The profiles Edit > Assign Profile gives a document stayed the active
color settings after another document came to the front, so a new,
opened or switched-to document drew and converted its colors through the
previous document's profile, and closing the last document left it in
use.
The session now puts the front document's profiles in use (the working
spaces where it has none, or no document is open) after a new or opened
document, a tab switch, a close, File > Revert, every command including
each batch step and Undo or Redo of Assign Profile, a failed batch or
plug-in call, a script's rollback and slice boundaries, a canceled
preview, undo group or undo scope, and for each document Export All Open
and the update of placed documents work in. The active settings are
rebuilt, and the documents redrawn, only when they change.
The sweeps in command_sweep.rs kept their own list of file and folder
keys (path, diffPath, folder, destinationFolder) in testkit's
safe_value and again in the temp-folder test, so a command whose file
key was not on the list was sent raw junk strings, and a key written as
`{path | name ...}` (document.open) was never swept.
- The engine exports the plug-in call rules' file keys as
`cmd::key_location`, `cmd::location_in` and `cmd::location_keys`,
which read every key a params description names, the keys of the
commands its `...` entries name, and the schema. `diffPath` is a file
key, so a plug-in call that carries it is refused; Slice Options'
`url` and Export for Screens' `folders` name part of the document, so
a call to object.slice.options with a top-level `url` is accepted.
- testkit's `param_keys` reads the keys the engine reads, and
`junk_params_for_command` and `safe_value_for_command` send every
string under a file or folder key, in arrays and in objects inside
them, as a location in the sweep's temp folder. Each such key also
gets a list of paths and a list of `{ids, path}` objects.
- Every catalog sweep, the serializability sweep included, uses them,
and the temp-folder test checks every key the catalog names, at any
depth.
- A custom arrowhead path allows at most 4,096 subpaths; stroke.set
refuses a longer one and reading drops it.
- A symbol whose shapes cannot be united or clipped is listed in
skipped instead of becoming a head that misses part of its art.
- The arrowheads file is refused when its document unpacks to more
than 64 MB.
- Edit Arrowheads creates the starter file only when none exists and
otherwise opens the file unchanged.
- After a save to the arrowheads file, the heads are read back from
the written file.
- The plug-in argument check accepts path under startArrow.Custom and
endArrow.Custom in stroke.set.
- A custom head's menu preview is scaled to fit its box, and rows
outside the visible part of the menu do not render previews.
A call whose arguments hold a file or folder key at any depth, such as an
effect's textureImage.path, is refused before the command runs; the walk
keeps its own stack. Each call also runs with automation file access
confined to no roots, so every checked read or write a command makes is
refused, whichever param carried the path.
A run that calls imageTrace.make used to take the trace the app handed in
for the command, and a failed run did not give it back. The trace is now
set aside while the run goes and handed back after it.
A command's result describes the document, so a plug-in without doc.read
gets -6 for every call, whether or not the id names a command. A run that
calls commands commits an edit still in progress first and prepares its
input again when that changed the document or the selection.
A call was refused when any string in its arguments started with plugin., so a filter could not create text such as "plugin.example". Only the values of effect, effects, id (effect.apply's other name for effect), command and commands count now, at any depth.
A filter at plug-in API level 2 with the new `commands` permission names
the commands it may run in its manifest's `commandAllowlist` and runs
them with `env.vc_call`, reading each result with `env.vc_call_result`.
Each call runs through Session::execute on the run's document and sees
what earlier calls changed; the calls and the filter's output are one
undo step, and a run that fails, is cancelled or makes a failed call
leaves the documents, their history and the session state the commands
change as they were.
Commands that touch files, the clipboard, preferences, the view,
scripts, actions, plug-ins, open documents or the undo history are never
callable, and every other command must be listed as allowed in
cmd/plugin_call/reviewed.rs, so a new command is refused until placed.
Calls are capped at 1,000 a run, 8 MiB a call and 64 MiB a run, and each
costs instructions from the run's budget. plugin.install refuses a
manifest that lists a refused command and reports unknown ids;
plugin.inspect lists both, and the approval dialog lists the commands.
Refs #2186
dotCooCoo