* Metafile: stop shading on a full canvas, charge nested pictures and clip regions to the budgets
* address review: count shared tiles once, include text advances, check clip region before keeping an item
* address review: count EMF+ object bytes against the canvas byte budget
* Apply review fixes
- crates/metafile/src/canvas.rs
- crates/metafile/src/tests.rs
* Apply review fixes
- crates/metafile/src/canvas.rs
* address review: count pieces of a continued EMF+ object against the shared byte budget
* Apply review fixes
- crates/metafile/src/canvas.rs
* address review: count the current and saved clips against the shared byte budget
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
DeckCraft kept its own Opus decoder (crates/opus) and Ogg demuxer
(crates/ogg), and two crates that only re-exported craft-media
(crates/isobmff, crates/matroska). craft-libs has all four: craft-audio's
opus module and craft-media's ogg, isobmff and matroska modules. The four
crates are removed and crates/media depends on craft-audio and craft-media
directly.
craft-media and craft-audio are pinned at 113f2360, the head of craft-libs
#810, which carries the two Ogg fixes DeckCraft made to its own copy
(51d19baa, 9d36b593). The pin moves to craft-libs main once #810 merges.
craft-pdf, craft-update and craft-ui keep their pins.
One API difference: craft-media's OpusTiming::of saturates on a hostile
granule position instead of returning an error. The end-trim product in
the Ogg Opus decode now saturates as well; a test with a three-channel
file and the largest granule panicked on it without that.
crates/bitstream stays: it also holds the video decoders' memory budget,
which craft-libs does not have.
* PPTX: charge repeated chart decodes and sidecar copies to presentation-wide budgets
* address review: count all chart vectors and relationship strings; reject a chart that crosses the presentation limit
* address review: charge chart part names/content types, roll back rejected capture
* address review: bound chart decode work across rejected and repeated references, cache refused sidecar captures
* address review: keep a chart past the presentation chart limits as its original part and closure, so a save writes it back
* UI: cap live video decoders and bound slide-show grid thumbnail height
* address review: retry video feed creation when playback resumes
* address review: reclaim the decoder of ended videos when the feed cap is reached
* test: cover the video decoder cap and its retry
* address review: seeking a video without a decoder retries the bounded decoder allocation
* Render: bound bevel edge work, shape-gradient flattening and colour-glyph fills
* address review: skip shape gradient fill when the outline is over the point limit
* address review: keep every contour of a compound bevel or shape gradient at a coarser raster, bound cubic subdivision before flattening
* Apply review fixes
- crates/render/src/pathgrad.rs
* Apply review fixes
- crates/render/src/pathgrad.rs
---------
Co-authored-by: autocraft-bot[bot] <354215646+autocraft-bot[bot]@users.noreply.github.com>
* Fonts: honor the disabled system fallback for symbol and script family loads
* address review: no catalog loading for loaded families when system fallback is off
* test: cascades load no installed family when system fallback is off
* pdf: gather a paragraph's text once, keep note line widths, count handout rules
* pdf: spell the rule-count check without a negated comparison
* address review: use a narrow tall page in the bounded-work test
* address review: require the huge-paper export to succeed
* Apply review fixes
- crates/pdf/src/lib.rs
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
* mcp: bound a batch's entries and the bytes of results it gathers
* address review: charge the escaped batch reply against the budget
* address review: charge batch error entries against the byte budget
* address review: truncate id in batch limit entry
* address review: count the pretty-printed batch reply against the byte cap
* engine: check the automation write roots before appending to the user dictionary
* address review: check the original Path for the dictionary write; isolate the confinement test
* pptx: preserve SmartArt node text when dgm:cxnLst has no parent-child connections
* fix(pptx): apply unconnected-point SmartArt outline fallback when type="doc" point is absent
* fix(pptx): restrict SmartArt pt_order fallback to empty parOf graphs and preserve cached Picture/Connector children
* fix(pptx): convert default rect geometry to line for connectors in diagram drawings
* docs(pptx): note flat ptLst order fallback on dgm::outline
Adds step-security/harden-runner (audit, pinned to v2.22.4 like
craft-common-actions) as the first step of each job that did not have it,
so every workflow in the org's public repos reports its egress to
StepSecurity. Audit, not block: block-mode allow lists come from each
job's observed traffic.
* Spelling: stop an affix header's count at the end of the file, share aliased dictionaries
* address review: share the first inserted dictionary on a concurrent load
* engine: edit each target shape once and read its box without copying it
* engine: check the fill colour field in the repeated-ids test
* Apply review fixes
- crates/engine/src/tests.rs
* address review: shape.lock skips targets inside a targeted group
* address review: dedupe shape.lock targets before walking groups
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
* engine: count a slide's notes, comments and tags in the undo memory budget
* engine: drive the undo-budget test through slide.rename
* address review: size text cost by the Paragraph and Run struct sizes
* metafile: bound clipping work across all subpaths of one drawn item
* address review: charge fill clipping as polygons grow, one budget per item
* address review: charge actual clip work instead of projected polygon growth
* address review: share one clip-work allowance between fill and stroke
* address review: share one clip-work budget across fill and stroke, give region intersection its own budget
* media: check an MP4 for oversized sample tables where symphonia will start reading it
* address review: run MP4 table guard only for MP4 or unknown containers
* Apply review fixes
- crates/media/src/probe.rs
- crates/media/src/mp4guard.rs
- crates/media/src/audio.rs
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
* H.264: bound decoder work from overlapping slices, gaps and queued output
- A macroblock that an earlier slice of the same picture already decoded is
refused, so overlapping slices cannot redo the picture's reconstruction
once per slice.
- The memory budget check counts pictures waiting in the output queue that
have left the DPB (one decode call may carry many access units) and the
DPB's actual size, counting shared buffers once.
- frame_num gap concealment advances the POC state across the skipped run in
constant time instead of once per missing frame_num.
- Storing a reference picture evicts until the DPB is under capacity, rather
than evicting one picture and inserting regardless.
* address review: charge pictures already held at their own size in the decoder budget
* address review: keep the h264 output-queue byte total incrementally
* engine: extend an ink stroke in place and cap a gesture's samples
* engine: move the ink extension out of drag
* address review: close scribbles at the release point; keep vertices when a capped press adds none
* Apply review fixes
- crates/engine/src/tools/pointer.rs
* raise ink gesture cap to 100000 points
---------
Co-authored-by: aiongg <67543387+aiongg@users.noreply.github.com>
Found while testing crates/model/src/trendline.rs:~419 (solve, used by polyfit)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The pdf-deps check compared craft-pdf and krilla against storytold/craft-libs
at c5a1cbfb, so the gate stopped at that step once the pin moved to
dotCooCoo/craft-libs c7c84230. The expected repository and revision now
match the pin in Cargo.toml.
craft-media, craft-pdf, craft-ui, craft-update and krilla move from craft-libs
c5a1cbfb to c7c84230, which carries storytold/craft-libs#687 and #696.
The check result window now shows whenever the updater's status is not
idle: after Help > Check for Updates, and at the first start after an
update, to say that it installed or why it failed. Restart to Update in
that window asks the app to close once nothing is unsaved. on_exit starts
the helper of a ready update, since on macOS it ends the process before
the app is dropped.
Found while testing crates/model/src/edit.rs:~505 (change_case_parts, sentence branch)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Found while testing crates/engine/src/cmd/format/paragraph.rs:123-129
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Found while testing crates/engine/src/cmd/shape/appearance.rs:8 (adjust, index via usize_param); same pattern in quick_style at :559
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The web shell queues the page's calls as control requests (the channel the desktop control server uses) and answers them on the next frame. The API is installed in every mode; opening, saving, the file name and the unsaved flag stay with the host messages.
Dylan M. Taylorandautocraft-bot[bot]
neilcawse
FredApps
dotCooCoo
NetterSilverandClaude Opus 5.5
Nasim
Helen Kwok