* #1086: ribbon tooltips show why a control is disabled
Hover hints give the command's own reason, cover split-button arrows,
menu buttons and the font/size/outline boxes, and show on keyboard focus.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #2678: translate disabled-control reasons in every interface language
Ribbon hints show a command's reason for being off; the 28 reasons now
have entries in all 22 catalogs (machine-written), and an audit test
reads every enabled check from the engine's command sources and fails
when a catalog lacks one.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #2678: translate the two disabled reasons added on main
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #2678: drop the unused combo import left by the merge
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #2678: translate the new disabled reasons and the da/nl/ro/sl catalogs; audit skips match patterns
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #2678: translate the no-document hint in every catalog and audit it; ROADMAP states the audit's real coverage
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Mail merge: go to any record, and merge or print a range of records (#3028) (#3894)
* Restrict Editing: a file command that changes the document is checked too
`always_allowed` waved through every `file.*` id, so on a protected document
the file commands that do change it went unchecked: the privacy options and
the properties wrote document settings, and the inspector's removals deleted
content. The privacy options' own comment already said they were "refused on
a protected document"; that wasn't true.
The allow-list now names the file commands that don't change the open
document, and the ones that do are checked like any other command. Reading
the document stays allowed: the inspector without removals, the privacy
settings, the info, and saving a version snapshot.
Restoring a stored version replaces the whole document, and a snapshot's own
protection is stale — restoring one lifted the protection and dropped its
password. The live document's protection, password and formatting limit now
survive a restore.
Co-Authored-By: opencode <noreply@opencode.ai>
* Restrict Editing: the user name can't change under protection
`file.setAuthor` sets the name a protected document's named exception
ranges are checked against, and the author new revisions and comments are
recorded under. `always_allowed` waved through every `file.*` id, so on a
protected document the name could be changed: an agent could take the
identity of a named editor and unlock their exception range, and forge the
authorship of the revisions it leaves behind.
A protected document refuses the change now, with the rule Word uses for a
content control's properties: stop protection first. The check is in the
command itself — `file.setAuthor` is a pure command, so `check_before`
never sees it — and in `check_before` for the day it isn't.
Word lets the user name change under protection: it is a preference there.
This project doesn't, because that identity gates what may be edited.
Co-Authored-By: opencode <noreply@opencode.ai>
* Restrict Editing: a protected document's protection needs an explicit stop
The guard in `restrict` refused a protected document only when its
protection had a password, so a password-less one could have its
protection changed — and `file.protect {"mode": "none"}` stopped it
outright. An agent could strip a user's protection silently and then edit
the document freely.
Two rules now, as Word has them (Stop Protection first):
- The protection of a protected document doesn't change, whatever the
mode. The formatting-only protection doesn't count: it stores the mode
"none", and it limits the styles, not the editing.
- Stopping the protection is explicit. The "none" mode is the shorthand
for it, but on a protected document only `{"stop": true}` stops it — the
way the pane's Stop Protection button does it — so a command that
merely names a mode can't strip it.
The password still guards the stop, and the formatting-only path (the
mode "none" with the formatting restriction) still works.
`cmd::tools::tests::protection_blocks_edits` stops the protection with
`{"mode": "none"}`; it has to stop it explicitly now.
Co-Authored-By: opencode <noreply@opencode.ai>
* Restrict Editing: the post-check compares the settings and the metadata
`outside_unchanged` is the check that rolls a command back when it
changed anything outside the editable regions. It compared the text, the
formatting, the page setup, the document defaults and the styles — but
not the document's settings, its metadata, its custom properties, the
resolved flag of its comments, its list definitions or its bibliography
sources. A command that changed the metadata of a protected document was
accepted and never rolled back: `file.properties {"title": "Forged
title"}` on a protected document with an exception changed the title and
stayed.
The settings, the core properties, the custom properties, the comments'
resolved flags, the list definitions and the sources are compared now, so
a command that changes them is rolled back like any other change outside
the editable regions.
The revisions and the media store stay out of it on purpose: an edit
inside an exception legitimately leaves a revision, and a picture
inserted there adds to the media store. The list definitions and the
sources are compared like the styles: the ones the document had must be
unchanged, but a new one may be added — a list or a citation inserted
inside an editable region adds its definition, like applying a style adds
one.
Saving is unaffected: it writes the metadata, but `file.save` is a pure
command and isn't post-checked, and the protection itself is changed by
`review.restrict`, which is always allowed.
Co-Authored-By: opencode <noreply@opencode.ai>
* The protection is stopped explicitly, and the docs say so
The test that stopped the protection used the "none" shorthand, which a
protected document now refuses; it stops it the explicit way instead, and
pins that the shorthand doesn't stop it. `file.protect` says the same: it
starts enforcement, and "none" doesn't stop a protected document.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the Restrict Editing gaps that are closed
Co-Authored-By: opencode <noreply@opencode.ai>
* A password guards the protection whatever its mode
The guard that stops the protection of a protected document from changing
asked whether the editing was restricted, so a formatting-only protection —
the mode "none", which limits the styles rather than the editing — was
exempted. A formatting-only protection can carry a password, and that password
guarded it: it was exempt from the guard, so `{"mode": "readOnly", "password":
"other"}` replaced the protection and the password with ones of the caller's
choosing, and the protection could then be stopped with them.
A password guards the protection whatever its mode, as it did before.
Co-Authored-By: opencode <noreply@opencode.ai>
* The CLI's --author names the session, it doesn't change the document
`--author` dispatched `file.setAuthor`, which a protected document refuses
now that the name is checked as the identity its exceptions are matched
against — so a script that named itself on a protected file failed before it
ran a single command.
The flag names the session, not the open document, so it sets the name
directly, with the same normalisation and blank-name check the command uses.
`file.setAuthor` keeps its protection check for the callers that mean to
change the document's identity.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the progress docs' status lines carry today's date
Co-Authored-By: opencode <noreply@opencode.ai>
* The document's properties and a version restore need the protection stopped
Two gaps the review found, both of them a change to a protected document that
went through without the protection seeing it.
The properties (`file.properties`) and the privacy options
(`file.privacyOptions`) are document-wide state, and they aren't tracked: under
tracked changes they changed the document with no revision to show for it, and
under the other modes they were only rolled back by the post-check, after the
command had run. They are refused now, before the command runs, as the content
control's properties are.
A version restore (`file.versions`) replaces the whole document, including the
content the protection kept read-only, and it did that without the password:
`file.versions` is a pure command, so the protection never saw it. Keeping the
live protection and its password stopped them being dropped, but the content
underneath was still replaced. A restore needs the protection stopped first,
and the password with it when the document has one.
The live protection still wins over the snapshot's stale one, so a restore
can't lock the user out of their own document either.
Co-Authored-By: opencode <noreply@opencode.ai>
* The inspector's removals are refused in every protected mode
`file.inspect` with removals takes content out of the document — the
comments, the revisions, the properties, the hidden text, the headers.
Under readOnly and comments it was refused, or rolled back by the
post-check where the document had an exception; under trackedChanges
nothing stopped it, so a document that tracks changes could have its
comments and revisions taken out with no revision to show for it.
The removals are refused now, in every mode a protected document can be
in, next to the properties and the privacy options. An inspection without
removals only reads the document, and still works.
The protection test covers the modes now, not only readOnly.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the session author, not the user name
"the user name can't change while the document is protected" was the
wrong term twice over: it is the session author — the name new tracked
changes and comments are recorded under, and the one a named exception
is matched against — and it is `file.setAuthor` that refuses to change
it. The CLI's `--author` names the session directly, so it works on a
protected document.
The parity row, the two status lines and the two progress rows now say
that.
Co-Authored-By: opencode <noreply@opencode.ai>
* Mail merge: go to any record, and merge or print a range of records (#3028)
Preview Results gets First Record and Last Record buttons and a record
number box; a number typed there and Enter preview that record.
Finish & Merge is now a menu. Edit Individual Documents... and Print
Documents... ask for all records, the current record, or a From and To
range by record number, and Print Documents opens Print for the merged
document. The dialog checks the range before Save Changes asks about
unsaved work.
New commands mailings.first, mailings.last, mailings.goToRecord and
mailings.printDocuments; mailings.finish takes "records": all|current.
A range with no records in it is refused instead of replacing the
document with an empty one.
* #3279: Keep protected session author fixed in CLI and Options
* The Document Inspector refuses its removals while the document tracks changes
The inspector's removals delete straight from the document: the hidden
text, the comments, the revisions and the headers go without ever reaching
the engine's tracked-delete path. On a document that tracks changes — and
`trackedChanges` protection turns tracking on — the content was gone with
no revision to show for it, and the revision trail was broken behind the
user's back.
The removals are not tracked, so they cannot be: rather than untrack them
silently, the inspector refuses the whole removal form while the document
tracks changes, and says why ("the document tracks changes: stop tracking
before removing content"). The check comes before anything is removed, so
the document is left untouched, and reading the document — the inspector
without removals — keeps working. A document that does not track changes
is inspected as before.
Co-Authored-By: opencode <noreply@opencode.ai>
* The inspector's tracking refusal doesn't cite an unrelated issue
#1344 is about the inspector missing hidden text, not about its removals
going untracked, so the reference only sent a reader to the wrong place.
Co-Authored-By: opencode <noreply@opencode.ai>
* A version snapshot belongs to the document it was taken from
`Session::set_document` resets everything about the open document — the
document id, the document, the selection, the undo history, the password,
the file name — but not the version snapshots. A snapshot taken of one
document therefore survived `file.new`, `file.open`, `file.newFromTemplate`
and `file.recover`, and `file.versions {"restore": index}` then put the
previous document's content into the open one.
The snapshots go with the document they were taken from: `set_document`
clears them, so a restore can only ever bring back a version of the
document that is open. Every caller replaces the document with another
one (a new or opened file, a recovered copy, a merge result, a sheet of
labels), so none of them loses anything it needs.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the inspector's tracking refusal and the version snapshot's scope
Co-Authored-By: opencode <noreply@opencode.ai>
* A comparison clears the version snapshots of the document it replaces
`review.compare` and `review.combine` open the original with `s.doc = doc`,
which bypasses `set_document` — so the version snapshots of the document the
comparison replaces survived it, and a restore could put the previous document
back over the comparison result.
The snapshots go with the document they were taken from, as everywhere else.
The document itself is still assigned directly: `set_document` resets the undo
history, and the comparison's own undo step would go with it.
Co-Authored-By: opencode <noreply@opencode.ai>
* #3277: Test Inspector refusal without protection
* #1327: Keep snapshots with their document through Compare
* #1327: Preserve file identity after rejected document replacement
* test: mark the portal test's blocking sleep as intentional (SonarCloud) (#3989)
The future is polled by hand with no async runtime, so a blocking sleep
is how the test models a slow dialog.
🤖 Generated with Codebuff
Co-authored-by: Codebuff <noreply@codebuff.com>
* Engine: no dead-code warnings on wasm (#3542)
* fix(engine): do not treat decimal points as sentence boundaries in Sentence case
In crates/engine/src/cmd/format.rs, convert_chars treated any period as a sentence boundary, causing numbers with decimal points (e.g. 3.14, 2.5) to capitalize the subsequent word in Sentence case.
Check if a period is surrounded by ASCII digits, and do not trigger uppercase capitalization when encountering a decimal point.
Closes#3485
* proof: drop U+FE0F from FORBIDDENWORD and NOSUGGEST flags too
Review follow-up: the directives that name one flag read the same emoji
form, so they now skip the variation selector like PFX/SFX and stem flags.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fmt: rustfmt equation array centring
* #3108 review: behind-text and in-front-of-text floats don't grow the row
FredApps' review: the row-growth loop counted every non-inline object, so a
page-anchored logo or watermark behind a cell's text would stretch its row to
the object's bottom edge - contradicting table.rs (behind-text frames count
for vertical alignment but don't increase the row's flow height) and Word.
Only floats that take part in the text flow (Square, Tight, Through,
TopAndBottom) grow the row now, the same classification layout already uses
elsewhere for "takes part in wrapping".
New test: a 300pt behind-text and a 300pt in-front-of-text picture each leave
the row at its text height; it fails with the old condition. The existing
Square-wrap tests and cell_frame_centres_empty still pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Engine: no dead-code warnings on wasm
`cargo check -p wordcraft-engine --target wasm32-unknown-unknown` warned
about five items whose only callers are platform-gated:
- citations `by_author`, user_templates `MAX_ENTRIES` and `label_of`: used
only by the desktop (non-wasm) source import and template listing.
- speech `voice_language`: used by espeak (Unix but macOS) and the macOS
voice picker, so `any(unix, test)`, not `any(not(windows), test)` (which
also took in wasm).
- speech `primary_tag`: used by those plus the Windows synthesizer, so
`any(unix, windows, test)`.
Each item now carries exactly its callers' gate rather than a blanket
allow(dead_code). Checked with cargo check on Linux, Windows (gnu), macOS
and wasm32 (zero warnings each), clippy -D warnings, and the engine tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Integration: #1847 reject comment IDs above u32::MAX
* Integration: #3267 leave footnote definitions out of link definitions
* Integration: #3471 drop duplicate egui options block; install_ui_fonts sets them
* Integration: #2153 drop trailing blank line and use assert! for bool checks in tab_separated_list_markers
* Integration: #2268 ODT lengths accept only the standard pc unit for picas
* Integration: #2269 LaTeX lengths keep macro names case-sensitive
* Integration: #2673 Khmer substitutes return the (list, flag) pair after #3245
* Integration: #2273 Latin weight/style and line styles take precedence over Asian, complex and line-type attributes
* Integration: #1851 DOCPROPERTY accepts the reference app's LastSavedBy name
* Integration: #1985 only ^0nnn codes read as Windows-1252
* Integration: #2416 collapse the nested vertical-align if (clippy::collapsible_if)
* Integration: #2185 hyperlink_target slices with get() and needs the whole field name
* Integration: #2034 objects without a stacking order draw above the ones before them
* Integration: #3434 drop review-bot notes from test doc comments
* Integration: #3419 doc comments back on their own items (EquationFrame and its test above them)
* Integration: #2334 test a formula string result continued in a CONTINUE record
* Integration: #3429 the based-on-chain test's doc comment back above its test
* Integration: #2453 drawing_payload test builds the shape fill as a Fill
* Integration: #3257 separate its Find-box test from #2407's recent-files test (auto-merge interleaved them)
* Integration: cargo fmt
* Integration: #1728 close the layout test the merge resolution left open
* Integration: cargo fmt
* Integration: cargo fmt
* Integration: cargo fmt
* Integration: #2722 Dutch registry comment on its own line
* Integration: #3203 English text for the keys the Romanian catalog lacks
Its complete-catalog test needs every key of every other catalog; the merged PRs added 72 since it was written. Rows carry the English text until translated.
* Integration: #1076 English text for the keys the Slovenian catalog lacks
Its complete-catalog test needs every key of every other catalog. Rows carry the English text until translated.
* Integration: status lines list each change once
Combining the tracks' status lines repeated a few entries (#2852, #1500, #2617).
* Integration: cargo xtask parity
* Integration: cargo fmt
* Integration: #1832 drop a useless .into() in the end-of-document citation test
clippy::useless_conversion failed cargo xtask ci.
* Integration: #2244 VML on/off values read case-insensitively by the shape fill reader
Main (#1500) moved VML fill reading into shape_style.rs, where filled="False" still counted as on; #2244's test vml_shape_wrap_side_and_anchor_case_insensitivity expects no fill.
* Integration: #2041 English text in the Polish catalog for the keys Italian gained
polish_covers_every_key_of_every_other_catalog expects Italian to have only "Style: APA" beyond Polish; #2041 translated 14 newer strings into Italian. Rows carry the English text until translated.
* Integration: #2722 English text for four labels the Dutch and Danish catalogs lack
every_tab_and_command_is_translated needs Format Shape Pane, Full Screen View, Personal Templates and Underline Color, added by other merged PRs. Rows carry the English text until translated.
* Integration: #3335 header Esc test allows the half-pixel return scroll that #3201 brings
#3201 makes entering an empty header scroll to it; Esc then scrolls back to the caret, landing 0.5 px from the start (17291.0 vs 17290.5). The test checks the view is back within a pixel.
* IME: the caret follows the composition text (#3556)
* Header and footer: a click in the other band edits it there (#3557)
* README: the app icon above the title
* Release 0.10.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* The inspector's removals are refused in every protected mode
`file.inspect` with removals takes content out of the document — the
comments, the revisions, the properties, the hidden text, the headers.
Under readOnly and comments it was refused, or rolled back by the
post-check where the document had an exception; under trackedChanges
nothing stopped it, so a document that tracks changes could have its
comments and revisions taken out with no revision to show for it.
The removals are refused now, in every mode a protected document can be
in, next to the properties and the privacy options. An inspection without
removals only reads the document, and still works.
The protection test covers the modes now, not only readOnly.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the session author, not the user name
"the user name can't change while the document is protected" was the
wrong term twice over: it is the session author — the name new tracked
changes and comments are recorded under, and the one a named exception
is matched against — and it is `file.setAuthor` that refuses to change
it. The CLI's `--author` names the session directly, so it works on a
protected document.
The parity row, the two status lines and the two progress rows now say
that.
Co-Authored-By: opencode <noreply@opencode.ai>
* #3279: Keep protected session author fixed in CLI and Options
* The Document Inspector refuses its removals while the document tracks changes
The inspector's removals delete straight from the document: the hidden
text, the comments, the revisions and the headers go without ever reaching
the engine's tracked-delete path. On a document that tracks changes — and
`trackedChanges` protection turns tracking on — the content was gone with
no revision to show for it, and the revision trail was broken behind the
user's back.
The removals are not tracked, so they cannot be: rather than untrack them
silently, the inspector refuses the whole removal form while the document
tracks changes, and says why ("the document tracks changes: stop tracking
before removing content"). The check comes before anything is removed, so
the document is left untouched, and reading the document — the inspector
without removals — keeps working. A document that does not track changes
is inspected as before.
Co-Authored-By: opencode <noreply@opencode.ai>
* The inspector's tracking refusal doesn't cite an unrelated issue
#1344 is about the inspector missing hidden text, not about its removals
going untracked, so the reference only sent a reader to the wrong place.
Co-Authored-By: opencode <noreply@opencode.ai>
* A version snapshot belongs to the document it was taken from
`Session::set_document` resets everything about the open document — the
document id, the document, the selection, the undo history, the password,
the file name — but not the version snapshots. A snapshot taken of one
document therefore survived `file.new`, `file.open`, `file.newFromTemplate`
and `file.recover`, and `file.versions {"restore": index}` then put the
previous document's content into the open one.
The snapshots go with the document they were taken from: `set_document`
clears them, so a restore can only ever bring back a version of the
document that is open. Every caller replaces the document with another
one (a new or opened file, a recovered copy, a merge result, a sheet of
labels), so none of them loses anything it needs.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the inspector's tracking refusal and the version snapshot's scope
Co-Authored-By: opencode <noreply@opencode.ai>
* A comparison clears the version snapshots of the document it replaces
`review.compare` and `review.combine` open the original with `s.doc = doc`,
which bypasses `set_document` — so the version snapshots of the document the
comparison replaces survived it, and a restore could put the previous document
back over the comparison result.
The snapshots go with the document they were taken from, as everywhere else.
The document itself is still assigned directly: `set_document` resets the undo
history, and the comparison's own undo step would go with it.
Co-Authored-By: opencode <noreply@opencode.ai>
* #3277: Test Inspector refusal without protection
* #1327: Keep snapshots with their document through Compare
* #1327: Preserve file identity after rejected document replacement
* test: mark the portal test's blocking sleep as intentional (SonarCloud) (#3989)
The future is polled by hand with no async runtime, so a blocking sleep
is how the test models a slow dialog.
🤖 Generated with Codebuff
Co-authored-by: Codebuff <noreply@codebuff.com>
* #3542: gate the label_of test off wasm32
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Divyanshu Gupta <divyanshu2074@gmail.com>
Co-authored-by: dmim2502-commits <234869083+dmim2502-commits@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: vangel76 <vangel1976@googlemail.com>
Co-authored-by: aiongg <aiongtaigi@gmail.com>
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
Co-authored-by: bflatastic <bombayapirat@gmail.com>
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Mat Strange <mat@matstrange.net>
Co-authored-by: opencode <noreply@opencode.ai>
Co-authored-by: skylar taylor-barrick <hi@skylar.cc>
Co-authored-by: Dylan M. Taylor <dylan@dylanmtaylor.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* Drop U+FFFE and U+FFFF from ODT export text (#3817)
Found while testing crates/formats/src/odt.rs:49-63 (fn x, the ODT text escaper; filter at line 58)
Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
* Cap the number of VML path commands parsed from a path attribute (#3951)
Fixes#3683
Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
* Return None from parse_number when the value overflows f64 (#3577)
Found while testing crates/doc/src/locale_number.rs:104
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Fix spurious 零 after a group's trailing zeros in Chinese numerals (#3745)
Found while testing crates/doc/src/cjk_numbers.rs:47-55 (Counting::format)
Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
* picture.corrections: a tiny sharpen value no longer panics in the blur (#3646) (#3830)
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
* Reject signs and non-digits in parse_date fields (#3575)
Found while testing crates/engine/src/cmd/controls.rs:113-123 (parse_date)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Layout: keep with next takes the 0.01 pt of slack the other fit checks take (#3816)
* Restrict Editing: a file command that changes the document is checked too
`always_allowed` waved through every `file.*` id, so on a protected document
the file commands that do change it went unchecked: the privacy options and
the properties wrote document settings, and the inspector's removals deleted
content. The privacy options' own comment already said they were "refused on
a protected document"; that wasn't true.
The allow-list now names the file commands that don't change the open
document, and the ones that do are checked like any other command. Reading
the document stays allowed: the inspector without removals, the privacy
settings, the info, and saving a version snapshot.
Restoring a stored version replaces the whole document, and a snapshot's own
protection is stale — restoring one lifted the protection and dropped its
password. The live document's protection, password and formatting limit now
survive a restore.
Co-Authored-By: opencode <noreply@opencode.ai>
* Restrict Editing: the user name can't change under protection
`file.setAuthor` sets the name a protected document's named exception
ranges are checked against, and the author new revisions and comments are
recorded under. `always_allowed` waved through every `file.*` id, so on a
protected document the name could be changed: an agent could take the
identity of a named editor and unlock their exception range, and forge the
authorship of the revisions it leaves behind.
A protected document refuses the change now, with the rule Word uses for a
content control's properties: stop protection first. The check is in the
command itself — `file.setAuthor` is a pure command, so `check_before`
never sees it — and in `check_before` for the day it isn't.
Word lets the user name change under protection: it is a preference there.
This project doesn't, because that identity gates what may be edited.
Co-Authored-By: opencode <noreply@opencode.ai>
* Restrict Editing: a protected document's protection needs an explicit stop
The guard in `restrict` refused a protected document only when its
protection had a password, so a password-less one could have its
protection changed — and `file.protect {"mode": "none"}` stopped it
outright. An agent could strip a user's protection silently and then edit
the document freely.
Two rules now, as Word has them (Stop Protection first):
- The protection of a protected document doesn't change, whatever the
mode. The formatting-only protection doesn't count: it stores the mode
"none", and it limits the styles, not the editing.
- Stopping the protection is explicit. The "none" mode is the shorthand
for it, but on a protected document only `{"stop": true}` stops it — the
way the pane's Stop Protection button does it — so a command that
merely names a mode can't strip it.
The password still guards the stop, and the formatting-only path (the
mode "none" with the formatting restriction) still works.
`cmd::tools::tests::protection_blocks_edits` stops the protection with
`{"mode": "none"}`; it has to stop it explicitly now.
Co-Authored-By: opencode <noreply@opencode.ai>
* Restrict Editing: the post-check compares the settings and the metadata
`outside_unchanged` is the check that rolls a command back when it
changed anything outside the editable regions. It compared the text, the
formatting, the page setup, the document defaults and the styles — but
not the document's settings, its metadata, its custom properties, the
resolved flag of its comments, its list definitions or its bibliography
sources. A command that changed the metadata of a protected document was
accepted and never rolled back: `file.properties {"title": "Forged
title"}` on a protected document with an exception changed the title and
stayed.
The settings, the core properties, the custom properties, the comments'
resolved flags, the list definitions and the sources are compared now, so
a command that changes them is rolled back like any other change outside
the editable regions.
The revisions and the media store stay out of it on purpose: an edit
inside an exception legitimately leaves a revision, and a picture
inserted there adds to the media store. The list definitions and the
sources are compared like the styles: the ones the document had must be
unchanged, but a new one may be added — a list or a citation inserted
inside an editable region adds its definition, like applying a style adds
one.
Saving is unaffected: it writes the metadata, but `file.save` is a pure
command and isn't post-checked, and the protection itself is changed by
`review.restrict`, which is always allowed.
Co-Authored-By: opencode <noreply@opencode.ai>
* The protection is stopped explicitly, and the docs say so
The test that stopped the protection used the "none" shorthand, which a
protected document now refuses; it stops it the explicit way instead, and
pins that the shorthand doesn't stop it. `file.protect` says the same: it
starts enforcement, and "none" doesn't stop a protected document.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the Restrict Editing gaps that are closed
Co-Authored-By: opencode <noreply@opencode.ai>
* A password guards the protection whatever its mode
The guard that stops the protection of a protected document from changing
asked whether the editing was restricted, so a formatting-only protection —
the mode "none", which limits the styles rather than the editing — was
exempted. A formatting-only protection can carry a password, and that password
guarded it: it was exempt from the guard, so `{"mode": "readOnly", "password":
"other"}` replaced the protection and the password with ones of the caller's
choosing, and the protection could then be stopped with them.
A password guards the protection whatever its mode, as it did before.
Co-Authored-By: opencode <noreply@opencode.ai>
* The CLI's --author names the session, it doesn't change the document
`--author` dispatched `file.setAuthor`, which a protected document refuses
now that the name is checked as the identity its exceptions are matched
against — so a script that named itself on a protected file failed before it
ran a single command.
The flag names the session, not the open document, so it sets the name
directly, with the same normalisation and blank-name check the command uses.
`file.setAuthor` keeps its protection check for the callers that mean to
change the document's identity.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the progress docs' status lines carry today's date
Co-Authored-By: opencode <noreply@opencode.ai>
* The document's properties and a version restore need the protection stopped
Two gaps the review found, both of them a change to a protected document that
went through without the protection seeing it.
The properties (`file.properties`) and the privacy options
(`file.privacyOptions`) are document-wide state, and they aren't tracked: under
tracked changes they changed the document with no revision to show for it, and
under the other modes they were only rolled back by the post-check, after the
command had run. They are refused now, before the command runs, as the content
control's properties are.
A version restore (`file.versions`) replaces the whole document, including the
content the protection kept read-only, and it did that without the password:
`file.versions` is a pure command, so the protection never saw it. Keeping the
live protection and its password stopped them being dropped, but the content
underneath was still replaced. A restore needs the protection stopped first,
and the password with it when the document has one.
The live protection still wins over the snapshot's stale one, so a restore
can't lock the user out of their own document either.
Co-Authored-By: opencode <noreply@opencode.ai>
* Layout: keep with next takes the 0.01 pt of slack the other fit checks take
place_para_in_flow moved a paragraph kept with the next one to a new page
when the two needed more than the room left by any amount, while lines, rows
and floats fit with 0.01 pt to spare. A kept paragraph whose need came to a
rounding error over the page bottom moved on alone.
* Release 0.10.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* The inspector's removals are refused in every protected mode
`file.inspect` with removals takes content out of the document — the
comments, the revisions, the properties, the hidden text, the headers.
Under readOnly and comments it was refused, or rolled back by the
post-check where the document had an exception; under trackedChanges
nothing stopped it, so a document that tracks changes could have its
comments and revisions taken out with no revision to show for it.
The removals are refused now, in every mode a protected document can be
in, next to the properties and the privacy options. An inspection without
removals only reads the document, and still works.
The protection test covers the modes now, not only readOnly.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the session author, not the user name
"the user name can't change while the document is protected" was the
wrong term twice over: it is the session author — the name new tracked
changes and comments are recorded under, and the one a named exception
is matched against — and it is `file.setAuthor` that refuses to change
it. The CLI's `--author` names the session directly, so it works on a
protected document.
The parity row, the two status lines and the two progress rows now say
that.
Co-Authored-By: opencode <noreply@opencode.ai>
* #3279: Keep protected session author fixed in CLI and Options
* The Document Inspector refuses its removals while the document tracks changes
The inspector's removals delete straight from the document: the hidden
text, the comments, the revisions and the headers go without ever reaching
the engine's tracked-delete path. On a document that tracks changes — and
`trackedChanges` protection turns tracking on — the content was gone with
no revision to show for it, and the revision trail was broken behind the
user's back.
The removals are not tracked, so they cannot be: rather than untrack them
silently, the inspector refuses the whole removal form while the document
tracks changes, and says why ("the document tracks changes: stop tracking
before removing content"). The check comes before anything is removed, so
the document is left untouched, and reading the document — the inspector
without removals — keeps working. A document that does not track changes
is inspected as before.
Co-Authored-By: opencode <noreply@opencode.ai>
* The inspector's tracking refusal doesn't cite an unrelated issue
#1344 is about the inspector missing hidden text, not about its removals
going untracked, so the reference only sent a reader to the wrong place.
Co-Authored-By: opencode <noreply@opencode.ai>
* A version snapshot belongs to the document it was taken from
`Session::set_document` resets everything about the open document — the
document id, the document, the selection, the undo history, the password,
the file name — but not the version snapshots. A snapshot taken of one
document therefore survived `file.new`, `file.open`, `file.newFromTemplate`
and `file.recover`, and `file.versions {"restore": index}` then put the
previous document's content into the open one.
The snapshots go with the document they were taken from: `set_document`
clears them, so a restore can only ever bring back a version of the
document that is open. Every caller replaces the document with another
one (a new or opened file, a recovered copy, a merge result, a sheet of
labels), so none of them loses anything it needs.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the inspector's tracking refusal and the version snapshot's scope
Co-Authored-By: opencode <noreply@opencode.ai>
* A comparison clears the version snapshots of the document it replaces
`review.compare` and `review.combine` open the original with `s.doc = doc`,
which bypasses `set_document` — so the version snapshots of the document the
comparison replaces survived it, and a restore could put the previous document
back over the comparison result.
The snapshots go with the document they were taken from, as everywhere else.
The document itself is still assigned directly: `set_document` resets the undo
history, and the comparison's own undo step would go with it.
Co-Authored-By: opencode <noreply@opencode.ai>
* #3277: Test Inspector refusal without protection
* #1327: Keep snapshots with their document through Compare
* #1327: Preserve file identity after rejected document replacement
* test: mark the portal test's blocking sleep as intentional (SonarCloud) (#3989)
The future is polled by hand with no async runtime, so a blocking sleep
is how the test models a slow dialog.
🤖 Generated with Codebuff
Co-authored-by: Codebuff <noreply@codebuff.com>
* Engine: no dead-code warnings on wasm (#3542)
* fix(engine): do not treat decimal points as sentence boundaries in Sentence case
In crates/engine/src/cmd/format.rs, convert_chars treated any period as a sentence boundary, causing numbers with decimal points (e.g. 3.14, 2.5) to capitalize the subsequent word in Sentence case.
Check if a period is surrounded by ASCII digits, and do not trigger uppercase capitalization when encountering a decimal point.
Closes#3485
* proof: drop U+FE0F from FORBIDDENWORD and NOSUGGEST flags too
Review follow-up: the directives that name one flag read the same emoji
form, so they now skip the variation selector like PFX/SFX and stem flags.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fmt: rustfmt equation array centring
* #3108 review: behind-text and in-front-of-text floats don't grow the row
FredApps' review: the row-growth loop counted every non-inline object, so a
page-anchored logo or watermark behind a cell's text would stretch its row to
the object's bottom edge - contradicting table.rs (behind-text frames count
for vertical alignment but don't increase the row's flow height) and Word.
Only floats that take part in the text flow (Square, Tight, Through,
TopAndBottom) grow the row now, the same classification layout already uses
elsewhere for "takes part in wrapping".
New test: a 300pt behind-text and a 300pt in-front-of-text picture each leave
the row at its text height; it fails with the old condition. The existing
Square-wrap tests and cell_frame_centres_empty still pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Engine: no dead-code warnings on wasm
`cargo check -p wordcraft-engine --target wasm32-unknown-unknown` warned
about five items whose only callers are platform-gated:
- citations `by_author`, user_templates `MAX_ENTRIES` and `label_of`: used
only by the desktop (non-wasm) source import and template listing.
- speech `voice_language`: used by espeak (Unix but macOS) and the macOS
voice picker, so `any(unix, test)`, not `any(not(windows), test)` (which
also took in wasm).
- speech `primary_tag`: used by those plus the Windows synthesizer, so
`any(unix, windows, test)`.
Each item now carries exactly its callers' gate rather than a blanket
allow(dead_code). Checked with cargo check on Linux, Windows (gnu), macOS
and wasm32 (zero warnings each), clippy -D warnings, and the engine tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Integration: #1847 reject comment IDs above u32::MAX
* Integration: #3267 leave footnote definitions out of link definitions
* Integration: #3471 drop duplicate egui options block; install_ui_fonts sets them
* Integration: #2153 drop trailing blank line and use assert! for bool checks in tab_separated_list_markers
* Integration: #2268 ODT lengths accept only the standard pc unit for picas
* Integration: #2269 LaTeX lengths keep macro names case-sensitive
* Integration: #2673 Khmer substitutes return the (list, flag) pair after #3245
* Integration: #2273 Latin weight/style and line styles take precedence over Asian, complex and line-type attributes
* Integration: #1851 DOCPROPERTY accepts the reference app's LastSavedBy name
* Integration: #1985 only ^0nnn codes read as Windows-1252
* Integration: #2416 collapse the nested vertical-align if (clippy::collapsible_if)
* Integration: #2185 hyperlink_target slices with get() and needs the whole field name
* Integration: #2034 objects without a stacking order draw above the ones before them
* Integration: #3434 drop review-bot notes from test doc comments
* Integration: #3419 doc comments back on their own items (EquationFrame and its test above them)
* Integration: #2334 test a formula string result continued in a CONTINUE record
* Integration: #3429 the based-on-chain test's doc comment back above its test
* Integration: #2453 drawing_payload test builds the shape fill as a Fill
* Integration: #3257 separate its Find-box test from #2407's recent-files test (auto-merge interleaved them)
* Integration: cargo fmt
* Integration: #1728 close the layout test the merge resolution left open
* Integration: cargo fmt
* Integration: cargo fmt
* Integration: cargo fmt
* Integration: #2722 Dutch registry comment on its own line
* Integration: #3203 English text for the keys the Romanian catalog lacks
Its complete-catalog test needs every key of every other catalog; the merged PRs added 72 since it was written. Rows carry the English text until translated.
* Integration: #1076 English text for the keys the Slovenian catalog lacks
Its complete-catalog test needs every key of every other catalog. Rows carry the English text until translated.
* Integration: status lines list each change once
Combining the tracks' status lines repeated a few entries (#2852, #1500, #2617).
* Integration: cargo xtask parity
* Integration: cargo fmt
* Integration: #1832 drop a useless .into() in the end-of-document citation test
clippy::useless_conversion failed cargo xtask ci.
* Integration: #2244 VML on/off values read case-insensitively by the shape fill reader
Main (#1500) moved VML fill reading into shape_style.rs, where filled="False" still counted as on; #2244's test vml_shape_wrap_side_and_anchor_case_insensitivity expects no fill.
* Integration: #2041 English text in the Polish catalog for the keys Italian gained
polish_covers_every_key_of_every_other_catalog expects Italian to have only "Style: APA" beyond Polish; #2041 translated 14 newer strings into Italian. Rows carry the English text until translated.
* Integration: #2722 English text for four labels the Dutch and Danish catalogs lack
every_tab_and_command_is_translated needs Format Shape Pane, Full Screen View, Personal Templates and Underline Color, added by other merged PRs. Rows carry the English text until translated.
* Integration: #3335 header Esc test allows the half-pixel return scroll that #3201 brings
#3201 makes entering an empty header scroll to it; Esc then scrolls back to the caret, landing 0.5 px from the start (17291.0 vs 17290.5). The test checks the view is back within a pixel.
* IME: the caret follows the composition text (#3556)
* Header and footer: a click in the other band edits it there (#3557)
* README: the app icon above the title
* Release 0.10.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* The inspector's removals are refused in every protected mode
`file.inspect` with removals takes content out of the document — the
comments, the revisions, the properties, the hidden text, the headers.
Under readOnly and comments it was refused, or rolled back by the
post-check where the document had an exception; under trackedChanges
nothing stopped it, so a document that tracks changes could have its
comments and revisions taken out with no revision to show for it.
The removals are refused now, in every mode a protected document can be
in, next to the properties and the privacy options. An inspection without
removals only reads the document, and still works.
The protection test covers the modes now, not only readOnly.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the session author, not the user name
"the user name can't change while the document is protected" was the
wrong term twice over: it is the session author — the name new tracked
changes and comments are recorded under, and the one a named exception
is matched against — and it is `file.setAuthor` that refuses to change
it. The CLI's `--author` names the session directly, so it works on a
protected document.
The parity row, the two status lines and the two progress rows now say
that.
Co-Authored-By: opencode <noreply@opencode.ai>
* #3279: Keep protected session author fixed in CLI and Options
* The Document Inspector refuses its removals while the document tracks changes
The inspector's removals delete straight from the document: the hidden
text, the comments, the revisions and the headers go without ever reaching
the engine's tracked-delete path. On a document that tracks changes — and
`trackedChanges` protection turns tracking on — the content was gone with
no revision to show for it, and the revision trail was broken behind the
user's back.
The removals are not tracked, so they cannot be: rather than untrack them
silently, the inspector refuses the whole removal form while the document
tracks changes, and says why ("the document tracks changes: stop tracking
before removing content"). The check comes before anything is removed, so
the document is left untouched, and reading the document — the inspector
without removals — keeps working. A document that does not track changes
is inspected as before.
Co-Authored-By: opencode <noreply@opencode.ai>
* The inspector's tracking refusal doesn't cite an unrelated issue
#1344 is about the inspector missing hidden text, not about its removals
going untracked, so the reference only sent a reader to the wrong place.
Co-Authored-By: opencode <noreply@opencode.ai>
* A version snapshot belongs to the document it was taken from
`Session::set_document` resets everything about the open document — the
document id, the document, the selection, the undo history, the password,
the file name — but not the version snapshots. A snapshot taken of one
document therefore survived `file.new`, `file.open`, `file.newFromTemplate`
and `file.recover`, and `file.versions {"restore": index}` then put the
previous document's content into the open one.
The snapshots go with the document they were taken from: `set_document`
clears them, so a restore can only ever bring back a version of the
document that is open. Every caller replaces the document with another
one (a new or opened file, a recovered copy, a merge result, a sheet of
labels), so none of them loses anything it needs.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the inspector's tracking refusal and the version snapshot's scope
Co-Authored-By: opencode <noreply@opencode.ai>
* A comparison clears the version snapshots of the document it replaces
`review.compare` and `review.combine` open the original with `s.doc = doc`,
which bypasses `set_document` — so the version snapshots of the document the
comparison replaces survived it, and a restore could put the previous document
back over the comparison result.
The snapshots go with the document they were taken from, as everywhere else.
The document itself is still assigned directly: `set_document` resets the undo
history, and the comparison's own undo step would go with it.
Co-Authored-By: opencode <noreply@opencode.ai>
* #3277: Test Inspector refusal without protection
* #1327: Keep snapshots with their document through Compare
* #1327: Preserve file identity after rejected document replacement
* test: mark the portal test's blocking sleep as intentional (SonarCloud) (#3989)
The future is polled by hand with no async runtime, so a blocking sleep
is how the test models a slow dialog.
🤖 Generated with Codebuff
Co-authored-by: Codebuff <noreply@codebuff.com>
* #3542: gate the label_of test off wasm32
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Divyanshu Gupta <divyanshu2074@gmail.com>
Co-authored-by: dmim2502-commits <234869083+dmim2502-commits@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: vangel76 <vangel1976@googlemail.com>
Co-authored-by: aiongg <aiongtaigi@gmail.com>
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
Co-authored-by: bflatastic <bombayapirat@gmail.com>
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Mat Strange <mat@matstrange.net>
Co-authored-by: opencode <noreply@opencode.ai>
Co-authored-by: skylar taylor-barrick <hi@skylar.cc>
Co-authored-by: Dylan M. Taylor <dylan@dylanmtaylor.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* Drop U+FFFE and U+FFFF from ODT export text (#3817)
Found while testing crates/formats/src/odt.rs:49-63 (fn x, the ODT text escaper; filter at line 58)
Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
* Cap the number of VML path commands parsed from a path attribute (#3951)
Fixes#3683
Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
* Return None from parse_number when the value overflows f64 (#3577)
Found while testing crates/doc/src/locale_number.rs:104
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Fix spurious 零 after a group's trailing zeros in Chinese numerals (#3745)
Found while testing crates/doc/src/cjk_numbers.rs:47-55 (Counting::format)
Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
* picture.corrections: a tiny sharpen value no longer panics in the blur (#3646) (#3830)
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
* Reject signs and non-digits in parse_date fields (#3575)
Found while testing crates/engine/src/cmd/controls.rs:113-123 (parse_date)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* #3816: also assert the next paragraph's first line stays on page 0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Mat Strange <mat@matstrange.net>
Co-authored-by: opencode <noreply@opencode.ai>
Co-authored-by: dfgodvan <180286157+dfgodvan@users.noreply.github.com>
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: skylar taylor-barrick <hi@skylar.cc>
Co-authored-by: Dylan M. Taylor <dylan@dylanmtaylor.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: Michael Mu <69072633+MichaelMuClaude@users.noreply.github.com>
Co-authored-by: Divyanshu Gupta <divyanshu2074@gmail.com>
Co-authored-by: dmim2502-commits <234869083+dmim2502-commits@users.noreply.github.com>
Co-authored-by: vangel76 <vangel1976@googlemail.com>
Co-authored-by: aiongg <aiongtaigi@gmail.com>
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
Co-authored-by: bflatastic <bombayapirat@gmail.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Co-authored-by: Joseph Anglada <fluorine@users.noreply.github.com>
* Parse the Flat OPC part root tag once when inheriting namespaces (#3944)
* Parse the Flat OPC part root tag once when inheriting namespaces
Fixes#3727
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* test: mark the portal test's blocking sleep as intentional (SonarCloud) (#3989)
The future is polled by hand with no async runtime, so a blocking sleep
is how the test models a slow dialog.
🤖 Generated with Codebuff
Co-authored-by: Codebuff <noreply@codebuff.com>
* Engine: no dead-code warnings on wasm (#3542)
* fix(engine): do not treat decimal points as sentence boundaries in Sentence case
In crates/engine/src/cmd/format.rs, convert_chars treated any period as a sentence boundary, causing numbers with decimal points (e.g. 3.14, 2.5) to capitalize the subsequent word in Sentence case.
Check if a period is surrounded by ASCII digits, and do not trigger uppercase capitalization when encountering a decimal point.
Closes#3485
* proof: drop U+FE0F from FORBIDDENWORD and NOSUGGEST flags too
Review follow-up: the directives that name one flag read the same emoji
form, so they now skip the variation selector like PFX/SFX and stem flags.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fmt: rustfmt equation array centring
* #3108 review: behind-text and in-front-of-text floats don't grow the row
FredApps' review: the row-growth loop counted every non-inline object, so a
page-anchored logo or watermark behind a cell's text would stretch its row to
the object's bottom edge - contradicting table.rs (behind-text frames count
for vertical alignment but don't increase the row's flow height) and Word.
Only floats that take part in the text flow (Square, Tight, Through,
TopAndBottom) grow the row now, the same classification layout already uses
elsewhere for "takes part in wrapping".
New test: a 300pt behind-text and a 300pt in-front-of-text picture each leave
the row at its text height; it fails with the old condition. The existing
Square-wrap tests and cell_frame_centres_empty still pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Engine: no dead-code warnings on wasm
`cargo check -p wordcraft-engine --target wasm32-unknown-unknown` warned
about five items whose only callers are platform-gated:
- citations `by_author`, user_templates `MAX_ENTRIES` and `label_of`: used
only by the desktop (non-wasm) source import and template listing.
- speech `voice_language`: used by espeak (Unix but macOS) and the macOS
voice picker, so `any(unix, test)`, not `any(not(windows), test)` (which
also took in wasm).
- speech `primary_tag`: used by those plus the Windows synthesizer, so
`any(unix, windows, test)`.
Each item now carries exactly its callers' gate rather than a blanket
allow(dead_code). Checked with cargo check on Linux, Windows (gnu), macOS
and wasm32 (zero warnings each), clippy -D warnings, and the engine tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Integration: #1847 reject comment IDs above u32::MAX
* Integration: #3267 leave footnote definitions out of link definitions
* Integration: #3471 drop duplicate egui options block; install_ui_fonts sets them
* Integration: #2153 drop trailing blank line and use assert! for bool checks in tab_separated_list_markers
* Integration: #2268 ODT lengths accept only the standard pc unit for picas
* Integration: #2269 LaTeX lengths keep macro names case-sensitive
* Integration: #2673 Khmer substitutes return the (list, flag) pair after #3245
* Integration: #2273 Latin weight/style and line styles take precedence over Asian, complex and line-type attributes
* Integration: #1851 DOCPROPERTY accepts the reference app's LastSavedBy name
* Integration: #1985 only ^0nnn codes read as Windows-1252
* Integration: #2416 collapse the nested vertical-align if (clippy::collapsible_if)
* Integration: #2185 hyperlink_target slices with get() and needs the whole field name
* Integration: #2034 objects without a stacking order draw above the ones before them
* Integration: #3434 drop review-bot notes from test doc comments
* Integration: #3419 doc comments back on their own items (EquationFrame and its test above them)
* Integration: #2334 test a formula string result continued in a CONTINUE record
* Integration: #3429 the based-on-chain test's doc comment back above its test
* Integration: #2453 drawing_payload test builds the shape fill as a Fill
* Integration: #3257 separate its Find-box test from #2407's recent-files test (auto-merge interleaved them)
* Integration: cargo fmt
* Integration: #1728 close the layout test the merge resolution left open
* Integration: cargo fmt
* Integration: cargo fmt
* Integration: cargo fmt
* Integration: #2722 Dutch registry comment on its own line
* Integration: #3203 English text for the keys the Romanian catalog lacks
Its complete-catalog test needs every key of every other catalog; the merged PRs added 72 since it was written. Rows carry the English text until translated.
* Integration: #1076 English text for the keys the Slovenian catalog lacks
Its complete-catalog test needs every key of every other catalog. Rows carry the English text until translated.
* Integration: status lines list each change once
Combining the tracks' status lines repeated a few entries (#2852, #1500, #2617).
* Integration: cargo xtask parity
* Integration: cargo fmt
* Integration: #1832 drop a useless .into() in the end-of-document citation test
clippy::useless_conversion failed cargo xtask ci.
* Integration: #2244 VML on/off values read case-insensitively by the shape fill reader
Main (#1500) moved VML fill reading into shape_style.rs, where filled="False" still counted as on; #2244's test vml_shape_wrap_side_and_anchor_case_insensitivity expects no fill.
* Integration: #2041 English text in the Polish catalog for the keys Italian gained
polish_covers_every_key_of_every_other_catalog expects Italian to have only "Style: APA" beyond Polish; #2041 translated 14 newer strings into Italian. Rows carry the English text until translated.
* Integration: #2722 English text for four labels the Dutch and Danish catalogs lack
every_tab_and_command_is_translated needs Format Shape Pane, Full Screen View, Personal Templates and Underline Color, added by other merged PRs. Rows carry the English text until translated.
* Integration: #3335 header Esc test allows the half-pixel return scroll that #3201 brings
#3201 makes entering an empty header scroll to it; Esc then scrolls back to the caret, landing 0.5 px from the start (17291.0 vs 17290.5). The test checks the view is back within a pixel.
* IME: the caret follows the composition text (#3556)
* Header and footer: a click in the other band edits it there (#3557)
* README: the app icon above the title
* Release 0.10.0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* The inspector's removals are refused in every protected mode
`file.inspect` with removals takes content out of the document — the
comments, the revisions, the properties, the hidden text, the headers.
Under readOnly and comments it was refused, or rolled back by the
post-check where the document had an exception; under trackedChanges
nothing stopped it, so a document that tracks changes could have its
comments and revisions taken out with no revision to show for it.
The removals are refused now, in every mode a protected document can be
in, next to the properties and the privacy options. An inspection without
removals only reads the document, and still works.
The protection test covers the modes now, not only readOnly.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the session author, not the user name
"the user name can't change while the document is protected" was the
wrong term twice over: it is the session author — the name new tracked
changes and comments are recorded under, and the one a named exception
is matched against — and it is `file.setAuthor` that refuses to change
it. The CLI's `--author` names the session directly, so it works on a
protected document.
The parity row, the two status lines and the two progress rows now say
that.
Co-Authored-By: opencode <noreply@opencode.ai>
* #3279: Keep protected session author fixed in CLI and Options
* The Document Inspector refuses its removals while the document tracks changes
The inspector's removals delete straight from the document: the hidden
text, the comments, the revisions and the headers go without ever reaching
the engine's tracked-delete path. On a document that tracks changes — and
`trackedChanges` protection turns tracking on — the content was gone with
no revision to show for it, and the revision trail was broken behind the
user's back.
The removals are not tracked, so they cannot be: rather than untrack them
silently, the inspector refuses the whole removal form while the document
tracks changes, and says why ("the document tracks changes: stop tracking
before removing content"). The check comes before anything is removed, so
the document is left untouched, and reading the document — the inspector
without removals — keeps working. A document that does not track changes
is inspected as before.
Co-Authored-By: opencode <noreply@opencode.ai>
* The inspector's tracking refusal doesn't cite an unrelated issue
#1344 is about the inspector missing hidden text, not about its removals
going untracked, so the reference only sent a reader to the wrong place.
Co-Authored-By: opencode <noreply@opencode.ai>
* A version snapshot belongs to the document it was taken from
`Session::set_document` resets everything about the open document — the
document id, the document, the selection, the undo history, the password,
the file name — but not the version snapshots. A snapshot taken of one
document therefore survived `file.new`, `file.open`, `file.newFromTemplate`
and `file.recover`, and `file.versions {"restore": index}` then put the
previous document's content into the open one.
The snapshots go with the document they were taken from: `set_document`
clears them, so a restore can only ever bring back a version of the
document that is open. Every caller replaces the document with another
one (a new or opened file, a recovered copy, a merge result, a sheet of
labels), so none of them loses anything it needs.
Co-Authored-By: opencode <noreply@opencode.ai>
* Docs: the inspector's tracking refusal and the version snapshot's scope
Co-Authored-By: opencode <noreply@opencode.ai>
* A comparison clears the version snapshots of the document it replaces
`review.compare` and `review.combine` open the original with `s.doc = doc`,
which bypasses `set_document` — so the version snapshots of the document the
comparison replaces survived it, and a restore could put the previous document
back over the comparison result.
The snapshots go with the document they were taken from, as everywhere else.
The document itself is still assigned directly: `set_document` resets the undo
history, and the comparison's own undo step would go with it.
Co-Authored-By: opencode <noreply@opencode.ai>
* #3277: Test Inspector refusal without protection
* #1327: Keep snapshots with their document through Compare
* #1327: Preserve file identity after rejected document replacement
* test: mark the portal test's blocking sleep as intentional (SonarCloud) (#3989)
The future is polled by hand with no async runtime, so a blocking sleep
is how the test models a slow dialog.
🤖 Generated with Codebuff
Co-authored-by: Codebuff <noreply@codebuff.com>
* #3542: gate the label_of test off wasm32
Co-A…
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: VoiceLessQ <44067308+VoiceLessQ@users.noreply.github.com>
Co-authored-by: Mat Strange <mat@matstrange.net>
Co-authored-by: opencode <noreply@opencode.ai>
Co-authored-by: skylar taylor-barrick <hi@skylar.cc>
Co-authored-by: Dylan M. Taylor <dylan@dylanmtaylor.com>
Co-authored-by: Codebuff <noreply@codebuff.com>
Co-authored-by: Michael Mu <69072633+MichaelMuClaude@users.noreply.github.com>
Co-authored-by: Divyanshu Gupta <divyanshu2074@gmail.com>
Co-authored-by: dmim2502-commits <234869083+dmim2502-commits@users.noreply.github.com>
Co-authored-by: vangel76 <vangel1976@googlemail.com>
Co-authored-by: aiongg <aiongtaigi@gmail.com>
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
Co-authored-by: bflatastic <bombayapirat@gmail.com>
Co-authored-by: Brandon Thomas <brandon@storyteller.ai>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Co-authored-by: Joseph Anglada <fluorine@users.noreply.github.com>
Co-authored-by: dfgodvan <dfgodvan@gmail.com>
Co-authored-by: dfgodvan <180286157+dfgodvan@users.noreply.github.com>
Co-authored-by: Michael Higgins <55243596+Higgs32584@users.noreply.github.com>
Co-authored-by: In Mean <6434741+inmean@users.noreply.github.com>
Co-authored-by: Jayesh Prajapati <156836276+Jayesh-Prajapati9@users.noreply.github.com>
Co-authored-by: Gabriel Matozo <69991354+GabrielMatozo@users.noreply.github.com>
Co-authored-by: Mathieu Rancourt <40959576+MatRanc@users.noreply.github.com>
Co-authored-by: pakiat <49967840+pakiat@users.noreply.github.com>
Co-authored-by: Marco Arnulfo <103679419+marcoarnulfo@users.noreply.github.com>
Co-authored-by: Menonro <nitayd2001@gmail.com>
Co-authored-by: Gabriel Luís da Silva <79342117+mercuryVM@users.noreply.github.com>
Co-authored-by: MarekSpodBiedry <73122968+MarekSpodBiedry@users.noreply.github.com>
Co-authored-by: dhruvLearner8 <83899022+dhruvLearner8@users.noreply.github.com>
Co-authored-by: vioreltus <142961713+vioreltus@users.noreply.github.com>
Co-authored-by: Dominik Strebel <dominik.strebel@gmail.com>
Co-authored-by: Mat Strange <54028700+matstrange@users.noreply.github.com>
Co-authored-by: Dmitriy <dmitriy@mrzv.org>
* gap: selection bar RTL/table rows WIP
* gap: selection bar in the right margin for right-to-left paragraphs and beside table rows
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap: selection bar review fixes (row bar only beside the table, Shift+click from outside, text-box tables)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap: selection bar review round 2 (0.5pt row-overlap tolerance, body-story check for Shift+click)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap: selection bar: triple-click or Ctrl+click beside a table row selects the document, as in Word
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap: selection bar: ui-parity wording (only triple-click was checked in Word)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap: selection bar: fix docs after rebase onto main
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gap: selection bar: a Shift+click drag keeps the anchor row of its press
table.selectAt takes an optional anchorRow; the app reads the anchor at the
press and sends it on every drag frame, so pointer jitter after an upward
Shift+click no longer re-reads it from the rows the press selected.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Selection bar RTL test: the left margin shows no bar arrow (Windows reports no cursor there)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #2042: repair three doc status lines a #3882 merge left with a stray Target
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* Fix#1974: the caret and clicks land between the letters of a ligature
The glyph's advance is shared evenly among its letters (mirrored in
right-to-left text); ligature letters keep their character spacing.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Fix#1974: a long word never wraps inside a ligature
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Fix#1974: a hyphenation point never splits a ligature
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1974: ligature tests use a bundled font that draws fi and ffi as ligatures
They assumed the installed default-font stand-in draws ligatures; Liberation Sans (Linux) draws
none, so they failed there.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* gap 19: RTF import compares heading and code run formatting with the file's stylesheet
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 19: review round 1: a style chain with formatting words is complete; unnumbered entries are Normal
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #662: ribbon groups shrink to fit the window (compact, then one drop-down)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1285: collapsed ribbon groups stay open while used; Styles gallery trims before it folds
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Ribbon collapse: accessible name for folded groups, Tables/Links icons (#662)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Ribbon: Esc in a collapsed-group popup doesn't leave full screen; tab-strip test ignores same-named ribbon buttons (#1285)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Ribbon tab-strip test: pick the tab, not a same-named folded group (#662)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Ribbon: a folded group's open state is keyed by its place in the row, not just its title (#1285)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* rustfmt: collapsed_group signature (#1285)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1348: WIP
* #1348: keep comment drafts per document, keep them on a refused edit, write them before save/close/new/open
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1348: a refused comment draft can be dropped; fields read-only where comments can't change
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1348: ui-parity: one Task panes and Context menus row after the rebase
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Docs after rebasing on main
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1348: keep the window open while a web save is unconfirmed; split the roadmap row by operation
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1348: pending comment drafts count as unsaved changes for the browser; a save error isn't hidden by a draft refusal
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #1348: an agent can't replace the document over a pending comment draft without force
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #778: .xls and legacy-encoding recipient lists; filter and sort recipients
- Recipient lists: legacy Excel 97-2003 .xls (BIFF8 reader on the cfb crate already in the
tree); Excel 5.0/95 and password-protected .xls refused with a clear message; a CSV named
.xls reads as text, an HTML one gets an error. .xls added to the picker filters (desktop,
web, built-in browser) and drop handling.
- Text lists (and plain-text import) detect legacy encodings when not UTF-8/UTF-16: GBK/GB18030,
Big5, Shift_JIS, EUC-KR, Windows code pages (encoding_rs + chardetng, MIT/Apache); an
`encoding` param overrides.
- mailings.filterRecipients / mailings.sortRecipients: field, comparison (equal, notEqual,
less, greater, lessOrEqual, greaterOrEqual, blank, notBlank, contains, notContains), value,
And/Or joins; sort keys. Preview, Finish & Merge and labels use only the matching records
in sort order. Edit Recipient List edits every record and keeps the filter.
- Recipient List dialog: Filter and Sort section and a merge-order column; catalog rows;
strings in every catalog; docs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* i18n: Hungarian and French strings for this change
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Review fixes for #885: total order for recipient sort, Bulgarian strings
- compare_cells now ranks numbers (compared numerically) before text (compared
case-insensitively), so it is a total order; a column mixing 9, 10 and 1a
could make slice::sort_by panic. Regression test sorts mixed columns.
- Bulgarian catalog: the 24 Filter and Sort strings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1287: placeholder (work in progress)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1287: keep the filter on a failed Edit Recipients; cap .xls/.xlsx cell text; dialog drops rules on unknown fields and caches the merge order
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1287: rustfmt
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #2601: Drop Cap Options dialog
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gaps: keep the Drop Cap Options note on the dialog-depth row
* i18n: translate the two Drop Cap disabled reasons in the audited catalogs
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Hover hints give the command's own reason, cover split-button arrows, menu buttons and the font/size/outline boxes, and show on keyboard focus.
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* gap: nested ink WIP
* gap 2: native ink nested in groups and drawing canvases survives DOCX saves
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 2: review round 1: ungrouping keeps nested ink; no orphan parts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 2: Impact cell matches the restated impact
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gap 2: only Word ink pins a group against Ungroup
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gap 2: alternate ink must hold an a:graphic to be written as standalone
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gap: nested ink WIP
* gap 2: native ink nested in groups and drawing canvases survives DOCX saves
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 2: review round 1: ungrouping keeps nested ink; no orphan parts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 2: Impact cell matches the restated impact
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gap 2: only Word ink pins a group against Ungroup
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gap 2: alternate ink must hold an a:graphic to be written as standalone
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* gap: RTF formatting revisions WIP
* gap 19: RTF formatting and paragraph-mark revisions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 19: review round 1: list kept on Reject; old formatting normalised; section marks; hostile borders
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 19: review round 2: \oldcprops holds only the changed properties, as Word writes it
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 19: old formatting in styled paragraphs uses the style's size and font
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 19: RTF import keeps main's heading and code normalisation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gap 19: file-format-parity status line keeps main's history
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gap 19: a paragraph that was a list item gets its old list back on Reject
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gap 19: a numbered item made bulleted keeps its numbered list for Reject
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* gap 19: format matrix names the tracked section mark
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* rtf test: Writer has the section fields main added; rustfmt
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1765: WIP
* #1765: ASK and SET fields show nothing
Like Word, ASK and SET only assign text to a bookmark: they draw no
result on the page or in a PDF. The stored result is kept and saved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* file-format-parity: note ASK/SET on the existing Fields row instead of a third one
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1741: WIP
* #1741: list items no longer get the sentence-capital grammar squiggle
The English "Capitalize the first word of a sentence" rule skips the first
word of a list paragraph (own or style numbering); later sentences are still
checked. check_text_with and paragraph_issues take a list_item flag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1741: review fixes
Thread the capital-first flag into the Polish, Croatian, Italian, Turkish and
Portuguese grammar rules; test the drawn squiggles through layout() for own,
style and num 0 numbering; tidy the proof test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1741: main's Vietnamese proofing test passes the new list-item argument
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* #1741: the third call in main's Vietnamese proofing test
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* rtf-sect-export: WIP
* Gap 19: RTF export writes sections
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Gap 19: RTF export writes sections — review fixes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* odt-sect-export: WIP
* Gap 19: ODT export writes sections
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Gap 19: ODT export writes sections — review fixes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* gaps log: RTF and ODT section export both done
* Gap 19: ODT continued lists share the earlier list's style; one RTF and ODT row in the parity table
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* WIP for #1609
* Equations: a script after _ or ^ is the whole run of letters and digits (#1609)
Word for Mac 16.113.4: V_dd and V_(dd) build up the same (dd is all
subscript), likewise x^ab, and Linear format shows V_dd bare.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Equations: bare scripts end at a space, digits continue a script run, upright function names (#1609)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Equations: a bare script also ends before a following period (#1609 review)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* ROADMAP: drop three progress rows main already has
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* odt-sect-export: WIP
* Gap 19: ODT export writes sections
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Gap 19: ODT export writes sections — review fixes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ODT export: a list cut by a section continues with text:continue-list; drop duplicate parity rows
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Field results (STYLEREF, REF, PAGE text, note marks) shown as one atomic
cluster now place their inner clusters in UAX #9 visual order, in the
direction of the text around the field, so "פרק א" in a header no longer
draws reversed. Smart quotes already matched Word's logical-order result
in Hebrew (” in acronyms, not gershayim); pinned with a typing test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1670: fix round 1: field results shaped per bidi run, so brackets mirror correctly
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* WIP for #1543
* DOCX: split mixed-direction runs and mark right-to-left pieces w:rtl so Word orders them as WordCraft does (#1543)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* DOCX: right-to-left pieces of split runs say their language (w:lang w:bidi) (#1543)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* DOCX: no phantom tracked formatting on split runs; typed text doesn't inherit run direction (#1543)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Engine: text typed or inserted anywhere takes its direction from its own letters, not the caret's run (#1543)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* WIP for #1480
* Web: an input method's DeleteSurrounding erases around the caret, so non-Latin typing no longer repeats (#1480)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Web: input-method rewrites keep formatting and the typing undo group; AutoCorrect resets the web text field (#1480)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1706: WIP
* #1706: Update Fields refreshes fields in headers, footers and text boxes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts:
# ROADMAP.md
# Conflicts:
# ROADMAP.md
* #1706: review fixes
Revision-history row, update_fields doc comment, test covers body field and locked header field.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1706: update the fields of the part being edited, as in Word
Word check: F9 with the caret in the body leaves header fields alone; with the caret in a header it updates that header. SEQ, citations and TOC run only from the body.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1706: printing updates every field in the document
references.updateFields takes {"all"?: bool}: the body (with SEQ, citations, TOC) plus every part story, wherever the caret is. Printing passes it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1706: ROADMAP status line after rebase
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1706: tests build the field form value added on main
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1706: the test's fields take main's new dirty flag
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* track-move-options: WIP
* track-move-options: Moves options in Track Changes Options and w:doNotTrackMoves
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* track-move-options: Moved from Hidden leaves the layout; per-revision hiding
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* track-move-options: Word's mark lists, (none) moves are plain, no borders on collapsed paragraphs
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* track-move-options: hr and sv translations for Moved from:/Moved to:
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* ink-arrows-2: WIP
* ink-arrows-2: Ink to Shape makes two-stroke arrows and closed-triangle heads
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ink-arrows-2: review fixes — recognise each stroke once, drawing-order pairing, arrow rect
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
part that inherits its lines sends it, and the picker only shows No Border checked for it.
- CellProps::valign is Option<VAlign>: a cell's own Top (Align Top, w:vAlign="top") beats a
table style part's vertical alignment, and round-trips through .docx.
- tableStyle edit rejects Part fields at the top level without "part".
- "font": null or "" makes a part's font inherited; clearing the dialog's font box sends it.
- Document ui.dialog's optional "part" in docs/control-protocol.md.
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* #714: table style editor formats every table style part
Modify/New Table Style: "Apply formatting to" any of the 13 ECMA-376
§17.7.6 parts (whole table, header/total row, first/last column,
odd/even row and column bands, four corner cells), each with font,
size, bold, italic, underline, colour, fill, borders (line style,
width, colour; all/none/outside/inside/each edge) and the 9-way cell
alignment, over a live preview.
- doc: TablePart, PartFormat, PartSet; TableStyleParts::part/set_part
(new parts and per-part jc/vAlign in `regions`)
- layout: generic part resolution incl. band2, corner cells, alignment
- docx: every tblStylePr type read/written with pPr jc and tcPr vAlign
- engine: table.newStyle/modifyStyle take ECMA part names, `part`,
`parts`, per-edge `borders`, `underline`, `align`/`vAlign`/`cellAlign`
- ui: dialog moved to dialogs_table_style.rs; ui.dialog takes `part`
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* i18n: Hungarian and French strings for this change
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Review fixes for #887: Bulgarian strings for the table style parts
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #714: Vietnamese strings for the table style parts (main's new vi catalog)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* hr: match the catalog's word for banded
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* Crop handles: Picture Format › Crop crop mode on the canvas, picture.crop takes the new size
ui.crop toggles crop mode for the selected (unturned) picture: black crop
handles trim a side or two, keeping the scale and the visible part in place;
the cropped-away part shows dimmed; Esc, Enter, a click outside or Crop again
keep the crop. A drop is one picture.crop with width/height, one undo step;
a floating picture moves by what a left/top crop trims.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Crop handles: flipped pictures trim the side under the handle, stale drags drop unapplied
Review round 1: the crop maths, the dimmed preview and the floating
position shift map the on-screen side to the source side (flip H swaps
left/right, flip V top/bottom). A drag remembers its picture and is
dropped unapplied if that picture is no longer the one in crop mode.
Sizes stay within 1-4000 pt at the same scale. Pointer-path tests drive
a real handle drag and a click outside. The dim is darker, and the
canvas keeps following a crop drag's pointer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Docs after rebasing on main
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Crop handles: ui-parity row merged with main; #1242's Cell Size note moved to the Tables row
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #778: .xls and legacy-encoding recipient lists; filter and sort recipients
- Recipient lists: legacy Excel 97-2003 .xls (BIFF8 reader on the cfb crate already in the
tree); Excel 5.0/95 and password-protected .xls refused with a clear message; a CSV named
.xls reads as text, an HTML one gets an error. .xls added to the picker filters (desktop,
web, built-in browser) and drop handling.
- Text lists (and plain-text import) detect legacy encodings when not UTF-8/UTF-16: GBK/GB18030,
Big5, Shift_JIS, EUC-KR, Windows code pages (encoding_rs + chardetng, MIT/Apache); an
`encoding` param overrides.
- mailings.filterRecipients / mailings.sortRecipients: field, comparison (equal, notEqual,
less, greater, lessOrEqual, greaterOrEqual, blank, notBlank, contains, notContains), value,
And/Or joins; sort keys. Preview, Finish & Merge and labels use only the matching records
in sort order. Edit Recipient List edits every record and keeps the filter.
- Recipient List dialog: Filter and Sort section and a merge-order column; catalog rows;
strings in every catalog; docs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* i18n: Hungarian and French strings for this change
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Review fixes for #885: total order for recipient sort, Bulgarian strings
- compare_cells now ranks numbers (compared numerically) before text (compared
case-insensitively), so it is a total order; a column mixing 9, 10 and 1a
could make slice::sort_by panic. Regression test sorts mixed columns.
- Bulgarian catalog: the 24 Filter and Sort strings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* vi: mail merge Filter and Sort strings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #775: STYLEREF fields in headers and footers show each page's result
Running headers/footers with STYLEREF (e.g. the current chapter title) are
evaluated per page at layout time (ECMA-376 §17.16.5.59): the page's first
paragraph of the style (\l: last), else the nearest before, else after.
Style names/ids, heading levels (STYLEREF 1), character styles, and the
\n \r \w \s \t \p switches. Body STYLEREF fields update with the other
fields. STYLEREF added to Insert › Quick Parts › Field with its options.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #775: STYLEREF error text in our own words
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Review fixes for #882: translate the STYLEREF Field dialog strings
Adds the style picker label, the six STYLEREF switch labels and the
STYLEREF description to all 18 interface catalogs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* STYLEREF: reuse the style index while the body and styles are unchanged
Headers with STYLEREF rebuilt and hashed the body's style index on every
layout pass (echelon's follow-up note on #882). The layout cache now keeps
the index with the body blocks it came from (shared, so an edited block is
a different pointer) and the styles/numbering hash, and rebuilds it only
when either changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* vi: STYLEREF field strings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Without a creation date in the document, each PDF is stamped with the
current time, so the expected PDF and the submitted one differed whenever a
clock second ticked over between them (seen on the macOS runner). The test
document now has a fixed creation date, and the test checks that both PDFs
carry it.
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* ODT: read and write tracked changes (gap 19)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts:
# ROADMAP.md
# crates/engine/src/tests.rs
# crates/formats/src/model.rs
# crates/formats/src/odt.rs
# docs/file-format-parity.md
# docs/gaps.md
* ODT tracked changes: deleted paragraph marks don't take the body's insertion; one region per deletion
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat-ink-to-shape-arrows: WIP
* Draw: Ink to Shape recognises arrows (gap 12)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Ink to Shape arrows: hand-drawn shafts, more tests, docs
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Ink to Shape arrows: the tip is the first near-farthest point
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Ink to Shape arrows: step to the real tip on dense strokes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1445: Save in the close prompt that can't write the file says so instead of looking like Cancel
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1445: a failed save from the close prompt brings the prompt back with the reason, Save As included
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1315: web Save before New/Open waits for the save picker; cancel or failure keeps the document
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1315: overlapping saves hold the replacement; cancel and waiting messages
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1252: dim highlights on a dark page so the text on them reads
On a dark page (View > Switch Modes) highlight and character-shading fills
were lightness-inverted like every other colour, which leaves saturated
hues such as yellow bright under white text. They are now marked as text
backgrounds (Draw::Fill text_bg) and dimmed toward black keeping their hue
(RenderOptions::ink_bg; yellow -> ~#4a4a10), and text drawn on them
(Draw::Glyphs on_text_bg) takes the lighter of its colour and its inverted
colour (RenderOptions::ink_text), so black and Automatic text draw white
with WCAG contrast >= 4.5 on all 16 highlight colours. Light page, print
and PDF are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1252: text on a dimmed highlight always reaches 4.5:1; lines too
Glyphs and lines now carry the text background they sit on
(Draw::Glyphs/Draw::Line text_bg: Option<Rgb>) instead of a bool. On a
dark page RenderOptions::ink_text takes the lighter of the colour and its
inversion, and falls back to white when that is under 4.5:1 against the
dimmed background (pure blue on a dim olive was 1.34:1). Underlines and
strikethroughs on a highlight use the same rule. The dim constants are
crate-private and documented as assuming the default dark paper grey.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1252: docs: the 4.5:1 rule for text and lines on highlights
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1381: WIP
* #1381: HTML import: bold <th>, cell text-align, region paper for HTML/MD/TXT
Header cells are bold unless their own CSS says otherwise. text-align on a
td/th, or inherited from its tr/row group/table, aligns the cell's
paragraphs; a paragraph's own alignment wins, and a table's align attribute
(which places the table) no longer counts. Files that give no page size
(HTML, Markdown, plain text) open on the region's paper, as a new blank
document does: file.open uses the session's region, wordcraft-cli reads the
system region the way the app does (Region::from_locale_vars, shared with
ui-egui). Tables size to that page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1381: the CLI uses the system region everywhere; help mentions WORDCRAFT_REGION
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #980: full screen on F11 and View › Window › Full Screen
view.fullScreen toggles OS-level full screen (ViewportCommand::Fullscreen),
on F11 and ⌃⌘F (macOS); Escape leaves it when nothing else takes Escape.
The window's own full screen changes (WM, macOS button) keep the flag in
step. Disabled on the web (the browser's own F11). Next Field moves from
F11 to Word's other keys, Alt+F1 / Alt+Shift+F1 (Shift+F11 kept).
Ribbon button with a drawn icon, keytip, translations in all catalogs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #980: Escape collapses a selection before leaving full screen; F11 only off macOS
In full screen, Escape left it even when it had a selection to collapse
or a drag to cancel; it now leaves only when nothing else takes Escape.
The shortcut read Ctrl+Ctrl+F on Windows and Linux: macOS gets ⌃⌘F and
F11, others F11. Docs: Alt+F1 may be taken by GNOME/KDE; keyboard
counts re-measured from the registry (152 commands, 172 combinations).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #860: Language menu opens Set Proofing Language… and Language Preferences…
Review › Language (and the status bar's language menu) offered only four
languages since #346 replaced the button that opened the Language dialog,
so French and the other 25 languages, and Set As Default, were out of
reach. The menu now ends with Set Proofing Language… (the Language dialog)
and Language Preferences… (Options › Language); a language outside the
short list shows by name and checked, and the status bar names it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #860: other regions of a language show by name, and no language shows twice
A tag outside the Language dialog's list (fr-CA, en-AU, de-AT) shows as the
language and region (French (Canada)) instead of the raw tag; pt-AO is
Portuguese (Angola), not Brazil. A current language named like a short-list
entry checks that entry rather than showing again above the list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #961: Alt+numpad decimal character codes (ANSI, OEM 437/850, Unicode)
Hold Alt, type a decimal code, release Alt: the character is typed at the
caret through the new text.typeCode command. A leading 0 means
Windows-1252, no leading 0 the OEM code page (437, or 850 for Western
European locales), above 255 the Unicode character. Not on macOS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #961: Alt codes follow the system code pages; ignore auto-repeat, drop on blur
text.typeCode takes optional ansi (874, 1250-1258) and oem (437, 737, 850,
852, 857, 866) code pages; OEM 852/866/737/857 tables added from the public
mapping files. On Windows the shell passes the system locale's pages and, for
codes up to 255, lets the character Windows composes replace ours (above 255
ours stays and Windows' byte-reduced text isn't typed). Auto-repeat of a held
digit adds nothing, and losing focus drops a half-typed code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #960: double-click the margin to create and edit a header or footer
Double-clicking the top or bottom margin in Print Layout now edits the
header/footer that page shows, creating it (first page, even page or
default slot) when the page has none. insert.editHeader/editFooter take
{"page"}; insert.closeHeader takes away a created one left empty.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #960: making a header by double-click is an undoable, protected edit
insert.editHeader/editFooter stay pure and hand creation to the new
mutating insert.createHeader/createFooter; closeHeader removes empty new
ones through insert.removeEmptyHeaders. An empty new header is never
saved, one an undo brings back goes on the next close, and a new header
goes in the first section (linked to later ones, as in Word).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
({name} {height} × {width} in, {kind}, {columns} × {rows}, …) and use the
region's decimal separator; the fixed-format paper rows dead since #838 are
removed from six catalogs.
- 20 strings added to all 18 catalogs: status-bar messages (table split and
merge, ink replay, citations, SmartArt, Researcher, Design defaults), the
Reading Mode toolbar, Go To, Search's Suggested, envelope paper names.
- Audit: citation style names stay exempt as proper names; `bad parameters:`
errors (JSON parameter names for scripts and MCP) stay English like the
other engine errors; placeholder-only patterns need no entry.
- Flakiness: the Read Aloud player drew the speech worker's error straight
from shared state, so with no TTS engine an error landing between poll and
draw was shown without being known to the app (the rare failure under
load); it now draws the error poll saw. The audit holds Read Aloud (no
speech thread, no sound) and gathers process-wide names (fonts, custom
dictionary) every frame, since tests running alongside change them.
#[ignore] removed.
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Engine: the Word 2003 format check reads through io, so commands still never touch files themselves
is_word_2003_file (#1081) opened the file with std::fs, which the file-access guard test
(commands_do_not_touch_the_file_system_themselves) forbids outside io.rs; main failed it.
A new io::read_file_head reads the first bytes inside the read root.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* UI: a chrome click counts the page as focused at once, so the next keystroke isn't dropped; the ribbon-focus test passes again
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* #1122: Read Aloud starts PowerShell without a console window
On Windows the speech program is PowerShell, a console program: each sentence it spoke flashed a console window over the document. It now starts with CREATE_NO_WINDOW.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1122: the console-window test checks the flags Read Aloud passes
windows_speech builds the PowerShell program, arguments and creation flags
that speak() turns into its Command; std can't read creation flags back from
a Command, so the test checks that value (CREATE_NO_WINDOW) and the arguments.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* #1002: equation pictures share one texture, keeping theme colours on Windows
The Equation tab's gallery tiles, structure buttons and symbols were a
texture each: hundreds of small textures, created as galleries opened and
all freed at once when the preview cache filled. On Windows (DirectX 12)
tiles then showed other textures' memory (inverted pictures, red and teal
fills, damaged interface letters). They are now packed into one atlas
texture written in place, the way egui keeps its glyphs; it starts over
when full (at most once a frame).
Tests: every equation picture composited in both themes is only the
theme's greys; all pictures share one texture, none freed while browsing,
none overlapping; the atlas packs rows and starts over when full.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1002: the theme test looks for paper anywhere, not in the corner (Windows fonts reach it)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1002: equation atlas uses up to four pages and never wipes a page drawn from this frame
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #816: copied equations reach other programs as MathML
A copy or cut whose selection holds an equation now also puts HTML on the
system clipboard, with each equation as Presentation MathML (wrapped in
<semantics> with the linear format as an application/x-unicodemath
annotation), so Word, LibreOffice, Google Docs and browsers paste a
formatted equation instead of `y=2x_s`.
- formats: new mathml module, a writer from the equation tree (runs,
fractions, scripts and pre-scripts, radicals, n-ary operators, delimiters,
functions, limits, accents, bars, border boxes, group characters, equation
arrays, matrices, phantoms) and a bounded reader (our annotation, else the
presentation elements, else a TeX annotation). HTML export writes
equations as MathML; HTML import (open and paste) reads <math> back.
- engine: edit.copy/edit.cut (and column copy) return `html` and keep
Session::clipboard_html when the fragment holds an equation.
- ui-egui: Services::set_clipboard_html; copy sites put HTML with the text
through it, falling back to egui's text copy.
- wordcraft: arboard set().html() with the text alternative; on Wayland
without data-control the text-only path is kept.
OMML on the clipboard (Word's "Office Open XML") needs custom clipboard
formats arboard can't set; left as a follow-up.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #816: honest clipboard docs; MathML reader fixes (token cap, function names, column vectors)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #822: a chosen interface size is absolute; Auto keeps the display scale
On a display the system reports at 200 % (a bare window manager on X11,
where winit guesses the scale from the monitor's DPI), "100%" drew at
200 %. As in PhotoCraft and PdfCraft (pdfcraft#1005), a chosen size now
divides the display scale back out, so 100% is one screen pixel per
point. The new default, Auto, keeps the display scale and its menu entry
shows the size it draws at. Sizes run 75-300 %; ui.json moves to
uiScale and migrates the old interfaceSize (100 -> Auto).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #822: an old interface size becomes the size it drew at; a valid uiScale wins
A pre-#822 interfaceSize was on top of the display scale, so it is kept
until the first frame knows that scale and becomes old x native
(125% on a 2x display stays at 250%). Note that on the web a chosen
size cancels browser zoom.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #822: rustfmt
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1116: keep a paragraph's space after clear of the footnote separator
On a page with footnotes (already there or brought by the line), a
paragraph's last line only fits if its space after fits above the notes
area too; otherwise it goes to the next page with its note (and, with
widow control, one more line). Contextual spacing and automatic spacing
between list items drop the requirement; pages without notes are
unchanged (space after may still run past the bottom margin).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1116: space after vs footnote separator uses the spacing code's tests, only on pages with notes
Contextual spacing drops a paragraph's space after only when that paragraph
asks for it, and the next paragraph counts as a list item only when it gets
a label (Numbering::shows_label), as in the spacing between paragraphs.
The kept space after is worked out only for a last line on a page with notes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #884: a dragged shape anchors in the column it lands in, so that column's text wraps around it
arrange.bounds (the canvas drag) re-anchored a moved object to the paragraph
under its top edge but ignored x: on a multi-column page it took the last
paragraph starting above that y in any column, usually one in the last column.
Layout places a float when it lays out its anchor, so text in an earlier column
(already laid out) ran through a shape dropped there. anchor_paragraph now picks
the paragraph in the column under the object's centre (the ink placement uses
the first stroke point).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #884: a dropped object finds its column from the section's column geometry
Columns came from the distinct left edges of the page's text, so a
paragraph shifted by mirrored indents on an even page made a column of its
own and the drop anchored to the wrong paragraph. The columns now come from
the section's column boxes on the page. Notes in the layout parity doc that
lines a paragraph continues into the next column don't wrap yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
egui drops the page's keyboard focus on any click elsewhere. Command
buttons handed it back (#686), but gallery tiles, tab names, empty ribbon
space, View check boxes and the status bar's items did not, so the caret
vanished and typing went nowhere. After a click on background chrome that
leaves nothing focused (no text field, dialog, popup, Backstage or comment
balloon), the canvas takes focus back, as in Word. Tabs, style tiles and
status-bar items now report their name and state to screen readers.
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #299: caret contrasts with the paper, page colour, shading or highlight under it
The caret was black (white only in Switch Modes' dark page), so it vanished
on a dark page colour, dark shading or a dark highlight. It now takes black
or white by WCAG contrast with the background at the caret
(wordcraft_render::background_at), cached per layout/view/position.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #299: shapes colour the caret's background only inside their outline; look up only when drawn
background_at hit-tests a filled shape's real outline (shape_path), so an ellipse's corner
shows what lies beneath. The caret's colour is worked out only when the caret (or IME text)
is drawn, and the unused Tokens::caret is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #299: rustfmt
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1129: no document behind the Start screen; Back shows an empty window
Launched with nothing to open, the Start screen no longer has a blank
document behind it. Esc or Back shows an empty window (no page, ribbon
greyed out but for Help, Info/Save/Save As/Print/Export off in File,
title "WordCraft") until Blank document, a template or a file is
opened; closing asks nothing. Commands that need a document say so.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1129: explicit no-document allow-list; control inspect/render need a document; fonts can be added
works_without_document lists the ui.* commands that make sense with no document instead of
letting every ui.* command through; font.add/list/remove work so a font file dropped on the
empty window is added. The control channel's document.inspect and ui.render answer that no
document is open instead of reading the hidden placeholder.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
A press on a selected balloon's Delete, Reply or Resolve button counted
as a click on the page and closed the balloon before the button saw its
click. Presses inside a balloon no longer leave it.
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* #1062: honour Remove personal information / Remove date and time on save
w:removePersonalInformation and w:removeDateAndTime (ECMA-376 §17.15.1.69-70)
are read into Settings, written back in CT_Settings order, and honoured by the
DOCX writer: comment and revision authors saved as "Author" (initials "A"), no
dc:creator / cp:lastModifiedBy, no w:date on comments and tracked changes. The
open document keeps its real values. New file.privacyOptions command sets both.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #1062: reading privacy options has no side effects; File › Options › Save check boxes
file.privacy reads the settings (a pure command: no undo step, no unsaved changes);
file.privacyOptions only changes them and refuses an empty call. File › Options › Save gets
a "Privacy for this document" section with the two check boxes, translated in every catalog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Reads rectangles, ellipses, triangles, arrows, stars, a connector with an
arrowhead and a text box, saves and reads back: kind, size, fill, outline
and width, position, wrapping, arrowhead and text-box text all match, and
the saved XML holds a wps:wsp per shape with its preset. The data loss in
#886 was fixed on the reading side by #671; this guards it.
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Word's symbol fonts are proprietary and never bundled, so text set in them
showed the substitute's letters. New wordcraft_doc::symbol_fonts maps every
code (stored as U+F020-U+F0FF, e.g. w:sym, or as a plain 8-bit code) to its
Unicode equivalent: Symbol from Unicode's Adobe symbol.txt, the Wingdings
and Webdings sets from Unicode L2/12-368 (WG2 N4384), checked against UCD.
Layout shapes the mapped characters (fallback faces draw them); PDF text,
copy as text and TXT export read as the symbols; the stored text and docx
round trips are unchanged.
Co-authored-by: Dmitrii Khlapov <19991457+dkhlapov@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
