CodeRabbit on #13206: docs/multi-channel-editing.md displays before/after
comparisons, which the rule keeps; it targets screenshots that only show a
PR's change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AGENTS.md rule 6 and docs/images/SOURCES.md now say docs/images holds only
images the README or a doc displays. Removes the nine PR before/after
captures nothing references (gradient-overlay-method, guide-position,
native-pipette-macos, preferences-apply; 1.9 MB) and their ATTRIBUTION.md
rows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolve conflicts by keeping both the Image Processor source parameter
and main's pdfSpotPlates text, and by combining the Last updated
headers in docs/gaps.md and docs/target-app-parity.md.
* Use craft-heif from craft-libs; remove crates/heif
PhotoCraft's HEIF decoder had drifted from LightCraft's by about 700 lines;
both now use craft-heif (storytold/craft-libs#784), built from LightCraft's
copy. HEIC colours now follow the HEVC VUI's range and matrix and libheif's
chroma upsampling. 8-bit files still open as 8-bit documents; a colour
description the VUI specifies now tags the image as an nclx did.
The codecs -> heif standalone exception ends with the local crate, and the
HEIF nextest step drops -p photocraft-heif, which no longer exists.
* Pin craft-heif to the merge of storytold/craft-libs#794
* heif: count the decoder's 16-bit buffer against max_alloc
* heif: match Apple's chroma upsampling; pin craft-heif to storytold/craft-libs#799
* heif: free the decoder's buffer before the HDR conversion and count that conversion's peak
* heif: hold the canvas the decoder really allocates to max_alloc
## Summary
`photocraft-cli mcp --bridge` sent the control token in clear as its first frame, to whatever had accepted the connection: a `[::1]` listener reached through a `localhost` lookup, or any process holding `127.0.0.1:<port>` while the app was not listening. This PR fixes both cases:
- **Literal loopback only.** `BridgeClient` parses its address into a socket address and connects to it. Only `127.0.0.1:<port>` and `[::1]:<port>` are accepted. `localhost:<port>` means `127.0.0.1:<port>` (what the desktop app binds) and is never looked up.
- **Challenge authentication.** The bridge authenticates with `auth.challenge {clientNonce}` → `{serverNonce, serverProof}` → `auth {proof}`. Both proofs are HMAC-SHA256 keyed by the token over both nonces, each under its own label. The client checks the server's proof before it sends its own and never falls back to sending the token. The token never crosses the wire, so a listener that is not the app gets only a random nonce.
- **One shared server implementation.** `security::ServerHandshake` replaces `authentication_reply`, and both the desktop control server and `photocraft-cli serve` use it. The servers still accept the one-frame `auth {token}`, so existing scripts and older clients keep working. A repeat `auth.challenge` after authenticating gets "already authenticated", like a repeat `auth`.
- HMAC comes from RustCrypto's `hmac` 0.12 with `sha2` 0.10 (`sha2` was already in the lockfile). The proofs are compared without an early exit.
- `docs/control-protocol.md` documents the handshake, the exact HMAC message, and the bridge's address rules. The book's protocol summary is updated too.
Compatibility: a new bridge needs an app from the same release. Against an older app it fails with "refused challenge authentication … the control token was not sent". It does not downgrade.
Known limit: the channel is plain TCP with no TLS, so nothing binds the handshake to the connection. A party sitting between a bridge and a real app could relay the handshake without learning the token. On loopback that needs it to hold the port the bridge dials while the app listens on another, which the literal-address rule above narrows. Older clients that still send `auth {token}` keep their old exposure until they upgrade.
Closes#9777
## Tests
New in `crates/automation/tests/it/bridge_token.rs`:
- `localhost_reaches_the_ipv4_app_not_an_ipv6_listener`: a listener on `[::1]:P` gets no connection, and the app on `127.0.0.1:P` does.
- `a_listener_that_is_not_the_app_never_receives_the_token`: on both loopbacks, a listener that stays silent, refuses, or fakes the challenge receives only the challenge frame, never the token. The error says why.
- `the_bridge_authenticates_to_the_headless_server_by_challenge`: end to end against `rpc::serve_tcp`. A wrong token is refused before its proof is sent.
Unit tests: the handshake in both directions, and that wrong, missing or replayed proofs, the token after a challenge, a second challenge and malformed nonces are all refused (`security.rs`). `loopback_socket` address parsing (`bridge.rs`). The desktop server answering a challenge, then dispatching (`control_server.rs`). The existing bridge and MCP fakes now run the real `ServerHandshake`.
Run locally (Windows 11, targeted tests only):
- **Fail before.** I put upstream's `crates/automation/src/bridge.rs` (the old client) back and ran `cargo test -p photocraft-automation --test it bridge_token`: **3 failed**. The `[::1]` listener received `{"method":"auth","params":{"token":"<the token>"}}`, a `127.0.0.1` listener received the raw token, and the headless test got "authentication required" instead of the refusal. The original audit tests (`audit_nv6_bridge_sends_token_to_ipv6_impostor`, `audit_nv6_bridge_sends_token_to_any_ipv4_holder`) fail the same way on upstream/main.
- **Pass after.**
- `cargo test -p photocraft-automation --lib --test it -- bridge security tcp`: 23 + 21 passed. This covers the new tests, the existing bridge, MCP-bridge, security and serve TCP tests, and the legacy-token tests that still pass unchanged.
- `cargo test -p photocraft control_server`: 6 passed, including the new challenge test. The legacy-token tests still pass.
- `cargo clippy -p photocraft-automation --all-targets -- -D warnings`: clean.
- `cargo fmt`: clean.
- `Cargo.lock` adds only `hmac` 0.12.1, plus `subtle` under `digest` (already in the lock). Checked with `cargo metadata --locked`.
Not run here: the full gate (`cargo xtask ...`, the workspace-wide tests, wasm, clippy on the desktop app crate). That is left to CI.
API note: the workspace-internal `security::authentication_reply` is replaced by `ServerHandshake::reply`, which returns an `AuthStep`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **Security**
* Control connections support challenge-response authentication, verifying possession of the configured token without sending it. Token-in-frame authentication remains available for scripts.
* The MCP bridge accepts literal loopback addresses and maps `localhost` directly to IPv4 loopback. It rejects servers that refuse or cannot complete challenge authentication.
* **Bug Fixes**
* Rejected authentication exchanges close the connection; successful authentication allows requests to proceed.
* **Documentation**
* Control protocol and bridge authentication behavior are documented.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Keep all 34 catalog deletions; sync crop options and fill rasterization text via craft-i18n 4a642c06dbcb8172f307f827c1167cd5dd8ac341. Adapt the fill prompt catalog test to embedded catalogs and preserve both parity-document updates.
One conflict, the gaps.md header: main's line (2026-11-08, G9 Column
Size now leads it) with this branch's G10 spot-plate item in front.
Main's changes to control-protocol.md and pdf/text.rs merged cleanly;
the doc.save row keeps `pdfSpotPlates`.
Co-Authored-By: Claude <noreply@anthropic.com>
A guide already on the canvas, moved with the Move tool (or with Ctrl/Cmd and another tool), kept
following the pointer: `handle_move_pointer` (canvas/tool_input.rs) called `GuideDrag::track`,
which never looked at Shift.
- `GuideDrag::follow_pointer`: with Shift the guide goes to the ruler tick nearest the pointer,
with the same `snap_to_tick` as a ruler drag. The tick is taken from the pointer before
View › Snap moved it (`unsnapped(raw)`), as a ruler drag never calls `snap_guide`, and that
move's snap lines are cleared. It goes through `track`, so a guide ⌥ turns (#5034) snaps along
the axis it now runs on.
- The release is judged by the pointer (`GuideDrag::pointer`), not by the tick: let go where it
was pressed, the guide is clicked (selected); let go off the document, it is removed. Off the
document a Shift move doesn't snap, and a tick past the document's edge leaves the guide on it.
- `snap_tick`: in a pixel ruler Shift snaps no closer than a whole pixel (guides out of a ruler,
moved guides, the zero point). Deep in, a pixel ruler labels every 5, 2 or 1 px, so its minor
ticks were 0.5, 0.2 or 0.1 px apart and Shift put guides between pixels.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add path text placement ranges and drag gestures
* Preview path placement and track bounded canvas damage
* Preserve legacy path anchors and show overflow markers
* Match path marker hit targets and directional cursors
* Fix path placement lint failures
* Cover path text body movement and position locks
* Keep open path text movable at range endpoints
* Target the type path after attaching text
* Fix path text range rendering and placement lifecycle
* Map vertical path text and preserve drag branch continuity
* Cover path placement lifecycle and preview damage regressions
* Preserve closest branch projection and fix CI regressions
* Normalize path endpoints and bind gestures to their viewport
* Simplify viewport ownership guards for Clippy
* Document path placement invariants and regression cases
* Fix path placement ownership, validation and geometry caching
* Correct path placement regression fixtures
* Ignore transient path geometry cache in UI state equality
* fix: allow path text flips with stale placement ranges
* fix: retain path text handles after shortening curves
* test: account for layer translation in path placement drags
* fix: mark path text range with x and o markers on the path
The beginning marker is an x and the end a small circle, both on the
path, with a plus in the circle while the range hides glyphs. The
cursor's triangle points right over the beginning, left over the end,
and both ways over the text body, which moves the whole range.
Direct Selection leaves an anchor or handle under a marker to path
editing; Path Selection always takes the marker.
* fix: resolve coincident path text markers by lap or drag direction
The x and o markers coincide on a closed path's full lap and on an
empty or end-clamped open range. A full lap now moves the whole text;
otherwise the first motion picks the beginning (backward) or the end
(forward). Marker fixtures press on the path, where the markers now
sit.
* fix: let either end of a full-lap path text range be dragged
Text attached to a closed path fills one lap, so its x and o markers
coincide and every press moved the whole text, leaving no way to
shorten the range. As the text begins just ahead of that point and
ends just behind it, a press ahead along the path now grabs the
beginning and one behind grabs the end; the point itself still moves
the whole text.
* test: check full-lap marker drags do not flip the text
* fix: read and write the path text range in PSD
Type on a path keeps its range in the Txt2 frame as /2 /6 [start end],
in curve-segment units with -1 for the default. Three reference-editor
files in ag-psd's test set fix the mapping: text-path ends a third into
the first segment and draws only "so" of "some text", and
text-path-26/27 move the start on an open path.
Import reads both ends (and the flipped flag) into the layer's start and
end. Export writes an open path whole with its start and end in the
range, instead of cutting the path at the start, and a closed path's
limited end as a range from its start. Path text in a document that
never came from a PSD now gets a Txt2 block, so its path is saved at
all, and the warning that the end limit is lost is gone.
* fix: let both selection tools grab a path text marker on an anchor
Direct Selection gave an anchor under a marker the click, so an open
path's default markers (on its end anchors) and a closed path's
coincident full-lap markers (on its first anchor) could not be moved
with that tool. In the reference editor either selection tool drags a
marker wherever the pointer shows the text bar with a triangle, so the
marker now wins for both tools.
The Direct Selection tests for reshaping a type path (#9114) drag its
last anchor, where the default end marker sits; they now end the
range short of it. To reshape at an anchor under a marker, drag the
marker off it or select the anchor with a marquee and nudge it.
* fix: keep explicit and empty path text ranges through PSD
An explicit end at the path's end stays explicit, so centered and right type keeps its alignment within the span. A closed range whose ends meet reads as empty, not as a full lap.
* ci: re-run checks after a download outage
* ci: re-run checks after a download outage
* fix: preserve legacy path text anchors through PSD
* ci: re-run checks against current main
---------
Co-authored-by: FredApps <153173854+FredApps@users.noreply.github.com>
* Eraser: add Erase to History (Brush, Pencil and Block modes)
Photoshop's Eraser has an Erase to History option; PhotoCraft had only the History Brush.
With it ticked, the Eraser paints the History panel's source state back instead of
erasing, through paint.historyBrush with eraseToHistory. Pencil and Block modes paint back
through their hard tips. A layer that did not exist in the source state paints that
state's visible image; the History Brush itself still refuses such a layer, as Photoshop's
does.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* Keep tool_event within clippy's complexity limit
* Test Erase to History at every depth and tip
* Update the History Brush params comment for Erase to History
* Erase to History paints a layer made since only from a single-layer state
Compared with Photoshop 27.11.0: on a layer the source state does not hold, Erase to History paints
when that state holds a single layer, Background or not, and gives an error when it holds a second
layer, even an empty one. The composite of a multi-layer state is gone; those states now refuse
the layer with the History Brush's error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Erase to History paints a single source layer's own pixels
Photoshop 27.11.0 paints a layer made since with the source layer's pixels: a 50% opacity layer
gives a solid stroke, where the composite gave a faded one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Erase to History: Pencil mode paints at full flow; test a group-only source state
Pencil mode has no Flow control, so a lower Flow set in Brush mode must not carry over. A source
state holding only a group has no pixels of its own and refuses a layer made since.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Erase to History keeps its options if a tool key is pressed mid-stroke
The stroke read the current tool and brush when it was committed, so pressing a tool's letter
during the drag dropped eraseToHistory and the stroke failed on a layer made since. The options
and the Eraser's tip are now captured at the press.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Erase to History: a single solid shape paints its colour; name the History row
Photoshop 27.11.0 paints a shape layer's solid colour along the whole stroke, past its path, and
calls the stroke History Eraser in the History panel.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Erase to History: a single shape without a solid fill paints white
Observed in Photoshop 27.11.0: a gradient, pattern or no fill paints plain white along the whole stroke, past the path and whatever the outline, in RGB, CMYK, Grayscale and Lab.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Eraser: Alt at the press reverses Erase to History for that stroke
As in Photoshop 27.11.0: with the option off Alt restores, with it on Alt erases. Alt pressed or released during the stroke changes nothing, and the option itself is left as it was.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Erase to History: name the Photoshop version compared
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Erase to History: review fixes for the error and the History Brush tip
A layer without pixels now gets the error that the target did not exist
in that history state, not "no active document". The History Brush keeps
its size, hardness and spacing from the press, as the Eraser does, if a
tool key is pressed mid-stroke.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Brush parity: add the Eraser's Erase to History
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Erase to History: document the functions this change touches
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* History Brush and Erase to History keep their whole brush from the press
Only mode, opacity, flow, size, hardness and spacing were kept from the press; the rest of the brush (tip shape, sampled tip, angle, dynamics, smoothing) came from the session brush at release. A tool key mid-stroke changed that brush, the commit rejected the live preview, and the fallback repainted the whole stroke with the new tool's brush. The stroke's params now carry the press-time brush as "brush" (stored tips as references, as each tool's remembered brush), and paint.historyBrush deep-merges it onto the session brush, so the live preview, the commit, its fallback and a replayed action all paint with it. Tests: a tool switch mid-stroke paints exactly what the same stroke paints without it, for the History Brush and Erase to History in Brush, Pencil and Block mode, across tip shape, sampled tips, dynamics and smoothing; a "brush" param paints as the session brush would; a malformed one is refused.
* History Brush docs: say "outside its shape", not "past its path"
The automation crate flags any command whose params text mentions a path as a possible filesystem path (registry_filesystem_path_params_are_classified); the eraseToHistory description meant a shape's vector outline. Also a test that a state whose one root item is a group of several layers is refused like the one-layer group: a group has no pixels to paint back.
* Test that a Shift-click Erase to History line commits its live pixels unsmoothed
Main's Shift-click fix (#11887) and this branch's press-time History
Brush params meet in finish_stroke_with; check the commit sends
smoothing 0 beside the brush param in all three Eraser modes.
---------
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Conflicts were the two docs headers only: gaps.md and
file-format-parity.md each take main's line (Fujifilm compressed RAF
now leads it) with this branch's PDF spot-plate items in front. Main
did not touch the PDF writer or the save commands since 009b93c5e.
Co-Authored-By: Claude <noreply@anthropic.com>
Main rewrote the PDF writer since e4e2607c8: a page per artboard with
page labels, writer cancellation (`ctl`), an export memory budget, and
PDF import. This branch adds spot plates, an optional page image and an
XMP packet. The merged writer keeps both:
- `print_pdf_pages` numbers its objects dynamically: per page its page,
contents, image and one XObject per plate; then the shared font, ICC
profile, overprint ExtGState and XMP metadata stream, each only when
present, the selection font and last the page-label tree. The XMP
packet is a parameter now, not a page field, since it is the
catalog's.
- `export(doc, spot_plates, ctl)` / `export_with(doc, spot_plates, xmp,
ctl)`. An artboard page carries its own region of every plate
(`plates_of` takes the page rect), so a two-board document separates
into two pages of named plates; a Multichannel artboard document is
pages of plates alone. The export budget counts one byte a pixel per
plate alongside the composite. New test:
artboard_pages_carry_their_region_of_each_plate.
- lib.rs passes `ctl` through; the PDF arm keeps the XmpEmbed gate.
- file_cmds.rs: main's `maximizeCompatibility` and this branch's
`pdfSpotPlates` both listed in the four spec strings and the import.
- docs: gaps.md and file-format-parity.md headers take main's line with
this branch's items in front; the PDF parity row keeps main's new
read column and notes and this branch's plate notes, plus that an
artboard page carries its region of each plate; control-protocol.md's
doc.save row lists both new params.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
* perf: add P85, the app frame after Paste Into on 24 MP (#9329)
Track-only row in the redraw area group: Paste Into a 5 % selection (untimed),
then time the next kittest frame. Guards: the command moves revision by >= 2 and
the frame records a refresh. Prints refresh px.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: P85 re-creates the selection before each Paste Into (#9329)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: a command's redraw area spans all its revisions; count whole redraws of small edits (#9329)
Session::dispatch is the one place damage spans revisions: a command that moved
the revision more than once reports step_damage of the document before and after
it, measured from DocState::damage_from. Deletes note_insert (Paste Into), Stroke
Path's hand-made union and the failed compound's None. Debug and test builds
count a whole-document redraw of an edit under 25 % in Session::whole_redraws.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: the canvas redraws the damage since the revision it showed (#9329)
damage_since, the navigator and the histograms accept any cached revision within
DocState::damage_from..revision, not only the one before. The Move tool's
Auto-Select clause becomes the generic rule: no pixels changed since the cache.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: P85 shows the selection for a frame before Paste Into (#9329)
Without that frame the canvas last showed the revision before select.rect,
two commands back, so it redrew everything whatever Paste Into reported.
The app always draws frames between a selection and the next command.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: a newly added pattern no layer refers to changes no pixels (#9329)
Pattern Stamp copies its pattern into the document on first use, which made
a multi-subpath Stroke Path report the whole canvas. Appended patterns are
now pixel-equal unless a layer reference could resolve to one. The small-edit
sweep also covers layer.translate and layer.showOnly.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: renumber the Paste Into frame row P85 -> P89 (#9329)
Main uses P83-P86 for #10259's open benchmarks. Regenerate docs/scorecard.md.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* style: rustfmt viewport_pages damage lookup
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Canvas: bound the pattern-reference walk; P89 undoes each paste
- `any_layer` stops at the same depth as the file's other layer walks,
treating a deeper tree as referring to the pattern.
- The Paste Into frame row undoes each paste, untimed, and checks the
layer stack is restored, so every sample pastes onto the same document.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Canvas: a same-named pattern a reference still resolves past is bounded
- `patterns_pixels_equal` compares where each reference resolves before
and after the append, since `pattern::find` tries ids before names.
- P89 also undoes its selection each sample and checks the history
length is restored; the timed frame is unchanged.
- Main's new `damage_since` callers take the `(damage_from, last_damage)` pair.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
Keeps the TSV deletions; pins craft-i18n 87f45ab (storytold/craft-i18n#216
head, now also carrying #11193's Move Toolbar rows) until #216 merges.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Add a toolbar side toggle and dock-edge resizing
- Let the toolbox sit on the canvas' left or right, persisted in the panel
state and switchable from the toolbar header and preferences.
- In the compact arrangement, stack dock, rail and toolbox on the dock's
physical edge so the toolbox cannot cover the rail.
- Make the dock panel's inner edge the single resize handle: it drives the
panel width and the dock total (split size and column widths) in the same
frame, so the rail and dock content stay bound with no reserved room and
no second handle. The docking layout's own column-edge handle is covered;
the bar is the theme separator at rest and the accent on hover/drag.
- Persist the layout, keep the split size in sync, handle RTL, and test the
toolbar side state.
* Toolbar side: dock-edge only with a lone canvas; test every theme
- Use the between-dock-and-canvas layout only when nothing is docked beside the canvas: that view drops the canvas from craft-ui's split, so with a panel there the standard layout keeps it visible and dockable.
- Add canvas_alone_layout/canvas_alone and a unit test for a lone canvas versus a split canvas side.
- Add a kittest that toggles the toolbar Left/Right across every ThemeKind::ALL entry, asserting the panel lands on the requested physical side.
- No dependency changes: Cargo.toml and Cargo.lock are identical to main, so the repository's exact pins are untouched.
* Toolbar side: keep the canvas a drop target during dock drags
While a panel is being dragged, draw the standard layout even with the toolbar at the dock edge. It keeps the canvas in craft-ui's split, so a panel can still be dropped beside it; after the drop the canvas is no longer alone and the standard layout stays. The between-dock-and-canvas layout resumes for a lone canvas once the drag ends.
* Toolbar side: stable drag layout, unwind-safe dock flag, clippy
- Restore the dock-only thread-local through a drop guard, so an unwinding show does not leave a later standard layout canvas-less.
- Do not switch the dock layout mid-drag: craft-ui records its areas on the press, and changing the shape cancels the drag. The layout stays stable; a panel beside the canvas still selects the standard layout before the drag begins.
- Fix the CI clippy errors: explicit auto-deref in end_dock_node/resize_end_dock and field reassignment in the toolbar_side test.
* Toolbar side: anchor the Edit Toolbar flyout; borrow the canvas layout
- more_slot_flyout takes the resolved ToolbarSide instead of the text direction, so a right-hand toolbar in LTR (and a left-hand toolbar in RTL) anchors the flyout away from the canvas like the tool flyouts.
- canvas_alone borrows the saved layout and treats the native-dock legacy layout as canvas-only, avoiding a per-frame clone and traversal.
* Toolbar side: only a horizontal canvas split uses the dock-edge layout
A saved workspace can put the canvas above another panel in a vertical root split; canvas_alone_layout now requires SplitAxis::Horizontal so that shape keeps the standard layout. The guard test covers the vertical case.
* Toolbar side: document the functions this PR adds
Covers ToolbarSide::resolve/other, canvas_alone_layout, the DockOnlyGuard drop, and the two new tests. Docstring coverage of the PR's own additions is now complete; no behaviour change.
* docs: refresh the scorecard after merging main
The merge left docs/scorecard.md stale against the combined settings table; regenerated with cargo xtask scorecard, which is what the gate's scorecard step checks.
* Toolbar side: honor the workspace lock, empty docks and the end-dock shape
- The dock-edge resize handle is inert while the workspace is locked (hover sense, no highlight) and set_end_dock_total refuses to write then; the drag test covers a locked workspace.
- An empty dock takes only the rail's width instead of a clamped blank column; dock_is_empty reports it and a test empties the dock.
- canvas_alone_layout now requires the second child to be the Dock itself, and end_dock_node/resize_end_dock follow horizontal splits only, so a layout the handle cannot resize keeps the standard layout instead of snapping back.
- Tests: DockOnlyGuard restores the flag on drop and unwinding; the theme test clicks the toolbar's move button instead of setting state; a dock-edge harness drags the edge, checks it persists and that a locked workspace refuses it; axis tests and a two-column ui.set {dockWidth} test.
- The flyout indicator follows the resolved toolbar side, the rail keeps its chrome fill and 4/8 inset with the separator inside it, ATTRIBUTION counts the new icon (116), and docs/control-protocol.md describes dockWidth as the whole end dock.
* Toolbar side: floating windows on empty docks, iconic widths, dockWidth columns
- An empty dock still runs the docking pass on the full remaining area, so Studio's floating Properties window keeps rendering with or without the rail; the dock column itself takes no width. A Studio regression builds an empty dock with a floating Properties group and asserts the pass runs and the window is drawn.
- Dock width now uses each column's displayed width (iconic_width while collapsed to icons), and resizing/scaling keeps iconic widths in step. A collapse-to-icons regression checks a 36-point column not reserving 290.
- ui.set {dockWidth} scales every column to the requested total directly instead of resizing only the first column and then finding the sum already equal. The two-column test also covers a target smaller than the other column's expanded width (250 from [300, 180]) and asserts per-column widths.
* Toolbar side: iconic widths, edge release and modal handling, side persistence
- An iconic-only dock keeps its narrow displayed width instead of being raised to the expanded
minimum, and the dock-edge panel records its laid-out width for a geometry regression.
- The release frame applies its final pointer position before dropping the drag, so the dock keeps
the width the user released at.
- The dock-edge handle is inert (and any stored drag is dropped) while a modal dialog is open.
- set_display_width changes iconic_width while iconic and leaves the columns expanded width for
expanding again; the regression resizes an iconic column and checks the restore.
- Clicking the toolbar side persists the panels snapshot immediately through persist_panels, even
when the dock is not drawn, while Remember Workspace Changes is on.
- The locked-drag test compares against the pre-drag width instead of only settled equality.
* Toolbar side: defer persistence while moving, translate the side labels
- persist_panels defers while the dock persistence pass sees a native window move/resize (the
same native_moved signal), so a click during an OS resize cannot save intermediate geometry;
it requests the usual 100 ms repaint and leaves the dock pass to save when the geometry is
stable.
- The toolbar-side tooltip/accessible labels now pass both literals directly to tl!, and all 34
registered catalogs carry translations for Move Toolbar to the Right/Left.
* Toolbar side: keep in-progress dock geometry out of toolbar saves
- native_moved caches its answer for the frame, so the dock pass and persist_panels see the same
movement result even though only the first call observes the change.
- persist_panels defers while a dock-edge drag is stored, a pointer is down or a native window
moved; it stores a pending flag and requests the usual 100 ms repaint.
- persist_pending runs in the frame tick (before preferences save) and retries the deferred save
once geometry is stable, so the toolbar side is not lost even when the dock was not drawn.
- The dock persistence pass also skips while the dock-edge drag start is stored, covering a
synthetic/accessibility click with no pointer button down.
* Toolbar side: keep a same-width dockWidth request a no-op
The dockWidth rewrite scaled and committed the legacy layout even when the requested width
already matched, so a later `ui.set {dockTabs}` took the customized-workspace path and expanded
the Properties group. Restore the early return for an unchanged displayed width and cover it:
setting the current dock width keeps `app.ui.docking` None.
Fixes the `a_new_adjustment_layer_brings_properties_to_the_front` failure on CI.
* Toolbar side: recheck native bounds, expire stale dock-edge drags
- native_moved keeps movement already seen in the frame but compares the bounds again on every
call, so a later dock save is not fooled by the early persist_pending check caching false
before the docking UI updates a floating window.
- dock_panel records the frame it rendered; persist_pending drops a stored dock-edge drag start
once the panel stopped rendering (Shift+Tab hides the dock mid-drag), so deferred saves resume.
- The same-width dockWidth test also selects a tab in a collapsed group and asserts the tab,
the collapsed state and that no workspace was customized.
* Toolbar side: draw the release width, clear drags when the dock empties
- The release frame draws the panel at the final pointer width just stored, instead of the width
read before the drag ended, so the panel and toolbar match the saved dock width.
- The empty-dock path clears a stored dock-edge drag start, so a dock that empties mid-drag cannot
leave deferred saves blocked.
- Tests: nested DockOnlyGuard (flag found set stays set), and a queued `ui.set {dockWidth}`
through the rendered dock pass checking a two-column dock totals 420 points.
* Toolbar side: cancel the dock-edge drag when resizing is unavailable
- A disabled parent UI (screen picking) never delivers drag_stopped, so dock_panel now clears a
stored dock-edge drag whenever resizing is unavailable: locked, modal, empty dock or disabled
UI. The same condition makes the handle hover-only, so it cannot start a new drag while
disabled.
- Regression: start a resize, disable the UI, release, re-enable and move the pointer; the drag
is cleared, the dock does not jump and persistence can resume.
* Toolbar side: bound the dock-edge layout and enforce column minima
- The dock-edge panel leaves the toolbar and the 200-point canvas minimum room, so a narrow
window shrinks the dock instead of the canvas.
- The empty dock runs the docking pass in a child ui that does not consume the parent layout, so
the toolbar and canvas keep their space.
- Column scaling keeps the 220-point panel minimum: minima are allocated first, the rest is shared
proportionally, and requests below the sum of minima stop there.
- The dock metrics (empty, iconic-only, width) come from one layout snapshot per frame.
- Removed dead empty-dock branches, narrowed the content-edge interceptor to one point either
side, corrected the toolbar target comment, used the drag press origin, and documented the
Side::End assumption.
- Tests: narrow-window canvas minimum, empty dock composed with toolbar and canvas, minimum-aware
two-column widths, and the empty compose regression.
* Toolbar side: bound the dock-edge layout, enforce panel minima, match iconic widths
- The dock-edge panel leaves the toolbar and the 200-point canvas minimum room, so a narrow
window shrinks the dock instead of the canvas.
- The empty dock runs the docking pass in a child ui that does not consume the parent layout, so
the toolbar and canvas keep their space.
- Column scaling allocates each column's 220-point panel minimum first and shares the rest
proportionally; requests below the sum of minima stop there.
- Iconic columns use craft-ui's renderer rule: iconic_width.unwrap_or(36).clamp(36, 240), including
the real collapse case that leaves iconic_width unset.
- Dock metrics come from one layout snapshot per frame; dead empty-dock branches are gone; the
content-edge interceptor is one point either side; the toolbar target comment is corrected and
the Side::End assumption documented.
- Tests: narrow-window canvas minimum, empty dock composed with toolbar/canvas, minimum-aware
two-column widths, collapse via Action::SetIconic leaving iconic_width unset, and the 36..240
clamp. The press-origin change was reverted: Sense::drag starts immediately.
* Toolbar side: distribute refused width, draw actual widths, invalidate stale drags
- scale_columns moves the total toward the request in passes, freezing columns that hit a bound
(iconic 36..240, expanded minimum 220), so width refused by the iconic cap reaches columns that
can still grow.
- set_end_dock_total returns the width actually stored; the dock panel uses that width during the
drag, on release and after, instead of forcing the requested or minimum width.
- The custom drag stores docking_generation; a workspace replacement clears the stale gesture
before any width mutation.
- Clamp bounds are normalized against the available maximum (including iconic columns) and
resizing is disabled when the window cannot fit the column minima, so narrow layouts cannot
panic.
- Tests: iconic-cap surplus redistribution, actual-vs-requested panel geometry during and after a
drag, workspace replacement during a drag, and a 300pt window resize without panic.
* Fix dock-edge resize bounds and cancellation
* Preserve explicit dock width across legacy migration
* Document dock code, dedupe widths, harden toolbar_side load
- Add doc comments to the functions and tests this PR touches (Docstring Coverage).
- Share the toolbar width (toolbar_width/toolbar_columns), the rail widths and
CANVAS_MIN_WIDTH instead of repeating the values; no values change.
- Document dockWidth as the requested model width, which a narrow window may draw
narrower in either layout, and test model 520 / drawn <= 364 / canvas >= 200.
- Document that a dockWidth change is shared equally among columns within their
minimums and iconic caps; tie ICONIC_WIDTH/ICONIC_MAX_WIDTH to craft-ui's
DockStyle defaults (36/240) in a test.
- Replace the DOCK_ONLY thread-local and its guard with show_layout(dock_only).
- Move the test-only probe writes behind panel_docking::record, with no-op stubs
outside tests.
- Read an unknown or malformed saved toolbar_side as Start instead of dropping
the whole panel state; ui.set still refuses it.
* Test visible dock chrome in narrow windows; name panel body minimum
- The narrow-window dockWidth test now checks the docking controls craft-ui drew:
hit_rects are full widget rects (before clipping), so the visible part of each,
intersected with the dock, must stay inside the dock and off the canvas and
the toolbox, with at least one control visible.
- Name the 200-point guard for drawing a panel's body PANEL_BODY_MIN_WIDTH,
separate from CANVAS_MIN_WIDTH; no value change.
* test(ui-egui): assert dock controls are clipped at the panel edge
The narrow-window test intersected each hit rect with the dock and then asserted the
intersection lies inside the dock, which always holds. Check each dock control's clipped
interact_rect against the dock instead, and add a squeezed-column test where a control's
full rect runs past the panel edge, so the clip is actually exercised.
* ci: retrigger pull_request workflows after resolving the merge conflict
No changes. GitHub did not queue Actions for 3652ede, the push that
resolved the conflict with main.
* test(ui-egui): assert saves resume after a disabled UI cancels a dock-edge drag
The test's doc says saves must resume once a disabled UI drops the held drag, but nothing
checked it. Assert that the held drag is not saved, that its width is saved as soon as the
drag is cancelled (while the UI is still disabled), and that a width change made after
re-enabling reaches the saved layout too.
* test(ui-egui): cancel a dock-edge drag on a window shrink and check the dockWidth column split
constrained_width_does_not_panic_while_resizing now starts the drag in a wide window and
shrinks the window below the column minima while it is held: the drag must be cancelled and
the dock must stay within the window. Both ui_set_dock_width tests now check how the change is
split between the columns, not only the total.
* test(ui-egui): tighten dock tests per CodeRabbit review 5824274070
- disabling_the_ui_cancels_a_dock_edge_drag: assert the drag is cancelled on the first disabled
frame, before the pointer is released.
- all_iconic_totals_stop_at_both_bounds_without_losing_expanded_widths: check the stored column
widths sum to the expected total after each request.
- explicit_width_request_preserves_queue_and_native_state_until_invalid_workspace_recovery: add
a changed-width (520) case next to the no-op one.
- the_toolbar_side_toggle_works_in_every_interface_theme: with the toolbar on the right, a grouped
tool's flyout opens to the left of its button.
* test(ui-egui): assert stored widths and native rect per CodeRabbit review 5824824938
- constrained_width_does_not_panic_while_resizing: the stored column widths captured before the
window shrinks are unchanged after the cancel and after the release.
- explicit_width_request_preserves_queue_and_native_state_until_invalid_workspace_recovery: the
native state keeps the exact rectangle the test saved until recovery, not just some state.
* Keep the toolbar side when a workspace saved none
A workspace saved before the toolbar could move has no panels.toolbar_side,
so applying it reset a right-hand toolbar to Start. Keep the current side
when the saved value is missing or unreadable; a valid saved side still wins.
* Cover a saved start side and the other panel flags on workspace apply
---------
Co-authored-by: FredApps <FredApps@users.noreply.github.com>
* perf: add P83/P84 redraw-area rows for a masked adjustment toggle and a reorder (#9329)
Track-only rows in the redraw area group that check they hit the path
they claim and print the refreshed pixel count: toggling a Curves masked
to <= 5 % of the canvas with >= 4 layers above it (so the GPU prefix
cache can't cover it), and bring forward / send backward of a <= 2 %
layer past an overlapping neighbour in the many-layer document.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: bound adjustment, reorder and clipping damage through context-aware change_bounds_in (#9329)
An unclipped adjustment reaches only the layers beneath it in its isolation
scope (and, in a 32-bit document, only under its mask; integer documents
round the whole backdrop after each adjustment, #9033). Reorders damage only
the moved layers at both ends; clipping and channel-exclusion toggles on
non-group layers are bounded. ui-egui's move and blend previews use the
context-aware bounds. Every new bound is checked against a full composite.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: keep Move preview on the context-free bound; cover a clip-base group's mode switch (#9329)
change_bounds_in is an in-place bound (the layers beneath an adjustment, or
its clip base, stay put), so the Move drag preview, which translates its
bound, goes back to the context-free change_bounds and its mask no longer
slides over layers with stale pixels. Hiding the last visible unclipped
adjustment in a pass-through group that is a clip base switches the group
between isolated and pass-through rendering, so its reach now joins the
group's bounds, as the clipped branch does. Doc fixes on change_bounds_in,
layer_change_bounds, one_sided_bounds and step_damage.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: reorder damage rejects nested video and grows by enclosing effects (#9329)
A moved group holding a video layer was bounded by the group's extents; the
moved-layer guard now uses the same recursive `contained` check as
`one_sided_bounds`. A moved layer's old and new bounds now grow by the reach of
the enclosing groups' effects, as the paired-layer branch does, so a reorder
that changes a parent group's shape redraws its drop shadow.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Engine: adding or deleting a layer in a group grows by the group's effect reach (#9329)
A layer added to or removed from a group with a drop shadow (or any effect
with reach) changes the group's effect output past the layer's own extent.
The one-sided branch of step_damage added only the layer's bounds, so the
shadow pixels outside them went stale. Grow them by the enclosing groups'
reach, as the reorder and pixel branches already do, sharing one helper.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: bound added, removed and moved layers within the effect reach of the canvas (#9329)
change_bounds_in clips to the canvas, so a layer just off the canvas inside a
group with a drop shadow had an empty bound, and growing it by the group's
reach kept it empty: deleting, adding back or reordering it left the shadow it
cast onto the canvas stale. The one-sided and reorder branches now clip to the
canvas grown by the enclosing groups' reach, then grow and clip to the canvas.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: grow clipping and property changes inside a group by its effect reach (#9329)
A paired layer whose clipping or properties changed was bounded by its own
extents on the canvas, and so were the clipped layers above it; nothing grew
them by the enclosing groups' effects. Unclipping a layer in a group with a
drop shadow, or changing a child's opacity, left the shadow past the layer
stale. Those rectangles now bound within the canvas grown by the reach, then
grow and clip to the canvas, as added, removed and moved layers do.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* perf: renumber this PR's rows P87/P88 after #10259 took P83–P86 (#9329)
The masked adjustment toggle and the bring forward / send backward rows
were P83 and P84; main now uses P83–P86 for the JPEG/PNG open benchmarks.
Regenerate docs/scorecard.md.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* test: drop deselects main's new adjustment layers no longer need (#9329)
Since #8801 a new adjustment layer takes the selection as its mask and
drops it, so Deselect after it has nothing to act on. Two damage tests and
the masked Curves perf row still deselected.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Engine: bound shapeless, off-canvas and frame-relayout group damage
- `composite_bounds` gives the canvas for a shapeless group, and bounds a
group's children within the canvas grown by its effect reach, so a
shadow cast onto the canvas by off-canvas pixels is kept.
- `beneath` includes a pass-through artboard's background.
- `layer_change_bounds` applies the enclosing groups' reach, as
`step_damage` does.
- `step_damage` adds a group's whole extents when a child change moves
its frame under a frame-spanning effect (Gradient Overlay).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
