mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-27 03:17:05 -06:00
60339cf675
* app.open: open directory .pcraft through the automation read root (#2490) The native on-disk format is a directory, but the automation read path serves regular files only, so agents could not open the files the app itself writes. The format crate's storage seam is now public (ByteSource + load_bytes_source); the workspace opens the .pcraft subdirectory through the held capability and loads through it. app.open tries the directory form for .pcraft paths and falls back to the bytes path for the single-file (zip) form; every other format is unchanged. * app.open .pcraft: review fixes (#2581) read_entry now bounds the read itself (the stat length is only a buffer hint) and both directory sources reject non-regular entries, so a crafted bundle with a FIFO entry can no longer block the open and stream unbounded. The desktop opener runs under the crash guard like its import sibling, the zip fallback is structural (Ok(None) instead of an error-message match), a directory-form document no longer arms a save-back target the file-only automation writer could never replace, and the open status is translated (Opened {name}, 16 locales). * read_entry: saturating max+1 so a usize::MAX budget can't overflow Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Brandon Thomas <echelon@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>