From e39e563408aa64b89be507326dd68aabdb25cb68 Mon Sep 17 00:00:00 2001 From: samhyun Date: Sun, 1 Nov 2026 18:21:00 +0900 Subject: [PATCH 01/36] M8: dots halfway between pixels stay put across pans, bands and patches The board's dot grid puts each mark on the device pixel nearest its page position, measured from the view's top-left. At a zoom of 1.0625 a step of 24 is 25.5 pixels, so every second mark falls halfway between two pixels, and a view a whole number of pixels on could put it on the other one: `round` sends halves away from zero, so a mark left of the view's origin went left and one right of it went right, and the origin `(px + offset) / scale` reached the half with another rounding error. A pan moved those marks by a pixel (up to 123 levels off). Positions are now rounded to 1/65536 px and then half up. Co-Authored-By: Claude Opus 5.5 --- crates/render/src/dots.rs | 11 ++++++++++- crates/render/src/dots_tests.rs | 24 ++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/crates/render/src/dots.rs b/crates/render/src/dots.rs index b13cbdd57..f3effd1f1 100644 --- a/crates/render/src/dots.rs +++ b/crates/render/src/dots.rs @@ -57,7 +57,7 @@ pub(crate) fn draw(pix: &mut Pixmap, view: &View, d: &Dots) { let strong = |k: i64| k.rem_euclid(major) == 0; // The device-pixel span of the mark on line `k` along an axis `len` pixels long from `o`. let span = |k: i64, o: f64, len: i64| { - let a = ((k as f64 * d.step * s - o).round() as i64).saturating_sub(lead); + let a = (nearest_px(k as f64 * d.step * s - o) as i64).saturating_sub(lead); (a.max(0), a.saturating_add(side).min(len)) }; let row = w as usize * 4; @@ -92,6 +92,15 @@ pub(crate) fn draw(pix: &mut Pixmap, view: &View, d: &Dots) { } } +/// The device pixel nearest `p` pixels from the view's top-left. A mark halfway between two pixels +/// goes to the right (or lower) one on either side of the origin, and `p` is first rounded to +/// 1/65536 px: a view a whole number of pixels off (a pan, a band, a patch) reaches it with another +/// rounding error, and would otherwise put the marks that fall halfway on the other pixel. +fn nearest_px(p: f64) -> f64 { + const STEPS: f64 = 65_536.0; + ((p * STEPS).round() / STEPS + 0.5).floor() +} + /// Which line covers each device pixel along an axis: 0 none, 1 a faded one, 2 a strong one. type Cover = Vec; diff --git a/crates/render/src/dots_tests.rs b/crates/render/src/dots_tests.rs index 53d052062..a5ff2edc9 100644 --- a/crates/render/src/dots_tests.rs +++ b/crates/render/src/dots_tests.rs @@ -134,3 +134,27 @@ fn graph_paper_is_strong_every_major_line() { assert_eq!(at(x, -195), strong, "a strong line at {x}"); } } + +/// At a zoom of 1.0625, a step of 24 is 25.5 pixels: every second dot falls halfway between two +/// pixels. A view a whole number of pixels on (a pan, a band, a patch) has to put it on the same +/// one, on whichever side of that view's origin it is. +#[test] +fn dots_halfway_between_pixels_stay_put() { + let (d, page) = page_with_square(); + for lines in [false, true] { + let opts = Options { dots: Some(Dots { lines, ..dots() }), ..Default::default() }; + let s = 1.0625; + let full = View { origin: (0.0, 0.0), scale: s, width: 400, height: 300 }; + let a = render_view_single(&d, page, &full, &opts).unwrap(); + for dx in 1..100u32 { + let dy = (dx * 37) % 100; + let v = View { origin: (f64::from(dx) / s, f64::from(dy) / s), scale: s, width: 250, height: 180 }; + let b = render_view_single(&d, page, &v, &opts).unwrap(); + for y in 0..180 { + for x in 0..250 { + assert_eq!(rgba(&b, x, y), rgba(&a, x + dx, y + dy), "lines {lines}, a pan by ({dx}, {dy}), at {x}, {y}"); + } + } + } + } +} From a46e2369bcd86afa8f8c859f6e914250606d4a40 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Max=20Mittelst=C3=A4dt?= <62167861+TheGalitube@users.noreply.github.com> Date: Sun, 1 Nov 2026 09:31:20 +0000 Subject: [PATCH 02/36] Preserve finite values at large rounding precision Found while testing crates/geom/src/transform.rs:59 Co-Authored-By: GPT-5.6-Luna Co-Authored-By: GPT-6-Luna --- crates/geom/src/tests.rs | 7 +++++++ crates/geom/src/transform.rs | 3 +++ 2 files changed, 10 insertions(+) diff --git a/crates/geom/src/tests.rs b/crates/geom/src/tests.rs index 37e6ccab7..509db9779 100644 --- a/crates/geom/src/tests.rs +++ b/crates/geom/src/tests.rs @@ -163,6 +163,13 @@ fn set_rotation_keeps_center() { } } +#[test] +fn round_to_handles_large_precision_without_changing_finite_values() { + assert_eq!(round_to(1.25, 400), 1.25); + assert_eq!(round_to(-1.25, 400), -1.25); + assert_eq!(round_to(1.23456, 2), 1.23); +} + #[test] fn reverse_subpaths_preserves_open_and_closed() { let mut open = BezPath::new(); diff --git a/crates/geom/src/transform.rs b/crates/geom/src/transform.rs index f992060fd..69c6c788d 100644 --- a/crates/geom/src/transform.rs +++ b/crates/geom/src/transform.rs @@ -57,6 +57,9 @@ pub fn rotate_about(xf: Affine, pivot: Point, degrees: f64) -> Affine { /// Round a value to `digits` decimals for display (avoids `-0` and float noise). pub fn round_to(v: f64, digits: i32) -> f64 { let f = 10f64.powi(digits); + if v.is_finite() && !f.is_finite() { + return v; + } let r = (v * f).round() / f; if r == 0.0 { 0.0 } else { r } } From c8f34acc59052e6d3482396866bae670a5a93e05 Mon Sep 17 00:00:00 2001 From: samhyun Date: Sun, 1 Nov 2026 18:40:05 +0900 Subject: [PATCH 03/36] M8: dots on the 1/65536 px rounding step stay put too Review of #1796: rounding a mark's position to 1/65536 px with `round` sent the halves of that step away from zero, the asymmetry the PR set out to remove, one step further down. At a step of 25.5 - 2^-17 px, a pan by 26 pixels put the first mark a pixel off a full render. Both roundings now go half up. Co-Authored-By: Claude Opus 5.5 --- crates/render/src/dots.rs | 11 ++++++----- crates/render/src/dots_tests.rs | 22 ++++++++++++++++++++++ 2 files changed, 28 insertions(+), 5 deletions(-) diff --git a/crates/render/src/dots.rs b/crates/render/src/dots.rs index f3effd1f1..5d4ae1fc1 100644 --- a/crates/render/src/dots.rs +++ b/crates/render/src/dots.rs @@ -92,13 +92,14 @@ pub(crate) fn draw(pix: &mut Pixmap, view: &View, d: &Dots) { } } -/// The device pixel nearest `p` pixels from the view's top-left. A mark halfway between two pixels -/// goes to the right (or lower) one on either side of the origin, and `p` is first rounded to -/// 1/65536 px: a view a whole number of pixels off (a pan, a band, a patch) reaches it with another -/// rounding error, and would otherwise put the marks that fall halfway on the other pixel. +/// The first device pixel of a mark whose edge is `p` pixels from the view's top-left: the one +/// whose left (or top) edge is nearest, and the right (or lower) one when two are as near. `p` is +/// first rounded to 1/65536 px, halves up as well: a view a whole number of pixels off (a pan, a +/// band, a patch) reaches it with another rounding error, and, rounded either way, would put the +/// marks that fall halfway on the other pixel. fn nearest_px(p: f64) -> f64 { const STEPS: f64 = 65_536.0; - ((p * STEPS).round() / STEPS + 0.5).floor() + ((p * STEPS + 0.5).floor() / STEPS + 0.5).floor() } /// Which line covers each device pixel along an axis: 0 none, 1 a faded one, 2 a strong one. diff --git a/crates/render/src/dots_tests.rs b/crates/render/src/dots_tests.rs index a5ff2edc9..18d96345f 100644 --- a/crates/render/src/dots_tests.rs +++ b/crates/render/src/dots_tests.rs @@ -158,3 +158,25 @@ fn dots_halfway_between_pixels_stay_put() { } } } + +/// A mark that rounds to a half step of 1/65536 px goes the same way on both sides of a view's +/// origin too: at a step of 25.5 − 2⁻¹⁷ px, the first mark is where 1/65536 px rounds up. +#[test] +fn dots_on_the_rounding_step_stay_put() { + let (d, page) = page_with_square(); + let step = 25.5 - 2f64.powi(-17); + for lines in [false, true] { + let opts = Options { dots: Some(Dots { step, lines, ..dots() }), ..Default::default() }; + let full = View { origin: (0.0, 0.0), scale: 1.0, width: 300, height: 200 }; + let a = render_view_single(&d, page, &full, &opts).unwrap(); + for pan in 1..60u32 { + let v = View { origin: (f64::from(pan), f64::from(pan)), scale: 1.0, width: 200, height: 120 }; + let b = render_view_single(&d, page, &v, &opts).unwrap(); + for y in 0..120 { + for x in 0..200 { + assert_eq!(rgba(&b, x, y), rgba(&a, x + pan, y + pan), "lines {lines}, a pan by {pan}, at {x}, {y}"); + } + } + } + } +} From 3f7f5f38ce985132d64b0b803fb96b83654fb86c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Max=20Mittelst=C3=A4dt?= <62167861+TheGalitube@users.noreply.github.com> Date: Sun, 1 Nov 2026 10:09:26 +0000 Subject: [PATCH 04/36] Reject overflowing u32 varints Found while testing crates/format/src/fig/kiwi.rs:190 Co-Authored-By: GPT-5.6-Luna Co-Authored-By: GPT-6-Luna --- crates/format/src/fig/kiwi.rs | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/crates/format/src/fig/kiwi.rs b/crates/format/src/fig/kiwi.rs index d34b3774d..c564e445d 100644 --- a/crates/format/src/fig/kiwi.rs +++ b/crates/format/src/fig/kiwi.rs @@ -187,9 +187,13 @@ impl<'b> Reader<'b> { let mut shift = 0; loop { let b = self.byte()?; - value |= u32::from(b & 127).checked_shl(shift).unwrap_or(0); + let part = b & 127; + if shift == 28 && (part > 0x0f || b & 128 != 0) { + return err("u32 varint overflow"); + } + value |= u32::from(part) << shift; shift += 7; - if b & 128 == 0 || shift >= 35 { + if b & 128 == 0 { return Ok(value); } } @@ -640,3 +644,17 @@ fn numbered(token: &str, default: u32) -> Result<(String, u32), KiwiError> { Some((name, n)) => Ok((name.to_string(), n.parse().map_err(|_| KiwiError(format!("schema text: bad number in `{token}`")))?)), } } + +#[cfg(test)] +mod tests { + use super::Reader; + + #[test] + fn overflowing_u32_varint_is_rejected() { + let mut boundary = Reader { data: &[0xff, 0xff, 0xff, 0xff, 0x0f], pos: 0 }; + assert_eq!(boundary.var_uint(), Ok(u32::MAX)); + + let mut overflowing = Reader { data: &[0xff, 0xff, 0xff, 0xff, 0x7f], pos: 0 }; + assert!(overflowing.var_uint().is_err(), "overflowing u32 varint was accepted"); + } +} From 8c93d0559fbb70d4b9478e286a506cf9abe6447d Mon Sep 17 00:00:00 2001 From: samhyun Date: Sun, 1 Nov 2026 19:03:53 +0900 Subject: [PATCH 05/36] M8: dots quantize their position apart from the view's origin Review of #1796: quantizing the mark's distance from the view's corner took in the error of the view's origin converted to pixels, so a mark one 1/65536 px step short of a half could still cross it. At a step of 24 and a zoom of (75.5 - 2^-17) / 24, a pan by 51 pixels moved the first mark. The mark's position and the origin are now each quantized before the one is taken from the other. The origin rounds its halves down: some 4 x 10^10 pixels out, its error is exactly half a step, and rounded up it moved the marks again. Past 2^37 pixels the step is finer than f64 and values are used as they are, so huge ones no longer overflow to infinity and come out as a mark at the view's corner. Co-Authored-By: Claude Opus 5.5 --- crates/render/src/dots.rs | 22 +++++++++----- crates/render/src/dots_tests.rs | 54 +++++++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+), 8 deletions(-) diff --git a/crates/render/src/dots.rs b/crates/render/src/dots.rs index 5d4ae1fc1..c33e89a22 100644 --- a/crates/render/src/dots.rs +++ b/crates/render/src/dots.rs @@ -57,7 +57,7 @@ pub(crate) fn draw(pix: &mut Pixmap, view: &View, d: &Dots) { let strong = |k: i64| k.rem_euclid(major) == 0; // The device-pixel span of the mark on line `k` along an axis `len` pixels long from `o`. let span = |k: i64, o: f64, len: i64| { - let a = (nearest_px(k as f64 * d.step * s - o) as i64).saturating_sub(lead); + let a = (nearest_px(k as f64 * d.step * s, o) as i64).saturating_sub(lead); (a.max(0), a.saturating_add(side).min(len)) }; let row = w as usize * 4; @@ -92,14 +92,20 @@ pub(crate) fn draw(pix: &mut Pixmap, view: &View, d: &Dots) { } } -/// The first device pixel of a mark whose edge is `p` pixels from the view's top-left: the one -/// whose left (or top) edge is nearest, and the right (or lower) one when two are as near. `p` is -/// first rounded to 1/65536 px, halves up as well: a view a whole number of pixels off (a pan, a -/// band, a patch) reaches it with another rounding error, and, rounded either way, would put the -/// marks that fall halfway on the other pixel. -fn nearest_px(p: f64) -> f64 { +/// The first device pixel of a mark whose edge is `at` pixels from the page origin, in a view whose +/// top-left is `o` pixels from it: the pixel whose left (or top) edge is nearest, and the right (or +/// lower) one when two are as near. A view a whole number of pixels off (a pan, a band, a patch) +/// gets `o` back from its origin with a rounding error, so `at` and `o` are each rounded to +/// 1/65536 px first: the mark's own position decides the pixel, and the view only counts it out +/// from its corner. The mark's halves go up and the origin's down: far out, where the origin's +/// error is half a step, it still comes back to the whole pixel. Past 2³⁷ px the step is finer +/// than `f64` and values are used as they are. +fn nearest_px(at: f64, o: f64) -> f64 { const STEPS: f64 = 65_536.0; - ((p * STEPS + 0.5).floor() / STEPS + 0.5).floor() + const EXACT: f64 = 137_438_953_472.0; // 2³⁷ + let up = |v: f64| if v.abs() < EXACT { (v * STEPS + 0.5).floor() / STEPS } else { v }; + let down = |v: f64| if v.abs() < EXACT { (v * STEPS - 0.5).ceil() / STEPS } else { v }; + (up(at) - down(o) + 0.5).floor() } /// Which line covers each device pixel along an axis: 0 none, 1 a faded one, 2 a strong one. diff --git a/crates/render/src/dots_tests.rs b/crates/render/src/dots_tests.rs index 18d96345f..75932a2bf 100644 --- a/crates/render/src/dots_tests.rs +++ b/crates/render/src/dots_tests.rs @@ -180,3 +180,57 @@ fn dots_on_the_rounding_step_stay_put() { } } } + +/// The view's origin is quantized apart from the marks: converted to pixels, a whole-pixel origin +/// comes back a hair off, and taken together with a mark one step short of a half it would push the +/// mark across. +#[test] +fn dots_one_rounding_step_short_of_a_half_stay_put() { + let (d, page) = page_with_square(); + let s = (75.5 - 2f64.powi(-17)) / 24.0; + for lines in [false, true] { + let opts = Options { dots: Some(Dots { lines, ..dots() }), ..Default::default() }; + let a = render_view_single(&d, page, &View { origin: (0.0, 0.0), scale: s, width: 300, height: 200 }, &opts).unwrap(); + for pan in 1..100u32 { + let v = View { origin: (f64::from(pan) / s, f64::from(pan) / s), scale: s, width: 200, height: 100 }; + let b = render_view_single(&d, page, &v, &opts).unwrap(); + for y in 0..100 { + for x in 0..200 { + assert_eq!(rgba(&b, x, y), rgba(&a, x + pan, y + pan), "lines {lines}, a pan by {pan}, at {x}, {y}"); + } + } + } + } +} + +/// Far out (some 4 × 10¹⁰ pixels), a whole-pixel origin comes back from page units exactly half a +/// rounding step off: rounded up, it would move the marks that fall halfway between pixels. +#[test] +fn far_out_dots_stay_put() { + let (d, page) = page_with_square(); + let s = 0.3; + let at = 42_536_140_695.0; + let opts = Options { dots: Some(Dots { step: 5.0, ..dots() }), ..Default::default() }; + let a = render_view_single(&d, page, &View { origin: (at / s, 0.0), scale: s, width: 420, height: 40 }, &opts).unwrap(); + for dx in 1..200u32 { + let v = View { origin: ((at + f64::from(dx)) / s, 0.0), scale: s, width: 200, height: 40 }; + let b = render_view_single(&d, page, &v, &opts).unwrap(); + for y in 0..40 { + for x in 0..200 { + assert_eq!(rgba(&b, x, y), rgba(&a, x + dx, y), "a pan by {dx}, at {x}, {y}"); + } + } + } +} + +/// Positions too far out to quantize draw nothing rather than a mark at the corner. +#[test] +fn dots_out_past_any_page_draw_nothing() { + let (d, page) = page_with_square(); + let plain = render_view_single(&d, page, &View { origin: (1e304, 0.0), scale: 1.0, width: 40, height: 40 }, &Options::default()).unwrap(); + for (step, x) in [(1e290, 1e304), (1e299, 1e305), (3e303, 1.5e308)] { + let opts = Options { dots: Some(Dots { step, ..dots() }), ..Default::default() }; + let p = render_view_single(&d, page, &View { origin: (x, 0.0), scale: 1.0, width: 40, height: 40 }, &opts).unwrap(); + assert_eq!(p.data(), plain.data(), "a step of {step} at {x}"); + } +} From 6f7814c9d3c4c8d25d1750962e6e9603725d9d2b Mon Sep 17 00:00:00 2001 From: michaelgiraldo <1228401+michaelgiraldo@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:23:39 -0800 Subject: [PATCH 06/36] M9: document combined browser and collaboration hosting --- docs/server.md | 12 ++++++++++++ packaging/server/Caddyfile | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+) diff --git a/docs/server.md b/docs/server.md index 9d42cb0fc..fddd5852e 100644 --- a/docs/server.md +++ b/docs/server.md @@ -753,6 +753,18 @@ sudo -u figcraft figcraft-server --config /etc/figcraft-server/server.toml key The other commands ([Managing files and links](#managing-files-and-links)) run the same way, as the `figcraft` user with `--config /etc/figcraft-server/server.toml`. +**Browser editor on the same hostname (optional).** The steps above install the collaboration +server. To also serve the editor, copy the complete contents of the matching +`figcraft-web-/` release directory into `/srv/figcraft-web`, with `index.html` directly +inside it; keep subdirectories such as `snippets/`. Use the commented browser-and-server block +in [`packaging/server/Caddyfile`](../packaging/server/Caddyfile) in place of its active server-only +block. Keep the loopback `listen`, `public_url` and `trusted_proxy` settings from steps 2 and 4. +The editor opens at `https://figcraft.example.com/app/`; the hostname root remains the +`wss://figcraft.example.com/` collaboration endpoint, not an editor homepage. Configure the +browser's `figcraft-server` meta tag as described in the +[web-hosting guide](../packaging/web/README.md#live-sessions), using the server address without a +publishing key. That guide also covers browser requirements, fonts and static-file delivery. + **In Docker instead of systemd.** [`packaging/server/Dockerfile`](../packaging/server/Dockerfile) builds a small image (the binary on a distroless base, no shell) that runs as an unprivileged user, keeps its files in the `/data` volume and stops gracefully on `docker stop`. Build it from diff --git a/packaging/server/Caddyfile b/packaging/server/Caddyfile index cd34394d0..e8ba7be8f 100644 --- a/packaging/server/Caddyfile +++ b/packaging/server/Caddyfile @@ -16,3 +16,35 @@ figcraft.example.com { # reverse_proxy 127.0.0.1:47900 # } # } + +# Browser editor and server on the same hostname instead. Use this block IN PLACE OF the +# active block above. Copy the complete browser release into /srv/figcraft-web, with index.html +# directly inside it and subdirectories such as snippets/ kept. See packaging/web/README.md for +# the browser's figcraft-server meta tag; never put a publishing key in public HTML. +# Open the editor at /app/. The hostname root remains the WSS endpoint, not an editor homepage. +# +# figcraft.example.com { +# encode gzip +# +# redir /app /app/?{query} 308 +# +# @entry path /app/ /app/index.html +# header @entry Cache-Control "no-cache" +# +# @release_assets path /app/figcraft-web-*.js /app/figcraft-web-*_bg.wasm +# header @release_assets Cache-Control "public, max-age=31536000, immutable" +# +# # No root favicon is configured: do not forward its implicit request to the WS server. +# handle /favicon.ico { +# respond 204 +# } +# +# handle_path /app/* { +# root * /srv/figcraft-web +# file_server +# } +# +# handle { +# reverse_proxy 127.0.0.1:47900 +# } +# } From 86e74a93f592050b72583ed928bd14eb6c381a0c Mon Sep 17 00:00:00 2001 From: michaelgiraldo <1228401+michaelgiraldo@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:54:10 -0800 Subject: [PATCH 07/36] M9: avoid immutable caching of missing browser assets --- packaging/server/Caddyfile | 5 +- packaging/server/caddy-test.sh | 119 +++++++++++++++++++++++++++++++++ 2 files changed, 123 insertions(+), 1 deletion(-) create mode 100755 packaging/server/caddy-test.sh diff --git a/packaging/server/Caddyfile b/packaging/server/Caddyfile index e8ba7be8f..b36700b7e 100644 --- a/packaging/server/Caddyfile +++ b/packaging/server/Caddyfile @@ -32,7 +32,10 @@ figcraft.example.com { # header @entry Cache-Control "no-cache" # # @release_assets path /app/figcraft-web-*.js /app/figcraft-web-*_bg.wasm -# header @release_assets Cache-Control "public, max-age=31536000, immutable" +# # Defer so a missing asset does not receive the one-year cache header. +# header @release_assets Cache-Control "public, max-age=31536000, immutable" { +# defer +# } # # # No root favicon is configured: do not forward its implicit request to the WS server. # handle /favicon.ico { diff --git a/packaging/server/caddy-test.sh b/packaging/server/caddy-test.sh new file mode 100755 index 000000000..f2dd6b563 --- /dev/null +++ b/packaging/server/caddy-test.sh @@ -0,0 +1,119 @@ +#!/bin/sh +# Exercise the optional browser/server example with synthetic files over loopback HTTP. +# Requires caddy and nc; no backend, root access, public DNS or certificate is needed. +# Usage: packaging/server/caddy-test.sh +# Overrides: CADDY=/path/to/caddy CADDYFILE=/path/to/Caddyfile CADDY_TEST_PORT=18080 +set -eu + +HERE="$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)" +CADDY="${CADDY:-caddy}" +CADDYFILE="${CADDYFILE:-$HERE/Caddyfile}" +PORT="${CADDY_TEST_PORT:-18080}" +case "$PORT" in ''|*[!0-9]*) echo 'CADDY_TEST_PORT must be a port number' >&2; exit 1 ;; esac +[ "$PORT" -gt 1023 ] && [ "$PORT" -lt 65536 ] || exit 1 +command -v "$CADDY" >/dev/null +command -v nc >/dev/null + +WORK="$(mktemp -d)" +PID='' +cleanup() { + status=$? + trap - 0 + if [ -n "$PID" ]; then + kill "$PID" 2>/dev/null || true + wait "$PID" 2>/dev/null || true + fi + rm -rf "$WORK" + exit "$status" +} +trap cleanup 0 +trap 'exit 1' HUP INT TERM +fail() { printf 'FAIL: %s\n' "$*" >&2; cat "$WORK/caddy.log" >&2; exit 1; } + +mkdir "$WORK/web" +printf 'synthetic editor\n' >"$WORK/web/index.html" +printf 'synthetic JavaScript asset\n' >"$WORK/web/figcraft-web-present.js" +printf 'synthetic WebAssembly asset\n' >"$WORK/web/figcraft-web-present_bg.wasm" + +# Extract the real commented block, changing only the hostname and filesystem root. +# The admin endpoint is disabled; state directories stay inside the temporary fixture. +printf '{\n\tadmin off\n}\n' >"$WORK/Caddyfile" +awk -v port="$PORT" -v root="$WORK/web" ' + $0 == "# figcraft.example.com {" { active = 1; found++; print "http://127.0.0.1:" port " {"; next } + active { + if ($0 !~ /^#/) exit 1 + if ($0 == "# }") { print "}"; active = 0; next } + sub(/^# ?/, "") + if ($1 == "root" && $2 == "*" && $3 == "/srv/figcraft-web") $0 = "\t\troot * \"" root "\"" + print + } + END { if (found != 1 || active) exit 1 } +' "$CADDYFILE" >>"$WORK/Caddyfile" + +XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" \ + "$CADDY" validate --config "$WORK/Caddyfile" --adapter caddyfile >"$WORK/caddy.log" 2>&1 || + fail 'extracted example did not validate' +XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" \ + "$CADDY" run --config "$WORK/Caddyfile" --adapter caddyfile >>"$WORK/caddy.log" 2>&1 & +PID=$! + +request() { + printf '%s %s HTTP/1.1\r\nHost: 127.0.0.1\r\nConnection: close\r\n\r\n' "$1" "$2" | + nc -w 2 127.0.0.1 "$PORT" >"$WORK/response" || return 1 + tr -d '\r' <"$WORK/response" >"$WORK/clean" + awk 'BEGIN { headers = 1 } headers && /^$/ { headers = 0; next } !headers { print }' \ + "$WORK/clean" >"$WORK/body" +} +status() { awk 'NR == 1 { print $2 }' "$WORK/clean"; } +cache() { + awk '/^$/ { exit } tolower($0) ~ /^cache-control:/ { sub(/^[^:]*:[ \t]*/, ""); print }' "$WORK/clean" +} + +attempt=0 +until request GET /app/ 2>/dev/null && [ "$(status)" = 200 ]; do + kill -0 "$PID" 2>/dev/null || fail 'Caddy did not start (port may be in use)' + attempt=$((attempt + 1)) + [ "$attempt" -lt 30 ] || fail 'Caddy did not become ready' + sleep 0.1 +done +kill -0 "$PID" 2>/dev/null || fail 'Caddy exited during startup' + +IMMUTABLE='public, max-age=31536000, immutable' +checks=0 +check() { + method=$1 + name=$2 + expected=$3 + request "$method" "/app/$name" || fail "$method $name request failed" + [ "$(status)" = "$expected" ] || fail "$method $name: expected HTTP $expected, got $(status)" + if [ "$expected" = 200 ]; then + [ "$(cache)" = "$IMMUTABLE" ] || fail "$method $name: successful asset lost its cache policy" + if [ "$method" = GET ]; then + cmp -s "$WORK/body" "$WORK/web/$name" || fail "$method $name: wrong file contents" + fi + else + [ -z "$(cache)" ] || fail "$method $name: a missing asset received Cache-Control: $(cache)" + fi + if [ "$method" = HEAD ]; then + [ ! -s "$WORK/body" ] || fail "$method $name: HEAD returned a body" + fi + checks=$((checks + 1)) + printf 'PASS: %s %s -> %s\n' "$method" "$name" "$expected" +} + +for method in GET HEAD; do + check "$method" figcraft-web-present.js 200 + check "$method" figcraft-web-present_bg.wasm 200 + check "$method" figcraft-web-later.js 404 + check "$method" figcraft-web-later_bg.wasm 404 +done + +# The same URLs must work immediately when deployment supplies the previously missing files. +printf 'new JavaScript asset\n' >"$WORK/web/figcraft-web-later.js" +printf 'new WebAssembly asset\n' >"$WORK/web/figcraft-web-later_bg.wasm" +for method in GET HEAD; do + check "$method" figcraft-web-later.js 200 + check "$method" figcraft-web-later_bg.wasm 200 +done + +printf 'Caddy browser asset caching: %s checks passed (%s)\n' "$checks" "$("$CADDY" version)" From 55821565ac0a3ecc36268a72fa5a2aec9430bb53 Mon Sep 17 00:00:00 2001 From: samhyun Date: Mon, 2 Nov 2026 09:58:03 +0900 Subject: [PATCH 08/36] M8: a spread round a stroke with corners keeps its whole shadow A dashed stroke is cut into dashes with corners wherever they fall round the outline, and a width profile or a brush can give the stroke corners of its own. A drop shadow's spread mitres those corners out, but a whole ellipse or a box still counted as growing by exactly its spread, so the shadow was cut off at the layer's edge (up to 255 levels). Such a node now gets the room a star does. Whether the outline's own mitres end on its box is a check of its own, which the stroke's reach keeps using, so a node with no spread keeps its bounds. Co-Authored-By: Claude Opus 5.5 --- crates/doc/src/node.rs | 22 ++++++++++--- crates/render/src/spread_tests.rs | 55 +++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+), 5 deletions(-) diff --git a/crates/doc/src/node.rs b/crates/doc/src/node.rs index 3ac81afdb..e24057f7b 100644 --- a/crates/doc/src/node.rs +++ b/crates/doc/src/node.rs @@ -944,7 +944,7 @@ impl Node { if self.stroke.cap_start.is_arrow() || self.stroke.cap_end.is_arrow() || point_arrows { w.max(self.stroke.weight) * 3.0 } else { w }; // Right-angled or smooth outlines (boxes, whole ellipses) end their mitres on the grown // box; an arc's corners don't. - let miter = if self.grows_by_exactly_its_spread() { 1.0 } else { self.stroke.miter_limit.clamp(1.0, 4.0) }; + let miter = if self.outline_mitres_end_on_its_box() { 1.0 } else { self.stroke.miter_limit.clamp(1.0, 4.0) }; base.max(if matches!(self.kind, NodeKind::Line | NodeKind::Vector { .. }) { caps } else { 0.0 }) * miter } else { 0.0 @@ -960,9 +960,10 @@ impl Node { !(matches!(self.kind, NodeKind::Group) || (matches!(self.kind, NodeKind::Text(_)) && self.has_visible_stroke())) } - /// Whether a spread grows this node's outline by exactly the spread (no sharp corners). An arc - /// (an ellipse that doesn't go all the way round) has corners where its ends meet its sides. - fn grows_by_exactly_its_spread(&self) -> bool { + /// Whether this node's outline has no sharp corners (right-angled ones aside), so mitres along + /// it end on its box grown by as much: a box or a whole ellipse. An arc (an ellipse that doesn't + /// go all the way round) has corners where its ends meet its sides. + fn outline_mitres_end_on_its_box(&self) -> bool { match self.kind { NodeKind::Rectangle | NodeKind::Section { .. } => true, NodeKind::Ellipse { sweep, .. } => figcraft_geom::full_sweep(sweep), @@ -970,9 +971,20 @@ impl Node { } } + /// Whether a spread grows this node by exactly the spread: its outline mitres end on its box + /// (see [`Node::outline_mitres_end_on_its_box`]), and so does its stroke. A dashed stroke is + /// cut into dashes with corners wherever they fall round the outline, and a width profile or a + /// brush can give the stroke corners of its own, which the spread mitres out. + fn grows_by_exactly_its_spread(&self) -> bool { + let s = &self.stroke; + let cornered = self.has_visible_stroke() && (!s.dashes.is_empty() || s.profile().is_some() || s.brush.is_some()); + !cornered && self.outline_mitres_end_on_its_box() + } + /// How much further than its spread a drop shadow can reach at the outline's sharp corners: /// spread moves the edges out in parallel and they meet in a mitre (see - /// [`SPREAD_MITER_LIMIT`]). Rectangles, frames and whole ellipses grow by exactly the spread. + /// [`SPREAD_MITER_LIMIT`]). Rectangles, frames and whole ellipses grow by exactly the spread, + /// unless their stroke has corners (see [`Node::grows_by_exactly_its_spread`]). fn spread_miter_reach(&self) -> f64 { if self.grows_by_exactly_its_spread() { return 0.0; diff --git a/crates/render/src/spread_tests.rs b/crates/render/src/spread_tests.rs index 6b30766fc..ec41dd8dd 100644 --- a/crates/render/src/spread_tests.rs +++ b/crates/render/src/spread_tests.rs @@ -192,3 +192,58 @@ fn arc_stroke_mitres_are_not_cut_off() { assert!(worst <= 2, "{align:?}: {worst} levels cut off"); } } + +/// A dashed stroke is cut into separate dashes with square ends, a width profile can step its +/// width and a brush lays down shapes of its own: round a whole ellipse or a rounded box, a spread +/// mitres out at their corners, past the box grown by the spread, and keeps its whole shadow. +#[test] +fn stroke_corners_spread_mitres_are_not_cut_off() { + use figcraft_doc::{Brush, Node, StrokeAlign, StrokeCap, WidthProfile}; + type Style = fn(&mut Node); + let strokes: [(&str, Style); 4] = [ + ("dashed", |n| n.stroke.dashes = vec![30.0, 30.0]), + ("dashed with square caps", |n| (n.stroke.dashes, n.stroke.dash_cap) = (vec![30.0, 30.0], Some(StrokeCap::Square))), + ("stepped", |n| n.stroke.width_profile = Some(WidthProfile::new([(0.0, 1.0), (0.25, 4.0), (0.26, 0.2), (0.75, 4.0)]))), + ("starry", |n| n.stroke.brush = Some(Brush::new("stars"))), + ]; + let shapes = [(NodeKind::Ellipse { start: 0.0, sweep: std::f64::consts::TAU, inner: 0.0 }, 0.0), (NodeKind::Rectangle, 100.0)]; + for (kind, radius) in shapes { + for (name, style) in strokes { + for align in [StrokeAlign::Outside, StrokeAlign::Center] { + let make = |effects: Vec| { + let (mut d, n) = shape(kind.clone(), effects); + let node = d.get_mut(n).unwrap(); + node.corners.radii = [radius; 4]; + node.strokes = vec![Paint::solid(Color::WHITE)]; + (node.stroke.weight, node.stroke.align) = (20.0, align); + style(node); + (d, n) + }; + let (d, n) = make(vec![EffectKind::DropShadow(shadow(30.0))]); + let clear = Shadow { color: Color::new(0.0, 0.0, 0.0, 0.0), ..shadow(120.0) }; + let (roomy, m) = make(vec![EffectKind::DropShadow(shadow(30.0)), EffectKind::DropShadow(clear)]); + let (a, b) = (render(&d, n), render(&roomy, m)); + let worst = a.data().chunks(4).zip(b.data().chunks(4)).map(|(p, q)| p[3].abs_diff(q[3])).max().unwrap_or(0); + // The stroke lands a little differently on a layer of another size, even when + // both have room to spare: up to 16 levels at a pixel or two. Cut off is 255. + assert!(worst <= 16, "{kind:?} radius {radius}, {name} {align:?}: {worst} levels cut off"); + } + } + } +} + +/// Without a spread, a dashed stroke reaches no further than a solid one: the bounds an export +/// goes by stay the box grown by the stroke. +#[test] +fn a_dashed_stroke_without_a_spread_keeps_its_bounds() { + use figcraft_doc::StrokeAlign; + for kind in [NodeKind::Rectangle, NodeKind::Ellipse { start: 0.0, sweep: std::f64::consts::TAU, inner: 0.0 }] { + let (mut d, n) = shape(kind.clone(), vec![]); + let node = d.get_mut(n).unwrap(); + node.strokes = vec![Paint::solid(Color::WHITE)]; + (node.stroke.weight, node.stroke.align) = (20.0, StrokeAlign::Outside); + node.stroke.dashes = vec![30.0, 30.0]; + let b = crate::export_bounds(&d, n).unwrap(); + assert_eq!((b.x0, b.y0, b.x1, b.y1), (80.0, 80.0, 320.0, 320.0), "{kind:?}"); + } +} From 6365e4339b4d4cf5754111715e2ea4e4eee74b9d Mon Sep 17 00:00:00 2001 From: ljkx <177671075+ljkx@users.noreply.github.com> Date: Mon, 2 Nov 2026 20:32:37 +0100 Subject: [PATCH 09/36] M4: Increase and decrease font weight step through the styles the family has (#1831) text.weightUp/weightDown stepped the CSS weight by 100 and stored a canonical name ("Medium", "Semi Bold", ...) whether the family had that face or not, so the first press on Arial Regular changed nothing visible and the stored style named a face no font provides. They now move to the nearest heavier or lighter style of the family with the same slant and width (Narrow stays Narrow), and stay put at either end. A family that isn't installed keeps the old 100 steps. --- crates/engine/src/cmd/text.rs | 65 ++++++++++++++++- crates/engine/src/lib.rs | 2 + crates/engine/src/text_weight_step_tests.rs | 81 +++++++++++++++++++++ 3 files changed, 145 insertions(+), 3 deletions(-) create mode 100644 crates/engine/src/text_weight_step_tests.rs diff --git a/crates/engine/src/cmd/text.rs b/crates/engine/src/cmd/text.rs index f72f215ee..c2b9043c3 100644 --- a/crates/engine/src/cmd/text.rs +++ b/crates/engine/src/cmd/text.rs @@ -122,11 +122,70 @@ fn toggle_italic(s: &mut Session, p: &Value) -> Result { }) } +/// What a style name says besides its weight and slant ("Narrow Bold Italic" → "narrow"). +fn style_rest(style: &str) -> String { + const WORDS: [&str; 25] = [ + "thin", + "hairline", + "extralight", + "ultralight", + "light", + "regular", + "normal", + "roman", + "book", + "medium", + "semibold", + "demibold", + "bold", + "extrabold", + "ultrabold", + "black", + "heavy", + "semi", + "demi", + "extra", + "ultra", + "italic", + "oblique", + "plain", + "standard", + ]; + let s = style.to_ascii_lowercase().replace('-', " "); + let words = s.split_whitespace().filter(|w| !WORDS.contains(w) && !w.chars().all(|c| c.is_ascii_digit())); + words.collect::>().join(" ") +} + +fn slanted(style: &str) -> bool { + let s = style.to_ascii_lowercase(); + s.contains("italic") || s.contains("oblique") +} + +/// The next heavier (`up`) or lighter style of `styles` (a family's) after the chars' style: the +/// nearest weight with the same slant and width, as the style menu lists them. None when the family +/// has nothing further that way. +pub(crate) fn next_style(styles: &[String], st: &TextStyle, up: bool) -> Option { + let (w, italic, rest) = (i32::from(st.weight()), st.italic(), style_rest(&st.font_style)); + styles + .iter() + .filter(|x| slanted(x) == italic && style_rest(x) == rest) + .map(|x| (i32::from(figcraft_doc::style_weight(x)) - w, x)) + .filter(|(d, _)| if up { *d > 0 } else { *d < 0 }) + .min_by_key(|(d, _)| d.abs()) + .map(|(_, x)| x.clone()) +} + fn step_weight(s: &mut Session, p: &Value, up: bool) -> Result { style(s, p, |st| { - let w = (i32::from(st.weight()) + if up { 100 } else { -100 }).clamp(100, 900) as u16; - let italic = st.italic(); - st.set_font_style(styled_name(weight_name(w), italic)); + let styles = figcraft_text::family_styles(&st.font_family); + if styles.is_empty() { + // A family that isn't installed: step the weight by 100 under its canonical name. + let w = (i32::from(st.weight()) + if up { 100 } else { -100 }).clamp(100, 900) as u16; + let italic = st.italic(); + st.set_font_style(styled_name(weight_name(w), italic)); + } else if let Some(next) = next_style(&styles, st, up) { + st.set_font_style(next); + } }) } diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs index e919444e2..621fdd8cb 100644 --- a/crates/engine/src/lib.rs +++ b/crates/engine/src/lib.rs @@ -575,6 +575,8 @@ mod text_style_picker_tests; #[cfg(test)] mod text_tail_tests; #[cfg(test)] +mod text_weight_step_tests; +#[cfg(test)] mod textfit_tests; #[cfg(test)] mod theme_pages_tests; diff --git a/crates/engine/src/text_weight_step_tests.rs b/crates/engine/src/text_weight_step_tests.rs new file mode 100644 index 000000000..f3f7fa587 --- /dev/null +++ b/crates/engine/src/text_weight_step_tests.rs @@ -0,0 +1,81 @@ +//! Increase and decrease font weight step through the styles the family has, by weight with the +//! same slant and width (#1831), not by 100 to a canonical name no face provides. + +use figcraft_doc::{NodeId, TextStyle}; +use serde_json::json; + +use crate::Session; +use crate::cmd::text::next_style; + +fn styles(names: &[&str]) -> Vec { + names.iter().map(|s| (*s).to_string()).collect() +} + +fn at(style: &str) -> TextStyle { + let mut st = TextStyle::default(); + st.set_font_style(style); + st +} + +/// Walk `from` heavier (`up`) or lighter until the family has nothing further. +fn walk(family: &[String], from: &str, up: bool) -> Vec { + let mut st = at(from); + let mut out = Vec::new(); + while let Some(next) = next_style(family, &st, up) { + st.set_font_style(next.clone()); + out.push(next); + } + out +} + +#[test] +fn the_steps_follow_the_family_with_the_same_slant_and_width() { + let arial = styles(&["Narrow", "Regular", "Italic", "Narrow Italic", "Bold", "Narrow Bold", "Bold Italic", "Narrow Bold Italic", "Black"]); + assert_eq!(walk(&arial, "Regular", true), ["Bold", "Black"]); + assert_eq!(walk(&arial, "Black", false), ["Bold", "Regular"]); + assert_eq!(walk(&arial, "Italic", true), ["Bold Italic"]); + assert_eq!(walk(&arial, "Narrow", true), ["Narrow Bold"]); + assert_eq!(walk(&arial, "Narrow Bold Italic", false), ["Narrow Italic"]); + let segoe = styles(&["Light", "Semilight", "Regular", "Italic", "Semibold", "Bold", "Black", "Bold Italic"]); + assert_eq!(walk(&segoe, "Regular", true), ["Semibold", "Bold", "Black"]); + assert_eq!(walk(&segoe, "Regular", false), ["Light"]); + // A style the family doesn't have (as the old steps stored) moves to the next real one. + assert_eq!(next_style(&segoe, &at("Medium"), true).as_deref(), Some("Semibold")); +} + +#[test] +fn a_custom_weight_axis_value_steps_from_where_it_is() { + let family = styles(&["Light", "Regular", "Medium", "Bold"]); + let mut st = at("Regular"); + st.variations.insert("wght".into(), 550.0); + assert_eq!(next_style(&family, &st, true).as_deref(), Some("Bold")); + assert_eq!(next_style(&family, &st, false).as_deref(), Some("Medium")); +} + +fn font_style(s: &Session, t: NodeId) -> String { + s.doc().unwrap().node(t).unwrap().kind.text().unwrap().spans()[0].2.font_style.clone() +} + +#[test] +fn the_commands_land_on_styles_the_family_has() { + figcraft_text::scan_system_fonts(); + // Any installed family with a regular face and a heavier upright one (CI machines differ). + let upright = |x: &String| !x.to_lowercase().contains("italic") && !x.to_lowercase().contains("oblique"); + let pick = figcraft_text::family_names().into_iter().find_map(|f| { + let st = figcraft_text::family_styles(&f); + (st.iter().any(|x| x == "Regular") && st.iter().any(|x| upright(x) && figcraft_doc::style_weight(x) > 400)).then_some((f, st)) + }); + let Some((family, styles)) = pick else { return }; + let mut s = Session::new(); + let r = s.execute("node.create", &json!({"type": "text", "text": "Hi", "props": {"fontFamily": family, "fontStyle": "Regular"}})).unwrap(); + let t = crate::params::id_of(&r["id"]).unwrap(); + s.execute("text.weightUp", &json!({"ids": [t]})).unwrap(); + let up = font_style(&s, t); + assert!(styles.contains(&up) && figcraft_doc::style_weight(&up) > 400, "{family}: {up} of {styles:?}"); + s.execute("text.weightDown", &json!({"ids": [t]})).unwrap(); + assert_eq!(font_style(&s, t), "Regular", "{family}: {styles:?}"); + // A family that isn't installed still steps by 100 under the canonical names. + s.execute("node.set", &json!({"ids": [t], "props": {"fontFamily": "No Such Family 7f3a", "fontStyle": "Regular"}})).unwrap(); + s.execute("text.weightUp", &json!({"ids": [t]})).unwrap(); + assert_eq!(font_style(&s, t), "Medium"); +} From dc82e6cac9b3ab2055dd294fa015fb9072d8f26e Mon Sep 17 00:00:00 2001 From: ljkx <177671075+ljkx@users.noreply.github.com> Date: Tue, 3 Nov 2026 00:49:00 +0100 Subject: [PATCH 10/36] M4: weight steps follow the family's order and keep widths and oblique slants (#1831) Review follow-up. The step now finds the chars' style in the family's list (the style menu's order, lightest first) and takes its neighbour, so a style whose name gives no distinct weight (Semilight) is reachable; a style the family lacks or a custom wght value still goes by weight, ties going to the nearer one in that order. "Extra", "Ultra", "Semi" and "Demi" are weight words only before a weight ("Extra Bold"), so "Extra Condensed" keeps its width; Oblique names count as slanted for the current style too; W3-style names are weights; and style_weight reads Hairline as 100, not 400. The installed-font test picks a family the step actually moves. --- crates/doc/src/tests.rs | 1 + crates/doc/src/text.rs | 3 +- crates/engine/src/cmd/text.rs | 65 ++++++++++++++++----- crates/engine/src/text_weight_step_tests.rs | 40 +++++++++++-- 4 files changed, 86 insertions(+), 23 deletions(-) diff --git a/crates/doc/src/tests.rs b/crates/doc/src/tests.rs index a0e3e17b0..0964f2e46 100644 --- a/crates/doc/src/tests.rs +++ b/crates/doc/src/tests.rs @@ -223,6 +223,7 @@ fn text_case() { assert_eq!(style_weight("Semi Bold Italic"), 600); assert_eq!(style_weight("Black"), 900); assert_eq!(style_weight("Regular"), 400); + assert_eq!(style_weight("Hairline"), 100); } #[test] diff --git a/crates/doc/src/text.rs b/crates/doc/src/text.rs index 0c41d3c9a..a0850ec83 100644 --- a/crates/doc/src/text.rs +++ b/crates/doc/src/text.rs @@ -389,8 +389,9 @@ pub fn style_weight(style: &str) -> u16 { { return n; } - let table: [(&str, u16); 10] = [ + let table: [(&str, u16); 11] = [ ("thin", 100), + ("hairline", 100), ("extralight", 200), ("ultralight", 200), ("light", 300), diff --git a/crates/engine/src/cmd/text.rs b/crates/engine/src/cmd/text.rs index c2b9043c3..31008533a 100644 --- a/crates/engine/src/cmd/text.rs +++ b/crates/engine/src/cmd/text.rs @@ -122,14 +122,23 @@ fn toggle_italic(s: &mut Session, p: &Value) -> Result { }) } -/// What a style name says besides its weight and slant ("Narrow Bold Italic" → "narrow"). +/// Hiragino's weight names: "W3" is 300. +fn w_number(word: &str) -> Option { + let n = word.strip_prefix('w')?.parse::().ok()?; + (1..=9).contains(&n).then_some(n * 100) +} + +/// What a style name says besides its weight and slant ("Narrow Bold Italic" → "narrow", +/// "Extra Condensed Bold" → "extra condensed"). fn style_rest(style: &str) -> String { - const WORDS: [&str; 25] = [ + const WEIGHTS: [&str; 25] = [ "thin", "hairline", "extralight", "ultralight", "light", + "semilight", + "demilight", "regular", "normal", "roman", @@ -141,40 +150,64 @@ fn style_rest(style: &str) -> String { "extrabold", "ultrabold", "black", + "extrablack", + "ultrablack", "heavy", - "semi", - "demi", - "extra", - "ultra", "italic", "oblique", "plain", "standard", ]; + // Words that grade the weight word after them ("Extra Bold") but a width otherwise ("Extra Condensed"). + const GRADES: [&str; 4] = ["extra", "ultra", "semi", "demi"]; let s = style.to_ascii_lowercase().replace('-', " "); - let words = s.split_whitespace().filter(|w| !WORDS.contains(w) && !w.chars().all(|c| c.is_ascii_digit())); - words.collect::>().join(" ") + let words: Vec<&str> = s.split_whitespace().collect(); + let weight = |w: &str| WEIGHTS.contains(&w) || w_number(w).is_some() || w.chars().all(|c| c.is_ascii_digit()); + let rest = words.iter().enumerate().filter(|(i, w)| { + let graded = GRADES.contains(w) && words.get(i + 1).is_some_and(|next| weight(next) && !matches!(*next, "italic" | "oblique")); + !weight(w) && !graded + }); + rest.map(|(_, w)| *w).collect::>().join(" ") } +/// A style name that slants: italic, or oblique as some families name it. fn slanted(style: &str) -> bool { let s = style.to_ascii_lowercase(); s.contains("italic") || s.contains("oblique") } -/// The next heavier (`up`) or lighter style of `styles` (a family's) after the chars' style: the -/// nearest weight with the same slant and width, as the style menu lists them. None when the family -/// has nothing further that way. +/// The weight a style name says ("W3" too). +fn name_weight(style: &str) -> u16 { + w_number(&style.to_ascii_lowercase()).unwrap_or_else(|| figcraft_doc::style_weight(style)) +} + +/// The next heavier (`up`) or lighter style of `styles` (a family's, lightest first, as the style +/// menu lists them) after the chars' style, with the same slant and width. The chars' style is +/// found in the list by name and its neighbour taken; a style the family doesn't have, or a custom +/// weight axis value, goes to the nearest weight that way. None when the family has nothing further. pub(crate) fn next_style(styles: &[String], st: &TextStyle, up: bool) -> Option { - let (w, italic, rest) = (i32::from(st.weight()), st.italic(), style_rest(&st.font_style)); - styles - .iter() - .filter(|x| slanted(x) == italic && style_rest(x) == rest) - .map(|x| (i32::from(figcraft_doc::style_weight(x)) - w, x)) + let italic = st.italic() || slanted(&st.font_style); + let rest = style_rest(&st.font_style); + let mut same: Vec<&String> = styles.iter().filter(|x| slanted(x) == italic && style_rest(x) == rest).collect(); + let norm = |s: &str| s.to_lowercase().replace([' ', '-', '_'], ""); + let here = same.iter().position(|x| norm(x) == norm(&st.font_style)); + if let Some(i) = here.filter(|_| !st.variations.contains_key("wght")) { + let next = if up { i.checked_add(1) } else { i.checked_sub(1) }; + return next.and_then(|n| same.get(n)).map(|x| (*x).clone()); + } + let w = i32::from(st.weight()); + // Of equal weights, the one nearest in the family's order: the first going up, the last going down. + if !up { + same.reverse(); + } + same.into_iter() + .map(|x| (i32::from(name_weight(x)) - w, x)) .filter(|(d, _)| if up { *d > 0 } else { *d < 0 }) .min_by_key(|(d, _)| d.abs()) .map(|(_, x)| x.clone()) } +/// `text.weightUp` / `text.weightDown`: each targeted run moves to the next style of its family. fn step_weight(s: &mut Session, p: &Value, up: bool) -> Result { style(s, p, |st| { let styles = figcraft_text::family_styles(&st.font_family); diff --git a/crates/engine/src/text_weight_step_tests.rs b/crates/engine/src/text_weight_step_tests.rs index f3f7fa587..f3647d77d 100644 --- a/crates/engine/src/text_weight_step_tests.rs +++ b/crates/engine/src/text_weight_step_tests.rs @@ -38,11 +38,39 @@ fn the_steps_follow_the_family_with_the_same_slant_and_width() { assert_eq!(walk(&arial, "Narrow Bold Italic", false), ["Narrow Italic"]); let segoe = styles(&["Light", "Semilight", "Regular", "Italic", "Semibold", "Bold", "Black", "Bold Italic"]); assert_eq!(walk(&segoe, "Regular", true), ["Semibold", "Bold", "Black"]); - assert_eq!(walk(&segoe, "Regular", false), ["Light"]); + assert_eq!(walk(&segoe, "Regular", false), ["Semilight", "Light"]); // A style the family doesn't have (as the old steps stored) moves to the next real one. assert_eq!(next_style(&segoe, &at("Medium"), true).as_deref(), Some("Semibold")); } +#[test] +fn extra_and_semi_before_a_width_keep_the_width() { + let family = styles(&["Extra Condensed Regular", "Condensed Regular", "Condensed Bold", "Extra Condensed Bold", "Semi Condensed Extra Bold"]); + assert_eq!(walk(&family, "Extra Condensed Regular", true), ["Extra Condensed Bold"]); + assert_eq!(walk(&family, "Condensed Bold", false), ["Condensed Regular"]); + assert_eq!(walk(&family, "Semi Condensed Extra Bold", false), Vec::::new()); +} + +#[test] +fn oblique_names_step_to_oblique_faces() { + let dejavu = styles(&["Book", "Oblique", "Bold", "Bold Oblique"]); + assert_eq!(walk(&dejavu, "Oblique", true), ["Bold Oblique"]); + assert_eq!(walk(&dejavu, "Bold Oblique", false), ["Oblique"]); + assert_eq!(walk(&dejavu, "Book", true), ["Bold"]); +} + +#[test] +fn hairline_and_w_numbers_are_weights() { + let family = styles(&["Hairline", "Thin", "Regular", "Bold"]); + assert_eq!(walk(&family, "Regular", false), ["Thin", "Hairline"]); + // Off the list (a stored style the family lacks): by weight, the nearer of two equal ones. + assert_eq!(next_style(&family, &at("Extra Light"), false).as_deref(), Some("Thin")); + assert_eq!(next_style(&family, &at("Extra Light"), true).as_deref(), Some("Regular")); + let hiragino = styles(&["W3", "W6"]); + assert_eq!(walk(&hiragino, "W3", true), ["W6"]); + assert_eq!(next_style(&hiragino, &at("Bold"), false).as_deref(), Some("W6")); +} + #[test] fn a_custom_weight_axis_value_steps_from_where_it_is() { let family = styles(&["Light", "Regular", "Medium", "Bold"]); @@ -59,19 +87,19 @@ fn font_style(s: &Session, t: NodeId) -> String { #[test] fn the_commands_land_on_styles_the_family_has() { figcraft_text::scan_system_fonts(); - // Any installed family with a regular face and a heavier upright one (CI machines differ). - let upright = |x: &String| !x.to_lowercase().contains("italic") && !x.to_lowercase().contains("oblique"); + // Any installed family with a Regular face and a style the step takes it to (CI machines differ). let pick = figcraft_text::family_names().into_iter().find_map(|f| { let st = figcraft_text::family_styles(&f); - (st.iter().any(|x| x == "Regular") && st.iter().any(|x| upright(x) && figcraft_doc::style_weight(x) > 400)).then_some((f, st)) + let up = next_style(&st, &at("Regular"), true).filter(|_| st.iter().any(|x| x == "Regular"))?; + Some((f, st, up)) }); - let Some((family, styles)) = pick else { return }; + let Some((family, styles, heavier)) = pick else { return }; let mut s = Session::new(); let r = s.execute("node.create", &json!({"type": "text", "text": "Hi", "props": {"fontFamily": family, "fontStyle": "Regular"}})).unwrap(); let t = crate::params::id_of(&r["id"]).unwrap(); s.execute("text.weightUp", &json!({"ids": [t]})).unwrap(); let up = font_style(&s, t); - assert!(styles.contains(&up) && figcraft_doc::style_weight(&up) > 400, "{family}: {up} of {styles:?}"); + assert_eq!(up, heavier, "{family}: {styles:?}"); s.execute("text.weightDown", &json!({"ids": [t]})).unwrap(); assert_eq!(font_style(&s, t), "Regular", "{family}: {styles:?}"); // A family that isn't installed still steps by 100 under the canonical names. From 2c9226c0215acf23772cd6c062790019fe9629d7 Mon Sep 17 00:00:00 2001 From: ljkx <177671075+ljkx@users.noreply.github.com> Date: Tue, 3 Nov 2026 03:44:58 +0100 Subject: [PATCH 11/36] M4: weight steps from an off-list weight compare the faces' own weights (#1831) next_style compared a custom wght value or a style the family lacks with the weights the style names say, so Segoe UI Variable's Semilight (350) counted as 300 and a wght of 325 stepped up to Regular. The family's styles now come with the weights the style menu sorts them by (figcraft_text::family_style_weights), and "W7 Italic" reads as 700. --- crates/engine/src/cmd/text.rs | 33 +++++++++------- crates/engine/src/text_weight_step_tests.rs | 43 ++++++++++++++++++--- crates/text/src/fontdb.rs | 13 ++++++- crates/text/src/lib.rs | 4 +- 4 files changed, 69 insertions(+), 24 deletions(-) diff --git a/crates/engine/src/cmd/text.rs b/crates/engine/src/cmd/text.rs index 31008533a..a25d19733 100644 --- a/crates/engine/src/cmd/text.rs +++ b/crates/engine/src/cmd/text.rs @@ -176,32 +176,35 @@ fn slanted(style: &str) -> bool { s.contains("italic") || s.contains("oblique") } -/// The weight a style name says ("W3" too). -fn name_weight(style: &str) -> u16 { - w_number(&style.to_ascii_lowercase()).unwrap_or_else(|| figcraft_doc::style_weight(style)) +/// The weight a style name says ("W3" and "W6 Italic" too). +pub(crate) fn name_weight(style: &str) -> u16 { + let first = style.to_ascii_lowercase().replace('-', " "); + first.split_whitespace().next().and_then(w_number).unwrap_or_else(|| figcraft_doc::style_weight(style)) } -/// The next heavier (`up`) or lighter style of `styles` (a family's, lightest first, as the style -/// menu lists them) after the chars' style, with the same slant and width. The chars' style is -/// found in the list by name and its neighbour taken; a style the family doesn't have, or a custom -/// weight axis value, goes to the nearest weight that way. None when the family has nothing further. -pub(crate) fn next_style(styles: &[String], st: &TextStyle, up: bool) -> Option { +/// The next heavier (`up`) or lighter style of `styles` (a family's with the weight each is listed +/// by, lightest first, as the style menu lists them) after the chars' style, with the same slant +/// and width. The chars' style is found in the list by name and its neighbour taken; a style the +/// family doesn't have, or a custom weight axis value, goes to the listed style of nearest weight +/// that way. None when the family has nothing further. +pub(crate) fn next_style(styles: &[(String, u16)], st: &TextStyle, up: bool) -> Option { let italic = st.italic() || slanted(&st.font_style); let rest = style_rest(&st.font_style); - let mut same: Vec<&String> = styles.iter().filter(|x| slanted(x) == italic && style_rest(x) == rest).collect(); + let mut same: Vec<&(String, u16)> = styles.iter().filter(|(x, _)| slanted(x) == italic && style_rest(x) == rest).collect(); let norm = |s: &str| s.to_lowercase().replace([' ', '-', '_'], ""); - let here = same.iter().position(|x| norm(x) == norm(&st.font_style)); - if let Some(i) = here.filter(|_| !st.variations.contains_key("wght")) { + let here = same.iter().position(|(x, _)| norm(x) == norm(&st.font_style)); + let axis = st.variations.contains_key("wght"); + if let Some(i) = here.filter(|_| !axis) { let next = if up { i.checked_add(1) } else { i.checked_sub(1) }; - return next.and_then(|n| same.get(n)).map(|x| (*x).clone()); + return next.and_then(|n| same.get(n)).map(|(x, _)| x.clone()); } - let w = i32::from(st.weight()); + let w = i32::from(if axis { st.weight() } else { name_weight(&st.font_style) }); // Of equal weights, the one nearest in the family's order: the first going up, the last going down. if !up { same.reverse(); } same.into_iter() - .map(|x| (i32::from(name_weight(x)) - w, x)) + .map(|(x, xw)| (i32::from(*xw) - w, x)) .filter(|(d, _)| if up { *d > 0 } else { *d < 0 }) .min_by_key(|(d, _)| d.abs()) .map(|(_, x)| x.clone()) @@ -210,7 +213,7 @@ pub(crate) fn next_style(styles: &[String], st: &TextStyle, up: bool) -> Option< /// `text.weightUp` / `text.weightDown`: each targeted run moves to the next style of its family. fn step_weight(s: &mut Session, p: &Value, up: bool) -> Result { style(s, p, |st| { - let styles = figcraft_text::family_styles(&st.font_family); + let styles = figcraft_text::family_style_weights(&st.font_family); if styles.is_empty() { // A family that isn't installed: step the weight by 100 under its canonical name. let w = (i32::from(st.weight()) + if up { 100 } else { -100 }).clamp(100, 900) as u16; diff --git a/crates/engine/src/text_weight_step_tests.rs b/crates/engine/src/text_weight_step_tests.rs index f3647d77d..96562bf7e 100644 --- a/crates/engine/src/text_weight_step_tests.rs +++ b/crates/engine/src/text_weight_step_tests.rs @@ -5,10 +5,16 @@ use figcraft_doc::{NodeId, TextStyle}; use serde_json::json; use crate::Session; -use crate::cmd::text::next_style; +use crate::cmd::text::{name_weight, next_style}; -fn styles(names: &[&str]) -> Vec { - names.iter().map(|s| (*s).to_string()).collect() +/// A family's styles listed by the weights their names say, as for faces not read yet. +fn styles(names: &[&str]) -> Vec<(String, u16)> { + names.iter().map(|s| ((*s).to_string(), name_weight(s))).collect() +} + +/// A family's styles with the faces' own weights. +fn weighed(faces: &[(&str, u16)]) -> Vec<(String, u16)> { + faces.iter().map(|(s, w)| ((*s).to_string(), *w)).collect() } fn at(style: &str) -> TextStyle { @@ -18,7 +24,7 @@ fn at(style: &str) -> TextStyle { } /// Walk `from` heavier (`up`) or lighter until the family has nothing further. -fn walk(family: &[String], from: &str, up: bool) -> Vec { +fn walk(family: &[(String, u16)], from: &str, up: bool) -> Vec { let mut st = at(from); let mut out = Vec::new(); while let Some(next) = next_style(family, &st, up) { @@ -80,6 +86,31 @@ fn a_custom_weight_axis_value_steps_from_where_it_is() { assert_eq!(next_style(&family, &st, false).as_deref(), Some("Medium")); } +#[test] +fn off_the_list_the_faces_own_weights_decide() { + // From 500 between 400 and 700 faces: the neighbours, under their own names (the axis value goes). + let family = weighed(&[("Light", 300), ("Regular", 400), ("Bold", 700)]); + let mut st = at("Regular"); + st.variations.insert("wght".into(), 500.0); + assert_eq!(next_style(&family, &st, true).as_deref(), Some("Bold")); + assert_eq!(next_style(&family, &st, false).as_deref(), Some("Regular")); + st.set_font_style("Bold"); + assert_eq!((st.weight(), st.variations.get("wght")), (700, None)); + // Segoe UI Variable's Semilight is 350, not the 300 its name says: from a `wght` of 325 it is + // the next heavier style, and from 375 the next lighter. + let segoe = weighed(&[("Light", 300), ("Semilight", 350), ("Regular", 400), ("Semibold", 600), ("Bold", 700)]); + st.variations.insert("wght".into(), 325.0); + assert_eq!(next_style(&segoe, &st, true).as_deref(), Some("Semilight")); + assert_eq!(next_style(&segoe, &st, false).as_deref(), Some("Light")); + st.variations.insert("wght".into(), 375.0); + assert_eq!(next_style(&segoe, &st, false).as_deref(), Some("Semilight")); + assert_eq!(next_style(&segoe, &st, true).as_deref(), Some("Regular")); + // A W-numbered name with a slant after it is still that weight ("W7 Italic" is 700). + let hiragino = weighed(&[("W3 Italic", 300), ("W6 Italic", 600), ("W8 Italic", 800)]); + assert_eq!(next_style(&hiragino, &at("W7 Italic"), false).as_deref(), Some("W6 Italic")); + assert_eq!(next_style(&hiragino, &at("W7 Italic"), true).as_deref(), Some("W8 Italic")); +} + fn font_style(s: &Session, t: NodeId) -> String { s.doc().unwrap().node(t).unwrap().kind.text().unwrap().spans()[0].2.font_style.clone() } @@ -89,8 +120,8 @@ fn the_commands_land_on_styles_the_family_has() { figcraft_text::scan_system_fonts(); // Any installed family with a Regular face and a style the step takes it to (CI machines differ). let pick = figcraft_text::family_names().into_iter().find_map(|f| { - let st = figcraft_text::family_styles(&f); - let up = next_style(&st, &at("Regular"), true).filter(|_| st.iter().any(|x| x == "Regular"))?; + let st = figcraft_text::family_style_weights(&f); + let up = next_style(&st, &at("Regular"), true).filter(|_| st.iter().any(|(x, _)| x == "Regular"))?; Some((f, st, up)) }); let Some((family, styles, heavier)) = pick else { return }; diff --git a/crates/text/src/fontdb.rs b/crates/text/src/fontdb.rs index d0004fcd9..c3c2f43a6 100644 --- a/crates/text/src/fontdb.rs +++ b/crates/text/src/fontdb.rs @@ -743,6 +743,12 @@ impl FontDb { /// Style names of a family, by weight then italic. pub fn styles(&mut self, family: &str) -> Vec { + self.style_weights(family).into_iter().map(|(name, _)| name).collect() + } + + /// [`styles`](Self::styles) with the weight each is listed by: the face's own (Segoe UI + /// Semilight is 350), a named instance's `wght`, or for a face not read yet its name's. + pub fn style_weights(&mut self, family: &str) -> Vec<(String, u16)> { self.load_family(family, None); let key = self.key(family); // (weight, italic, order in the font, name): named instances keep the font's order. @@ -768,7 +774,7 @@ impl FontDb { v.sort(); let mut seen = std::collections::HashSet::new(); v.retain(|x| seen.insert(norm_style(&x.3))); - v.into_iter().map(|x| x.3).collect() + v.into_iter().map(|x| (x.3, x.0)).collect() } /// The key `family` is known under: itself in any case; for a name designs use for Apple's @@ -1502,6 +1508,11 @@ pub fn family_styles(family: &str) -> Vec { db().write().unwrap_or_else(std::sync::PoisonError::into_inner).styles(family) } +/// [`family_styles`] with the weight each is listed by (see [`FontDb::style_weights`]). +pub fn family_style_weights(family: &str) -> Vec<(String, u16)> { + db().write().unwrap_or_else(std::sync::PoisonError::into_inner).style_weights(family) +} + /// Scan system fonts into the global db (desktop; a no-op on the web, or with /// `FIGCRAFT_NO_SYSTEM_FONTS` set). Runs once per process: a concurrent caller waits for that scan. /// The directory walk runs without holding the database lock; results are merged in one short write. diff --git a/crates/text/src/lib.rs b/crates/text/src/lib.rs index cad3e1326..b6d87d669 100644 --- a/crates/text/src/lib.rs +++ b/crates/text/src/lib.rs @@ -17,8 +17,8 @@ pub use breaks::{backspace_step, grapheme_step}; pub use color::{ColorBitmap, ColorInk, ColorLayer}; pub use fontdb::{ Axis, CRAFT_FONTS, Coords, Face, FontDb, LocalFont, NamedInstance, Rescan, add_local_fonts, axis_label, db, face_with_char, family_names, - family_styles, find_face, has_family, installed_fonts_known, load_font_bytes, load_local_font, local_only, no_coords, opt_out_of_system_fonts, - rescan_system_fonts, scan_system_fonts, scan_system_fonts_on_demand, system_fonts_scanned, take_wanted_local_fonts, + family_style_weights, family_styles, find_face, has_family, installed_fonts_known, load_font_bytes, load_local_font, local_only, no_coords, + opt_out_of_system_fonts, rescan_system_fonts, scan_system_fonts, scan_system_fonts_on_demand, system_fonts_scanned, take_wanted_local_fonts, }; pub use layout::{Decoration, Glyph, Line, TextLayout, layout}; pub use onpath::OnPath; From 45c89c5a737e493c9e2e3de12d0e40d02ee2edbc Mon Sep 17 00:00:00 2001 From: ljkx <177671075+ljkx@users.noreply.github.com> Date: Tue, 3 Nov 2026 04:38:16 +0100 Subject: [PATCH 12/36] M4: weight steps reach a weight family's italics and read W weights after a width (#1831) A family installed as one family per weight ("Foo Bold" with Regular and Italic faces) now lists Bold and Bold Italic, the names resolve draws them by, with the faces' own weights when they are read. A W-numbered weight counts after other words too ("Condensed W7 Italic" is 700). --- crates/engine/src/cmd/text.rs | 6 +-- crates/engine/src/text_weight_step_tests.rs | 4 ++ crates/text/src/fontdb.rs | 21 ++++++++-- crates/text/src/fontdb_names_tests.rs | 43 ++++++++++++++++++++- 4 files changed, 67 insertions(+), 7 deletions(-) diff --git a/crates/engine/src/cmd/text.rs b/crates/engine/src/cmd/text.rs index a25d19733..9024e1229 100644 --- a/crates/engine/src/cmd/text.rs +++ b/crates/engine/src/cmd/text.rs @@ -176,10 +176,10 @@ fn slanted(style: &str) -> bool { s.contains("italic") || s.contains("oblique") } -/// The weight a style name says ("W3" and "W6 Italic" too). +/// The weight a style name says ("W3", "W6 Italic" and "Condensed W7" too). pub(crate) fn name_weight(style: &str) -> u16 { - let first = style.to_ascii_lowercase().replace('-', " "); - first.split_whitespace().next().and_then(w_number).unwrap_or_else(|| figcraft_doc::style_weight(style)) + let words = style.to_ascii_lowercase().replace('-', " "); + words.split_whitespace().find_map(w_number).unwrap_or_else(|| figcraft_doc::style_weight(style)) } /// The next heavier (`up`) or lighter style of `styles` (a family's with the weight each is listed diff --git a/crates/engine/src/text_weight_step_tests.rs b/crates/engine/src/text_weight_step_tests.rs index 96562bf7e..e8bf65a7b 100644 --- a/crates/engine/src/text_weight_step_tests.rs +++ b/crates/engine/src/text_weight_step_tests.rs @@ -109,6 +109,10 @@ fn off_the_list_the_faces_own_weights_decide() { let hiragino = weighed(&[("W3 Italic", 300), ("W6 Italic", 600), ("W8 Italic", 800)]); assert_eq!(next_style(&hiragino, &at("W7 Italic"), false).as_deref(), Some("W6 Italic")); assert_eq!(next_style(&hiragino, &at("W7 Italic"), true).as_deref(), Some("W8 Italic")); + // And after a width ("Condensed W7 Italic" is 700 too). + let condensed = weighed(&[("Condensed W3 Italic", 300), ("Condensed W6 Italic", 600), ("Condensed W8 Italic", 800)]); + assert_eq!(next_style(&condensed, &at("Condensed W7 Italic"), true).as_deref(), Some("Condensed W8 Italic")); + assert_eq!(next_style(&condensed, &at("Condensed W7 Italic"), false).as_deref(), Some("Condensed W6 Italic")); } fn font_style(s: &Session, t: NodeId) -> String { diff --git a/crates/text/src/fontdb.rs b/crates/text/src/fontdb.rs index c3c2f43a6..a856aa1fe 100644 --- a/crates/text/src/fontdb.rs +++ b/crates/text/src/fontdb.rs @@ -767,9 +767,24 @@ impl FontDb { v.push((w, f.italic || italic_name(&inst.name), k, inst.name.clone())); } } - // A family installed as one family per weight offers those weights too. - for (_, style) in self.split_families(&key) { - v.push((pending_weight(&style).clamp(1, 1000) as u16, italic_name(&style), 0, style)); + // A family installed as one family per weight offers those weights too, upright and italic + // as that family's faces are ("Foo Bold" with Regular and Italic faces: Bold and Bold + // Italic, the names `resolve` finds them by). A face read gives its own weight, one not + // read the name's; the families aren't read for this. + for (k, style) in self.split_families(&key) { + let named = pending_weight(&style).clamp(1, 1000) as u16; + let italic = italic_name(&style); + let read = self.families.get(&k).map(|(_, idx)| idx.as_slice()).unwrap_or_default().iter().filter_map(|i| self.faces.get(*i)); + let unread = self.pending.get(&k).into_iter().flat_map(|(_, entries)| entries).map(|e| (named, italic_name(&e.style))); + let faces: Vec<(u16, bool)> = read.map(|f| (f.weight, f.italic)).chain(unread).collect(); + if faces.is_empty() { + v.push((named, italic, 0, style)); + continue; + } + for (w, slanted) in faces { + let name = if slanted && !italic { format!("{style} Italic") } else { style.clone() }; + v.push((w, slanted || italic, 0, name)); + } } v.sort(); let mut seen = std::collections::HashSet::new(); diff --git a/crates/text/src/fontdb_names_tests.rs b/crates/text/src/fontdb_names_tests.rs index 0d31b7c56..62bd27be3 100644 --- a/crates/text/src/fontdb_names_tests.rs +++ b/crates/text/src/fontdb_names_tests.rs @@ -5,9 +5,10 @@ //! case; the picker lists what is installed. Synthetic family names only, over pending entries //! (no files) and the embedded faces when the build has them. +use std::collections::BTreeMap; use std::sync::Arc; -use super::{CRAFT_FONTS, Face, FontBytes, FontDb, Pending, style_words}; +use super::{CRAFT_FONTS, Face, FontBytes, FontDb, LocalFont, Pending, scan_dir, style_words, system_font_dirs}; fn entry(style: &str) -> Pending { Pending { path: format!("no-such-dir/{style}.ttf").into(), index: 0, style: style.into(), postscript: None, local: None } @@ -104,3 +105,43 @@ fn faces_are_found_and_listed_under_either_name() { assert!(Arc::ptr_eq(&db.find("Synthetic Text SemiBold", "Regular").unwrap(), &semibold)); assert!(Arc::ptr_eq(&db.find("synthetictext", "Semibold").unwrap(), &semibold)); } + +#[test] +fn a_family_per_weight_offers_its_italics_too() { + // Listed by name before anything is read: Synthetic Slab Bold's Italic face is Bold Italic. + let local = |id: usize, family: &str, style: &str| LocalFont { id, family: family.into(), style: style.into(), postscript: String::new() }; + let mut db = FontDb::default(); + db.add_local(vec![ + local(0, "Synthetic Slab", "Regular"), + local(1, "Synthetic Slab", "Italic"), + local(2, "Synthetic Slab Bold", "Regular"), + local(3, "Synthetic Slab Bold", "Italic"), + ]); + let listed = |db: &mut FontDb| db.style_weights("Synthetic Slab"); + let want = |v: &[(&str, u16)]| v.iter().map(|(s, w)| ((*s).to_string(), *w)).collect::>(); + assert_eq!(listed(&mut db), want(&[("Regular", 400), ("Italic", 400), ("Bold", 700), ("Bold Italic", 700)])); + assert_eq!(resolved(&db, "Synthetic Slab", "Bold Italic"), pair("synthetic slab bold", "Italic"), "the style drawn by that face"); + // Faces read give their own weights: Synthetic Slab Semi Light's are 350, not the name's 300. + let stand_in = CRAFT_FONTS.first().map(|f| f.bytes.to_vec()).or_else(|| { + let mut installed = BTreeMap::new(); + for dir in system_font_dirs() { + scan_dir(&dir, 0, &mut installed); + } + installed.values().flat_map(|(_, v)| v).find_map(|p| std::fs::read(&p.path).ok()) + }); + let Some(bytes) = stand_in.map(Arc::new) else { + eprintln!("skipping the read faces: no font to stand in"); + return; + }; + let face = |family: &str, style: &str, weight: u16, italic: bool| { + let mut f = Face::from_bytes(FontBytes::Shared(bytes.clone()), 0, Some(family), Some(style)).unwrap(); + f.instances.clear(); + (f.weight, f.italic) = (weight, italic); + f + }; + let mut db = FontDb::default(); + db.add(face("Synthetic Slab", "Regular", 400, false)); + db.add(face("Synthetic Slab Semi Light", "Regular", 350, false)); + db.add(face("Synthetic Slab Semi Light", "Italic", 350, true)); + assert_eq!(listed(&mut db), want(&[("Semi Light", 350), ("Semi Light Italic", 350), ("Regular", 400)])); +} From 8864068cd592f517d4dd4b0ce6c4270957d9d0c6 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Tue, 3 Nov 2026 04:21:45 +0000 Subject: [PATCH 13/36] fix(engine): compare online servers' paths with their case same_server lowercased the whole address, so files on /Team/ and /team/ (which a proxy can route to different servers) counted as one server and the online refresh sent both files' owner tokens to whichever answered. The scheme and host still compare without case; the path keeps its. --- crates/engine/src/online_tests.rs | 3 +++ crates/engine/src/sharing/online.rs | 13 ++++++++----- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/crates/engine/src/online_tests.rs b/crates/engine/src/online_tests.rs index af13db8e7..c6feca29c 100644 --- a/crates/engine/src/online_tests.rs +++ b/crates/engine/src/online_tests.rs @@ -590,4 +590,7 @@ fn same_server_ignores_the_default_port_before_a_path() { assert!(same_server("wss://share.example:443/figcraft/", "wss://share.example/figcraft/")); assert!(same_server("ws://host:80/x", "ws://host/x")); assert!(!same_server("wss://share.example:8443/figcraft/", "wss://share.example/figcraft/")); + // The path is a route: owner tokens for /Team/ must never be sent to /team/. + assert!(same_server("WSS://Share.Example/team/", "wss://share.example/team")); + assert!(!same_server("wss://share.example/Team/", "wss://share.example/team/")); } diff --git a/crates/engine/src/sharing/online.rs b/crates/engine/src/sharing/online.rs index d68b20f82..89eb8a266 100644 --- a/crates/engine/src/sharing/online.rs +++ b/crates/engine/src/sharing/online.rs @@ -117,14 +117,17 @@ pub(crate) fn plain_server(server: &str) -> String { /// Two addresses name the same server (case, a closing slash and the scheme's own port aside). pub fn same_server(a: &str, b: &str) -> bool { let norm = |s: &str| { - let s = plain_server(s).to_ascii_lowercase(); + let s = plain_server(s); let s = s.trim_end_matches('/'); - let port = if s.starts_with("wss://") { ":443" } else { ":80" }; let start = s.find("://").map_or(0, |i| i + 3); let end = s[start..].find('/').map_or(s.len(), |i| start + i); - match s[start..end].strip_suffix(port) { - Some(host) => format!("{}{}{}", &s[..start], host, &s[end..]), - None => s.to_string(), + // The scheme and host compare without case; the path routes (a proxy may send + // `/Team/` and `/team/` to different servers), so it keeps its case. + let head = s[..end].to_ascii_lowercase(); + let port = if head.starts_with("wss://") { ":443" } else { ":80" }; + match head[start..].strip_suffix(port) { + Some(host) => format!("{}{}{}", &head[..start], host, &s[end..]), + None => format!("{head}{}", &s[end..]), } }; norm(a) == norm(b) From 4e7d8319f1c04428672e7c84e80d63b9eb11f966 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Tue, 3 Nov 2026 04:22:15 +0000 Subject: [PATCH 14/36] fix(collab-net): hold a health check's header read to the handshake deadline The request line was read within the hello timeout, but the header loop after it only timed out per read, so a peer dripping header bytes kept the worker thread and its connection slot for as long as it liked. Each header read now gets what is left of the one deadline. --- crates/collab-net/src/hub/conn.rs | 34 +++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/crates/collab-net/src/hub/conn.rs b/crates/collab-net/src/hub/conn.rs index 1f365cbab..345f94117 100644 --- a/crates/collab-net/src/hub/conn.rs +++ b/crates/collab-net/src/hub/conn.rs @@ -51,6 +51,12 @@ fn health_check(stream: &mut TcpStream, until: Instant) -> bool { let mut req = Vec::new(); let mut chunk = [0u8; 1024]; while !req.windows(4).any(|w| w == b"\r\n\r\n") && req.len() < 16 << 10 { + // The same deadline as the request line: a peer dripping header bytes would otherwise + // hold this thread and its connection slot for as long as it liked. + let left = until.saturating_duration_since(Instant::now()); + if left.is_zero() || stream.set_read_timeout(Some(left)).is_err() { + break; + } match stream.read(&mut chunk) { Ok(0) | Err(_) => break, Ok(n) => req.extend_from_slice(chunk.get(..n).unwrap_or_default()), @@ -407,3 +413,31 @@ fn linger(ws: &mut WebSocket) { } } } + +#[cfg(test)] +mod health_check_tests { + use super::*; + + #[test] + fn a_health_check_dripping_headers_ends_at_the_deadline() { + let listener = TcpListener::bind("127.0.0.1:0").unwrap(); + let addr = listener.local_addr().unwrap(); + let client = std::thread::spawn(move || { + let mut c = TcpStream::connect(addr).unwrap(); + c.write_all(b"GET /healthz HTTP/1.1\r\n").unwrap(); + // One header byte every 20 ms, far past the deadline, until the server hangs up. + for _ in 0..200 { + if c.write_all(b"X").is_err() { + break; + } + std::thread::sleep(Duration::from_millis(20)); + } + }); + let (mut stream, _) = listener.accept().unwrap(); + let start = Instant::now(); + assert!(health_check(&mut stream, start + Duration::from_millis(300))); + assert!(start.elapsed() < Duration::from_secs(2), "{:?}", start.elapsed()); + drop(stream); + client.join().unwrap(); + } +} From a9e66d2de9cc628a09f98898b69ec8a5bb2404fc Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Tue, 3 Nov 2026 04:24:32 +0000 Subject: [PATCH 15/36] perf(vectordrawable): keep warning names in a set Each affected layer name was checked against every name already kept for the warning, quadratic in the number of distinct names although only three are ever shown. A set holds the distinct names; the first three stay in order. --- crates/vectordrawable/src/warnings.rs | 38 ++++++++++++++++++++++----- 1 file changed, 32 insertions(+), 6 deletions(-) diff --git a/crates/vectordrawable/src/warnings.rs b/crates/vectordrawable/src/warnings.rs index 445198d5b..6f7f152ef 100644 --- a/crates/vectordrawable/src/warnings.rs +++ b/crates/vectordrawable/src/warnings.rs @@ -63,27 +63,53 @@ const NAMED: usize = 3; #[derive(Default)] pub(crate) struct Warnings { - seen: std::collections::BTreeMap>, + /// Per warning: the distinct names so far (a set, so a document with many distinct names + /// doesn't make each check a scan of all before it), and the first few in order. + seen: std::collections::BTreeMap, Vec)>, } impl Warnings { pub fn add(&mut self, w: Warn, layer: &str) { - let names = self.seen.entry(w).or_default(); - if !names.iter().any(|n| n == layer) { - names.push(layer.to_string()); + let (distinct, first) = self.seen.entry(w).or_default(); + if distinct.insert(layer.to_string()) && first.len() < NAMED { + first.push(layer.to_string()); } } pub fn finish(self) -> Vec { self.seen .into_iter() - .map(|(w, names)| { + .map(|(w, (distinct, names))| { let shown: Vec = names.iter().take(NAMED).map(|n| if n.is_empty() { "unnamed layer".to_string() } else { n.clone() }).collect(); - let more = names.len().saturating_sub(NAMED); + let more = distinct.len().saturating_sub(NAMED); let more = if more > 0 { format!(", {more} more") } else { String::new() }; format!("{} ({}{more})", w.message(), shown.join(", ")) }) .collect() } } + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn names_are_counted_once_each_and_the_first_three_shown() { + let mut w = Warnings::default(); + for name in ["a", "b", "a", "c", "d", "b", "e"] { + w.add(Warn::NothingDrawn, name); + } + let lines = w.finish(); + assert_eq!(lines.len(), 1); + assert!(lines[0].ends_with("(a, b, c, 2 more)"), "{}", lines[0]); + // Many distinct names: each is one set insertion, not a scan of all before it. + let mut w = Warnings::default(); + let start = std::time::Instant::now(); + for i in 0..200_000 { + w.add(Warn::TooLarge, &format!("layer {i}")); + } + assert!(w.finish()[0].ends_with("199997 more)")); + assert!(start.elapsed() < std::time::Duration::from_secs(5), "{:?}", start.elapsed()); + } +} From dd03165d79362b2d25b3c21de7128a0c24d31544 Mon Sep 17 00:00:00 2001 From: ljkx <177671075+ljkx@users.noreply.github.com> Date: Tue, 3 Nov 2026 05:27:23 +0100 Subject: [PATCH 16/36] M4: weight steps read number weights after a width too (#1831) An off-list "Condensed 600" read as 400, since a number word counted as a weight only at the start of the name: weightUp took Condensed 500 and weightDown found nothing. A number from 100 to 1000 now counts in any position, as W numbers do. Smaller numbers (a width grade, an optical size: "Condensed 2", "Caption 12") are part of the width rather than a weight, so optical sizes no longer step into each other. --- crates/engine/src/cmd/text.rs | 13 ++++++++++--- crates/engine/src/text_weight_step_tests.rs | 14 ++++++++++++++ 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/crates/engine/src/cmd/text.rs b/crates/engine/src/cmd/text.rs index 9024e1229..392fd4636 100644 --- a/crates/engine/src/cmd/text.rs +++ b/crates/engine/src/cmd/text.rs @@ -128,6 +128,13 @@ fn w_number(word: &str) -> Option { (1..=9).contains(&n).then_some(n * 100) } +/// A weight number as some families name styles ("Condensed 600"). Below 100 it is something else +/// (a width grade, an optical size: "Condensed 2", "Caption 12"). +fn number_weight(word: &str) -> Option { + let n = word.parse::().ok().filter(|_| word.bytes().all(|b| b.is_ascii_digit()))?; + (100..=1000).contains(&n).then_some(n) +} + /// What a style name says besides its weight and slant ("Narrow Bold Italic" → "narrow", /// "Extra Condensed Bold" → "extra condensed"). fn style_rest(style: &str) -> String { @@ -162,7 +169,7 @@ fn style_rest(style: &str) -> String { const GRADES: [&str; 4] = ["extra", "ultra", "semi", "demi"]; let s = style.to_ascii_lowercase().replace('-', " "); let words: Vec<&str> = s.split_whitespace().collect(); - let weight = |w: &str| WEIGHTS.contains(&w) || w_number(w).is_some() || w.chars().all(|c| c.is_ascii_digit()); + let weight = |w: &str| WEIGHTS.contains(&w) || w_number(w).or_else(|| number_weight(w)).is_some(); let rest = words.iter().enumerate().filter(|(i, w)| { let graded = GRADES.contains(w) && words.get(i + 1).is_some_and(|next| weight(next) && !matches!(*next, "italic" | "oblique")); !weight(w) && !graded @@ -176,10 +183,10 @@ fn slanted(style: &str) -> bool { s.contains("italic") || s.contains("oblique") } -/// The weight a style name says ("W3", "W6 Italic" and "Condensed W7" too). +/// The weight a style name says ("W3", "W6 Italic", "Condensed W7" and "Condensed 600" too). pub(crate) fn name_weight(style: &str) -> u16 { let words = style.to_ascii_lowercase().replace('-', " "); - words.split_whitespace().find_map(w_number).unwrap_or_else(|| figcraft_doc::style_weight(style)) + words.split_whitespace().find_map(|w| w_number(w).or_else(|| number_weight(w))).unwrap_or_else(|| figcraft_doc::style_weight(style)) } /// The next heavier (`up`) or lighter style of `styles` (a family's with the weight each is listed diff --git a/crates/engine/src/text_weight_step_tests.rs b/crates/engine/src/text_weight_step_tests.rs index e8bf65a7b..057a0a4e5 100644 --- a/crates/engine/src/text_weight_step_tests.rs +++ b/crates/engine/src/text_weight_step_tests.rs @@ -77,6 +77,20 @@ fn hairline_and_w_numbers_are_weights() { assert_eq!(next_style(&hiragino, &at("Bold"), false).as_deref(), Some("W6")); } +#[test] +fn number_weights_count_after_a_width_but_other_numbers_dont() { + // An off-list "Condensed 600" is 600, as "600" alone is: between Condensed 500 and 700. + let condensed = weighed(&[("Condensed 300", 300), ("Condensed 500", 500), ("Condensed 700", 700)]); + assert_eq!(next_style(&condensed, &at("Condensed 600"), true).as_deref(), Some("Condensed 700")); + assert_eq!(next_style(&condensed, &at("Condensed 600"), false).as_deref(), Some("Condensed 500")); + assert_eq!((name_weight("Condensed 600"), name_weight("600 Italic"), name_weight("Condensed 1000")), (600, 600, 1000)); + // A number that isn't a weight (a width grade, an optical size) is part of the width. + assert_eq!((name_weight("Condensed 2"), name_weight("Caption 12 Bold"), name_weight("Condensed +600")), (400, 700, 400)); + let optical = styles(&["Caption 12 Regular", "Caption 24 Regular", "Caption 12 Bold", "Caption 24 Bold"]); + assert_eq!(walk(&optical, "Caption 12 Regular", true), ["Caption 12 Bold"]); + assert_eq!(walk(&optical, "Caption 24 Bold", false), ["Caption 24 Regular"]); +} + #[test] fn a_custom_weight_axis_value_steps_from_where_it_is() { let family = styles(&["Light", "Regular", "Medium", "Bold"]); From 692c4545ba2dcf31a405fd7c28cdaac9d13e813d Mon Sep 17 00:00:00 2001 From: ljkx <177671075+ljkx@users.noreply.github.com> Date: Tue, 3 Nov 2026 11:41:15 +0100 Subject: [PATCH 17/36] M4: weight steps read Univers numbers (45 Light, 57 Condensed) by weight within their width (#1831) --- crates/engine/src/cmd/text.rs | 95 +++++++++++++-------- crates/engine/src/text_weight_step_tests.rs | 32 +++++++ 2 files changed, 92 insertions(+), 35 deletions(-) diff --git a/crates/engine/src/cmd/text.rs b/crates/engine/src/cmd/text.rs index 392fd4636..2ef66c519 100644 --- a/crates/engine/src/cmd/text.rs +++ b/crates/engine/src/cmd/text.rs @@ -135,46 +135,65 @@ fn number_weight(word: &str) -> Option { (100..=1000).contains(&n).then_some(n) } +/// Style-name words that give a weight or a slant. +const WEIGHT_WORDS: [&str; 25] = [ + "thin", + "hairline", + "extralight", + "ultralight", + "light", + "semilight", + "demilight", + "regular", + "normal", + "roman", + "book", + "medium", + "semibold", + "demibold", + "bold", + "extrabold", + "ultrabold", + "black", + "extrablack", + "ultrablack", + "heavy", + "italic", + "oblique", + "plain", + "standard", +]; + +/// Words that grade the weight word after them ("Extra Bold") but a width otherwise ("Extra Condensed"). +const GRADES: [&str; 4] = ["extra", "ultra", "semi", "demi"]; + +/// The width a Univers number leading a style name gives, as Univers, Frutiger and Helvetica Neue +/// LT name styles ("45 Light", "55 Roman", "57 Condensed", "67 Bold Condensed"): the first digit +/// grades the weight, the second the width (3 or 4 extended, 5 or 6 normal, 7 or 8 condensed, 9 +/// ultra condensed; even is italic, which the name says too). Only before weight, slant and width +/// words, so another leading number ("12 Regular", "55 Rounded") stays part of the width. +fn univers_width(words: &[&str]) -> Option { + const WIDTHS: [&str; 6] = ["condensed", "compressed", "narrow", "extended", "expanded", "wide"]; + let (code, rest) = words.split_first()?; + let &[b'1'..=b'9', d @ b'3'..=b'9'] = code.as_bytes() else { return None }; + let known = |w: &&str| WEIGHT_WORDS.contains(w) || GRADES.contains(w) || WIDTHS.contains(w); + (!rest.is_empty() && rest.iter().all(known)).then_some((d - b'1') / 2) +} + /// What a style name says besides its weight and slant ("Narrow Bold Italic" → "narrow", -/// "Extra Condensed Bold" → "extra condensed"). +/// "Extra Condensed Bold" → "extra condensed", "67 Bold Condensed" → its Univers width and "condensed"). fn style_rest(style: &str) -> String { - const WEIGHTS: [&str; 25] = [ - "thin", - "hairline", - "extralight", - "ultralight", - "light", - "semilight", - "demilight", - "regular", - "normal", - "roman", - "book", - "medium", - "semibold", - "demibold", - "bold", - "extrabold", - "ultrabold", - "black", - "extrablack", - "ultrablack", - "heavy", - "italic", - "oblique", - "plain", - "standard", - ]; - // Words that grade the weight word after them ("Extra Bold") but a width otherwise ("Extra Condensed"). - const GRADES: [&str; 4] = ["extra", "ultra", "semi", "demi"]; let s = style.to_ascii_lowercase().replace('-', " "); let words: Vec<&str> = s.split_whitespace().collect(); - let weight = |w: &str| WEIGHTS.contains(&w) || w_number(w).or_else(|| number_weight(w)).is_some(); + let weight = |w: &str| WEIGHT_WORDS.contains(&w) || w_number(w).or_else(|| number_weight(w)).is_some(); let rest = words.iter().enumerate().filter(|(i, w)| { let graded = GRADES.contains(w) && words.get(i + 1).is_some_and(|next| weight(next) && !matches!(*next, "italic" | "oblique")); !weight(w) && !graded }); - rest.map(|(_, w)| *w).collect::>().join(" ") + let univers = univers_width(&words).map(|d| format!("univers width {d}")); + // The Univers number (the first word kept) gives way to its width. + let rest = rest.map(|(_, w)| *w).skip(usize::from(univers.is_some())); + univers.as_deref().into_iter().chain(rest).collect::>().join(" ") } /// A style name that slants: italic, or oblique as some families name it. @@ -183,10 +202,16 @@ fn slanted(style: &str) -> bool { s.contains("italic") || s.contains("oblique") } -/// The weight a style name says ("W3", "W6 Italic", "Condensed W7" and "Condensed 600" too). +/// The weight a style name says ("W3", "W6 Italic", "Condensed W7", "Condensed 600" and "45 Light" too). pub(crate) fn name_weight(style: &str) -> u16 { - let words = style.to_ascii_lowercase().replace('-', " "); - words.split_whitespace().find_map(|w| w_number(w).or_else(|| number_weight(w))).unwrap_or_else(|| figcraft_doc::style_weight(style)) + let s = style.to_ascii_lowercase().replace('-', " "); + let words: Vec<&str> = s.split_whitespace().collect(); + // A Univers number's weight digit has no fixed CSS weight ("65" is Medium in Helvetica Neue, + // Bold in Univers): the words after it say it. + if let Some((_, rest)) = words.split_first().filter(|_| univers_width(&words).is_some()) { + return figcraft_doc::style_weight(&rest.join(" ")); + } + words.iter().find_map(|w| w_number(w).or_else(|| number_weight(w))).unwrap_or_else(|| figcraft_doc::style_weight(style)) } /// The next heavier (`up`) or lighter style of `styles` (a family's with the weight each is listed diff --git a/crates/engine/src/text_weight_step_tests.rs b/crates/engine/src/text_weight_step_tests.rs index 057a0a4e5..a6c465789 100644 --- a/crates/engine/src/text_weight_step_tests.rs +++ b/crates/engine/src/text_weight_step_tests.rs @@ -91,6 +91,38 @@ fn number_weights_count_after_a_width_but_other_numbers_dont() { assert_eq!(walk(&optical, "Caption 24 Bold", false), ["Caption 24 Regular"]); } +#[test] +fn univers_numbers_step_by_weight_within_their_width() { + // Helvetica Neue LT, Univers, Frutiger: the first digit grades the weight, the second the width. + let hn = weighed(&[ + ("45 Light", 300), + ("46 Light Italic", 300), + ("55 Roman", 400), + ("56 Italic", 400), + ("57 Condensed", 400), + ("65 Medium", 500), + ("67 Medium Condensed", 500), + ("75 Bold", 700), + ("76 Bold Italic", 700), + ("77 Bold Condensed", 700), + ]); + assert_eq!(walk(&hn, "55 Roman", true), ["65 Medium", "75 Bold"]); + assert_eq!(walk(&hn, "65 Medium", false), ["55 Roman", "45 Light"]); + assert_eq!(walk(&hn, "57 Condensed", true), ["67 Medium Condensed", "77 Bold Condensed"]); + assert_eq!(walk(&hn, "67 Medium Condensed", false), ["57 Condensed"]); + assert_eq!(walk(&hn, "46 Light Italic", true), ["56 Italic", "76 Bold Italic"]); + // Faces not read yet: the words after the number give the weight. + let univers = styles(&["45 Light", "55 Roman", "65 Bold", "75 Black", "57 Condensed", "67 Bold Condensed"]); + assert_eq!(walk(&univers, "45 Light", true), ["55 Roman", "65 Bold", "75 Black"]); + assert_eq!(walk(&univers, "67 Bold Condensed", false), ["57 Condensed"]); + assert_eq!((name_weight("45 Light"), name_weight("75 Black"), name_weight("57 Condensed")), (300, 900, 400)); + // Other leading numbers stay part of the width: before another word, or not a width digit. + let other = styles(&["12 Regular", "12 Bold", "55 Rounded", "55 Rounded Bold", "Regular", "Bold"]); + assert_eq!(walk(&other, "12 Regular", true), ["12 Bold"]); + assert_eq!(walk(&other, "55 Rounded", true), ["55 Rounded Bold"]); + assert_eq!(walk(&other, "Regular", true), ["Bold"]); +} + #[test] fn a_custom_weight_axis_value_steps_from_where_it_is() { let family = styles(&["Light", "Regular", "Medium", "Bold"]); From 02db900cc81e0b57c6861beded522c33a156f2a6 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Tue, 3 Nov 2026 04:02:53 +0000 Subject: [PATCH 18/36] fix(engine): keep plugins out of branches, saved versions and library links A read-only plugin could archive, merge, create or update a branch: branch state lives beside the document, so neither the command's history flag nor the document Arc check saw the write. Any plugin could read a saved version through dev.compare's version parameter although version.* is denied, and library.list handed plugins each library's path, which for a server library is the share link with its token. --- crates/engine/src/doc_list_paths_tests.rs | 17 +++++++++ crates/engine/src/extensions/plugins.rs | 43 ++++++++++++++++++++--- 2 files changed, 56 insertions(+), 4 deletions(-) diff --git a/crates/engine/src/doc_list_paths_tests.rs b/crates/engine/src/doc_list_paths_tests.rs index 0c62a18dd..f69941919 100644 --- a/crates/engine/src/doc_list_paths_tests.rs +++ b/crates/engine/src/doc_list_paths_tests.rs @@ -46,3 +46,20 @@ fn a_plugin_gets_names_but_no_paths() { assert!(out.contains("Front"), "{out}"); assert!(!out.contains(SECRET) && !out.contains("path"), "{out}"); } + +#[test] +fn a_plugin_gets_library_names_but_not_their_links() { + const LINK: &str = "ws://tracker.example:9/?file=f&token=per-file-secret"; + let mut s = Session::new(); + s.doc_mut().unwrap().libraries_mut().enabled.push(figcraft_doc::LibraryLink { + id: "lib".into(), + name: "Kit".into(), + path: LINK.into(), + version: 3, + }); + let tail = "(call $set_output (i32.const 40000) (call $reply_read (i32.const 40000) (i32.const 20000))) (return (i32.const 0))"; + install(&mut s, manifest("org.test.libs", "read", &[]), &script(&[("library.list", json!({}))], OnRefusal::Fail, tail)); + let out = ex(&mut s, "plugin.run", json!({"id": "org.test.libs"}))["output"].to_string(); + assert!(out.contains("Kit"), "{out}"); + assert!(!out.contains("per-file-secret") && !out.contains("\\\"path\\\""), "{out}"); +} diff --git a/crates/engine/src/extensions/plugins.rs b/crates/engine/src/extensions/plugins.rs index 2b1094306..78044ee71 100644 --- a/crates/engine/src/extensions/plugins.rs +++ b/crates/engine/src/extensions/plugins.rs @@ -170,12 +170,21 @@ fn refusal(m: &Manifest, command: &str, params: &Value) -> Option { if command == "variable.import" && get(params, "variables").and_then(Value::as_str).is_some_and(|t| !t.trim_start().starts_with('{')) { return Some("plugins can't read files: pass the variables JSON itself".into()); } + // A saved version is the file's history, which plugins can't read (`version.` is denied). + if command == "dev.compare" && get(params, "version").is_some_and(|v| !v.is_null()) { + return Some("plugins can't read saved versions: leave out `version`".into()); + } if !m.permissions.allows(command) { return Some(format!("`{command}` isn't in the commands {} asked permission for", m.name)); } if m.permissions.access == Access::Read && find_command(command).is_some_and(|c| c.history) { return Some(format!("`{command}` edits the document, and {} may only read it", m.name)); } + // Branches live beside the document (not in its undo history or its `Arc`), so the write + // checks below don't see them change. + if m.permissions.access == Access::Read && matches!(command, "branch.create" | "branch.updateFromMain" | "branch.merge" | "branch.archive") { + return Some(format!("`{command}` changes the file's branches, and {} may only read it", m.name)); + } None } @@ -253,10 +262,19 @@ impl figcraft_plugin::Host for EngineHost<'_> { Ok(v) }); r.map(|mut v| { - // A plugin gets the open files' names, not where they are on disk (#1117). - if command == "doc.list" { - for e in v.as_array_mut().into_iter().flatten().filter_map(Value::as_object_mut) { - e.remove("path"); + // A plugin gets the open files' and libraries' names, not where they are on disk or + // the share links (with their tokens) that reach them (#1117). + if matches!(command, "doc.list" | "library.list") { + // `doc.list` is a list; `library.list` keeps its list under `libraries`. + let list = if command == "library.list" { v.get_mut("libraries") } else { Some(&mut v) }; + for e in list.and_then(Value::as_array_mut).into_iter().flatten().filter_map(Value::as_object_mut) { + // An error may quote the path too. + if let Some(Value::String(path)) = e.remove("path") + && !path.is_empty() + && let Some(Value::String(err)) = e.get_mut("error") + { + *err = err.replace(&path, "the library"); + } } } v.to_string() @@ -698,6 +716,23 @@ mod refusal_tests { let r = refusal(&m, "library.publishToServer", &json!({})); assert!(r.is_some(), "library.publishToServer uploads the document and must be refused"); } + + #[test] + fn read_only_plugin_cannot_change_branches() { + let m = Manifest::parse(r#"{"id":"x.y","name":"X","main":"plugin.wasm"}"#).unwrap(); + for cmd in ["branch.archive", "branch.updateFromMain", "branch.merge", "branch.create"] { + assert!(refusal(&m, cmd, &json!({})).is_some(), "{cmd} changes persisted branch state"); + } + assert!(refusal(&m, "branch.list", &json!({})).is_none()); + } + + #[test] + fn plugins_cannot_compare_against_a_saved_version() { + let m = Manifest::parse(r#"{"id":"x.y","name":"X","main":"plugin.wasm","permissions":{"access":"write"}}"#).unwrap(); + assert!(refusal(&m, "dev.compare", &json!({"version": "v1"})).is_some()); + assert!(refusal(&m, "dev.compare", &json!({"version": null})).is_none()); + assert!(refusal(&m, "dev.compare", &json!({})).is_none()); + } } #[cfg(test)] From 4cd7313ca2ccfaa6a71308b03c8f5ad472d7bf6a Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 4 Nov 2026 00:20:16 +0000 Subject: [PATCH 19/36] address review: give plugins a fixed message for library failures --- crates/engine/src/doc_list_paths_tests.rs | 17 +++++++++++++++++ crates/engine/src/extensions/plugins.rs | 22 +++++++++++++--------- 2 files changed, 30 insertions(+), 9 deletions(-) diff --git a/crates/engine/src/doc_list_paths_tests.rs b/crates/engine/src/doc_list_paths_tests.rs index f69941919..0d73d0736 100644 --- a/crates/engine/src/doc_list_paths_tests.rs +++ b/crates/engine/src/doc_list_paths_tests.rs @@ -63,3 +63,20 @@ fn a_plugin_gets_library_names_but_not_their_links() { assert!(out.contains("Kit"), "{out}"); assert!(!out.contains("per-file-secret") && !out.contains("\\\"path\\\""), "{out}"); } + +#[test] +fn a_plugin_gets_a_fixed_message_for_library_update_failures() { + const LINK: &str = "/home/someone/private/kits/kit.figcraft"; + let mut s = Session::new(); + s.doc_mut().unwrap().libraries_mut().enabled.push(figcraft_doc::LibraryLink { + id: "lib".into(), + name: "Kit".into(), + path: LINK.into(), + version: 3, + }); + let tail = "(call $set_output (i32.const 40000) (call $reply_read (i32.const 40000) (i32.const 20000))) (return (i32.const 0))"; + install(&mut s, manifest("org.test.upd", "read", &[]), &script(&[("library.updates", json!({}))], OnRefusal::Fail, tail)); + let out = ex(&mut s, "plugin.run", json!({"id": "org.test.upd"}))["output"].to_string(); + assert!(out.contains("could not be read"), "{out}"); + assert!(!out.contains("someone") && !out.contains("private"), "{out}"); +} diff --git a/crates/engine/src/extensions/plugins.rs b/crates/engine/src/extensions/plugins.rs index 78044ee71..7677a9b7d 100644 --- a/crates/engine/src/extensions/plugins.rs +++ b/crates/engine/src/extensions/plugins.rs @@ -264,16 +264,20 @@ impl figcraft_plugin::Host for EngineHost<'_> { r.map(|mut v| { // A plugin gets the open files' and libraries' names, not where they are on disk or // the share links (with their tokens) that reach them (#1117). - if matches!(command, "doc.list" | "library.list") { - // `doc.list` is a list; `library.list` keeps its list under `libraries`. - let list = if command == "library.list" { v.get_mut("libraries") } else { Some(&mut v) }; + if matches!(command, "doc.list" | "library.list" | "library.updates") { + // `doc.list` is a list; `library.list` keeps its list under `libraries`, and + // `library.updates` its failures under `errors`. + let list = match command { + "library.list" => v.get_mut("libraries"), + "library.updates" => v.get_mut("errors"), + _ => Some(&mut v), + }; for e in list.and_then(Value::as_array_mut).into_iter().flatten().filter_map(Value::as_object_mut) { - // An error may quote the path too. - if let Some(Value::String(path)) = e.remove("path") - && !path.is_empty() - && let Some(Value::String(err)) = e.get_mut("error") - { - *err = err.replace(&path, "the library"); + e.remove("path"); + // A failure's text may quote the path, a token or another form of it: the + // plugin gets a fixed message. + if let Some(err) = e.get_mut("error").filter(|v| v.is_string()) { + *err = json!("the library could not be read"); } } } From bda7ca910d287663322f7bf932094636ae4f7712 Mon Sep 17 00:00:00 2001 From: Trevor Brown Date: Wed, 4 Nov 2026 01:52:02 -0500 Subject: [PATCH 20/36] M6: a FigJam elbow connector saved with its path keeps it on import (#1910) The `.jam` importer routed every elbowed connector itself, so one drawn around a layer by hand in FigJam came in routed through it. FigJam saves the path as `connectorControlPoints`: one per run between the first and the last, each a point on its run (in the connector's parent's coordinates) with the run's axis; the first run leaves the start's side and the last arrives at the end's. They become the `ConnectorPath::Runs` a board connector reshaped by hand has, walked by `figcraft_doc::route_along`, so the path is kept exactly. Points that don't make such a path (off both axes, two runs the same way in a row, a first or last run sideways to its side, more runs than a hand could make) leave the connector to the router as before, and only connectors routed here count in the "own routing" note. `figcraft_doc::attach_points` and `MAX_RUNS` are exported for it. Docs: file-format-parity.md, boards-parity.md. Co-Authored-By: Claude Fable 5.1 --- crates/doc/src/board_route.rs | 11 +++- crates/doc/src/lib.rs | 2 +- crates/format/src/fig/map/connector.rs | 50 +++++++++++++++-- crates/format/src/fig/tail_tests.rs | 77 ++++++++++++++++++++++++++ crates/format/src/fig/tests.rs | 3 +- docs/boards-parity.md | 2 +- docs/file-format-parity.md | 7 ++- 7 files changed, 140 insertions(+), 12 deletions(-) diff --git a/crates/doc/src/board_route.rs b/crates/doc/src/board_route.rs index 1aa45c810..38efbef9b 100644 --- a/crates/doc/src/board_route.rs +++ b/crates/doc/src/board_route.rs @@ -66,6 +66,12 @@ pub fn attached_sides(from: RouteEnd, to: RouteEnd) -> (Option, Option (Point, Point) { + (attach(from, to.centre()).0, attach(to, from.centre()).0) +} + /// The route's path handles: one for each run of an elbow and one for a curve, with the portion /// of the path each moves and where it sits. pub fn path_handles(pts: &[Point], routing: Routing) -> Vec<(usize, Point)> { @@ -90,8 +96,9 @@ pub fn reshaped(from: RouteEnd, to: RouteEnd, routing: Routing, path: Option<&Co } } -/// A path of more runs than this can't be made by hand: [`reshaped`] refuses another. -const MAX_RUNS: usize = 64; +/// A path of more runs than this can't be made by hand: [`reshaped`] refuses another, and an +/// importer leaves a saved one to the router. +pub const MAX_RUNS: usize = 64; /// The runs of the right-angled route `pts` with run `portion` moved to `p`. fn reshaped_runs(pts: &[Point], portion: usize, p: Point) -> Option { diff --git a/crates/doc/src/lib.rs b/crates/doc/src/lib.rs index 1349aac1d..b60a65ada 100644 --- a/crates/doc/src/lib.rs +++ b/crates/doc/src/lib.rs @@ -27,7 +27,7 @@ pub mod vector_faces; pub mod vector_regions; pub use board::*; -pub use board_route::{RouteEnd, attached_sides, path_handles, reshaped, route_along, route_points}; +pub use board_route::{MAX_RUNS, RouteEnd, attach_points, attached_sides, path_handles, reshaped, route_along, route_points}; pub use colors::*; pub use comments::*; pub use facilitation::*; diff --git a/crates/format/src/fig/map/connector.rs b/crates/format/src/fig/map/connector.rs index de2ff501c..01c07c00e 100644 --- a/crates/format/src/fig/map/connector.rs +++ b/crates/format/src/fig/map/connector.rs @@ -2,7 +2,7 @@ use super::layer::{cap_name, own_text, svg_path, valid_size}; use super::paint::{paint, stroke}; use super::{Affine, Kv, Mapper, NO_STYLE, Obj, Point, Value, View, generated_record, guid, json, matrix, network, num, rows}; use figcraft_doc::geom::kurbo::{BezPath, PathEl, Rect, Shape}; -use figcraft_doc::{RouteEnd, Routing, Side, route_points}; +use figcraft_doc::{ConnectorPath, MAX_RUNS, RouteEnd, Routing, Side, attach_points, attached_sides, route_along}; /// How a connector imports: from its saved snapshot (`terminal`: as one vector, no room for its /// label), or drawn from its ends, as a frame with its line and `label` when it has one. @@ -48,7 +48,8 @@ impl<'a> Mapper<'a> { /// A connector's end caps, and when it has no saved outline or network its line between its /// ends (free points, or a sibling layer): straight to the point given on the layer (its - /// centre unless given), or elbowed or curved from a side of it, as a board connector runs. + /// centre unless given), or elbowed or curved from a side of it, as a board connector runs; + /// an elbow saved with its path (FigJam's control points) runs along it (#1910). /// Returns the middle of that line by length, in the connector's own coordinates. pub(super) fn connector(&mut self, o: &mut Obj, v: &View<'a>, space: Affine) -> Option { for (from, to) in [("connectorStartCap", "strokeCapStart"), ("connectorEndCap", "strokeCapEnd")] { @@ -94,11 +95,13 @@ impl<'a> Mapper<'a> { }; ok.then_some(end) }; - let Some(pts) = end("connectorStart").zip(end("connectorEnd")).and_then(|(a, b)| route_points(a, b, routing)) else { + let ends = end("connectorStart").zip(end("connectorEnd")); + let path = ends.filter(|_| routing == Routing::Elbow).and_then(|(a, b)| saved_runs(v, a, b)); + let Some(pts) = ends.and_then(|(a, b)| route_along(a, b, routing, path.as_ref())) else { self.warn("connectors whose ends can't be placed are empty"); return None; }; - if routing != Routing::Straight { + if routing != Routing::Straight && path.is_none() { self.warn("elbowed and curved connectors without a saved path follow FigCraft's own routing"); } // A curved route is one curve: its ends and the two control points between them. @@ -407,6 +410,45 @@ pub(super) fn connector_has_saved_label(v: &View<'_>) -> bool { .is_some_and(|s| !s.trim().is_empty()) } +/// The path a FigJam elbow connector was saved with: its `connectorControlPoints`, one per run +/// between the first and the last, each a point on its run (in the connector's parent's +/// coordinates, like its ends) with the run's axis; the first run leaves the start's side and the +/// last arrives at the end's, so neither is saved. `None` without any, or when they don't make +/// such a path: a point off both axes, two runs in a row the same way, a first or last run that +/// would leave or arrive sideways to its side, or more runs than a hand could make here. +fn saved_runs(v: &View<'_>, from: RouteEnd, to: RouteEnd) -> Option { + let saved = v.list("connectorControlPoints"); + if saved.is_empty() || saved.len() + 2 > MAX_RUNS { + return None; + } + let (p0, p1) = attach_points(from, to); + let mid = p0.midpoint(p1); + let mut at = Vec::with_capacity(saved.len()); + let (mut first, mut last) = (None, None); + for p in saved { + let pos = p.get("position").and_then(|q| Some(Point::new(num(q, "x")?, num(q, "y")?)))?; + let (ax, ay) = p.get("axis").and_then(|q| Some((num(q, "x")?, num(q, "y")?)))?; + let sideways = match (ax != 0.0, ay != 0.0) { + (true, false) => true, + (false, true) => false, + _ => return None, + }; + if last == Some(sideways) { + return None; + } + first.get_or_insert(!sideways); + last = Some(sideways); + at.push(if sideways { pos.y - mid.y } else { pos.x - mid.x }); + } + // The run through each end goes the way its side faces: the first at right angles to the first + // saved run, the last to the last. + let (across, last) = (first?, last?); + let faces_across = |s: Side| matches!(s, Side::Left | Side::Right); + let (s0, s1) = attached_sides(from, to); + let fits = s0.is_none_or(|s| faces_across(s) == across) && s1.is_none_or(|s| faces_across(s) != last); + fits.then_some(ConnectorPath::Runs { across, at }) +} + /// The side of its layer a connector end leaves from: the `magnet` the file names, else the edge /// its point on the layer (`relativePosition`, 0–1) lies on, else the side facing the other end. fn side(e: &Kv<'_>, at: Option<(f64, f64)>) -> Side { diff --git a/crates/format/src/fig/tail_tests.rs b/crates/format/src/fig/tail_tests.rs index 2c8cce032..09e6ed85a 100644 --- a/crates/format/src/fig/tail_tests.rs +++ b/crates/format/src/fig/tail_tests.rs @@ -863,3 +863,80 @@ fn write_fixture() { std::fs::write(out, zip_file(&tail_canvas())).unwrap(); } } + +/// An elbow connector saved with its path (#1910): FigJam's control points, one per run between +/// the first and the last, each on its run with the run's axis, give the path the connector keeps; +/// the first run leaves the start's side and the last arrives at the end's. +#[test] +fn an_elbow_connector_saved_with_its_path_keeps_it() { + let mut message = tail_message(); + let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() }; + let box_at = |id, name: &str, x, y| node(id, Some((1, "*")), "RECTANGLE", name, vec![("size", xy(100.0, 100.0)), ("transform", at(x, y))]); + let point = |x, y, ax, ay| o(vec![("position", xy(x, y)), ("axis", xy(ax, ay))]); + // From A's bottom, across at y 740, down at x 200, into B's left: four runs. + let saved = node( + 66, + Some((1, "+")), + "CONNECTOR", + "Saved", + vec![ + ("strokePaints", arr(vec![solid(0.0, 0.0, 0.0)])), + ("connectorStart", o(vec![("endpointNodeID", g(64)), ("relativePosition", xy(0.5, 1.0))])), + ("connectorEnd", o(vec![("endpointNodeID", g(65)), ("relativePosition", xy(0.0, 0.5))])), + ("connectorLineStyle", e("ELBOWED")), + ("connectorControlPoints", arr(vec![point(150.0, 740.0, 1.0, 0.0), point(200.0, 800.0, 0.0, 1.0)])), + ], + ); + nodes.extend([box_at(64, "A", 0.0, 600.0), box_at(65, "B", 300.0, 800.0), saved]); + let (doc, warnings) = import(&canvas(&schema(), &message), "Saved path").unwrap(); + let world = doc.world_transform(named(&doc, "Saved").id); + let line: Vec<_> = + network_of(&doc, "Saved").vertices.iter().map(|v| world * figcraft_doc::geom::Point::new(v.x, v.y)).map(|p| (p.x, p.y)).collect(); + assert_eq!(line, [(50.0, 700.0), (50.0, 740.0), (200.0, 740.0), (200.0, 850.0), (300.0, 850.0)]); + // The fixture's own Link, saved without a path, is routed here: the note counts it alone. + let routed: Vec<_> = warnings.iter().filter(|w| w.contains("FigCraft's own routing")).collect(); + assert_eq!(routed.len(), 1, "{warnings:?}"); + assert!(!routed[0].contains('×'), "a connector with its path isn't counted among those routed here: {routed:?}"); +} + +/// Saved control points that don't make a path from the connector's sides (#1910): a first run +/// that would leave the bottom sideways, a point off both axes, or two runs in a row the same way +/// leave the connector to FigCraft's routing, as one saved without a path is. +#[test] +fn an_elbow_whose_saved_path_doesnt_fit_its_sides_is_routed_here() { + let mut message = tail_message(); + let Kv::Array(nodes) = field_mut(&mut message, "nodeChanges").unwrap() else { panic!() }; + let box_at = |id, name: &str, x, y| node(id, Some((1, "*")), "RECTANGLE", name, vec![("size", xy(100.0, 100.0)), ("transform", at(x, y))]); + let point = |x, y, ax, ay| o(vec![("position", xy(x, y)), ("axis", xy(ax, ay))]); + let elbow = |id, name: &str, points: Vec>| { + let mut fields = vec![ + ("strokePaints", arr(vec![solid(0.0, 0.0, 0.0)])), + ("connectorStart", o(vec![("endpointNodeID", g(64)), ("relativePosition", xy(0.5, 1.0))])), + ("connectorEnd", o(vec![("endpointNodeID", g(65)), ("relativePosition", xy(0.0, 0.5))])), + ("connectorLineStyle", e("ELBOWED")), + ]; + if !points.is_empty() { + fields.push(("connectorControlPoints", arr(points))); + } + node(id, Some((1, "+")), "CONNECTOR", name, fields) + }; + nodes.extend([ + box_at(64, "A", 0.0, 600.0), + box_at(65, "B", 300.0, 800.0), + elbow(66, "Plain", vec![]), + elbow(67, "Sideways", vec![point(100.0, 650.0, 0.0, 1.0)]), + elbow(68, "Askew", vec![point(150.0, 740.0, 1.0, 1.0)]), + elbow(69, "Repeated", vec![point(150.0, 740.0, 1.0, 0.0), point(150.0, 760.0, 1.0, 0.0)]), + ]); + let (doc, warnings) = import(&canvas(&schema(), &message), "Unfit paths").unwrap(); + let line = |name: &str| -> Vec<(f64, f64)> { + let world = doc.world_transform(named(&doc, name).id); + network_of(&doc, name).vertices.iter().map(|v| world * figcraft_doc::geom::Point::new(v.x, v.y)).map(|p| (p.x, p.y)).collect() + }; + let plain = line("Plain"); + assert!(plain.len() >= 3, "routed in right angles: {plain:?}"); + for name in ["Sideways", "Askew", "Repeated"] { + assert_eq!(line(name), plain, "{name} is routed as one without a path"); + } + assert!(warnings.iter().any(|w| w.contains("FigCraft's own routing")), "{warnings:?}"); +} diff --git a/crates/format/src/fig/tests.rs b/crates/format/src/fig/tests.rs index 2d4a1f7d6..317d0c6f5 100644 --- a/crates/format/src/fig/tests.rs +++ b/crates/format/src/fig/tests.rs @@ -51,6 +51,7 @@ message VariableSetID GUID guid, AssetRef assetRef message ConditionalActions Action[] actions, VariableData condition message VectorData uint vectorNetworkBlob, Vector normalizedSize, NodeChange[] styleOverrideTable message ConnectorEndpoint GUID endpointNodeID, Vector position, Vector relativePosition +message ConnectorControlPoint Vector position, Vector axis message VariableData AnyValue value, DataType dataType message Paint PaintType type, Color color, float opacity, bool visible, Image image, Matrix transform, ColorStop[] stops, VariableData colorVar, ImageScaleMode imageScaleMode message ParentIndex GUID guid, string position @@ -74,7 +75,7 @@ message Event InteractionType interactionType message Action GUID transitionNodeID, TransitionType transitionType, float transitionDuration, EasingType easingType, ConnectionType connectionType, NavigationType navigationType, VariableTarget targetVariable, VariableData targetVariableData, VariableSetID targetVariableSetID, GUID targetVariableModeID, ConditionalActions[] conditionalActions message Interaction Event event, Action[] actions message StartingPoint string name, string position -message NodeChange GUID guid, ParentIndex parentIndex, NodeType type, string name, bool visible, float opacity, Vector size, Matrix transform, Paint[] fillPaints, Paint[] strokePaints, float strokeWeight, float cornerRadius, bool resizeToFit, bool internalOnly, float fontSize, FontName fontName, TextData textData, uint styleID, Path[] fillGeometry, Path[] strokeGeometry, StyleType styleType, StyleId styleIdForFill, SymbolData symbolData, PropDef[] componentPropDefs, PropAssignment[] componentPropAssignments, VariableDataMap parameterConsumptionMap, SetMode[] variableSetModes, VariableID variableSetID, ResolvedType variableResolvedType, Values variableDataValues, ModeMap variableModeBySetMap, Interaction[] prototypeInteractions, StartingPoint prototypeStartingPoint, GUIDPath guidPath, StackMode stackMode, float stackSpacing, float stackHorizontalPadding, float stackVerticalPadding, uint count, float starInnerScale, VectorData vectorData, StrokeCap strokeCap, StrokeJoin strokeJoin, VectorMirror handleMirroring, ShapeWithTextType shapeWithTextType, ConnectorEndpoint connectorStart, ConnectorEndpoint connectorEnd, StrokeCap connectorStartCap, StrokeCap connectorEndCap, ConnectorLineStyle connectorLineStyle, ConstraintType horizontalConstraint, ConstraintType verticalConstraint, NodeChange[] derivedSymbolData, string key, string version, LeadingTrim leadingTrim, float[] dashPattern +message NodeChange GUID guid, ParentIndex parentIndex, NodeType type, string name, bool visible, float opacity, Vector size, Matrix transform, Paint[] fillPaints, Paint[] strokePaints, float strokeWeight, float cornerRadius, bool resizeToFit, bool internalOnly, float fontSize, FontName fontName, TextData textData, uint styleID, Path[] fillGeometry, Path[] strokeGeometry, StyleType styleType, StyleId styleIdForFill, SymbolData symbolData, PropDef[] componentPropDefs, PropAssignment[] componentPropAssignments, VariableDataMap parameterConsumptionMap, SetMode[] variableSetModes, VariableID variableSetID, ResolvedType variableResolvedType, Values variableDataValues, ModeMap variableModeBySetMap, Interaction[] prototypeInteractions, StartingPoint prototypeStartingPoint, GUIDPath guidPath, StackMode stackMode, float stackSpacing, float stackHorizontalPadding, float stackVerticalPadding, uint count, float starInnerScale, VectorData vectorData, StrokeCap strokeCap, StrokeJoin strokeJoin, VectorMirror handleMirroring, ShapeWithTextType shapeWithTextType, ConnectorEndpoint connectorStart, ConnectorEndpoint connectorEnd, StrokeCap connectorStartCap, StrokeCap connectorEndCap, ConnectorLineStyle connectorLineStyle, ConstraintType horizontalConstraint, ConstraintType verticalConstraint, NodeChange[] derivedSymbolData, string key, string version, LeadingTrim leadingTrim, float[] dashPattern, ConnectorControlPoint[] connectorControlPoints message Blob byte[] bytes message Message NodeChange[] nodeChanges, Blob[] blobs "; diff --git a/docs/boards-parity.md b/docs/boards-parity.md index 7526d39aa..ef7c4a8b3 100644 --- a/docs/boards-parity.md +++ b/docs/boards-parity.md @@ -64,7 +64,7 @@ all end with the same geometry. | Audio and huddles | missing | | | AI features (summaries, sorting stickies, generating boards) | missing | | | Grid on the page | done | the canvas render draws it after the page colour and before the layers (`figcraft_render::Dots`), so objects cover it. Dots by default, or lines, graph paper (a strong line every 2–12 cells over fainter ones, like Japanese section paper) or none; spacing (4–512), mark size and contrast are settings kept with the preferences (`board.grid`; Preferences ▸ Board grid). Zoomed out it thins out (dots and lines by halves, graph paper down to its strong lines) until the marks are at least 14 points apart (10 for lines), the marks the next step drops fading out first; dots stay about a point and a half across on screen (1 to 3 points), scaled by the size setting. Dark marks on a light page, light ones on a dark page, from the theme's ink; written straight into the image, no allocation per mark, a crossing of two lines blended once; never in exports. FigCraft's own settings: the incumbent's board grid has none | -| `.jam` import and export | **partial**: a `.jam` opens as a board, best effort (#1342): its stickies and shapes with text come in as frames with their generated layers and its connectors as vectors, not as native board objects; no export | see [`file-format-parity.md`](file-format-parity.md) | +| `.jam` import and export | **partial**: a `.jam` opens as a board, best effort (#1342): its stickies and shapes with text come in as frames with their generated layers and its connectors as vectors, not as native board objects (an elbowed connector keeps the path it was saved with, #1910); no export | see [`file-format-parity.md`](file-format-parity.md) | ## Revision history diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md index 56cc701a2..835e3ac00 100644 --- a/docs/file-format-parity.md +++ b/docs/file-format-parity.md @@ -1,6 +1,6 @@ # File format parity -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-01 · **Change:** minor (a FigJam connector without a saved snapshot took no stroke and was invisible; its line's paint, weight, cap and dashes now come from the file's generated line record (#1807); a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); imported and pasted text finds an installed family under the other names its fonts give it, and with other case and spacing (#1292); `.fig` export writes colour calculations as the colour they show in each mode and leaves out, with a warning, one that resolves to nothing (#1280); `.fig` import budgets four decoded values per compressed byte instead of one, still within 20M–128M, so dense files within that budget open instead of being refused as having too many values (#574); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; folders, devices and pipes are refused before anything is read (#1114); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); a FigJam `.jam` file opens as a board (#1342); FigJam `.jam` files open like `.fig` files: File ▸ Open, drag and drop, `file.import` and the command line (#1342); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); SVG import draws each pattern tile once per scale, within the layer budget (#1080); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); offline Penpot 2.x import/export (#1143); `.sketch` import checked against Sketch's renders: master backgrounds, symbol clipping, tints before Sketch 64, mask opacity, bitmap fills, image overrides on shapes, stretching stacks, blur radii, colour adjustments, OKLab gradients, text growth, shape group borders (#1389); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); image member names are checked on read, and REST image placeholders get archive-safe keys (#1086); Android Vector Drawable (XML) export; `.fig` export: files the incumbent imports, with component set properties, and grid track sizes at its field ids; Save and auto-save don't replace changes another app made to the open file (#1330); `.sketch` import, best effort, Sketch 48 and newer; the PNG row names ignore overlapping layers and where include bounding box is offered; the Fonts table's missing-font row describes the Missing fonts window; `.figcraft` carries the file kind (boards); `.fig` import: resized instances and variable modes by asset key; atomic saves; auto-save; SVG export clip of nested frames; SVG/PDF export depth refusal (#208); `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; `.fig` export: written files checked by opening them in other software; experimental `.fig` export; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; embedded image colour profiles; `.fig` import, best effort; animated GIF fills and TIFF images; last major: created, formats from the installed Figma's Info.plist and help center, ours from source; REST import keeps slot layers and instances' slot content (#792); REST import reads grid track sizes (#465); `.fig` import fidelity from the community batches, budgets for large files, the import report, a `.fig` copy from Save as, paste from another design app; instance layers' size and resizing and Hug on import (#731, #732)) · **Target:** Figma Design (desktop app 126.10.7) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** minor (a FigJam elbow connector saved with its path (`connectorControlPoints`) keeps it on import, as a board connector reshaped by hand does, instead of being routed again (#1910); a FigJam connector without a saved snapshot took no stroke and was invisible; its line's paint, weight, cap and dashes now come from the file's generated line record (#1807); a Dash cap setting (none, round or square) on Dash and Custom strokes, drawn on both ends of every dash; pasted layers whose image the clipboard lacks are named and show a placeholder that reads as missing (#1646); paint-style colours on layers pasted from another design app keep their style instead of turning black (#1638); imported and pasted text finds an installed family under the other names its fonts give it, and with other case and spacing (#1292); `.fig` export writes colour calculations as the colour they show in each mode and leaves out, with a warning, one that resolves to nothing (#1280); `.fig` import budgets four decoded values per compressed byte instead of one, still within 20M–128M, so dense files within that budget open instead of being refused as having too many values (#574); `.fig` ZIP image reads share a total byte budget and count skipped images in the import warnings (#1076); every file a command reads whole by path is a regular file within a cap that fits it: documents 16 GiB, placed images 256 MiB, CLI scripts 1 GiB; folders, devices and pipes are refused before anything is read (#1114); files nested 256 levels deep import on the browser's 1 MB stack (#1101); SVG and PDF exports count pattern sources and the renders they embed from the layer's depth, so one cap bounds a whole export (#1082); opening a `.figcraft` file unpacks at most 6 GiB in all (2 GiB in the browser), every area together (#1079); `.fig` instance expansion no longer walks variable nodes for every instance or copies every outer override row into each nested instance (#1077); a FigJam `.jam` file opens as a board (#1342); FigJam `.jam` files open like `.fig` files: File ▸ Open, drag and drop, `file.import` and the command line (#1342); SVG import reads `color()` and `color-mix()` colours, with a note and a grey for those it can't (#1550); SVG import draws each pattern tile once per scale, within the layer budget (#1080); a file's JPEG thumbnail can't crash the home screen (#1491's progressive JPEG check, now shared); `.fig` import: library text styles linked by asset key, and override rows restating a nested level (#1234); `.fig` import keeps the file's saved line breaks while the text and its box are unedited (#1236); Download a missing free font from the Missing fonts window (`font.download`, #754); offline Penpot 2.x import/export (#1143); `.sketch` import checked against Sketch's renders: master backgrounds, symbol clipping, tints before Sketch 64, mask opacity, bitmap fills, image overrides on shapes, stretching stacks, blur radii, colour adjustments, OKLab gradients, text growth, shape group borders (#1389); FigJam outer shape outlines and sticky body fallback beside author text (#1341, #1397); image member names are checked on read, and REST image placeholders get archive-safe keys (#1086); Android Vector Drawable (XML) export; `.fig` export: files the incumbent imports, with component set properties, and grid track sizes at its field ids; Save and auto-save don't replace changes another app made to the open file (#1330); `.sketch` import, best effort, Sketch 48 and newer; the PNG row names ignore overlapping layers and where include bounding box is offered; the Fonts table's missing-font row describes the Missing fonts window; `.figcraft` carries the file kind (boards); `.fig` import: resized instances and variable modes by asset key; atomic saves; auto-save; SVG export clip of nested frames; SVG/PDF export depth refusal (#208); `.fig` export: instance sizes, variables with modes, shared styles, variable-width strokes; `.fig` export: written files checked by opening them in other software; experimental `.fig` export; export and inspect behaviour suite and fixes; .fig import: editable vector networks and more layer kinds; embedded image colour profiles; `.fig` import, best effort; animated GIF fills and TIFF images; last major: created, formats from the installed Figma's Info.plist and help center, ours from source; REST import keeps slot layers and instances' slot content (#792); REST import reads grid track sizes (#465); `.fig` import fidelity from the community batches, budgets for large files, the import report, a `.fig` copy from Save as, paste from another design app; instance layers' size and resizing and Hug on import (#731, #732)) · **Target:** Figma Design (desktop app 126.10.7) Every format Figma reads or writes, with FigCraft's support. Sources: `Info.plist` of `/Applications/Figma.app` (document types only; nothing inside the bundle's code was read), Figma's @@ -17,10 +17,10 @@ and prototype interactions are still unchecked there. | Format | Figma | FigCraft read | FigCraft write | Fidelity / testing | Hours | |---|---|---|---|---|---| -| `.fig` (Figma Design, `com.figma.document`, `application/x-figma`) | native (cloud; "Save local copy") | **yes, best effort** (`file.open`, `file.import`, drop, CLI, MCP) | **experimental** ([below](#export-to-fig-experimental)) | `.fig` files open (best effort): the zip, its deflate/zstd chunks and the kiwi schema are decoded generically and mapped by field name onto the REST importer, so pages, the layer tree, geometry, paints (styles resolved), strokes, effects, text with styled runs, vectors as editable vector networks with region-specific fill paints (points, curved segments, filled areas with their winding, per-point corner radius and handle mirroring, end caps; outlines when the network is missing or damaged), auto layout (grid included; a flow that records no primary-axis sizing hugs on that axis, an instance that records no auto layout has its main's), constraints, ellipse arcs, boolean operations, components, sets (with their descriptions), instances (expanded from their main with overrides, derived layout and property values; the size and resizing their layers override stay overrides), styles, variables with modes and bindings, prototyping (set-variable, set-variable-mode and conditional actions included) and image fills from the archive come across; sticky notes and shapes with text keep their generated backgrounds, styled text, text paints, saved child bounds and sticky author lines as editable frame children, including saved vector networks without geometry paths, outer fill/stroke outlines when generated geometry is damaged, and outer body text when its generated child is unusable even if an author survives (#1341, #1397); connectors, tables, code blocks, slides and similar layers come in as the closest frames, text layers and vectors, with a warning; anything else is a warning. Since 2026-10-17 (community batches #727, #728): an instance's own identity and the cached library components a file carries, overrides applied by key and order, local text values and instance overrides over a shared text style, grid track sizes (fixed, content-sized, fill), slot content, labels of connectors saved with their drawn path (a static snapshot; the ends aren't live), skip ink, paragraph options and hanging lists, list start numbers, vertical trim, per-point stroke joins, editable text on a path, image adjustments and images carried in the message; since 2026-10-29, style links that name a library style by asset key and version (the file's own copy of it), with override rows above the linking one still winning, and override rows restating a nested level's overrides applied at that level, below the instance's own (#1234), and the line breaks the file saved with a text, followed until an edit or a resize could move one, or where a line would come out more than 3% wider than its box in the fonts at hand (#1236). Budgets come from the file's own size (four decoded values per compressed byte, 20M–128M, lower ceilings on 32-bit targets; the layer cap follows the file's size too), so a 15.4 MB synthetic file with 300,000 layers opens whole; ZIP image reads have a separate total budget of 4 GiB (1 GiB on 32-bit targets) of decompressed ZIP-member bytes containing encoded images, with the 256 MiB per-image cap kept: a member that cannot fit is skipped before its output buffer is allocated, and the import report names the budget and counts skipped images (#1076). Failed reads and invalid image contents still consume the bytes read; a reference used by several layers is read once. This is not a limit on decoded pixels or total import memory; images carried inside the message are unchanged. The file's bytes stay out of the command journal; an import report lists what was left out or changed once the file opens. Elbowed and curved connectors without a saved path are routed as FigCraft's board connectors are (right angles, or one curve, from the sides of the layers they join), and a connector routed here takes its line's paint, weight, cap and dashes from the file's generated line record, as one with a saved snapshot does (#1807). A connector's label without a saved snapshot is kept as text centred on its line, without its background. Not read: table cells beyond their own layers, live style and variable links for vector region fills, variables bound to fields the editor can't bind, video fills. Tested on fixtures generated in code (`crates/format/src/fig/tests.rs`, `tail_tests.rs` and the per-feature `*_tests.rs` beside them, fuzzed), `crates/engine/src/shapebuilder_region_paints_tests.rs`, and by reading back what the export writes; the FigJam report sample from #1341 checked locally only; no representative real-world corpus yet | read tail 5–10, write: checks against real files 5–15 | +| `.fig` (Figma Design, `com.figma.document`, `application/x-figma`) | native (cloud; "Save local copy") | **yes, best effort** (`file.open`, `file.import`, drop, CLI, MCP) | **experimental** ([below](#export-to-fig-experimental)) | `.fig` files open (best effort): the zip, its deflate/zstd chunks and the kiwi schema are decoded generically and mapped by field name onto the REST importer, so pages, the layer tree, geometry, paints (styles resolved), strokes, effects, text with styled runs, vectors as editable vector networks with region-specific fill paints (points, curved segments, filled areas with their winding, per-point corner radius and handle mirroring, end caps; outlines when the network is missing or damaged), auto layout (grid included; a flow that records no primary-axis sizing hugs on that axis, an instance that records no auto layout has its main's), constraints, ellipse arcs, boolean operations, components, sets (with their descriptions), instances (expanded from their main with overrides, derived layout and property values; the size and resizing their layers override stay overrides), styles, variables with modes and bindings, prototyping (set-variable, set-variable-mode and conditional actions included) and image fills from the archive come across; sticky notes and shapes with text keep their generated backgrounds, styled text, text paints, saved child bounds and sticky author lines as editable frame children, including saved vector networks without geometry paths, outer fill/stroke outlines when generated geometry is damaged, and outer body text when its generated child is unusable even if an author survives (#1341, #1397); connectors, tables, code blocks, slides and similar layers come in as the closest frames, text layers and vectors, with a warning; anything else is a warning. Since 2026-10-17 (community batches #727, #728): an instance's own identity and the cached library components a file carries, overrides applied by key and order, local text values and instance overrides over a shared text style, grid track sizes (fixed, content-sized, fill), slot content, labels of connectors saved with their drawn path (a static snapshot; the ends aren't live), skip ink, paragraph options and hanging lists, list start numbers, vertical trim, per-point stroke joins, editable text on a path, image adjustments and images carried in the message; since 2026-10-29, style links that name a library style by asset key and version (the file's own copy of it), with override rows above the linking one still winning, and override rows restating a nested level's overrides applied at that level, below the instance's own (#1234), and the line breaks the file saved with a text, followed until an edit or a resize could move one, or where a line would come out more than 3% wider than its box in the fonts at hand (#1236). Budgets come from the file's own size (four decoded values per compressed byte, 20M–128M, lower ceilings on 32-bit targets; the layer cap follows the file's size too), so a 15.4 MB synthetic file with 300,000 layers opens whole; ZIP image reads have a separate total budget of 4 GiB (1 GiB on 32-bit targets) of decompressed ZIP-member bytes containing encoded images, with the 256 MiB per-image cap kept: a member that cannot fit is skipped before its output buffer is allocated, and the import report names the budget and counts skipped images (#1076). Failed reads and invalid image contents still consume the bytes read; a reference used by several layers is read once. This is not a limit on decoded pixels or total import memory; images carried inside the message are unchanged. The file's bytes stay out of the command journal; an import report lists what was left out or changed once the file opens. Elbowed and curved connectors without a saved path are routed as FigCraft's board connectors are (right angles, or one curve, from the sides of the layers they join); an elbowed one saved with its path (`connectorControlPoints`: a point and an axis per run between the first and the last) keeps that path when it leaves and arrives by the ends' sides (#1910), and a curved one's saved `connectorBezierControlPoints` are not read; a connector routed here takes its line's paint, weight, cap and dashes from the file's generated line record, as one with a saved snapshot does (#1807). A connector's label without a saved snapshot is kept as text centred on its line, without its background. Not read: table cells beyond their own layers, live style and variable links for vector region fills, variables bound to fields the editor can't bind, video fills. Tested on fixtures generated in code (`crates/format/src/fig/tests.rs`, `tail_tests.rs` and the per-feature `*_tests.rs` beside them, fuzzed), `crates/engine/src/shapebuilder_region_paints_tests.rs`, and by reading back what the export writes; the FigJam report sample from #1341 checked locally only; no representative real-world corpus yet | read tail 5–10, write: checks against real files 5–15 | | `.penpot` (Penpot 2.x ZIP export) | — | **yes, offline** (open, import, drop, CLI, MCP) | **yes, offline** (export, CLI convert) | Editable layers, supported flex/grid layout, components, tokens and prototypes using the existing model. Unsupported layouts retain saved positions and bounded metadata; toggle-overlay and embedded font binaries are reported. Font references remain editable; no downloads. Synthetic regression coverage; live Penpot and cross-platform QA remain open. See [Penpot reference](penpot.md). | further live Penpot and cross-platform QA | | `.sketch` (Sketch 48 and newer) | import (file browser ▸ Import or drop, desktop app too; converted to a Figma file, symbols as components; per the help center) | **yes, best effort** (`file.open`, `file.import`, drop, CLI, MCP; Open With from Finder, Explorer and Linux file managers once installed; recent files show its `previews/preview.png`) | no (out of scope) | zip + JSON read from the public format description; Sketch 43–47 (text as binary property lists) and older (SQLite) files are refused with a message to resave them in a newer Sketch. Pages, artboards as frames with their background, groups; Sketch 2025 and newer: frames (clipping or not) with their style, graphics, stacks as auto layout (direction, gap, alignment, padding, wrap, hug/fill sizing, stretching filling every item across, items ignoring the stack), corners in the style (rounded, smooth with its smoothing; angled, inside square and inside arc as paths), pins and sizing, per-side borders, lists of blurs (progressive background blurs, glass), inner shadows in the shadow list, tints (a graphic's, group's or instance's fill colouring its layers, and colour overrides; from Sketch 64, before which a group's fill draws nothing), text colour and visibility overrides, text sized by its sizing; rectangles with corner radii, ovals, stars and polygons while their points are the generated ones, paths as editable vector networks, shape groups as their shape, as one compound path (children without an operation, by the group's winding rule) or as boolean operations (mixed operations nested from the left); operands' own borders ignored as Sketch does; open paths filled as if closed, edited ovals and rectangles as paths, bitmaps (their image under their style's fills; colour adjustments as image filters with Sketch's tone curve, contrast and then brightness added), slices, hotspots; transforms (rotation, flips after it), resizing constraints; fills (solid, gradients with Sketch's geometry, gradients mixed in OKLab or OKLCH as sRGB stops along the same colours, image patterns), borders (the first enabled border's width and position), shadows, inner shadows, layer, motion and background blurs (Sketch's radius is the standard deviation), opacity and blend modes; clipping masks (an outline mask that shows its own style draws a copy under itself, as Sketch does, and its opacity fades it and what it clips together; alpha masks only mask; broken mask chains wrapped), progressive opacity (Fade) as an alpha mask of its gradient; text with styled runs (UTF-16 ranges), paragraph and vertical alignment, lines placed by Sketch's line spacing behaviour, box sizing, fonts found by their PostScript names among the installed ones (else the family read from the name), variable font axes, Sketch's natural line (ascent and descent rounded, no line gap, a fifth more for classic Mac fonts) for text without a fixed line height; symbols as components (library copies on a page of their own) and instances carrying their masters' layers with overrides (text, nested swaps and hiding, images, also on shapes' image fills, layer and text styles, nested paths), clipping only where the master clips (`clippingBehavior` 1), laid out for their size the way Sketch does it (proportional sharing per pins from format 110, scaling before) and still live; master backgrounds in instances only when the master includes them in both instances and exports, as on Sketch's canvas and renders; Apple's system fonts found under the names designs use, with the platform's tracking kept as letter spacing; shared layer styles as paint (fills, border colours) and effect styles, shared text styles as text styles; Color Variables (also library ones) as colour variables with bindings; prototype links, flow starts, export options, layout and square grids (hidden, as Sketch shows them only in its layout view). Instances of a stack laid out at their size and texts an override changed measured again on open, an auto-width one growing from its aligned edge. Warnings: noise fills, OKLab and OKLCH gradients, motion and zoom blurs (drawn as plain blurs), fonts embedded with their data (not used), Smart Layout (kept as laid out), locked overrides, scaled instances. Tested on fixtures built in code (`crates/format/src/sketch/*_tests.rs`, fuzzed) and locally (`FIGCRAFT_SKETCH_SAMPLES`) on one real Sketch 50 file and the public Apache-2.0 IBM Carbon Design Kit saved by Sketch 68 and 83 (70,000 layers open in ~3 s, debug build; its edition saved by Sketch 47 is refused, as it should be); compared artboard by artboard with Sketch 2026's own renders (`FIGCRAFT_SKETCHTOOL`, black-box): the Sketch 50 file's 73 artboards differ in at most 2.3% of their pixels (0.8% on average) (text metrics, fonts FigCraft doesn't find, antialiasing), Carbon 11's 69 1.1% on average and at most 4.4% (text in IBM Plex, which the file embeds and FigCraft doesn't use yet), a Sketch 64 file's 65 artboards 2.1% on average, a Sketch 2026 showcase file's 16 frames 0.9% on average (at most 1.9%); the rules for master backgrounds, symbol clipping, mask opacity, bitmap fills, image overrides, stretching stacks, blur radii, colour adjustments, gradient interpolation and text growth checked against Sketch's renders of files built for each case (black-box, synthetic) | 5–10 (Smart Layout as auto layout, motion and zoom blurs, several borders of different widths; fonts embedded in the file once `.figcraft` documents can carry fonts: until then they would only last the session). Known limitations: a plain group (not a frame) that fills a stack keeps its layers' size where Sketch stretches them; a font Sketch can't find draws in the installed family's own weight (Sketch falls back to a regular face); text in the system SF Pro comes out a few percent narrower than Sketch's; macOS's reserved system fonts (PingFang) aren't found; brightness past about +0.4 is approximated (image filters can't add); OKLab gradients become sRGB stops (FigCraft gradients mix in sRGB) | -| `.jam` (whiteboards) | native to FigJam | **yes, best effort** (`file.open`, `file.import`, File ▸ Open, drop, CLI, MCP) | no | the same archive as a `.fig` (its canvas header reads `fig-jam.`) through the same reader (#1342): it opens as a board (the file kind; a `.fig` stays a design file), with generated sticky and shape backgrounds and text kept (#1341) as ordinary layers rather than native board objects (see [boards-parity](boards-parity.md)); tables, stamps, code blocks and the like come in as frames with their text and connectors as vectors, with an import note; a layer type the reader doesn't know is left out with a note naming it; writing `.jam` is not supported | — | +| `.jam` (whiteboards) | native to FigJam | **yes, best effort** (`file.open`, `file.import`, File ▸ Open, drop, CLI, MCP) | no | the same archive as a `.fig` (its canvas header reads `fig-jam.`) through the same reader (#1342): it opens as a board (the file kind; a `.fig` stays a design file), with generated sticky and shape backgrounds and text kept (#1341) as ordinary layers rather than native board objects (see [boards-parity](boards-parity.md)); tables, stamps, code blocks and the like come in as frames with their text and connectors as vectors (an elbowed connector keeps the path it was saved with, #1910), with an import note; a layer type the reader doesn't know is left out with a note naming it; writing `.jam` is not supported | — | | `.deck` (Slides) | native to other Figma products | no | no | out of scope | — | | REST API file JSON (`GET /v1/files/:key`) + local variables JSON + `images/` folder | the API's output | **yes** (`file.open`, `file.import`, CLI) | no | pages, layer tree, geometry, paints, strokes, effects, text runs, vectors, auto layout (sizing modes left out read as hug, as documented; grid track sizes from `gridColumnsSizing` / `gridRowsSizing`: px, fr, auto, `minmax(0, 1fr)`, `repeat()`), constraints, grids, components, sets, instances with overrides (sizes and resizing included), component properties, slots (`SLOT` layers bound to their slot property; an instance's slot keeps its content as the instance's own unless its property value is the main's default content; slot limits and preferred components are warnings), styles, prototyping (incl. conditionals and variable modes), variables with modes, aliases, scopes and bindings, image adjustments (the same tint sign as `.fig`); the import report after opening; warnings for what's skipped (video triggers and actions, modifier keys). Unit tests in `crates/format/src/rest/*_tests.rs` | — | | `.figcraft` (ours: zip of `document.json` + images, versions inside) | — | yes | yes | streamed JSON, 50k layers save ~0.09 s / load ~0.16 s (`cargo xtask bench`); old files keep opening (`large_tests.rs`); image members are `images/`, and a key that can't be one — path text, a space, over 128 chars — is left out with a complaint instead of loaded (`image_tests`); saves write a unique staging file and rename it into place (#284); optional auto-save of files with a path (`pref.autoSave`, #305); Save and auto-save refuse to write over a file another app (figcraft-cli, say) changed since it was opened or saved here, judged by its size and modification time: Revert to saved loads those changes, Save as keeps both, `file.save {overwrite: true}` replaces them (#1330); `kind: "board"` marks a board (left out for design files, so files from before boards are design files; the home screen reads it for the file's mark); board objects keep their `board` metadata on the layer; Dev Mode measurements are kept on the layer they start from (`measurements: [{to} | {side}]`, left out when there are none, so older files open with none) | — | @@ -187,6 +187,7 @@ source paint coordinates. | Date | Change | Summary | |---|---|---| +| 2026-11-04 | minor | `.fig` and `.jam` import, #1910: an elbowed connector saved with its path keeps it. FigJam stores `connectorControlPoints`, one per run between the first and the last, each a point on its run (in the connector's parent's coordinates) with the run's axis; the first run leaves the start's side and the last arrives at the end's. They become the `ConnectorPath::Runs` a board connector reshaped by hand has (`figcraft_doc::route_along`), so a connector drawn around a layer in FigJam stays around it instead of being routed through it. Points that don't make such a path (off both axes, two runs in a row the same way, a first or last run sideways to its side, more runs than a hand could make) leave the connector to the router as before, and only connectors routed here count in the "follow FigCraft's own routing" note. A curved connector's `connectorBezierControlPoints` are still not read. Tests: `tail_tests::an_elbow_connector_saved_with_its_path_keeps_it`, `tail_tests::an_elbow_whose_saved_path_doesnt_fit_its_sides_is_routed_here`. | | 2026-11-01 | patch | `.fig` and `.jam` import: a connector without a saved snapshot (elbowed and curved ones are routed here) took no stroke, so it was invisible (#1807); its line's paint, weight, cap and dashes now come from the file's generated line record, as a saved snapshot's do, and the connector's own values, when it has any, win. Test: `fig::connector_label_tests::a_routed_connector_takes_its_line_style_from_the_generated_record`. Numbers unchanged | | 2026-10-31 | patch | M4: Dash and Custom strokes have a Dash cap (None, Round, Square) in the advanced stroke settings and `node.set {dashCap}`, on both ends of every dash on the canvas and in PNG, PDF and SVG. Unset, dashes keep taking the end point caps, so older files look the same; the saved file writes it only when set. Numbers unchanged | | 2026-10-30 | minor | `.fig` import: a connector's label without a saved snapshot was skipped; now the connector imports as a frame holding its line and the label, as a connector with a saved snapshot does, the label centred on the line's middle by length (in a 200-wide box, laid out again with the fonts at hand), in the connector's fill paints or black. Its background isn't known without the snapshot and is left out. Not checked on real files. Test: `fig::tests::tail::a_labelled_connector_without_a_snapshot_keeps_its_label` | From 5855c8705c81a7f624c8ecbaba1214538cc273f8 Mon Sep 17 00:00:00 2001 From: Trevor Brown Date: Wed, 4 Nov 2026 02:39:24 -0500 Subject: [PATCH 21/36] docs: boards-parity's status line and revision history move with its .jam row (#1910) Review: the row changed without the status line and a history row, which land together. Co-Authored-By: Claude Fable 5.1 --- docs/boards-parity.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/boards-parity.md b/docs/boards-parity.md index ef7c4a8b3..cf72aaa8c 100644 --- a/docs/boards-parity.md +++ b/docs/boards-parity.md @@ -1,6 +1,6 @@ # Boards parity -> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-10-31 · **Change:** minor (a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a connector end dropped along a side of a shape attaches to that side (#1708); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; a connector's bar sets its start and end points, dashes, weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); "+" handles beside a selected sticky or shape make the next one, joined by a connector (#1597); a FigJam `.jam` file opens as a board (#1342); board grid settings: dots, lines, graph paper or none, spacing, size and contrast; the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); templates and tables; facilitation: a shared timer and voting sessions; the dot grid, dragging a connector's end to re-attach it, curved connectors, elbows that go around what they join) · **Target:** the incumbent's whiteboard product (behaviour from its public help centre) +> **Last reviewed:** 2026-10-24 · **Last updated:** 2026-11-04 · **Change:** patch (a `.jam` elbowed connector saved with its path keeps it on import instead of being routed again (#1910); a connector end moved with Cmd/Ctrl held goes on any part of an object, and stays there as the object moves or resizes; a connector end dropped along a side of a shape attaches to that side (#1708); a board connector's path can be reshaped by dragging its path handles (#1710); boards have 16 more shapes (arrows, polygons, star, plus and flowchart symbols), in pickers that lay them out in a grid; a board keeps earlier votes' results, listed newest first in Results and deleted one at a time; a connector's bar sets its start and end points, dashes, weight and any colour (#1596); cells copied from a spreadsheet paste onto a board as a table; Shift+Cmd/Ctrl+Enter on a selected board shape adds the next shape already joined to it, and goes on typing (#1597); "+" handles beside a selected sticky or shape make the next one, joined by a connector (#1597); a FigJam `.jam` file opens as a board (#1342); board grid settings: dots, lines, graph paper or none, spacing, size and contrast; the connector tool shows the connector it will make while dragging, ends snapping to attach points (#1387); templates and tables; facilitation: a shared timer and voting sessions; the dot grid, dragging a connector's end to re-attach it, curved connectors, elbows that go around what they join) · **Target:** the incumbent's whiteboard product (behaviour from its public help centre) **Breadth ~47%, ready ~29% (estimated, erring low).** A board is a FigCraft file of its own kind (`file.newBoard`) with a dot grid on the page, sticky notes, shapes with text, connectors that @@ -70,6 +70,7 @@ all end with the same geometry. | Date | Change | Summary | |---|---|---| +| 2026-11-04 | patch | M6, #1910: a `.jam` elbowed connector saved with its path (FigJam's `connectorControlPoints`) keeps it on import: the points become the `ConnectorPath::Runs` a connector reshaped by hand has and the line is walked along them, so a connector drawn around a layer stays around it; one whose points don't make a path from its ends' sides is routed as before. Still a vector, not a native board object. Details in [`file-format-parity.md`](file-format-parity.md). | | 2026-10-31 | minor | M12: as the help describes, holding Cmd/Ctrl while moving a connector's end places it on any part of an object instead of snapping to a side. It keeps that spot as a fraction of the object's box, so it follows the object when it moves or resizes, and without the key an end snaps as before. `board.connector {fromAt, toAt}` and `board.reattach {at}` take it; saved only when set. Numbers unchanged | | 2026-10-31 | patch | M12, #1708: a connector end dropped on the outer half of a shape takes the side it is towards, instead of only within 10 px of a side's middle, so a drop anywhere along an edge chooses that edge (dragging a selected connector's end and with the connector tool, ring included); a drop in the middle of a shape still takes the facing side. | | 2026-10-31 | minor | M12, #1710: a selected elbow or curved connector shows path handles. Dragging a run moves it and a first or last run gains an extra run to stay on its end; a curve's middle goes where it is dragged (`board.reshape`, one undo step). The shape travels with what the connector joins, is saved with the file, and goes back to routing itself when the style changes or an end moves to something else. | From 31dcd0e5feca2d4ff7b80d69a4b996880c476198 Mon Sep 17 00:00:00 2001 From: Trevor Brown Date: Wed, 4 Nov 2026 03:46:49 -0500 Subject: [PATCH 22/36] M6: a saved connector path going back into its object is routed instead (#1910) Review: the first and last runs were checked for lying at right angles to their sides, not for going out of the object, so a path whose first run went up through the start's box (or whose last arrived from inside the end's) was kept and drawn through it. Both runs now have to go the way the side faces; one along the side or back into the object leaves the connector to the router. Two more cases in the routed-here test. Co-Authored-By: Claude Fable 5.1 --- crates/format/src/fig/map/connector.rs | 12 ++++++++---- crates/format/src/fig/tail_tests.rs | 6 +++++- docs/file-format-parity.md | 2 +- 3 files changed, 14 insertions(+), 6 deletions(-) diff --git a/crates/format/src/fig/map/connector.rs b/crates/format/src/fig/map/connector.rs index 01c07c00e..e89b875ed 100644 --- a/crates/format/src/fig/map/connector.rs +++ b/crates/format/src/fig/map/connector.rs @@ -440,12 +440,16 @@ fn saved_runs(v: &View<'_>, from: RouteEnd, to: RouteEnd) -> Option, p: Point, q: Point| s.is_none_or(|s| (q - p).dot(s.normal()) > 0.0); let (s0, s1) = attached_sides(from, to); - let fits = s0.is_none_or(|s| faces_across(s) == across) && s1.is_none_or(|s| faces_across(s) != last); + let fits = out_of(s0, p0, onto(across, p0, a0)) && out_of(s1, p1, onto(!last, p1, a1)); fits.then_some(ConnectorPath::Runs { across, at }) } diff --git a/crates/format/src/fig/tail_tests.rs b/crates/format/src/fig/tail_tests.rs index 09e6ed85a..773edd4d8 100644 --- a/crates/format/src/fig/tail_tests.rs +++ b/crates/format/src/fig/tail_tests.rs @@ -927,6 +927,10 @@ fn an_elbow_whose_saved_path_doesnt_fit_its_sides_is_routed_here() { elbow(67, "Sideways", vec![point(100.0, 650.0, 0.0, 1.0)]), elbow(68, "Askew", vec![point(150.0, 740.0, 1.0, 1.0)]), elbow(69, "Repeated", vec![point(150.0, 740.0, 1.0, 0.0), point(150.0, 760.0, 1.0, 0.0)]), + // The first run would go up from A's bottom, through A; the last would arrive at B's left + // from inside B. Each run is at right angles to its side, so only the way it goes is wrong. + elbow(70, "Backwards", vec![point(100.0, 650.0, 1.0, 0.0), point(200.0, 740.0, 0.0, 1.0)]), + elbow(71, "Inside", vec![point(150.0, 740.0, 1.0, 0.0), point(350.0, 800.0, 0.0, 1.0)]), ]); let (doc, warnings) = import(&canvas(&schema(), &message), "Unfit paths").unwrap(); let line = |name: &str| -> Vec<(f64, f64)> { @@ -935,7 +939,7 @@ fn an_elbow_whose_saved_path_doesnt_fit_its_sides_is_routed_here() { }; let plain = line("Plain"); assert!(plain.len() >= 3, "routed in right angles: {plain:?}"); - for name in ["Sideways", "Askew", "Repeated"] { + for name in ["Sideways", "Askew", "Repeated", "Backwards", "Inside"] { assert_eq!(line(name), plain, "{name} is routed as one without a path"); } assert!(warnings.iter().any(|w| w.contains("FigCraft's own routing")), "{warnings:?}"); diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md index 835e3ac00..d60a70c0d 100644 --- a/docs/file-format-parity.md +++ b/docs/file-format-parity.md @@ -187,7 +187,7 @@ source paint coordinates. | Date | Change | Summary | |---|---|---| -| 2026-11-04 | minor | `.fig` and `.jam` import, #1910: an elbowed connector saved with its path keeps it. FigJam stores `connectorControlPoints`, one per run between the first and the last, each a point on its run (in the connector's parent's coordinates) with the run's axis; the first run leaves the start's side and the last arrives at the end's. They become the `ConnectorPath::Runs` a board connector reshaped by hand has (`figcraft_doc::route_along`), so a connector drawn around a layer in FigJam stays around it instead of being routed through it. Points that don't make such a path (off both axes, two runs in a row the same way, a first or last run sideways to its side, more runs than a hand could make) leave the connector to the router as before, and only connectors routed here count in the "follow FigCraft's own routing" note. A curved connector's `connectorBezierControlPoints` are still not read. Tests: `tail_tests::an_elbow_connector_saved_with_its_path_keeps_it`, `tail_tests::an_elbow_whose_saved_path_doesnt_fit_its_sides_is_routed_here`. | +| 2026-11-04 | minor | `.fig` and `.jam` import, #1910: an elbowed connector saved with its path keeps it. FigJam stores `connectorControlPoints`, one per run between the first and the last, each a point on its run (in the connector's parent's coordinates) with the run's axis; the first run leaves the start's side and the last arrives at the end's. They become the `ConnectorPath::Runs` a board connector reshaped by hand has (`figcraft_doc::route_along`), so a connector drawn around a layer in FigJam stays around it instead of being routed through it. Points that don't make such a path (off both axes, two runs in a row the same way, a first or last run sideways to its side or going back into its object, more runs than a hand could make) leave the connector to the router as before, and only connectors routed here count in the "follow FigCraft's own routing" note. A curved connector's `connectorBezierControlPoints` are still not read. Tests: `tail_tests::an_elbow_connector_saved_with_its_path_keeps_it`, `tail_tests::an_elbow_whose_saved_path_doesnt_fit_its_sides_is_routed_here`. | | 2026-11-01 | patch | `.fig` and `.jam` import: a connector without a saved snapshot (elbowed and curved ones are routed here) took no stroke, so it was invisible (#1807); its line's paint, weight, cap and dashes now come from the file's generated line record, as a saved snapshot's do, and the connector's own values, when it has any, win. Test: `fig::connector_label_tests::a_routed_connector_takes_its_line_style_from_the_generated_record`. Numbers unchanged | | 2026-10-31 | patch | M4: Dash and Custom strokes have a Dash cap (None, Round, Square) in the advanced stroke settings and `node.set {dashCap}`, on both ends of every dash on the canvas and in PNG, PDF and SVG. Unset, dashes keep taking the end point caps, so older files look the same; the saved file writes it only when set. Numbers unchanged | | 2026-10-30 | minor | `.fig` import: a connector's label without a saved snapshot was skipped; now the connector imports as a frame holding its line and the label, as a connector with a saved snapshot does, the label centred on the line's middle by length (in a 200-wide box, laid out again with the fonts at hand), in the connector's fill paints or black. Its background isn't known without the snapshot and is left out. Not checked on real files. Test: `fig::tests::tail::a_labelled_connector_without_a_snapshot_keeps_its_label` | From fccaa431014d9dc3c4565aae05849f74b79f8d8a Mon Sep 17 00:00:00 2001 From: fluid-chey Date: Wed, 4 Nov 2026 12:17:25 -0700 Subject: [PATCH 23/36] M9: a joined live session keeps reconnecting and says when it's disconnected A session you joined could end for reasons that pass, or after about 85 s of retries, and its tab then looked like an unsaved local file. Work done there reached no one, with only a 3 s toast to say so. A live connection now reconnects until you leave, pausing a minute after each 12 attempts. Only refusals that are for good stop it, so "too many messages", "busy" and the like retry. Messages queued while offline go out paced so a long queue can't trip the server's rate limit. A session that ended stays on its tab: the tab shows a red mark and a strip across the canvas offers Retry now or Try again, Save a copy and Dismiss. Joining again uses the same tab, and what changed offline opens beside it as an unsaved copy. A session that gets out of step joins again by itself. Co-Authored-By: Claude Opus 5.5 --- apps/figcraft-server/src/codes_tests.rs | 2 +- apps/figcraft-server/src/server_tests.rs | 2 +- crates/collab-net/src/driver.rs | 47 +++++++-- crates/collab-net/src/driver_tests.rs | 115 +++++++++++++++++++++-- crates/collab-net/src/guest.rs | 23 ++++- crates/collab-net/src/join.rs | 53 +++++++++-- crates/collab-net/src/link.rs | 6 ++ crates/collab-net/src/session_tests.rs | 5 +- crates/collab-net/src/sessions_tests.rs | 4 +- crates/collab-net/src/throttle.rs | 27 ++++++ crates/collab-net/src/web.rs | 4 + crates/engine/src/collab_live_tests.rs | 111 ++++++++++++++++++++++ crates/engine/src/live_tests.rs | 10 +- crates/engine/src/sharing/live.rs | 47 +++++++++ crates/engine/src/sharing/live/events.rs | 58 ++++++++++-- crates/engine/src/sharing/live/join.rs | 27 +++++- crates/engine/src/sharing/live/sync.rs | 9 +- crates/engine/src/sharing/live/types.rs | 2 + crates/ui-egui/locales/en.toml | 7 ++ crates/ui-egui/src/canvas.rs | 10 +- crates/ui-egui/src/icons.rs | 2 + crates/ui-egui/src/icons/draw.rs | 8 ++ crates/ui-egui/src/live.rs | 64 +++++++++++++ crates/ui-egui/src/live_joining_tests.rs | 49 ++++++++++ crates/ui-egui/src/live_tests.rs | 2 +- crates/ui-egui/src/tabs.rs | 26 +++-- docs/collab-protocol.md | 18 +++- docs/collaboration-parity.md | 1 + docs/mcp.md | 5 +- docs/server.md | 2 +- 30 files changed, 687 insertions(+), 59 deletions(-) diff --git a/apps/figcraft-server/src/codes_tests.rs b/apps/figcraft-server/src/codes_tests.rs index cbc7f70a7..42b15961e 100644 --- a/apps/figcraft-server/src/codes_tests.rs +++ b/apps/figcraft-server/src/codes_tests.rs @@ -118,7 +118,7 @@ fn a_file_shared_online_is_joined_by_its_codes() { }); for guest in [&b, &c] { assert!(guest.message.as_deref().unwrap_or_default().contains("Sharing was stopped"), "{:?}", guest.message); - assert_eq!(guest.live().status, Status::Off, "over, not failed: nothing retries"); + assert!(guest.live().rejoinable() && !guest.live().status.active(), "over: nothing retries, and the tab says so"); } assert_eq!(layers(&b), before + 2, "Bo keeps the copy"); let folder = dir.path().join("files").join(&p.file); diff --git a/apps/figcraft-server/src/server_tests.rs b/apps/figcraft-server/src/server_tests.rs index f60150da9..f3d084499 100644 --- a/apps/figcraft-server/src/server_tests.rs +++ b/apps/figcraft-server/src/server_tests.rs @@ -160,7 +160,7 @@ fn revoked_links_stop_working_at_once() { assert_eq!((files.len(), files[0].people), (1, 3)); // Revoked: Cy is out at once, the others stay. assert_eq!(ask(Admin::Revoke { file: file.clone(), link: review.link.id.clone() }), AdminReply::Done); - pump(&mut [&mut a, &mut b, &mut c], "Cy out", |s| s[2].live().status == Status::Off && s[0].live().peers.len() == 1); + pump(&mut [&mut a, &mut b, &mut c], "Cy out", |s| s[2].live().rejoinable() && s[0].live().peers.len() == 1); // Told as when a host stops: the session is over for Cy, whose copy stays open (no retries). assert!(c.message.as_deref().unwrap_or_default().contains("Sharing was stopped"), "{:?}", c.message); assert!(live(&b)); diff --git a/crates/collab-net/src/driver.rs b/crates/collab-net/src/driver.rs index 3ddd3b3c1..d96650371 100644 --- a/crates/collab-net/src/driver.rs +++ b/crates/collab-net/src/driver.rs @@ -18,6 +18,7 @@ use figcraft_collab::message::{self, ClientMsg, Presence, ServerMsg}; use figcraft_engine::live::{Event, Status}; +use std::collections::VecDeque; use std::time::Duration; // `std::time::Instant` on native builds; the browser's clock in the web build. use web_time::Instant; @@ -28,7 +29,7 @@ use crate::invite::Endpoint; use crate::join::{GuestConfig, Next, Outcome, Resuming, Seen, Taken, after, ask, closed, hello, resolved, take, too_large, unresolved}; use crate::limits::NetLimits; use crate::requests::Publish; -use crate::throttle::{PRESENCE_INTERVAL, Throttle, earliest}; +use crate::throttle::{PRESENCE_INTERVAL, Pace, Throttle, earliest}; /// A WebSocket the driver opens, writes and closes; what it receives comes back through the /// driver's event methods. @@ -79,6 +80,9 @@ pub(crate) struct Driver { /// Your latest presence while not welcomed (sent with the welcome). pending: Option, throttle: Throttle, + /// Sync messages waiting their turn (a long queue from while offline), and when each may go. + pace: Pace, + paced: VecDeque<(Instant, ClientMsg)>, reconnect_at: Option, /// What this connection asks a server (a managing one), and what follows its answers. asking: Option<(Box, Then)>, @@ -86,7 +90,7 @@ pub(crate) struct Driver { } impl Driver { - fn new(sock: S, cfg: GuestConfig, inbox: Inbox) -> Self { + fn new(sock: S, cfg: GuestConfig, inbox: Inbox, now: Instant) -> Self { Self { sock, cfg, @@ -97,6 +101,8 @@ impl Driver { resume: Resuming::default(), pending: None, throttle: Throttle::new(PRESENCE_INTERVAL), + pace: Pace::new(now), + paced: VecDeque::new(), reconnect_at: None, asking: None, done: false, @@ -105,7 +111,7 @@ impl Driver { /// Start joining (progress arrives in `inbox`). pub(crate) fn start(sock: S, cfg: GuestConfig, inbox: Inbox, now: Instant) -> Self { - let mut d = Self::new(sock, cfg, inbox); + let mut d = Self::new(sock, cfg, inbox, now); d.inbox.push(Event::Status(Status::Connecting)); d.connect(now); d @@ -114,7 +120,7 @@ impl Driver { /// Start with what `next` asks a server (a background request): the events it ends in go to /// `inbox`, then the join it ends in, if any, as `cfg` says. pub(crate) fn asking(sock: S, cfg: GuestConfig, next: exchange::Next, inbox: Inbox, now: Instant) -> Self { - let mut d = Self::new(sock, cfg, inbox); + let mut d = Self::new(sock, cfg, inbox, now); d.follow(next, now); d } @@ -303,8 +309,31 @@ impl Driver { if !self.conn.as_ref().is_some_and(|c| c.welcomed) { return; } - if !self.write(&msg) { - self.end(Outcome::Retry("the connection dropped".into()), now); + let wait = self.pace.wait(now); + if wait.is_zero() && self.paced.is_empty() { + if !self.write(&msg) { + self.end(Outcome::Retry("the connection dropped".into()), now); + } + } else { + self.paced.push_back((now + wait, msg)); + } + } + + /// Send the sync messages whose turn has come; false when one couldn't go. + fn send_paced(&mut self, now: Instant) -> bool { + while let Some((_, msg)) = self.paced.pop_front_if(|(at, _)| *at <= now) { + if !self.write(&msg) { + return false; + } + } + true + } + + /// Reconnect now, if it is waiting to: the pauses grow from the beginning again. + pub(crate) fn retry(&mut self, now: Instant) { + if !self.done && self.reconnect_at.is_some() { + self.attempt = 0; + self.connect(now); } } @@ -327,7 +356,7 @@ impl Driver { [Some(c.last_ping + l.keepalive), Some(c.last_heard + c.silence_limit(l)), if c.welcomed { self.throttle.due() } else { None }] } }); - earliest(conn.into_iter().flatten().chain([self.reconnect_at])) + earliest(conn.into_iter().flatten().chain([self.reconnect_at, self.paced.front().map(|(at, _)| *at)])) } /// Do what's due at `now`: reconnect, send held presence or a ping, give up on a connection @@ -357,7 +386,7 @@ impl Driver { if now >= last_heard + silence { return self.end(Outcome::Retry("the host stopped answering".into()), now); } - let ok = self.throttle.take_due(now).is_none_or(|p| self.write(&ClientMsg::Presence(p))); + let ok = self.send_paced(now) && self.throttle.take_due(now).is_none_or(|p| self.write(&ClientMsg::Presence(p))); let ok = ok && (now < last_ping + l.keepalive || self.ping(now)); if !ok { self.end(Outcome::Retry("the connection dropped".into()), now); @@ -388,6 +417,8 @@ impl Driver { self.sock.close(); } self.throttle = Throttle::new(PRESENCE_INTERVAL); + // Made for this connection: the sync client sends again what the server didn't get. + self.paced.clear(); match after(outcome, &self.cfg, self.was_live, &mut self.attempt, &self.inbox) { Next::Stop(e) => { if let Some(e) = e { diff --git a/crates/collab-net/src/driver_tests.rs b/crates/collab-net/src/driver_tests.rs index ea7900745..57921df3d 100644 --- a/crates/collab-net/src/driver_tests.rs +++ b/crates/collab-net/src/driver_tests.rs @@ -252,7 +252,7 @@ fn a_silent_host_counts_as_dropped_and_the_client_reconnects() { } #[test] -fn reconnects_back_off_then_give_up() { +fn a_live_connection_reconnects_in_rounds_and_never_gives_up() { let t0 = Instant::now(); let (mut d, inbox) = start(Script::default(), t0); d.opened(t0); @@ -260,7 +260,7 @@ fn reconnects_back_off_then_give_up() { let mut now = t0; let mut pauses = Vec::new(); d.closed(1006, "", now); - while !d.done() { + for _ in 0..26 { let next = d.deadline().unwrap(); pauses.push(next - now); now = next; @@ -269,11 +269,114 @@ fn reconnects_back_off_then_give_up() { d.closed(1006, "", now); } let secs: Vec = pauses.iter().map(Duration::as_secs_f64).collect(); - assert_eq!(secs, [0.5, 1.0, 2.0, 4.0, 8.0, 10.0, 10.0, 10.0, 10.0, 10.0, 10.0, 10.0]); + let round = [1.0, 2.0, 4.0, 8.0, 10.0, 10.0, 10.0, 10.0, 10.0, 10.0, 10.0]; + assert_eq!(secs[0], 0.5); + assert_eq!(secs[1..12], round); + assert_eq!(secs[12], 60.0, "a longer pause after a round"); + assert_eq!(secs[13..24], round, "then as many again"); + assert_eq!(secs[24], 60.0); + assert!(!d.done()); let st = statuses(&inbox.drain()); - assert_eq!(st.len(), 14, "connecting, 12 reconnects, then failed"); - assert!(matches!(st.last(), Some(Status::Failed { reason }) if reason.starts_with("Lost the connection to the host")), "{st:?}"); - assert_eq!(d.deadline(), None); + assert!(!st.iter().any(|s| matches!(s, Status::Failed { .. })), "{st:?}"); + assert!(matches!(st.last(), Some(Status::Reconnecting { attempt: 27 })), "{st:?}"); +} + +#[test] +fn retry_now_skips_the_pause_and_starts_the_round_over() { + let t0 = Instant::now(); + let (mut d, inbox) = start(Script::default(), t0); + d.opened(t0); + d.message(&welcome(), t0); + d.closed(1006, "", t0); + let mut now = t0; + for _ in 0..12 { + now = d.deadline().unwrap(); + d.tick(now); + d.closed(1006, "", now); + } + assert_eq!(d.deadline().unwrap() - now, Duration::from_secs(60)); + let opened = d.sock.opened.len(); + d.retry(now); + assert_eq!(d.sock.opened.len(), opened + 1, "connects at once"); + inbox.drain(); + d.closed(1006, "", now); + assert_eq!(statuses(&inbox.drain()), vec![Status::Reconnecting { attempt: 1 }]); + assert_eq!(d.deadline().unwrap() - now, ms(500), "the pauses grow from the beginning again"); +} + +#[test] +fn a_session_that_was_live_only_stops_for_a_refusal_that_is_for_good() { + let t0 = Instant::now(); + // The words servers turn a session away with for now. + for reason in [ + "too many messages", + "the server is busy: try again in a moment", + "the session is full", + "no hello in time", + "this file can't be opened on the server (its data is damaged); tell the server's owner", + "too many connections from your address lately: wait a minute and try again", + ] { + for frame in [false, true] { + let (mut d, inbox) = start(Script::default(), t0); + d.opened(t0); + d.message(&welcome(), t0); + inbox.drain(); + if frame { + d.closed(1008, reason, t0); + } else { + d.message(&encode(&ServerMsg::Refused { reason: reason.into() }), t0); + } + assert!(!d.done(), "{reason}"); + assert_eq!(statuses(&inbox.drain()), vec![Status::Reconnecting { attempt: 1 }], "{reason}"); + } + } + // And the words for good. + for reason in [ + "this link isn't valid (it may have been revoked)", + "this file isn't on the server (it may have been removed)", + "this file was removed from the server", + "you were removed from this session", + "this server no longer accepts connections from your address", + "this server doesn't accept connections from your address", + "wrong session token", + "protocol 9 isn't supported", + "message too large: this server takes at most 64 MiB at once (a change that big can't be kept here)", + ] { + let (mut d, inbox) = start(Script::default(), t0); + d.opened(t0); + d.message(&welcome(), t0); + d.closed(1008, reason, t0); + assert!(d.done(), "{reason}"); + assert!(matches!(statuses(&inbox.drain()).last(), Some(Status::Failed { reason: r }) if r.contains(reason)), "{reason}"); + } +} + +#[test] +fn a_long_queue_goes_out_paced_and_in_order() { + let t0 = Instant::now(); + let (mut d, _inbox) = start(Script::default(), t0); + d.opened(t0); + d.message(&welcome(), t0); + let before = d.sock.sent.len(); + for seq in 0..500 { + d.send(ClientMsg::Ack { seq }, t0); + } + let at_once = d.sock.sent.len() - before; + assert!((1..=200).contains(&at_once), "{at_once} at once: a server drops a connection past 400"); + let mut now = t0; + while d.sock.sent.iter().filter(|m| matches!(m, ClientMsg::Ack { .. })).count() < 500 { + now = d.deadline().unwrap(); + d.tick(now); + } + let seqs: Vec = d.sock.sent.iter().filter_map(|m| if let ClientMsg::Ack { seq } = m { Some(*seq) } else { None }).collect(); + assert_eq!(seqs, (0..500).collect::>()); + assert!(now - t0 >= Duration::from_secs(4), "the rest take their time: {:?}", now - t0); + // Unsent ones were made for this connection: the sync client sends them again. + for seq in 0..500 { + d.send(ClientMsg::Ack { seq }, now); + } + d.closed(1006, "", now); + assert_eq!(d.deadline().unwrap() - now, ms(500), "nothing left to send but the reconnect"); } #[test] diff --git a/crates/collab-net/src/guest.rs b/crates/collab-net/src/guest.rs index bdb5b98b2..84572b884 100644 --- a/crates/collab-net/src/guest.rs +++ b/crates/collab-net/src/guest.rs @@ -31,7 +31,7 @@ use crate::manage; use crate::net::{Duplex, NetLimits, config, open, shutdown}; use crate::requests; pub use crate::requests::Publish; -use crate::throttle::{PRESENCE_INTERVAL, Throttle, earliest}; +use crate::throttle::{PRESENCE_INTERVAL, Pace, Throttle, earliest}; /// A joined (or joining) session. Dropping it leaves. pub struct Guest { @@ -44,6 +44,8 @@ enum Cmd { /// For the server, in order (document changes). Send(ClientMsg), Leave, + /// Try now rather than after the pause under way (reconnecting). + Retry, /// The reader of connection `epoch` got its welcome. Welcomed(u64), /// Connection `epoch` ended. @@ -133,6 +135,11 @@ impl Guest { let _ = self.cmd.send(Cmd::Send(msg)); } + /// Reconnect now, if it is waiting to. + pub fn retry(&self) { + let _ = self.cmd.send(Cmd::Retry); + } + /// Leave (returns at once: a connection attempt in progress ends on its own). pub fn leave(&mut self) { let _ = self.cmd.send(Cmd::Leave); @@ -227,6 +234,11 @@ fn supervise(cfg: &GuestConfig, inbox: &Inbox, rx: &Receiver, me: &Sender return, Ok(Cmd::Presence(p)) => pending = Some(p), + // A fresh start: the pauses grow from the beginning again. + Ok(Cmd::Retry) => { + attempt = 0; + break; + } // From the old connection's client: the next welcome starts over. Ok(_) => {} Err(RecvTimeoutError::Timeout) => break, @@ -267,6 +279,7 @@ fn session( let hello = hello(cfg, resume); let mut welcomed = false; let mut throttle = Throttle::new(PRESENCE_INTERVAL); + let mut pace = Pace::new(Instant::now()); let outcome = if send(&mut writer, &hello) { loop { let ping_at = last_ping + cfg.limits.keepalive; @@ -274,7 +287,11 @@ fn session( let mut out = None; let mut now_send = Vec::new(); match rx.recv_timeout(wake.saturating_duration_since(Instant::now())) { - Ok(Cmd::Send(m)) if welcomed => now_send.push(m), + Ok(Cmd::Send(m)) if welcomed => { + // A long queue from while offline doesn't go out faster than the server takes it. + std::thread::sleep(pace.wait(Instant::now())); + now_send.push(m); + } // Made for the previous connection (the sync client sends again what the server // didn't get once it has caught up with this connection's welcome). Ok(Cmd::Send(_)) => {} @@ -292,7 +309,7 @@ fn session( break Outcome::Left; } // From an earlier connection. - Ok(Cmd::Welcomed(_) | Cmd::Lost(..)) => {} + Ok(Cmd::Welcomed(_) | Cmd::Lost(..) | Cmd::Retry) => {} Err(RecvTimeoutError::Timeout) => {} } if !now_send.iter().all(|m| send(&mut writer, m)) { diff --git a/crates/collab-net/src/join.rs b/crates/collab-net/src/join.rs index 033186af2..63f94bec2 100644 --- a/crates/collab-net/src/join.rs +++ b/crates/collab-net/src/join.rs @@ -39,8 +39,10 @@ pub struct GuestConfig { /// The pause before the first reconnect; it doubles each time up to `max_backoff`. pub backoff: Duration, pub max_backoff: Duration, - /// Reconnect attempts before giving up. + /// Reconnect attempts in a row before the longer pause (`round_pause`), after which it tries + /// as many again: a connection that was live is never given up on by itself. pub attempts: u32, + pub round_pause: Duration, /// Join as the client you were (an app that starts over after a crash): the first hello /// carries it, and a server that still knows the id gives it back. pub resume: Option, @@ -57,6 +59,7 @@ impl GuestConfig { backoff: Duration::from_millis(500), max_backoff: Duration::from_secs(10), attempts: 12, + round_pause: Duration::from_secs(60), resume: None, } } @@ -65,6 +68,14 @@ impl GuestConfig { pub(crate) fn backoff(&self, attempt: u32) -> Duration { self.backoff.saturating_mul(1u32 << attempt.saturating_sub(1).min(16)).min(self.max_backoff) } + + /// The pause before reconnect attempt `attempt` (from 1): growing within a round of + /// [`attempts`](Self::attempts), and [`round_pause`](Self::round_pause) between rounds. + pub(crate) fn pause(&self, attempt: u32) -> Duration { + let round = self.attempts.max(1); + let into_round = attempt.saturating_sub(1) % round; + if into_round == 0 && attempt > round { self.round_pause } else { self.backoff(into_round + 1) } + } } /// How a connection ended. @@ -143,11 +154,38 @@ pub(crate) enum Next { Reconnect(Duration), } -/// After `outcome`: a refusal or the end of the session is final, and so is a first join that -/// can't reach the host; a live connection that dropped tries again with growing pauses until the -/// attempts run out. +/// What a server refuses for good, whenever you ask: the link, the file or your place in it is +/// gone, or the two versions can't talk. Anything else a server refuses a session with (it is +/// busy, a limit was hit, the file couldn't be read just now) may pass, and servers of any version +/// say so in these words, so a reason not listed here means try again. +const FINAL_REFUSALS: [&str; 11] = [ + "isn't valid", + "isn't on the server", + "was removed from the server", + "were removed from this session", + "no longer accepts connections", + "doesn't accept connections", + "wrong session token", + "isn't supported", + "couldn't be read", + "message too large", + "this version can't read", +]; + +/// Whether `reason`, from a server refusing a session that was live, is for good. +pub(crate) fn final_refusal(reason: &str) -> bool { + FINAL_REFUSALS.iter().any(|f| reason.contains(f)) +} + +/// After `outcome`: the end of the session is final, and so are a refusal for good and a first +/// join that can't reach the host. A live connection that dropped or was turned away for now tries +/// again until you leave: with growing pauses, and a longer one between rounds. pub(crate) fn after(outcome: Outcome, cfg: &GuestConfig, was_live: bool, attempt: &mut u32, inbox: &Inbox) -> Next { let failed = |reason: String| Next::Stop(Some(Event::Status(Status::Failed { reason }))); + let outcome = match outcome { + Outcome::Refused(why) if was_live && !final_refusal(&why) => Outcome::Retry(why), + o => o, + }; match outcome { Outcome::Left => Next::Stop(None), Outcome::Refused(why) => failed(format!("The host refused: {why}")), @@ -155,13 +193,10 @@ pub(crate) fn after(outcome: Outcome, cfg: &GuestConfig, was_live: bool, attempt Outcome::Ended(reason) => Next::Stop(Some(Event::Ended { reason })), Outcome::Retry(why) if !was_live => failed(format!("Couldn't join the live session: {why}")), Outcome::Retry(why) => { - *attempt += 1; - if *attempt > cfg.attempts { - return failed(format!("Lost the connection to the host ({why})")); - } + *attempt = attempt.saturating_add(1); log::info!("live session: connection lost ({why}); reconnecting, attempt {attempt}"); inbox.push(Event::Status(Status::Reconnecting { attempt: *attempt })); - Next::Reconnect(cfg.backoff(*attempt)) + Next::Reconnect(cfg.pause(*attempt)) } } } diff --git a/crates/collab-net/src/link.rs b/crates/collab-net/src/link.rs index fdcba5b97..0024da781 100644 --- a/crates/collab-net/src/link.rs +++ b/crates/collab-net/src/link.rs @@ -266,6 +266,12 @@ impl LiveLink for NetLink { } } + fn retry(&mut self, session: SessionId) { + if let Some(Active::Guest(g)) = self.sessions.get(session) { + g.retry(); + } + } + fn presence(&mut self, session: SessionId, p: &Presence) { match self.sessions.get(session) { Some(Active::Host(h)) => h.presence(p.clone()), diff --git a/crates/collab-net/src/session_tests.rs b/crates/collab-net/src/session_tests.rs index 4d5680eed..51b9e89b6 100644 --- a/crates/collab-net/src/session_tests.rs +++ b/crates/collab-net/src/session_tests.rs @@ -124,8 +124,9 @@ fn following_a_viewport_until_you_move() { fn the_host_stopping_ends_the_session_for_guests() { let (mut host, mut guest, _, _) = host_and_join(); host.execute("collab.stop", &json!({})).unwrap(); - pump(&mut host, &mut guest, "the end", |_, g| g.live().status == Status::Off); - assert!(guest.live().peers.is_empty()); + pump(&mut host, &mut guest, "the end", |_, g| g.live().rejoinable()); + assert!(guest.live().peers.is_empty() && !guest.live().syncing()); + assert!(guest.live().disconnected(), "the tab says so"); assert_eq!(guest.message.as_deref(), Some(crate::host::ENDED)); } diff --git a/crates/collab-net/src/sessions_tests.rs b/crates/collab-net/src/sessions_tests.rs index 4a2579f8e..d21668150 100644 --- a/crates/collab-net/src/sessions_tests.rs +++ b/crates/collab-net/src/sessions_tests.rs @@ -158,8 +158,8 @@ fn two_files_are_hosted_and_joined_independently() { assert!(host.live_of(hb).presence.get(&ada(&host, hb)).is_none_or(|p| p.cursor.is_none()), "no cursor in the file that isn't in front"); // The host closes B: its session ends for everyone, A's goes on. host.execute("file.close", &json!({"index": 1, "force": true})).unwrap(); - pump(&mut [&mut host, &mut guest], "B's session ending", |s| s[0].live.iter().count() == 1 && s[1].live.iter().count() == 1); - assert_eq!(guest.live_of(gb).status, Status::Off); + pump(&mut [&mut host, &mut guest], "B's session ending", |s| s[0].live.iter().count() == 1 && s[1].live_of(gb).rejoinable()); + assert!(guest.live_of(gb).disconnected(), "the guest's tab says so"); assert_eq!(guest.docs.len(), 3, "the guest keeps its copy of B"); assert_eq!((host.live_of(ha).status.clone(), host.live_of(ha).peers.len()), (Status::Live, 1)); assert_eq!(guest.live_of(ga).status, Status::Live); diff --git a/crates/collab-net/src/throttle.rs b/crates/collab-net/src/throttle.rs index beff3e6f8..1f90ff504 100644 --- a/crates/collab-net/src/throttle.rs +++ b/crates/collab-net/src/throttle.rs @@ -10,6 +10,33 @@ use web_time::Instant; /// How often presence goes out at most. pub const PRESENCE_INTERVAL: Duration = Duration::from_millis(33); +/// How many messages other than presence go out at once, and per second after that: with presence +/// and pings that stays under what a server takes from a connection before it drops it. +const PACE_BURST: f64 = 200.0; +const PACE_RATE: f64 = 60.0; + +/// Paces messages that must all go out (everything queued while offline leaves at once when the +/// connection comes back): `wait` says how long until the next may. +#[derive(Debug)] +pub struct Pace { + tokens: f64, + last: Instant, +} + +impl Pace { + pub fn new(now: Instant) -> Self { + Self { tokens: PACE_BURST, last: now } + } + + /// Take one message's turn at `now`: how long to wait before sending it (zero: at once). + pub fn wait(&mut self, now: Instant) -> Duration { + let passed = now.saturating_duration_since(self.last).as_secs_f64(); + self.last = now; + self.tokens = (self.tokens + passed * PACE_RATE).min(PACE_BURST) - 1.0; + if self.tokens >= 0.0 { Duration::ZERO } else { Duration::from_secs_f64(-self.tokens / PACE_RATE) } + } +} + #[derive(Debug)] pub struct Throttle { interval: Duration, diff --git a/crates/collab-net/src/web.rs b/crates/collab-net/src/web.rs index 32fbaad9d..8c54f6c23 100644 --- a/crates/collab-net/src/web.rs +++ b/crates/collab-net/src/web.rs @@ -242,6 +242,10 @@ impl LiveLink for NetLink { } } + fn retry(&mut self, session: SessionId) { + self.with(session, |d, now| d.retry(now)); + } + fn presence(&mut self, session: SessionId, p: &Presence) { self.with(session, |d, now| d.presence(p.clone(), now)); } diff --git a/crates/engine/src/collab_live_tests.rs b/crates/engine/src/collab_live_tests.rs index d53eeff26..6499c1895 100644 --- a/crates/engine/src/collab_live_tests.rs +++ b/crates/engine/src/collab_live_tests.rs @@ -318,6 +318,117 @@ fn a_dropped_connection_keeps_editing_and_catches_up() { assert_eq!((doc.node(r).unwrap().name.as_str(), doc.node(f).unwrap().name.as_str()), ("Sent", "Offline")); } +impl Room { + /// Person `i` has been told to join again: the server takes them as someone new. + fn welcome_anew(&mut self, i: usize) { + let ClientMsg::Hello(h) = Client::hello("f", "t", "Person", "") else { panic!("not a hello") }; + let (id, out) = self.server.join(h).unwrap(); + let w = welcome_of(&out, id); + let p = &mut self.people[i]; + p.id = id; + p.online = true; + p.script.lock().unwrap().events.extend([Event::Welcome { info: info(Role::Guest, id), peers: vec![] }, Event::Sync(w)]); + p.s.live_poll(); + } + + fn event(&mut self, i: usize, e: Event) { + let p = &mut self.people[i]; + p.script.lock().unwrap().events.push(e); + p.s.live_poll(); + } +} + +#[test] +fn reconnecting_can_be_told_to_try_now_and_shows_as_disconnected() { + let mut room = Room::new(base(), 1, 7); + assert!(!room.s(0).live().disconnected()); + assert!(room.s(0).execute("collab.reconnect", &json!({})).is_err(), "nothing was lost"); + room.disconnect(0); + assert!(room.s(0).live().disconnected()); + assert_eq!(room.s(0).execute("collab.reconnect", &json!({})).unwrap()["status"], "reconnecting"); + let session = room.s(0).live().id; + assert_eq!(room.people[0].script.lock().unwrap().retried, [session]); +} + +#[test] +fn a_session_that_cant_go_on_stays_on_its_tab_and_joins_again_there() { + let mut room = Room::new(base(), 2, 7); + let (f, r) = frame_and_rect(room.server.document()); + let uid = room.s(0).ds().unwrap().uid; + let tabs = room.s(0).docs.len(); + room.disconnect(0); + room.s(0).execute("node.set", &json!({"id": r, "props": {"name": "Offline"}})).unwrap(); + room.event(0, Event::Status(Status::Failed { reason: "The host refused: this link isn't valid".into() })); + // The tab says so, and is yours to go on working in. + let live = room.s(0).live(); + assert!(live.disconnected() && live.rejoinable() && live.doc_uid == Some(uid)); + assert!(room.s(0).live_read_only(uid).is_none()); + room.s(0).execute("node.set", &json!({"id": f, "props": {"name": "Offline too"}})).unwrap(); + // A try that fails leaves it just as it was. + assert_eq!(room.s(0).execute("collab.reconnect", &json!({})).unwrap()["status"], "connecting"); + assert!(room.s(0).live().disconnected() && !room.s(0).live().rejoinable()); + assert!(room.s(0).live_read_only(uid).is_none(), "it can still be edited while it tries"); + room.event(0, Event::Status(Status::Failed { reason: "Couldn't join the live session: no answer".into() })); + assert!(room.s(0).live().rejoinable()); + // Someone else's edit lands meanwhile. + room.s(1).execute("transform.move", &json!({"ids": [r], "dx": 5, "dy": 5})).unwrap(); + room.settle(); + // The next try joins in the same tab, and what was done offline opens beside it. + room.s(0).execute("collab.reconnect", &json!({})).unwrap(); + room.welcome_anew(0); + let s = room.s(0); + assert_eq!(s.live().status, Status::Live); + assert!(!s.live().disconnected()); + assert_eq!(s.docs.len(), tabs + 1, "the copy's is the only new tab"); + let (tab, copy) = (s.docs.iter().find(|d| d.uid == uid).unwrap(), s.docs.last().unwrap()); + assert_eq!(s.live().doc_uid, Some(uid)); + assert_ne!(tab.doc.node(r).unwrap().name, "Offline", "the session's tab shows the server's version"); + assert_eq!(copy.doc.name, format!("{} (offline copy)", tab.doc.name)); + assert_eq!(copy.doc.node(r).unwrap().name, "Offline"); + assert_eq!(copy.doc.node(f).unwrap().name, "Offline too"); + assert!(copy.is_dirty(), "closing the copy asks first"); + assert!(s.message.as_deref().is_some_and(|m| m.contains("offline copy"))); +} + +#[test] +fn joining_again_with_nothing_changed_opens_no_copy() { + let mut room = Room::new(base(), 1, 7); + let tabs = room.s(0).docs.len(); + room.disconnect(0); + room.event(0, Event::Ended { reason: "Sharing was stopped".into() }); + assert!(room.s(0).live().rejoinable(), "the end of a session you were in shows on its tab too"); + assert_eq!(room.s(0).message.as_deref(), Some("Sharing was stopped")); + room.s(0).execute("collab.reconnect", &json!({})).unwrap(); + room.welcome_anew(0); + assert_eq!(room.s(0).docs.len(), tabs); + assert_eq!(room.s(0).live().status, Status::Live); +} + +#[test] +fn a_session_out_of_step_joins_again_by_itself() { + let mut room = Room::new(base(), 1, 7); + let joins = room.people[0].script.lock().unwrap().joined.len(); + let tabs = room.s(0).docs.len(); + // A batch from far in the future: it can't be applied. + room.event(0, Event::Sync(ServerMsg::Changes(figcraft_collab::Accepted { seq: 999, author: 42, batch_id: 1, changes: vec![] }))); + assert_eq!(room.s(0).live().status, Status::Connecting); + assert!(room.s(0).live().disconnected()); + assert_eq!(room.people[0].script.lock().unwrap().joined.len(), joins + 1); + room.welcome_anew(0); + assert_eq!(room.s(0).live().status, Status::Live); + assert_eq!(room.s(0).docs.len(), tabs); +} + +#[test] +fn leaving_a_lost_session_makes_the_tab_a_plain_copy() { + let mut room = Room::new(base(), 1, 7); + room.disconnect(0); + room.event(0, Event::Status(Status::Failed { reason: "gone".into() })); + room.s(0).execute("collab.leave", &json!({})).unwrap(); + assert_eq!(room.s(0).live().status, Status::Off); + assert!(!room.s(0).live().disconnected()); +} + #[test] fn random_commands_with_undo_and_drops_converge_through_the_engine() { for seed in 0..6 { diff --git a/crates/engine/src/live_tests.rs b/crates/engine/src/live_tests.rs index 1bae1b106..0b2b7c993 100644 --- a/crates/engine/src/live_tests.rs +++ b/crates/engine/src/live_tests.rs @@ -17,7 +17,9 @@ pub(crate) struct Script { pub(crate) events: Vec, pub(crate) sent: Vec, pub(crate) hosted: Vec, - joined: Vec, + pub(crate) joined: Vec, + /// The sessions told to reconnect now, in order. + pub(crate) retried: Vec, pub(crate) left: usize, pub(crate) msgs: Vec, pub(crate) published: Vec, @@ -46,6 +48,10 @@ impl LiveLink for Mock { i.url = format!("ws://{}/?file=f&token=t", i.address); Ok(i) } + fn retry(&mut self, session: u64) { + self.0.lock().unwrap().retried.push(session); + } + fn join(&mut self, session: u64, link: &str, _: &str) -> Result<(), String> { if !link.starts_with("figcraft://") { return Err("not an invite".into()); @@ -229,7 +235,7 @@ fn events_build_who_is_here() { assert_eq!(s.live_summary()["attempt"], 1); push(&script, vec![Event::Status(Status::Failed { reason: "Lost the connection".into() })]); s.live_poll(); - assert!(s.live().info.is_none()); + assert!(s.live().peers.is_empty() && !s.live().syncing()); assert_eq!(s.live_summary()["reason"], "Lost the connection"); assert_eq!(s.message.as_deref(), Some("Lost the connection")); assert!(!s.live_poll(), "nothing new"); diff --git a/crates/engine/src/sharing/live.rs b/crates/engine/src/sharing/live.rs index 45d56776c..b54331520 100644 --- a/crates/engine/src/sharing/live.rs +++ b/crates/engine/src/sharing/live.rs @@ -140,6 +140,18 @@ pub struct Live { /// The branches of the session's file made or last updated from main in this session: every /// layer of their base was in it (see [`crate::branches`]). branch_bases: BTreeSet, + /// You were in this session and aren't now: what joining it again takes (`collab.reconnect`). + stranded: Option, +} + +/// What's kept of a session you joined once it can't go on by itself. The tab stays yours to work +/// in, and says so. +#[derive(Clone)] +struct Stranded { + /// The invite link you joined with (it holds the token: never shown). + link: String, + /// The server's state when it stopped: what's different from it in the tab is your own work. + confirmed: Box, } impl Live { @@ -158,6 +170,41 @@ impl Live { *self = Live { id: self.id, tab: self.tab, ..Live::default() }; } + /// Keep this session on its tab for joining again (see [`Stranded`]): a session you joined, or + /// one that already is; any other goes back to no session. + fn strand(&mut self) { + let joined = self.info.as_ref().filter(|i| i.role == Role::Guest && !i.link.is_empty()); + let held = self.stranded.take().or_else(|| { + let (client, info) = (self.client.as_ref()?, joined?); + Some(Stranded { link: info.link.clone(), confirmed: Box::new(client.confirmed().clone()) }) + }); + if held.is_none() { + return self.reset(); + } + *self = Live { + id: self.id, + tab: self.tab, + doc_uid: self.doc_uid, + info: self.info.take(), + server: std::mem::take(&mut self.server), + published: self.published.take(), + share: self.share.take(), + stranded: held, + ..Live::default() + }; + } + + /// You were in this session and aren't now: the connection dropped and it is trying again, or + /// it can't go on by itself. What you do in its tab isn't reaching anyone. + pub fn disconnected(&self) -> bool { + matches!(self.status, Status::Reconnecting { .. }) || self.stranded.is_some() + } + + /// The session can be joined again in its tab (`collab.reconnect`). + pub fn rejoinable(&self) -> bool { + self.stranded.is_some() && !self.status.active() + } + /// The document sync client (once the welcome arrived): peers, pending batches, the user's /// undo history. pub fn client(&self) -> Option<&Client> { diff --git a/crates/engine/src/sharing/live/events.rs b/crates/engine/src/sharing/live/events.rs index 757decbc5..5bc94c0f4 100644 --- a/crates/engine/src/sharing/live/events.rs +++ b/crates/engine/src/sharing/live/events.rs @@ -214,8 +214,15 @@ impl Session { // order. Event::Sync(msg) => live.deferred.push(msg), Event::Ended { reason } => { - self.message = Some(if behind.is_empty() { reason } else { format!("{}: {reason}", behind.trim_start()) }); - self.live.end(id); + let joined = live.syncing() && live.role() == Some(Role::Guest); + let text = if behind.is_empty() { reason.clone() } else { format!("{}: {reason}", behind.trim_start()) }; + if joined { + // The tab says so and stays yours: it doesn't pass for a file of your own. + self.live_fail(id, reason); + } else { + self.live.end(id); + } + self.message = Some(text); } Event::Published(p) => { // Shared with a code: the popover shows it, nothing more to say. @@ -389,6 +396,7 @@ impl Session { } (Some(Role::Guest), Some(uid)) => { // Joining again in this tab, or the file you published arriving from the server. + self.live_keep_offline_work(id, uid); let doc = Arc::new(client.document().clone()); let was_dirty = self.docs.iter().find(|d| d.uid == uid).is_some_and(DocState::is_dirty); self.apply_remote(uid, doc.clone()); @@ -435,15 +443,53 @@ impl Session { live.synced = synced; live.client = Some(client); live.deferred.clear(); + live.stranded = None; } - /// Session `id` is over with a message: it couldn't be joined, the connection was lost for - /// good or sync broke. Its tab shows why. + /// Session `id` is back on document `uid` after it couldn't go on, and the server's version is + /// about to replace the tab's: what you did since opens beside it, unsaved, so nothing is lost. + fn live_keep_offline_work(&mut self, id: SessionId, uid: u64) { + let Some(held) = self.live.sessions.get(&id).and_then(|l| l.stranded.as_ref()) else { return }; + let Some(local) = self.docs.iter().find(|d| d.uid == uid).map(|d| d.doc.clone()) else { return }; + let name = local.name.clone(); + // A document that can't be compared is kept too. + if figcraft_collab::diff(&held.confirmed, &local).is_ok_and(|d| d.changes.is_empty()) { + self.message = Some(format!("Reconnected to {name}")); + return; + } + let mut copy = DocState::new((*local).clone(), None); + let copy_name = format!("{name} (offline copy)"); + Arc::make_mut(&mut copy.doc).name.clone_from(©_name); + self.docs.push(copy); + self.message = Some(format!("Reconnected to {name}. What you changed while disconnected is open beside it as “{copy_name}”")); + } + + /// Join session `id` again in its tab (see [`Live::strand`]), as someone new: a fresh join needs + /// nothing from the connection that was lost. + pub(super) fn live_rejoin(&mut self, cmd: &str, id: SessionId) -> Result<()> { + let name = display_name(&self.prefs); + let Some(link) = self.live.sessions.get(&id).and_then(|l| l.stranded.as_ref()).map(|s| s.link.clone()) else { + return Err(crate::bad(cmd, "this file has no live session to join again")); + }; + self.live.leave(id); + if let Some(why) = crate::file_access::network_refused() { + return Err(EngineError::Disabled(cmd.to_string(), why)); + } + let Some(net) = self.live.link() else { return Err(super::unavailable(cmd)) }; + net.join_resuming(id, &link, &name, None).map_err(|e| crate::bad(cmd, e))?; + if let Some(live) = self.live.sessions.get_mut(&id) { + live.status = Status::Connecting; + } + Ok(()) + } + + /// Session `id` is over with a message: it couldn't be joined, it was refused or ended for + /// good, or sync broke. Its tab shows why, and a session you were in can be joined again there. pub(super) fn live_fail(&mut self, id: SessionId, reason: String) { log::warn!("live session: {reason}"); self.live.leave(id); if let Some(live) = self.live.sessions.get_mut(&id) { - live.reset(); + live.strand(); live.status = Status::Failed { reason: reason.clone() }; } self.message = Some(reason); @@ -456,7 +502,7 @@ impl Session { let live = self.live.doc(uid)?; match &live.client { Some(c) => limited_by(c.access()), - None if live.status.active() && live.role() != Some(Role::Host) => Some(PUBLISHING), + None if live.status.active() && live.role() != Some(Role::Host) && !live.disconnected() => Some(PUBLISHING), None => None, } } diff --git a/crates/engine/src/sharing/live/join.rs b/crates/engine/src/sharing/live/join.rs index 836267b2a..75ade0c80 100644 --- a/crates/engine/src/sharing/live/join.rs +++ b/crates/engine/src/sharing/live/join.rs @@ -48,6 +48,24 @@ fn leave(s: &mut Session, p: &Value) -> Result { Ok(json!({"ended": ended.is_some_and(|l| l.status.active())})) } +/// Back into the open file's session now: a reconnect that is waiting tries at once, and a session +/// that couldn't go on is joined again in its tab. +fn reconnect(s: &mut Session, _: &Value) -> Result { + const CMD: &str = "collab.reconnect"; + let live = s.live(); + let (id, reconnecting, rejoinable) = (live.id, matches!(live.status, Status::Reconnecting { .. }), live.rejoinable()); + if reconnecting { + if let Some(net) = s.live.link() { + net.retry(id); + } + } else if rejoinable { + s.live_rejoin(CMD, id)?; + } else { + return Err(bad(CMD, "this file has no lost live session to reconnect")); + } + Ok(json!({"status": s.live().status.id()})) +} + fn stop(s: &mut Session, p: &Value) -> Result { // A file shared online stays its owner's on the server: stopping takes the others' links (and // their codes) away, which disconnects whoever joined with them, and the owner stays in the @@ -192,10 +210,17 @@ pub fn specs() -> Vec { false, join ), + spec!( + "collab.reconnect", + "Reconnect live session", + "{} → {status}: for the open file's session when it is disconnected: a reconnect that is waiting tries now, and a session that couldn't go on (`failed`, the file open in its tab) is joined again there, what you changed since opening beside it. Refused when nothing was lost", + false, + reconnect + ), spec!( "collab.leave", "Leave live session", - "{session? (a session's id from `collab.peers`'s `sessions`, e.g. a join still on its way; default: the open file's session)} → {ended}: the synced file stays open as a local copy", + "{session? (a session's id from `collab.peers`'s `sessions`, e.g. a join still on its way; default: the open file's session)} → {ended}: the synced file stays open as a local copy (also how a tab stops showing a session that couldn't go on)", false, leave ), diff --git a/crates/engine/src/sharing/live/sync.rs b/crates/engine/src/sharing/live/sync.rs index 79f693731..0930151dc 100644 --- a/crates/engine/src/sharing/live/sync.rs +++ b/crates/engine/src/sharing/live/sync.rs @@ -118,7 +118,14 @@ impl Session { for m in std::mem::take(&mut live.deferred) { match client.receive(m, &EngineRecompute) { Ok(more) => out.extend(more), - Err(e) => return self.live_fail(id, format!("The live session got out of step ({e}); join again")), + Err(e) => { + self.live_fail(id, format!("The live session got out of step ({e})")); + // A fresh join has nothing to get out of step with. + if let Err(e) = self.live_rejoin("collab.reconnect", id) { + log::warn!("live session: couldn't join again: {e}"); + } + return; + } } } let doc = Arc::new(client.document().clone()); diff --git a/crates/engine/src/sharing/live/types.rs b/crates/engine/src/sharing/live/types.rs index 93455c0d8..f2108eb36 100644 --- a/crates/engine/src/sharing/live/types.rs +++ b/crates/engine/src/sharing/live/types.rs @@ -496,6 +496,8 @@ pub trait LiveLink: Send { /// End session `session` (stop hosting or leave); the others go on. Nothing for a session /// that is over already. fn leave(&mut self, session: SessionId); + /// Session `session` is waiting to reconnect: try now. + fn retry(&mut self, _session: SessionId) {} /// Your latest presence in `session` (the link throttles and coalesces). fn presence(&mut self, session: SessionId, p: &Presence); /// A message for `session`'s server (document changes), sent in order. diff --git a/crates/ui-egui/locales/en.toml b/crates/ui-egui/locales/en.toml index 11f0bb4ac..e24d81452 100644 --- a/crates/ui-egui/locales/en.toml +++ b/crates/ui-egui/locales/en.toml @@ -406,6 +406,12 @@ name = "English" "Decoration style" = "Decoration style" "Decoration" = "Decoration" "Deep select" = "Deep select" +"Disconnected. Reconnecting…" = "Disconnected. Reconnecting…" +"Disconnected. Your edits stay here and sync when the connection returns. Reconnecting…" = "Disconnected. Your edits stay here and sync when the connection returns. Reconnecting…" +"Dismiss" = "Dismiss" +"Not connected: {reason}. Your work is still in this tab." = "Not connected: {reason}. Your work is still in this tab." +"Retry now" = "Retry now" +"Save a copy…" = "Save a copy…" "Wrap style" = "Wrap style" "Balance" = "Balance" "Pretty" = "Pretty" @@ -415,6 +421,7 @@ name = "English" "Set hug contents" = "Set hug contents" "Set fill container" = "Set fill container" "Double-click an edge of an auto layout frame" = "Double-click an edge of an auto layout frame" +"{name}, disconnected from its live session" = "{name}, disconnected from its live session" "⌥ double-click an edge of an auto layout child" = "⌥ double-click an edge of an auto layout child" "Alt+double-click an edge of an auto layout child" = "Alt+double-click an edge of an auto layout child" "Default" = "Default" diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs index 5ccfe5d46..6cea501c1 100644 --- a/crates/ui-egui/src/canvas.rs +++ b/crates/ui-egui/src/canvas.rs @@ -312,11 +312,13 @@ pub fn show(app: &mut FigApp, ui: &mut Ui, worker: &mut Worker) { crate::live::draw(app, &painter, &ctx); crate::live::agent::draw(app, &painter, &ctx); crate::live::chat_box(app, &ctx); - crate::live::spotlight_banner(app, &ctx, rect); + // The other banners float below the strip that says the session is disconnected. + let banners = rect.with_min_y(rect.min.y + crate::live::connection_banner(app, &ctx, rect)); + crate::live::spotlight_banner(app, &ctx, banners); crate::comments::popovers(app, &ctx); - crate::versions::preview_banner(app, &ctx, rect); - crate::branch_ui::banner(app, &ctx, rect); - crate::dev_mode::focus_bar(app, &ctx, rect); + crate::versions::preview_banner(app, &ctx, banners); + crate::branch_ui::banner(app, &ctx, banners); + crate::dev_mode::focus_bar(app, &ctx, banners); // The cursor: the tool's, unless something on the canvas with its own has the pointer. app.canvas.cursor = None; if let (true, Some(at)) = (own_cursor && resp.hovered(), ctx.input(|i| i.pointer.hover_pos())) { diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/icons.rs index f8480127f..cd6f34a08 100644 --- a/crates/ui-egui/src/icons.rs +++ b/crates/ui-egui/src/icons.rs @@ -205,6 +205,8 @@ icons! { Online, /// In a live session others get into: a point sending waves to both sides. LiveShared, + /// Disconnected from a live session: the point and its waves, struck through. + LiveDisconnected, /// A file of yours on a server that only you get into: a point inside a closed ring. LivePrivate, /// A design file: a pen nib leaning to the left, its grip filled. diff --git a/crates/ui-egui/src/icons/draw.rs b/crates/ui-egui/src/icons/draw.rs index 1d3925507..904b54107 100644 --- a/crates/ui-egui/src/icons/draw.rs +++ b/crates/ui-egui/src/icons/draw.rs @@ -809,6 +809,14 @@ fn draw(p: &P, icon: Icon) { p.arc(8.0, 8.0, r, PI - FRAC_PI_4, PI + FRAC_PI_4); } } + LiveDisconnected => { + p.dot(8.0, 8.0, 1.6); + for r in [3.6, 6.0] { + p.arc(8.0, 8.0, r, -FRAC_PI_4, FRAC_PI_4); + p.arc(8.0, 8.0, r, PI - FRAC_PI_4, PI + FRAC_PI_4); + } + p.line(3.0, 13.0, 13.0, 3.0); + } LivePrivate => { p.dot(8.0, 8.0, 1.6); p.circle(8.0, 8.0, 5.0); diff --git a/crates/ui-egui/src/live.rs b/crates/ui-egui/src/live.rs index efa64617c..c80548323 100644 --- a/crates/ui-egui/src/live.rs +++ b/crates/ui-egui/src/live.rs @@ -436,6 +436,70 @@ pub fn chat_box(app: &mut FigApp, ctx: &egui::Context) { app.ui.live.chat = Some(chat); } +/// While the active document's live session is disconnected: a thin strip across the top of the +/// canvas that says so, with what can be done about it. Returns how much of the canvas it takes. +pub fn connection_banner(app: &mut FigApp, ctx: &egui::Context, canvas: Rect) -> f32 { + const H: f32 = 30.0; + let live = app.session.live(); + let Some(uid) = app.session.docs.get(app.session.active).map(|d| d.uid).filter(|u| crate::tabs::live_lost(app, *u)) else { return 0.0 }; + let (text, retry, gone) = match &live.status { + Status::Failed { reason } => { + (trf("Not connected: {reason}. Your work is still in this tab.", &[("reason", &failure_text(reason))]), Some(tr("Try again")), true) + } + Status::Reconnecting { .. } => { + (tr("Disconnected. Your edits stay here and sync when the connection returns. Reconnecting…").to_string(), Some(tr("Retry now")), false) + } + _ => (tr("Disconnected. Reconnecting…").to_string(), None, false), + }; + // Saved as a file of its own: it is one now. + if gone && app.session.docs.iter().any(|d| d.uid == uid && d.path.is_some()) { + app.run("collab.leave", json!({})); + return 0.0; + } + let t = Tokens::get(ctx); + let ink = text_on(t.danger); + let (mut try_now, mut save, mut dismiss) = (false, false, false); + let strip = Rect::from_min_size(canvas.min, vec2(canvas.width(), H)); + egui::Area::new(egui::Id::unique("live_connection_banner")).order(egui::Order::Foreground).fixed_pos(strip.min).show(ctx, |ui| { + ui.set_min_size(strip.size()); + ui.set_max_size(strip.size()); + ui.painter().rect_filled(strip, egui::CornerRadius::ZERO, t.danger); + let button = |ui: &mut Ui, label: &str| { + ui.add( + egui::Button::new(egui::RichText::new(label).font(regular(11.0)).color(ink)) + .fill(Color32::TRANSPARENT) + .stroke(Stroke::new(1.0, ink)) + .corner_radius(egui::CornerRadius::same(4)), + ) + .clicked() + }; + let inner = strip.shrink2(vec2(12.0, 0.0)); + ui.scope_builder(egui::UiBuilder::new().max_rect(inner).layout(egui::Layout::right_to_left(egui::Align::Center)), |ui| { + ui.spacing_mut().item_spacing.x = 8.0; + if gone { + dismiss = button(ui, tr("Dismiss")); + save = button(ui, tr("Save a copy…")); + } + if let Some(label) = retry { + try_now = button(ui, label); + } + ui.with_layout(egui::Layout::left_to_right(egui::Align::Center), |ui| { + ui.add(egui::Label::new(egui::RichText::new(text).font(regular(11.0)).color(ink)).truncate()); + }); + }); + }); + if try_now { + app.run("collab.reconnect", json!({})); + } + if save { + app.save_as_dialog(); + } + if dismiss { + app.run("collab.leave", json!({})); + } + H +} + /// While you spotlight, or someone does and you stopped following them: a banner on the canvas to /// stop, or to follow again. pub fn spotlight_banner(app: &mut FigApp, ctx: &egui::Context, canvas: Rect) { diff --git a/crates/ui-egui/src/live_joining_tests.rs b/crates/ui-egui/src/live_joining_tests.rs index a5d46b8e8..7929a9334 100644 --- a/crates/ui-egui/src/live_joining_tests.rs +++ b/crates/ui-egui/src/live_joining_tests.rs @@ -97,3 +97,52 @@ fn leave_takes_a_session_id() { assert_eq!(h.app.session.execute("collab.leave", &json!({"session": id})).unwrap()["ended"], true); assert!(h.app.session.live.get(id).is_none()); } + +/// Joined, with the file in its tab. +fn joined(h: &mut Harness) -> u64 { + join(h); + h.welcome(); + h.sync(); + h.app.session.docs[h.app.session.active].uid +} + +const STRIP: &str = "Disconnected. Your edits stay here and sync when the connection returns. Reconnecting…"; + +#[test] +fn a_dropped_connection_shows_on_the_tab_and_across_the_canvas_with_retry() { + let (mut h, _) = Harness::new(); + let uid = joined(&mut h); + assert!(!crate::tabs::live_lost(&h.app, uid)); + assert!(!has_text(&h.frames(2), STRIP), "not while connected"); + h.send(vec![LiveEvent::Status(Status::Reconnecting { attempt: 3 })]); + let shapes = h.frames(2); + assert!(crate::tabs::live_lost(&h.app, uid)); + assert!(has_text(&shapes, STRIP)); + h.click(text_center(&shapes, "Retry now")); + assert!(h.app.ui.last_error.is_none(), "{:?}", h.app.ui.last_error); + assert_eq!(h.app.session.live().status, Status::Reconnecting { attempt: 3 }); + // Back: the strip goes. + h.welcome(); + assert!(!has_text(&h.frames(2), STRIP)); + assert!(!crate::tabs::live_lost(&h.app, uid)); +} + +#[test] +fn a_session_that_ended_stays_on_its_tab_until_dismissed() { + let (mut h, _) = Harness::new(); + let uid = joined(&mut h); + h.send(vec![LiveEvent::Status(Status::Failed { reason: "The host refused: this link isn't valid".into() })]); + let shapes = h.frames(2); + assert!(crate::tabs::live_lost(&h.app, uid)); + assert!(has_text(&shapes, "Not connected: The host refused: this link isn't valid. Your work is still in this tab.")); + assert!(has_text(&shapes, "Save a copy…")); + h.click(text_center(&shapes, "Try again")); + assert_eq!(h.app.session.live().status, Status::Connecting); + assert!(crate::tabs::live_lost(&h.app, uid), "still disconnected while it tries"); + h.send(vec![LiveEvent::Status(Status::Failed { reason: "no".into() })]); + let shapes = h.frames(2); + h.click(text_center(&shapes, "Dismiss")); + assert!(!has_text(&h.frames(2), "Try again")); + assert!(!crate::tabs::live_lost(&h.app, uid)); + assert_eq!(h.app.session.live().status, Status::Off); +} diff --git a/crates/ui-egui/src/live_tests.rs b/crates/ui-egui/src/live_tests.rs index cd8454afa..bd2dd4ce2 100644 --- a/crates/ui-egui/src/live_tests.rs +++ b/crates/ui-egui/src/live_tests.rs @@ -126,7 +126,7 @@ impl Harness { color: "#14AE5C".into(), file_name: "Shared".into(), pages: vec![], - link: String::new(), + link: "figcraft://join?host=127.0.0.1:47900&file=f&token=t".into(), url: String::new(), address: "127.0.0.1:47900".into(), network: false, diff --git a/crates/ui-egui/src/tabs.rs b/crates/ui-egui/src/tabs.rs index e59552d12..e043eb2d9 100644 --- a/crates/ui-egui/src/tabs.rs +++ b/crates/ui-egui/src/tabs.rs @@ -149,6 +149,7 @@ pub fn tab_bar(app: &mut FigApp, ui: &mut Ui) { let name = &d.doc.name; // In a live session: a mark after the name says whether others get in. let live = live_mark(app, d.uid); + let lost = live_lost(app, d.uid); let dirty = d.is_dirty(); let r = tab_rects[slot]; let body_r = Rect::from_min_max(r.min, pos2(r.max.x - 32.0, r.max.y)); @@ -171,8 +172,8 @@ pub fn tab_bar(app: &mut FigApp, ui: &mut Ui) { } }); } - let label = tab_label(name, live); - let resp = if live.is_some() { resp.on_hover_text(&label) } else { resp }; + let label = if lost { trf("{name}, disconnected from its live session", &[("name", name)]) } else { tab_label(name, live) }; + let resp = if live.is_some() || lost { resp.on_hover_text(&label) } else { resp }; crate::a11y::tab(&resp, &label, active); let progress = open_progress(&opening, d.uid, now); let tab = TabPaint { @@ -182,6 +183,7 @@ pub fn tab_bar(app: &mut FigApp, ui: &mut Ui) { width: w, state: [active, resp.hovered(), cresp.hovered(), dirty], live, + lost, progress, }; paint_tab(ui, &t, &tab); @@ -432,7 +434,7 @@ fn detach_tab(app: &mut FigApp, ui: &Ui, i: usize, at: Option) { /// How wide document tab `i` wants to be: its name, the live mark and the unsaved dot. fn preferred_width(app: &FigApp, i: usize) -> f32 { let d = &app.session.docs[i]; - let mark_w = if live_mark(app, d.uid).is_some() { 18.0 } else { 0.0 }; + let mark_w = if live_mark(app, d.uid).is_some() || live_lost(app, d.uid) { 18.0 } else { 0.0 }; let dot_w = if d.is_dirty() && mark_w > 0.0 { 12.0 } else { 0.0 }; (regular(12.0).size * 0.6 * d.doc.name.chars().count() as f32 + 64.0 + mark_w + dot_w).clamp(120.0, 220.0) } @@ -457,14 +459,16 @@ struct TabPaint<'a> { state: [bool; 4], /// In a live session: whether others get in. live: Option, + /// Disconnected from its live session. + lost: bool, /// How far the opening animation is (0..=1). progress: f32, } /// Draws a document tab: background, icon, name, live mark, unsaved dot and close button. fn paint_tab(ui: &Ui, t: &Tokens, tab: &TabPaint) { - let TabPaint { name, kind, rects: [r, close_r], width: w, state: [active, hovered, close_hovered, dirty], live, progress } = *tab; - let mark_w = if live.is_some() { 18.0 } else { 0.0 }; + let TabPaint { name, kind, rects: [r, close_r], width: w, state: [active, hovered, close_hovered, dirty], live, lost, progress } = *tab; + let mark_w = if live.is_some() || lost { 18.0 } else { 0.0 }; let paint_r = r.translate(vec2(-28.0 * (1.0 - progress).powi(2), 0.0)); let painter = ui.painter().with_clip_rect(r); if active { @@ -487,8 +491,10 @@ fn paint_tab(ui: &Ui, t: &Tokens, tab: &TabPaint) { t.text.linear_multiply(progress), (w - mark_w - if dirty { 72.0 } else { 60.0 }).max(0.0), ); - if let Some(shared) = live { - let at = Rect::from_center_size(pos2(paint_r.max.x - 38.0, paint_r.center().y), vec2(14.0, 14.0)); + let at = Rect::from_center_size(pos2(paint_r.max.x - 38.0, paint_r.center().y), vec2(14.0, 14.0)); + if lost { + icons::paint(&painter, at, Icon::LiveDisconnected, t.danger.linear_multiply(progress)); + } else if let Some(shared) = live { icons::paint(&painter, at, crate::online::mark(shared), if shared { t.success } else { t.icon_secondary }.linear_multiply(progress)); } if dirty { @@ -672,6 +678,12 @@ pub fn live_mark(app: &FigApp, uid: u64) -> Option { live.shared().filter(|_| live.doc_uid == Some(uid)) } +/// Document `uid` is a live session's whose connection is gone: what happens in it reaches no one. +pub fn live_lost(app: &FigApp, uid: u64) -> bool { + let live = app.session.live_of(uid); + live.disconnected() && live.doc_uid == Some(uid) +} + /// Minimise, maximise/restore and close at the right end of the title bar; returns their width. fn window_buttons(app: &mut FigApp, ui: &mut Ui, bar: Rect) -> f32 { const W: f32 = 46.0; diff --git a/docs/collab-protocol.md b/docs/collab-protocol.md index b4b459afb..9852a1686 100644 --- a/docs/collab-protocol.md +++ b/docs/collab-protocol.md @@ -535,9 +535,21 @@ resuming with its offline edits, and leaving the session going back to snapshot `ws:///` and sends the token only inside its `Hello`. Links are pasted into the Join dialog (its field has the keyboard when it opens; Escape closes it), or opened from anywhere: see *Opening invite links* below. -- Reconnect: a connection that drops after it was live reconnects with growing pauses (0.5 s, - doubling up to 10 s, 12 attempts); a refusal (wrong token, full) or the host ending the session - is final; a first join that can't reach the host fails at once. A reconnect resumes as the same +- Reconnect: a connection that drops after it was live reconnects until you leave, with growing + pauses (0.5 s, doubling up to 10 s, 12 attempts), then a minute's pause and as many again. A + server turning a live session away is taken as passing (busy, a limit, a file it couldn't read + just now) unless it says why in words that are for good: the link, the file or your place in it + is gone, or the versions can't talk (`FINAL_REFUSALS` in `crates/collab-net/src/join.rs`). Those + and the host ending the session are final; a first join that can't reach the host fails at once. + Messages queued while offline go out paced, so they stay within what a server takes from a + connection. +- Disconnected: while it reconnects, and after it can't go on, the tab shows a red mark and a strip + across the top of the canvas says so, with **Retry now** (`collab.reconnect`). The tab can still + be edited. A session you joined that ended stays on its tab with **Try again**, **Save a copy…** + and **Dismiss** (`collab.leave`). **Try again** joins it in the same tab as someone new; if the + tab changed since it lost the server, what changed opens beside it as an unsaved + "offline copy" and the tab shows the server's version. A session that gets out of step does the + same by itself. A reconnect resumes as the same client: the guest's connection keeps the session id, client id and last sequence number from the messages it read and sends them in its next `Hello` (see Offline and reconnect). - The browser build joins and publishes to a server (see *Built (the browser client)*); hosting diff --git a/docs/collaboration-parity.md b/docs/collaboration-parity.md index fb54a8d55..deab037ae 100644 --- a/docs/collaboration-parity.md +++ b/docs/collaboration-parity.md @@ -26,6 +26,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla | Date | Change | Summary | |---|---|---| +| 2026-11-04 | minor | M9: a session you joined no longer turns into a local file by itself. A dropped connection reconnects until you leave (a minute's pause after each 12 attempts, a pause Retry now skips); only refusals that are for good stop it; queued messages go out paced. While disconnected the tab shows a red mark and a strip across the canvas says so; a session that ended stays on its tab with Try again, Save a copy and Dismiss, and what changed offline opens beside it when it joins again | | 2026-10-31 | patch | M9, #1665: the document in a live session's welcome goes compressed (deflate) to clients whose hello announces `packed`, about seven times smaller on the wire (a synthetic file of 4,040 layers: 397 KB to 53 KB); older clients keep getting it uncompressed, and the client reads a packed document only up to the size an uncompressed welcome could have had. | | 2026-10-30 | minor | M9, part of #742: a team list on `figcraft-server`. With `team_files = "edit"` (or `comment`, `view`) everyone who reaches the server sees the files shared from it now (a link of theirs has a join code: Share ▸ Start sharing) and joins them by a team list link, `figcraft://join?server=…&file=…&team=1`, which carries no secret: the server hands out the file's team link while it stays shared (`ResolveTeam`, answered like a join code), and Stop sharing revokes it with the others, disconnecting whoever joined with it. Turning the list off or changing its access refuses the old team links at once. `collab.files {refresh}` asks the server in Preferences for its list (`Admin::Team`; not the public server FigCraft ships with), and Home ▸ Online shows it below your own files: a row joins its file, its menu copies the link for the app or, with the server's `web_url`, for the browser build (`#join=…`). A browser build served beside its server names it with ``, the page's default for sharing, codes and the team list. No accounts: the list is for a server only your team reaches. Tests: `team_tests` (the server and apps over loopback), `code_tests` (links and the browser's driver), `online_tests` (the Online section), `query_tests` (the page's server). Percentages and hours unchanged | | 2026-10-30 | minor | M9, #1130: `figcraft-server` compares the SHA-256 digests of the presented and the kept server key instead of the raw strings, as `docs/server.md` says; the key file, `figcraft-server key` and rotation are unchanged. Numbers unchanged. | diff --git a/docs/mcp.md b/docs/mcp.md index b5e49e749..aae5e5860 100644 --- a/docs/mcp.md +++ b/docs/mcp.md @@ -1478,7 +1478,10 @@ only: a host stops hosting it, a guest leaves it. see `FIGCRAFT_CA_FILE` in [`server.md`](server.md#behind-a-reverse-proxy-tls)). `collab.leave {}` leaves the active document's session (or ends a join started from it that is still on its way or failed), and `collab.leave {session}` the session with that id (from `sessions`), whichever - document is active; the synced document stays open as your copy. + document is active; the synced document stays open as your copy. `collab.reconnect {}` acts on + the active document's lost session: a reconnect that is waiting tries now, and a session you + joined that couldn't go on is joined again in its tab. A dropped connection keeps reconnecting + until you leave (see *Reconnect* in [`collab-protocol.md`](collab-protocol.md)). - `collab.publish {server, name?, key?}` puts the active document on a `figcraft-server` ([`server.md`](server.md)) and syncs it from there (as that document's session; others go on): `server` is the address `figcraft-server key` prints (`ws://host:47900/?key=…`; or give `key` separately), `name` the diff --git a/docs/server.md b/docs/server.md index 9d42cb0fc..6fb4056a5 100644 --- a/docs/server.md +++ b/docs/server.md @@ -43,7 +43,7 @@ Releases also ship it ready-built for Linux (`figcraft-server--linux-x8 tells everyone it is restarting. Every change it accepted is on disk before anyone is told about it, so even a hard kill loses nothing confirmed (a file's log is then folded into a new snapshot the next time everyone leaves it). Apps that were in a file keep editing and reconnect once the - server is back (for about a minute and a half), as the same participants. + server is back, as the same participants. ## Publishing a file From 436b893741fcafa3e88f5666ccc8d34e4674e4c0 Mon Sep 17 00:00:00 2001 From: fluid-chey Date: Wed, 4 Nov 2026 12:49:11 -0700 Subject: [PATCH 24/36] M9: pace queued sends without blocking, and address review comments Queued sync messages wait in a list the session loop drains, so Leave, a lost connection, presence and pings are never held up behind them. A text frame from the host stays final. A session that ended stays on its tab after a Save as: ending it there could turn a tab into a plain local file with no word about it. Co-Authored-By: Claude Opus 5.5 --- crates/collab-net/src/driver_tests.rs | 13 +++++++++++++ crates/collab-net/src/guest.rs | 19 ++++++++++++------- crates/collab-net/src/join.rs | 3 ++- crates/ui-egui/src/live.rs | 9 +++------ docs/collaboration-parity.md | 4 ++-- 5 files changed, 32 insertions(+), 16 deletions(-) diff --git a/crates/collab-net/src/driver_tests.rs b/crates/collab-net/src/driver_tests.rs index 57921df3d..df4d5c492 100644 --- a/crates/collab-net/src/driver_tests.rs +++ b/crates/collab-net/src/driver_tests.rs @@ -349,6 +349,19 @@ fn a_session_that_was_live_only_stops_for_a_refusal_that_is_for_good() { assert!(d.done(), "{reason}"); assert!(matches!(statuses(&inbox.drain()).last(), Some(Status::Failed { reason: r }) if r.contains(reason)), "{reason}"); } + // What this end finds it can't talk to: a text frame, or a message it can't read. + for text in [true, false] { + let (mut d, inbox) = start(Script::default(), t0); + d.opened(t0); + d.message(&welcome(), t0); + if text { + d.text(t0); + } else { + d.message(&[0xFF, 1, 2, 3], t0); + } + assert!(d.done(), "text: {text}"); + assert!(matches!(statuses(&inbox.drain()).last(), Some(Status::Failed { .. }))); + } } #[test] diff --git a/crates/collab-net/src/guest.rs b/crates/collab-net/src/guest.rs index 84572b884..02685339f 100644 --- a/crates/collab-net/src/guest.rs +++ b/crates/collab-net/src/guest.rs @@ -9,6 +9,7 @@ //! Publishing ([`Guest::publish`]) first uploads the document to a server over a managing //! connection, then joins the new file with its edit link on the same thread. +use std::collections::VecDeque; use std::io; use std::net::TcpStream; use std::sync::Arc; @@ -280,17 +281,17 @@ fn session( let mut welcomed = false; let mut throttle = Throttle::new(PRESENCE_INTERVAL); let mut pace = Pace::new(Instant::now()); + // Sync messages waiting their turn (a long queue from while offline), and when each may go. + let mut paced: VecDeque<(Instant, ClientMsg)> = VecDeque::new(); let outcome = if send(&mut writer, &hello) { loop { let ping_at = last_ping + cfg.limits.keepalive; - let wake = earliest([throttle.due(), Some(ping_at)]).unwrap_or(ping_at); + let wake = earliest([throttle.due(), Some(ping_at), paced.front().map(|(at, _)| *at)]).unwrap_or(ping_at); let mut out = None; - let mut now_send = Vec::new(); match rx.recv_timeout(wake.saturating_duration_since(Instant::now())) { Ok(Cmd::Send(m)) if welcomed => { - // A long queue from while offline doesn't go out faster than the server takes it. - std::thread::sleep(pace.wait(Instant::now())); - now_send.push(m); + let now = Instant::now(); + paced.push_back((now + pace.wait(now), m)); } // Made for the previous connection (the sync client sends again what the server // didn't get once it has caught up with this connection's welcome). @@ -312,10 +313,14 @@ fn session( Ok(Cmd::Welcomed(_) | Cmd::Lost(..) | Cmd::Retry) => {} Err(RecvTimeoutError::Timeout) => {} } - if !now_send.iter().all(|m| send(&mut writer, m)) { + let now = Instant::now(); + let mut sent = true; + while sent && let Some((_, m)) = paced.pop_front_if(|(at, _)| *at <= now) { + sent = send(&mut writer, &m); + } + if !sent { break Outcome::Retry("the connection dropped".into()); } - let now = Instant::now(); let out = out.or_else(|| throttle.take_due(now)); let ok = out.is_none_or(|p| send(&mut writer, &ClientMsg::Presence(p))); let ok = ok diff --git a/crates/collab-net/src/join.rs b/crates/collab-net/src/join.rs index 63f94bec2..aa1c008eb 100644 --- a/crates/collab-net/src/join.rs +++ b/crates/collab-net/src/join.rs @@ -158,7 +158,7 @@ pub(crate) enum Next { /// gone, or the two versions can't talk. Anything else a server refuses a session with (it is /// busy, a limit was hit, the file couldn't be read just now) may pass, and servers of any version /// say so in these words, so a reason not listed here means try again. -const FINAL_REFUSALS: [&str; 11] = [ +const FINAL_REFUSALS: [&str; 12] = [ "isn't valid", "isn't on the server", "was removed from the server", @@ -170,6 +170,7 @@ const FINAL_REFUSALS: [&str; 11] = [ "couldn't be read", "message too large", "this version can't read", + "sent a text message", ]; /// Whether `reason`, from a server refusing a session that was live, is for good. diff --git a/crates/ui-egui/src/live.rs b/crates/ui-egui/src/live.rs index c80548323..ac00b2c4e 100644 --- a/crates/ui-egui/src/live.rs +++ b/crates/ui-egui/src/live.rs @@ -441,7 +441,9 @@ pub fn chat_box(app: &mut FigApp, ctx: &egui::Context) { pub fn connection_banner(app: &mut FigApp, ctx: &egui::Context, canvas: Rect) -> f32 { const H: f32 = 30.0; let live = app.session.live(); - let Some(uid) = app.session.docs.get(app.session.active).map(|d| d.uid).filter(|u| crate::tabs::live_lost(app, *u)) else { return 0.0 }; + if !app.session.docs.get(app.session.active).is_some_and(|d| crate::tabs::live_lost(app, d.uid)) { + return 0.0; + } let (text, retry, gone) = match &live.status { Status::Failed { reason } => { (trf("Not connected: {reason}. Your work is still in this tab.", &[("reason", &failure_text(reason))]), Some(tr("Try again")), true) @@ -451,11 +453,6 @@ pub fn connection_banner(app: &mut FigApp, ctx: &egui::Context, canvas: Rect) -> } _ => (tr("Disconnected. Reconnecting…").to_string(), None, false), }; - // Saved as a file of its own: it is one now. - if gone && app.session.docs.iter().any(|d| d.uid == uid && d.path.is_some()) { - app.run("collab.leave", json!({})); - return 0.0; - } let t = Tokens::get(ctx); let ink = text_on(t.danger); let (mut try_now, mut save, mut dismiss) = (false, false, false); diff --git a/docs/collaboration-parity.md b/docs/collaboration-parity.md index deab037ae..6c4aa9340 100644 --- a/docs/collaboration-parity.md +++ b/docs/collaboration-parity.md @@ -1,6 +1,6 @@ # Collaboration parity -> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-31 · **Change:** minor (a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); `figcraft-server` checks the server key by comparing SHA-256 digests, not the raw keys (#1130); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; `comment.list {mentions}` lists only the threads that @mention a name (#1415); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); an AI agent attached over MCP shows where it works (#1416); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); comment.list reports each message's @mentions (#1415); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); a refused batch's fixes take time linear in the batch (#1063); image entries are checked as they apply; branches in live sessions and branch history entries; server message limits follow `max_file_mb`; a damaged log generation field keeps flushed edits; the web build joins from a `#join=` link; removing someone from a live session; live-session revert guard; live sessions per document; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; cursor chat and spotlight in live sessions; branch version history and finer list merges; comments and version history behaviour suite and fixes; hosting the server: `wss://` in the desktop app, server releases, deployment guide; team libraries on the server and swap library; branches: create, update from main, review and merge; wording: the standalone server with share links to edit or view; numbers unchanged) · **Target:** Figma Design (desktop app 126.10.7) +> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-11-04 · **Change:** minor (M9: a joined live session reconnects until you leave and says when it is disconnected, with a red tab mark and a strip across the canvas; a live session's welcome sends the document compressed to clients that read it, about seven times smaller (#1665); a server can list the files shared from it now for everyone who reaches it, Home ▸ Online shows them and their links carry no secret (`team_files`, part of #742); `figcraft-server` checks the server key by comparing SHA-256 digests, not the raw keys (#1130); joining and leaving a file nobody is editing reads and writes nothing on the server: it stays loaded a minute after everyone leaves (#1074); `comment.people` lists names that were only @mentioned, and `comment.next` and `comment.prompt` carry the mentions too (#1415); share links can comment: a third access level beside edit and view, whose holder sees the file live and adds, replies to, reacts to and resolves comments but can't change the design; `comment.list {mentions}` lists only the threads that @mention a name (#1415); the browser build publishes files to a server, so Share ▸ Online and Publish to server work there (#917); an AI agent attached over MCP shows where it works (#1416); one name for live sessions and comments: Preferences ▸ Your name, in the Join dialog too, kept in the browser, and a rename shows at once in the sessions you are in (#1380); the Join dialog shows a join from the click until its file is ready, with Cancel, and a failed join with Try again (#1381); requests that change a server's files have a budget per address, the server key's too, and join codes are found by their hash (#1075); comment.list reports each message's @mentions (#1415); the batches kept for reconnecting apps are bounded in bytes by default, and `figcraft-server` takes `max_log_mb` (#1069); sibling placement in live sessions searches instead of counting (#1065); an AI agent attached over MCP comments under its own name, with an Agent label (#1414); a refused batch's fixes take time linear in the batch (#1063); image entries are checked as they apply; branches in live sessions and branch history entries; server message limits follow `max_file_mb`; a damaged log generation field keeps flushed edits; the web build joins from a `#join=` link; removing someone from a live session; live-session revert guard; live sessions per document; a public figcraft-server: open hosting, owner tokens, per-address limits, idle expiry, moderation, install.sh; cursor chat and spotlight in live sessions; branch version history and finer list merges; comments and version history behaviour suite and fixes; hosting the server: `wss://` in the desktop app, server releases, deployment guide; team libraries on the server and swap library; branches: create, update from main, review and merge; wording: the standalone server with share links to edit or view; numbers unchanged) · **Target:** Figma Design (desktop app 126.10.7) Figma is multiplayer first; FigCraft is local first. **Ready ~13% (estimated):** comments, version history and branches (review and merge) work inside one file; the real-time collaboration core landed in #103 (sync model, @@ -12,7 +12,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla | Feature | Figma | FigCraft | Hours | |---|---|---|---| -| Real-time co-editing | yes | **core built, no networking** (#103): client-scoped ids, per-property change sets with fractional positions, server ordering and validation, optimistic clients, binary messages; randomized multi-client convergence tests over real commands. Live sessions over the network landed (`crates/collab-net`): the WebSocket transport (keep-alive, size and rate limits, reconnect with backoff), hosting from the app (this machine or the local network) with invite links, live cursors with name tags, selections, avatars and follow, `collab.*` commands. Document sync between apps works over them (the host's server orders every batch; guests open the host's file as a new tab). Sessions are per document: each open file has its own or none, several run at once (host one, join another, publish a third) and keep syncing behind the tab in front, and closing a file ends its session only. Revert to saved is refused until the document leaves its live session; its access checks and sync association stay intact. Undo is per person (only your own steps, others' later writes left alone), refused edits roll back with a toast, and a reconnect resumes as the same client with what it missed (or a snapshot) and sends what was made offline. The browser build joins (same messages through the browser's WebSocket API); `figcraft://` invite links open the desktop app and join. Styles, variables, collections, modes and comments made in a session take ids from their creator's space (the server checks it), so concurrent creations all survive; modes, per-mode values and replies inside one entry still resolve last-writer-wins. A standalone `figcraft-server` keeps many files, persists them (a snapshot plus a log, compacted), loses nothing confirmed across a restart (apps resume as the same participants) and takes files published from the app (File ▸ Publish to server…). The desktop app and the CLI open `wss://` links too (TLS through a reverse proxy), and releases ship the server for Linux with a deployment guide (systemd, Caddy, nginx, Docker) and `install.sh`. A server can be open to the public: anyone publishes without the key, within limits per address, and files nobody opens expire. Message limits follow the server's `max_file_mb`, so files above 64 MiB publish and open (the client takes at most 1 GiB from a server, and the server warns when large limits meet open publishing, #705); a damaged generation field in a file's log no longer drops the edits flushed to it (#687). Image entries are checked as they apply: a key must be a plain name (letters, digits, `-`, `_`; it becomes `images/` in a saved file), bytes under a content-hash key must hash to it (lowercase sha256), a side is at most 65 535 px and the decoded bytes at most 256 MiB (what the importers read), a key's bytes can't be replaced and an image a layer shows can't be removed, so no collaborator can poison the shared image store or balloon memory; snapshots and server logs from before these checks open without the images they refuse (#1086). The batches kept for apps that reconnect are bounded in bytes by default (64 MiB; `max_log_mb` on `figcraft-server`), and an app further behind catches up with a snapshot (#1069). Placing a layer among its siblings is a binary search, so large pastes and reorders in one batch no longer take quadratic time (#1065). A refused batch's fixes take time linear in the batch: each deleted layer is restored once and each entry fix looked up once (#1063). Left: server archives beyond Linux | 25–55 | +| Real-time co-editing | yes | **core built, no networking** (#103): client-scoped ids, per-property change sets with fractional positions, server ordering and validation, optimistic clients, binary messages; randomized multi-client convergence tests over real commands. Live sessions over the network landed (`crates/collab-net`): the WebSocket transport (keep-alive, size and rate limits, a live connection reconnecting until you leave), hosting from the app (this machine or the local network) with invite links, live cursors with name tags, selections, avatars and follow, `collab.*` commands. Document sync between apps works over them (the host's server orders every batch; guests open the host's file as a new tab). Sessions are per document: each open file has its own or none, several run at once (host one, join another, publish a third) and keep syncing behind the tab in front, and closing a file ends its session only. Revert to saved is refused until the document leaves its live session; its access checks and sync association stay intact. Undo is per person (only your own steps, others' later writes left alone), refused edits roll back with a toast, and a reconnect resumes as the same client with what it missed (or a snapshot) and sends what was made offline. The browser build joins (same messages through the browser's WebSocket API); `figcraft://` invite links open the desktop app and join. Styles, variables, collections, modes and comments made in a session take ids from their creator's space (the server checks it), so concurrent creations all survive; modes, per-mode values and replies inside one entry still resolve last-writer-wins. A standalone `figcraft-server` keeps many files, persists them (a snapshot plus a log, compacted), loses nothing confirmed across a restart (apps resume as the same participants) and takes files published from the app (File ▸ Publish to server…). The desktop app and the CLI open `wss://` links too (TLS through a reverse proxy), and releases ship the server for Linux with a deployment guide (systemd, Caddy, nginx, Docker) and `install.sh`. A server can be open to the public: anyone publishes without the key, within limits per address, and files nobody opens expire. Message limits follow the server's `max_file_mb`, so files above 64 MiB publish and open (the client takes at most 1 GiB from a server, and the server warns when large limits meet open publishing, #705); a damaged generation field in a file's log no longer drops the edits flushed to it (#687). Image entries are checked as they apply: a key must be a plain name (letters, digits, `-`, `_`; it becomes `images/` in a saved file), bytes under a content-hash key must hash to it (lowercase sha256), a side is at most 65 535 px and the decoded bytes at most 256 MiB (what the importers read), a key's bytes can't be replaced and an image a layer shows can't be removed, so no collaborator can poison the shared image store or balloon memory; snapshots and server logs from before these checks open without the images they refuse (#1086). The batches kept for apps that reconnect are bounded in bytes by default (64 MiB; `max_log_mb` on `figcraft-server`), and an app further behind catches up with a snapshot (#1069). Placing a layer among its siblings is a binary search, so large pastes and reorders in one batch no longer take quadratic time (#1065). A refused batch's fixes take time linear in the batch: each deleted layer is restored once and each entry fix looked up once (#1063). Left: server archives beyond Linux | 25–55 | | Live cursors, selections, viewports; follow / observation mode; spotlight | yes | **done, in live sessions**: named cursors (one name for live sessions and comments: Preferences ▸ Your name, also in the Share popover and the Join dialog, kept in the browser too; a rename shows at once in the sessions you're in, #1380), selection outlines, avatars (an AI agent attached over MCP also shows its avatar and an outline around the layers it last edited or selected while it works, in or out of a session, #1416), follow (click an avatar), others' text carets and selected characters with their names, a note when two people type in one layer; spotlight (your avatar's menu, `collab.spotlight`): everyone follows your view and page, people who join later too, anyone who moves their view stops following and a banner offers to follow again, a newer spotlight takes over. Left: polish (no accounts, so anyone in the session can spotlight) | 2–4 | | Cursor chat, audio, high-fives | yes | **partial, in live sessions**: cursor chat (`/` opens a bubble at your pointer; everyone sees it as you type, it fades a few seconds after the last change, Enter sends and Escape takes it back, 100 characters; `collab.cursorChat` for agents); sent as ephemeral presence the host checks and rate-limits, never stored. No audio, high-fives or emote reactions | 2–5 | | Share links, permissions (view / edit), teams and projects | yes | **partial**: sharing with a join code from the Share popover (online: the file goes to the server in Preferences and the server names its edit, comment and view links with short codes; local network: the app hosts and the code carries its address; one field joins with a code or a link, in the popover and on the home screen, and the Join dialog then shows the join until its file is ready (Cancel), or why it failed (Try again, #1381); the browser build also joins from a link in its URL's fragment, `#join=…`, which never reaches the web host's logs, capped at 6 KiB and checked like a `figcraft://` link (#712; unit-tested, not run in a browser), and shares online and publishes to a server as the desktop app does, though not on the local network (#917; the owner token of a file it puts on an open server lasts as long as the page)); `figcraft-server` share links per file with edit, comment or view access (a viewer sees changes and presence, a "View only" badge and only the moving tools; a commenter also adds, replies to, reacts to and resolves comment threads, with a "Can comment" badge and the comment tool, #1525; the server refuses their other edits), revocable at once, tokens stored as hashes; managed from the app's Share popover (first links), the server's command line or a managing connection. On a server open to the public, whoever published a file manages it with its owner token (links, name, removal: `collab.manageFile`), which the app remembers: Home ▸ Online lists your online files (open again as owner, start and stop sharing, copy the code, rename, remove, forget), with one request per server for what became of them; anyone in a file can report it, and the operator blocks addresses. The person hosting a session, or a file's owner, removes someone from it (right-click their avatar, `collab.removePerson`): they are disconnected and their address can't join that file again while it runs. The list is per computer; a server only a team reaches can also list the files shared from it now for everyone (`team_files`): Home ▸ Online shows that team list for the server in Preferences, a row joins its file, and its links (`figcraft://join?server=…&file=…&team=1`, or the browser build's) carry no secret and stop working with the share. No accounts, teams or projects | 8–17 | From e87078a8ec2c591cde5bc164bda24cbef3c01dda Mon Sep 17 00:00:00 2001 From: fluid-chey Date: Wed, 4 Nov 2026 13:03:09 -0700 Subject: [PATCH 25/36] M9: leaving a live session sends what was waiting its turn Co-Authored-By: Claude Opus 5.5 --- crates/collab-net/src/driver.rs | 6 ++++++ crates/collab-net/src/driver_tests.rs | 15 +++++++++++++++ crates/collab-net/src/guest.rs | 2 ++ docs/collaboration-parity.md | 2 +- 4 files changed, 24 insertions(+), 1 deletion(-) diff --git a/crates/collab-net/src/driver.rs b/crates/collab-net/src/driver.rs index d96650371..622b6c52d 100644 --- a/crates/collab-net/src/driver.rs +++ b/crates/collab-net/src/driver.rs @@ -339,6 +339,12 @@ impl Driver { /// Leave the session. pub(crate) fn leave(&mut self, now: Instant) { + // What you did before leaving still reaches the others, whatever its turn. + while let Some((_, msg)) = self.paced.pop_front() { + if !self.write(&msg) { + break; + } + } self.end(Outcome::Left, now); } diff --git a/crates/collab-net/src/driver_tests.rs b/crates/collab-net/src/driver_tests.rs index df4d5c492..83684db7e 100644 --- a/crates/collab-net/src/driver_tests.rs +++ b/crates/collab-net/src/driver_tests.rs @@ -392,6 +392,21 @@ fn a_long_queue_goes_out_paced_and_in_order() { assert_eq!(d.deadline().unwrap() - now, ms(500), "nothing left to send but the reconnect"); } +#[test] +fn leaving_sends_what_was_waiting_its_turn() { + let t0 = Instant::now(); + let (mut d, _inbox) = start(Script::default(), t0); + d.opened(t0); + d.message(&welcome(), t0); + for seq in 0..300 { + d.send(ClientMsg::Ack { seq }, t0); + } + d.leave(t0); + let seqs: Vec = d.sock.sent.iter().filter_map(|m| if let ClientMsg::Ack { seq } = m { Some(*seq) } else { None }).collect(); + assert_eq!(seqs, (0..300).collect::>()); + assert!(d.done()); +} + #[test] fn a_first_join_that_cant_reach_the_host_fails_at_once() { let t0 = Instant::now(); diff --git a/crates/collab-net/src/guest.rs b/crates/collab-net/src/guest.rs index 02685339f..f338fcce2 100644 --- a/crates/collab-net/src/guest.rs +++ b/crates/collab-net/src/guest.rs @@ -306,6 +306,8 @@ fn session( } Ok(Cmd::Lost(e, o)) if e == epoch => break o, Ok(Cmd::Leave) | Err(RecvTimeoutError::Disconnected) => { + // What you did before leaving still reaches the others, whatever its turn. + while paced.pop_front().is_some_and(|(_, m)| send(&mut writer, &m)) {} let _ = writer.close(Some(CloseFrame { code: CloseCode::Normal, reason: "".into() })); break Outcome::Left; } diff --git a/docs/collaboration-parity.md b/docs/collaboration-parity.md index 6c4aa9340..6f1faad8e 100644 --- a/docs/collaboration-parity.md +++ b/docs/collaboration-parity.md @@ -26,7 +26,7 @@ cursors, selections, text carets, cursor chat and spotlights shown live ([`colla | Date | Change | Summary | |---|---|---| -| 2026-11-04 | minor | M9: a session you joined no longer turns into a local file by itself. A dropped connection reconnects until you leave (a minute's pause after each 12 attempts, a pause Retry now skips); only refusals that are for good stop it; queued messages go out paced. While disconnected the tab shows a red mark and a strip across the canvas says so; a session that ended stays on its tab with Try again, Save a copy and Dismiss, and what changed offline opens beside it when it joins again | +| 2026-11-04 | minor | M9: a session you joined no longer turns into a local file by itself. A dropped connection reconnects until you leave (a minute's pause after each 12 attempts, a pause Retry now skips); only the host ending the session and refusals that are for good stop it; queued messages go out paced. While disconnected the tab shows a red mark and a strip across the canvas says so; a session that ended stays on its tab with Try again, Save a copy and Dismiss, and what changed offline opens beside it when it joins again | | 2026-10-31 | patch | M9, #1665: the document in a live session's welcome goes compressed (deflate) to clients whose hello announces `packed`, about seven times smaller on the wire (a synthetic file of 4,040 layers: 397 KB to 53 KB); older clients keep getting it uncompressed, and the client reads a packed document only up to the size an uncompressed welcome could have had. | | 2026-10-30 | minor | M9, part of #742: a team list on `figcraft-server`. With `team_files = "edit"` (or `comment`, `view`) everyone who reaches the server sees the files shared from it now (a link of theirs has a join code: Share ▸ Start sharing) and joins them by a team list link, `figcraft://join?server=…&file=…&team=1`, which carries no secret: the server hands out the file's team link while it stays shared (`ResolveTeam`, answered like a join code), and Stop sharing revokes it with the others, disconnecting whoever joined with it. Turning the list off or changing its access refuses the old team links at once. `collab.files {refresh}` asks the server in Preferences for its list (`Admin::Team`; not the public server FigCraft ships with), and Home ▸ Online shows it below your own files: a row joins its file, its menu copies the link for the app or, with the server's `web_url`, for the browser build (`#join=…`). A browser build served beside its server names it with ``, the page's default for sharing, codes and the team list. No accounts: the list is for a server only your team reaches. Tests: `team_tests` (the server and apps over loopback), `code_tests` (links and the browser's driver), `online_tests` (the Online section), `query_tests` (the page's server). Percentages and hours unchanged | | 2026-10-30 | minor | M9, #1130: `figcraft-server` compares the SHA-256 digests of the presented and the kept server key instead of the raw strings, as `docs/server.md` says; the key file, `figcraft-server key` and rotation are unchanged. Numbers unchanged. | From 0ca48147e5b6cbb35181e042ac942f90c6120d40 Mon Sep 17 00:00:00 2001 From: fluid-chey Date: Wed, 4 Nov 2026 13:21:38 -0700 Subject: [PATCH 26/36] M9: a reconnect starts its pace afresh in the browser, as on the desktop Co-Authored-By: Claude Opus 5.5 --- crates/collab-net/src/driver.rs | 2 ++ crates/collab-net/src/driver_tests.rs | 18 ++++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/crates/collab-net/src/driver.rs b/crates/collab-net/src/driver.rs index 622b6c52d..a570836d3 100644 --- a/crates/collab-net/src/driver.rs +++ b/crates/collab-net/src/driver.rs @@ -165,6 +165,8 @@ impl Driver { fn connect(&mut self, now: Instant) { self.reconnect_at = None; + // A server counts per connection. + self.pace = Pace::new(now); self.conn = Some(Conn::new(now)); if let Err(e) = self.sock.open(&self.server().url()) { self.dropped(e, now); diff --git a/crates/collab-net/src/driver_tests.rs b/crates/collab-net/src/driver_tests.rs index 83684db7e..69cafb929 100644 --- a/crates/collab-net/src/driver_tests.rs +++ b/crates/collab-net/src/driver_tests.rs @@ -392,6 +392,24 @@ fn a_long_queue_goes_out_paced_and_in_order() { assert_eq!(d.deadline().unwrap() - now, ms(500), "nothing left to send but the reconnect"); } +#[test] +fn a_new_connection_starts_with_a_fresh_pace() { + let t0 = Instant::now(); + let (mut d, _inbox) = start(Script::default(), t0); + d.opened(t0); + d.message(&welcome(), t0); + for seq in 0..500 { + d.send(ClientMsg::Ack { seq }, t0); + } + d.closed(1006, "", t0); + let back = d.deadline().unwrap(); + d.tick(back); + d.opened(back); + d.message(&welcome(), back); + d.send(ClientMsg::Ack { seq: 900 }, back); + assert!(d.sock.sent.iter().any(|m| matches!(m, ClientMsg::Ack { seq: 900 })), "sent at once"); +} + #[test] fn leaving_sends_what_was_waiting_its_turn() { let t0 = Instant::now(); From c25088c58a9bbaf5ad6a47766868b14d615a7d5e Mon Sep 17 00:00:00 2001 From: fluid-chey Date: Wed, 4 Nov 2026 13:49:15 -0700 Subject: [PATCH 27/36] M9: count the pace of queued sends when they go, and say when leaving early The pace was set when a message was queued, so messages held up by a stalled connection left together afterwards and could trip the server's rate limit. One queue now counts it as they go, for the desktop and the browser alike. Leaving while changes are unconfirmed now says so: an undo waits for its edit, so what was still on its way may not all reach the others. Co-Authored-By: Claude Opus 5.5 --- crates/collab-net/src/driver.rs | 33 +++++++----------- crates/collab-net/src/driver_tests.rs | 16 +++++++++ crates/collab-net/src/guest.rs | 19 ++++------- crates/collab-net/src/throttle.rs | 47 ++++++++++++++++++++------ crates/engine/src/collab_live_tests.rs | 12 +++++++ crates/engine/src/sharing/live/join.rs | 9 +++-- 6 files changed, 92 insertions(+), 44 deletions(-) diff --git a/crates/collab-net/src/driver.rs b/crates/collab-net/src/driver.rs index a570836d3..049a60146 100644 --- a/crates/collab-net/src/driver.rs +++ b/crates/collab-net/src/driver.rs @@ -18,7 +18,6 @@ use figcraft_collab::message::{self, ClientMsg, Presence, ServerMsg}; use figcraft_engine::live::{Event, Status}; -use std::collections::VecDeque; use std::time::Duration; // `std::time::Instant` on native builds; the browser's clock in the web build. use web_time::Instant; @@ -29,7 +28,7 @@ use crate::invite::Endpoint; use crate::join::{GuestConfig, Next, Outcome, Resuming, Seen, Taken, after, ask, closed, hello, resolved, take, too_large, unresolved}; use crate::limits::NetLimits; use crate::requests::Publish; -use crate::throttle::{PRESENCE_INTERVAL, Pace, Throttle, earliest}; +use crate::throttle::{PRESENCE_INTERVAL, Paced, Throttle, earliest}; /// A WebSocket the driver opens, writes and closes; what it receives comes back through the /// driver's event methods. @@ -80,9 +79,8 @@ pub(crate) struct Driver { /// Your latest presence while not welcomed (sent with the welcome). pending: Option, throttle: Throttle, - /// Sync messages waiting their turn (a long queue from while offline), and when each may go. - pace: Pace, - paced: VecDeque<(Instant, ClientMsg)>, + /// Sync messages waiting their turn (a long queue from while offline). + paced: Paced, reconnect_at: Option, /// What this connection asks a server (a managing one), and what follows its answers. asking: Option<(Box, Then)>, @@ -101,8 +99,7 @@ impl Driver { resume: Resuming::default(), pending: None, throttle: Throttle::new(PRESENCE_INTERVAL), - pace: Pace::new(now), - paced: VecDeque::new(), + paced: Paced::new(now), reconnect_at: None, asking: None, done: false, @@ -165,8 +162,8 @@ impl Driver { fn connect(&mut self, now: Instant) { self.reconnect_at = None; - // A server counts per connection. - self.pace = Pace::new(now); + // A server counts per connection, and these were made for the last one. + self.paced = Paced::new(now); self.conn = Some(Conn::new(now)); if let Err(e) = self.sock.open(&self.server().url()) { self.dropped(e, now); @@ -311,19 +308,15 @@ impl Driver { if !self.conn.as_ref().is_some_and(|c| c.welcomed) { return; } - let wait = self.pace.wait(now); - if wait.is_zero() && self.paced.is_empty() { - if !self.write(&msg) { - self.end(Outcome::Retry("the connection dropped".into()), now); - } - } else { - self.paced.push_back((now + wait, msg)); + self.paced.push(msg); + if !self.send_paced(now) { + self.end(Outcome::Retry("the connection dropped".into()), now); } } /// Send the sync messages whose turn has come; false when one couldn't go. fn send_paced(&mut self, now: Instant) -> bool { - while let Some((_, msg)) = self.paced.pop_front_if(|(at, _)| *at <= now) { + while let Some(msg) = self.paced.take_due(now) { if !self.write(&msg) { return false; } @@ -342,7 +335,7 @@ impl Driver { /// Leave the session. pub(crate) fn leave(&mut self, now: Instant) { // What you did before leaving still reaches the others, whatever its turn. - while let Some((_, msg)) = self.paced.pop_front() { + while let Some(msg) = self.paced.take_now() { if !self.write(&msg) { break; } @@ -364,7 +357,7 @@ impl Driver { [Some(c.last_ping + l.keepalive), Some(c.last_heard + c.silence_limit(l)), if c.welcomed { self.throttle.due() } else { None }] } }); - earliest(conn.into_iter().flatten().chain([self.reconnect_at, self.paced.front().map(|(at, _)| *at)])) + earliest(conn.into_iter().flatten().chain([self.reconnect_at, self.paced.due()])) } /// Do what's due at `now`: reconnect, send held presence or a ping, give up on a connection @@ -426,7 +419,7 @@ impl Driver { } self.throttle = Throttle::new(PRESENCE_INTERVAL); // Made for this connection: the sync client sends again what the server didn't get. - self.paced.clear(); + self.paced = Paced::new(now); match after(outcome, &self.cfg, self.was_live, &mut self.attempt, &self.inbox) { Next::Stop(e) => { if let Some(e) = e { diff --git a/crates/collab-net/src/driver_tests.rs b/crates/collab-net/src/driver_tests.rs index 69cafb929..19c282615 100644 --- a/crates/collab-net/src/driver_tests.rs +++ b/crates/collab-net/src/driver_tests.rs @@ -392,6 +392,22 @@ fn a_long_queue_goes_out_paced_and_in_order() { assert_eq!(d.deadline().unwrap() - now, ms(500), "nothing left to send but the reconnect"); } +#[test] +fn messages_held_up_by_a_stall_dont_leave_together() { + let t0 = Instant::now(); + let (mut d, _inbox) = start(Script::default(), t0); + d.opened(t0); + d.message(&welcome(), t0); + for seq in 0..700 { + d.send(ClientMsg::Ack { seq }, t0); + } + let acks = |d: &Driver