diff --git a/.config/nextest.toml b/.config/nextest.toml
index a082d13515..83ee9cd6f6 100644
--- a/.config/nextest.toml
+++ b/.config/nextest.toml
@@ -12,7 +12,7 @@
gpu = { max-threads = 4 }
[[profile.default.overrides]]
-filter = 'package(photocraft-gpu) | (package(photocraft-ui-egui) & (kind(test) | test(/canvas|gpu|mip|type_tool/)))'
+filter = 'package(photocraft-gpu) | (package(photocraft-ui-egui) & (kind(test) | test(/canvas|gpu|mip|type_tool|background_redraw::|floating_group_titles|swap_arrow::tests::rendered_glyph/)))'
test-group = 'gpu'
# CI (`--profile ci`, .github/workflows/ci.yml). Stops at the first failure so a red PR frees its
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f2a954c9be..ba8243353d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,7 @@ on:
push:
branches: [main]
pull_request:
+ types: [opened, synchronize, reopened, ready_for_review]
workflow_dispatch:
inputs:
fuzz:
@@ -22,8 +23,8 @@ env:
PHOTOCRAFT_NO_PRINT: "1"
LPDEST: photocraft-no-such-printer
# Debug and test builds keep line tables (file:line in panic backtraces) but drop the rest of the
- # debug info: faster codegen and links (Windows PDBs most of all), and a target dir small enough
- # for the Linux job's second, craft-fonts build (it ran out of disk with full debug info).
+ # debug info: faster codegen and links, and a smaller target dir (the Linux test job ran out of
+ # disk with full debug info). The Windows test legs drop debuginfo entirely (see the test job).
CARGO_PROFILE_DEV_DEBUG: line-tables-only
# A newer push to a PR branch cancels its older run. Runs on main are never cancelled: a merge
@@ -43,7 +44,7 @@ jobs:
name: select platforms
runs-on: ubuntu-latest
outputs:
- os: ${{ steps.pick.outputs.os }}
+ legs: ${{ steps.pick.outputs.legs }}
web: ${{ steps.pick.outputs.web }}
steps:
- uses: actions/checkout@v4
@@ -57,9 +58,15 @@ jobs:
run: |
# No macOS on PRs or main: the org's 5 macOS slots are kept for release builds, and
# release.yml builds and tests macOS (a failing release is fixed and rebuilt).
- all='["ubuntu-latest","windows-latest"]'
+ # Windows tests run as two legs in parallel: the unit tests and the integration tests. As
+ # one job they took ~28 min on the Windows runner; the legs take ~13 and ~15. Splitting
+ # the integration tests over a third runner (nextest --partition) saved ~2 min of wall
+ # time but cost ~7 runner-minutes and one more Windows slot per PR.
+ linux='{"os":"ubuntu-latest","part":"all"}'
+ win() { printf '{"os":"windows-latest","part":"%s"}' "$1"; }
+ all="[$linux,$(win unit),$(win integration)]"
if [ "$EVENT" != pull_request ] || [ "$FULL" = true ]; then
- echo "os=$all" >> "$GITHUB_OUTPUT"
+ echo "legs=$all" >> "$GITHUB_OUTPUT"
echo "web=true" >> "$GITHUB_OUTPUT"
exit 0
fi
@@ -72,20 +79,25 @@ jobs:
echo "web=false" >> "$GITHUB_OUTPUT"
fi
if git diff --name-only "$BASE" HEAD | grep -Eq '^(apps/|crates/(ui-egui|text|gpu|tablet|heif)/|Cargo\.lock$|(.*/)?build\.rs$|\.github/workflows/ci\.yml$)'; then
- echo "os=$all" >> "$GITHUB_OUTPUT"
+ echo "legs=$all" >> "$GITHUB_OUTPUT"
else
- echo 'os=["ubuntu-latest"]' >> "$GITHUB_OUTPUT"
+ echo "legs=[$linux]" >> "$GITHUB_OUTPUT"
fi
test:
timeout-minutes: 100
- name: test (${{ matrix.os }})
+ name: test (${{ matrix.os }}${{ matrix.part != 'all' && format(', {0}', matrix.part) || '' }})
needs: platforms
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
- os: ${{ fromJSON(needs.platforms.outputs.os) }}
+ include: ${{ fromJSON(needs.platforms.outputs.legs) }}
+ env:
+ # No debuginfo on Windows: writing PDBs for ~200 test binaries cost 2.2 of ~21 build minutes.
+ # A panic still names its file and line; only backtrace frames lose theirs (Linux keeps
+ # line-tables-only, so a backtrace with lines is one OS away).
+ CARGO_PROFILE_DEV_DEBUG: ${{ startsWith(matrix.os, 'windows') && '0' || 'line-tables-only' }}
steps:
- uses: actions/checkout@v4
@@ -108,21 +120,44 @@ jobs:
# Only main saves caches; PRs restore main's. Every PR used to save its own set (up to
# 3.8 GB), usable by that PR only, so the repo's 10 GB cache budget kept evicting main's.
# A failing test still saves: the cache holds compiled dependencies, not test results.
+ # The Windows legs share one key (same dependencies); the integration leg saves it,
+ # because it also runs Clippy and so leaves Clippy's dependency metadata in it.
- uses: Swatinem/rust-cache@v2
with:
- save-if: ${{ github.ref == 'refs/heads/main' }}
+ save-if: ${{ github.ref == 'refs/heads/main' && (matrix.part == 'all' || matrix.part == 'integration') }}
cache-on-failure: true
- # The cheap checks run first: a format, lint, layering or stale-scorecard failure is red
- # after a few minutes instead of after the test passes (#6119). Clippy restores main's cache.
+ # sccache caches the workspace crates' compiled libraries, which rust-cache leaves out:
+ # warm, each Windows leg built 4.5 min faster. Like rust-cache, only main writes (PRs read
+ # main's entries); a full set is ~90 MB, so it barely touches the 10 GB budget (#2688).
+ # Test executables can't be cached, so a PR still links its tests.
+ - name: Install sccache (Windows)
+ if: runner.os == 'Windows'
+ uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+ with:
+ version: v0.18.0
+
+ - name: Use sccache (Windows)
+ if: runner.os == 'Windows'
+ env:
+ MAIN: ${{ github.ref == 'refs/heads/main' }}
+ run: |
+ echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
+ echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+ if [ "$MAIN" != true ]; then echo "SCCACHE_GHA_RW_MODE=READ_ONLY" >> "$GITHUB_ENV"; fi
+ shell: bash
+
- name: Format
if: runner.os == 'Linux'
run: cargo fmt --all -- --check
+ # Keep formatting, strict Clippy, layering and scorecard checks ahead of tests.
- name: Clippy
+ if: matrix.part == 'all' || matrix.part == 'integration'
run: cargo clippy --workspace --all-targets --locked --features heif -- -D warnings
- name: Dependency layering
+ if: matrix.part == 'all' || matrix.part == 'integration'
run: cargo xtask layers
# docs/scorecard.md must match its sources (checklists, budgets, baseline, corpus floors,
@@ -131,36 +166,114 @@ jobs:
if: runner.os == 'Linux'
run: cargo xtask scorecard --check
- # cargo-nextest runs the test binaries in parallel (`cargo test` runs them one at a time) and
- # its `ci` profile (.config/nextest.toml) stops at the first failure and fails hung tests.
+ # nextest runs the test binaries in parallel (cargo test runs them one at a time), with the
+ # GPU tests capped by the `gpu` group in .config/nextest.toml (#2204).
- uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
with:
tool: cargo-nextest@0.9.146
# `--features heif`: official builds open HEIC photos via the optional photocraft-heif crate.
- # nextest doesn't run doctests, so `cargo test --doc` does, with the same selection.
- # Separate native commands into steps so Windows reports either command's failure.
+ # `--lib --bins --tests` leaves out the examples, which cargo test would build and link but
+ # never run (Clippy's `--all-targets` still checks they compile). nextest skips doctests, so
+ # they get their own step.
+ #
+ # On Windows the unit leg runs `--lib --bins` and the integration leg `--test '*'` (every
+ # integration-test target); the feature selection stays the same, so both legs share the
+ # dependency cache. The `ci` profile fails fast and terminates hung tests
+ # (.config/nextest.toml); assertion failures are not retried.
- name: Test
- run: cargo nextest run --workspace --locked --features heif --profile ci
+ env:
+ PART: ${{ matrix.part }}
+ run: |
+ case "$PART" in
+ unit) targets=(--lib --bins) ;;
+ integration) targets=(--test '*') ;;
+ *) targets=(--lib --bins --tests) ;;
+ esac
+ cargo nextest run --profile ci --workspace --locked --features heif "${targets[@]}"
+ shell: bash
+
+ # Every command against adversarial params must return Err, never panic or hang (AGENTS.md
+ # Rule 9). It is `#[ignore]`d (slow), so Test skips it. Same packages, features and targets as
+ # Test, so nothing rebuilds: `--test panic_hunt` would drop the other crates' dev-dependency
+ # features and recompile the whole graph. The `ci` profile terminates it if it hangs.
+ - name: Panic hunt
+ if: runner.os == 'Linux'
+ run: >-
+ cargo nextest run --profile ci --workspace --locked --features heif --lib --bins --tests
+ --run-ignored only -E 'binary_id(photocraft-engine::panic_hunt)'
- name: Doctests
- run: cargo test --doc --workspace --locked --features heif
+ if: matrix.part == 'all' || matrix.part == 'unit'
+ run: cargo test --workspace --locked --features heif --doc
+
+ # The Windows tests used to be one job named `test (windows-latest)`; they're now legs named
+ # `test (windows-latest, unit)` and `test (windows-latest, integration)`. This job keeps the old
+ # name reporting, so a required status check on it (none today) would keep working. It fails
+ # unless the whole test matrix and both Linux variants passed. `needs` reports one result
+ # for all matrix legs; when a PR runs no Windows legs it still checks every Linux result.
+ windows-gate:
+ timeout-minutes: 5
+ name: test (windows-latest)
+ needs: [platforms, test, test-variants]
+ if: ${{ !cancelled() }}
+ runs-on: ubuntu-latest
+ steps:
+ - env:
+ PLATFORMS: ${{ needs.platforms.result }}
+ TEST: ${{ needs.test.result }}
+ VARIANTS: ${{ needs.test-variants.result }}
+ run: |
+ echo "platforms: $PLATFORMS, test: $TEST, variants: $VARIANTS"
+ [ "$PLATFORMS" = success ] && [ "$TEST" = success ] && [ "$VARIANTS" = success ]
+
+ # The two other builds of the Linux tests, in parallel with the test job instead of after it (they
+ # added ~10 min to its critical path). Each restores the test job's cache (`shared-key: test` is
+ # that job's key) and saves none: the dependencies are the same, and the 10 GB cache budget is
+ # tight (#2688).
+ test-variants:
+ timeout-minutes: 100
+ name: test (${{ matrix.variant }})
+ runs-on: ubuntu-latest
+ strategy:
+ fail-fast: false
+ matrix:
+ variant: [without heif, with craft-fonts]
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Install Linux system dependencies (egui/winit/rfd)
+ run: |
+ nohup sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup \
+ /opt/hostedtoolcache/CodeQL /dev/null 2>&1 &
+ sudo apt-get update
+ sudo apt-get install -y --no-install-recommends \
+ libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
+ libgl1-mesa-dev libgtk-3-dev
+
+ - uses: dtolnay/rust-toolchain@stable
+
+ - uses: Swatinem/rust-cache@v2
+ with:
+ shared-key: test
+ save-if: false
+
+ - uses: taiki-e/install-action@83ac0ad63c0167e6f06796fab0fce28db1bf3db0 # v2.87.22
+ with:
+ tool: cargo-nextest@0.9.146
# The same codecs without the optional decoder: HEIC must stay a clear "not in this build"
# error for distributors who leave it out.
- name: Test without heif
- if: runner.os == 'Linux'
+ if: matrix.variant == 'without heif'
run: cargo nextest run -p photocraft-heif -p photocraft-codecs -p photocraft-io --locked --profile ci
- # The same tests built with the optional craft-fonts input (crates/text/build.rs), so the
- # Japanese font tests that skip without it run here. Linux only. Keep the exact `--workspace
- # --features heif` of the Test step: any other package or feature selection resolves a
- # different feature set, recompiles the whole dependency graph into the same target dir and
- # runs the runner out of disk (as `-p photocraft-text -p photocraft-ui-egui` did after #800).
- # Only the tests of the crates that read `CRAFT_FONTS` run (the `-E` filter changes what runs,
- # not what is built); engine and the apps only pass text on to them (#6120).
+ # The tests built with the optional craft-fonts input (crates/text/build.rs), so the Japanese
+ # font tests that skip without it run. Keep the test job's exact `--workspace --features heif
+ # --lib --bins --tests`, so the restored dependencies match and only the workspace rebuilds.
+ # Filter execution to the three crates that read the optional font input (#6127).
- name: Check out craft-fonts
- if: runner.os == 'Linux'
+ if: matrix.variant == 'with craft-fonts'
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
repository: storytold/craft-fonts
@@ -168,12 +281,12 @@ jobs:
path: craft-fonts
- name: Test with craft-fonts
- if: runner.os == 'Linux'
+ if: matrix.variant == 'with craft-fonts'
env:
CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
CRAFT_FONTS_REQUIRED: "1"
run: >-
- cargo nextest run --workspace --locked --features heif --profile ci
+ cargo nextest run --profile ci --workspace --locked --features heif --lib --bins --tests
-E 'package(photocraft-text) | package(photocraft-io) | package(photocraft-ui-egui)'
corpus:
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index fa0693f58e..970c6577a4 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -27,38 +27,10 @@ permissions:
jobs:
freebsd:
- name: FreeBSD 14 (build + test + package)
- runs-on: ubuntu-latest
- timeout-minutes: 300
- steps:
- - uses: actions/checkout@v4
- - name: Build, test and package in a FreeBSD VM
- uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
- with:
- release: "14.3"
- usesh: true
- cpu: 4
- mem: 12288
- # Nothing to bring back; copying the target dir out of the VM fails on large builds.
- copyback: false
- prepare: |
- pkg install -y bash git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 alsa-lib
- curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
- run: |
- set -e
- . "$HOME/.cargo/env"
- # The checkout is synced in under another owner; let tests that call git read it.
- git config --global --add safe.directory "*"
- rustc --version
- CARGO_PROFILE_DEV_DEBUG=0 cargo build --workspace --all-targets --locked --features heif
- CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked --features heif --exclude photocraft-ui-egui
- CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --lib
- CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --doc
- # The VM's software Vulkan driver crashes (SIGSEGV) when several tests set up a GPU
- # device at once, so the GPU integration tests run one at a time here.
- CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --test '*' -- --test-threads=1
- # The release package, as release.yml builds it. Free the debug build's disk first.
- rm -rf target/debug
- CARGO_BUILD_JOBS=4 bash packaging/freebsd/package.sh
- tar -tzf dist/release/photocraft-*-freebsd-x86_64.tar.gz \
- | grep -E '/bin/photocraft$|/bin/photocraft-cli$|/share/applications/ai\.storyteller\.photocraft\.desktop$|/share/doc/photocraft/LICENSE-MIT$'
+ # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+ uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
+ with:
+ craft-fonts-ref: abb83316d96aa59c1cf64784289e378fe9fa5695
+ cargo-build-extra-args: "--features heif"
+ custom-test-command: "CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked --features heif --exclude photocraft-ui-egui && CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --lib && CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --doc && CARGO_PROFILE_DEV_DEBUG=0 cargo test -p photocraft-ui-egui --locked --test '*' -- --test-threads=1"
+ run-package-check: true
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
new file mode 100644
index 0000000000..18392587a8
--- /dev/null
+++ b/.github/workflows/nix.yml
@@ -0,0 +1,33 @@
+# Evaluates the Nix flake (no build, about a minute): `nix build` / `nix develop` stop at evaluation
+# when Cargo.lock gains something nix/package.nix can't vendor, and nothing else would notice.
+name: Nix
+
+on:
+ push:
+ branches: [main]
+ paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
+ pull_request:
+ paths: ["flake.nix", "flake.lock", "nix/**", "Cargo.lock", ".github/workflows/nix.yml"]
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+concurrency:
+ group: nix-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ eval:
+ runs-on: ubuntu-latest
+ timeout-minutes: 15
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+ - name: nix flake check --no-build
+ run: |
+ if [ -f flake.nix ]; then
+ nix flake check --no-build --all-systems
+ else
+ echo "No flake.nix present in this repository; skipping check."
+ fi
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 26eca62464..1ae19efa66 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -57,6 +57,7 @@ next to them.
| `crates/ui-egui/src/theme.rs` (Solarized Dark palette) | Solarized colour scheme used by the Solarized Dark theme | Ethan Schoonover | | MIT, [`LICENSE-solarized.txt`](crates/ui-egui/src/LICENSE-solarized.txt) |
| `crates/ui-egui/src/theme.rs` (Breeze Light and Breeze Dark themes) | The Breeze Light and Breeze Dark themes are original colour values on PhotoCraft's Studio layout, chosen to look close to KDE Plasma's Breeze (cool blue-greys, blue accent, 5 px frame radius) so the app blends into a Plasma desktop. None of Breeze's colour values, files or code are copied; the values are a few levels away from its schemes and tuned for text contrast | PhotoCraft contributors | Inspired by the look of KDE Breeze, (its colour schemes are LGPL-2.0-or-later) | Original work |
| `crates/ui-egui/src/theme.rs` (Soft Dark and Soft Light themes) | Original colour values and radii for two low-contrast themes on PhotoCraft's Studio layout; no third-party palette, file or code is used | PhotoCraft contributors | Original | Original work |
+| `crates/algo/data/libfacedetection.bin` (face detection weights, read by `crates/algo/src/faces.rs`, whose network code is a port of the library's) | libfacedetection CNN (YuNet design) weights and inference code, weights converted to half precision | Shiqi Yu | [ShiqiYu/libfacedetection](https://github.com/ShiqiYu/libfacedetection) (`src/facedetectcnn-data.cpp`, `facedetectcnn.cpp`, `facedetectcnn-model.cpp`) | BSD-3-Clause, [`LICENSE-libfacedetection.txt`](crates/algo/data/LICENSE-libfacedetection.txt) |
### Optional build input: craft-fonts (not files in this repo)
diff --git a/Cargo.lock b/Cargo.lock
index 99799dc20f..c482af17ca 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1222,6 +1222,11 @@ dependencies = [
"libc",
]
+[[package]]
+name = "craft-docpath"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=82a24b006eefa036b43c09a67fb9a3fbd17ffe63#82a24b006eefa036b43c09a67fb9a3fbd17ffe63"
+
[[package]]
name = "craft-print"
version = "0.1.0"
@@ -4646,6 +4651,7 @@ dependencies = [
"rfd",
"ron",
"serde_json",
+ "tempfile",
"winit",
"winresource",
"winsafe",
@@ -4795,6 +4801,7 @@ dependencies = [
"photocraft-format",
"photocraft-geom",
"photocraft-io",
+ "photocraft-ipp",
"photocraft-ops",
"photocraft-paint",
"photocraft-plugins",
@@ -4870,6 +4877,7 @@ name = "photocraft-io"
version = "0.9.0"
dependencies = [
"blake3",
+ "craft-docpath",
"crc32fast",
"flate2",
"photocraft-affinity",
@@ -4894,6 +4902,10 @@ dependencies = [
"thiserror 2.0.21",
]
+[[package]]
+name = "photocraft-ipp"
+version = "0.9.0"
+
[[package]]
name = "photocraft-ops"
version = "0.9.0"
@@ -5038,6 +5050,7 @@ dependencies = [
"serde_json",
"sys-locale",
"toml",
+ "unicode-bidi",
"winsafe",
]
diff --git a/Cargo.toml b/Cargo.toml
index 3c5ad2e0ff..25a7a101c3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,9 +36,11 @@ photocraft-engine = { path = "crates/engine" }
photocraft-ui-egui = { path = "crates/ui-egui" }
photocraft-testkit = { path = "crates/testkit" }
photocraft-tablet = { path = "crates/tablet" }
+photocraft-ipp = { path = "crates/ipp" }
# external
craft-print = { git = "https://github.com/storytold/craft-libs", rev = "3d37da389a3618ab9b76109da11416e9ca4ea719" }
+craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-libs", rev = "82a24b006eefa036b43c09a67fb9a3fbd17ffe63" }
thiserror = "2"
serde = { version = "1", features = ["derive", "rc"] }
serde_json = "1"
@@ -75,9 +77,18 @@ opt-level = 2
opt-level = 1
# Line tables keep file:line in panic backtraces but drop variable info, which roughly halves link
# time and PDB size for the ~260 test binaries (#2204). CI sets the same through
-# CARGO_PROFILE_DEV_DEBUG. To inspect locals in a debugger, build with CARGO_PROFILE_DEV_DEBUG=true.
+# CARGO_PROFILE_DEV_DEBUG (and no debuginfo at all for the Windows tests). To inspect locals in a
+# debugger, build with CARGO_PROFILE_DEV_DEBUG=true.
debug = "line-tables-only"
+# Test builds compile ui-egui without optimization: its library and unit tests were the biggest
+# test-build units after engine's (12.6 of ~63 compile minutes on the Windows CI runner), and its
+# tests run no heavier pixel code of their own (that lives in the crates that stay optimized).
+# Measured on CI: Windows build 18.9 -> 15.4 min, test run 10.0 -> 10.5. `cargo run` and
+# `cargo build` use the dev profile and are unaffected.
+[profile.test.package.photocraft-ui-egui]
+opt-level = 0
+
[profile.release]
lto = "thin"
codegen-units = 1
@@ -127,6 +138,14 @@ opt-level = "z"
[profile.wasm-release.package.naga]
opt-level = "z"
+# The browser UI toolkit favors size to stay within the WebAssembly upload budget.
+[profile.wasm-release.package.egui]
+opt-level = "z"
+[profile.wasm-release.package.epaint]
+opt-level = "z"
+[profile.wasm-release.package.eframe]
+opt-level = "z"
+
# Pixel processing keeps its speed-oriented optimization level, with two exceptions.
# Colour-management transforms are built once and cached (`transform::cached`), so "z" costs
# little runtime. The browser app composites per frame on the GPU (`crates/gpu`, WebGPU/WebGL2),
diff --git a/NOTICE b/NOTICE
index 887010d4a6..a7302a940c 100644
--- a/NOTICE
+++ b/NOTICE
@@ -16,6 +16,7 @@ Inter font (assets/fonts/Inter-*.ttf) — SIL Open Font License 1.1. See assets/
JetBrains Mono font (assets/fonts/JetBrainsMono-Regular.ttf) — SIL Open Font License 1.1. See assets/fonts/OFL-JetBrainsMono.txt.
Lucide icons (assets/icons/*.svg, except slice-knife.svg) — ISC; icons derived from Feather also MIT. See assets/icons/LICENSE-lucide.txt.
SCOWL English word list (assets/dict/en_US-scowl-50.txt.gz) — SCOWL license. See assets/dict/LICENSE-SCOWL.txt.
+libfacedetection face detection weights and network (crates/algo/data/libfacedetection.bin, crates/algo/src/faces/cnn.rs) — BSD-3-Clause, Copyright (c) 2015-2019, Shiqi Yu, all rights reserved. See crates/algo/data/LICENSE-libfacedetection.txt.
Builds made with craft-fonts (CRAFT_FONTS_DIR; all official releases) also embed the fonts listed in
https://github.com/storytold/craft-fonts/blob/main/ATTRIBUTION.md (today BIZ UDPGothic, Shippori Mincho and
diff --git a/README.md b/README.md
index d1e839323c..12e2ef4b12 100644
--- a/README.md
+++ b/README.md
@@ -275,6 +275,8 @@ flatpak install --user photocraft--linux-x86_64.flatpak # or -linux-a
flatpak run ai.storyteller.photocraft
```
+The Flatpak prints through the host's CUPS socket (File › Print talks IPP to it directly, no `lp` needed); without CUPS, or without a printer, File › Print opens the system print dialog through the print portal. See [printing](docs/printing.md).
+
The AppImage needs no install: the first run registers its launcher icon and menu entry in `~/.local/share` so the dock shows PhotoCraft's icon on Wayland. Set `PHOTOCRAFT_NO_DESKTOP_INTEGRATION=1` to skip that, and see [`docs/releasing.md`](docs/releasing.md) › Linux to undo it.
On a Wayland session, files dropped on the window don't open yet: winit 0.30, the windowing library under egui, has no Wayland drag and drop (#386). Use File › Open, or copy the image in your file manager and paste it with Ctrl+V. To drag and drop, start PhotoCraft under XWayland: `WAYLAND_DISPLAY= photocraft`, `WAYLAND_DISPLAY= ./photocraft--linux-x86_64.AppImage`, or `flatpak run --nosocket=wayland --socket=x11 ai.storyteller.photocraft`. On Wayland, PhotoCraft shows the command for your install in a notice until you dismiss it. Preferences › Performance › Linux display server = X11 does the same on every launch. With a fractional display scale (125%, 150%, 175%) an XWayland window is drawn at a lower resolution and enlarged by the compositor, so the interface is blurred there; native Wayland stays sharp (#1072).
@@ -300,6 +302,19 @@ Maintainers: [`docs/releasing.md`](docs/releasing.md) explains how releases are
> [!IMPORTANT]
> **Status:** PhotoCraft is in early alpha, and we want to be straight about where it stands: much of Photoshop's feature surface exists in some form, but **it is not yet a Photoshop replacement for daily professional work**. The biggest gaps are AI/generative features, 15 missing tools, depth in typography and pro workflows, and plug-in compatibility. Every Photoshop menu item is wired to a command ([`docs/parity-checklist.md`](docs/parity-checklist.md)), but that measures wiring, not behaviour. The honest, dimension-by-dimension picture and where we're going next are in the [roadmap](ROADMAP.md) and [parity assessment](docs/target-app-parity.md). Expect rough edges, and please file issues (include your OS, document size, layer count and a screenshot). You can also tell us what broke on [Discord](https://discord.gg/artcraft).
+## Community packages
+
+These installers are maintained by community members, not by the PhotoCraft team.
+
+On Gentoo, the [::snakebyte overlay](https://github.com/switch87/snakebyte-overlay) packages the Linux release as `media-gfx/photocraft-bin`:
+
+```sh
+eselect repository add snakebyte git https://github.com/switch87/snakebyte-overlay.git
+emaint sync -r snakebyte
+echo 'media-gfx/photocraft-bin ~amd64' >> /etc/portage/package.accept_keywords/photocraft
+emerge --ask media-gfx/photocraft-bin
+```
+
## Documentation
Developer, architecture, automation, format, and security documentation is maintained in the [PhotoCraft documentation book](book/).
diff --git a/apps/photocraft-cli/Cargo.toml b/apps/photocraft-cli/Cargo.toml
index a6d3b49389..f4848f379a 100644
--- a/apps/photocraft-cli/Cargo.toml
+++ b/apps/photocraft-cli/Cargo.toml
@@ -1,6 +1,6 @@
[package]
name = "photocraft-cli"
-description = "Headless Photocraft: convert, inspect, run commands, batch, MCP server"
+description = "Headless PhotoCraft: convert, inspect, run commands, batch, MCP server"
version.workspace = true
edition.workspace = true
license.workspace = true
diff --git a/apps/photocraft-cli/src/lib.rs b/apps/photocraft-cli/src/lib.rs
index b93d4ccc8f..03001ab02d 100644
--- a/apps/photocraft-cli/src/lib.rs
+++ b/apps/photocraft-cli/src/lib.rs
@@ -1,4 +1,4 @@
-//! Headless Photocraft command line. `run` is the whole program, so it can be
+//! Headless PhotoCraft command line. `run` is the whole program, so it can be
//! tested in-process as well as through the binary.
#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
@@ -12,7 +12,7 @@ use photocraft_io::ExportOptions;
use serde_json::{Value, json};
pub const USAGE: &str = "\
-photocraft-cli: headless Photocraft
+photocraft-cli: headless PhotoCraft
USAGE:
photocraft-cli convert [--format ] [--quality <1-100>] [--tiff-layers] [--tga-bits <24|32>] [--dpx-bits <8|10|12|16>]
diff --git a/apps/photocraft-web/Cargo.toml b/apps/photocraft-web/Cargo.toml
index a4ded64181..4ecad80ae4 100644
--- a/apps/photocraft-web/Cargo.toml
+++ b/apps/photocraft-web/Cargo.toml
@@ -1,6 +1,6 @@
[package]
name = "photocraft-web"
-description = "Photocraft in the browser (eframe web runner, WebGPU with WebGL2 fallback)"
+description = "PhotoCraft in the browser (eframe web runner, WebGPU with WebGL2 fallback)"
version.workspace = true
edition.workspace = true
license.workspace = true
@@ -34,7 +34,7 @@ rfd = { workspace = true }
wasm-bindgen = "0.2"
wasm-bindgen-futures = "0.4"
js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Storage", "Event", "EventTarget", "MouseEvent", "PointerEvent", "BeforeUnloadEvent", "AbortController", "AbortSignal", "DomException", "Response", "IdbFactory", "IdbOpenDbRequest", "IdbDatabase", "IdbRequest", "IdbTransaction", "IdbTransactionMode", "IdbObjectStore", "IdbCursor", "IdbCursorWithValue", "RequestInit", "Navigator"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "DomRect", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Storage", "Event", "EventTarget", "MouseEvent", "PointerEvent", "BeforeUnloadEvent", "AbortController", "AbortSignal", "DomException", "Response", "IdbFactory", "IdbOpenDbRequest", "IdbDatabase", "IdbRequest", "IdbTransaction", "IdbTransactionMode", "IdbObjectStore", "IdbCursor", "IdbCursorWithValue", "RequestInit", "Navigator"] }
[dev-dependencies]
serde_json = { workspace = true }
diff --git a/apps/photocraft-web/src/main.rs b/apps/photocraft-web/src/main.rs
index 5ba75f5254..0802a02ebf 100644
--- a/apps/photocraft-web/src/main.rs
+++ b/apps/photocraft-web/src/main.rs
@@ -1,4 +1,4 @@
-//! Photocraft in the browser.
+//! PhotoCraft in the browser.
//!
//! Runs the same [`photocraft_ui_egui::PhotocraftApp`] as the desktop app through eframe's web
//! runner (wgpu: WebGPU where available, WebGL2 otherwise). Build with `trunk build --release`
@@ -6,10 +6,10 @@
//!
//! Differences from the desktop app:
//! - no TCP control server (browsers can't listen on sockets);
-//! - File → Open uses the browser file picker; bytes arrive asynchronously through
-//! `Services::inbox`;
+//! - file pickers return browser file contents asynchronously through `Services::file_dialog`;
+//! this includes File → Open and commands such as Place Embedded;
//! - saving/exporting triggers a browser download;
-//! - dropped files are read asynchronously by `web::WebShell` and delivered through the inbox.
+//! - dropped files are read asynchronously by `web::WebShell` and delivered through `Services::inbox`.
//!
//! URL query flags: `?cpu` forces the CPU canvas path (same as `PHOTOCRAFT_CPU_CANVAS=1`);
//! `?webgl` forces the WebGL2 backend instead of WebGPU.
diff --git a/apps/photocraft-web/src/web.rs b/apps/photocraft-web/src/web.rs
index eb350d17eb..6fd3620483 100644
--- a/apps/photocraft-web/src/web.rs
+++ b/apps/photocraft-web/src/web.rs
@@ -1,6 +1,8 @@
//! The browser shell: web `Services`, drag-and-drop, and the eframe web runner.
+use std::cell::Cell;
use std::collections::{HashMap, HashSet};
+use std::rc::Rc;
use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::{Arc, Mutex};
@@ -79,11 +81,13 @@ pub fn start() {
Box::new(move |cc| {
PhotocraftApp::setup_context(&cc.egui_ctx, ThemeKind::Pro);
let inbox: Inbox = Arc::default();
+ let place_inbox: Inbox = Arc::default();
let served: Served = Arc::default();
load_font_manifest(served.clone(), cc.egui_ctx.clone());
let (session, warnings) = crate::preset_bridge::session(presets.clone());
preset_warnings.extend(warnings);
- let mut app = PhotocraftApp::new(session, services(inbox.clone()));
+ let drag = listen_drag(&pen_target);
+ let mut app = PhotocraftApp::new(session, services(inbox.clone(), place_inbox.clone(), drag_pos_service(pen_target.clone(), drag)));
if !preset_warnings.is_empty() {
photocraft_ui_egui::notices::post(&mut app, i18n::t("Some brush presets could not be loaded"), preset_warnings, true, None);
}
@@ -97,7 +101,7 @@ pub fn start() {
}
let unsaved = Arc::new(AtomicBool::new(false));
guard_unload(unsaved.clone());
- Ok(Box::new(WebShell { app, inbox, unsaved, served, database, presets }))
+ Ok(Box::new(WebShell { app, inbox, place_inbox, unsaved, served, database, presets }))
}),
)
.await;
@@ -140,6 +144,38 @@ fn listen_pen(target: &web_sys::HtmlCanvasElement, feed: photocraft_ui_egui::sty
}
}
+/// The pointer in a drag over the page, in CSS pixels relative to the viewport (`clientX`,
+/// `clientY`): the last `dragover` or `drop` event's.
+type DragPos = Rc>>;
+
+/// Follows files dragged over the canvas. eframe's drop events carry no pointer position and the
+/// page gets no pointer events during a drag, so this is where a drop lands: on the document's
+/// canvas it places the files, elsewhere it opens them (#5749).
+fn listen_drag(target: &web_sys::HtmlCanvasElement) -> DragPos {
+ use wasm_bindgen::closure::Closure;
+ let pos = DragPos::default();
+ for kind in ["dragover", "drop"] {
+ let pos = pos.clone();
+ // A DragEvent is a MouseEvent: only its client position is read.
+ let cb = Closure::::new(move |e: web_sys::MouseEvent| pos.set(Some((e.client_x() as f32, e.client_y() as f32))));
+ if target.add_event_listener_with_callback(kind, cb.as_ref().unchecked_ref()).is_ok() {
+ cb.forget();
+ }
+ }
+ pos
+}
+
+/// `Services::cursor_pos` for the web: the last drag position in egui points, mapped as eframe
+/// maps pointer events (relative to the canvas, divided by the zoom factor).
+fn drag_pos_service(canvas: web_sys::HtmlCanvasElement, pos: DragPos) -> photocraft_ui_egui::CursorPosFn {
+ Box::new(move |ctx: &egui::Context| {
+ let (x, y) = pos.get()?;
+ let rect = canvas.get_bounding_client_rect();
+ let zoom = ctx.zoom_factor();
+ (zoom.is_finite() && zoom > 0.0).then(|| egui::pos2((x - rect.left() as f32) / zoom, (y - rect.top() as f32) / zoom))
+ })
+}
+
/// Closing or reloading the tab while a document has unsaved changes asks first, as closing the
/// desktop window does: the browser shows its own "Leave site?" prompt (#1380). `unsaved` is
/// refreshed every frame by [`WebShell`].
@@ -219,10 +255,13 @@ async fn fetch_bytes(url: &str, integrity: Option<&str>) -> Result, Stri
}
/// Wraps the app to read dropped files asynchronously (browsers can't read them synchronously,
-/// so the app's own drop path can't handle them) and feed them through the inbox.
+/// so the app's own drop path can't handle them) and feed them through the inboxes.
struct WebShell {
app: PhotocraftApp,
+ /// Dropped files to open as documents.
inbox: Inbox,
+ /// Dropped files to place on the active document's canvas.
+ place_inbox: Inbox,
/// Read by the `beforeunload` listener ([`guard_unload`]).
unsaved: Arc,
served: Served,
@@ -285,17 +324,26 @@ impl WebShell {
impl eframe::App for WebShell {
fn logic(&mut self, ctx: &egui::Context, frame: &mut eframe::Frame) {
let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
- for f in dropped {
- let inbox = self.inbox.clone();
+ if !dropped.is_empty() {
+ let names: Vec =
+ dropped.iter().map(|f| f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into())).collect();
+ // Decided now, where the drop landed: on the document's canvas the files are placed
+ // as layers (as on the desktop), elsewhere opened.
+ let places = self.app.dropped_on_canvas(ctx, &names);
+ let files: Vec<_> = dropped.into_iter().zip(names).zip(places).collect();
+ let (inbox, place_inbox) = (self.inbox.clone(), self.place_inbox.clone());
let ctx = ctx.clone();
+ // One after another, so they open or place in the order they were dropped.
wasm_bindgen_futures::spawn_local(async move {
- let name = f.path().file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| "dropped".into());
- match f.bytes_async().await {
- Ok(bytes) => {
- inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
- ctx.request_repaint();
+ for ((f, name), place) in files {
+ match f.bytes_async().await {
+ Ok(bytes) => {
+ let queue = if place { &place_inbox } else { &inbox };
+ queue.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
+ ctx.request_repaint();
+ }
+ Err(e) => log::error!("couldn't read dropped file {name}: {e}"),
}
- Err(e) => log::error!("couldn't read dropped file {name}: {e}"),
}
});
}
@@ -333,7 +381,7 @@ impl eframe::App for WebShell {
}
}
-fn services(inbox: Inbox) -> Services {
+fn services(inbox: Inbox, place_inbox: Inbox, cursor_pos: photocraft_ui_egui::CursorPosFn) -> Services {
Services {
screen_pick: screen_color_service(),
import: Some(Box::new(|name: &str, bytes: &[u8], max_svg_group_depth: usize| {
@@ -384,6 +432,8 @@ fn services(inbox: Inbox) -> Services {
photocraft_codecs::encode(&img, photocraft_codecs::Format::Png, &EncodeOptions::default()).map_err(|e| e.to_string())
})),
inbox: Some(inbox),
+ place_inbox: Some(place_inbox),
+ cursor_pos: Some(cursor_pos),
// Preferences live in the browser's localStorage.
load_prefs: Some(Box::new(|| local_storage()?.get_item(PREFS_KEY).ok().flatten())),
save_prefs: Some(Box::new(|text: &str| local_storage().ok_or("no localStorage")?.set_item(PREFS_KEY, text).map_err(|e| format!("{e:?}")))),
diff --git a/apps/photocraft/Cargo.toml b/apps/photocraft/Cargo.toml
index e5af663471..505947e222 100644
--- a/apps/photocraft/Cargo.toml
+++ b/apps/photocraft/Cargo.toml
@@ -4,7 +4,7 @@ version.workspace = true
edition.workspace = true
license.workspace = true
default-run = "photocraft"
-description = "Photocraft: an open-source, native image editor"
+description = "PhotoCraft: an open-source, native image editor"
build = "build.rs"
[features]
@@ -65,6 +65,8 @@ dispatch2 = { version = "=0.3.1", default-features = false, features = ["std"] }
# Drop position on X11 (`cursor.rs`): pure-Rust X client, already in Cargo.lock; pinned exactly.
[target.'cfg(target_os = "linux")'.dependencies]
photocraft-cms = { workspace = true }
+# The print portal's PDF: a private (0600) temporary file, removed when the dialog is done.
+tempfile = "3"
x11rb = { version = "=0.13.2", default-features = false, features = ["image", "randr", "xkb"] }
# Clipboard images in types other than PNG on Wayland (`services.rs`, #2546): arboard asks for
# image/png only. Already in Cargo.lock (arboard's wayland-data-control); pinned exactly.
diff --git a/apps/photocraft/src/app_dirs.rs b/apps/photocraft/src/app_dirs.rs
index 2897bebdb0..5775e254df 100644
--- a/apps/photocraft/src/app_dirs.rs
+++ b/apps/photocraft/src/app_dirs.rs
@@ -9,6 +9,9 @@
//! folder can't be written (read-only medium, Program Files), the app warns and falls back.
//! 3. The platform convention: macOS `~/Library/Application Support/Photocraft`, Windows
//! `%APPDATA%\Photocraft`, Linux `$XDG_CONFIG_HOME/photocraft` or `~/.config/photocraft`.
+//!
+//! One exception: on Windows the platform convention keeps crash-recovery autosaves out of the
+//! roaming profile ([`recovery_dir`]).
use std::ffi::OsString;
use std::path::{Path, PathBuf};
@@ -60,6 +63,379 @@ pub fn config_dir() -> Option {
current().dir.clone()
}
+/// The crash-recovery folder's name.
+const RECOVERY: &str = "Recovery";
+
+/// Where crash-recovery autosaves live, with any left in the settings directory by an earlier
+/// version moved there first ([`adopt_legacy_recovery`]). Call it once, at startup.
+pub fn recovery_dir() -> Option {
+ let data = current();
+ let dir = resolve_recovery(data, |k| std::env::var_os(k))?;
+ Some(match data.dir.as_ref().map(|d| d.join(RECOVERY)) {
+ Some(legacy) => adopt_legacy_recovery(&legacy, &dir),
+ None => dir,
+ })
+}
+
+/// The recovery folder for `data` (#5648). Autosaves hold whole documents and are rewritten every
+/// few minutes, so on Windows the platform convention puts them in the machine-local
+/// `%LOCALAPPDATA%\Photocraft\Recovery`: the roaming `%APPDATA%` may be synced at sign-in and
+/// sign-out or capped by policy. They stay out of `%TEMP%`, which cleanup tools may empty before
+/// a crashed document is recovered. The override and portable folders keep everything in one
+/// place, and other platforms already keep these folders local.
+pub fn resolve_recovery(data: &DataDir, env: impl Fn(&str) -> Option) -> Option {
+ if cfg!(windows)
+ && data.mode == Mode::Platform
+ && let Some(local) = env("LOCALAPPDATA").filter(|l| !l.is_empty())
+ {
+ return Some(PathBuf::from(local).join("Photocraft").join(RECOVERY));
+ }
+ data.dir.as_ref().map(|d| d.join(RECOVERY))
+}
+
+/// The lock file, beside the recovery folder, that keeps two PhotoCraft processes starting at
+/// once (`--new-instance`, control launches) from moving the same autosaves.
+const MIGRATION_LOCK: &str = "recovery-migration.lock";
+
+/// How long a launch waits for another one's move before going ahead without moving anything.
+const MIGRATION_WAIT: std::time::Duration = std::time::Duration::from_secs(5);
+
+/// Suffix of a copy staged for publishing ([`stage_copy`]): disposable, the original still exists.
+const STAGED: &str = ".moving";
+
+/// Suffix of an original set aside while it is copied to another volume ([`move_across`]): it
+/// may be the only copy, so it is put back, never thrown away, if the move doesn't finish.
+const HELD: &str = ".held";
+
+/// Move autosaves from `legacy` (the recovery folder of versions before #5648) into `dir`, so a
+/// crash just before an update is still offered for recovery. Returns the folder this process
+/// uses for its recovery store. That is `legacy` only when `dir` doesn't exist and no process can
+/// be moving autosaves (the move failed, or its lock can't be made), so nothing deletes what is
+/// written there. A launch that finds another one moving uses `dir`, which the move never
+/// replaces or removes. See [`adopt_locked`] for how they move.
+pub fn adopt_legacy_recovery(legacy: &Path, dir: &Path) -> PathBuf {
+ adopt_legacy_recovery_waiting(legacy, dir, MIGRATION_WAIT)
+}
+
+/// [`adopt_legacy_recovery`], waiting up to `wait` for another process's move.
+fn adopt_legacy_recovery_waiting(legacy: &Path, dir: &Path, wait: std::time::Duration) -> PathBuf {
+ let held_aside = || legacy.parent().is_some_and(|p| !side_entries(p, legacy, HELD).is_empty());
+ if legacy == dir || (!legacy.is_dir() && !held_aside()) {
+ return dir.to_path_buf();
+ }
+ // An empty old folder has nothing to move (`remove_dir` only removes an empty one).
+ if !held_aside() && std::fs::remove_dir(legacy).is_ok() {
+ return dir.to_path_buf();
+ }
+ let unmoved = || if dir.exists() || !legacy.is_dir() { dir.to_path_buf() } else { legacy.to_path_buf() };
+ let Some(parent) = dir.parent() else { return unmoved() };
+ let lock =
+ std::fs::create_dir_all(parent).and_then(|()| std::fs::OpenOptions::new().create(true).truncate(false).write(true).open(parent.join(MIGRATION_LOCK)));
+ let Ok(lock) = lock else {
+ // No lock file means no other process can be moving: the old folder is safe to use.
+ log::warn!("couldn't open the recovery move lock in {}; autosaves stay where they are", parent.display());
+ return unmoved();
+ };
+ let deadline = std::time::Instant::now() + wait;
+ loop {
+ match lock.try_lock() {
+ Ok(()) => break,
+ Err(std::fs::TryLockError::WouldBlock) if std::time::Instant::now() < deadline => std::thread::sleep(std::time::Duration::from_millis(50)),
+ Err(std::fs::TryLockError::WouldBlock) => {
+ // Another process is moving and may yet remove the old folder: never write there.
+ log::info!("another PhotoCraft is moving crash-recovery autosaves; using {}", dir.display());
+ return dir.to_path_buf();
+ }
+ Err(std::fs::TryLockError::Error(e)) => {
+ // Locking fails for every process here alike, so none can be moving.
+ log::warn!("couldn't lock {}: {e}; autosaves stay where they are", parent.join(MIGRATION_LOCK).display());
+ return unmoved();
+ }
+ }
+ }
+ // The lock file stays (removing it would race a process about to lock it); the OS releases
+ // the lock when `lock` is dropped or the process ends.
+ let used = adopt_locked(legacy, dir);
+ if used == legacy {
+ // This process writes its autosaves to the old folder: it keeps the lock for as long as it
+ // runs, so no other launch moves (and removes) the folder under it.
+ KEPT_LOCKS.lock().unwrap_or_else(std::sync::PoisonError::into_inner).push(lock);
+ }
+ used
+}
+
+/// Migration locks of the old folders this process uses (see [`adopt_legacy_recovery`]), kept
+/// until it ends.
+static KEPT_LOCKS: std::sync::Mutex> = std::sync::Mutex::new(Vec::new());
+
+/// The move itself, under the migration lock. First, what a process that ended mid-move left is
+/// tidied: originals it set aside are put back, copies it staged are removed. An empty `legacy`
+/// is then just removed. Otherwise the whole folder moves if `dir` doesn't exist yet; when both
+/// exist, each autosave (`.pcraft` bundle and `.json` sidecar, see
+/// `photocraft_format::autosave`) moves as a whole, bundle first, unless `dir` already has either
+/// part, and one that stays is left in `legacy` untouched. Every move is a [`move_path`].
+fn adopt_locked(legacy: &Path, dir: &Path) -> PathBuf {
+ if let Some(parent) = legacy.parent() {
+ for held in side_entries(parent, legacy, HELD) {
+ put_back(&held, legacy);
+ }
+ }
+ // Autosave parts held aside inside the old folder by a per-autosave move.
+ let held_parts: Vec<(PathBuf, String)> = std::fs::read_dir(legacy)
+ .into_iter()
+ .flatten()
+ .flatten()
+ .filter_map(|e| e.file_name().to_str().and_then(|n| side_of(n, HELD)).map(|orig| (e.path(), orig.to_owned())))
+ .collect();
+ for (held, original) in held_parts {
+ put_back(&held, &legacy.join(original));
+ }
+ for folder in [dir.parent(), Some(dir)].into_iter().flatten() {
+ remove_stale_staging(folder);
+ }
+ // Another process may have finished the move while this one waited.
+ if !legacy.is_dir() {
+ return dir.to_path_buf();
+ }
+ if std::fs::remove_dir(legacy).is_ok() {
+ return dir.to_path_buf();
+ }
+ if !dir.exists() {
+ // The common case: the whole folder moves at once.
+ return match move_path(legacy, dir) {
+ Ok(()) => {
+ log::info!("moved crash-recovery autosaves from {} to {}", legacy.display(), dir.display());
+ dir.to_path_buf()
+ }
+ Err(e) => {
+ log::warn!("couldn't move crash-recovery autosaves from {} to {} ({e}); using the old folder", legacy.display(), dir.display());
+ if legacy.is_dir() { legacy.to_path_buf() } else { dir.to_path_buf() }
+ }
+ };
+ }
+ move_entries(legacy, dir);
+ // Only an emptied folder goes; anything that couldn't move stays for a later launch.
+ let _ = std::fs::remove_dir(legacy);
+ dir.to_path_buf()
+}
+
+/// Move each autosave of `from` into `to` (both folders): bundle first, then sidecar, skipped if
+/// `to` has either part. Temp files of an interrupted write (`photocraft_format::atomic`) go
+/// along too, for the recovery store's startup sweep there.
+fn move_entries(from: &Path, to: &Path) {
+ let Ok(entries) = std::fs::read_dir(from) else { return };
+ let names: Vec = entries.flatten().filter_map(|e| e.file_name().to_str().map(str::to_owned)).collect();
+ let keys: std::collections::BTreeSet<&str> = names.iter().filter_map(|n| n.strip_suffix(".pcraft").or_else(|| n.strip_suffix(".json"))).collect();
+ for key in keys {
+ let parts = [format!("{key}.pcraft"), format!("{key}.json")];
+ if parts.iter().any(|p| std::fs::symlink_metadata(to.join(p)).is_ok()) {
+ continue;
+ }
+ // A bundle that moves without its sidecar is still listed (`list_recovery` reads a
+ // committed bundle's manifest); a sidecar must never move without its bundle.
+ for part in &parts {
+ let src = from.join(part);
+ if std::fs::symlink_metadata(&src).is_ok()
+ && let Err(e) = move_path(&src, &to.join(part))
+ {
+ log::warn!("couldn't move {} to {}: {e}", src.display(), to.display());
+ break;
+ }
+ }
+ }
+ for name in names.iter().filter(|n| n.ends_with(".pcsave.tmp")) {
+ let _ = move_path(&from.join(name), &to.join(name));
+ }
+}
+
+/// How deep [`copy_tree`] follows folders: an autosave bundle is a few levels deep.
+const MAX_COPY_DEPTH: u32 = 16;
+
+fn already_exists(path: &Path) -> std::io::Error {
+ std::io::Error::new(std::io::ErrorKind::AlreadyExists, format!("{} already exists", path.display()))
+}
+
+/// A path beside `of`, named `..-`, that no other call uses.
+fn side_path(of: &Path, suffix: &str) -> std::io::Result {
+ static NEXT: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+ let parent = of.parent().ok_or_else(|| std::io::Error::other(format!("{} has no parent folder", of.display())))?;
+ let name = of.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+ Ok(parent.join(format!(".{name}.{}-{}{suffix}", std::process::id(), NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed))))
+}
+
+/// The name `side` was made from, if it is a [`side_path`] name with `suffix`.
+fn side_of<'a>(side: &'a str, suffix: &str) -> Option<&'a str> {
+ let rest = side.strip_prefix('.')?.strip_suffix(suffix)?;
+ let (name, ids) = rest.rsplit_once('.')?;
+ let (pid, n) = ids.split_once('-')?;
+ let digits = |s: &str| !s.is_empty() && s.bytes().all(|b| b.is_ascii_digit());
+ (!name.is_empty() && digits(pid) && digits(n)).then_some(name)
+}
+
+/// The side paths with `suffix` in `folder` made from `of`.
+fn side_entries(folder: &Path, of: &Path, suffix: &str) -> Vec {
+ let Some(name) = of.file_name().and_then(|n| n.to_str()) else { return Vec::new() };
+ std::fs::read_dir(folder)
+ .into_iter()
+ .flatten()
+ .flatten()
+ .filter(|e| e.file_name().to_str().and_then(|n| side_of(n, suffix)) == Some(name))
+ .map(|e| e.path())
+ .collect()
+}
+
+/// Move the file or folder `from` to `to` without ever replacing anything at `to`. On one volume
+/// a folder is renamed (Windows refuses an existing target; elsewhere only an empty folder could
+/// be replaced) and a file is hard-linked, which fails on an existing target, and then unlinked
+/// at `from`. Otherwise (another volume, e.g. a roaming profile redirected to a network share
+/// while `%LOCALAPPDATA%` stays local) it is copied ([`move_across`]).
+fn move_path(from: &Path, to: &Path) -> std::io::Result<()> {
+ if std::fs::symlink_metadata(to).is_ok() {
+ return Err(already_exists(to));
+ }
+ let meta = std::fs::symlink_metadata(from)?;
+ let moved = if meta.is_dir() { std::fs::rename(from, to) } else { std::fs::hard_link(from, to).and_then(|()| std::fs::remove_file(from)) };
+ match moved {
+ Ok(()) => Ok(()),
+ Err(e) if matches!(e.kind(), std::io::ErrorKind::AlreadyExists | std::io::ErrorKind::DirectoryNotEmpty) => Err(e),
+ Err(_) => move_across(from, to),
+ }
+}
+
+/// Move `from` to `to` by copying. `from` is first renamed aside on its own volume
+/// (`..-.held`, [`hold`]), so a process still writing to the old path (another
+/// launch that couldn't take the lock, an older PhotoCraft) starts a new `from` there instead of
+/// adding to what is copied, and nothing it writes is removed. The held original is copied to a
+/// staged path ([`stage_copy`]), published without replacing anything ([`publish`]), and only
+/// then removed. If the copy or publish fails, the held original is put back ([`put_back`]).
+fn move_across(from: &Path, to: &Path) -> std::io::Result<()> {
+ let held = hold(from)?;
+ match stage_copy(&held, to).and_then(|staged| publish(&staged, to)) {
+ Ok(()) => {
+ let removed = if std::fs::symlink_metadata(&held)?.is_dir() { std::fs::remove_dir_all(&held) } else { std::fs::remove_file(&held) };
+ if let Err(e) = removed {
+ log::warn!("copied {} to {} but couldn't remove {}: {e}", from.display(), to.display(), held.display());
+ }
+ Ok(())
+ }
+ Err(e) => {
+ put_back(&held, from);
+ Err(e)
+ }
+ }
+}
+
+/// Rename `from` aside on its own volume (see [`move_across`]); returns where it is now.
+fn hold(from: &Path) -> std::io::Result {
+ let held = side_path(from, HELD)?;
+ std::fs::rename(from, &held)?;
+ Ok(held)
+}
+
+/// Return the held original `held` to `original`. If `original` has been made again meanwhile (a
+/// writer that kept using the old path), the held folder's entries move into it without replacing
+/// anything ([`move_entries`]); whatever can't move stays held, logged, and is tried again under
+/// the next move's lock ([`adopt_locked`] puts back what a process that ended mid-move held).
+/// Nothing held is ever removed with data in it.
+fn put_back(held: &Path, original: &Path) {
+ if std::fs::symlink_metadata(original).is_err() && std::fs::rename(held, original).is_ok() {
+ return;
+ }
+ if held.is_dir() && original.is_dir() {
+ move_entries(held, original);
+ if std::fs::remove_dir(held).is_ok() {
+ return;
+ }
+ }
+ log::warn!("{} is kept aside: {} exists", held.display(), original.display());
+}
+
+/// Copy `from` to a staging path beside `to` that this call creates exclusively, so nothing
+/// another process made is ever written to or cleaned up. On failure the staged copy is removed.
+fn stage_copy(from: &Path, to: &Path) -> std::io::Result {
+ let staged = side_path(to, STAGED)?;
+ let is_dir = std::fs::symlink_metadata(from)?.is_dir();
+ let copied = if is_dir { copy_tree(from, &staged, 0) } else { copy_file(from, &staged) };
+ if let Err(e) = copied {
+ // `copy_tree` and `copy_file` create `staged` exclusively, and everything under a
+ // fresh folder is new: `AlreadyExists` means `staged` was someone else's to keep.
+ if e.kind() != std::io::ErrorKind::AlreadyExists {
+ let _ = if is_dir { std::fs::remove_dir_all(&staged) } else { std::fs::remove_file(&staged) };
+ }
+ return Err(e);
+ }
+ Ok(staged)
+}
+
+/// Remove copies a process left staged in `folder` when it ended mid-move: disposable, since the
+/// original is still in place or held aside. Called only under the migration lock, which every
+/// staging happens under. Links are never followed.
+fn remove_stale_staging(folder: &Path) {
+ let Ok(entries) = std::fs::read_dir(folder) else { return };
+ for entry in entries.flatten() {
+ if !entry.file_name().to_str().is_some_and(|n| side_of(n, STAGED).is_some()) {
+ continue;
+ }
+ let removed = match entry.file_type() {
+ Ok(t) if t.is_dir() => std::fs::remove_dir_all(entry.path()),
+ Ok(t) if t.is_file() => std::fs::remove_file(entry.path()),
+ _ => continue,
+ };
+ if let Err(e) = removed {
+ log::warn!("couldn't remove the stale staged copy {}: {e}", entry.path().display());
+ }
+ }
+}
+
+/// Give the staged copy its final name `to` without replacing anything there (see [`move_path`]
+/// for the folder and file cases). On failure the staged copy is removed and `to` is untouched.
+fn publish(staged: &Path, to: &Path) -> std::io::Result<()> {
+ let is_dir = std::fs::symlink_metadata(staged)?.is_dir();
+ let published = if std::fs::symlink_metadata(to).is_ok() {
+ Err(already_exists(to))
+ } else if is_dir {
+ std::fs::rename(staged, to)
+ } else {
+ std::fs::hard_link(staged, to).and_then(|()| std::fs::remove_file(staged))
+ };
+ if published.is_err() {
+ let _ = if is_dir { std::fs::remove_dir_all(staged) } else { std::fs::remove_file(staged) };
+ }
+ published
+}
+
+/// Copy the folder `from` to the new folder `to` (created here; an existing `to` is an error):
+/// plain files and folders only (a link or other special file is refused), at most
+/// [`MAX_COPY_DEPTH`] levels.
+fn copy_tree(from: &Path, to: &Path, depth: u32) -> std::io::Result<()> {
+ if depth > MAX_COPY_DEPTH {
+ return Err(std::io::Error::other(format!("{} is nested too deep", from.display())));
+ }
+ std::fs::create_dir(to)?;
+ for entry in std::fs::read_dir(from)? {
+ let entry = entry?;
+ let target = to.join(entry.file_name());
+ if entry.file_type()?.is_dir() {
+ copy_tree(&entry.path(), &target, depth.saturating_add(1))?;
+ } else {
+ copy_file(&entry.path(), &target)?;
+ }
+ }
+ Ok(())
+}
+
+/// Copy one plain file (a link or other special file is refused) to the new file `to` (an
+/// existing `to` is an error), flushed to disk.
+fn copy_file(from: &Path, to: &Path) -> std::io::Result<()> {
+ if !std::fs::symlink_metadata(from)?.file_type().is_file() {
+ return Err(std::io::Error::other(format!("{} is not a plain file", from.display())));
+ }
+ let mut src = std::fs::File::open(from)?;
+ let mut dst = std::fs::OpenOptions::new().write(true).create_new(true).open(to)?;
+ std::io::copy(&mut src, &mut dst)?;
+ dst.sync_all()
+}
+
/// Resolve the data directory from the environment (`env`) and the executable's folder.
pub fn resolve(env: impl Fn(&str) -> Option, exe_dir: Option<&Path>) -> DataDir {
if let Some(d) = env("PHOTOCRAFT_CONFIG_DIR").filter(|d| !d.is_empty()) {
@@ -223,6 +599,300 @@ mod tests {
let _ = std::fs::remove_dir_all(&root);
}
+ /// #5648: on Windows, autosaves go to the machine-local `%LOCALAPPDATA%`, not the roaming
+ /// profile; an override or portable folder keeps them inside itself.
+ #[test]
+ fn autosaves_stay_out_of_the_roaming_profile() {
+ let root = temp("recovery-local");
+ let settings = root.join("appdata").join("Photocraft");
+ let local = root.join("local");
+ let env = env_of(&[("LOCALAPPDATA", &local)]);
+ let platform = DataDir { dir: Some(settings.clone()), mode: Mode::Platform, warning: None };
+ let expected = if cfg!(windows) { local.join("Photocraft").join("Recovery") } else { settings.join("Recovery") };
+ assert_eq!(resolve_recovery(&platform, &env), Some(expected));
+ for mode in [Mode::Override, Mode::Portable] {
+ let d = DataDir { dir: Some(settings.clone()), mode, warning: None };
+ assert_eq!(resolve_recovery(&d, &env), Some(settings.join("Recovery")), "{mode:?}");
+ }
+ // No (or an empty) LOCALAPPDATA: beside the settings, as before.
+ let empty = PathBuf::new();
+ assert_eq!(resolve_recovery(&platform, env_of(&[("LOCALAPPDATA", &empty)])), Some(settings.join("Recovery")));
+ assert_eq!(resolve_recovery(&platform, |_| None), Some(settings.join("Recovery")));
+ let nowhere = DataDir { dir: None, mode: Mode::Platform, warning: None };
+ assert_eq!(resolve_recovery(&nowhere, |_| None), None);
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ /// An autosave bundle and its sidecar, as `format::Autosaver` writes them.
+ fn autosave(dir: &Path, key: &str) {
+ std::fs::create_dir_all(dir.join(format!("{key}.pcraft"))).unwrap();
+ std::fs::write(dir.join(format!("{key}.pcraft")).join("manifest.json"), key).unwrap();
+ std::fs::write(dir.join(format!("{key}.json")), key).unwrap();
+ }
+
+ #[test]
+ fn autosaves_from_the_old_folder_move_to_the_new_one() {
+ let root = temp("recovery-move");
+ let legacy = root.join("roaming").join("Recovery");
+ let dir = root.join("local").join("Photocraft").join("Recovery");
+ autosave(&legacy, "a");
+ assert_eq!(adopt_legacy_recovery(&legacy, &dir), dir);
+ assert!(!legacy.exists(), "the old folder is gone");
+ assert_eq!(std::fs::read_to_string(dir.join("a.pcraft").join("manifest.json")).unwrap(), "a");
+ assert!(dir.join("a.json").is_file());
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ #[test]
+ fn autosaves_merge_into_an_existing_folder_without_overwriting() {
+ let root = temp("recovery-merge");
+ let legacy = root.join("roaming").join("Recovery");
+ let dir = root.join("local").join("Recovery");
+ autosave(&legacy, "old");
+ autosave(&legacy, "both");
+ // A temp file of an interrupted write moves along, for the recovery store's sweep.
+ let temp_file = ".old.json.4294967294-0.pcsave.tmp";
+ std::fs::write(legacy.join(temp_file), b"partial").unwrap();
+ std::fs::create_dir_all(&dir).unwrap();
+ std::fs::write(dir.join("both.json"), "newer").unwrap();
+ assert_eq!(adopt_legacy_recovery(&legacy, &dir), dir);
+ assert!(dir.join(temp_file).is_file() && !legacy.join(temp_file).exists());
+ assert!(dir.join("old.pcraft").is_dir() && dir.join("old.json").is_file(), "a whole autosave moves");
+ assert_eq!(std::fs::read_to_string(dir.join("both.json")).unwrap(), "newer", "never overwritten");
+ assert!(!dir.join("both.pcraft").exists(), "a clashing autosave isn't split");
+ assert!(legacy.join("both.pcraft").is_dir() && legacy.join("both.json").is_file(), "it stays behind whole");
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ #[test]
+ fn autosaves_that_cannot_move_keep_being_used_where_they_are() {
+ let root = temp("recovery-stuck");
+ let legacy = root.join("roaming").join("Recovery");
+ autosave(&legacy, "a");
+ // A file where the new folder's parent should be: nothing can be created there.
+ std::fs::write(root.join("blocked"), b"in the way").unwrap();
+ let dir = root.join("blocked").join("Recovery");
+ assert_eq!(adopt_legacy_recovery(&legacy, &dir), legacy);
+ assert!(legacy.join("a.json").is_file(), "nothing lost");
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ #[test]
+ fn an_empty_old_folder_is_removed_even_where_it_cannot_move() {
+ let root = temp("recovery-empty");
+ let legacy = root.join("roaming").join("Recovery");
+ std::fs::create_dir_all(&legacy).unwrap();
+ std::fs::write(root.join("blocked"), b"in the way").unwrap();
+ let dir = root.join("blocked").join("Recovery");
+ assert_eq!(adopt_legacy_recovery(&legacy, &dir), dir, "nothing to keep listed");
+ assert!(!legacy.exists(), "the empty old folder is gone");
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ /// Where a rename can't cross volumes (a roaming profile on a network share), an autosave
+ /// is copied whole, nested folders included, and only then removed.
+ #[test]
+ fn a_move_across_volumes_copies_then_removes() {
+ let root = temp("recovery-copy");
+ let legacy = root.join("roaming").join("Recovery");
+ autosave(&legacy, "a");
+ std::fs::create_dir_all(legacy.join("a.pcraft").join("tiles")).unwrap();
+ std::fs::write(legacy.join("a.pcraft").join("tiles").join("t0.zst"), b"tile").unwrap();
+ let dir = root.join("local").join("Recovery");
+ std::fs::create_dir_all(root.join("local")).unwrap();
+ move_across(&legacy, &dir).unwrap();
+ assert!(!legacy.exists(), "the original is removed after the copy");
+ assert_eq!(side_leftovers(&root.join("roaming")), 0, "nothing is left held aside");
+ assert_eq!(std::fs::read_to_string(dir.join("a.pcraft").join("manifest.json")).unwrap(), "a");
+ assert_eq!(std::fs::read(dir.join("a.pcraft").join("tiles").join("t0.zst")).unwrap(), b"tile");
+ assert_eq!(std::fs::read_to_string(dir.join("a.json")).unwrap(), "a");
+ // One file on its own, as the per-autosave moves do.
+ move_across(&dir.join("a.json"), &root.join("a.json")).unwrap();
+ assert!(!dir.join("a.json").exists() && root.join("a.json").is_file());
+ assert_eq!(side_leftovers(&dir) + side_leftovers(&root), 0);
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ #[test]
+ fn a_failed_copy_puts_the_original_back_and_leaves_no_partial_copy() {
+ let root = temp("recovery-copy-fail");
+ let legacy = root.join("Recovery");
+ autosave(&legacy, "a");
+ // Deeper than any bundle: the copy gives up part way.
+ let mut deep = legacy.join("a.pcraft");
+ for _ in 0..=MAX_COPY_DEPTH {
+ deep = deep.join("d");
+ }
+ std::fs::create_dir_all(&deep).unwrap();
+ let dir = root.join("Local");
+ assert!(move_across(&legacy, &dir).is_err());
+ assert!(!dir.exists(), "nothing is published");
+ assert_eq!(side_leftovers(&root), 0, "no staged copy, nothing left held aside");
+ assert!(legacy.join("a.json").is_file() && deep.is_dir(), "the original is back in place");
+ // A target that already exists is never copied into or removed.
+ std::fs::create_dir_all(&dir).unwrap();
+ std::fs::write(dir.join("keep"), b"mine").unwrap();
+ assert!(move_across(&legacy.join("a.json"), &dir).is_err());
+ assert_eq!(std::fs::read(dir.join("keep")).unwrap(), b"mine");
+ assert!(legacy.join("a.json").is_file());
+ assert_eq!(side_leftovers(&root) + side_leftovers(&legacy), 0);
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ /// Staged (`.moving`) and held (`.held`) side paths left in `dir`.
+ fn side_leftovers(dir: &Path) -> usize {
+ std::fs::read_dir(dir)
+ .unwrap()
+ .flatten()
+ .filter(|e| e.file_name().to_str().is_some_and(|n| side_of(n, STAGED).is_some() || side_of(n, HELD).is_some()))
+ .count()
+ }
+
+ /// The target appears after the copy is staged (another process got there first): publishing
+ /// fails, that process's target keeps its contents, the staged copy is removed and the
+ /// original is left as it was. Folder and file alike.
+ #[test]
+ fn a_target_that_appears_while_copying_is_never_replaced_or_removed() {
+ let root = temp("recovery-race");
+ let legacy = root.join("roaming").join("Recovery");
+ autosave(&legacy, "a");
+ let local = root.join("local");
+ std::fs::create_dir_all(&local).unwrap();
+ // A whole folder.
+ let dir = local.join("Recovery");
+ let staged = stage_copy(&legacy, &dir).unwrap();
+ autosave(&dir, "theirs");
+ let e = publish(&staged, &dir).unwrap_err();
+ assert_eq!(e.kind(), std::io::ErrorKind::AlreadyExists);
+ assert_eq!(std::fs::read_to_string(dir.join("theirs.json")).unwrap(), "theirs", "their folder is intact");
+ assert!(!dir.join("a.json").exists(), "nothing was copied into it");
+ assert!(!staged.exists() && side_leftovers(&local) == 0, "only the staged copy is removed");
+ assert!(legacy.join("a.json").is_file(), "the original is untouched");
+ // One file.
+ let to = dir.join("a.json");
+ let staged = stage_copy(&legacy.join("a.json"), &to).unwrap();
+ std::fs::write(&to, "theirs").unwrap();
+ assert_eq!(publish(&staged, &to).unwrap_err().kind(), std::io::ErrorKind::AlreadyExists);
+ assert_eq!(std::fs::read_to_string(&to).unwrap(), "theirs");
+ assert!(!staged.exists() && legacy.join("a.json").is_file());
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ /// A process holds the lock and is copying the old folder (held aside, copy staged) when a
+ /// second launch gives up waiting. The second launch must get the new folder, never the old
+ /// one, and what it writes there survives the first one finishing: the publish refuses the
+ /// now-existing folder and the original is put back, so both autosaves stay (#6412 review).
+ #[test]
+ fn a_launch_that_times_out_never_writes_where_a_move_removes() {
+ let root = temp("recovery-timeout");
+ let legacy = root.join("roaming").join("Recovery");
+ autosave(&legacy, "old");
+ let local = root.join("local");
+ std::fs::create_dir_all(&local).unwrap();
+ let dir = local.join("Recovery");
+ // First process: takes the lock, sets the original aside and stages its copy, then pauses.
+ let first = std::fs::OpenOptions::new().create(true).truncate(false).write(true).open(local.join(MIGRATION_LOCK)).unwrap();
+ first.lock().unwrap();
+ let held = hold(&legacy).unwrap();
+ let staged = stage_copy(&held, &dir).unwrap();
+ // Second launch: times out and writes a newer autosave where it was told to.
+ let chosen = adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO);
+ assert_eq!(chosen, dir, "a launch that couldn't get the lock never uses the old folder");
+ autosave(&chosen, "new");
+ // First process resumes: publish, and on failure put the original back (as `move_across`).
+ assert_eq!(publish(&staged, &dir).unwrap_err().kind(), std::io::ErrorKind::AlreadyExists);
+ put_back(&held, &legacy);
+ drop(first);
+ assert_eq!(std::fs::read_to_string(dir.join("new.json")).unwrap(), "new", "the newer autosave survives");
+ assert_eq!(std::fs::read_to_string(legacy.join("old.json")).unwrap(), "old", "the old one is back in place");
+ assert_eq!(side_leftovers(&local) + side_leftovers(&root.join("roaming")), 0);
+ // The next launch merges them.
+ assert_eq!(adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO), dir);
+ assert!(dir.join("old.json").is_file() && dir.join("new.json").is_file() && !legacy.exists());
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ /// A writer that still uses the old path while it is being copied (an older PhotoCraft)
+ /// starts a new folder there; the move removes only the original it held aside.
+ #[test]
+ fn a_write_to_the_old_path_during_a_copy_is_not_removed() {
+ let root = temp("recovery-old-writer");
+ let legacy = root.join("roaming").join("Recovery");
+ autosave(&legacy, "old");
+ let local = root.join("local");
+ std::fs::create_dir_all(&local).unwrap();
+ let dir = local.join("Recovery");
+ let held = hold(&legacy).unwrap();
+ let staged = stage_copy(&held, &dir).unwrap();
+ autosave(&legacy, "new");
+ publish(&staged, &dir).unwrap();
+ std::fs::remove_dir_all(&held).unwrap();
+ assert_eq!(std::fs::read_to_string(dir.join("old.json")).unwrap(), "old");
+ assert_eq!(std::fs::read_to_string(legacy.join("new.json")).unwrap(), "new", "the new write is untouched");
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ /// What a process killed mid-move left is tidied at the next move: a held original is put
+ /// back (it may be the only copy) and moved, a staged copy is removed; other dot-files and
+ /// look-alike names are not touched.
+ #[test]
+ fn a_killed_move_is_tidied_next_time() {
+ let root = temp("recovery-stale");
+ let roaming = root.join("roaming");
+ let legacy = roaming.join("Recovery");
+ autosave(&legacy, "a");
+ let held = hold(&legacy).unwrap();
+ assert!(!legacy.exists() && held.is_dir());
+ let local = root.join("local");
+ let dir = local.join("Recovery");
+ let stale = local.join(".Recovery.4294967294-3.moving");
+ autosave(&stale, "half");
+ let kept = [local.join(".Recovery.moving"), local.join(".keep.1-x.moving"), local.join("notes.txt")];
+ for k in &kept {
+ std::fs::write(k, b"x").unwrap();
+ }
+ assert_eq!(adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO), dir);
+ assert_eq!(std::fs::read_to_string(dir.join("a.json")).unwrap(), "a", "the held original was put back and moved");
+ assert!(!stale.exists(), "the stale staged copy is gone");
+ assert_eq!(side_leftovers(&roaming), 0);
+ assert!(kept.iter().all(|k| k.is_file()), "only side names are touched");
+ assert_eq!(side_of(".a.json.12-0.moving", STAGED), Some("a.json"));
+ assert!(side_of("a.json.12-0.moving", STAGED).is_none() && side_of(".a.json.-0.moving", STAGED).is_none());
+ assert!(side_of(".a.json.12-0.held", STAGED).is_none() && side_of(".a.json.12-0.held", HELD) == Some("a.json"));
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ /// While another process holds the move lock, a launch moves nothing and uses the new folder;
+ /// once the lock is released, the move happens.
+ #[test]
+ fn a_move_waits_for_another_process_holding_the_lock() {
+ let root = temp("recovery-lock");
+ let legacy = root.join("roaming").join("Recovery");
+ autosave(&legacy, "a");
+ let dir = root.join("local").join("Recovery");
+ std::fs::create_dir_all(root.join("local")).unwrap();
+ let held = std::fs::OpenOptions::new().create(true).truncate(false).write(true).open(root.join("local").join(MIGRATION_LOCK)).unwrap();
+ held.lock().unwrap();
+ assert_eq!(adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO), dir);
+ assert!(legacy.join("a.json").is_file() && !dir.exists(), "nothing moved under another's lock");
+ drop(held);
+ assert_eq!(adopt_legacy_recovery_waiting(&legacy, &dir, std::time::Duration::ZERO), dir);
+ assert!(dir.join("a.json").is_file() && !legacy.exists());
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
+ #[test]
+ fn no_old_folder_or_the_same_folder_changes_nothing() {
+ let root = temp("recovery-noop");
+ let dir = root.join("Recovery");
+ assert_eq!(adopt_legacy_recovery(&root.join("missing"), &dir), dir);
+ assert!(!dir.exists(), "nothing is created up front");
+ autosave(&dir, "a");
+ assert_eq!(adopt_legacy_recovery(&dir, &dir), dir);
+ assert!(dir.join("a.json").is_file());
+ let _ = std::fs::remove_dir_all(&root);
+ }
+
#[test]
fn missing_exe_dir_or_env_never_panics() {
let d = resolve(|_| None, None);
diff --git a/apps/photocraft/src/logging.rs b/apps/photocraft/src/logging.rs
index 292428b8ce..33b7df2462 100644
--- a/apps/photocraft/src/logging.rs
+++ b/apps/photocraft/src/logging.rs
@@ -4,7 +4,9 @@
//! lost device, the crash guard's panic report) vanished. A launch from a desktop menu has no
//! terminal, so the file is what a bug report can attach: `/logs/photocraft.log`
//! (see `app_dirs`). Each start moves the previous log to `photocraft.1.log` (and that one to
-//! `.2`), so the log of a run that crashed survives the next launch.
+//! `.2`), so the log of a run that crashed survives the next launch. A start while another
+//! instance is still running leaves that instance's log alone and writes `photocraft-.log`
+//! (see [`rotate`]).
//!
//! Levels: `info` for PhotoCraft's own crates, `warn` for everything else (wgpu and naga are
//! chatty). `RUST_LOG` replaces that with env_logger-style directives: `debug`,
@@ -15,7 +17,7 @@
//! written once the file is attached. Writing never panics: a file that can't be created or
//! written leaves standard error as the only sink.
-use std::fs::File;
+use std::fs::{File, OpenOptions, TryLockError};
use std::io::Write;
use std::path::{Path, PathBuf};
use std::sync::{Mutex, OnceLock, PoisonError};
@@ -116,10 +118,76 @@ fn numbered(dir: &Path, n: usize) -> PathBuf {
if n == 0 { dir.join(LOG_FILE) } else { dir.join(format!("photocraft.{n}.log")) }
}
-/// Shift the previous logs up one (`.log` → `.1.log` → … → `..log`, the oldest dropped)
-/// and create a fresh, empty log file in `dir` (created if missing).
-pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
+/// Held by the instance that writes [`LOG_FILE`], from its start until it exits. A separate lock
+/// file rather than a lock on the log itself: Windows locks are mandatory, and a locked log could
+/// not be opened for a bug report while the app runs.
+pub const OWNER_LOCK: &str = "photocraft.lock";
+/// Held while one start rotates and prunes the logs, so two starts at once can't interleave.
+pub const ROTATE_LOCK: &str = "rotate.lock";
+
+/// The log of an instance started while another one was writing [`LOG_FILE`].
+fn instance_log(dir: &Path, pid: u32) -> PathBuf {
+ dir.join(format!("photocraft-{pid}.log"))
+}
+
+/// The lock file that marks [`instance_log`] as in use.
+fn instance_lock(dir: &Path, pid: u32) -> PathBuf {
+ dir.join(format!("photocraft-{pid}.lock"))
+}
+
+/// The process id in an [`instance_log`] file name.
+fn instance_pid(name: &str) -> Option {
+ let digits = name.strip_prefix("photocraft-")?.strip_suffix(".log")?;
+ if digits.is_empty() || !digits.bytes().all(|b| b.is_ascii_digit()) {
+ return None;
+ }
+ digits.parse().ok()
+}
+
+fn open_lock(path: &Path) -> std::io::Result {
+ OpenOptions::new().read(true).write(true).create(true).truncate(false).open(path)
+}
+
+/// Take `file`'s lock without waiting: `Ok(true)` holds it, `Ok(false)` when another process holds it.
+fn try_hold(file: &File) -> std::io::Result {
+ match file.try_lock() {
+ Ok(()) => Ok(true),
+ Err(TryLockError::WouldBlock) => Ok(false),
+ Err(TryLockError::Error(e)) => Err(e),
+ }
+}
+
+/// Open a fresh, empty log file in `dir` (created if missing).
+///
+/// Normally the previous logs shift up one (`.log` → `.1.log` → … → `..log`, the oldest
+/// dropped). While another instance is still writing [`LOG_FILE`] (it holds [`OWNER_LOCK`]), the
+/// chain is left alone and this start writes `photocraft-.log` instead: rotating would move
+/// that instance's live log away and, a few launches later, delete it (#6432). Such side-by-side
+/// logs are pruned to the newest [`KEEP`] once their instances have exited. On a file system
+/// without locks every start rotates, as before.
+pub fn rotate(dir: &Path) -> std::io::Result {
std::fs::create_dir_all(dir)?;
+ // Waits only for another start's few file operations; without locking support, go on.
+ let guard = open_lock(&dir.join(ROTATE_LOCK)).ok().filter(|g| g.lock().is_ok());
+ let log = rotate_locked(dir);
+ drop(guard);
+ log
+}
+
+fn rotate_locked(dir: &Path) -> std::io::Result {
+ prune_instance_logs(dir);
+ let owner = open_lock(&dir.join(OWNER_LOCK))?;
+ let state = try_hold(&owner);
+ if let Ok(false) = state {
+ let pid = std::process::id();
+ let lock = open_lock(&instance_lock(dir, pid))?;
+ let held = try_hold(&lock).unwrap_or(false);
+ let path = instance_log(dir, pid);
+ let file = File::create(&path)?;
+ return Ok(LogFile { path, file, owner: held.then_some(lock) });
+ }
+ // This start holds the owner lock (or the file system has no locks).
+ let held = state.unwrap_or(false);
for n in (1..=KEEP).rev() {
match std::fs::rename(numbered(dir, n - 1), numbered(dir, n)) {
Err(e) if e.kind() != std::io::ErrorKind::NotFound => return Err(e),
@@ -128,7 +196,40 @@ pub fn rotate(dir: &Path) -> std::io::Result<(PathBuf, File)> {
}
let path = numbered(dir, 0);
let file = File::create(&path)?;
- Ok((path, file))
+ Ok(LogFile { path, file, owner: held.then_some(owner) })
+}
+
+/// Remove the side-by-side logs of instances that have exited, all but the newest [`KEEP`].
+/// A log whose lock file is held belongs to a running instance and is never touched. Failures
+/// are ignored: pruning only saves disk space.
+fn prune_instance_logs(dir: &Path) {
+ let Ok(entries) = std::fs::read_dir(dir) else { return };
+ let mut finished: Vec<(SystemTime, u32)> = Vec::new();
+ for entry in entries.flatten() {
+ let Some(pid) = entry.file_name().to_str().and_then(instance_pid) else { continue };
+ // A missing lock file means nobody holds it; an unknown lock state counts as running.
+ let running = match OpenOptions::new().read(true).write(true).open(instance_lock(dir, pid)) {
+ Ok(lock) => !try_hold(&lock).unwrap_or(false),
+ Err(_) => false,
+ };
+ if !running {
+ let modified = entry.metadata().and_then(|m| m.modified()).unwrap_or(SystemTime::UNIX_EPOCH);
+ finished.push((modified, pid));
+ }
+ }
+ finished.sort_unstable_by(|a, b| b.cmp(a));
+ for &(_, pid) in finished.iter().skip(KEEP) {
+ let _ = std::fs::remove_file(instance_log(dir, pid));
+ let _ = std::fs::remove_file(instance_lock(dir, pid));
+ }
+}
+
+/// A log file opened by [`rotate`].
+pub struct LogFile {
+ pub path: PathBuf,
+ pub file: File,
+ /// The held lock that marks `path` as in use; `None` where locking isn't supported.
+ owner: Option,
}
/// One formatted log line: ` [] : \n`.
@@ -205,17 +306,20 @@ pub struct AppLogger {
filter: Filter,
stderr: bool,
sink: Mutex,
+ /// The lock that marks the attached log file as in use (see [`rotate`]); held until exit.
+ owner: Mutex>,
}
impl AppLogger {
pub fn new(filter: Filter, stderr: bool) -> AppLogger {
- AppLogger { filter, stderr, sink: Mutex::new(Sink::new(MAX_FILE_BYTES)) }
+ AppLogger { filter, stderr, sink: Mutex::new(Sink::new(MAX_FILE_BYTES)), owner: Mutex::new(None) }
}
/// Rotate the logs in `dir` and send records to the fresh file; returns its path.
pub fn attach_dir(&self, dir: &Path) -> Result {
- let (path, file) = rotate(dir).map_err(|e| format!("{}: {e}", dir.display()))?;
+ let LogFile { path, file, owner } = rotate(dir).map_err(|e| format!("{}: {e}", dir.display()))?;
self.sink.lock().unwrap_or_else(PoisonError::into_inner).attach(file);
+ *self.owner.lock().unwrap_or_else(PoisonError::into_inner) = owner;
Ok(path)
}
}
@@ -318,7 +422,7 @@ mod tests {
fn rotation_keeps_the_previous_logs_and_starts_an_empty_file() {
let dir = temp_dir("rotate");
for run in 1..=4 {
- let (path, _file) = rotate(&dir).expect("rotate");
+ let LogFile { path, file: _file, owner: _owner } = rotate(&dir).expect("rotate");
assert_eq!(path, dir.join(LOG_FILE));
assert_eq!(std::fs::read_to_string(&path).expect("read"), "");
std::fs::write(&path, format!("run {run}")).expect("write");
@@ -330,6 +434,64 @@ mod tests {
let _ = std::fs::remove_dir_all(&dir);
}
+ /// #6432: a second launch moved the running instance's live log to `.1.log`, a third to
+ /// `.2.log`, and a fourth deleted it.
+ #[test]
+ fn a_second_start_leaves_the_running_instance_log_alone() {
+ let dir = temp_dir("second");
+ let mut first = rotate(&dir).expect("first start");
+ assert_eq!(first.path, dir.join(LOG_FILE));
+ first.file.write_all(b"first, before\n").expect("write");
+ for _ in 0..KEEP + 1 {
+ let second = rotate(&dir).expect("second start");
+ assert_eq!(second.path, instance_log(&dir, std::process::id()));
+ assert_eq!(read(&second.path), "");
+ }
+ first.file.write_all(b"first, after\n").expect("write");
+ assert_eq!(read(&dir.join(LOG_FILE)), "first, before\nfirst, after\n");
+ assert!(!dir.join("photocraft.1.log").exists(), "the running instance's log was rotated");
+ // Once the first instance is gone, the next start rotates as before.
+ drop(first);
+ let third = rotate(&dir).expect("third start");
+ assert_eq!(third.path, dir.join(LOG_FILE));
+ assert_eq!(read(&dir.join("photocraft.1.log")), "first, before\nfirst, after\n");
+ drop(third);
+ let _ = std::fs::remove_dir_all(&dir);
+ }
+
+ #[test]
+ fn instance_logs_are_pruned_only_when_no_one_holds_them() {
+ let dir = temp_dir("prune");
+ let first = rotate(&dir).expect("first start");
+ // Earlier side-by-side runs that have exited, oldest first; the oldest has no lock file
+ // (as if its lock file had been removed), the others an unlocked one.
+ let now = SystemTime::now();
+ for (age, pid) in [(400u64, 1u32), (300, 2), (200, 3), (100, 4)] {
+ let path = instance_log(&dir, pid);
+ std::fs::write(&path, format!("run {pid}")).expect("write");
+ File::options().write(true).open(&path).expect("open").set_modified(now - Duration::from_secs(age)).expect("mtime");
+ if pid != 1 {
+ std::fs::write(instance_lock(&dir, pid), "").expect("lock file");
+ }
+ }
+ // One older still running: its log is never removed, however old.
+ let live = instance_log(&dir, 5);
+ std::fs::write(&live, "live").expect("write");
+ File::options().write(true).open(&live).expect("open").set_modified(now - Duration::from_secs(900)).expect("mtime");
+ let held = File::create(instance_lock(&dir, 5)).expect("lock file");
+ held.try_lock().expect("hold");
+
+ let second = rotate(&dir).expect("second start");
+ assert_eq!(second.path, instance_log(&dir, std::process::id()));
+ // The newest KEEP finished ones stay, the rest go with their lock files.
+ assert!(instance_log(&dir, 4).exists() && instance_log(&dir, 3).exists());
+ assert!(!instance_log(&dir, 2).exists() && !instance_log(&dir, 1).exists());
+ assert!(!instance_lock(&dir, 2).exists());
+ assert_eq!(read(&live), "live");
+ drop((first, second, held));
+ let _ = std::fs::remove_dir_all(&dir);
+ }
+
#[test]
fn rotation_into_an_unusable_directory_is_an_error_not_a_panic() {
let dir = temp_dir("blocked");
@@ -355,7 +517,7 @@ mod tests {
#[test]
fn lines_logged_before_the_file_exists_are_written_when_it_is_attached() {
let dir = temp_dir("pending");
- let (path, file) = rotate(&dir).expect("rotate");
+ let LogFile { path, file, .. } = rotate(&dir).expect("rotate");
let mut sink = Sink::new(MAX_FILE_BYTES);
sink.write("early 1\n");
sink.write("early 2\n");
@@ -368,7 +530,7 @@ mod tests {
#[test]
fn the_pending_buffer_is_bounded_and_says_how_much_it_dropped() {
let dir = temp_dir("bounded");
- let (path, file) = rotate(&dir).expect("rotate");
+ let LogFile { path, file, .. } = rotate(&dir).expect("rotate");
let mut sink = Sink::new(MAX_FILE_BYTES);
for i in 0..MAX_PENDING + 5 {
sink.write(&format!("line {i}\n"));
@@ -384,7 +546,7 @@ mod tests {
#[test]
fn the_file_stops_at_its_size_cap_with_one_note() {
let dir = temp_dir("cap");
- let (path, file) = rotate(&dir).expect("rotate");
+ let LogFile { path, file, .. } = rotate(&dir).expect("rotate");
let mut sink = Sink::new(100);
sink.attach(file);
for i in 0..50 {
diff --git a/apps/photocraft/src/main.rs b/apps/photocraft/src/main.rs
index 0b82237a39..05355e55bf 100644
--- a/apps/photocraft/src/main.rs
+++ b/apps/photocraft/src/main.rs
@@ -1,9 +1,18 @@
-//! Photocraft desktop app.
+//! PhotoCraft desktop app.
//!
//! Usage: `photocraft [--control ] [--control-token <64-hex> |
//! --control-token-file ] [--automation-read-root ]
//! [--automation-write-root ] [--safe-gpu] [--in-window-menus] [--present-mode ]
-//! [--frame-latency ] [--stroke-trace ] [files…]`
+//! [--frame-latency ] [--stroke-trace ] [--new-instance] [--] [files…]`
+//! (`photocraft --help` prints [`USAGE`]; `--version` prints the version).
+//!
+//! Any other argument starting with `-` is a usage error (exit status 2, issue #6431), so a typo
+//! such as `--safegpu` doesn't open the window and then fail to open the flag as a file. A file
+//! whose name starts with `-` goes after `--`.
+//!
+//! On Windows and Linux a launch hands its files to the PhotoCraft that is already running (new
+//! tabs in its window) and exits; `--new-instance` starts a separate copy instead, as does any
+//! `--control` launch (see `single_instance`).
//!
//! `--present-mode` (`fifo`, `autovsync`, `novsync`) and `--frame-latency` (1–3) override how
//! frames reach the display for this launch (`PHOTOCRAFT_PRESENT_MODE` / `…_FRAME_LATENCY`;
@@ -50,9 +59,18 @@ mod linux_libs;
mod logging;
mod monitor_profile;
mod photoshop_settings;
+// Save As through the desktop portal, which reports the file type picked (#6121).
+#[cfg(target_os = "linux")]
+mod portal_save;
mod presentation;
+// The print portal needs the session bus (zbus, Linux only); its pure helpers are tested everywhere.
+#[cfg(any(target_os = "linux", test))]
+mod print_portal;
mod screen_color;
mod services;
+// macOS gets one instance from LaunchServices (open-documents Apple events).
+#[cfg(any(not(target_os = "macos"), test))]
+mod single_instance;
// Windows gets pen pressure from winit (WM_POINTER); the web runner has its own listener.
#[cfg(any(target_os = "macos", target_os = "linux", test))]
mod tablet;
@@ -139,21 +157,63 @@ fn parse_control_port(value: &str, source: &str) -> Result {
value.trim().parse().map_err(|_| format!("{source}: `{value}` is not a valid port (expected a number from 0 to 65535)"))
}
-/// Process exit status for the collected `--control` / `PHOTOCRAFT_CONTROL_PORT` errors: `None`
-/// when there are none, else 2 (a command-line usage error), never 0.
-fn control_args_exit_code(errors: &[String]) -> Option {
+/// Process exit status for the collected usage errors (a bad `--control` /
+/// `PHOTOCRAFT_CONTROL_PORT`, an unknown option): `None` when there are none, else 2 (a
+/// command-line usage error), never 0.
+fn usage_exit_code(errors: &[String]) -> Option {
if errors.is_empty() { None } else { Some(2) }
}
+/// `photocraft --help`. Keep in step with the options `main` accepts and the module docs.
+const USAGE: &str = "\
+Usage: photocraft [options] [--] [files…]
+
+Opens PhotoCraft with the given files.
+
+Options:
+ -h, --help Print this help and exit
+ --version Print the version, commit and build date and exit
+ --safe-gpu Start with the CPU renderer for this launch (after a graphics driver crash)
+ --in-window-menus macOS: keep the menus inside the window instead of the menu bar
+ --new-instance Windows and Linux: start a separate PhotoCraft instead of opening
+ the files in the one already running
+ --present-mode How frames reach the display: fifo, autovsync or novsync
+ --frame-latency Frames queued for the display: 1 to 3
+ --stroke-trace
+ Time each brush stroke's frames
+ --control Start the localhost JSON-lines control server on this port
+ --control-token <64-hex> Control server token (default: a new random one, printed)
+ --control-token-file Read the control server token from this file, or create it
+ with a new one
+ --automation-read-root Directory the control server may read files from
+ --automation-write-root
+ Directory the control server may write files to
+ -- Treat every later argument as a file, even one starting with `-`
+
+A bad --present-mode, --frame-latency or --stroke-trace value is reported and ignored.
+Environment: PHOTOCRAFT_CONTROL_PORT, PHOTOCRAFT_CONTROL_TOKEN, PHOTOCRAFT_CONTROL_TOKEN_FILE,
+PHOTOCRAFT_AUTOMATION_READ_ROOT, PHOTOCRAFT_AUTOMATION_WRITE_ROOT, PHOTOCRAFT_PRESENT_MODE,
+PHOTOCRAFT_FRAME_LATENCY, PHOTOCRAFT_STROKE_TRACE, PHOTOCRAFT_IN_WINDOW_MENUS, PHOTOCRAFT_NEW_INSTANCE,
+PHOTOCRAFT_CONFIG_DIR.
+";
+
+/// Print to standard output for `--help` / `--version`. Unlike `println!`, never panics when
+/// stdout is closed or a pipe (`photocraft --help | head -1`).
+fn print_stdout(text: &str) {
+ use std::io::Write as _;
+ let mut out = std::io::stdout().lock();
+ let _ = out.write_all(text.as_bytes()).and_then(|()| out.flush());
+}
+
#[cfg(test)]
mod control_port_tests {
- use super::{control_args_exit_code, parse_control_port};
+ use super::{parse_control_port, usage_exit_code};
#[test]
fn control_port_errors_exit_non_zero() {
- assert_eq!(control_args_exit_code(&[]), None);
+ assert_eq!(usage_exit_code(&[]), None);
let errors = vec![parse_control_port("nope", "--control").unwrap_err()];
- assert_eq!(control_args_exit_code(&errors), Some(2));
+ assert_eq!(usage_exit_code(&errors), Some(2));
}
#[test]
@@ -181,11 +241,11 @@ fn main() -> eframe::Result {
// The system font scan can take seconds (minutes on some Macs): run it off the UI thread.
photocraft_ui_egui::type_tool::warm_fonts();
let mut control_port: Option = None;
- let mut control_arg_errors: Vec = Vec::new();
+ let mut usage_errors: Vec = Vec::new();
if let Some(value) = std::env::var("PHOTOCRAFT_CONTROL_PORT").ok().filter(|v| !v.trim().is_empty()) {
match parse_control_port(&value, "PHOTOCRAFT_CONTROL_PORT") {
Ok(port) => control_port = Some(port),
- Err(error) => control_arg_errors.push(error),
+ Err(error) => usage_errors.push(error),
}
}
let mut control_token = None;
@@ -198,28 +258,59 @@ fn main() -> eframe::Result {
// reported in a notice once the app is up; a control token is a usage error like a bad port.
let mut unreadable_paths: Vec = Vec::new();
let mut safe_gpu = false;
+ let mut new_instance = false;
+ // Options that apply only to the process they're given to; a launch with any keeps its own.
+ let mut launch_options: Vec<&'static str> = Vec::new();
let (mut present_mode_arg, mut frame_latency_arg, mut stroke_trace_arg): (Option, Option, Option) = (None, None, None);
let mut in_window_menus = std::env::var_os("PHOTOCRAFT_IN_WINDOW_MENUS").is_some_and(|v| !v.is_empty() && v != "0");
let mut args = std::env::args_os().skip(1);
+ // After `--`, every argument is a file, even one that starts with `-`.
+ let mut only_files = false;
while let Some(a) = args.next() {
+ if only_files {
+ match a.into_string() {
+ Ok(s) => files.push(s),
+ Err(raw) => unreadable_paths.push(raw.to_string_lossy().into_owned()),
+ }
+ continue;
+ }
match a.to_str() {
+ Some("--") => only_files = true,
+ Some("--help" | "-h") => {
+ print_stdout(USAGE);
+ return Ok(());
+ }
Some("--control") => match args.next() {
Some(value) => match parse_control_port(&value.to_string_lossy(), "--control") {
Ok(port) => control_port = Some(port),
- Err(error) => control_arg_errors.push(error),
+ Err(error) => usage_errors.push(error),
},
- None => control_arg_errors.push("--control: missing port value (expected `--control `)".to_string()),
+ None => usage_errors.push("--control: missing port value (expected `--control `)".to_string()),
},
Some("--control-token") => match args.next().map(std::ffi::OsString::into_string) {
Some(Ok(token)) => control_token = Some(token),
- Some(Err(raw)) => control_arg_errors.push(format!("--control-token: value is not valid Unicode (`{}`)", raw.to_string_lossy())),
+ Some(Err(raw)) => usage_errors.push(format!("--control-token: value is not valid Unicode (`{}`)", raw.to_string_lossy())),
None => control_token = None,
},
Some("--control-token-file") => control_token_file = args.next().map(std::path::PathBuf::from),
- Some("--automation-read-root") => automation_read_root = args.next().map(std::path::PathBuf::from),
- Some("--automation-write-root") => automation_write_root = args.next().map(std::path::PathBuf::from),
- Some("--safe-gpu") => safe_gpu = true,
+ Some("--automation-read-root") => {
+ launch_options.push("--automation-read-root");
+ automation_read_root = args.next().map(std::path::PathBuf::from);
+ }
+ Some("--automation-write-root") => {
+ launch_options.push("--automation-write-root");
+ automation_write_root = args.next().map(std::path::PathBuf::from);
+ }
+ Some("--safe-gpu") => {
+ launch_options.push("--safe-gpu");
+ safe_gpu = true;
+ }
Some(flag @ ("--present-mode" | "--frame-latency" | "--stroke-trace")) => {
+ launch_options.push(match flag {
+ "--present-mode" => "--present-mode",
+ "--frame-latency" => "--frame-latency",
+ _ => "--stroke-trace",
+ });
let flag = flag.to_string();
match args.next().map(std::ffi::OsString::into_string) {
Some(Ok(v)) => match flag.as_str() {
@@ -231,25 +322,34 @@ fn main() -> eframe::Result {
_ => eprintln!("photocraft: {flag}: missing or unreadable value; ignored"),
}
}
- Some("--in-window-menus") => in_window_menus = true,
+ Some("--in-window-menus") => {
+ launch_options.push("--in-window-menus");
+ in_window_menus = true;
+ }
+ Some("--new-instance") => new_instance = true,
Some("--version") => {
- println!("photocraft {}", photocraft_engine::build_info::long_version());
+ print_stdout(&format!("photocraft {}\n", photocraft_engine::build_info::long_version()));
return Ok(());
}
// Old macOS passes a process serial number when launched from Finder.
Some(s) if s.starts_with("-psn_") => {}
+ // A typo such as `--safegpu`, or `--help` spelt another way, must not open the window
+ // and then fail to open the flag as a file (#6431).
+ Some(s) if s.starts_with('-') => usage_errors.push(format!("unknown option `{s}` (put `--` before a file name that starts with `-`)")),
Some(s) => files.push(s.to_owned()),
None => unreadable_paths.push(a.to_string_lossy().into_owned()),
}
}
- // A malformed control port must not silently drop the control server (issue #701): name the
- // bad value and fail the launch, like `photocraft-cli serve --port` does for the same typo.
- // Exit status 2 is the usual command-line usage error, so a launcher sees the failure.
- if let Some(code) = control_args_exit_code(&control_arg_errors) {
- for error in &control_arg_errors {
+ // A malformed control port must not silently drop the control server (issue #701), and an
+ // unknown option must not open the window (#6431): name the bad argument and fail the launch,
+ // like `photocraft-cli` does for the same typos. Exit status 2 is the usual command-line usage
+ // error, so a launcher sees the failure.
+ if let Some(code) = usage_exit_code(&usage_errors) {
+ for error in &usage_errors {
eprintln!("photocraft: {error}");
}
+ eprintln!("Run `photocraft --help` for usage.");
std::process::exit(code);
}
@@ -263,6 +363,48 @@ fn main() -> eframe::Result {
}
}
+ // One PhotoCraft per user (#3708): files opened from Explorer or a file manager while it runs
+ // become tabs in its window. Only with the per-user settings folder (a portable copy's may be
+ // shared between users), and not for automation, `--new-instance` or per-process options.
+ #[cfg(not(target_os = "macos"))]
+ let single_instance = {
+ let new_instance_env = std::env::var("PHOTOCRAFT_NEW_INSTANCE").ok();
+ let context = single_instance::LaunchContext {
+ per_user_settings: app_dirs::current().mode == app_dirs::Mode::Platform,
+ new_instance_flag: new_instance,
+ new_instance_env: new_instance_env.as_deref(),
+ control: control_port.is_some(),
+ unreadable_paths: !unreadable_paths.is_empty(),
+ launch_options: &launch_options,
+ };
+ match (single_instance::skip_reason(&context), services::config_dir()) {
+ (Some(reason), _) => {
+ log::info!("running as a separate PhotoCraft: {reason}");
+ None
+ }
+ (None, None) => None,
+ (None, Some(dir)) => {
+ let paths: Vec = files.iter().map(|f| single_instance::absolute(f)).collect();
+ match single_instance::claim(&dir, &paths) {
+ single_instance::Launch::Forwarded => {
+ log::info!("handed {} file(s) to the running PhotoCraft", paths.len());
+ return Ok(());
+ }
+ single_instance::Launch::Primary(primary) => Some(primary),
+ single_instance::Launch::Standalone(reason) => {
+ log::warn!("starting a separate PhotoCraft: {reason}");
+ None
+ }
+ }
+ }
+ }
+ };
+ // Lives until the event loop returns, then `shutdown` lets the next launch become the primary.
+ #[cfg(not(target_os = "macos"))]
+ let single_instance = &single_instance;
+ #[cfg(target_os = "macos")]
+ let _ = (new_instance, &launch_options);
+
// The display server to open the window on: Xwayland for a pen on Wayland, which gives this
// app no pen input (#639).
#[cfg(target_os = "linux")]
@@ -426,7 +568,15 @@ fn main() -> eframe::Result {
services::xwayland_command(var("FLATPAK_ID").as_deref(), var("APPIMAGE").as_deref(), std::env::var_os("DISPLAY").is_some());
}
}
- let mut app = PhotocraftApp::new(Session::new(), services);
+ #[cfg(target_os = "linux")]
+ let session = {
+ let mut session = Session::new();
+ session.print_spooler = print_portal::spooler();
+ session
+ };
+ #[cfg(not(target_os = "linux"))]
+ let session = Session::new();
+ let mut app = PhotocraftApp::new(session, services);
app.min_frame_ms = uncapped.then_some(1000.0 / 240.0);
app.integrated_titlebar = cfg!(target_os = "macos");
app.custom_titlebar = custom_titlebar;
@@ -525,6 +675,11 @@ fn main() -> eframe::Result {
}
#[cfg(not(target_os = "macos"))]
let _ = in_window_menus;
+ // Files from later launches (Explorer, file managers) open here as new tabs.
+ #[cfg(not(target_os = "macos"))]
+ if let Some(primary) = single_instance {
+ app.services.os_events = Some(primary.connect(&cc.egui_ctx));
+ }
// Where file drags and drops are (winit 0.30 doesn't say).
app.services.cursor_pos = cursor::service(cc);
// The custom title bar's undecorated window must stay borderless, or its caption and
@@ -562,6 +717,13 @@ fn main() -> eframe::Result {
Ok(Box::new(app))
}),
);
+ // The window is gone: refuse further files and free the lock, so a launch that is waiting (or
+ // the CPU-compatibility relaunch below) becomes the primary instead of handing its files to a
+ // process that is exiting.
+ #[cfg(not(target_os = "macos"))]
+ if let Some(primary) = single_instance {
+ primary.shutdown();
+ }
// Closed or failed outside graphics initialization: not a driver crash. A renderer error
// keeps the marker, so the next start tries a safer backend, unless there is no safer one:
// a failed CPU start would otherwise pin every later start to CPU.
diff --git a/apps/photocraft/src/portal_save.rs b/apps/photocraft/src/portal_save.rs
new file mode 100644
index 0000000000..42588e2bc4
--- /dev/null
+++ b/apps/photocraft/src/portal_save.rs
@@ -0,0 +1,183 @@
+//! File › Save As through the XDG desktop portal on Linux (#6121, #4328, #4394).
+//!
+//! The GTK file chooser behind the portal keeps the typed name when the user picks another file
+//! type, and rfd 0.17 reads only the file name from the portal's answer, so `image.psd` with PNG
+//! picked came back as `image.psd` and was written as a PSD. The answer does say which type was
+//! picked (`current_filter`), so Save As asks the portal itself and gives a name the dialog left
+//! alone that type's extension ([`crate::services::with_chosen_type`]). rfd stays the fallback
+//! (zenity, or no portal), and this can go once an rfd release reads the picked type
+//! (PolyMeilex/rfd#341).
+//!
+//! The dialog is attached to the window on X11. On Wayland it has no parent: naming the window to
+//! the portal needs an xdg-foreign handle, which takes `unsafe` code the workspace forbids.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+
+use zbus::zvariant::{OwnedObjectPath, OwnedValue, Value};
+
+/// One file type in the dialog: its label and extensions (`("PNG", ["png"])`).
+pub type Filter = (String, Vec);
+
+/// A Save dialog to show.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct SaveRequest {
+ /// The portal's parent window identifier (`x11:`), or empty.
+ pub parent: String,
+ /// The name the dialog shows: the stem of the suggested file (`test`), see
+ /// `services::dialog_file_name`.
+ pub name: Option,
+ /// The suggested file's name (`test.psd`): a name that comes back with its extension still
+ /// takes the extension of the type picked ([`crate::services::with_chosen_type`]).
+ pub suggested: Option,
+ pub folder: Option,
+ pub filters: Vec,
+ /// The filter the dialog starts on.
+ pub current: Option,
+}
+
+/// What the user chose: the path, as typed, and the label of the file type picked.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Saved {
+ pub path: PathBuf,
+ pub filter: Option,
+}
+
+/// The portal's parent window identifier for `window`: `x11:` on X11, empty elsewhere.
+pub fn parent_id(window: Option) -> String {
+ use eframe::wgpu::rwh::RawWindowHandle;
+ match window {
+ Some(RawWindowHandle::Xlib(h)) => format!("x11:{:x}", h.window),
+ Some(RawWindowHandle::Xcb(h)) => format!("x11:{:x}", h.window.get()),
+ _ => String::new(),
+ }
+}
+
+/// Shows the portal's Save dialog and waits for it. `Ok(None)` is Cancel; `Err` means the portal
+/// couldn't show it (no portal, no FileChooser), so the caller falls back to rfd.
+pub fn save_file(conn: &zbus::blocking::Connection, req: &SaveRequest) -> Result, String> {
+ use futures_lite::StreamExt;
+ use zbus::blocking::Proxy;
+ let unique = conn.unique_name().ok_or("Portal connection has no unique name")?.as_str().trim_start_matches(':').replace('.', "_");
+ static NEXT: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+ let token = format!("photocraft_save_{}_{}", std::process::id(), NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed));
+ let path = format!("/org/freedesktop/portal/desktop/request/{unique}/{token}");
+ // Listen before asking, so a quick answer isn't missed.
+ let request = Proxy::new(conn, "org.freedesktop.portal.Desktop", path.as_str(), "org.freedesktop.portal.Request").map_err(|e| e.to_string())?;
+ let mut replies = futures_lite::future::block_on(request.inner().receive_signal("Response")).map_err(|e| e.to_string())?;
+ let chooser = Proxy::new(conn, "org.freedesktop.portal.Desktop", "/org/freedesktop/portal/desktop", "org.freedesktop.portal.FileChooser")
+ .map_err(|e| e.to_string())?;
+ let handle: OwnedObjectPath = chooser.call("SaveFile", &(req.parent.as_str(), "Save As", options(req, &token))).map_err(|e| e.to_string())?;
+ // A portal older than 0.9 ignores `handle_token` and answers on a request path of its own,
+ // which it returns: listen there instead, as the Request documentation asks.
+ let reply = if handle.as_str() == path {
+ futures_lite::future::block_on(replies.next())
+ } else {
+ let request = Proxy::new(conn, "org.freedesktop.portal.Desktop", handle.as_str(), "org.freedesktop.portal.Request").map_err(|e| e.to_string())?;
+ let mut replies = futures_lite::future::block_on(request.inner().receive_signal("Response")).map_err(|e| e.to_string())?;
+ futures_lite::future::block_on(replies.next())
+ }
+ .ok_or("The save dialog closed without an answer")?;
+ let (code, results): (u32, HashMap) = reply.body().deserialize().map_err(|e| e.to_string())?;
+ answer(code, &results)
+}
+
+/// The `SaveFile` options for `req`.
+fn options<'a>(req: &'a SaveRequest, token: &'a str) -> HashMap<&'static str, Value<'a>> {
+ let mut o: HashMap<&'static str, Value<'a>> = HashMap::from([("handle_token", Value::from(token)), ("modal", Value::from(true))]);
+ if let Some(name) = &req.name {
+ o.insert("current_name", Value::from(name.as_str()));
+ }
+ if let Some(folder) = &req.folder {
+ // A byte string with its terminating NUL, as the portal specifies.
+ use std::os::unix::ffi::OsStrExt;
+ let mut bytes = folder.as_os_str().as_bytes().to_vec();
+ bytes.push(0);
+ o.insert("current_folder", Value::from(bytes));
+ }
+ let wire = |(label, exts): &Filter| (label.clone(), exts.iter().map(|e| (0u32, format!("*.{e}"))).collect::>());
+ if !req.filters.is_empty() {
+ o.insert("filters", Value::from(req.filters.iter().map(wire).collect::>()));
+ }
+ if let Some(f) = req.current.and_then(|i| req.filters.get(i)) {
+ o.insert("current_filter", Value::from(wire(f)));
+ }
+ o
+}
+
+/// Reads the portal's `Response`: code 0 with the first `uris` entry. 1 is Cancel, and 2 a dialog
+/// closed some other way, such as with Esc in GNOME's: no file either, and not a reason to show
+/// rfd's dialog instead (it did, so Esc opened a second Save As).
+fn answer(code: u32, results: &HashMap) -> Result, String> {
+ match code {
+ 0 => {}
+ 1 | 2 => return Ok(None),
+ _ => return Err(format!("the save dialog failed (portal response {code})")),
+ }
+ let uris: Vec = results
+ .get("uris")
+ .ok_or("no file in the portal's answer")?
+ .try_clone()
+ .map_err(|e| e.to_string())?
+ .try_into()
+ .map_err(|e: zbus::zvariant::Error| e.to_string())?;
+ let uri = uris.first().ok_or("no file in the portal's answer")?;
+ let path = file_uri_path(uri).ok_or_else(|| format!("not a local file: {uri}"))?;
+ let filter = results.get("current_filter").and_then(|v| {
+ let (label, _globs): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+ Some(label)
+ });
+ Ok(Some(Saved { path, filter }))
+}
+
+/// `file:///home/me/A%20b.psd` → `/home/me/A b.psd`; `None` for other schemes.
+fn file_uri_path(uri: &str) -> Option {
+ let rest = uri.strip_prefix("file://")?;
+ // Only local files: `file:///…` or `file://localhost/…`.
+ let rest = rest.strip_prefix("localhost").unwrap_or(rest);
+ if !rest.starts_with('/') {
+ return None;
+ }
+ let bytes = rest.as_bytes();
+ let mut out = Vec::with_capacity(bytes.len());
+ let mut i = 0;
+ while i < bytes.len() {
+ if bytes[i] == b'%'
+ && let Some(b) = bytes.get(i + 1..i + 3).and_then(|h| std::str::from_utf8(h).ok()).and_then(|h| u8::from_str_radix(h, 16).ok())
+ {
+ out.push(b);
+ i += 3;
+ } else {
+ out.push(bytes[i]);
+ i += 1;
+ }
+ }
+ use std::os::unix::ffi::OsStringExt;
+ Some(PathBuf::from(std::ffi::OsString::from_vec(out)))
+}
+
+/// Save As on Linux: the portal's dialog, with the name given the extension of the file type
+/// picked. When that changes the name to one that already exists, the dialog opens again under
+/// the new name, so the portal asks before replacing it (it asked only about the typed name).
+pub fn save_as(conn: &zbus::blocking::Connection, mut req: SaveRequest) -> Result, String> {
+ loop {
+ let Some(saved) = save_file(conn, &req)? else { return Ok(None) };
+ let picked = saved.filter.as_deref().and_then(|label| req.filters.iter().position(|(l, _)| l == label));
+ // With one type offered there is nothing to pick, and a typed extension is the user's.
+ let exts: &[String] = match picked {
+ Some(i) if req.filters.len() > 1 => &req.filters[i].1,
+ _ => &[],
+ };
+ let path = crate::services::with_chosen_type(&saved.path, req.suggested.as_deref(), exts);
+ if path == saved.path || !path.exists() {
+ return Ok(Some(path));
+ }
+ req.name = path.file_name().map(|n| n.to_string_lossy().into_owned());
+ req.suggested = req.name.clone();
+ req.folder = path.parent().map(Path::to_path_buf);
+ req.current = picked;
+ }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/photocraft/src/portal_save/tests.rs b/apps/photocraft/src/portal_save/tests.rs
new file mode 100644
index 0000000000..ed44a10d9c
--- /dev/null
+++ b/apps/photocraft/src/portal_save/tests.rs
@@ -0,0 +1,232 @@
+use super::*;
+use std::sync::{Arc, Mutex};
+
+#[test]
+fn file_uris_become_local_paths() {
+ assert_eq!(file_uri_path("file:///home/me/Untitled-1.psd"), Some(PathBuf::from("/home/me/Untitled-1.psd")));
+ assert_eq!(file_uri_path("file:///home/me/A%20b%C3%A9.png"), Some(PathBuf::from("/home/me/A bé.png")));
+ assert_eq!(file_uri_path("file://localhost/tmp/x.png"), Some(PathBuf::from("/tmp/x.png")));
+ assert_eq!(file_uri_path("sftp://host/x.png"), None);
+ assert_eq!(file_uri_path("file://host/x.png"), None);
+}
+
+#[test]
+fn x11_windows_are_named_to_the_portal() {
+ use eframe::wgpu::rwh::{RawWindowHandle, XlibWindowHandle};
+ assert_eq!(parent_id(Some(RawWindowHandle::Xlib(XlibWindowHandle::new(0x3a0000f)))), "x11:3a0000f");
+ assert_eq!(parent_id(None), "");
+}
+
+/// What the mock portal answers to one `SaveFile` call: the response code, and the file and
+/// filter label the user "picked".
+type Script = Vec<(u32, Option<(&'static str, &'static str)>)>;
+
+/// The options of each `SaveFile` call the mock portal received: current_name and the label of
+/// current_filter.
+type Seen = Arc, Option)>>>;
+
+/// A private session bus (`dbus-daemon`) with a mock `org.freedesktop.portal.FileChooser` that
+/// answers `SaveFile` from `script`. `None` when there is no `dbus-daemon` to run.
+fn mock_portal(script: Script) -> Option<(zbus::blocking::Connection, Seen, std::process::Child)> {
+ mock_portal_with(script, false)
+}
+
+/// [`mock_portal`]; with `own_paths` it is a portal older than 0.9, which ignores `handle_token`,
+/// answers on a request path of its own and returns that from `SaveFile`, as a real dialog does
+/// once the user is done with it (here after 300 ms).
+fn mock_portal_with(script: Script, own_paths: bool) -> Option<(zbus::blocking::Connection, Seen, std::process::Child)> {
+ use std::io::BufRead;
+ let mut daemon =
+ std::process::Command::new("dbus-daemon").args(["--session", "--nofork", "--print-address=1"]).stdout(std::process::Stdio::piped()).spawn().ok()?;
+ let mut address = String::new();
+ std::io::BufReader::new(daemon.stdout.take()?).read_line(&mut address).ok()?;
+ let address = address.trim().to_string();
+ let server = zbus::blocking::connection::Builder::address(address.as_str()).unwrap().name("org.freedesktop.portal.Desktop").unwrap().build().unwrap();
+ let seen: Seen = Arc::default();
+ let log = seen.clone();
+ std::thread::spawn(move || {
+ let mut script = script.into_iter();
+ for msg in zbus::blocking::MessageIterator::from(&server) {
+ let Ok(msg) = msg else { break };
+ let header = msg.header();
+ if header.message_type() != zbus::message::Type::MethodCall || header.member().map(|m| m.as_str()) != Some("SaveFile") {
+ continue;
+ }
+ let (_parent, _title, options): (String, String, HashMap) = msg.body().deserialize().unwrap();
+ let text = |key: &str| options.get(key).and_then(|v| String::try_from(v.try_clone().ok()?).ok());
+ let filter = options.get("current_filter").and_then(|v| {
+ let (label, _): (String, Vec<(u32, String)>) = v.try_clone().ok()?.try_into().ok()?;
+ Some(label)
+ });
+ log.lock().unwrap().push((text("current_name"), filter));
+ let sender = header.sender().unwrap().as_str().trim_start_matches(':').replace('.', "_");
+ let token = if own_paths { format!("old{}", log.lock().unwrap().len()) } else { text("handle_token").unwrap() };
+ let path = format!("/org/freedesktop/portal/desktop/request/{sender}/{token}");
+ server.reply(&header, &OwnedObjectPath::try_from(path.as_str()).unwrap()).unwrap();
+ if own_paths {
+ std::thread::sleep(std::time::Duration::from_millis(300));
+ }
+ let (code, pick) = script.next().unwrap_or((2, None));
+ let mut results: HashMap<&str, Value<'_>> = HashMap::new();
+ if let Some((uri, label)) = pick {
+ results.insert("uris", Value::from(vec![uri.to_string()]));
+ results.insert("current_filter", Value::from((label.to_string(), vec![(0u32, "*.x".to_string())])));
+ }
+ server
+ .emit_signal(
+ header.sender().cloned().map(zbus::names::BusName::from),
+ path.as_str(),
+ "org.freedesktop.portal.Request",
+ "Response",
+ &(code, results),
+ )
+ .unwrap();
+ }
+ });
+ let client = zbus::blocking::connection::Builder::address(address.as_str()).unwrap().build().unwrap();
+ Some((client, seen, daemon))
+}
+
+fn request(name: &str) -> SaveRequest {
+ let filters = [("PSD Document", &["psd", "psb"][..]), ("PNG", &["png"]), ("JPEG", &["jpg"])];
+ SaveRequest {
+ parent: String::new(),
+ name: Some(name.into()),
+ suggested: Some(name.into()),
+ folder: Some(PathBuf::from("/tmp")),
+ filters: filters.iter().map(|(l, e)| (l.to_string(), e.iter().map(|s| s.to_string()).collect())).collect(),
+ current: Some(0),
+ }
+}
+
+/// #6121 end to end through a real D-Bus: the name comes back as typed with the type picked,
+/// and Save As writes it with that type's extension.
+#[test]
+fn save_as_follows_the_file_type_picked_in_the_portal_dialog() {
+ let dir = std::env::temp_dir().join(format!("photocraft-portal-{}", std::process::id()));
+ std::fs::create_dir_all(&dir).unwrap();
+ let typed = format!("file://{}/Untitled-1.psd", dir.display());
+ let typed: &'static str = Box::leak(typed.into_boxed_str());
+ let Some((conn, seen, mut daemon)) = mock_portal(vec![(0, Some((typed, "PNG"))), (1, None), (0, Some((typed, "PSD Document")))]) else {
+ eprintln!("no dbus-daemon: skipped");
+ return;
+ };
+ // PNG picked with `Untitled-1.psd` still in the name: written as Untitled-1.png.
+ assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), Some(dir.join("Untitled-1.png")));
+ assert_eq!(seen.lock().unwrap()[0], (Some("Untitled-1.psd".into()), Some("PSD Document".into())), "the request carried the name and type");
+ // Cancel.
+ assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), None);
+ // The type the name already has: unchanged.
+ assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), Some(dir.join("Untitled-1.psd")));
+ daemon.kill().ok();
+ std::fs::remove_dir_all(&dir).ok();
+}
+
+/// The dialog opens on the bare name (`test`, see `services::dialog_file_name`), so GTK doesn't
+/// ask to replace test.psd when PNG is picked: the type picked gives the extension, and a name
+/// that then exists is asked about under that name.
+#[test]
+fn a_bare_name_takes_the_picked_type_and_an_existing_target_is_asked_about() {
+ let dir = std::env::temp_dir().join(format!("photocraft-portal-bare-{}", std::process::id()));
+ std::fs::create_dir_all(&dir).unwrap();
+ std::fs::write(dir.join("test.psd"), b"open document").unwrap();
+ let uri = |name: &str| -> &'static str { Box::leak(format!("file://{}/{name}", dir.display()).into_boxed_str()) };
+ let Some((conn, seen, mut daemon)) = mock_portal(vec![
+ (0, Some((uri("test"), "PNG"))),
+ (0, Some((uri("test.psd"), "PNG"))),
+ (0, Some((uri("test"), "PSD Document"))),
+ (0, Some((uri("test.psd"), "PSD Document"))),
+ ]) else {
+ eprintln!("no dbus-daemon: skipped");
+ return;
+ };
+ // As File › Save As opens it: `test` shown, `test.psd` suggested.
+ let opened = || SaveRequest { suggested: Some("test.psd".into()), ..request("test") };
+ // PNG picked: test.png, and nothing was asked about test.psd.
+ assert_eq!(save_as(&conn, opened()).unwrap(), Some(dir.join("test.png")));
+ // The suggested extension back in the name (typed again, or GTK's completion) with PNG
+ // picked: test.png too, not a PSD written over test.psd.
+ assert_eq!(save_as(&conn, opened()).unwrap(), Some(dir.join("test.png")));
+ // The type untouched: test.psd, which exists, so the dialog asks again as test.psd (the
+ // portal's replace prompt is then about the file that is written).
+ assert_eq!(save_as(&conn, opened()).unwrap(), Some(dir.join("test.psd")));
+ let seen = seen.lock().unwrap().clone();
+ let names: Vec<_> = seen.iter().map(|(name, _)| name.as_deref()).collect();
+ assert_eq!(names, [Some("test"), Some("test"), Some("test"), Some("test.psd")], "{seen:?}");
+ assert_eq!(seen[3].1.as_deref(), Some("PSD Document"));
+ daemon.kill().ok();
+ std::fs::remove_dir_all(&dir).ok();
+}
+
+/// GNOME's dialog closed with Esc answers 2 ("ended some other way"): no file, like Cancel, and
+/// no fallback to rfd, which opened a second Save As.
+#[test]
+fn a_dialog_closed_some_other_way_is_a_cancel() {
+ let Some((conn, _seen, mut daemon)) = mock_portal(vec![(2, None)]) else {
+ eprintln!("no dbus-daemon: skipped");
+ return;
+ };
+ assert_eq!(save_as(&conn, request("test")), Ok(None));
+ daemon.kill().ok();
+}
+
+/// An extension the user typed is theirs: `art.png` with the PSD type left as the dialog opened
+/// saves a PNG, as it did before the type was read.
+#[test]
+fn a_typed_extension_wins_over_an_untouched_file_type() {
+ let typed: &'static str = "file:///tmp/photocraft-none/art.png";
+ let Some((conn, _seen, mut daemon)) = mock_portal(vec![(0, Some((typed, "PSD Document")))]) else {
+ eprintln!("no dbus-daemon: skipped");
+ return;
+ };
+ assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), Some(PathBuf::from("/tmp/photocraft-none/art.png")));
+ daemon.kill().ok();
+}
+
+/// A portal older than 0.9 answers on a request path of its own: the wait follows the handle
+/// `SaveFile` returns, as the Request documentation asks, instead of the predicted path.
+#[test]
+fn the_answer_is_awaited_on_the_handle_the_portal_returns() {
+ let typed: &'static str = "file:///tmp/photocraft-none/Untitled-1.psd";
+ let Some((conn, _seen, mut daemon)) = mock_portal_with(vec![(0, Some((typed, "PNG")))], true) else {
+ eprintln!("no dbus-daemon: skipped");
+ return;
+ };
+ assert_eq!(save_as(&conn, request("Untitled-1.psd")).unwrap(), Some(PathBuf::from("/tmp/photocraft-none/Untitled-1.png")));
+ daemon.kill().ok();
+}
+
+/// When the extension the type gives names a file that exists, the dialog opens again under that
+/// name (so the portal asks before replacing it) instead of overwriting it unasked.
+#[test]
+fn a_renamed_file_that_exists_is_confirmed_in_the_dialog() {
+ let dir = std::env::temp_dir().join(format!("photocraft-portal-exists-{}", std::process::id()));
+ std::fs::create_dir_all(&dir).unwrap();
+ std::fs::write(dir.join("art.png"), b"old").unwrap();
+ let typed: &'static str = Box::leak(format!("file://{}/art.psd", dir.display()).into_boxed_str());
+ let confirmed: &'static str = Box::leak(format!("file://{}/art.png", dir.display()).into_boxed_str());
+ let Some((conn, seen, mut daemon)) = mock_portal(vec![(0, Some((typed, "PNG"))), (0, Some((confirmed, "PNG")))]) else {
+ eprintln!("no dbus-daemon: skipped");
+ return;
+ };
+ assert_eq!(save_as(&conn, request("art.psd")).unwrap(), Some(dir.join("art.png")));
+ let seen = seen.lock().unwrap().clone();
+ assert_eq!(seen.len(), 2, "asked again: {seen:?}");
+ assert_eq!(seen[1], (Some("art.png".into()), Some("PNG".into())), "under the new name, on the picked type");
+ assert_eq!(std::fs::read(dir.join("art.png")).unwrap(), b"old", "nothing written by the dialog");
+ daemon.kill().ok();
+ std::fs::remove_dir_all(&dir).ok();
+}
+
+/// With only one type offered (the Swatches panel's .aco) a typed extension is kept.
+#[test]
+fn a_single_file_type_keeps_the_typed_extension() {
+ let typed: &'static str = "file:///tmp/photocraft-none/Swatches.ase";
+ let Some((conn, _seen, mut daemon)) = mock_portal(vec![(0, Some((typed, "Color Swatches")))]) else {
+ eprintln!("no dbus-daemon: skipped");
+ return;
+ };
+ let req = SaveRequest { filters: vec![("Color Swatches".into(), vec!["aco".into()])], ..request("Swatches.aco") };
+ assert_eq!(save_as(&conn, req).unwrap(), Some(PathBuf::from("/tmp/photocraft-none/Swatches.ase")));
+ daemon.kill().ok();
+}
diff --git a/apps/photocraft/src/print_portal.rs b/apps/photocraft/src/print_portal.rs
new file mode 100644
index 0000000000..0eef02a01c
--- /dev/null
+++ b/apps/photocraft/src/print_portal.rs
@@ -0,0 +1,239 @@
+//! Printing through the XDG Print portal (`org.freedesktop.portal.Print`): the system print
+//! dialog, which a sandboxed app can reach without a CUPS socket. The engine prints over IPP
+//! when it can reach a print server (`photocraft-ipp`); this is its fallback when it cannot, and
+//! the only route with `PHOTOCRAFT_PRINT_PORTAL=1` (`0` disables it). `PreparePrint` shows the
+//! dialog seeded with the job's copies and paper; `Print` hands it the PDF. Both answer through a
+//! `Request` object's `Response` signal, which this module waits for on its own thread so the
+//! window keeps painting while the dialog is open; the outcome goes to the log.
+//! https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Print.html
+
+#[cfg(target_os = "linux")]
+use photocraft_engine::print_cmds::{PrintJob, Spooler};
+
+/// The spooler to install on the session, unless `PHOTOCRAFT_PRINT_PORTAL=0`. The portal itself
+/// is looked up per job, so a missing one costs nothing at start-up.
+#[cfg(target_os = "linux")]
+pub fn spooler() -> Option {
+ let setting = std::env::var("PHOTOCRAFT_PRINT_PORTAL").ok();
+ if setting.as_deref() == Some("0") {
+ return None;
+ }
+ Some(Spooler { name: "portal", preferred: setting.as_deref() == Some("1"), run: std::sync::Arc::new(print) })
+}
+
+/// Opens the system print dialog for the job and returns as soon as it is up.
+#[cfg(target_os = "linux")]
+fn print(job: &PrintJob) -> Result {
+ let conn = zbus::blocking::connection::Builder::session()
+ .and_then(|b| b.method_timeout(std::time::Duration::from_secs(5)).build())
+ .map_err(|e| format!("no session bus for the print portal ({e}); print to PDF instead"))?;
+ let proxy = portal(&conn)?;
+ let version: u32 = proxy.get_property("version").map_err(|e| format!("no print portal on this desktop ({e}); print to PDF instead"))?;
+ // The document goes to a private temporary file (0600, created atomically by `tempfile`),
+ // not a guessable name in a shared /tmp. The guard owns the file: it lives on the portal
+ // thread until the dialog is done, and a failure to start that thread drops it here.
+ let mut file = tempfile::Builder::new().prefix("photocraft-print-").suffix(".pdf").tempfile().map_err(|e| format!("cannot create the print file: {e}"))?;
+ std::io::Write::write_all(&mut file, &job.pdf).map_err(|e| format!("cannot write the print file: {e}"))?;
+ let (title, settings, page_setup) = (job.title.clone(), settings(job), page_setup(job));
+ std::thread::Builder::new()
+ .name("print-portal".into())
+ .spawn(move || {
+ let outcome = dialog(&conn, &title, &settings, &page_setup, file.path());
+ drop(file);
+ match outcome {
+ Ok(what) => log::info!("print portal (v{version}): {what}"),
+ Err(e) => log::warn!("print portal (v{version}): {e}"),
+ }
+ })
+ .map_err(|e| format!("cannot start the print thread: {e}"))?;
+ Ok("the system print dialog".into())
+}
+
+#[cfg(target_os = "linux")]
+fn portal(conn: &zbus::blocking::Connection) -> Result, String> {
+ zbus::blocking::Proxy::new(conn, "org.freedesktop.portal.Desktop", "/org/freedesktop/portal/desktop", "org.freedesktop.portal.Print")
+ .map_err(|e| e.to_string())
+}
+
+/// `PreparePrint` then `Print`, each waited for on its request's `Response` signal.
+#[cfg(target_os = "linux")]
+fn dialog(
+ conn: &zbus::blocking::Connection,
+ title: &str,
+ settings: &[(&'static str, Seed)],
+ page_setup: &[(&'static str, Seed)],
+ pdf: &std::path::Path,
+) -> Result {
+ use std::collections::HashMap;
+ use zbus::zvariant::{OwnedObjectPath, OwnedValue, Value};
+ type Dict<'a> = HashMap<&'a str, Value<'a>>;
+ fn as_dict(pairs: &[(&'static str, Seed)]) -> Dict<'static> {
+ pairs
+ .iter()
+ .map(|(k, v)| {
+ let value = match v {
+ Seed::Text(t) => Value::from(t.clone()),
+ Seed::Mm(mm) => Value::from(*mm),
+ };
+ (*k, value)
+ })
+ .collect()
+ }
+ let proxy = portal(conn)?;
+ let sender = conn.unique_name().map(|n| n.as_str().to_string()).ok_or("the bus connection has no name")?;
+ let wait = |token: &str| -> Result, String> {
+ let path = request_path(&sender, token);
+ let request = zbus::blocking::Proxy::new(conn, "org.freedesktop.portal.Desktop", path, "org.freedesktop.portal.Request").map_err(|e| e.to_string())?;
+ request.receive_signal("Response").map_err(|e| e.to_string())
+ };
+ let response = |mut signals: zbus::blocking::proxy::SignalIterator<'static>| -> Result, String> {
+ let message = signals.next().ok_or("the print portal went away")?;
+ let (code, results): (u32, HashMap) = message.body().deserialize().map_err(|e| format!("odd portal reply: {e}"))?;
+ match code {
+ 0 => Ok(results),
+ 1 => Err("cancelled in the print dialog".into()),
+ _ => Err("the print dialog failed".into()),
+ }
+ };
+
+ let token = format!("photocraft_prepare_{}", nonce());
+ let signals = wait(&token)?;
+ let mut options: Dict<'_> = HashMap::new();
+ options.insert("handle_token", Value::from(token.as_str()));
+ let _: OwnedObjectPath =
+ proxy.call("PreparePrint", &("", title, as_dict(settings), as_dict(page_setup), options)).map_err(|e| format!("PreparePrint failed: {e}"))?;
+ let results = response(signals)?;
+ let prepared = results.get("token").and_then(|v| u32::try_from(v.clone()).ok()).ok_or("the print dialog gave no token")?;
+
+ let file = std::fs::File::open(pdf).map_err(|e| format!("cannot reopen the print file: {e}"))?;
+ let token = format!("photocraft_print_{}", nonce());
+ let signals = wait(&token)?;
+ let mut options: Dict<'_> = HashMap::new();
+ options.insert("handle_token", Value::from(token.as_str()));
+ options.insert("token", Value::from(prepared));
+ let fd = zbus::zvariant::Fd::from(std::os::fd::AsFd::as_fd(&file));
+ let _: OwnedObjectPath = proxy.call("Print", &("", title, fd, options)).map_err(|e| format!("Print failed: {e}"))?;
+ response(signals)?;
+ Ok("printed through the system print dialog".into())
+}
+
+#[cfg(target_os = "linux")]
+fn nonce() -> u64 {
+ use std::sync::atomic::{AtomicU64, Ordering};
+ static N: AtomicU64 = AtomicU64::new(0);
+ let t = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos() as u64).unwrap_or(0);
+ t ^ N.fetch_add(1, Ordering::Relaxed)
+}
+
+/// The request object the portal answers on: the sender's unique name without its colon and
+/// with dots as underscores, then the handle token.
+fn request_path(unique_name: &str, token: &str) -> String {
+ format!("/org/freedesktop/portal/desktop/request/{}/{token}", unique_name.trim_start_matches(':').replace('.', "_"))
+}
+
+/// A value seeded into the dialog: GtkPrintSettings are strings; a GtkPageSetup's sizes are
+/// doubles in millimetres (`gtk_paper_size_new_from_gvariant` ignores anything else).
+#[derive(Debug, Clone, PartialEq)]
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+enum Seed {
+ Text(String),
+ Mm(f64),
+}
+
+fn text(s: &str) -> Seed {
+ Seed::Text(s.to_string())
+}
+
+/// The standard paper sizes, as (PWG name, PPD name, width mm, height mm), portrait. GTK's
+/// print settings take the PWG name; its page setup finds the size by the PPD name.
+const PAPERS: [(&str, &str, f64, f64); 8] = [
+ ("na_letter", "Letter", 215.9, 279.4),
+ ("na_legal", "Legal", 215.9, 355.6),
+ ("na_ledger", "Ledger", 279.4, 431.8),
+ ("iso_a3", "A3", 297.0, 420.0),
+ ("iso_a4", "A4", 210.0, 297.0),
+ ("iso_a5", "A5", 148.0, 210.0),
+ ("na_index-4x6", "4x6", 101.6, 152.4),
+ ("na_5x7", "5x7", 127.0, 177.8),
+];
+
+const MM_PER_PT: f64 = 25.4 / 72.0;
+
+type Paper = (&'static str, &'static str, f64, f64);
+
+/// The job's paper: its row in `PAPERS` when it is a standard size, and the portrait size in
+/// millimetres.
+fn paper(paper_pt: (f64, f64)) -> (Option<&'static Paper>, f64, f64) {
+ let (w, h) = (paper_pt.0.min(paper_pt.1) * MM_PER_PT, paper_pt.0.max(paper_pt.1) * MM_PER_PT);
+ let row = PAPERS.iter().find(|(_, _, pw, ph)| (pw - w).abs() < 1.0 && (ph - h).abs() < 1.0);
+ (row, w, h)
+}
+
+fn orientation(landscape: bool) -> Seed {
+ text(if landscape { "landscape" } else { "portrait" })
+}
+
+/// `PreparePrint`'s settings (GtkPrintSettings keys, string values).
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+fn settings_for(copies: u32, paper_pt: (f64, f64), landscape: bool) -> Vec<(&'static str, Seed)> {
+ let (row, w, h) = paper(paper_pt);
+ let mut v = vec![("n-copies", text(&copies.to_string())), ("orientation", orientation(landscape))];
+ match row {
+ Some((pwg, _, _, _)) => v.push(("paper-format", text(pwg))),
+ None => v.extend([("paper-width", text(&format!("{w:.2}"))), ("paper-height", text(&format!("{h:.2}")))]),
+ }
+ v
+}
+
+/// `PreparePrint`'s page setup (GtkPageSetup keys): the size in millimetres, found by its PPD
+/// name when it has one, else a custom size named by its dimensions.
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+fn page_setup_for(paper_pt: (f64, f64), landscape: bool) -> Vec<(&'static str, Seed)> {
+ let (row, w, h) = paper(paper_pt);
+ let mut v = vec![("Orientation", orientation(landscape)), ("Width", Seed::Mm(w)), ("Height", Seed::Mm(h))];
+ match row {
+ Some((_, ppd, _, _)) => v.push(("PPDName", text(ppd))),
+ None => v.push(("Name", text(&format!("custom_{w:.0}x{h:.0}mm")))),
+ }
+ v
+}
+
+#[cfg(target_os = "linux")]
+fn settings(job: &PrintJob) -> Vec<(&'static str, Seed)> {
+ settings_for(job.copies, job.paper, job.landscape)
+}
+
+#[cfg(target_os = "linux")]
+fn page_setup(job: &PrintJob) -> Vec<(&'static str, Seed)> {
+ page_setup_for(job.paper, job.landscape)
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn request_path_follows_the_portal_rule() {
+ assert_eq!(request_path(":1.42", "photocraft_prepare_7"), "/org/freedesktop/portal/desktop/request/1_42/photocraft_prepare_7");
+ }
+
+ #[test]
+ fn standard_papers_get_their_pwg_and_ppd_names_and_custom_ones_their_size() {
+ // A4 landscape as the engine lays it out: width > height, still A4.
+ let s = settings_for(2, (841.89, 595.28), true);
+ assert_eq!(s, vec![("n-copies", text("2")), ("orientation", text("landscape")), ("paper-format", text("iso_a4"))]);
+ let p = page_setup_for((841.89, 595.28), true);
+ assert_eq!(p[0], ("Orientation", text("landscape")));
+ let Seed::Mm(w) = p[1].1 else { panic!("width is millimetres") };
+ let Seed::Mm(h) = p[2].1 else { panic!("height is millimetres") };
+ assert!((w - 210.0).abs() < 0.01 && (h - 297.0).abs() < 0.01, "{w} x {h}");
+ assert_eq!(p[3], ("PPDName", text("A4")));
+ assert_eq!(settings_for(1, (612.0, 792.0), false)[2], ("paper-format", text("na_letter")));
+ assert_eq!(page_setup_for((612.0, 792.0), false)[3], ("PPDName", text("Letter")));
+ assert_eq!(settings_for(1, (288.0, 432.0), false)[2], ("paper-format", text("na_index-4x6")));
+ // 100 x 200 mm is nobody's standard.
+ let custom = settings_for(1, (283.46, 566.93), false);
+ assert_eq!(&custom[2..], &[("paper-width", text("100.00")), ("paper-height", text("200.00"))]);
+ assert_eq!(page_setup_for((283.46, 566.93), false)[3], ("Name", text("custom_100x200mm")));
+ }
+}
diff --git a/apps/photocraft/src/services.rs b/apps/photocraft/src/services.rs
index 9de1c475ea..d4e7a01553 100644
--- a/apps/photocraft/src/services.rs
+++ b/apps/photocraft/src/services.rs
@@ -95,18 +95,51 @@ fn save_filters(suggested: &str) -> Vec<(String, Vec)> {
v
}
-/// The name the save dialog starts with. On Windows a visible extension stays put when the user
-/// picks another type (with File name extensions shown, `image.psd` saved as PhotoCraft stayed
-/// `image.psd`, #4394), while a bare name gets the chosen type's extension, so there the dialog
-/// gets the stem and the suggested type (listed first by [`save_filters`]) supplies `.psd`. A
-/// stem that still has a dot (`scan.jpg.psd`: Windows could keep `scan.jpg`) or an upper-case
+/// `path` with the extension of the file type picked in the save dialog (`chosen`), where the
+/// dialog left the name alone (#6121): the format follows the extension, and the GTK file chooser
+/// keeps the typed name when another type is picked. Only a name that still has the extension the
+/// dialog opened with (`opened_with`, `Untitled-1.psd` with PNG picked) or none gets the type's
+/// extension, as PolyMeilex/rfd#341 does. An extension the user typed that PhotoCraft saves
+/// (`art.png` with the PSD type untouched, the way to save a PNG before this) is theirs and stays,
+/// and so does one of the type's own (`.psb` for PSD). One PhotoCraft doesn't save (`scan.2024`)
+/// is part of the name, and the type's extension is added after it.
+#[cfg(any(target_os = "linux", test))]
+pub(crate) fn with_chosen_type(path: &Path, opened_with: Option<&str>, chosen: &[String]) -> PathBuf {
+ let Some(first) = chosen.first() else { return path.to_path_buf() };
+ let ext = path.extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase);
+ let opened_ext = opened_with.and_then(|n| Path::new(n).extension()).and_then(|e| e.to_str()).map(str::to_ascii_lowercase);
+ match ext {
+ Some(ext) if chosen.contains(&ext) => path.to_path_buf(),
+ Some(ext) if opened_ext.as_ref() == Some(&ext) => path.with_extension(first),
+ Some(ext) if SAVE_FILTERS.iter().chain(OTHER_SAVE_FILTERS).any(|(_, exts)| exts.contains(&ext.as_str())) => path.to_path_buf(),
+ _ => {
+ let mut name = path.as_os_str().to_owned();
+ name.push(".");
+ name.push(first);
+ PathBuf::from(name)
+ }
+ }
+}
+
+/// The name the save dialog starts with. Where the type picked gives a bare name its extension
+/// (`adds_extension`), the dialog gets the stem and the suggested type (listed first by
+/// [`save_filters`]) supplies `.psd`:
+/// - On Windows a visible extension stays put when the user picks another type (with File name
+/// extensions shown, `image.psd` saved as PhotoCraft stayed `image.psd`, #4394).
+/// - On Linux the portal's dialog keeps the name as typed, and before returning asks whether to
+/// replace a file of that name, so `test.psd` with PNG picked asked to replace test.psd, which
+/// the save leaves alone (#6121). From the stem [`with_chosen_type`] gives the picked type's
+/// extension, and a name that then exists is asked about under that name
+/// (`portal_save::save_as`).
+///
+/// A stem that still has a dot (`scan.jpg.psd`: Windows could keep `scan.jpg`) or an upper-case
/// extension (the user's spelling) keeps the whole name. Elsewhere the whole name is kept: the
-/// macOS panel has no type list, and on Linux rfd doesn't report which type was picked.
-fn dialog_file_name(suggested: &str, windows: bool) -> Option {
+/// macOS panel has no type list, and rfd's Linux dialogs don't say which type was picked.
+fn dialog_file_name(suggested: &str, adds_extension: bool) -> Option {
let path = Path::new(suggested);
let name = path.file_name()?.to_string_lossy().into_owned();
let (Some(stem), Some(ext)) = (path.file_stem(), path.extension().and_then(|e| e.to_str())) else { return Some(name) };
- let bare = windows && Path::new(stem).extension().is_none() && !ext.is_empty() && ext == ext.to_ascii_lowercase();
+ let bare = adds_extension && Path::new(stem).extension().is_none() && !ext.is_empty() && ext == ext.to_ascii_lowercase();
Some(if bare { stem.to_string_lossy().into_owned() } else { name })
}
@@ -148,17 +181,52 @@ fn show_file_dialog(request: FileDialogRequest, parent: Option<&eframe::Frame>,
Box::pin(async move { picked.await.map(|folder| FileDialogAnswer::FolderTo(path_of(&folder))) })
}
FileDialogRequest::Save { suggested } => {
- for (name, exts) in save_filters(&suggested) {
- dialog = dialog.add_filter(name, &exts);
+ let filters = save_filters(&suggested);
+ let name = dialog_file_name(&suggested, cfg!(windows));
+ let dir = Path::new(&suggested).parent().filter(|p| !p.as_os_str().is_empty()).map(Path::to_path_buf);
+ for (name, exts) in &filters {
+ dialog = dialog.add_filter(name, exts);
}
- if let Some(name) = dialog_file_name(&suggested, cfg!(windows)) {
+ if let Some(name) = &name {
dialog = dialog.set_file_name(name);
}
- if let Some(dir) = Path::new(&suggested).parent().filter(|p| !p.as_os_str().is_empty()) {
+ if let Some(dir) = &dir {
dialog = dialog.set_directory(dir);
}
- let picked = dialog.save_file();
- Box::pin(async move { picked.await.map(|file| FileDialogAnswer::SaveTo(path_of(&file))) })
+ // On Linux the portal's own dialog, which reports the file type picked (#6121); rfd if
+ // the portal can't show it.
+ #[cfg(target_os = "linux")]
+ {
+ use eframe::wgpu::rwh::HasWindowHandle;
+ let parent = crate::portal_save::parent_id(parent.and_then(|p| p.window_handle().ok()).map(|h| h.as_raw()));
+ let req = crate::portal_save::SaveRequest {
+ parent,
+ name: dialog_file_name(&suggested, true),
+ suggested: Path::new(&suggested).file_name().map(|n| n.to_string_lossy().into_owned()),
+ folder: dir,
+ filters,
+ current: Some(0),
+ };
+ Box::pin(async move {
+ let portal = zbus::blocking::connection::Builder::session()
+ .and_then(|b| b.build())
+ .map_err(|e| e.to_string())
+ .and_then(|conn| crate::portal_save::save_as(&conn, req));
+ match portal {
+ Ok(path) => path.map(|p| FileDialogAnswer::SaveTo(p.to_string_lossy().into_owned())),
+ Err(e) => {
+ log::info!("portal save dialog unavailable ({e}), using rfd");
+ dialog.save_file().await.map(|file| FileDialogAnswer::SaveTo(path_of(&file)))
+ }
+ }
+ })
+ }
+ #[cfg(not(target_os = "linux"))]
+ {
+ let _ = filters;
+ let picked = dialog.save_file();
+ Box::pin(async move { picked.await.map(|file| FileDialogAnswer::SaveTo(path_of(&file))) })
+ }
}
};
// Without the thread the reply is dropped unanswered, which the app takes as Cancel.
@@ -196,8 +264,8 @@ fn block_on(future: impl Future