The desktop hook returns Ok(false) when preferences are switched off or there is
no settings folder; the commands report that like a host without a hook. Also
move add_saved out of works_without_document's doc comment.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The save_prefs hook now returns a Result; both commands add saved/saveError to
their result and the status line says when the write failed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
UPDATE_APP (native builds; craft-update is a native-only dependency) carries our 128 px icon and accent (#3f5fe0, its colour in ArtCraft Launcher). The updater, the self-update
helper and craft-update's startup prompt all get them through crate::UPDATE_APP; the
prompt draws the icon, the accent and "by ArtCraft" (craft-update's default developer).
craft-update is pinned to storytold/craft-libs main at 1065653e7 (#434).
* Options: a blank User Name stays blank after a restart (#4368)
* docs: ui-parity row for the blank User Name (#4368)
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1103: ignore macOS launch arguments and name the real cause when a file won't open
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1103: filter launch args on macOS only; leave Backstage after a failed Finder open
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1103: leave Backstage after a failed drag-and-drop open
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1103: name the file when an open fails after the Save changes prompt
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1103: report failed opens from every deferred path in execute_user
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1103: keep the named failed-open message after a browser save
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1103: only opens held back by a prompt or save leave Backstage on failure
A direct open from Recent keeps File open and reports there (#2938).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1103: re-apply open-failure reporting on main's split ui-egui modules
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Qualify i18n paths in report_open_failure after merging main
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* Task panes: a pane dropped over a docked pane's outer or inner third docks outside or inside it, and the order is kept (craft-libs#357)
* Pin craft-libs at b74f1b6 (pane order on an edge, craft-libs#357)
* Pin craft-libs at b926b5c (craft-libs main)
Audit finding 79 (CWE-117): the CLI printed Zotero's alert text (and, with
--trace, the method name and call/reply JSON) to stderr as received, so a peer
on Zotero's port could end the "Zotero:" line, forge following output or send
terminal escape sequences. escape_peer shows backslashes, control characters
(C0, DEL, C1), line separators and bidi overrides as visible escapes (\\, \n,
\u{1b}), keeping each record on its own attributable line.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Startup check is opt-in for the desktop app, the Windows update helper is dispatched before argument parsing, and a successful update closes through the app's own close path.
SonarCloud's analysis of main at b4da59f0c lists 23 closures such as `|v| v.as_slice()` that hand their argument straight to one method. This passes the method itself: `Vec::as_slice`, `str::to_ascii_lowercase`, `f64::total_cmp` and the like, all forms the repo already uses elsewhere. Behaviour is unchanged.
Five stay. The four in crates/proof/src/es/mod.rs sit in code that #4191 replaces, and its replacement already uses `PoisonError::into_inner`. In crates/engine/src/io/safe_save.rs the path would be `<dyn std::error::Error + Send + Sync>::is::<Guided>`, which reads worse than `|inner| inner.is::<Guided>()`.
* Bump craft-print, craft-pdf, krilla and craft-i18n to craft-libs 1774443
* PDF export writes link annotations only for safe targets (craft_pdf::write::uri_target)
* Chart default category and series names use fmt_plain, so RTL interfaces put no isolate marks into the document
- Format Shape is a task pane with the others: its title bar comes from
craft_ui::panes and its drag undo mark is forgotten while it is closed.
- The in-repo catalogs are gone upstream; the pane strings this branch
added to them (Styles Pane Position, Dock Left, Dock Right, Float, Pane
Options, Move Pane: {title}, Resize Pane) go to craft-i18n.
- Every craft-libs crate (craft-ui, craft-i18n, craft-print, craft-pdf,
krilla) is pinned at storytold/craft-libs 16fb3d4. craft_ui's Printer
has a label: the spooler's description of the printer.
On Windows the paste path asked arboard (3.6.1) for decoded pixels.
arboard decodes the registered "PNG" format and CF_DIBV5 with no image
limits, so a clipboard item of a few dozen bytes whose header declares
100,000 x 100,000 pixels made the decoder allocate tens of GB. The
allocation failure aborted the app outside Session::run's guard, before
paste_picture's size checks ever saw the picture.
On Windows the app now reads the clipboard itself (clipboard-win, the
raw read capped at 200 MB):
- "PNG" goes to Insert Picture as encoded bytes, once its header shows
a size a paste takes (16,000 a side, 50 M pixels).
- Otherwise CF_DIBV5 or CF_DIB is probed through
wordcraft_geom::picture::probe_dib, checked the same way, then decoded
within the decode budget into pixels.
probe_dib reads a DIB in the layout the image crate expects: a 32-bit
BI_RGB DIB with an alpha mask becomes bit fields, so its alpha is kept
as arboard did. A V4 or V5 bit-field DIB without the copy of its colour
masks after the header (arboard writes one) gets that copy, because the
decoder skips 12 bytes there and would otherwise read into the pixels.
Linux keeps using arboard, which decodes the clipboard's PNG within the
image crate's default 512 MB limit. macOS keeps it too: arboard decodes
the pasteboard's TIFF there, which can still reach the JPEG strip
decoder of #3645; that path is untouched here because it can't be built
or run on this machine.
cargo check and clippy for x86_64-pc-windows-gnu pass on the
Windows-only code; it hasn't been run on Windows.
