A call whose arguments hold a file or folder key at any depth, such as an
effect's textureImage.path, is refused before the command runs; the walk
keeps its own stack. Each call also runs with automation file access
confined to no roots, so every checked read or write a command makes is
refused, whichever param carried the path.
Create Gradient Mesh, a Mesh tool click and Object > Expand of a gradient
to a mesh gave each border edge one cubic fitted between two mesh points
and picked the corners from the bounding box, so the border cut off
corners and curves: 49 pt off a five-point star, 54 pt off a notch.
- The border follows the outline of the largest subpath by length; border
points sit on it and an edge with no anchor inside is the exact piece
of its segment.
- Where no single cubic follows a run within 0.1 pt (a thousandth of the
size on a small outline), a mesh line goes through an anchor, the
sharpest corner first; at most 256 lines each way. Rectangles and
ellipses keep the rows and columns asked for.
- Smooth runs keep their end tangents; border handles are no longer made
collinear.
- To Center and To Edge highlight placement accounts for the extra lines
(for_path_shaded, also used for gradient fills).
- Non-finite points give no mesh; a degenerate outline keeps the old
bounding-box mesh.
Holes of a compound path are still left out, as before.
Docs: docs/target-app-parity.md.
`Session::history_budget` (default `default_history_budget()`) caps the
memory the undo steps of all open documents keep together. After each
command, tool edit, interaction commit, direct edit, framed script run
and closed undo group, `Session::trim_histories` drops the oldest steps
of any document first, undo steps before redo steps. Each document keeps
its last eight undo steps and next eight redo steps, and a held history
keeps all of its steps. While a script runs or an undo group is open,
no steps are dropped, so a canceled group leaves the other documents'
steps in place. Closing a document frees its share. The steps are not
counted again while neither the budget nor any history changed. Each
document's own `byte_budget` stays as its ceiling.
A compound member copied or cut on its own now keeps the compound's
gradient fitted where it was: an unplaced gradient is pinned to the
compound's bounds, measured once per compound.
Clear that deletes every anchor or segment of every member of a compound
path now removes the compound too, as Cut does, instead of leaving an
empty compound in the layer.
The edit.copy and edit.clear descriptions, docs/mcp.md and the progress
line now say that selecting the compound copies it whole, that isolation
mode takes each member as itself, and how a compound of one and Paste in
Front with the copied member still selected behave.
A run that calls imageTrace.make used to take the trace the app handed in
for the command, and a failed run did not give it back. The trace is now
set aside while the run goes and handed back after it.
A compound-path member selected on its own, whole with Direct Selection
or with Group Selection, is now copied as an ordinary path instead of
promoting the selection to its compound. Cut removes the same objects
Copy takes, so the other members stay a compound path, a compound of
one included. The compound is still taken whole when every member is
selected whole, or when the compound itself is selected.
A copied member or piece takes the compound's paint, opacity, blending
mode, opacity mask, pixel alignment and fill rule.
Tests that pinned the earlier rule from #786 now check the new one.
A command's result describes the document, so a plug-in without doc.read
gets -6 for every call, whether or not the id names a command. A run that
calls commands commits an edit still in progress first and prepares its
input again when that changed the document or the selection.
docs/mcp.md and docs/target-app-parity.md said that a width or height
typed with Measure Type by Glyph Bounds on changes the font size by the
scale. The font size follows the vertical scale only: a width typed
alone, out of proportion, changes the horizontal scale and keeps the
font size, and a height typed alone changes the horizontal scale the
other way. A new test checks both.
A call was refused when any string in its arguments started with plugin., so a filter could not create text such as "plugin.example". Only the values of effect, effects, id (effect.apply's other name for effect), command and commands count now, at any depth.
A script.run that a control request started in the app's frames was
advanced by later frames, which run unconfined, so its vc.run file
commands could read and write outside the caller's automation roots.
The job now keeps the file-access scope of its script.run and runs
each slice in it, as background opening and the folder walker do.
main added text.setPathHandle, which moves a handle of type on a path's path in the document. Commands a plug-in may call are listed one by one, so it goes in the allowed list.
A filter at plug-in API level 2 with the new `commands` permission names
the commands it may run in its manifest's `commandAllowlist` and runs
them with `env.vc_call`, reading each result with `env.vc_call_result`.
Each call runs through Session::execute on the run's document and sees
what earlier calls changed; the calls and the filter's output are one
undo step, and a run that fails, is cancelled or makes a failed call
leaves the documents, their history and the session state the commands
change as they were.
Commands that touch files, the clipboard, preferences, the view,
scripts, actions, plug-ins, open documents or the undo history are never
callable, and every other command must be listed as allowed in
cmd/plugin_call/reviewed.rs, so a new command is refused until placed.
Calls are capped at 1,000 a run, 8 MiB a call and 64 MiB a run, and each
costs instructions from the run's budget. plugin.install refuses a
manifest that lists a refused command and reports unknown ids;
plugin.inspect lists both, and the approval dialog lists the commands.
Refs #2186
Done ran text.spelling.removeWord and text.spelling.addWord one word at a
time, each saving the file, so a save that failed after a delete was saved
left that word deleted even after Cancel. text.spelling.editDictionary
{remove, add} makes every change, saves once and takes all of them back when
the save fails; Done runs it once.
Exports RGB, CMYK and grey JPGs at qualities 100, 80 and 50, at 1x and 2x,
and decodes each one. It also checks that only the CMYK files leave out the
JFIF segment (#3140). Covers #2096 too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Direct Selection showed and dragged the anchors of type on a path's path
(#3980) but not their direction handles: handle_anchors read only a
path's own data, and the canvas draws only a path's handles.
- text.setPathHandle moves a handle of type on a path's path, in
document space, as path.setHandle moves a path's; the brackets keep
their fractions and the text reflows. One undo step.
- Direct Selection draws the handles of selected type on a path and
drags them with it (Alt: one side, Shift: 45 degree steps).
The custom dictionary's words in a list, with an Entry field and Add, Delete
and Change, applied on Done, as the public Check and correct spelling page
describes it. The menu item moves from the Spelling submenu to the Edit menu,
where the page puts it.
Each command a script runs keeps a savepoint of the state it may need
to put back if it fails. The savepoint cloned every open document's
whole undo history, so a script that made N edits did O(N^2) work.
- The savepoint now clones each document's state without its history
and keeps a mark: the newest undo and redo steps and the serials of
the steps under them. Until the command ends, the history trims no
step, and a new step sets the redo steps aside instead of dropping
them. A failed command truncates both stacks back to the mark.
- file.close, file.closeAll, document.close and file.revert still keep
a whole copy, since they remove the history or the document.
- When a failed command removed or changed a step under the newest
one, the history cannot be put back exactly, and the run stops with
an error; its rollback restores the documents as they were before
the run.
- run_guarded no longer copies the histories during a script's run,
and a committed run moves the histories from before it back instead
of copying them.
- Symbol editing mode shares its saved redo steps between copies of a
document's state.
- A script cannot run edit.clearHistory. A run keeps each document's
undo steps from before it, so the command reported a clear that the
commit then undid.
BFlat