Add tests that an action step running plugin.install with grant is
refused, that ui.key, ui.click and ui.pointer sent through the control
path at the open approval dialog approve nothing, with OK focused too,
that MCP answer_dialog reports the app's refusal, that ui.installPlugin
given grant or allowHeavy approves nothing, and that a module recorded
in grants.json installs from a session with that store and no flag
while other bytes under its id are refused.
The batch assertion now checks the refusal's message. The docs and
comments state that Enter confirms the dialog only when OK has the
keyboard focus.
Found while testing crates/mcp/src/resources.rs:191 (read_object)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The Export for Screens dialog and the Asset Export panel open
remembered settings and presets without the row and settings keys the
export no longer reads, and without settings for a format it doesn't
write, so their export and Save Preset are not refused.
A format row and a format's settings take `params`, an exporter
plug-in's own, and `security.passwordRequired`, which remembered
settings hold where PDF passwords were left out, and `settings` takes an
exporter plug-in's format, as before the key check. assets.export and assets.settings.set check the
rows and settings they are given as document.exportForScreens does.
An unknown top-level key of document.exportForScreens gets the
command's usual "the command takes" error.
The MCP save and Export for Screens calls no longer check the params
themselves: Session::execute checks them before anything runs.
document.save, file.saveAs, file.saveCopy and file.saveAsTemplate wrote
the file when given a key that no save format reads, beside the path or
in options, or an unknown key inside a PDF option object such as
marks.useDocumentBleed. document.exportForScreens did the same for an
unknown top-level key, a key in a format row and a key in the settings
of a format.
These commands now refuse such a key and name its path
(options.noSuchOption, formats[1].marks.useDocumentBleed). The svg
object is checked in every save, export and format row, also when the
file written is not SVG. A save still leaves out a key that only another
save format reads, and warns as before. A format row and a format's
settings still take includeArtboardFill and richBlack, which the
encoders read. document.exportPresets.save checks its settings, with the
rows and settings in it, the same way.
In the app, file.save and file.exportForScreens sent as commands are
checked as document.save and document.exportForScreens, and app.save is
checked before anything is written; MCP's app.save, file.save and
file.exportForScreens are checked the same way. The SVG Options dialog
no longer passes its internal fields on to the save.
File › Open With asks for the parameters of an importer that declares
any, at their defaults, once the file is picked (dialog `pluginImport`),
and opens the file with the values set. `file.openWith`, `app.open` and
MCP's `open_file` take `params` and pass them to the importer;
`app.open` without them runs the importer on their defaults, with no
dialog. A file opened with Open With is added to Open Recent, as File ›
Open adds the files it opens.
open_file passes `importer` (an importer plug-in's format id,
plugin.<id>) on to app.open. Headless, it becomes document.open's
`importer`; in the app, app.open with `importer` runs file.openWith, so
the file opens with that importer as File > Open With does, also when a
built-in format reads its extension.
document.export, document.exportSelection, document.serialize, app.export
and file.export took {noSuchOption: true} and wrote the file with no
warning. They now refuse a key that no format lists in document.formats,
and name the nearest key when one is close. document.exportPdf,
document.pdfSettings and pdf.preset.save refuse a key PDF doesn't take,
document.exportEps one EPS doesn't take and document.exportDxf one DXF
doesn't take. Each refuses an unknown key inside an option object it takes,
such as marks.useDocumentBleed, and names its path.
A key that only another format reads, such as {format: pdf, quality: 80},
is still ignored: docs/mcp.md says one object can carry several formats'
options. The check runs for callers (the control channel, MCP, the CLI).
A journal or a recorded action isn't checked, and a saved PDF preset with
a key that is no longer read still loads.
document.formats now also lists PDF's thumbnails, fastWebView and
viewAfterSaving.
save_file's note for a key in `options` that the written format doesn't
read named every .ai file a PDF-compatible .ai, also when the save wrote
a version 7 file (`aiVersion: "7"`) or one without PDF content
(`pdfCompatible: false`).
The save itself now writes that note, beside its note on a top-level
`compress`, `version`, `preview` or `precision`, and names the file it
writes, including when it reuses the options the document was last saved
with. save_file returns the save's reply unchanged, and
`run_command document.save` and the other save commands give the same
notes.
A `backquote` given as a string or a number, on the request or on an
event, was read as absent, so `"true"` moved the object's geometry
instead of its pattern. `pointer_gesture` and `ui.pointer`, headless
and desktop, now answer with an error before any event runs.
File > Open and File > Place read BMP files named .dib or .rle (run-length
encoded bitmaps included), Photoshop files named .pdd and PNG files named
.pns, in any letter case. The Open and Place dialogs list them in "All
readable files", "All placeable files" and their format's own filter, and
Glass's Load Texture lists them too. Linked files with these names update
and relink, the Links panel shows their format, and Edit Original opens
them.
The extensions are read-only: exports still write .bmp, .psd and .png, and
an export to a path with one of the new extensions is refused as before.
The desktop packaging does not associate them with the app.
Holding backquote while dragging with the Selection tool (move, bounding-box
scale or rotate) or the Rotate, Reflect, Scale or Shear tool applies the drag
to the selected objects' pattern fills and strokes and leaves their geometry
in place. The key state at release decides the result: the key may be pressed
after the mouse button goes down, and releasing it before the button comes up
commits an ordinary transform. Objects without pattern paint do not move.
PointerEvent gains a `backquote` flag (false when absent). The desktop canvas
reads it from the held key on every pointer event, and `ui.pointer` and the
`pointer_gesture` tool accept it per event or as a default for the gesture.
remote_call_reports_nothing_sent_when_reconnect_is_refused set up the
closed connection once, so only its first run went through the
stale-connection probe. Each run now sets up its own closed connection
before the timed call.
The vectorcraft-mcp tests of the remote backend in tests.rs gave a fake
app 2 or 5 s to accept a connection or to read a request, and waited
2 s for a connection to end or a line to arrive. When a busy machine
held the client's thread for longer, the fake app gave up and the test
failed. These waits now use WAIT (20 s).
remote_connect_fails_fast asserted that a refused connect returned
within 5 s, and remote_call_reports_nothing_sent_when_reconnect_is_refused
asserted that the call returned within 2 s. On Windows a refused local connect
ends at the backend's own 800 ms connect timeout. A connect without
that timeout takes about 2 s. The 5 s bound did not tell the two apart,
and the 2 s bound left 1.2 s for any pause of the thread. Both tests
now bound the connect by FAILED_CONNECT (1.5 s) and run it up to five
times, until one run is under the bound. The second test checks the
error of every run.
The reference app switches an arc between open and closed with C,
flips it with F and changes its angle with Up/Down while it is dragged
out. VectorCraft's Arc tool ignored these keys during a drag.
While an arc is dragged out, C now switches it between an open and a
closed path, F switches its base between the X and Y axes in the same
box, and Up/Down raise and lower its slope by 10 within -100 to 100.
Each press switches once. The arc drawn on release uses the new values,
and they stay as the Arc tool's options. With nothing dragged, C and F
are shortcuts as before.
Docs: docs/mcp.md, docs/target-app-parity.md.
Found while testing crates/mcp/src/server.rs:180-205 (read_line_capped)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A Shape Builder click or drag over a selection of more than 128
segments merged on the UI thread, so the app stopped drawing and
answering until the merge was done. The tool now computes such a
merge on another thread from the map it built for the hover.
Meanwhile the canvas keeps drawing, the touched regions stay
highlighted and the pointer is the busy pointer. When the merge is
done, the tool runs shapeBuilder.merge with the gesture's params as
one undo step, and the command takes the computed shapes when it
would compute the same ones. The web build merges in the command, as
before.
A press while the map is still being built no longer waits for it on
the UI thread: the tool records the gesture and makes it once the map
is there.
Clicks, drags and the Shape Builder's arrow keys made during the
merge, and commands, menu items, the app's own dialogs, saves and tool
or document switches, run after it on the merged art; engine queries
that only read run at once. A change to the selected paths made
outside a command drops the merge. The headless host and ui.pointer
reply once the merge is applied.
The Shape Builder and the Live Paint Bucket keep their map of the
selection over a new revision of the document when the selected paths
and their outlines are unchanged, instead of building it again.
Found while testing crates/mcp/src/resources.rs:169 (decode)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
dotCooCoo