// can't be read.
+async fn pick_file(accept: &str) -> Result), String>>, wasm_bindgen::JsValue> {
+ let window = web_sys::window().ok_or("no window")?;
+ let document = window.document().ok_or("no document")?;
+ let body = document.body().ok_or("no body")?;
+ let input: web_sys::HtmlInputElement = document.create_element("input")?.dyn_into()?;
+ input.set_type("file");
+ input.set_accept(accept);
+ input.set_hidden(true);
+ // Some browsers (older Safari) open the picker only for an input in the page.
+ body.append_child(&input)?;
+ let (closed, picker) = PickerClosed::new(&window, input.clone());
+ input.click();
+ let result = wasm_bindgen_futures::JsFuture::from(closed).await;
+ let file = input.files().and_then(|files| files.get(0));
+ drop(picker);
+ result?;
+ let Some(file) = file else { return Ok(None) };
+ let name = file.name();
+ if let Err(why) = figcraft_ui_egui::browser_can_read(&name, file.size()) {
+ return Ok(Some(Err(why)));
+ }
+ Ok(Some(match wasm_bindgen_futures::JsFuture::from(file.array_buffer()).await {
+ Ok(buffer) => Ok((name, js_sys::Uint8Array::new(&buffer).to_vec())),
+ Err(e) => {
+ log::error!("couldn't read {name}: {e:?}");
+ Err(figcraft_ui_egui::unreadable(&name))
+ }
+ }))
+}
+
+/// How long after the page gets focus back the file picker counts as closed (milliseconds): a
+/// picked file's `change` can come just after the focus, and must win. A `change` later than this
+/// (a slow cloud-backed file in a browser that never sends `cancel`) counts as a cancel.
+const PICKER_FOCUS_SETTLE_MS: i32 = 1_000;
+
+/// Settles a file picker's promise once: on `change` (a file was picked), on `cancel` (closed
+/// without one) or shortly after the page gets focus back, for browsers that never send `cancel`
+/// (Safari before 16.4), where the pick would otherwise stay pending and block every later one.
+/// Dropping it (also when the pick is abandoned) removes the input, the focus listener and its timer.
+struct PickerClosed {
+ window: web_sys::Window,
+ input: web_sys::HtmlInputElement,
+ _settle: wasm_bindgen::closure::Closure,
+ on_focus: wasm_bindgen::closure::Closure,
+ timer: std::rc::Rc>>,
+}
+
+impl PickerClosed {
+ fn new(window: &web_sys::Window, input: web_sys::HtmlInputElement) -> (js_sys::Promise, Self) {
+ let resolve = std::rc::Rc::new(std::cell::RefCell::new(None::));
+ let slot = resolve.clone();
+ let closed = js_sys::Promise::new(&mut |res, _rej| *slot.borrow_mut() = Some(res));
+ let settle = wasm_bindgen::closure::Closure::::new(move || {
+ if let Some(res) = resolve.borrow_mut().take() {
+ let _ = res.call0(&wasm_bindgen::JsValue::NULL);
+ }
+ });
+ let _ = input.add_event_listener_with_callback("change", settle.as_ref().unchecked_ref());
+ let _ = input.add_event_listener_with_callback("cancel", settle.as_ref().unchecked_ref());
+ let timer = std::rc::Rc::new(std::cell::Cell::new(None));
+ let (w, t, f) = (window.clone(), timer.clone(), settle.as_ref().unchecked_ref::().clone());
+ let on_focus = wasm_bindgen::closure::Closure::::new(move || {
+ if t.get().is_none() {
+ t.set(w.set_timeout_with_callback_and_timeout_and_arguments_0(&f, PICKER_FOCUS_SETTLE_MS).ok());
+ }
+ });
+ let _ = window.add_event_listener_with_callback("focus", on_focus.as_ref().unchecked_ref());
+ (closed, Self { window: window.clone(), input, _settle: settle, on_focus, timer })
+ }
+}
+
+impl Drop for PickerClosed {
+ fn drop(&mut self) {
+ if let Some(t) = self.timer.take() {
+ self.window.clear_timeout_with_handle(t);
+ }
+ let _ = self.window.remove_event_listener_with_callback("focus", self.on_focus.as_ref().unchecked_ref());
+ self.input.remove();
+ }
+}
+
fn download(name: &str, bytes: &[u8]) -> Result<(), wasm_bindgen::JsValue> {
let window = web_sys::window().ok_or("no window")?;
let document = window.document().ok_or("no document")?;
diff --git a/apps/figcraft/Cargo.toml b/apps/figcraft/Cargo.toml
index bafb6da14..fac4842b1 100644
--- a/apps/figcraft/Cargo.toml
+++ b/apps/figcraft/Cargo.toml
@@ -21,7 +21,7 @@ eframe = { workspace = true, features = ["default_fonts", "wgpu", "accesskit", "
serde_json = { workspace = true }
log = { workspace = true }
rfd = { workspace = true }
-arboard = { workspace = true, features = ["image-data"] }
+arboard = { workspace = true, features = ["image-data", "wayland-data-control"] }
webbrowser = { workspace = true }
image = { workspace = true }
env_logger = { version = "0.11", default-features = false, features = ["auto-color", "humantime"] }
@@ -43,3 +43,9 @@ wat = { workspace = true }
[build-dependencies]
winresource = "0.1"
+
+[target.'cfg(target_os = "linux")'.dependencies]
+# Use vector window controls without a title-font renderer or embedded Cantarell.
+winit = { version = "0.30", default-features = false, features = ["wayland-csd-adwaita-notitle"] }
+raw-window-handle = "0.6"
+wayland-client = "0.31"
diff --git a/apps/figcraft/src/apple_events.rs b/apps/figcraft/src/apple_events.rs
index 6b7920944..41ae5cc36 100644
--- a/apps/figcraft/src/apple_events.rs
+++ b/apps/figcraft/src/apple_events.rs
@@ -50,7 +50,7 @@ pub fn poll(inbox: &Inbox, fig: &mut FigApp, ctx: &egui::Context) {
/// Open `paths` as File › Open does; a file that fails shows its error and the others still open.
pub fn open_documents(fig: &mut FigApp, paths: Vec) {
for p in paths {
- if fig.run("file.open", json!({"path": p.to_string_lossy()})).is_some() {
+ if fig.run_user("file.open", json!({"path": p.to_string_lossy()})).is_some() {
fig.ui.home = false;
}
}
diff --git a/apps/figcraft/src/args.rs b/apps/figcraft/src/args.rs
index 2e3099cbf..436df61f8 100644
--- a/apps/figcraft/src/args.rs
+++ b/apps/figcraft/src/args.rs
@@ -1,16 +1,26 @@
-//! The command line: `figcraft [--control ] [files…] [figcraft://join?…]`. An invite link
+//! The command line: `figcraft [--control ] [--automation-read-root ]…
+//! [--automation-write-root ]… [files…] [figcraft://join?…]`. An invite link
//! (what the system passes when a `figcraft://` link is opened) joins that session once the window
//! is up; everything else that isn't a flag is a file to open, as a path or a `file://` URL (the
-//! Linux desktop entry passes URLs, `%U`, so that it can also hand over invite links).
+//! Linux desktop entry passes URLs, `%U`, so that it can also hand over invite links). Any other
+//! `--flag` is unknown and stops the app at startup (#836): a mistyped root flag must never leave
+//! the app running unconfined. After a bare `--`, every argument is a file.
/// What the app was started with.
#[derive(Debug, Default, PartialEq, Eq)]
pub struct Args {
- /// `--control `: the JSON-lines control server.
+ /// `--control ` (or `--control=`): the JSON-lines control server.
pub control: Option,
pub files: Vec,
/// The last invite link given.
pub join: Option,
+ /// `--automation-read-root ` / `--automation-write-root ` (each repeatable; `=` works
+ /// too): the folders the app's file access is confined to. A flag without a value gives `""`,
+ /// which is refused at startup.
+ pub read_roots: Vec,
+ pub write_roots: Vec,
+ /// `--flags` the app doesn't know, as given.
+ pub unknown: Vec,
}
/// An invite link rather than a file (`figcraft:` links, in any case).
@@ -49,13 +59,27 @@ pub fn parse(args: &[String]) -> Args {
let mut out = Args::default();
let mut it = args.iter();
while let Some(a) = it.next() {
- if a == "--control" {
- out.control = it.next().and_then(|p| p.parse().ok());
+ if a == "--" {
+ out.files.extend(it.by_ref().cloned());
+ break;
+ }
+ let (flag, inline) = a.split_once('=').map_or((a.as_str(), None), |(f, v)| (f, Some(v.to_string())));
+ let roots = match flag {
+ "--automation-read-root" => Some(&mut out.read_roots),
+ "--automation-write-root" => Some(&mut out.write_roots),
+ _ => None,
+ };
+ if let Some(roots) = roots {
+ roots.push(inline.or_else(|| it.next().cloned()).unwrap_or_default());
+ } else if flag == "--control" {
+ out.control = inline.or_else(|| it.next().cloned()).and_then(|p| p.parse().ok());
} else if is_invite(a) {
out.join = Some(a.clone());
} else if let Some(path) = file_url_path(a) {
out.files.push(path);
- } else if !a.starts_with("--") {
+ } else if a.starts_with("--") {
+ out.unknown.push(a.clone());
+ } else {
out.files.push(a.clone());
}
}
diff --git a/apps/figcraft/src/args_tests.rs b/apps/figcraft/src/args_tests.rs
index 0ed404c8f..b274bedab 100644
--- a/apps/figcraft/src/args_tests.rs
+++ b/apps/figcraft/src/args_tests.rs
@@ -9,13 +9,44 @@ fn args(a: &[&str]) -> Vec {
#[test]
fn files_and_the_control_port() {
assert_eq!(parse(&args(&[])), Args::default());
- let a = parse(&args(&["--control", "4242", "a.figcraft", "--verbose", "b.svg"]));
- assert_eq!(a, Args { control: Some(4242), files: args(&["a.figcraft", "b.svg"]), join: None });
+ let a = parse(&args(&["--control", "4242", "a.figcraft", "b.svg"]));
+ assert_eq!(a, Args { control: Some(4242), files: args(&["a.figcraft", "b.svg"]), ..Args::default() });
// A missing or bad port is ignored, not taken as a file.
assert_eq!(parse(&args(&["--control"])), Args::default());
assert_eq!(parse(&args(&["--control", "nope"])).control, None);
}
+#[test]
+fn the_control_port_accepts_the_equals_form() {
+ let a = parse(&args(&["--control=7980", "a.figcraft"]));
+ assert_eq!(a, Args { control: Some(7980), files: args(&["a.figcraft"]), ..Args::default() });
+ // A bad port is ignored, not taken as a file.
+ assert_eq!(parse(&args(&["--control=nope"])), Args::default());
+}
+
+#[test]
+fn automation_roots_repeat_and_are_never_files() {
+ let a = parse(&args(&["--automation-read-root", "in", "--automation-write-root=out", "--automation-read-root=more", "a.figcraft"]));
+ assert_eq!(a.read_roots, args(&["in", "more"]));
+ assert_eq!(a.write_roots, args(&["out"]));
+ assert_eq!(a.files, args(&["a.figcraft"]));
+ // A flag without its folder is kept as an empty one, which startup refuses.
+ assert_eq!(parse(&args(&["--automation-write-root"])).write_roots, args(&[""]));
+}
+
+#[test]
+fn unknown_flags_are_refused_never_ignored() {
+ // #836: a mistyped root flag (or one an older release lacks) must stop the app, not start it
+ // unconfined. Both forms, with and without `=`.
+ let a = parse(&args(&["--automation-write-roots", "out", "--automation-write-dir=out", "--verbose", "a.figcraft"]));
+ assert_eq!(a.unknown, args(&["--automation-write-roots", "--automation-write-dir=out", "--verbose"]));
+ assert!(a.write_roots.is_empty());
+ // Single-dash arguments are left as they were (files); after `--` everything is a file.
+ let a = parse(&args(&["--control", "1", "--", "--odd.figcraft", "--automation-write-root=x"]));
+ assert_eq!(a.files, args(&["--odd.figcraft", "--automation-write-root=x"]));
+ assert!(a.unknown.is_empty() && a.write_roots.is_empty());
+}
+
#[test]
fn invite_links_join_instead_of_opening() {
let link = "figcraft://join?host=192.168.1.20:47900&file=abc&token=AbCdEfGhIjKlMnOpQrStUv";
diff --git a/apps/figcraft/src/control_server_tests.rs b/apps/figcraft/src/control_server_tests.rs
index d243fb916..008170fbb 100644
--- a/apps/figcraft/src/control_server_tests.rs
+++ b/apps/figcraft/src/control_server_tests.rs
@@ -160,7 +160,11 @@ fn connection_limit_rejects_excess_clients_and_reuses_finished_slots() {
assert_eq!(workers.len(), 1);
client.write_all(b"invalid\n").unwrap();
assert_eq!(reply(&mut BufReader::new(client.try_clone().unwrap()))["ok"], false);
- client.shutdown(Shutdown::Both).unwrap();
+ // The server closes this connection after answering an invalid request, and shutting down
+ // a socket whose peer has already closed is ENOTCONN on macOS and the BSDs where Linux
+ // returns Ok. Closing the client is what the worker is waiting for, so the result is moot:
+ // the other shutdowns in this file run while the peer is still open and stay checked.
+ let _ = client.shutdown(Shutdown::Both);
workers.pop().unwrap().join().unwrap();
}
diff --git a/apps/figcraft/src/linux_window.rs b/apps/figcraft/src/linux_window.rs
new file mode 100644
index 000000000..f47b61e03
--- /dev/null
+++ b/apps/figcraft/src/linux_window.rs
@@ -0,0 +1,112 @@
+//! Request winit's frame only on Wayland compositors without xdg-decoration.
+//! Desktop/session names cannot identify the backend of an individual window.
+
+use std::os::unix::net::UnixStream;
+use std::path::PathBuf;
+use std::sync::mpsc;
+use std::time::Duration;
+
+use raw_window_handle::{HasDisplayHandle, RawDisplayHandle};
+use wayland_client::globals::{GlobalListContents, registry_queue_init};
+use wayland_client::protocol::wl_registry;
+use wayland_client::{Connection, Dispatch, QueueHandle};
+
+/// Capture the socket path before winit consumes an inherited WAYLAND_SOCKET.
+/// Never consume, duplicate or query that inherited connection: there may be no
+/// independently addressable display, or WAYLAND_DISPLAY may name another server.
+pub fn display_socket() -> Option {
+ if std::env::var_os("WAYLAND_SOCKET").is_some_and(|s| !s.is_empty()) {
+ return None;
+ }
+ let display = std::env::var_os("WAYLAND_DISPLAY").filter(|s| !s.is_empty())?;
+ let path = PathBuf::from(display);
+ if path.is_absolute() {
+ Some(path)
+ } else {
+ std::env::var_os("XDG_RUNTIME_DIR").filter(|s| !s.is_empty()).map(|dir| PathBuf::from(dir).join(path))
+ }
+}
+
+pub fn needs_native_frame(cc: &eframe::CreationContext<'_>, socket: Option) -> bool {
+ let wayland = cc.display_handle().is_ok_and(|h| matches!(h.as_raw(), RawDisplayHandle::Wayland(_)));
+ if !wayland {
+ log::debug!("window controls: non-Wayland window, retaining custom controls");
+ return false;
+ }
+ let server_decorations = socket.and_then(probe);
+ log::debug!("window controls: Wayland xdg-decoration available: {server_decorations:?}");
+ native_frame(wayland, server_decorations)
+}
+
+fn native_frame(wayland: bool, server_decorations: Option) -> bool {
+ wayland && server_decorations == Some(false)
+}
+
+fn probe(socket: PathBuf) -> Option {
+ // The compositor must not be able to block startup on a registry roundtrip.
+ // On failure/timeout retain FigCraft's own working title bar and buttons.
+ let (send, receive) = mpsc::sync_channel(1);
+ std::thread::Builder::new()
+ .name("wayland-decorations".into())
+ .spawn(move || {
+ let _ = send.send(registry_has_decorations(socket));
+ })
+ .ok()?;
+ receive.recv_timeout(Duration::from_millis(500)).ok().flatten()
+}
+
+fn registry_has_decorations(socket: PathBuf) -> Option {
+ // A fresh connection leaves winit's event queue and inherited descriptors alone.
+ let stream = UnixStream::connect(socket).ok()?;
+ let connection = Connection::from_socket(stream).ok()?;
+ let (globals, _queue) = registry_queue_init::(&connection).ok()?;
+ Some(globals.contents().with_list(|list| list.iter().any(|g| g.interface == "zxdg_decoration_manager_v1")))
+}
+
+struct Registry;
+
+impl Dispatch for Registry {
+ fn event(
+ _state: &mut Self,
+ _registry: &wl_registry::WlRegistry,
+ _event: wl_registry::Event,
+ _data: &GlobalListContents,
+ _connection: &Connection,
+ _queue: &QueueHandle,
+ ) {
+ }
+}
+
+#[cfg(test)]
+mod tests {
+ #[test]
+ fn only_wayland_without_server_decorations_uses_the_frame() {
+ for (wayland, server_decorations, expected) in [
+ (false, None, false),
+ (false, Some(false), false),
+ (false, Some(true), false),
+ (true, Some(true), false),
+ (true, Some(false), true),
+ (true, None, false),
+ ] {
+ assert_eq!(super::native_frame(wayland, server_decorations), expected);
+ }
+ }
+
+ #[test]
+ fn an_unavailable_display_keeps_the_custom_controls() {
+ assert_eq!(super::probe("/nonexistent/figcraft-wayland-test".into()), None);
+ }
+
+ #[test]
+ fn an_unresponsive_display_cannot_block_window_startup() -> std::io::Result<()> {
+ let socket = std::env::temp_dir().join(format!("figcraft-decoration-timeout-{}", std::process::id()));
+ let listener = std::os::unix::net::UnixListener::bind(&socket)?;
+ let start = std::time::Instant::now();
+ assert_eq!(super::probe(socket.clone()), None);
+ assert!(start.elapsed() < std::time::Duration::from_secs(2));
+ drop(listener);
+ let _ = std::fs::remove_file(socket);
+ Ok(())
+ }
+}
diff --git a/apps/figcraft/src/main.rs b/apps/figcraft/src/main.rs
index fdcc66f9e..00856c5d5 100644
--- a/apps/figcraft/src/main.rs
+++ b/apps/figcraft/src/main.rs
@@ -6,6 +6,12 @@
//! `--control ` (or `FIGCRAFT_CONTROL_PORT`) starts a localhost JSON-lines control server:
//! `{"id":1,"method":"engine.execute","params":{"command":"shape.rectangle","params":{"x":0,"y":0,"width":100,"height":100}}}`
//! → `{"id":1,"ok":true,"result":{…}}`. Methods: `figcraft_ui_egui::control`.
+//!
+//! `--automation-read-root ` / `--automation-write-root ` (each repeatable) confine the
+//! files the window and the control channel read and write (`figcraft_engine::file_access`); the
+//! app's own folders (settings, recovery copies, installed plugins) and opening the files given on
+//! the command line are not. A root that isn't an existing folder stops the app at startup, and so
+//! does any flag the app doesn't know (a mistyped root flag must not start the app unconfined).
#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
#![cfg_attr(all(target_os = "windows", not(debug_assertions)), windows_subsystem = "windows")]
@@ -15,6 +21,8 @@ mod args;
mod control_server;
mod gamepad;
mod graphics;
+#[cfg(target_os = "linux")]
+mod linux_window;
mod recovery;
mod services;
mod startup;
@@ -100,10 +108,13 @@ impl eframe::App for App {
}
fn on_exit(&mut self) {
- with_app(|fig| services::save_state(fig));
- if let Some(r) = recovery::lock(&self.recovery).take() {
- r.finish();
- }
+ // With the app out of reach (busy), its recovery copies stay for the next start.
+ let copies = recovery::lock(&self.recovery).take();
+ with_app(|fig| services::shutdown(fig, services::config_dir().as_deref(), copies));
+ // Everything is kept: end before the windows' teardown, where AppKit's Touch Bar support
+ // throws on the content view AccessKit restores (craft-libs#3, #781).
+ #[cfg(target_os = "macos")]
+ std::process::exit(0);
}
}
@@ -119,6 +130,23 @@ fn main() -> eframe::Result {
return Ok(());
}
let args = args::parse(&args);
+ if let Some(flag) = args.unknown.first() {
+ eprintln!(
+ "FigCraft: unknown option {flag}\nUsage: figcraft [--control PORT] [--automation-read-root DIR]... [--automation-write-root DIR]... [FILE | figcraft://join?...]..."
+ );
+ std::process::exit(2);
+ }
+ let roots = match (
+ args.read_roots.is_empty() && args.write_roots.is_empty(),
+ figcraft_engine::file_access::Roots::new(&args.read_roots, &args.write_roots),
+ ) {
+ (true, _) => None,
+ (false, Ok(r)) => Some(Arc::new(r)),
+ (false, Err(e)) => {
+ eprintln!("FigCraft: {e}");
+ std::process::exit(2);
+ }
+ };
let port = args.control.or_else(|| std::env::var("FIGCRAFT_CONTROL_PORT").ok().and_then(|p| p.parse().ok()));
// System fonts: index them in the background, then wake the UI (an idle window draws no frames)
// to lay text out again with them.
@@ -143,6 +171,7 @@ fn main() -> eframe::Result {
log::error!("{f}: {e}");
}
}
+ let opened: Vec = session.docs.iter().map(|d| d.uid).collect();
// Documents a crashed or killed run left unsaved come back; this run keeps its own copies.
let recovery_root = services::config_dir().map(|d| d.join("Recovery"));
// The preferences first: they hold the online files a recovered document may be one of.
@@ -164,17 +193,18 @@ fn main() -> eframe::Result {
// default, never a build from source unless asked).
session.live.links = figcraft_collab_net::links::system();
session.invite_links_startup();
- // A first run (no settings kept yet, nothing to open) starts on the home screen, with its
- // tips and templates; later runs start in a new file.
let first_run = svc.prefs.is_none() && args.join.is_none();
- if session.docs.is_empty() && !first_run {
+ if session.docs.is_empty() && opens_new_file(first_run, session.prefs.start_on_home, port.is_some()) {
let _ = session.execute("file.new", &json!({}));
}
// The interface language from the first frame on, and for the message when the window can't
// open (no frame then).
figcraft_ui_egui::i18n::set(&session.prefs.language, figcraft_ui_egui::Services::system_language(&svc).as_deref());
let mut fig = FigApp::new(session, Box::new(svc));
+ fig.automation_roots = roots;
fig.ui.home = false;
+ // Files named on the command line are the user's too: their missing fonts are listed.
+ fig.ui.font_checks = opened;
fig.note_recovered(recovered.copies);
if let Some(link) = &args.join {
figcraft_ui_egui::live::open_invite(&mut fig, link);
@@ -192,21 +222,18 @@ fn main() -> eframe::Result {
.with_inner_size([1440.0, 900.0])
.with_min_inner_size([800.0, 500.0])
.with_drag_and_drop(true);
- // The tab strip is the title bar: macOS keeps its window buttons inset into it; elsewhere the
- // window is frameless and FigCraft draws the buttons and resize edges.
- if cfg!(target_os = "macos") {
- viewport = viewport.with_fullsize_content_view(true).with_titlebar_shown(false).with_title_shown(false);
- fig.ui.title_bar = figcraft_ui_egui::TitleBar::Inset;
- } else {
- viewport = viewport.with_decorations(false);
- fig.ui.title_bar = figcraft_ui_egui::TitleBar::Custom;
- }
+ // Start frameless on Linux; the app creator checks the actual display backend
+ // before enabling a client-side frame. Other windows inherit that decision.
+ fig.ui.title_bar = desktop_title_bar();
+ viewport = window_chrome(viewport, fig.ui.title_bar);
if let Some(icon) = icon {
viewport = viewport.with_icon(icon);
}
let mut options = eframe::NativeOptions { viewport, renderer: eframe::Renderer::Wgpu, ..Default::default() };
graphics::configure(&mut options.wgpu_options);
figcraft_ui_egui::windows::install(fig);
+ #[cfg(target_os = "linux")]
+ let linux_display = linux_window::display_socket();
// Registered before the event loop starts, so it catches the Finder event that launched the app
// as well as later ones. Lives until the event loop returns; the app creator only borrows it.
#[cfg(target_os = "macos")]
@@ -217,6 +244,11 @@ fn main() -> eframe::Result {
"FigCraft",
options,
Box::new(move |_cc| {
+ #[cfg(target_os = "linux")]
+ if linux_window::needs_native_frame(_cc, linux_display) {
+ let _ = with_app(|fig| fig.ui.title_bar = figcraft_ui_egui::TitleBar::Native);
+ _cc.egui_ctx.send_viewport_cmd(egui::ViewportCommand::Decorations(true));
+ }
Ok(Box::new(App {
queue,
ctx_slot,
@@ -233,3 +265,49 @@ fn main() -> eframe::Result {
}
result
}
+
+/// With nothing to open, whether the window starts in a new file rather than on the home screen.
+/// A first run (no settings kept yet) shows the home screen's tips and templates, and later runs
+/// start in a new file unless the preference asks for Home, which `--control` overrides: its
+/// callers expect a document to act on.
+fn opens_new_file(first_run: bool, start_on_home: bool, control: bool) -> bool {
+ !first_run && (!start_on_home || control)
+}
+
+fn desktop_title_bar() -> figcraft_ui_egui::TitleBar {
+ use figcraft_ui_egui::TitleBar;
+ if cfg!(target_os = "macos") { TitleBar::Inset } else { TitleBar::Custom }
+}
+
+fn window_chrome(viewport: egui::ViewportBuilder, title_bar: figcraft_ui_egui::TitleBar) -> egui::ViewportBuilder {
+ use figcraft_ui_egui::TitleBar;
+ match title_bar {
+ TitleBar::Inset => viewport.with_fullsize_content_view(true).with_titlebar_shown(false).with_title_shown(false),
+ TitleBar::Native => viewport.with_decorations(true),
+ TitleBar::Custom => viewport.with_decorations(false),
+ }
+}
+
+#[cfg(all(test, target_os = "linux"))]
+mod linux_window_tests {
+ #[test]
+ fn linux_starts_with_the_existing_frameless_title_bar() {
+ let bar = super::desktop_title_bar();
+ assert_eq!(bar, figcraft_ui_egui::TitleBar::Custom);
+ let viewport = super::window_chrome(egui::ViewportBuilder::default(), bar);
+ assert_eq!(viewport.decorations, Some(false));
+ }
+}
+
+#[cfg(test)]
+mod start_tests {
+ use super::opens_new_file;
+
+ #[test]
+ fn the_home_preference_starts_on_home_except_for_control_callers() {
+ assert!(opens_new_file(false, false, false), "a new file by default");
+ assert!(!opens_new_file(false, true, false), "Home when the preference asks");
+ assert!(opens_new_file(false, true, true), "--control still starts with a document");
+ assert!(!opens_new_file(true, false, false), "a first run shows the home screen");
+ }
+}
diff --git a/apps/figcraft/src/recovery.rs b/apps/figcraft/src/recovery.rs
index b2614598f..06b0cbeb7 100644
--- a/apps/figcraft/src/recovery.rs
+++ b/apps/figcraft/src/recovery.rs
@@ -120,8 +120,7 @@ impl Recovery {
(0..10).find_map(|n| {
let dir = root.join(if n == 0 { pid.to_string() } else { format!("{pid}-{n}") });
std::fs::create_dir_all(&dir).ok()?;
- let lock = File::options().write(true).create(true).truncate(false).open(dir.join(LOCK)).ok()?;
- lock.try_lock().ok()?;
+ let lock = lock_folder(&dir).ok()?;
Some(Self { dir, _lock: lock, written: HashMap::new(), next: 0.0, waiting: Vec::new() })
})
}
@@ -250,6 +249,17 @@ impl Recovery {
self.written.insert(uid, Copy { done: None, flight: Some((vec![revision], writer)) });
}
+ /// Quitting: a normal quit ([`finish`](Self::finish)) when the unsaved-changes question was
+ /// `asked` or nothing is unsaved. Otherwise (macOS's Quit menu ends the app without asking) the
+ /// unsaved documents are copied and the copies stay for the next start, as after a crash.
+ pub fn quit(mut self, s: &Session, asked: bool) {
+ if asked || !s.docs.iter().any(|d| needs_copy(s, d)) {
+ return self.finish();
+ }
+ self.write(s, true);
+ self.settle(s);
+ }
+
/// A normal quit: the documents were saved or their changes discarded on purpose. (Earlier
/// runs' copies still waiting for their outcome stay for the next start.)
pub fn finish(self) {
@@ -282,6 +292,17 @@ fn remove_kept(w: Waiting) {
/// The extension of the note beside the copy of a document that is one of your online files.
const ONLINE: &str = "online";
+/// How long the startup waits, once, for folder locks that may free themselves (#334).
+#[cfg(unix)]
+const LOCK_WAIT: std::time::Duration = std::time::Duration::from_millis(100);
+
+/// Lock the folder `dir` (`WouldBlock` while another process holds it).
+fn lock_folder(dir: &Path) -> Result {
+ let lock = File::options().write(true).create(true).truncate(false).open(dir.join(LOCK)).map_err(std::fs::TryLockError::Error)?;
+ lock.try_lock()?;
+ Ok(lock)
+}
+
/// The copy at `file` is of one of your online files: join that file again as its owner, keeping
/// the copy to compare with what arrives. The session, or `None` when the copy isn't one (or its
/// file isn't recorded any more, or is open already): then it opens as any other copy.
@@ -351,6 +372,7 @@ pub fn recover_all(root: &Path, s: &mut Session) -> Recovered {
}
}
};
+ let (mut free, mut held) = (Vec::new(), Vec::new());
for e in entries.flatten() {
let path = e.path();
if !path.is_dir() {
@@ -358,10 +380,22 @@ pub fn recover_all(root: &Path, s: &mut Session) -> Recovered {
continue;
}
// Still running (another window of the app), or not ours to take.
- let Ok(lock) = File::options().write(true).create(true).truncate(false).open(path.join(LOCK)) else { continue };
- if lock.try_lock().is_err() {
- continue;
+ match lock_folder(&path) {
+ Ok(lock) => free.push((path, lock)),
+ Err(std::fs::TryLockError::WouldBlock) => held.push(path),
+ Err(_) => {}
}
+ }
+ // A child between its `fork` and its `exec` shares the run's open descriptors, and a `flock`
+ // lasts while any of them is open, so an ended run's folder can look held for a moment. Wait
+ // once, however many folders are held, and try those again (#334). Windows doesn't pass the
+ // lock to child processes.
+ #[cfg(unix)]
+ if !held.is_empty() {
+ std::thread::sleep(LOCK_WAIT);
+ free.extend(held.into_iter().filter_map(|path| lock_folder(&path).ok().map(|lock| (path, lock))));
+ }
+ for (path, lock) in free {
let lock = Arc::new(lock);
let files: Vec = std::fs::read_dir(&path).into_iter().flatten().flatten().map(|f| f.path()).collect();
for f in &files {
diff --git a/apps/figcraft/src/recovery_tests.rs b/apps/figcraft/src/recovery_tests.rs
index a3d608f9d..0322e2374 100644
--- a/apps/figcraft/src/recovery_tests.rs
+++ b/apps/figcraft/src/recovery_tests.rs
@@ -167,6 +167,23 @@ fn a_normal_quit_removes_the_recovered_copies_it_took_over() {
let _ = std::fs::remove_dir_all(&root);
}
+#[test]
+fn quitting_without_the_unsaved_question_keeps_copies_for_the_next_start() {
+ let root = root("quitunasked");
+ // macOS's Quit menu: nothing asked, so the unsaved document comes back next time.
+ let s = edited();
+ Recovery::start(&root).unwrap().quit(&s, false);
+ let mut next = Session::empty();
+ assert_eq!(recover(&root, &mut next), 1);
+ let _ = std::fs::remove_dir_all(&root);
+ // Asked (saved or discarded on purpose), or nothing unsaved: nothing is left.
+ for (s, asked) in [(edited(), true), (Session::new(), false)] {
+ Recovery::start(&root).unwrap().quit(&s, asked);
+ assert!(std::fs::read_dir(&root).unwrap().next().is_none(), "asked: {asked}");
+ }
+ let _ = std::fs::remove_dir_all(&root);
+}
+
#[test]
fn a_run_whose_folder_name_is_still_held_takes_another() {
let root = root("pidreuse");
@@ -186,6 +203,29 @@ fn a_run_whose_folder_name_is_still_held_takes_another() {
let _ = std::fs::remove_dir_all(&root);
}
+/// #334: a lock that frees itself is not a run that is still going. A child between its `fork` and
+/// its `exec` inherits the run's open descriptors and a `flock` lasts while any descriptor for the
+/// file is open, so a crashed run's copies must still come back once that child has exec'd.
+#[cfg(unix)]
+#[test]
+fn a_lock_freed_a_moment_later_is_not_a_run_that_is_still_going() {
+ let root = root("fork-window");
+ crashed(&edited(), &root);
+ // Hold the crashed run's folder lock on a second descriptor, the way a child forked before its
+ // exec holds it, and free it shortly after.
+ let lock = std::fs::File::options().write(true).create(true).truncate(false).open(root.join("crashed").join("lock")).unwrap();
+ lock.try_lock().unwrap();
+ let freed = std::thread::spawn(move || {
+ std::thread::sleep(std::time::Duration::from_millis(10));
+ drop(lock);
+ });
+ // The next start waits for that lock rather than reading the run as still going.
+ let mut next = Session::empty();
+ assert_eq!(recover(&root, &mut next), 1, "the copies come back once the lock frees itself");
+ freed.join().unwrap();
+ let _ = std::fs::remove_dir_all(&root);
+}
+
/// The rectangles in `doc`.
fn rectangles(doc: &figcraft_engine::doc::Document) -> usize {
doc.nodes().filter(|n| matches!(n.kind, figcraft_engine::doc::NodeKind::Rectangle)).count()
diff --git a/apps/figcraft/src/services.rs b/apps/figcraft/src/services.rs
index bd8a42043..7ee41ada0 100644
--- a/apps/figcraft/src/services.rs
+++ b/apps/figcraft/src/services.rs
@@ -167,10 +167,18 @@ fn reveal(path: &Path) -> std::io::Result<()> {
/// The preferences' file in the config folder.
const STATE: &str = "state.json";
-pub fn save_state(app: &FigApp) {
- if let Some(dir) = config_dir() {
- write_prefs(&dir, &app.session.prefs);
+/// Everything quitting keeps, all done when it returns (macOS then ends the process): the
+/// preferences in `dir`, this run's recovery copies ([`Recovery::quit`](crate::recovery::Recovery::quit))
+/// and the live sessions' ends (one this app hosts tells everyone and stops; a joined one leaves).
+pub fn shutdown(app: &mut FigApp, dir: Option<&Path>, recovery: Option) {
+ if let Some(dir) = dir {
+ write_prefs(dir, &app.session.prefs);
}
+ // Before the sessions end: a recovered online file's copy waits for its session's outcome.
+ if let Some(r) = recovery {
+ r.quit(&app.session, app.ui.quit);
+ }
+ drop(std::mem::take(&mut app.session.live));
}
/// Write `prefs` to `dir` atomically (a temporary file renamed over the old one: a crash leaves
@@ -223,12 +231,47 @@ fn picked(pick: impl Future
+ 
