A filter at plug-in API level 2 with the new `commands` permission names
the commands it may run in its manifest's `commandAllowlist` and runs
them with `env.vc_call`, reading each result with `env.vc_call_result`.
Each call runs through Session::execute on the run's document and sees
what earlier calls changed; the calls and the filter's output are one
undo step, and a run that fails, is cancelled or makes a failed call
leaves the documents, their history and the session state the commands
change as they were.
Commands that touch files, the clipboard, preferences, the view,
scripts, actions, plug-ins, open documents or the undo history are never
callable, and every other command must be listed as allowed in
cmd/plugin_call/reviewed.rs, so a new command is refused until placed.
Calls are capped at 1,000 a run, 8 MiB a call and 64 MiB a run, and each
costs instructions from the run's budget. plugin.install refuses a
manifest that lists a refused command and reports unknown ids;
plugin.inspect lists both, and the approval dialog lists the commands.
Refs #2186
The put-back after a failed page check replaces each live envelope with
its drawn art in one go, which fails as a whole when one envelope lies in
another's art: only the outermost are put back now. A live envelope of
type removes its hidden type only once it has found the drawn art it
replaces. The file format docs lose a revision row left twice by a rebase.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The file-format revision row for #3179 says that the page check weighs
a live envelope of type as the art it draws, that layers used though
they don't draw as the page leave envelopes of type their drawn art,
and that a slot bound to a visibility variable keeps it too, and lists
the new tests. The parity assessment's evidence says the same, and
the change gets its row and status entry there.
Part of #3179.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An envelope whose contents hold type kept its drawn art, with the type
hidden, because the type is laid out from the text document only after
the layers are read. It now waits for that, as warped type does: once
its text slots hold their type, the envelope is made of that type and
drawn by VectorCraft's own rule, and where it draws as the drawn art the
file saves (the same check and budget as other envelopes) it takes the
drawn art's place, with the type visible and editable in Edit Contents.
The hidden copy of the type goes.
As other live envelopes are, it is held to the page: when the layers
with it don't draw as the page, its drawn art and hidden type are put
back. A .ai whose layers would open alone, without its PDF part, now
waits on the PDF part when an envelope of type is in them; where none
opens live, the layers open alone as before. Layers built without a page
leave envelopes of type their drawn art.
Elsewhere it keeps its drawn art and hidden type, with the note: type in
a font that isn't available, a slot without made type (threaded, bound
to a text variable, a wrap object, type a look draws), an envelope that
doesn't read, no check left, or one that draws differently. Envelopes in
a symbol's or a pattern's art keep their drawn art.
Part of #3179.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move a stray table row and the PR #3273/#3272 revision notes into
Feature revisions, keep one "Feature evidence last updated" line, drop the
duplicate Flyout update status line and fold eight reconciliation rows
into one per date. No score or estimate changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Direct Selection showed and dragged the anchors of type on a path's path
(#3980) but not their direction handles: handle_anchors read only a
path's own data, and the canvas draws only a path's handles.
- text.setPathHandle moves a handle of type on a path's path, in
document space, as path.setHandle moves a path's; the brackets keep
their fractions and the text reflows. One undo step.
- Direct Selection draws the handles of selected type on a path and
drags them with it (Alt: one side, Shift: 45 degree steps).
The check that keeps a live envelope or warped type only where it draws
as the art saved with it renders each on its own, over nothing, and
compared the pixels as seen on white. White art over nothing looks like
nothing on white, so white contents that drew somewhere else passed and
opened live in the wrong place.
Pixels now also differ when they look different seen on black, so such
art keeps its saved art, as colored art does. Opaque colored art is
compared as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With the Linear mode, two problems kept a click on an anchor from
taking it:
- A press on an anchor that moved more than 3 pixels before the release
dragged out the dimension of the segment under the pointer and
committed it almost on top of the art. A press on an anchor now picks
it unless the pointer moves past the anchor's 8-pixel reach; a longer
drag still dimensions the segment.
- A pick linked only an anchor of the segment nearest the pointer. An
anchor of another path near that segment, for example one inside a
group lying just inside another object's edge, was taken at most as a
Smart Guides point with no link, so the dimension did not follow it
when the art changed. A pick now links the nearest anchor of any
visible, unlocked path within reach, in groups and compound paths too.
In Outline the canvas kept the Preview pasteboard color and filled each
artboard with white paper. Paths and type draw as black hairlines, so
art on the pasteboard was close to invisible in the dark interface
brightnesses.
In Outline the whole canvas is now white in every interface brightness
and Canvas Color, pasteboard included. The artboards draw no paper and
show as their edges, so Simulate Colored Paper, an artboard's background
color and the paper of View > Hide Artboards no longer show in Outline.
The artboard names and the ruler origin's crosshair draw in dark gray
there. In split views and floating windows the artboard names follow
that window's own Outline setting, as the canvas already did.
Each command a script runs keeps a savepoint of the state it may need
to put back if it fails. The savepoint cloned every open document's
whole undo history, so a script that made N edits did O(N^2) work.
- The savepoint now clones each document's state without its history
and keeps a mark: the newest undo and redo steps and the serials of
the steps under them. Until the command ends, the history trims no
step, and a new step sets the redo steps aside instead of dropping
them. A failed command truncates both stacks back to the mark.
- file.close, file.closeAll, document.close and file.revert still keep
a whole copy, since they remove the history or the document.
- When a failed command removed or changed a step under the newest
one, the history cannot be put back exactly, and the run stops with
an error; its rollback restores the documents as they were before
the run.
- run_guarded no longer copies the histories during a script's run,
and a committed run moves the histories from before it back instead
of copying them.
- Symbol editing mode shares its saved redo steps between copies of a
document's state.
- A script cannot run edit.clearHistory. A run keeps each document's
undo steps from before it, so the command reported a clear that the
commit then undid.
A right-click on type has a Spelling submenu with Auto Spell Check, as the
public Check and correct spelling page describes. A submenu that holds only
toggles shows their check marks, even in the context menu.
Escape reset a rotated view only as the second of two presses less than
a second apart, and a click or another key between them started the
count again. With the Rotate View tool one press reset it.
Now an Escape that has nothing else to end resets the rotation. An
Escape that ends something else (isolation mode, a path being drawn, a
full screen mode, a dialog and the others listed in
docs/target-app-parity.md) ends only that, and the next Escape resets
the view, however long after it comes. Tools report a path or pick that
Escape ends with `Tool::ends_on_escape`.
The rotate view tests that needed two presses now check one press, and
the screen mode test that named the old pair is renamed.
Docs: docs/target-app-parity.md.
A mask, inverted mask or knockout group over type now keeps the region
that covers any artwork. Type is measured by its layout or, on a path,
by the path, and a reader that sets live type in its own font can draw
it wider, so a region sized from that box could cut glyphs off.
A live object (blend, envelope, repeat, mesh, placed document,
intertwine) under a mask is measured as the art the writer writes for
it, expanded on its own with the same limits.
The writer keeps its symbol boxes and symbols' art reach in plain
fields instead of cells.
Opacity masks, inverted and unclipped masks, and knockout groups were
written with mask and filter regions of 200,000 x 200,000 units around
the origin. CairoSVG draws each mask into an image of its region's size
and stops with "out of memory", so a file with any of them did not
open; Firefox drew inverted masks wrong and WebKit drew knockout groups
and inverted masks wrong.
Each region now covers what the masked or knocked-out art paints: its
visual box grown by its raster effects, brush art and members' reach,
the mask art's box, and in a scaled symbol instance its strokes and
effects at their own size. A mask whose art reaches past its object
still comes back whole on import.
dotCooCoo