* perf(engine): replace linear scans that made document-sized inputs quadratic
enum_of re-classified the whole string for every character; widget names,
comment mentions and devcompare's common siblings each searched a growing
Vec; data.fill's export names and codegen's class names retried every
suffix from 2 against a list, cubic in the number of copies of one name;
and a batch rename template had no length cap although it is expanded
again for every match.
* address review: report the pattern in its own length error
* fix(engine): hold a plugin's text.preview to the permissions of the command it previews
* address review: check PREVIEWABLE before recursing into a preview's inner command
A read-only plugin could archive, merge, create or update a branch: branch
state lives beside the document, so neither the command's history flag nor
the document Arc check saw the write. Any plugin could read a saved version
through dev.compare's version parameter although version.* is denied, and
library.list handed plugins each library's path, which for a server library
is the share link with its token.
The confirmation showed the directory entry's access and commands, but the
downloaded bundle's manifest was registered as is, so a directory could
show a read-only plugin and install one that edits the document. A manifest
asking for more than the entry showed is refused before it is saved.
The assets of a plugin folder were read through whatever links they
pointed at, so a folder handed to the publisher could put any file the
publisher can read into the bundle the directory then serves to everyone.
A linked asset, or a linked assets folder, is refused by name before
anything is sent.
A widget description can have a line, 100 long and black and 1 thick unless told
otherwise, and an SVG that comes in as locked layers, scaled to fit a size and
within the widget's 256 layers. The Counter example uses both.
* M11: a widget opens its plugin's panel (plugin API 5)
Gap 6: a widget callback's ui_show opens the plugin's panel and keeps the module loaded; the panel's callbacks get the widget's id and state and redraw it in the same undo step. Older plugins' ui_show from a widget still opens nothing. The Counter example sets its count from a panel.
* M11: open_panel takes its opener as one value
* M6: plugin panels show images
An image control in a plugin panel carries a picture as base64 (at most 256 KB; panel specs up to 1 MB), drawn at its size up to a field's width and named by its label, which shows instead when the picture can't be decoded or is over 4,096 px on a side. Images can't be clicked or be command parameters. Panel and form captions no longer wrap.
* Render worker: in_flight counts the watchdog's late preview
The watchdog that previews a render running past PREVIEW_AFTER_MS could pass its still-rendering check, lose the race to the full render, and then hand over its preview and wake the UI after Worker::in_flight had gone false. An idle test that had settled then saw a 0 ns repaint whose cause egui reports a frame late (CI on #1639: 'asked for a repaint in 0ns: [app/files.rs:211]', the autosave tick of the previous frame). The watchdog now marks itself busy from before that check until it has handed over and woken (or skipped), and in_flight counts it; the full render's done markers are SeqCst so the watchdog sees a finished render before in_flight can read idle.
* Docs: drop a status item the merge listed twice
* M8: opening a file contacts no team library server it names until you check it (#1097)
* M8: translate the team library check strings (#1097)
* M8: the Assets panel library test checks what allows a library, without its own fake link (Sonar duplication and coverage)
bflatastic
Dylan M. Taylor
aiongg