- `ui.render` and `ui.screenshot` without a `path` return the PNG as base64 `png` in the
reply instead of writing a fixed name into the shared temporary folder, where another
user could have planted a link to one of this user's files; the MCP bridge's
`render_page` and `screenshot` use that and no longer round-trip through
`temp_dir()/wordcraft-mcp-*.png`. A given `path` still works as before (#678).
- One allow-list, `wordcraft_doc::link`: `is_web_or_mail_link` for Ctrl/⌘-click and
`is_safe_href` (web, mail, `#bookmark`, relative path; schemes read the way browsers
do, so `java\nscript:` is a script) for the HTML and Markdown exporters and the HTML
importer. Scripts and other schemes export as plain text (#679).
- Tests: the allow-list, exporters with hostile links, the MCP bridge against a fake app
(no `path` ever asked for), the control channel's in-reply PNGs.
Co-authored-by: petycomppety <30414255+petycomppety@users.noreply.github.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* Content controls: keep, show and edit w:sdt (#381)
Content controls are now part of the model instead of being unwrapped on open:
ControlStart/ControlEnd markers around their content (inline or around whole
paragraphs), with table, row and cell wraps for controls around tables,
repeating-section rows and cells. All sdtPr properties round-trip (title, tag,
id, lock, placeholder, temporary, rich/plain text, w14 check box, combo box,
drop-down list, date, picture, building block gallery, w15 repeating
sections); unknown children are kept verbatim. The writer plans per block list
which controls are written inline and which around blocks so the XML always
nests, and drops markers that lost their partner.
Editing: deletions keep a marker whose partner is outside the range, typing
replaces a shown placeholder, emptying a control brings it back, sdtLocked and
contentLocked refuse with a status message. Developer tab with insert
commands, Design Mode, Properties dialog; frames and title tabs on the page,
check boxes toggle on click, list and calendar pickers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* #381: refresh catalog count and parity checklist after rebase
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Select Recipients › Use an Existing List… now reads .xlsx, .xlsm and .ods
workbooks besides CSV. A new read-only SpreadsheetML / ODF spreadsheet
reader in wordcraft-formats lists the sheets and turns one sheet into rows
of display strings: shared, inline and rich strings, numbers, booleans,
cached formula results, dates and times as ISO 8601 from the cell's number
format, sparse cells, ODS value types, repeated rows/columns and covered
cells. Zip entries, rows, columns, cells, string lengths and repeat counts
are capped, and nothing recurses.
mailings.recipients takes "data" (base64) and "sheet" and "headers"; a
workbook with several sheets and no sheet answers with the sheet names, and
the app shows a Select Table dialog with "First row of data contains column
headers". The desktop picker, dropped files and the web inbox route
spreadsheets to the recipient list.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
- TXT: the engine opens and saves .txt through wordcraft-formats (BOM/unmarked
UTF-16 sniffing, Windows-1252 fallback; list labels and a tab on export)
instead of its own narrower decoder and body plain text.
- RTF: \uN and \ucN are handled in document info, bookmark names and field
instructions, not only in body text.
- ODT: common paragraph styles (and common parents of automatic styles) give
their text formatting, except the style that sets the paragraph kind;
table-cell-properties fo:background-color becomes cell shading.
- HTML: tables without style or visible borders export without cell borders;
white-space:pre paragraphs keep leading/trailing spaces.
- LaTeX: brace groups restore the paragraph alignment set inside them.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
`crates/docx/src/xml.rs` parses untrusted document XML through
`quick_xml::reader::NsReader`. In 0.38.4 that is RUSTSEC-2026-0195 (CVSS 7.5): the
namespace resolver pushes a binding for every `xmlns` / `xmlns:*` declaration on a
start tag into an unbounded `Vec`, with no limit on the number of declarations.
None of the reader's existing caps bound that path - MAX_PART (256 MiB), MAX_TOTAL
(512 MiB), MAX_ENTRIES, MAX_DEPTH and MAX_ELEMENTS bound part size, entry count,
nesting and element count, not declarations per tag.
Measured before this change, `wordcraft-cli convert` on a crafted .docx whose
`word/document.xml` is one start tag with 21,845,333 `xmlns:a="u"` declarations:
508 KB on disk -> 262 MB decompressed (under MAX_PART) -> 1.19 GB peak RSS,
exit 0: the document opened and converted without any warning.
At the MAX_PART/MAX_TOTAL ceiling that is roughly 2.4 GB of resident memory from
about a megabyte of download, i.e. an OOM kill with unsaved work open. Nothing
panics, so the `Session::run` guard does not catch it.
0.41.0 caps namespace declarations per start tag at 256
(`DEFAULT_MAX_DECLARATIONS_PER_ELEMENT`, raisable through
`NamespaceResolver::set_max_declarations_per_element`) and returns
`NamespaceError::TooManyDeclarations` beyond it. The same fixture now fails in
about a second with a clear error and no namespace allocation:
wordcraft-cli: malformed XML: start tag declares more than 256 namespace
bindings; raise the limit with NamespaceResolver::set_max_declarations_per_element
Two API adaptations for 0.41 (0.x bumps are allowed to break):
- `resolve_attribute` moved off `NsReader` on to the resolver:
`r.resolve_attribute(key)` -> `r.resolver_mut().resolve_attribute(key)`.
- `Attribute::unescape_value` is deprecated in favour of `normalized_value`, which
also applies XML attribute-value normalization as the spec requires; attribute
values in a Word part are UTF-8 here (UTF-16 parts are transcoded first).
Regression test: `crates/docx/src/xml.rs::too_many_namespace_declarations_is_error`
asserts a tag with 10,000 declarations is an error. It fails on 0.38.4 and passes
on 0.41.0.
This also clears the second quick-xml advisory, RUSTSEC-2026-0194
(quadratic duplicate-attribute scan). That one was not reachable here - the reader
already passes `with_checks(false)` at xml.rs:257, and a 60,000-attribute tag parses
in the same 65 ms as a 20,000-attribute one - but `cargo audit` is clean afterwards.
Verified: `cargo xtask ci`; `cargo audit` (no vulnerabilities left, the two
unmaintained-crate warnings are `krilla`'s `rustybuzz`/`ttf-parser` and are
unrelated); 32 docx tests plus the malformed-input suite; and 21 crafted hostile
documents through `wordcraft-cli convert` with zero panics before and after.
One residual, unchanged by this commit: the fixture above still costs about 509 MB,
because MAX_PART lets one part decompress to 256 MiB and every part is held in memory
while the package is read. That is the existing, intended bound; what this commit
removes is the namespace allocation on top of it.
* Keep charts, SmartArt and OLE objects when saving DOCX (#319)
Charts and SmartArt diagrams were drawn since #292 but the writer skipped
them, and OLE objects kept only their picture, so opening and saving a
document silently dropped them.
The reader now keeps each object's own markup (the a:graphic of a chart or
diagram, the whole w:object of an OLE object) on the model object, and every
part it reaches through relationships (chart part, embedded workbook, colour
and style parts; diagram data, layout, quick style, colours and drawing; OLE
embedding and picture) as opaque bytes in Document::passthrough, with their
content types and relationships in a manifest, as the VBA project already is.
The writer emits the object with fresh relationship ids pointing at the
re-added parts, keeping each part's own relationship ids and content types.
A chart or diagram gets its frame from the object's current size and
position; an OLE object gets its new size written into its VML shape. A part
whose name the writer uses itself is renamed, and an object pasted more than
once gets its own copies of every part (sharing past a size budget). Part
counts, relationship counts, markup size and copy bytes are all capped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Keep charts, SmartArt and OLE objects when saving DOCX (#319)
Charts and SmartArt diagrams were drawn since #292 but the writer skipped
them, and OLE objects kept only their picture, so opening and saving a
document silently dropped them.
The reader now keeps each object's own markup (the a:graphic of a chart or
diagram, the whole w:object of an OLE object) on the model object, and every
part it reaches through relationships (chart part, embedded workbook, colour
and style parts; diagram data, layout, quick style, colours and drawing; OLE
embedding and picture) as opaque bytes in Document::passthrough, with their
content types and relationships in a manifest, as the VBA project already is.
The writer emits the object with fresh relationship ids pointing at the
re-added parts, keeping each part's own relationship ids and content types.
A chart or diagram gets its frame from the object's current size and
position; an OLE object gets its new size written into its VML shape. A part
whose name the writer uses itself is renamed, and an object pasted more than
once gets its own copies of every part (sharing past a size budget). Part
counts, relationship counts, markup size and copy bytes are all capped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Merge fix: #340's rotation round-trip test builds an Image with #333's ole field
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
A few hundred KB of `*[`, `, `<` (for `>`) and `&` (for `;`). Bracket and destination scans now
share a per-paragraph look-ahead budget, tags are searched within 4 KB and entity names
within 33 bytes.
- HTML `unescape` searched the whole remaining text for `;` after every stray `&`; it now
looks only at the first 33 bytes.
- The Markdown/HTML-to-document step appended every inline through `insert_text`, which
rescans all earlier runs, so a paragraph with thousands of runs took quadratic time on
its own. It now appends runs directly and normalises once.
Ordinary links, images, tags and entities read as before.
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
A chart or SmartArt diagram in a DOCX was dropped on import: it took no
room, so the text after it moved up (five of the six chart documents in
docxide-pdf's fixtures came out a page short), and nothing was drawn.
They are now an InlineObject::Graphic: it takes its room, floats and
wraps like a picture, and draws a list of neutral items (shapes, paths,
one-line texts, pictures) that layout scales to the object's box.
- Charts (read/chart.rs) are drawn from the values the chart part
caches: clustered, stacked and 100% bar and column charts, line, area,
pie, doughnut and scatter charts, with title, legend, gridlines, axis
labels and Excel number and date formats.
- SmartArt (read/diagram.rs) is drawn from the drawing Word stores
beside the diagram: preset shapes, theme colours, text and pictures.
- Theme colour handling is shared (read/drawing_color.rs).
- Each chart or diagram part is read once, only through a relationship
of its type, under a per-file budget of items.
- Tagged PDF tags them as figures with their alternative text, and the
accessibility check reports charts without one.
Not yet: charts and diagrams aren't written back when saving a DOCX
(they weren't before either), so the editor doesn't let you move or
resize them. Radar, stock, 3-D and combination charts draw their first
supported chart type only; SmartArt pictures aren't clipped to their
shape.
docxide-pdf bench (365 documents, vs main + #135): page counts right
320 -> 326 (all five chart documents and one SmartArt document), Jaccard
passes 208 -> 215, SSIM passes 76 -> 79; eight documents better, none
worse.
Co-authored-by: Oliver Zieschang <4963183+naxvog@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* M5.5: Word equations (OMML) import, lay out and save like Word
Equations were flattened to plain text on import. Now OMML is read into a
math tree (fractions, scripts, radicals, n-ary operators, delimiters,
functions, limits, accents, bars, boxes, equation arrays, matrices,
phantoms), laid out with the OpenType MATH table (Cambria Math when
installed, else STIX Two Math and other open math fonts), drawn to screen
and PDF, and written back as the original OMML. Display equations sit on
their own centred line. insert.equation parses the linear format into
structure.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* M5.5: equation editor like Word's — Equation tab, in-place editing, # numbers
Insert › Equation now opens an equation for in-place editing, with the
Equation tab: ready-made equations, Unicode/LaTeX input and conversion
(professional ↔ linear), Normal Text, eight symbol sets, and the eleven
structure galleries (fraction, script, radical, integral, large operator,
bracket, function, accent, limit and log, operator, matrix) with tiles
rendered by the math engine. Typing builds up like Word (a/b, x^2, √, ∑…
then space), Math AutoCorrect turns \alpha, \sqrt… into symbols, Tab moves
between empty slots, arrows/Backspace work through structures, and the
right-click menu has structure commands (fraction type, radical degree,
limit position, matrix rows/columns, remove brackets…). A trailing #(n)
numbers a display equation with the number at the right margin; # alone
numbers it automatically. DOCX output keeps numbers Word-compatible.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* i18n: equation editor strings in Spanish, Brazilian Portuguese and Ukrainian
The catalogs that landed on main after #191 was opened lacked the Equation
tab and equation command labels.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Equations: our own names and order for the built-in equations
Clean room: the ready-made equation list used another product's gallery entry
names and order. Same formulas (and ids), with our own descriptive labels,
grouped by subject (geometry, algebra, calculus, trigonometry, probability).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ROADMAP: equations row matches the landed equation editor
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fmt after merge
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* D0+D1: open Word 97-2003 .doc — container, FIB, piece table text (#28)
New wordcraft-docbin crate (L2) reads the OLE2 container via the cfb
crate (MIT) and parses the FIB and piece table from the [MS-DOC]
specification: text pieces decode as UTF-16LE or Windows-1252 (table
moved to wordcraft-doc::encoding), subdocument CP ranges, and Word's
special characters map to the model's (tabs, breaks, hyphens). .doc/.dot
registered in OPEN_EXTS and the I/O dispatch. Encrypted and Word 6/95
files give clear errors; every length is checked and proptest
truncation/flips never panic.
* D2: .doc formatting — stylesheet, fonts, CHPX/PAPX FKPs, sprms (#28)
Sprm decoder with operand-size rules (incl. sprmTDefTable/sprmPChgTabs
exceptions and the Prm0 isprm table), bin tables + ChpxFkp/PapxFkp page
lookup, STSH styles (StdfBase layout validated against real Word files:
bchUpe == cbStd, sti 0 = Normal) and the SttbfFfn font table in both
extended and self-delimiting flavours. The CP walk now splits runs on
formatting changes and resolves paragraph styles: bold/italic/strike/
underline/caps/hidden, colours (Ico palette + COLORREF), half-point
sizes, super/subscript, fonts, highlights; alignment, indents, spacing,
keep options, outline levels. Unknown sprms are skipped leniently;
an env-gated corpus test opens real files (styles + text asserted).
* D3: .doc structure — sections, headers/footers, tables, lists (#28)
- Sections: PlcfSed/Sepx with 16-bit measurement sprms (sprmSXaPage & co),
explicit sprmSBOrientation with a width/height fallback; even/odd/first
header and footer stories from Plcfhdd become document parts.
- Tables: sprmTDefTable grids (operand length fixed to cb+1 per the spec),
horizontal merges (sprmTMerge), vertical merges (sprmTVertMerge), cell
shading (sprmTSetShd / sprmTDefTableShd80), cell widths, valign, row
height/header/cant-split, and table borders (sprmTTableBorders80 Brc80s).
- Lists: PlfLst (LSTF + appended LVLs) and PlfLfo (LFO + LFOLVL overrides)
resolved into the numbering model; sprmPIlvl/sprmPIlfo mark paragraphs.
- Combined fixture (intro + table + list + 2 sections + header) round-trips
through Document JSON; hostile proptests now mutate the structured fixture.
* D4: .doc notes, fields, bookmarks and inline pictures (#28)
- Footnotes/endnotes: PlcffndRef/PlcfEndRef reference CPs paired with the
PlcffndTxt/PlcfEndTxt story ranges; each story walks into a Footnote or
Endnote part and the 0x02 anchor becomes a NoteRef object.
- Fields: 0x13/0x14/0x15 state machine in the walker — instruction text is
hidden, the cached result kept; HYPERLINK fields keep their result as
linked runs, everything else becomes one Field object.
- Bookmarks: SttbfBkmk names + Plcfbkf/Plcfbkl CPs become BookmarkStart/
BookmarkEnd objects at their anchors.
- Pictures: sprmCPicLocation points into the Data stream; the PICF header
gives the display size (dxaGoal/dyaGoal scaled by mx/my) and the payload
is format-sniffed (PNG/JPEG/GIF/BMP; metafiles are dropped with a warn).
- Hostile proptests now truncate/flip a fixture with all of the above.
* D5: .doc import hardening, caps and roadmap (#28)
- Cap inline pictures at 5 000 per document.
- Engine test: .doc/.dot bytes dispatch through the Word 97-2003 reader
(garbage must error, never panic or open empty).
- ROADMAP: Word 97-2003 import row (60% — text, formatting, styles,
sections, headers/footers, tables, lists, notes, fields, bookmarks,
raster pictures).
Real-corpus validation stays opt-in: WORDCRAFT_DOCBIN_FIXTURES=<dir>
cargo test -p wordcraft-docbin corpus_files_open.
* Corpus fixes: compressed-piece FC space, PAPX query point, none-level labels (#28)
Validated against two real files (kept locally under plan/word/fixtures,
gitignored): a 1 MB Lorem-ipsum sample and a 2003 styles/lists/table
sample.
- FKP bin tables and pages address the WordDocument stream in true byte
offsets; a compressed piece stores its base fc doubled (byte = fc/2),
so fc_of_cp now unwinds the doubling. Before, every PAPX/CHPX lookup in
compressed (cp1252) files landed on the wrong entry — tables collapsed
to one row, lists and heading styles were lost.
- The paragraph-properties query now uses the paragraph mark's own FC
(inside the paragraph) instead of the FC after it, which picked up the
next paragraph's FKP entry.
- Fixture papx entries re-keyed to paragraph-start CPs, the real rgfc
convention.
- Counters::next_label returns nothing for NumFormat::None levels (Word's
numFmt none shows no label; also fixes a latent docx-reader case).
- Symbol/Wingdings bullet chars map to Unicode glyphs (• ▪ ○ ●).
With this, both corpus files render headings, styles, nested and numbered
lists, the tables and the PAGE field correctly; metafile-wrapped images
and OLE objects stay dropped by policy (logged).
* docbin: bound the text walk by real text; dedupe and cap pictures (#28)
Hostile CP numbers no longer drive the work:
- header/footnote/endnote story ranges from the Table stream are clamped to their
subdocument (ccpHdd/ccpFtn/ccpEdn) with checked base additions, and every walk stops at
the last piece's CP; a story spanning [0, 4e9) used to push billions of U+FFFD;
- characters are found by binary search over the pieces (PieceTable::char_at), and an
unreadable stretch (gap, truncated or out-of-stream piece) is skipped in one step rather
than one U+FFFD per CP; the old per-character scan was O(chars x pieces);
- the piece CPs are made non-decreasing at parse, so inverted pieces are empty and binary
search stays sound; surrogate pairs now decode;
- note references are looked up by binary search; the style's CharProps is borrowed, not
cloned, per character;
- pictures are interned by fc_pic (5000 anchors on one picture share one media entry and
one copy) and the bytes copied per document are capped at 256 MB.
Each fix has a crafted-bytes regression test; against the previous code the story,
piece-claim, last-piece and many-pieces tests hang (killed at 60 s) and the shared
picture test copies the picture once per anchor (80 GB).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docbin: checked offset arithmetic in lists, sections and table rows (#28)
- list.rs: PlfLst/PlfLfo/LVL offsets (at + 2 + cLst*28, at + 4 + lfoMac*16, off += len,
...) saturate, which matters on 32-bit targets (wasm32) where fc + n can overflow usize;
the LFO override path no longer indexes abstracts directly.
- sections.rs: the Sepx range (fc_sepx + 2 + cb) is checked; Plcfhdd is read only as far
as the stories a capped section count can use (it used to reserve lcb/4 entries).
- table.rs: sprmTDyaRowHeight = i16::MIN negated in i16 (overflow panic in debug builds);
now -(v as f32).
Regression tests: the row height test failed before (overflow panic with debug assertions, a 0 pt height without); the list test pins the saturating
offsets (it only overflowed on 32-bit targets).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Format the merged OPEN_EXTS list
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* HTML import: pictures referenced by a relative path are embedded (#98)
An img whose src was a path next to the HTML file was dropped, leaving
only its alt text; only data: URIs loaded. The HTML importer now takes
an optional image loader (the formats crate stays free of file access
and wasm-safe), and opening an HTML file from disk loads relative
sources from the file's folder. URLs and absolute paths are not
followed, and files that aren't pictures are ignored.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* HTML import: relative pictures stay in the folder, read only regular files, within a budget (#98)
Review follow-up for #113. Pictures named by a relative path are now
loaded by LocalImages:
- Only regular files are read. The path is checked before opening (a
named pipe would block the open), the opened handle is checked again,
and the read goes through take(limit + 1), so the per-picture limit
holds even for files that report a length of 0, like /dev/zero.
- The path is canonicalized and must stay inside the HTML file's
folder, so `..` and symlinks can't reach other files.
- Each file is read once and shared between references, and every
reference counts against a 1 GB budget for the document, so one large
picture referenced many times can't make the import read or copy
without bound. Bytes read from oversized files count too.
The image loader now returns Arc<Vec<u8>>, and make_img takes either a
Vec or an Arc.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: lloyd <lloyd@stackworx.io>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* LaTeX (.tex) import and export (#7)
Open and save LaTeX source as a document format, next to Markdown and
HTML. Export writes a standalone article (fontenc, ulem, xcolor,
multirow, amsmath, hyperref, loaded only when used): unnumbered sections,
itemize/enumerate, quote, center/flushright, verbatim, tabular with the
document's column widths and merged cells, equations as $..$ / \[..\],
character formatting, colours and links; metadata goes to \hypersetup.
Import reads the everyday subset: preamble \title/\author, sectioning
(\part/\chapter shift levels), paragraphs, lists with labels, quote,
alignment environments, verbatim-like environments, tabular with
\multicolumn/\multirow/\cellcolor and p{} widths, inline and display
math, formatting commands and declarations, colours, links, refs,
citations, footnotes, accents, TeX ligatures and special characters.
Unknown commands keep their arguments' text; layout and definition
commands are dropped with their arguments. Nesting is depth-limited and
input is capped, so hostile files can't overflow the stack.
The flow model gains an Equation inline so equations survive LaTeX round
trips; the other text formats write their linear text as before.
Wired into open/save dispatch, the file dialog filter, Backstage Export,
the web app, CLI/MCP help, docs and the Linux desktop entry.
Fixes#7.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019FczntrDNYd6DupyBdpbL5
* #7: bound LaTeX column specs and equation export (review)
- spec_widths: `*{n}{…}` repeats recurse with a depth argument and stop at
MAX_NEST, so a deeply nested column spec no longer overflows the stack or
exhausts memory. Column counts saturate and widths stop at MAX_COLS.
- Column specs read from the source are capped at MAX_SPEC (4096) chars.
- balanced() looks groups up in a table of closers built in one stack pass,
so linear_to_latex no longer rescans to the end of the string for every
unmatched `(` (quadratic: 50k took seconds). spec_widths uses it too.
- env_name restores the position when `\begin{` / `\end{` has no `}`
within 64 chars, so the `{` is no longer lost.
- Regression tests: the 100k-deep `*{1}{` spec and a 200k-`(` equation in
deep_nesting_is_bounded; unclosed_begin_keeps_its_brace and
spec_widths_repeats_are_bounded.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LyVbT6Vv4BwWZ4hY8973qD
* #7: linear-time labels, brackets and \begin{; no commands from the document in exports
Applies @HaringIbon's review suggestions:
1. Parser::anchor keeps at most MAX_ANCHOR_RUN (64) bookmarks in a row with
no text between them; text() looked back past every one, so a file of
labels imported in quadratic time. Labels separated by text are all kept.
2. linear_to_latex_at checks for the `/` of a fraction before copying the
group out, so deeply nested matched brackets export in linear time.
3. env_name searches only the next 65 bytes for `}`, so a run of unclosed
`\begin{` imports in linear time.
4. An equation's `\name` is written as a command only when it is a known
symbol, function or font/spacing command (MATH_COMMANDS); anything else
becomes `\backslash name`. Two carets are never written side by side in
equations or anchor names, since TeX reads `^^5c` as a backslash. Compiling
an export can no longer `\input` files or `\write18` named by the document.
Regression tests: three cases added to deep_nesting_is_bounded, plus
latex_export_carries_no_commands_from_the_document and
latex_labels_in_a_row_are_read_in_linear_time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LyVbT6Vv4BwWZ4hY8973qD
* Merge follow-ups: FTable.borderless (from #102) in the LaTeX importer; rustfmt
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* Lists: a numbered list after a bulleted list keeps its numbering in ODT, RTF and Markdown (#83)
* Import: a top-level list item of the other kind starts a new list
The writers now split a bulleted list from a following numbered one, but the shared importer merged consecutive list paragraphs back into one list, so ODT and RTF still read the numbered items as bullets.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A w:num can redefine any of its abstract list's levels with a whole
w:lvl inside w:lvlOverride. We kept only the start value from it and
numbered with the abstract list's levels, so documents that rely on it
showed the wrong labels: a construction specification (SpecLink) read
"A. PART 1 GENERAL" and "I. SECTION INCLUDES" where Word shows "PART 1
GENERAL" and "1.01 SECTION INCLUDES". Saving such a document also
dropped the definitions, so Word showed the wrong labels afterwards.
Num::level_overrides keeps them; Numbering::level and the list counters
prefer them over the abstract list's levels; the .docx reader reads them
with the abstract levels' parser and the writer writes them back (one
w:lvlOverride per level with its startOverride and/or lvl).
In docxide-pdf's Word reference corpus 6 of 382 documents carry such
definitions; the specification's SSIM goes 13% -> 41%, the others
restate their abstract lists and are unchanged.
Tests: counters use a list's own levels ("" and "%2.%3" in decimalZero
give "1.01", "1.02", "2.01") and fall back to the abstract list for the
rest; level overrides round-trip through .docx beside start overrides.
Co-authored-by: Oliver Zieschang <4963183+naxvog@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* HTML import: keep body text when </head> is omitted
Close an open head implicitly on body-content start tags, before skipped raw-text handling. Preserve head metadata and title capture while allowing body paragraphs and inline text to import.
Co-Authored-By: Codex <noreply@openai.com>
* RTF import: read pictures inside shppict wrappers
Recognize shppict as a transparent destination so nested pict groups are decoded instead of inheriting Skip. Continue skipping nonshppict legacy duplicates and pictures under other skipped destinations.
Co-Authored-By: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
