From 04455c489968f6e47cf791649db736558c8757a7 Mon Sep 17 00:00:00 2001 From: fluid-chey Date: Wed, 4 Nov 2026 12:23:09 -0700 Subject: [PATCH 1/2] M9: joining a live session again merges what you did while disconnected Joining again after a session couldn't go on opened your offline changes in a copy beside the file. They now go on top as one undoable edit, through the three-way merge branches use. The rejoin asks to resume as the same client, so layers made offline are yours to send. What can't go in (the same thing changed both ways, or layers a new client can't make) leaves the server's version, and your whole version opens beside it so nothing is lost. A server that no longer knows you merges the same way instead of discarding unconfirmed work. Co-Authored-By: Claude Opus 5.5 --- crates/engine/src/collab_live_tests.rs | 104 ++++++++++++++++++----- crates/engine/src/live_tests.rs | 7 ++ crates/engine/src/sharing/live.rs | 24 +++--- crates/engine/src/sharing/live/events.rs | 59 +++++++++---- crates/engine/src/sharing/live/join.rs | 2 +- crates/engine/src/sharing/live/sync.rs | 22 ++++- docs/collab-protocol.md | 11 ++- 7 files changed, 175 insertions(+), 54 deletions(-) diff --git a/crates/engine/src/collab_live_tests.rs b/crates/engine/src/collab_live_tests.rs index 6499c1895..f221420dc 100644 --- a/crates/engine/src/collab_live_tests.rs +++ b/crates/engine/src/collab_live_tests.rs @@ -319,9 +319,10 @@ fn a_dropped_connection_keeps_editing_and_catches_up() { } impl Room { - /// Person `i` has been told to join again: the server takes them as someone new. - fn welcome_anew(&mut self, i: usize) { - let ClientMsg::Hello(h) = Client::hello("f", "t", "Person", "") else { panic!("not a hello") }; + /// Person `i` has been told to join again: the server takes them as `resume` says. + fn welcome_as(&mut self, i: usize, resume: Option) { + let ClientMsg::Hello(mut h) = Client::hello("f", "t", "Person", "") else { panic!("not a hello") }; + h.resume = resume; let (id, out) = self.server.join(h).unwrap(); let w = welcome_of(&out, id); let p = &mut self.people[i]; @@ -351,7 +352,7 @@ fn reconnecting_can_be_told_to_try_now_and_shows_as_disconnected() { } #[test] -fn a_session_that_cant_go_on_stays_on_its_tab_and_joins_again_there() { +fn a_session_that_cant_go_on_stays_on_its_tab_and_merges_when_it_joins_again() { let mut room = Room::new(base(), 2, 7); let (f, r) = frame_and_rect(room.server.document()); let uid = room.s(0).ds().unwrap().uid; @@ -363,7 +364,8 @@ fn a_session_that_cant_go_on_stays_on_its_tab_and_joins_again_there() { let live = room.s(0).live(); assert!(live.disconnected() && live.rejoinable() && live.doc_uid == Some(uid)); assert!(room.s(0).live_read_only(uid).is_none()); - room.s(0).execute("node.set", &json!({"id": f, "props": {"name": "Offline too"}})).unwrap(); + let made = room.s(0).execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 5, "height": 5})).unwrap(); + let made = NodeId(made["id"].as_u64().unwrap()); // A try that fails leaves it just as it was. assert_eq!(room.s(0).execute("collab.reconnect", &json!({})).unwrap()["status"], "connecting"); assert!(room.s(0).live().disconnected() && !room.s(0).live().rejoinable()); @@ -371,23 +373,85 @@ fn a_session_that_cant_go_on_stays_on_its_tab_and_joins_again_there() { room.event(0, Event::Status(Status::Failed { reason: "Couldn't join the live session: no answer".into() })); assert!(room.s(0).live().rejoinable()); // Someone else's edit lands meanwhile. - room.s(1).execute("transform.move", &json!({"ids": [r], "dx": 5, "dy": 5})).unwrap(); + room.s(1).execute("transform.move", &json!({"ids": [f], "dx": 5, "dy": 5})).unwrap(); + let theirs = |d: &Document| d.node(f).unwrap().transform; room.settle(); - // The next try joins in the same tab, and what was done offline opens beside it. + let moved = theirs(room.server.document()); + // The next try joins in the same tab, as the same client, and everything goes on top. room.s(0).execute("collab.reconnect", &json!({})).unwrap(); - room.welcome_anew(0); + let resumed = room.people[0].script.lock().unwrap().resumed.expect("as who you were"); + assert_eq!((resumed.client_id, resumed.seq), (room.people[0].id, u64::MAX)); + room.welcome_as(0, Some(resumed)); + room.settle(); + room.check(); let s = room.s(0); assert_eq!(s.live().status, Status::Live); assert!(!s.live().disconnected()); - assert_eq!(s.docs.len(), tabs + 1, "the copy's is the only new tab"); - let (tab, copy) = (s.docs.iter().find(|d| d.uid == uid).unwrap(), s.docs.last().unwrap()); - assert_eq!(s.live().doc_uid, Some(uid)); - assert_ne!(tab.doc.node(r).unwrap().name, "Offline", "the session's tab shows the server's version"); - assert_eq!(copy.doc.name, format!("{} (offline copy)", tab.doc.name)); - assert_eq!(copy.doc.node(r).unwrap().name, "Offline"); - assert_eq!(copy.doc.node(f).unwrap().name, "Offline too"); - assert!(copy.is_dirty(), "closing the copy asks first"); - assert!(s.message.as_deref().is_some_and(|m| m.contains("offline copy"))); + assert_eq!(s.docs.len(), tabs, "no copy: it all went in"); + let doc = room.server.document(); + assert_eq!(doc.node(r).unwrap().name, "Offline"); + assert!(doc.contains(made), "layers you made too"); + assert_eq!(theirs(doc), moved, "and the other edit is still there"); + assert!(room.s(0).message.as_deref().is_some_and(|m| m.contains("is in the file"))); +} + +#[test] +fn the_same_thing_changed_both_ways_keeps_the_others_and_opens_your_version_beside_it() { + let mut room = Room::new(base(), 2, 7); + let (f, r) = frame_and_rect(room.server.document()); + let tabs = room.s(0).docs.len(); + room.disconnect(0); + room.s(0).execute("node.set", &json!({"id": r, "props": {"name": "Mine"}})).unwrap(); + room.s(0).execute("node.set", &json!({"id": f, "props": {"name": "Only mine"}})).unwrap(); + room.event(0, Event::Status(Status::Failed { reason: "gone".into() })); + room.s(1).execute("node.set", &json!({"id": r, "props": {"name": "Theirs"}})).unwrap(); + room.settle(); + room.s(0).execute("collab.reconnect", &json!({})).unwrap(); + let resumed = room.people[0].script.lock().unwrap().resumed; + room.welcome_as(0, resumed); + room.settle(); + room.check(); + let doc = room.server.document(); + assert_eq!(doc.node(r).unwrap().name, "Theirs", "what conflicts isn't written over"); + assert_eq!(doc.node(f).unwrap().name, "Only mine", "what doesn't goes in"); + let s = room.s(0); + assert_eq!(s.docs.len(), tabs + 1); + let copy = s.docs.last().unwrap(); + assert!(copy.doc.name.ends_with("(offline copy)") && copy.is_dirty(), "closing the copy asks first"); + assert_eq!(copy.doc.node(r).unwrap().name, "Mine"); +} + +#[test] +fn layers_the_new_client_cant_make_open_beside_the_file() { + let mut room = Room::new(base(), 1, 7); + let tabs = room.s(0).docs.len(); + room.disconnect(0); + let made = room.s(0).execute("shape.rectangle", &json!({"x": 0, "y": 0, "width": 5, "height": 5})).unwrap(); + let made = NodeId(made["id"].as_u64().unwrap()); + room.event(0, Event::Status(Status::Failed { reason: "gone".into() })); + room.s(0).execute("collab.reconnect", &json!({})).unwrap(); + // The server takes you as someone new. + room.welcome_as(0, None); + room.settle(); + room.check(); + assert!(!room.server.document().contains(made)); + let s = room.s(0); + assert_eq!(s.docs.len(), tabs + 1); + assert!(s.docs.last().unwrap().doc.contains(made), "it isn't lost"); +} + +#[test] +fn a_server_that_forgot_you_keeps_your_offline_edits() { + let mut room = Room::new(base(), 1, 7); + let (_, r) = frame_and_rect(room.server.document()); + room.disconnect(0); + room.s(0).execute("node.set", &json!({"id": r, "props": {"name": "Offline"}})).unwrap(); + // The same file under a new session: it knows no one. + room.server = Server::new(room.server.document().clone(), "t", Limits::default()); + room.welcome_as(0, None); + room.settle(); + assert_eq!(room.server.document().node(r).unwrap().name, "Offline"); + assert_eq!(room.s(0).live().status, Status::Live); } #[test] @@ -399,7 +463,8 @@ fn joining_again_with_nothing_changed_opens_no_copy() { assert!(room.s(0).live().rejoinable(), "the end of a session you were in shows on its tab too"); assert_eq!(room.s(0).message.as_deref(), Some("Sharing was stopped")); room.s(0).execute("collab.reconnect", &json!({})).unwrap(); - room.welcome_anew(0); + let resumed = room.people[0].script.lock().unwrap().resumed; + room.welcome_as(0, resumed); assert_eq!(room.s(0).docs.len(), tabs); assert_eq!(room.s(0).live().status, Status::Live); } @@ -414,7 +479,8 @@ fn a_session_out_of_step_joins_again_by_itself() { assert_eq!(room.s(0).live().status, Status::Connecting); assert!(room.s(0).live().disconnected()); assert_eq!(room.people[0].script.lock().unwrap().joined.len(), joins + 1); - room.welcome_anew(0); + let resumed = room.people[0].script.lock().unwrap().resumed; + room.welcome_as(0, resumed); assert_eq!(room.s(0).live().status, Status::Live); assert_eq!(room.s(0).docs.len(), tabs); } diff --git a/crates/engine/src/live_tests.rs b/crates/engine/src/live_tests.rs index 0b2b7c993..1e2f22f4f 100644 --- a/crates/engine/src/live_tests.rs +++ b/crates/engine/src/live_tests.rs @@ -18,6 +18,8 @@ pub(crate) struct Script { pub(crate) sent: Vec, pub(crate) hosted: Vec, pub(crate) joined: Vec, + /// What the last join asked to resume as. + pub(crate) resumed: Option, /// The sessions told to reconnect now, in order. pub(crate) retried: Vec, pub(crate) left: usize, @@ -48,6 +50,11 @@ impl LiveLink for Mock { i.url = format!("ws://{}/?file=f&token=t", i.address); Ok(i) } + fn join_resuming(&mut self, session: u64, link: &str, name: &str, resume: Option) -> Result<(), String> { + self.0.lock().unwrap().resumed = resume; + self.join(session, link, name) + } + fn retry(&mut self, session: u64) { self.0.lock().unwrap().retried.push(session); } diff --git a/crates/engine/src/sharing/live.rs b/crates/engine/src/sharing/live.rs index b54331520..ef0a7f0ba 100644 --- a/crates/engine/src/sharing/live.rs +++ b/crates/engine/src/sharing/live.rs @@ -152,6 +152,8 @@ struct Stranded { link: String, /// The server's state when it stopped: what's different from it in the tab is your own work. confirmed: Box, + /// Who you were: the layers you made are in that client's id space. + resume: Resume, } impl Live { @@ -170,17 +172,19 @@ impl Live { *self = Live { id: self.id, tab: self.tab, ..Live::default() }; } - /// Keep this session on its tab for joining again (see [`Stranded`]): a session you joined, or - /// one that already is; any other goes back to no session. - fn strand(&mut self) { + /// Remember what joining this session again takes, if it is one you joined (see [`Stranded`]). + fn hold(&mut self) { let joined = self.info.as_ref().filter(|i| i.role == Role::Guest && !i.link.is_empty()); - let held = self.stranded.take().or_else(|| { - let (client, info) = (self.client.as_ref()?, joined?); - Some(Stranded { link: info.link.clone(), confirmed: Box::new(client.confirmed().clone()) }) - }); - if held.is_none() { - return self.reset(); + if let (None, Some(client), Some(info)) = (&self.stranded, &self.client, joined) { + self.stranded = Some(Stranded { link: info.link.clone(), confirmed: Box::new(client.confirmed().clone()), resume: client.resume() }); } + } + + /// Keep this session on its tab for joining again: a session you joined, or one that already + /// is; any other goes back to no session. + fn strand(&mut self) { + self.hold(); + let Some(held) = self.stranded.take() else { return self.reset() }; *self = Live { id: self.id, tab: self.tab, @@ -189,7 +193,7 @@ impl Live { server: std::mem::take(&mut self.server), published: self.published.take(), share: self.share.take(), - stranded: held, + stranded: Some(held), ..Live::default() }; } diff --git a/crates/engine/src/sharing/live/events.rs b/crates/engine/src/sharing/live/events.rs index 5bc94c0f4..86473ea52 100644 --- a/crates/engine/src/sharing/live/events.rs +++ b/crates/engine/src/sharing/live/events.rs @@ -1,8 +1,11 @@ use super::host::{clean_hosting, clean_shared}; +use figcraft_collab::Change; +use figcraft_collab::merge::{self, Side}; + use super::types::{Event, MAX_PEERS, PageInfo, Role, SessionId, SessionInfo, Status}; use super::{ - Access, Arc, Client, ClientMsg, DocState, Document, EngineError, Live, NodeId, PUBLISHING, Peer, Presence, Result, ServerMsg, Session, Signal, - ToolId, display_name, editing_hint, editing_of, limited_by, sanitize, tool_left, + Access, Arc, Client, ClientMsg, DocState, Document, EngineError, Live, NodeId, PUBLISHING, Peer, Presence, Result, Resume, ServerMsg, Session, + Signal, ToolId, display_name, editing_hint, editing_of, limited_by, sanitize, tool_left, }; /// What a live session's document holding components that contain each other's instances shows @@ -371,11 +374,12 @@ impl Session { /// Session `id`'s welcome: start the sync client; the host keeps editing the document it /// shared, a guest opens the host's file as a new tab (or gets it again in that tab after a /// reconnect). - fn live_welcome(&mut self, id: SessionId, welcome: ServerMsg) { - let client = match Client::join(welcome) { + pub(super) fn live_welcome(&mut self, id: SessionId, welcome: ServerMsg) { + let mut client = match Client::join(welcome) { Ok(c) => c, Err(e) => return self.live_fail(id, format!("Couldn't open the shared file: {e}")), }; + let mut merged = None; let Some(live) = self.live.sessions.get(&id) else { return }; let existing = live.doc_uid.filter(|u| self.docs.iter().any(|d| d.uid == *u)); let (uid, synced) = match (live.role(), existing) { @@ -396,7 +400,7 @@ impl Session { } (Some(Role::Guest), Some(uid)) => { // Joining again in this tab, or the file you published arriving from the server. - self.live_keep_offline_work(id, uid); + merged = self.live_merge_offline_work(id, uid, &mut client); let doc = Arc::new(client.document().clone()); let was_dirty = self.docs.iter().find(|d| d.uid == uid).is_some_and(DocState::is_dirty); self.apply_remote(uid, doc.clone()); @@ -444,31 +448,50 @@ impl Session { live.client = Some(client); live.deferred.clear(); live.stranded = None; + self.live.send(id, merged); } /// Session `id` is back on document `uid` after it couldn't go on, and the server's version is - /// about to replace the tab's: what you did since opens beside it, unsaved, so nothing is lost. - fn live_keep_offline_work(&mut self, id: SessionId, uid: u64) { - let Some(held) = self.live.sessions.get(&id).and_then(|l| l.stranded.as_ref()) else { return }; - let Some(local) = self.docs.iter().find(|d| d.uid == uid).map(|d| d.doc.clone()) else { return }; + /// about to replace the tab's: what you did since goes on top of it as one edit of `client`, + /// returned to send, the way two people's edits merge. What can't (the same thing changed both + /// ways, or layers `client` can't make) leaves the server's as it is, and your whole version opens + /// beside it, unsaved, so nothing is lost. + fn live_merge_offline_work(&mut self, id: SessionId, uid: u64, client: &mut Client) -> Option { + let held = self.live.sessions.get(&id)?.stranded.as_ref()?; + let local = self.docs.iter().find(|d| d.uid == uid)?.doc.clone(); let name = local.name.clone(); - // A document that can't be compared is kept too. - if figcraft_collab::diff(&held.confirmed, &local).is_ok_and(|d| d.changes.is_empty()) { + let plan = merge::plan(held.confirmed.document(), &local, client.document()).ok(); + let mine = plan.as_ref().map(|p| p.changes(Side::Branch)); + if mine.is_some_and(<[Change]>::is_empty) { self.message = Some(format!("Reconnected to {name}")); - return; + return None; + } + let me = u64::from(client.id()); + let own = mine.is_some_and(|m| m.iter().all(|c| !matches!(c, Change::Create { id, .. } if id.0 >> 32 != me))); + let merged = plan.as_ref().filter(|_| own).and_then(|p| p.merge(client.document(), Side::Branch, &|_| Some(Side::Main)).ok()); + let sent = merged.and_then(|(mut doc, touched)| { + doc.mark_dirty(touched); + client.edit_with(&doc, Some("Changes made while disconnected")).ok() + }); + if sent.is_some() && plan.is_some_and(|p| p.conflicts.is_empty()) { + self.message = Some(format!("Reconnected to {name}. What you changed while disconnected is in the file")); + return sent.flatten(); } let mut copy = DocState::new((*local).clone(), None); let copy_name = format!("{name} (offline copy)"); Arc::make_mut(&mut copy.doc).name.clone_from(©_name); self.docs.push(copy); - self.message = Some(format!("Reconnected to {name}. What you changed while disconnected is open beside it as “{copy_name}”")); + self.message = Some(format!( + "Reconnected to {name}. Some of what you changed while disconnected couldn't go in: your whole version is open beside it as “{copy_name}”" + )); + sent.flatten() } - /// Join session `id` again in its tab (see [`Live::strand`]), as someone new: a fresh join needs - /// nothing from the connection that was lost. + /// Join session `id` again in its tab (see [`Live::strand`]): nothing is needed from the + /// connection that was lost. pub(super) fn live_rejoin(&mut self, cmd: &str, id: SessionId) -> Result<()> { let name = display_name(&self.prefs); - let Some(link) = self.live.sessions.get(&id).and_then(|l| l.stranded.as_ref()).map(|s| s.link.clone()) else { + let Some((link, resume)) = self.live.sessions.get(&id).and_then(|l| l.stranded.as_ref()).map(|s| (s.link.clone(), s.resume)) else { return Err(crate::bad(cmd, "this file has no live session to join again")); }; self.live.leave(id); @@ -476,7 +499,9 @@ impl Session { return Err(EngineError::Disabled(cmd.to_string(), why)); } let Some(net) = self.live.link() else { return Err(super::unavailable(cmd)) }; - net.join_resuming(id, &link, &name, None).map_err(|e| crate::bad(cmd, e))?; + // As the client you were when the server still knows it, so the layers you made are yours to + // send; the whole document is asked for (no change is "after" this number). + net.join_resuming(id, &link, &name, Some(Resume { seq: u64::MAX, ..resume })).map_err(|e| crate::bad(cmd, e))?; if let Some(live) = self.live.sessions.get_mut(&id) { live.status = Status::Connecting; } diff --git a/crates/engine/src/sharing/live/join.rs b/crates/engine/src/sharing/live/join.rs index 75ade0c80..c1b8d9e22 100644 --- a/crates/engine/src/sharing/live/join.rs +++ b/crates/engine/src/sharing/live/join.rs @@ -213,7 +213,7 @@ pub fn specs() -> Vec { spec!( "collab.reconnect", "Reconnect live session", - "{} → {status}: for the open file's session when it is disconnected: a reconnect that is waiting tries now, and a session that couldn't go on (`failed`, the file open in its tab) is joined again there, what you changed since opening beside it. Refused when nothing was lost", + "{} → {status}: for the open file's session when it is disconnected: a reconnect that is waiting tries now, and a session that couldn't go on (`failed`, the file open in its tab) is joined again there, what you changed since going on top (your whole version opening beside it when some of it can't). Refused when nothing was lost", false, reconnect ), diff --git a/crates/engine/src/sharing/live/sync.rs b/crates/engine/src/sharing/live/sync.rs index 0930151dc..576ee501b 100644 --- a/crates/engine/src/sharing/live/sync.rs +++ b/crates/engine/src/sharing/live/sync.rs @@ -1,8 +1,8 @@ use super::host::hosting_json; use super::types::{NO_SESSION, SessionId, Share, SharedLink, Status}; use super::{ - Access, Arc, Client, EditingText, EngineError, EngineRecompute, FollowedView, Live, Result, Session, Value, ViewState, bad, busy, close, code, - editing_of, json, + Access, Arc, Client, EditingText, EngineError, EngineRecompute, FollowedView, Live, Result, ServerMsg, Session, Value, ViewState, bad, busy, + close, code, editing_of, json, }; impl Session { @@ -115,7 +115,23 @@ impl Session { let Some(live) = self.live.sessions.get_mut(&id) else { return }; let Some(client) = live.client.as_mut() else { return }; let mut out = Vec::new(); - for m in std::mem::take(&mut live.deferred) { + let mut waiting = std::mem::take(&mut live.deferred).into_iter(); + while let Some(m) = waiting.next() { + // The server no longer knows this client (it restarted without its saved state, say): + // it welcomed you as someone new. What you did goes on top like after any rejoin. + if let ServerMsg::Welcome { session, client_id, .. } = &m { + let me = client.resume(); + if (*session, *client_id) != (me.session, me.client_id) { + live.hold(); + live.client = None; + let rest: Vec<_> = waiting.collect(); + self.live_welcome(id, m); + if let Some(live) = self.live.sessions.get_mut(&id) { + live.deferred = rest; + } + return; + } + } match client.receive(m, &EngineRecompute) { Ok(more) => out.extend(more), Err(e) => { diff --git a/docs/collab-protocol.md b/docs/collab-protocol.md index 9852a1686..79ea13763 100644 --- a/docs/collab-protocol.md +++ b/docs/collab-protocol.md @@ -546,10 +546,13 @@ resuming with its offline edits, and leaving the session going back to snapshot - Disconnected: while it reconnects, and after it can't go on, the tab shows a red mark and a strip across the top of the canvas says so, with **Retry now** (`collab.reconnect`). The tab can still be edited. A session you joined that ended stays on its tab with **Try again**, **Save a copy…** - and **Dismiss** (`collab.leave`). **Try again** joins it in the same tab as someone new; if the - tab changed since it lost the server, what changed opens beside it as an unsaved - "offline copy" and the tab shows the server's version. A session that gets out of step does the - same by itself. A reconnect resumes as the same + and **Dismiss** (`collab.leave`). **Try again** joins it in the same tab, as the same client when + the server still knows it, and what changed since it lost the server goes on top as one undoable + edit, through the three-way merge of `crates/collab/src/merge.rs`. The same thing changed both + ways keeps the other person's, and layers a new client can't make aren't sent; in those cases + your whole version also opens beside it as an unsaved "offline copy", so nothing is lost. A + session that gets out of step, or a server that no longer knows you, does the same by itself. A + reconnect resumes as the same client: the guest's connection keeps the session id, client id and last sequence number from the messages it read and sends them in its next `Hello` (see Offline and reconnect). - The browser build joins and publishes to a server (see *Built (the browser client)*); hosting From b28edd3c7a904c1653e5857cc54345d84ff2f2ad Mon Sep 17 00:00:00 2001 From: fluid-chey Date: Wed, 4 Nov 2026 12:49:13 -0700 Subject: [PATCH 2/2] M9: record the offline merge in the collaboration status Co-Authored-By: Claude Opus 5.5 --- docs/collaboration-parity.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/collaboration-parity.md b/docs/collaboration-parity.md index 6c4aa9340..ff13dce70 100644 --- a/docs/collaboration-parity.md +++ b/docs/collaboration-parity.md @@ -1,6 +1,6 @@ # Collaboration parity -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** minor (M9: a joined live session reconnects until you leave and says when it is disconnected, with a red tab mark and a strip across the canvas; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); `figcraft-server` checks the server key by comparing SHA-256 digests, not the raw keys (#1130); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; `comment.list {mentions}` lists only the threads that @mention a name (#1415); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); an AI agent attached over MCP shows where it works (#1416); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); comment.list reports each message's @mentions (#1415); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); a refused batch's fixes take time linear in the batch (#1063); image entries are checked as they apply; branches in live sessions and branch history entries; server message limits follow `max_file_mb`; a damaged log generation field keeps flushed edits; the web build joins from a `#join=` link; removing someone from a live session; live-session revert guard; live sessions per document; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; cursor chat and spotlight in live sessions; branch version history and finer list merges; comments and version history behaviour suite and fixes; hosting the server: `wss://` in the desktop app, server releases, deployment guide; team libraries on the server and swap library; branches: create, update from main, review and merge; wording: the standalone server with share links to edit or view; numbers unchanged) · **Target:** Figma Design (desktop app 126.10.7) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** minor (M9: a joined live session reconnects until you leave and says when it is disconnected, and joining it again merges what you did while disconnected; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); `figcraft-server` checks the server key by comparing SHA-256 digests, not the raw keys (#1130); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; `comment.list {mentions}` lists only the threads that @mention a name (#1415); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); an AI agent attached over MCP shows where it works (#1416); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); comment.list reports each message's @mentions (#1415); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); a refused batch's fixes take time linear in the batch (#1063); image entries are checked as they apply; branches in live sessions and branch history entries; server message limits follow `max_file_mb`; a damaged log generation field keeps flushed edits; the web build joins from a `#join=` link; removing someone from a live session; live-session revert guard; live sessions per document; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; cursor chat and spotlight in live sessions; branch version history and finer list merges; comments and version history behaviour suite and fixes; hosting the server: `wss://` in the desktop app, server releases, deployment guide; team libraries on the server and swap library; branches: create, update from main, review and merge; wording: the standalone server with share links to edit or view; numbers unchanged) · **Target:** Figma Design (desktop app 126.10.7) Figma is multiplayer first; FigCraft is local first. **Ready ~13% (estimated):** comments, version history and branches (review and merge) work inside one file; the real-time collaboration core landed in #103 (sync model, @@ -12,7 +12,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla | Feature | Figma | FigCraft | Hours | |---|---|---|---| -| Real-time co-editing | yes | **core built, no networking** (#103): client-scoped ids, per-property change sets with fractional positions, server ordering and validation, optimistic clients, binary messages; randomized multi-client convergence tests over real commands. Live sessions over the network landed (`crates/collab-net`): the WebSocket transport (keep-alive, size and rate limits, a live connection reconnecting until you leave), hosting from the app (this machine or the local network) with invite links, live cursors with name tags, selections, avatars and follow, `collab.*` commands. Document sync between apps works over them (the host's server orders every batch; guests open the host's file as a new tab). Sessions are per document: each open file has its own or none, several run at once (host one, join another, publish a third) and keep syncing behind the tab in front, and closing a file ends its session only. Revert to saved is refused until the document leaves its live session; its access checks and sync association stay intact. Undo is per person (only your own steps, others' later writes left alone), refused edits roll back with a toast, and a reconnect resumes as the same client with what it missed (or a snapshot) and sends what was made offline. The browser build joins (same messages through the browser's WebSocket API); `figcraft://` invite links open the desktop app and join. Styles, variables, collections, modes and comments made in a session take ids from their creator's space (the server checks it), so concurrent creations all survive; modes, per-mode values and replies inside one entry still resolve last-writer-wins. A standalone `figcraft-server` keeps many files, persists them (a snapshot plus a log, compacted), loses nothing confirmed across a restart (apps resume as the same participants) and takes files published from the app (File ▸ Publish to server…). The desktop app and the CLI open `wss://` links too (TLS through a reverse proxy), and releases ship the server for Linux with a deployment guide (systemd, Caddy, nginx, Docker) and `install.sh`. A server can be open to the public: anyone publishes without the key, within limits per address, and files nobody opens expire. Message limits follow the server's `max_file_mb`, so files above 64 MiB publish and open (the client takes at most 1 GiB from a server, and the server warns when large limits meet open publishing, #705); a damaged generation field in a file's log no longer drops the edits flushed to it (#687). Image entries are checked as they apply: a key must be a plain name (letters, digits, `-`, `_`; it becomes `images/` in a saved file), bytes under a content-hash key must hash to it (lowercase sha256), a side is at most 65 535 px and the decoded bytes at most 256 MiB (what the importers read), a key's bytes can't be replaced and an image a layer shows can't be removed, so no collaborator can poison the shared image store or balloon memory; snapshots and server logs from before these checks open without the images they refuse (#1086). The batches kept for apps that reconnect are bounded in bytes by default (64 MiB; `max_log_mb` on `figcraft-server`), and an app further behind catches up with a snapshot (#1069). Placing a layer among its siblings is a binary search, so large pastes and reorders in one batch no longer take quadratic time (#1065). A refused batch's fixes take time linear in the batch: each deleted layer is restored once and each entry fix looked up once (#1063). Left: server archives beyond Linux | 25–55 | +| Real-time co-editing | yes | **core built, no networking** (#103): client-scoped ids, per-property change sets with fractional positions, server ordering and validation, optimistic clients, binary messages; randomized multi-client convergence tests over real commands. Live sessions over the network landed (`crates/collab-net`): the WebSocket transport (keep-alive, size and rate limits, a live connection reconnecting until you leave, and rejoining with offline edits merged), hosting from the app (this machine or the local network) with invite links, live cursors with name tags, selections, avatars and follow, `collab.*` commands. Document sync between apps works over them (the host's server orders every batch; guests open the host's file as a new tab). Sessions are per document: each open file has its own or none, several run at once (host one, join another, publish a third) and keep syncing behind the tab in front, and closing a file ends its session only. Revert to saved is refused until the document leaves its live session; its access checks and sync association stay intact. Undo is per person (only your own steps, others' later writes left alone), refused edits roll back with a toast, and a reconnect resumes as the same client with what it missed (or a snapshot) and sends what was made offline. The browser build joins (same messages through the browser's WebSocket API); `figcraft://` invite links open the desktop app and join. Styles, variables, collections, modes and comments made in a session take ids from their creator's space (the server checks it), so concurrent creations all survive; modes, per-mode values and replies inside one entry still resolve last-writer-wins. A standalone `figcraft-server` keeps many files, persists them (a snapshot plus a log, compacted), loses nothing confirmed across a restart (apps resume as the same participants) and takes files published from the app (File ▸ Publish to server…). The desktop app and the CLI open `wss://` links too (TLS through a reverse proxy), and releases ship the server for Linux with a deployment guide (systemd, Caddy, nginx, Docker) and `install.sh`. A server can be open to the public: anyone publishes without the key, within limits per address, and files nobody opens expire. Message limits follow the server's `max_file_mb`, so files above 64 MiB publish and open (the client takes at most 1 GiB from a server, and the server warns when large limits meet open publishing, #705); a damaged generation field in a file's log no longer drops the edits flushed to it (#687). Image entries are checked as they apply: a key must be a plain name (letters, digits, `-`, `_`; it becomes `images/` in a saved file), bytes under a content-hash key must hash to it (lowercase sha256), a side is at most 65 535 px and the decoded bytes at most 256 MiB (what the importers read), a key's bytes can't be replaced and an image a layer shows can't be removed, so no collaborator can poison the shared image store or balloon memory; snapshots and server logs from before these checks open without the images they refuse (#1086). The batches kept for apps that reconnect are bounded in bytes by default (64 MiB; `max_log_mb` on `figcraft-server`), and an app further behind catches up with a snapshot (#1069). Placing a layer among its siblings is a binary search, so large pastes and reorders in one batch no longer take quadratic time (#1065). A refused batch's fixes take time linear in the batch: each deleted layer is restored once and each entry fix looked up once (#1063). Left: server archives beyond Linux | 25–55 | | Live cursors, selections, viewports; follow / observation mode; spotlight | yes | **done, in live sessions**: named cursors (one name for live sessions and comments: Preferences ▸ Your name, also in the Share popover and the Join dialog, kept in the browser too; a rename shows at once in the sessions you're in, #1380), selection outlines, avatars (an AI agent attached over MCP also shows its avatar and an outline around the layers it last edited or selected while it works, in or out of a session, #1416), follow (click an avatar), others' text carets and selected characters with their names, a note when two people type in one layer; spotlight (your avatar's menu, `collab.spotlight`): everyone follows your view and page, people who join later too, anyone who moves their view stops following and a banner offers to follow again, a newer spotlight takes over. Left: polish (no accounts, so anyone in the session can spotlight) | 2–4 | | Cursor chat, audio, high-fives | yes | **partial, in live sessions**: cursor chat (`/` opens a bubble at your pointer; everyone sees it as you type, it fades a few seconds after the last change, Enter sends and Escape takes it back, 100 characters; `collab.cursorChat` for agents); sent as ephemeral presence the host checks and rate-limits, never stored. No audio, high-fives or emote reactions | 2–5 | | Share links, permissions (view / edit), teams and projects | yes | **partial**: sharing with a join code from the Share popover (online: the file goes to the server in Preferences and the server names its edit, comment and view links with short codes; local network: the app hosts and the code carries its address; one field joins with a code or a link, in the popover and on the home screen, and the Join dialog then shows the join until its file is ready (Cancel), or why it failed (Try again, #1381); the browser build also joins from a link in its URL's fragment, `#join=…`, which never reaches the web host's logs, capped at 6 KiB and checked like a `figcraft://` link (#712; unit-tested, not run in a browser), and shares online and publishes to a server as the desktop app does, though not on the local network (#917; the owner token of a file it puts on an open server lasts as long as the page)); `figcraft-server` share links per file with edit, comment or view access (a viewer sees changes and presence, a "View only" badge and only the moving tools; a commenter also adds, replies to, reacts to and resolves comment threads, with a "Can comment" badge and the comment tool, #1525; the server refuses their other edits), revocable at once, tokens stored as hashes; managed from the app's Share popover (first links), the server's command line or a managing connection. On a server open to the public, whoever published a file manages it with its owner token (links, name, removal: `collab.manageFile`), which the app remembers: Home ▸ Online lists your online files (open again as owner, start and stop sharing, copy the code, rename, remove, forget), with one request per server for what became of them; anyone in a file can report it, and the operator blocks addresses. The person hosting a session, or a file's owner, removes someone from it (right-click their avatar, `collab.removePerson`): they are disconnected and their address can't join that file again while it runs. The list is per computer; a server only a team reaches can also list the files shared from it now for everyone (`team_files`): Home ▸ Online shows that team list for the server in Preferences, a row joins its file, and its links (`figcraft://join?server=…&file=…&team=1`, or the browser build's) carry no secret and stop working with the share. No accounts, teams or projects | 8–17 | @@ -26,7 +26,8 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla | Date | Change | Summary | |---|---|---| -| 2026-11-04 | minor | M9: a session you joined no longer turns into a local file by itself. A dropped connection reconnects until you leave (a minute's pause after each 12 attempts, a pause Retry now skips); only refusals that are for good stop it; queued messages go out paced. While disconnected the tab shows a red mark and a strip across the canvas says so; a session that ended stays on its tab with Try again, Save a copy and Dismiss, and what changed offline opens beside it when it joins again | +| 2026-11-04 | minor | M9: a session you joined no longer turns into a local file by itself. A dropped connection reconnects until you leave (a minute's pause after each 12 attempts, a pause Retry now skips); only refusals that are for good stop it; queued messages go out paced. While disconnected the tab shows a red mark and a strip across the canvas says so; a session that ended stays on its tab with Try again, Save a copy and Dismiss | +| 2026-11-04 | minor | M9: joining a session again merges what you did while disconnected as one undoable edit, through the three-way merge branches use, as the same client when the server still knows it. What conflicts keeps the other person's, and your whole version opens beside it as an unsaved copy. A server that no longer knows you merges the same way instead of discarding unconfirmed work | | 2026-10-31 | patch | M9, #1665: the document in a live session's welcome goes compressed (deflate) to clients whose hello announces `packed`, about seven times smaller on the wire (a synthetic file of 4,040 layers: 397 KB to 53 KB); older clients keep getting it uncompressed, and the client reads a packed document only up to the size an uncompressed welcome could have had. | | 2026-10-30 | minor | M9, part of #742: a team list on `figcraft-server`. With `team_files = "edit"` (or `comment`, `view`) everyone who reaches the server sees the files shared from it now (a link of theirs has a join code: Share ▸ Start sharing) and joins them by a team list link, `figcraft://join?server=…&file=…&team=1`, which carries no secret: the server hands out the file's team link while it stays shared (`ResolveTeam`, answered like a join code), and Stop sharing revokes it with the others, disconnecting whoever joined with it. Turning the list off or changing its access refuses the old team links at once. `collab.files {refresh}` asks the server in Preferences for its list (`Admin::Team`; not the public server FigCraft ships with), and Home ▸ Online shows it below your own files: a row joins its file, its menu copies the link for the app or, with the server's `web_url`, for the browser build (`#join=…`). A browser build served beside its server names it with ``, the page's default for sharing, codes and the team list. No accounts: the list is for a server only your team reaches. Tests: `team_tests` (the server and apps over loopback), `code_tests` (links and the browser's driver), `online_tests` (the Online section), `query_tests` (the page's server). Percentages and hours unchanged | | 2026-10-30 | minor | M9, #1130: `figcraft-server` compares the SHA-256 digests of the presented and the kept server key instead of the raw strings, as `docs/server.md` says; the key file, `figcraft-server key` and rotation are unchanged. Numbers unchanged. |