- Every request under a read root records the hidden libraries before it
runs, and the reply hides those and the ones hidden after it. A panic
is answered inside the request, so its error is hidden too.
- A hidden path followed by more path text stays only when the longer
text is another loaded library's id with no `.` or `..` part.
- Encoded file data is skipped only for a base64 string under
`dataBase64`, `pngBase64` or `thumbnailBase64`; objects and lists under
those keys, and other keys ending in `Base64`, are searched.
- The error of a failed request hides a path outside the read roots that
the request sent by its file name, so it reads the same whether or not
a library was loaded from that path.
- Paths written with `%XX` escapes are hidden, and on Windows paths in
another letter case.
- Recorded steps in `ui.inspect` leave out `~`, paths under `~` and paths
starting with `./` or `../` outside the read roots under any param.
- Hidden libraries are numbered in load order and keep their id from one
request to the next.
Under the read roots, every control reply now shows a hidden library's
id as loaded/<file name> and its path as the file name in every string
and key: status text, dialogs, the command palette query, a script's
report, recorded steps and errors. The id and path are replaced at any
boundary, so a path between spaces, brackets or quotes, followed by a
period or by more path text (<path>.bak), or quoted with escaped
backslashes is hidden too. An occurrence that continues into a longer
path stays only when the request may read that longer path, so a
readable library's id that begins with a hidden one keeps its text.
The libraries hidden after the request ran are hidden, and for a
request that names one, those hidden before it too. A reply with no
path separator in it is not searched. Encoded file data (dataBase64,
pngBase64) is sent unchanged.
Recorded steps in ui.inspect leave out a path outside the read roots
under path, paths, file, files, folder and any param whose name ends in
Path, Paths, File, Files or Folder (diffPath, fontFiles,
destinationFolder), and an absolute path or file: URL outside the roots
under any other param or in any list. The file: scheme is matched in
any case, a URL's %XX escapes are decoded before the check, a file: URL
inside the roots stays, and a file: URL that
names another host is always left out. file_access::is_path_key holds the list of
path params, and testkit's is_path_key uses it.
Follows #6608. ui.inspect shows a library loaded from outside the read
roots as loaded/<file name>. A request may now name the library or its
panel by that id in a panel, library or panels param, in a docking
destination (anchor, before, onto, above, below) and in
window.panel.layout's action: ui.set {panel} reopens the closed panel
instead of floating a new one. The reply to such a request, an error
included, shows the shown id.
ui.inspect rewrites only whole ids, and only in the fields that hold
library and panel ids, so a readable library's id that begins with a
hidden one keeps its path, and status text, the command palette query
and a script's report keep their text. A hidden library does not take
the id of a library loaded without a path.
ui.inspect also leaves out of recorded action steps the path and folder
params, params named like destinationFolder and the entries of a paths
list that lie outside the read roots, also inside a batch step's
commands. It hides a library id holding a path written with either
separator, and checks a folder preference against the roots as written,
without trimming spaces.
The 27 commands that act on `ids` or else the selection (Apply as
Filter, Print Ink Fixes, the Arrange, Cleanup and Path Tools plug-in
commands, Smooth, Text Wrap, variable.bind and variable.unbind among them)
refused `ids: null` with "ids must be an array of non-negative integer
object ids". They now read null as `ids` left out, as the other commands
that take `ids` do. Remove Breaks also reads null as left out when it
decides whether to act on the characters the Type tool selected.
The status message already ends in an ellipsis and shows its full text
on hover when it is clipped. The Help Bar's hint and the tool name in
the status bar ran past the window edge instead; the Dimension tool's
hint is wider than an 800-point window. Both now end in an ellipsis and
show their full text in a tooltip on hover. Screen readers receive the
full text, and text that fits shows no tooltip.
In a narrow status bar the tool name now ends in an ellipsis before it
takes the status message's room. Before, the tool name could leave the
message almost no width.
The tooltips of the clipped hint, tool name and message wrap to fit
inside the window. egui's tooltips are 500 points wide, which is wider
than an 800-point window at UI Scaling 1.6 or more.
The hint and tool name tests fail without the change. The status
message test covers its existing ellipsis and tooltip.
Ruler guides were a list kept beside the layers. Each guide is now an
object of its layer or sublayer, always directly in it and above the
layer's art. These behave as on main:
- Guides draw on screen only. Exports (SVG, PDF, PNG, PSD), Fit All,
Select All, the art bounds, clicks and marquees, and a layer's
Pathfinder and Transform effects leave them out. The Layers panel
lists them as guide rows of their layer, the highest guide.list
index first.
- Deleting a layer deletes its guides, and merging layers keeps their
guides in the merged layer.
- The guide commands number guides as guide.list does, in the order
they were made.
New: each guide takes an id from the document's object ids. An object
command given a guide's id fails with an error, and node.move cannot
put a guide into a group or out of its layers. A guide made while an
opacity mask, a symbol or a pattern is edited moves to the top
visible, unlocked layer when editing ends.
File format: native files still save the guides in the document's
guides list, in every file version, so older builds read them. Each
entry may now also carry the guide's id, name, locked and hidden
flags; older builds ignore those fields. Opening a file puts each
saved guide on its layer (on the top visible, unlocked layer when the
file names none or a layer it does not have), and each saved guide
counts against the object limit for opening a file. A ruler guide node
that a file holds below a layer's art moves up to the layer's guides,
and one anywhere else (in a group or another object, beside the
layers, or in a symbol) is removed. Ruler guides read from an .ai file
become guide objects on the layer they were on, numbered in the order
the file lists them.
The test for new XML with a one-item list now starts from an item that
has a parent, an attribute and a child. It checks that the copy has no
parent and that changing the copy's attribute and child leaves the
original unchanged, so a copy that drops or shares the children fails.
Outside Windows, `\\host\s\x.txt`, `\\?\C:\x.txt` and `\\.\pipe\x` are
relative file names in the script's folder, so `exists`, `open` and
`getFiles` look them up. The test now expects no lookups for them on
Windows only, and on macOS and Linux checks `//host/s/x.txt`, an absolute
path outside the folder, alone. The returned values are the same on every
platform.
Adds step-security/harden-runner (audit, pinned to v2.22.4 like
craft-common-actions) as the first step of each job that did not have it,
so every workflow in the org's public repos reports its egress to
StepSecurity. Audit, not block: block-mode allow lists come from each
job's observed traffic.
The folder the Additional Plug-ins Folder preference or plugin.reload last loaded is kept for the
whole process. The six engine tests that set the preference or run plugin.reload now hold one lock,
so another test loading its own folder between two steps cannot change what the next step loads or
lists.
new XML(list) now returns a deep copy of the list's single item, as
ECMA-357 section 13.4.2 specifies for an XMLList argument; before, it
returned the item itself, so changes to the new value changed the list.
insertChildAfter and insertChildBefore take one unit of fuel for each
child they compare with the reference, as childIndex does.
The test for the missing xpath method now checks the XML and XMLList
prototypes; reading .xpath on a value selects child elements and
returned an empty list in every case.
`color_name` clamps each component before rounding, but `clamp` keeps a
-0.0, so a color with a -0.0 component was named "R=-0 G=128 B=-0" (and
"K=-0", "Gray K=-0" in CMYK and Gray). Adding 0.0 after rounding turns
it into 0, as the Lab branch already does.
The params docs now state the direction (and the zero) of each angle or
rotation a command takes; behaviour is unchanged. Shape creation, text.create,
the grids, add-on shapes, saved views, Liquify, Puppet Warp pins, Mirror and
Radial Repeat and Vector Halftone turn clockwise; text character rotation,
gradients, the eraser tip and print screen angles turn counter-clockwise.
view.saved.new's rotation note changes its schema, so the API level goes to 3.
A test walks every command's params doc and fails when a param named like an
angle or rotation doesn't say clockwise or counter-clockwise.
Check Script read names with Rust's alphabetic and alphanumeric tests, so it
split names at U+2118, U+203F, U+00B7 and the zero width non-joiner and joiner,
and took U+00B2 and U+2E2F into names. It now uses the Unicode 16.0 ID_Start
and ID_Continue rule that vectorcraft-js uses, with `$` and `_`
(https://www.unicode.org/reports/tr31/,
https://tc39.es/ecma262/#sec-names-and-keywords).
A `\uXXXX` escape is part of a name only when it stands for a character the
name may hold where it is: `\u0030abc` no longer becomes `0abc`, and malformed
escapes end the name.
The engine's lexer comparison test now checks that both crates take the same
characters into names, written out and as escapes.
A closed subpath that refits to a single curve has one anchor, which is
not a subpath, so Simplify dropped it: a small circle inside a compound
path was lost and the result ended hundreds of points from the original,
and a small closed path on its own came out empty. Such a subpath is now
refitted in two parts, cut at the point farthest from its start, or in
three when two parts would still enclose no area (two lines that retrace
each other with Convert to Straight Lines). A closed subpath of a single
segment stays as it is.
dotCooCoo