psim::births_at builds the GPU's birth schedule (the birth step of every
particle id) from the rate of each step, with the CPU step's carry
arithmetic. births() for a constant rate now uses it. It stops as soon
as the cap would be passed, before adding a step's births, so a huge
rate can't build a huge list first.
SimCache::run_where takes a check on each checkpoint (its step and
state). A simulation whose steps depend on inputs outside its key, such
as a parameter's values over time, resumes only from a checkpoint
reached with the same inputs. A fresh checkpoint now replaces one at the
same step, so a changed history doesn't leave stale checkpoints behind.
run() is run_where with no check.
EffectHost::param_at(effect_index, id, layer_time) evaluates a single
parameter (by its flattened id, such as birthRate or group/param) of the
effect at that index in the layer's stack. A simulation can then sample
one parameter at every step without flattening the whole effect each
time.
The effect index is passed in, rather than read from the renderer's
running-effect index as params_at does: GPU-batched effects never update
that index, so a batched effect would read another effect's parameters.
The renderer's implementation walks the effect group by match id and
evaluates just that property (keyframes and expressions) at the comp
time of the layer time.
A layer selected by another layer's effect (Displacement Map, Blend...) had
its structure, values, matrix and time hashed into the owner's key, but not
the comp camera/lights its own scene-reading effects (Caustics, CC Particle
World...) see. The owner's key included the scene only when the owner itself
ran such an effect, and a cached owner never runs the selected layer's
effects, so moving the camera or a light reused stale owner pixels.
Dependencies::layer now hashes comp_scene for every selected (or nested)
layer that reads it, with the same policy as owner keys.
Fixes#1252
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9kwMcw2pYQ5fSjKa3ZPnh
The 1 GiB array limit counted wire bytes, but arrays are kept as f64/i64,
so boolean arrays grew 8x and 32-bit arrays 2x past it, and nothing bounded
the total across arrays. Every Model linked to a Geometry also built its own
copy of the mesh.
- A per-import Budget (2 GiB) is charged 8 bytes per array element before
the array is decompressed or widened, ASCII files are charged for their
parsed values, and each built mesh is charged for its vertex and index
data. Going past it fails the import with a clear error instead of an
allocation abort. parse_within/read_within take a lower limit for tests.
- Models instancing the same geometry with the same materials share one
mesh; a different material mapping still gets its own.
Fixes#1234
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9kwMcw2pYQ5fSjKa3ZPnh
Accessor counts sized the f32/u32 output before the buffer view was looked
at, and offsets, strides and count * components used unchecked arithmetic,
so a few hundred bytes of JSON could request a multi-gigabyte allocation
(aborting the process) or overflow.
- Doc::layout checks count * components, adds the view and accessor offsets,
rejects a byteStride smaller than an element, and checks that the last
element ends inside the buffer, all with checked arithmetic, before
floats() or ints() allocate anything.
- Accessors without a buffer view (all zeros) are capped at 2^24 components.
- idx() and node index lists use usize::try_from instead of 'as usize'; an
image bufferView's end and a GLB chunk's end are computed with checked_add.
Fixes#1235
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9kwMcw2pYQ5fSjKa3ZPnh
Depth-limited <use> expansion still let a few kilobytes of branching
references expand to 2^N elements. The parser now counts every element it
converts, <use> copies included, against a budget of max(500 000, twice the
file's own elements) and fails the import with Error::Xml once it is spent.
Targets currently being expanded are tracked, so mutual references stop at
the first repeat instead of nesting to the depth limit.
Fixes#1236
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9kwMcw2pYQ5fSjKa3ZPnh
Project::comp_contains recursed through precomp layers with no visited
set or depth limit. A damaged project with a precomp cycle that doesn't
pass the queried comp (A and B nesting each other, C unrelated) recursed
until the stack ran out, which aborts the process ("stack overflow,
aborting"): it can't be caught as a command error, so unsaved work is
lost. layer.addItem checks it before adding a precomp, and the renderer
calls it for every nested comp and its audio. A long chain used the
stack the same way, and comps shared by many paths were walked once per
path (exponential for nested diamonds).
It is now an explicit stack with a visited set: same answers (a comp
contains itself; a target reached through a cycle is found), each comp
visited once, no recursion. The renderer already skips a precomp that
contains the comp being rendered, so a cyclic project now renders
instead of crashing; nothing is repaired on load.
Tests: project comp_contains_ends_on_cycles_long_chains_and_shared_
precomps (cycle with an unrelated target, self-nesting, a target through
a cycle, 40 levels of diamonds, a 20 000-comp chain); engine
a_project_with_a_precomp_cycle_opens_adds_and_renders_without_running_
out_of_stack (file.open, layer.addItem both ways, render). On main the
engine test aborts with a stack overflow.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every socket operation locked one global table and held it through the
blocking write_all/flush, and streams had no write timeout (accepted
ones were explicitly blocking). A peer that stopped reading kept the
script blocked for good, and every other socket call, close included,
waited behind it.
- The table maps handles to Arc<Entry>, each with its own Mutex<Sock>.
The table is locked only to look a socket up, add or remove one,
never during network I/O, so one stalled socket doesn't hold up the
others.
- `write` sets a write timeout from the socket's `timeout` (10 s by
default, as reads) and reports "write timed out … the other side
isn't reading" instead of blocking. Failures to set the read or write
timeout, or to make an accepted stream blocking, are reported instead
of ignored.
- `close` removes the socket and shuts its stream down through a second
handle, so a call blocked on it fails at once.
Tests (socket.rs, native only): a 64 MB write to a loopback peer that
never reads fails with "timed out" after a 1 s timeout; while one socket
is blocked writing, another answers at once, and closing the blocked one
returns at once and ends its write. Both fail on main (the write never
gives up; the second socket waits on the table lock).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
effectcraft-cli read its command line with std::env::args, which panics
on an argument that is not valid Unicode (a Latin-1 file name on Linux,
for example). `effectcraft-cli $'\xff'` or
`effectcraft-cli render-frame --out $'caf\xe9.png'` printed a panic from
std's env.rs and exited 101.
It now reads std::env::args_os and refuses such an argument as a usage
error (exit 2) that names it, before anything runs, like an unknown
option. A lossy copy is not used: every argument is a string here, and
`caf\u{fffd}.png` would read or write another file than the one named.
FilmCraft moved its CLI to args_os too (storytold/filmcraft#850).
Tests: a unit test for the conversion and a process test that runs the
CLI with a non-Unicode `--out` path (both unix-only). Before the fix the
process test fails (exit 101, not 2).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
makehybrid -hfs gave every file in the image a com.apple.FinderInfo, so the app in the
DMG, and a copy installed from it, failed codesign --verify --strict --deep ("resource
fork, Finder information, or similar detritus not allowed"), though Gatekeeper accepts
it. Build the image as VectorCraft (#1085) and PdfCraft (#823) do now: hdiutil create
-srcfolder with a few tries for CI's "Resource busy", and verify the mounted app with
--strict --deep so the regression can't ship again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With Warn User When Executing Files on, file.executeFile asks the
frontend first, and the frontend's answer re-runs it with
`confirmed: true`. That flag was taken from the parameters whoever
called, so a script could pass it itself (app.run('file.executeFile',
{path, confirmed: true}), also inside engine.batch) and the file opened
without the question, as long as the user had allowed file and network
access.
`confirmed` now counts only when the command isn't running for a script
(Session::running_for_script, which #590 uses for the same reason and
which stays set through nested batches). A script's request always gets
the question; the user's answer from the frontend's form still opens
the file; with the warning off nothing changes. The permission gate
itself is unchanged.
Tests: engine a_script_cannot_confirm_executing_a_file_for_itself
(execute_for_script directly and through engine.batch; the frontend's
confirmation; warning off) and the same through real JavaScript in the
script crate (app.run, app.run('engine.batch'), File.execute()). Both
fail on main.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
essential.templateInfo was missing from confine.rs's READS, so its
`path` got no named check, and the fallback only scans absolute-looking
strings: a relative path (or one through `..`) escaped the read roots
and the command parsed and returned a template outside them.
An audit of every registered engine command with a parameter named
like a file found the same gap in more commands, now classified:
- READS: essential.templateInfo, file.importProject,
file.watchFolder.poll, footage.relink, layer.newModel,
mediaBrowser.fileInfo / list / import / removeFavorite,
face.model.install, roto.model.install, templates.create (`path`).
- WRITES: file.exportTimeline, file.createProxy (`path` / `output`,
which may be a file-name template, as for render.preRender).
- MIXED_WRITES: templates.create writes `projectPath` and `footageDir`.
Tests (confine.rs):
- every_command_with_file_parameters_is_classified fails when a
command takes a path, paths, folder, file, output... parameter and is
neither confined, refused, checked by a lookup, a Render Queue output
(checked when the queue renders) nor listed in NOT_FILES (property
paths and the like). New file commands can't slip through.
- relative_and_outside_paths_of_newly_listed_commands_are_refused:
relative, `..` and outside paths are refused and in-root ones allowed,
directly and in a batch; writes go only to write roots; createProxy
accepts a name template. It fails on main (templateInfo with
`t.ectemplate` passes).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A ReferenceError's first use was searched across the whole file, so a mention
earlier in a comment, a string or another function could report the wrong line.
The search now starts at the innermost script frame's line, and covers the whole
file only when there is no frame. Follow-up to storytold/effectcraft#1161.
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Out on an auto-Bezier key leaves its in side playing the same values,
and undo and redo restore each state. On a curved Position path with
unequal segment lengths and durations, In sets the key's speed from the
incoming path length, playback arrives faster than a constant speed, and
the out side plays as before.
A roving key passes speed straight through: the engine keeps both its
sides linear whenever the keys are edited (retime_roving), so an ease set
on one never plays. The panel still counted it as eased, so a selected
roving key showed "Eased 1 keyframe(s)" and stayed linear. The previous
pair-only panel did the same to a pair holding a roving key.
Selected roving keys are now left out of the work and counted. The
status names how many were skipped and that turning off Roving lets them
ease; when nothing else was selected, nothing changes and no undo step
opens. Fixed keys next to a roving key still ease.
Guide layers render only in their own comp's viewer: a nested renderer (precomp, collapsed
precomp in 2D, Classic 3D and Advanced 3D, comps read by effects, aux passes, the GPU walk's
resident precomps) now runs with guides off (Renderer::nested_opts), so a precomp's guide
layers no longer show in the parent comp's viewer or in a "Current Settings" render.
The Timeline layer and Composition viewer right-click menus (shared layer_menu) gain a
Guide Layer item (a plain toggle, no check mark) acting on the selection, and guide layers show a guide mark
before their name in the Timeline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
In After Effects solo is not time-dependent: while any AV layer is soloed,
non-soloed layers are excluded at every time. The renderer, nested/collapsed
3D paths, engine viewer helpers and viewer hit tests only counted solo layers
active at the current time, so outside the soloed layer's in-out range the
whole comp reappeared. Drop the time condition (audio already ignored it).
Update the #66 viewer regression test to the AE behaviour and add a render
test for it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One middle key between unequal segments in each mode, with its
neighbours, times, values and selection unchanged and one undo restoring
it; first and last keys, keys that aren't neighbours and keys of several
properties; no undo step when nothing can ease; a Hold and an
auto-Bezier side kept as they play; per-dimension and motion-path
speeds on Scale and Position; and the pair's outer sides under In-Out
and Out. All but the unchanged API tests fail on main.
The panel eased only pairs of neighbouring selected keyframes, so a single
selected key (or keys that aren't neighbours) changed nothing.
An Ease selector (In, Out, In-Out; In-Out by default) now chooses the
sides of each selected key to ease. In eases a key's incoming side with
the curve's in side, Out its outgoing side with the curve's out side. A
side is eased when it has a neighbouring key, selected or not; the
neighbour is left as it is. Each side's speeds scale to the segment on
that side, so a key between a +100/s and a -40/s segment gets each its
own. The side not eased keeps playing as it did (easeSide, unchanged).
Sides are measured before any key changes, and no undo step opens when
no selected key has a segment on the chosen side; the status says which
neighbour is missing. A selected pair in In-Out still gets the whole
curve; its outer sides now ease too when they face an unselected key.
From Keys still reads the curve of a selected pair.
Every layer gets the Video switch (eye) in the Timeline (nulls, cameras and lights
were excluded by an is_av() check). A selected layer whose eye is off no longer
draws its box, handles, anchor or paths in the viewer. Alt-click on an eye and
Layer > Switches > Hide Other Video now take nulls along.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Alt-clicking a stopwatch added an expression, but its editor needed
another click before typing went into it. In After Effects the new
expression's field takes the keyboard at once, its text selected.
The pick whip's one-shot refocus (the editor takes the keyboard back
after a reference goes in) is now an ExprFocus request for any
property: which text to select, counted from the end, and the pass it
was asked for in. An Alt-click that adds an expression asks for it with
the whole text selected, so typing replaces it; the expression row is
opened if it was closed and scrolled into view (it is added below the
stopwatch's row, which can be the last one shown). The request is taken
once, when the editor is drawn, and dropped if its expression doesn't
appear or it isn't taken within a few passes, so it never takes the
keyboard later; an Alt-click that removes the expression clears it.
Tests (ui_inline_edit): typing straight after the Alt-click replaces
the new expression; a field clicked right after keeps the keyboard;
after removing it nothing has the keyboard; an expression added at the
Timeline's bottom brings its editor into view with the keyboard. Both
fail on main.
With Separate Dimensions, X Position and Y Position are separate scalar
properties. The new test puts an expression on X Position only and checks,
in the Timeline and Properties panel and in both themes, that X is red and
Y keeps the ordinary colour. It fails on main.
Round nonzero duration frame counts away from zero while retaining
absolute-time rounding, default argument selection and numeric coercion.
Cover fractional durations, absolute controls, defaults and coercion.
Sort expected paths in the existing footage test for temporary-directory portability.
Co-authored-by: Codex <codex@openai.com>
pixel_form_with borrowed the comp unchanged when it held only comp markers and no layer
markers, so a lone plain comp marker still reached the disk key. Tests: a lone comp marker
keeps the key; a protected marker with a duration (and its duration) on a stretched precomp's
source changes the key of the comp that nests it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Preset rows (text, built-in and user .ecpreset) were click-only, so dragging
one onto a layer did nothing. They now start a DragPayload::Preset drag with
a ghost, and the Timeline, Composition viewer and Effect Controls apply the
preset to the layer it is dropped on, as they already do for effects and as
After Effects does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A path's vertices and its two tangent arrays deserialize independently,
and nothing on load makes them agree. mask.new pads them, but a path
read from a project file may carry fewer tangents than vertices.
mask.addVertex checked its index against the vertices only and then
inserted into both tangent arrays, and mask.setVertex indexed the
tangent arrays after the same check, so either command panicked on
such a path (Vec insert/index out of bounds).
ShapePath::fit_tangents gives both arrays one entry per vertex (missing
tangents become corners, extras are dropped), and edit_path_counted
calls it on the value it edits, so every mask/shape-path vertex command
works on a consistent path. Other keyframes of an animated path were
already padded by apply_count_op when the vertex count changes.
Tests: two regression tests save a project, cut every mask path's
tangent arrays to one entry (static value and keyframes), reopen it
through Project::from_json and run setVertex and addVertex. Both panic
at mask.rs:209 without the fix.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each checked property now names the panels that must show it: the layer's
Position, Rotation and Opacity in the Timeline and Properties panel, the
Transform effect's in Effect Controls. Every component rectangle is
required, and the painted text must include both numbers of a vector (and
the Timeline's comma), the revolutions, sign and degrees of an angle, and
the number of a scalar. These presence checks run in both themes and after
every expression state change.
Hover now covers all three panels in dark and light themes, and a new test
scrubs Opacity in the Timeline and Effect Controls, confirming a drag is
active before checking the colour. All four tests fail on main.
A property driven by an expression showed its value in the ordinary blue;
After Effects shows it red (refs #1072). Tokens::for_value(expression)
gives the value fields the expression colour (expr_text, dark and light)
for both hot_text and accent_hover, so a hovered or dragged value stays
red. The Timeline's value_editor, Effect Controls' parameter rows and the
Properties panel's transform rows pass these value tokens to their
number and angle fields (and the Timeline's vector separator and plain
enum number), from Property::has_expression() every frame: a disabled,
removed or empty expression is blue again. Names, stopwatches, keyframe
buttons, link icons and dropdowns keep the ordinary tokens. Red means an
expression drives the value, not that it evaluated; errors keep their
own reporting.
Tests (ui_expression_values, reading the painted text colour): a vector
(Position, with its separator), an angle (Rotation, both parts) and a
scalar (Opacity), on the layer and on the Transform effect, are red in
all three panels, in dark and light themes, and Scale (no expression)
stays blue; disabled, removed and whitespace-only expressions are blue
and enabling again is red; a hovered expression value stays red while a
hovered ordinary one takes the hover accent. All three fail without this
change. ui_effect_controls and ui_inline_edit still pass.
The Track Matte menu and pick whip applied to every selected layer,
nulls, cameras and lights included, though their rows have no Track
Matte. A mode chosen for selected solids then went to a selected null
too: at the top of the comp it had no layer above to take as its matte
and the whole change was refused; at the bottom it took the layer above
as its matte and hid it.
Track Matte edits now go to the selected layers that can have a matte
(matte_layers); parenting still includes nulls, cameras and lights.
Tests (ui_batch_links): a selected null on top or at the bottom gets no
matte and changes nothing else; a layer locked with its Lock switch
stays selected and keeps its parent, transform and matte through the
other row's menus and pick whips. Both fail before.
With several layers set at once from one selected row, a selected
layer locked after it was selected (its Lock switch doesn't deselect
it) had its parent, its compensated transform or its matte changed too.
layer.setParent, layer.setTrackMatte and layer.trackMatte now leave
locked layers as they are, the rule the other layer edits follow
(unlocked): among several, the others change; alone, it is an error
that changes nothing. Done in the engine, a layer locked while a pick
whip is being dragged is covered too.
Test: locked_layers_keep_their_parent_and_matte.
Expansion was a fill plus a stroke 2·|expansion| wide, blended per pixel. Once the
expansion passed the shape's curvature radius the stroke's inner edge inverted: a
20 px circle expanded by 60 left a ring with the layer showing through the middle,
+600 cut only the original dot, and negative values left islands. The outline is
now offset with Offset Paths' geometry (round joins) and filled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tylerjenningsw
DWAA1660andClaude Opus 5.5
Kristian MyramandClaude Sonnet 5.5
Marco Arnulfo
iannitramandClaude Opus 5.5
Daniel van LithandClaude Opus 5.5
Fabio LussiandClaude Opus 5.5
ThemolxandClaude Opus 5.5
Moein Saharkhiz
sanyamsingh001andCodex
vangel76andClaude Sonnet 5.5
Lloyd NicholsonandClaude Opus 5.5
zitann2020andDeepSeek V4.1 Flash
Ian-ChegeandClaude Opus 5.5