plugin.install of a module that lists no permissions ignored the result
of removing the id's grant. When grants.json could not be updated, the
formerly approved bytes could still be installed without approval. The
store now gets the old module back, so the grant and the module it
covers stay together. The new module stays when the old one can't be
read back and when grants.json can't be read, since such a file approves
nothing. Deleting the last grant now reports a failure.
plugin.remove had the same fault. It now moves the settings and cache
aside and removes the grant before anything is deleted. When the grant
can't be removed, the folder is moved back, the command returns an
error and the plug-in stays installed.
In Safe Mode and for a disabled stored module, load_stored_plugins does
not read the module, so grants.json keeps the grant for its id. The next
load that reads the module forgets the grant.
- A file read for opening is laid out in the composite fonts registered
then. Opening a document and reverting the front one now measure again
the type set in a font named like a composite font that an open document
defines, the font database holds or the session registered earlier. Type
in other fonts, missing ones included, keeps the bounds it was read with.
- Switching to a document or closing the front one measures again the type
set in a composite font whose definition changed, and any type without
bounds.
- A document reverted while in the back measures its type in composite
fonts when it comes to the front, not in the front document's.
- Text holding an inline graphic whose symbol's type was measured again
takes the graphic's new size.
- A failed or panicked command puts the font database's composite fonts
back with the documents.
- Setting a composite font to the definition an export lends keeps it after
the export ends.
SVG export wrote an SVG filter as a live <filter> when its SVG 1.1 form
was at most 64 KB, without counting the region and id it writes into
it. A filter close to the limit came back over it, SVG import dropped
it, and the reopened object had no filter.
Export now leaves room for the id and the measured region, checks the
SVG 1.1 form the way import does, and counts each character past U+00FF
as the character reference Latin-1 output writes. A filter that does not
fit is exported as the other pixel effects are. The SVG 1.1 form and its
check are kept for the filters seen last, as checked filters already
are, so export does not check one filter again for each object.
The test for a changed module under a granted id now checks that the next
start, a folder load and a refused install leave the id's settings and
cache unattached.
`plugin.clearCache` without an id empties the cache of every plug-in
installed in the process. In the engine's library tests it could empty
the cache of another storage test running at the same time, and its
`bytesFreed` could count that test's cache. It now runs in
`crates/engine/tests/plugin_clear_cache.rs`, and the library test checks
that clearing one plug-in's cache leaves the other plug-in's cache.
The storage fuzz test starts each case with an empty plug-in store,
deletes the store when the case ends, and installs `fuzz.storage` with
`replace: true`, so the cases that shrink a failure install their
module.
docs/mcp.md says that files `plugin.remove` can't delete stay in the
folder renamed with `.removed` until the plug-in is removed again.
dotCooCoo