Wall-clock bounds of 1-2 s failed on loaded runners. Each bound is now 10 s, at least 10x the
fixed code's time on a loaded machine and well under the old code's on the same input:
- cluster ends: a million marks (was 200,000); 30 ms now. The rescan (the test's brute) took
2.9 s at 50,000 and is quadratic: about 20 minutes at a million.
- clipped-cell lookups: 100,000 cells and lines (was 20,000); 0.25 s now, a pass over the cells
per line would be 10^10 steps.
- metafile text with a huge font: ~20 ms now; with the size check off it ran past 4 minutes.
- hostile dash patterns: milliseconds now; drawn as dashes they ran past 4 minutes.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o
A metafile text run's glyphs larger than 65,536 device pixels (or of no
finite size) were left out silently; the first time any are this run a
warning says how many (once a run: a page is drawn on every repaint). A
picture refused by decode_peak_fits is logged too, once per picture since
the refusal is cached with it. The 12 bytes a pixel charged to 16-bit
images is the decoder's true peak: image's decoder_to_vec allocates
w×h×8 for Rgba16 and into_rgba8 copies to RGBA8 while it is alive.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o
Finding 14: each glyph's text end was found by scanning the following
glyphs for a larger cluster, quadratic in a run of glyphs sharing one
cluster (a letter with many combining marks); cluster_ends does it in one
backward pass. Finding 31: every placed line was drawn with a clone of
every clipped table cell on its page (lines x cells); the page's clipped
cells are now indexed once by story and path and each line takes only its
own cell, the first in page order as layout picks it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Finding 22. A link whose bookmark name differed in case from the bookmark
fell back to scanning the whole bookmark map with eq_ignore_ascii_case, per
link (bookmarks x links), and the HashMap's order made which of several
same-but-for-case bookmarks won arbitrary. The exporter now keeps an exact
and an ASCII-folded index, each filled first-in-document-order.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Finding 33. geom::subpaths reserved pts + counts ops up front, so a
poly-polygon record with a long list of zero counts reserved room for ops
it never emits, and the canvas charged only ops.len() against MAX_BYTES.
subpaths now sizes the vector exactly, and Canvas::push charges what each
item holds (capacity) for paths, bitmaps and text.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Finding 36. kurbo's dash iterator stops advancing when a dash is so small
that subtracting it from the segment length changes nothing (and loops on
negative entries), so a document dash pattern like [1e-30, 1e-30] hung the
renderer. Before calling kurbo, safe_dashes drops a pattern that is
negative, non-finite, zero-length, or would cut the stroke into more than
100 000 pieces for its path's length bound; the stroke is drawn solid.
kurbo is unchanged; normal patterns dash as before.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Finding 27. An EMF/WMF text record's font height is file data; a glyph
billions of device pixels tall reached vello's flattening, which subdivides
its curves for ever. draw_vector_text now skips a glyph whose device bounds
are non-finite, larger than 65536 px a side, or off the raster. Text at
normal sizes draws as before.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Finding 26. Rendered::to_png resized its pixel buffer to width*height*4
when the lengths differed, so a Rendered claiming a huge size (its fields
are public) allocated that much with no budget; to_jpeg asserted inside
the encoder on the same mismatch. Both now encode only pixels that are
exactly width*height RGBA within the raster cap, and return empty (logged)
otherwise.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Finding 37. decode_fits charged every picture 8 bytes a pixel (RGBA8 decode
plus its copy), but a 16-bit or float image decodes to 8-16 bytes a pixel
before conversion, so the real peak was up to 2.5x the budget.
geom::decode_peak_fits takes the decoder's native bytes per pixel; render's
decode_pixmap_within and pdf's load_image_within read it from the decoder
(header only, same limits) before decoding.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Finding 0. decode_png probed the PNG's size with the image crate's default
limits, and the PNG decoder inflates an iCCP profile while reading the
header: a tiny colour-font glyph could carry a few-KB chunk that inflates
to hundreds of MB before the size check. The probe and the decode now share
one reader with the glyph's own size and byte budget; past it the profile
is dropped and the glyph still draws.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Build wordcraft.wxs a second time as a dual-purpose package
(Scope=perUserOrMachine: ALLUSERS=2, MSIINSTALLPERUSER=1), shipped as
wordcraft-<ver>-windows-user-<arch>.msi. Registry keys move from HKLM to
HKMU so the same components land in HKLM per-machine and HKCU per-user.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Picks up the startup prompt without the glyphs a font may lack (storytold/craft-libs#343, #344): the close mark is painted and the version pill is ASCII, so apps that panic on a missing glyph no longer take the prompt down.
Part of tracking issue storytold/craft-libs#319
Picks up the update prompt fix that draws its close mark and version pill
without glyphs a font may lack, so the prompt no longer takes the app down
when a bundled face has no ✕ or →.
Part of tracking issue storytold/craft-libs#319🤖 Generated with Codebuff
Co-authored-by: Codebuff <noreply@codebuff.com>
Wake the UI when a manual check is queued from a menu callback; the update prompt owns the keyboard while it is open (LightCraft); Download opens through the desktop URL hook (FilmCraft); the Help menu dispatches through menus::invoke (FigCraft); print jobs and comment drafts hold an install back (WordCraft); Check for Updates is a registered command (GridCraft); an install holds back while documents are unsaved.
Results are read independent of the prompt, a dropped worker is an error, failures return to the prompt, and no update starts over unsaved work. A manual check during the startup check is honored.
Startup check is opt-in for the desktop app, the Windows update helper is dispatched before argument parsing, and a successful update closes through the app's own close path.
Keeps the worker's failure visible instead of leaving the prompt installing, repaints while a check runs, and no longer calls process::exit past the unsaved-work prompt.
Integrate `craft-update` pinned to storytold/craft-libs fe61243 to check for
updates on startup, display the standard suite update modal with changelog notes,
and support one-click in-app updating and restart.
Ref: storytold/craft-libs#319
* #3680: Read Aloud tidies in one linear pass and cuts space-free sentences
Finding 56. tidy() repeated whole-string replacements until nothing
changed; each pass removed one level of nested empty brackets, so 40,000
pairs took ~50 s in a debug build. It is now one pass that drops a closing
bracket's empty pair as it goes, checked against the old algorithm on
20,000 generated strings. Sentences with no space to split at are cut at
MAX_UTTERANCE (1,200) characters, and each sentence is sliced from a char
vector instead of skipping from the paragraph's start.
Fixes#3680
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* #3692: Paste Special reads only a regular picture file, bounded
Finding 24. A copied path naming a device such as /dev/zero reports a
length of 0, so the size check passed and std::fs::read read forever.
The path and the opened handle must both be regular files, and at most
the picture limit + 1 bytes are read. A named pipe swapped in between the
check and the open can still block the open (no portable non-blocking
open without platform flags); noted in the code.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* #3692: macOS signing import decodes the certificate into a private temp folder
Finding 25. The .p12 bundle was written to a predictable name in the
shared temp folder, where a planted link could redirect it. It now goes
into a mktemp -d folder under the same temp root, removed on exit. The
keychain is unchanged.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* #3666: engine file reads open once and check the handle; a FIFO is refused without blocking
read_file_capped checked the path's metadata and then read the path
again, so a file swapped or grown after the check was read whole;
read_file_head opened the path with no type check, so saving to a FIFO
.xml path (the Word 2003 sniff) blocked until a writer appeared. Both
now go through open_regular_file (path checked before opening, handle
checked after, opened once) and a bounded read; read_regular_file uses
the same pieces. Tests: both helpers refuse a FIFO without blocking
and a folder; read_file_capped refuses content over the cap.
Fixes#3666
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* #3692: Paste Special reads picture files through the engine's bounded read
Ultrareview finding 9: paste_picture kept a third copy of the regular-file
bounded read; it now calls wordcraft_engine::io::read_regular_file (public,
with a wasm stub).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* #3666: open a checked file non-blocking so a swap to a named pipe can't hang
CodeRabbit: a path replaced by a FIFO between the regular-file check and
File::open blocked in open, before the handle check could refuse it. On Unix the
open now uses O_NONBLOCK (no effect on regular files; libc is already in the
lockfile) and the handle check refuses the pipe. The FIFO tests' cleanup writers
open non-blocking too, so a regression fails the test instead of hanging it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* #3666: review — Paste Special refuses a picture file whose handle reports more than the cap before reading it
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o
* #3692: review — macOS signing keychain lives in the private mktemp folder too; removed if the import fails
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o
* #3666: review — libc comes from the workspace dependencies
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o
* #3680: review — Read Aloud logs a warning when its sentence cap leaves text unread
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o
* #3692: review — engine speech timing test gets a margin a busy CI machine can't break
tidy_is_linear_on_nested_brackets: 2 s -> 10 s. The one-pass tidy takes ~13 ms on a loaded
machine; tidy_by_replacing (the old tidy, kept in the tests) took 293 s on the same input.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CX1hMKX28764Lrx5moxs1o
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
# Please enter the commit message for your changes. Lines starting
# with '#' will be kept; you may remove them yourself if you want to.
# An empty message aborts the commit.
#
# interactive rebase in progress; onto d588e0b8
# Last command done (1 command done):
# pick 6a1268ea # #1845: filter-as-you-type command search in Customize Ribbon, QAT and Keyboard pickers
# No commands remaining.
# You are currently rebasing branch 'feat/1845-command-filter' on 'd588e0b8'.
#
# Changes to be committed:
# modified: crates/ui-egui/src/dialogs_keyboard.rs
# modified: crates/ui-egui/src/dialogs_ribbon.rs
# modified: docs/ui-parity.md
#
# Conflicts:
# docs/ui-parity.md
* Bound MCP stdio request and bridge reply line reads
Fixes#3685
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* #3685: an unreadable reply from the app is final, not retried
A reply that is too long (or not UTF-8) means the app already ran the
request; retrying on a new connection could run a state-changing request
twice.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>
Co-authored-by: Brandon Thomas <echelon@gmail.com>
* AutoFormat As You Type: optional period with double-space, off by default (#2848)
* Test the double-space option through the AutoCorrect dialog (#2848)
* File > Options > Proofing: an AutoCorrect Options button opens the dialog (#476)
* #2848: report doubleSpacePeriod in tools.autocorrect's params doc and result
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
