The keyboard pane (Options::keyboard) draws a US ANSI layout under the
table and detail pane, coloured by who holds each key with the toggled
and held modifiers, lists the clicked key's shortcuts and assigns key and
modifiers to the selected command. Fixed rows always report a label, with
"Now used by" when a command took their key. A read-only dialog has no
set row, keeps Summarize in the footer and closes with shortcuts.close.
Set row with picker, New Set (based on current shortcuts or a set),
Rename, Delete, Save, Revert Set, Export, Import and Summarize; actions
that do not fit go into a More menu. The foreign import review lists
what will change, suggestions to pick, unmatched, unreadable,
approximated and matched-without-change entries, then the report of
skipped, taken and failed changes with Copy Report. ui::summary writes
the shortcut summary as HTML and plain text.
- view.rs: header with Show (dropdown or tabs), Filter and Search with search
by key; table and detail pane in a resizable split, the detail pane below
the table under 720 pt; virtual rows with chips, + and the restore button;
detail pane with current shortcuts, New Shortcut, typed entry, Context,
Assign, Use Default and Clear; prompts, conflict bar, messages, clash,
shadow and problem lines; Undo, Redo, Reset All, Cancel and OK.
- Escape, Enter, Undo and Redo keys when idle; table keys (arrows, Home,
End, Enter records, Delete removes); focus locks while recording.
- Accessibility labels for every control, row selection, and on_widget
automation ids.
- style.rs: DialogStyle and the icon-button and divider styles.
- show() sizes the window to the screen; closing it is Cancel.
- tests/ui_dialog.rs: recording, conflicts, search, areas, display, labels,
table keys, small windows, RTL. tests/ui_snapshot.rs (feature snapshot)
writes PNGs when CRAFT_KEYMAP_SNAPSHOT_DIR is set.
DialogState with every dialog action as a call on EditSession, Recorder,
editor::holders and Profiles; the table rows (areas from paths, kind and
scope, filters, search by label, translation or chord, grouping, sorting,
a row cache); key capture while recording, including clipboard events,
which removes the events it takes; the Text trait, I18nText and the list
of strings the dialog looks up. Drawing comes separately.
Profiles keeps the user's sets beside the app's built-in ones: switch, duplicate,
rename, delete, export one set as JSON and import it back, and import another
application's set through an import plan as a new set. The editor model holds an
edit session with undo and cancel, conflict queries for steal or keep, a chord
recorder with double press, and search.
The last segment of a panel-menu entry matches alone only when the panel
name is a segment of some catalogue path. An entry without keys matched
only as a panel-menu item leaves the command's shortcuts alone and is
listed in ImportReport::matched_without_change. Tests cover an entry
without keys next to one with keys for the same command, in both orders.
- ForeignEntry::in_panel_menu marks an item whose leading segments name a panel
(InDesign's "Character: All Caps"); it also matches a catalogue path ending
with its segments, then its last segment as a unique label.
- Aliases count in the menu steps too, joined segments are tried as a label or
alias anywhere, and normalize_label reads a colon as a space, so the alias
"Preferences: General…" matches "Edit > Preferences > General...".
- A leading Show, Hide or Show/Hide is dropped only for commands marked
Bindable::toggle, and only after the names as written found nothing.
- Keys in skipped contexts are left out of unmatched rows, so entries with only
such keys no longer use up the suggestion cap.
reset, and an edit that leaves a command with its defaults, removed
only the entry the command read. A variant of its key
(window.panel { "panel": "layers" }) stayed and took effect on the
next load. Both remove every entry that resolves to the command.
conflicts_with lists the commands that share one command's chords, with
that command as a, without filtering every conflict. The README shows
set_bindings with one binding for an editor with one shortcut per
command; assign adds a binding.
Apps that stored { command: text } before read the field in older builds
again. Overrides with several bindings for a command still serialize as
the { command, keys } array. keymap::overrides_list always writes the
array, for craft-settings files, where only an array lets a reset entry
leave the file.
Hit carries the trigger that matched and whether the press matched it
exactly. Dispatcher::dispatch_filtered takes a predicate; a declined hit
leaves its event and text in place.
egui's Copy, Cut and Paste events stay with the app unless
with_clipboard_events(true): egui-winit sends them in place of the
clipboard presses, and a Paste event consumed as a hit lost its text.
With them on, Hit::pasted holds that text, and a web clipboard press
and the event it causes run once for every clipboard chord, not only
Cmd+C/X/V. The Hit doc line moves from DOUBLE_PRESS to Hit.
craft-keymap holds the data and logic for keyboard bindings: egui-free
chords with one canonical text form, bindings to commands with params,
several bindings per command, scopes, tool groups, conflicts, overrides
kept in a craft-settings type, an import pipeline for other applications'
shortcut sets, and an optional egui dispatcher. Apps keep their command
catalogue, file readers and UI.
Skylar's review of 886a0b3:
1. tc/tid go locale by locale: in each locale the context or @id row,
then the plain row, so pt-br's plain row beats pt's context row.
2. pt (and pt-* other than pt-br) uses pt-PT plural rules: 0 is plural.
3. A script subtag (sr-Latn-RS, sr_RS@latin, be_BY@latin) never picks a
code of another script; sr-Cyrl-RS still picks sr.
4. A row defined twice is reported and the first kept, as in the checker.
5. The pseudo locale is debug-only via from_code, get marks too, and
looked_up() lists what was looked up for an app's audit.
6. intl_pluralrules pinned to =7.0.2; plural_form_counts copied from the
checker, plus pt.
7. I18n::new takes the app's offered codes: languages(), from_code,
match_tag and system_lang only return those; others stay fallbacks.
Smaller: en/pseudo/repeated codes are skipped and reported,
system_lang is cached, zh-hant-hk falls back to zh-hant, rtl adds ckb,
dv, ps, sd, ug and yi.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Review fixes (CodeRabbit): a glibc @latin/@cyrillic modifier becomes the
script subtag and only codes with that script are tried. sys-locale
drops the modifier, so on desktop Unix system_lang reads LANGUAGE,
LC_ALL, LC_MESSAGES and LANG raw, in its order. README: tl! qualifies
CURRENT with $crate; get follows the locale chain but never the plain
row or English.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Final review fixes: a European Portuguese locale wins over pt-br when both
are embedded; sr-latn no longer falls back to Cyrillic sr; get() looks up
one context with no plain or English fallback (key-cap names).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F9fM3mv1PUyKpk5rdwUQrW
resolve_absolute_refuses_results_that_are_not_absolute resolved links against a
document at /home/u/docs/a.doc outside its cfg!(windows) branch. On Windows that
path is rooted but has no drive, so it is not absolute, resolve_absolute refuses
the result as documented, and the unwrap panicked. The Windows arm already covers
the same three cases with a drive. Found by the new docpath CI job on its first run.
The per-crate workflows name their crates with -p, so the new crate had no job
and its tests, including the Windows-only colon and stream assertions, never ran
in CI.
A test is not instant and the address field stays editable while it runs,
so its answer can arrive after the address has changed. `set_models` then
recorded the models against whatever the field held by the time it
returned, filing one endpoint's models under another — the mislabelling
`models_fit` exists to prevent, reached the asynchronous way rather than
the synchronous ones already closed.
`set_models` now takes the address the test was started against and
returns whether the models were taken, so an answer that outlived its
address is dropped and the caller can say the result is out of date. The
parameter replaces the old signature rather than joining it: there was no
second legitimate caller, and leaving an address-free version beside it
would have left the racy call the shorter, easier one to reach — against
this module's rule that the rules live once so two screens cannot
disagree.
Also fixes a pre-existing mismatch found while testing this:
`from_connection` recorded the loaded address untrimmed while `prepare`
compares it trimmed, so a stored endpoint with stray whitespace dropped
its models on the first save.
Model provenance across loaded and preset endpoints and repeated endpoint edits, so models from one endpoint are not relabelled as another's, and eligibility resolved in both directions: a model must accept every input the tool sends, and the tool must supply every input the model requires (new ResolveError::InputRequired).
All 18 checks pass on a40245bd, including craft-ai-core fmt, clippy -D warnings, tests and the wasm32 check on Ubuntu, Windows and macOS.
Note for callers: after a tracked endpoint change, use set_models for newly discovered models; direct assignment on fresh custom drafts and unchanged saved endpoints still works. The asynchronous in-flight probe race is separate and not addressed here.
resolve_absolute refuses a result that is not absolute on the running
platform, such as a relative link in a document that has no path yet.
It is the function to call before opening a file.
The eager tuple computed o + 8 even when the first read had failed,
overflowing a 32-bit usize at offsets near u32::MAX (n = 2 with
size = u32::MAX - 20 reaches it: o fits, o + 8 does not). The record is
now bounds-checked in one slice and the fields read inside it, the same
complete-record pattern the profile reader uses elsewhere.
Consent expiry is now per kind of data: renewing text no longer renews an expired image permission. A connection edit keeps models found by a test at the new address, and drops only the ones saved for the old one.
parse_curve computed 12 + n * 2 with n straight from the file and only
checked the 1 << 20 bound afterwards, inside the table arm — on a 32-bit
(wasm32) target, which craft-cms ships branches for, a trC curve count of
0xFFFFFFFF overflows with overflow checks on and panics before the guard
could reject it. The mluc reader computed 16 + k * size unchecked, where
wrapping reads another record's bytes as the language, length and offset
(wrong text, no error) instead of stopping.
Hoist the curve-count guard above the arithmetic and compute the record
offset with checked_mul/checked_add, breaking out when it does not fit.
This ports the app-side fix accepted as PhotoCraft #4976 / PR #5227,
which was never carried into craft-cms. On a 64-bit host both sites are
benign (the arithmetic fits), so the two new tests pass before and after
there; they bite on a 32-bit/overflow-check build, which deserves a
wasm32 CI job — craft-cms has none yet.
PDFR / #106: share the patched PDF reader, interpreter and raster boundary
with explicit input and decode limits, diagnostics and portable contracts.
Preserve the original reader/writer commits and immutable consumer pins.
Fresh current-main workspace gates and all 15 hosted jobs passed on the
exact integration tree. Applications retain their own import/export policy.
Add opt-in shared PDF authoring with bounded font preparation, caller-owned metadata and settings, guarded serialization, and a backend that rejects poisoned drawing state.
Preserve the existing writer commits so immutable dependency pins remain reachable from main. Reader and application migrations remain separate.
PR #105.
A configured connection does not authorise an app by itself. An agreement now
covers one app, connection, destination and capability, for the kinds of data
it named, and may carry an expiry (unix seconds).
- Disclosure carries the capability; ConsentRecord gains optional capability
and expires_at.
- ConsentLedger::needs_consent takes the time (the crate has no clock);
grant_until sets an expiry, grant stays open-ended. The latest grant sets
the expiry for that capability only.
- Records saved before this have no capability and cover nothing, so the
person is asked once more.
Nine new tests; six deliberate bugs (expiry ignored, off by one, capability
ignored, legacy record covers everything, expiry not updated, timed grant made
permanent) were each caught.
aiongg
Dylan M. Taylor
skylar taylor-barrick
Martin BallandClaude Opus 5.5
midasmatterhorn
Jeremy
