2 Commits

Include renames

Author	SHA1	Message	Date
bflatastic	94349d86b0	M9: live sessions per document ... Live sessions are per document instead of one for the whole app. - **Engine** (`crates/engine/src/live.rs`): `Session.live` is now `Lives`: the app-wide parts (the installed link, the invite-link registration) plus one `Live` per session. One place resolves "the session of this document": `Session::live()` (the active document's; status off when it has none), `live_mut()`, `live_of(uid)`. Sync, undo, read-only checks, follow, cursor chat, spotlight and presence all go through the session of the document they are about, so edits and presence never cross. Sessions behind the active tab keep syncing; your presence there is empty. - **Link** (`LiveLink`): every call takes the `SessionId` the engine picked and `poll` returns `(SessionId, Event)`, so one link carries several sessions. The desktop link and the browser link keep them in a shared table with one mailbox per session (`crates/collab-net/src/sessions.rs`); each hosted document listens on its own port. - **Commands**: `collab.*` act on the active document's session; no parameters changed. `collab.peers` keeps its shape and gains `session` (its id, null when the document isn't in one) and `sessions` (every session: `{session, document, status, reason, role, fileName, link, peers}`). `collab.join` returns the new session and opens its file in a tab of its own without touching other sessions; until then (or if it fails) it shows on the tab it was started from. Starting a session for a document replaces only that document's own session. Closing a document ends its session only. - **UI** (`crates/ui-egui/src/live.rs`): the Share popover, avatars, cursors, chat, spotlight banner, follow frame and read-only reason read the session of the tab in front, per window. What belongs to one session in the window (cursors shown, your chat box, a report being written) is dropped when another tab comes to the front. `ui.inspect`'s `live` gains `session` and `sessions`. No new strings or command ids. - **Docs**: `docs/collab-protocol.md`, `docs/mcp.md`, `docs/control-protocol.md`, `docs/collaboration-parity.md`, `docs/gaps.md` (gap 2), `ROADMAP.md`.	2026-10-12 17:54:18 +07:00
bflatastic	def6f84b22	M11: plugin directory on figcraft-server ... A self-hosted plugin directory, with no third-party service: `figcraft-server` keeps plugin bundles, the app browses, installs and updates from it, and `figcraft-cli` publishes to it. - **Bundles** (`figcraft_plugin::bundle`): a plugin's manifest, module and up to 32 plain-named assets in one uncompressed, length-prefixed binary form (nothing can expand beyond the bytes sent). Its SHA-256 names it. `Bundle::decode` never allocates beyond its input and refuses trailing bytes; `Bundle::check` parses the manifest (refusing a plugin API this build doesn't run), requires a version of 1-4 numbers, compiles the module without running it (only the sandbox's imports allowed) and checks asset names (no paths, no dot files, no Windows device names, unique ignoring case). Manifests gain an optional `author`. - **Protocol**: a new connection kind next to managing and team-library connections: `OpenPlugins {key}` then `Plugins {list | fetch | publish | unpublish}`. Browsing needs no credential; publishing and unpublishing need the server key (a wrong key is refused). Older servers refuse the connection and the app says the server has no plugin directory. The protocol version is unchanged; old clients are unaffected. - **Server** (`apps/figcraft-server/src/directory.rs`): `<data>/plugins/index.json` plus `<data>/plugins/<sha256>.bin`, so no publisher-chosen name reaches the file system. Every publish is checked in full and must be a newer version; caps `max_plugins` (versions, 0 turns it off), `max_plugin_mb` (<= 32), `max_plugins_mb`. Fetches re-hash the file before sending (a damaged bundle is never sent) and share a download budget (~32 MiB/s) so a flood is refused, not queued. Damaged index entries are skipped and reported, never deleted; an unreadable index lists nothing and refuses writes until the operator fixes it. Operator moderation: `figcraft-server plugins [list]` and `plugins remove ID [--version V]` (offline or through the running server). Logs name ids and versions, never keys. - **App**: Plugins > Manage plugins gets Installed / Browse tabs. Browse lists a server's plugins (version, author as typed, size, access) with a search; nothing is fetched until Browse is pressed. Install / Update open a confirmation listing the permissions asked for, the source and the SHA-256; only its button downloads. The download must match the listed SHA-256 (and the one shown), then is checked like an imported plugin before anything is written. Installed plugins live per user under `<settings>/FigCraft/Plugins/<hash of id>/` and run in the same sandbox; Remove deletes the folder. - **Commands**: `plugin.directory.list {server?, query?}`, `plugin.directory.install {id, version?, confirm, server?, sha256?}` (refused without `confirm: true`; never opens a dialog), `plugin.directory.publish {path | plugin, server}`, `plugin.directory.unpublish {id, version?, server}`. `ui.set {pluginsTab, pluginConfirm}` on the control channel. - **CLI**: `figcraft-cli plugin publish FOLDER --server ws://host:port/` with the key from `FIGCRAFT_SERVER_KEY` (or `?key=`), never printed. - Docs: plugins.md (directories, publishing, commands, manifest), server.md (operating the directory: access, checks, caps, moderation, backups, security), collab-protocol.md, mcp.md, cli.md, control-protocol.md, target-app-parity area 18 and Ecosystem, ROADMAP, roadmap.md M11, gaps.md gap 6. Plugins & widgets 55%/32% -> 60%/35%, 10-30 h -> 8-26 h.	2026-10-12 05:28:53 +07:00