effect.apply / effect.applyLast run through the menu dispatcher (Effect
menu, Last Effect, an effect dropped on a Timeline layer or on Effect
Controls) now bring up Effect Controls, opened if closed and brought to
the front without taking the focus, on the layer the effect went to
(selecting it if it was dropped on an unselected layer, keeping the new
effect selected). Double-clicking an effect's name in the Timeline opens
it in Effect Controls (layer.select, prop.select, window.panel) instead
of twirling it, as in After Effects.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 04bd305b9dccbb34d8c70fe870513208cdae0b7b)
Opening a comp (Project double-click, Open Composition, a Timeline tab)
now reopens the Composition panel if it was closed and brings it (and
the Timeline) to the front, as in After Effects. A closed Composition
panel also reopens in the centre (with the Layer panel or other viewers,
else above the Timeline) instead of beside Effects & Presets, which also
fixes Window > Composition.
App::raise_panel opens/fronts a panel without moving the focus;
show_panel builds on it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit adf2c6dac78ce426ea0bf6b4199b7238d8ad99dd)
A selected pin was drawn only 1 px bigger and slightly brighter. Now, like
selected and unselected mask vertices in the viewer, a selected pin is
filled with its kind colour and ringed in white, and an unselected pin is
hollow (dark centre, coloured outline). Drawing only; hit-testing is
unchanged.
Regression test: selected_puppet_pins_are_filled_and_unselected_hollow.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 103b5c41e9e8ea84008593e05af50b01a2800b3e)
Clicking an effect's name selected it (prop.select with the effect's group
uid) but group rows never painted the selection, so there was no feedback.
Group rows (effects, masks, shape groups...) now fill with row_selected when
selected, exactly like selected property rows.
Regression test: timeline_selected_effect_row_highlights.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 8b140428b39a24c3e1207ffde0430e759e316112)
- Project panel Clear (#95's focus routing) goes through invoke, so deleting
items that compositions use still asks first (M3.16).
- ui_project_delete: let a dialog finish egui::Modal's sizing frame before
clicking its buttons (#95 moved dialogs to egui::Modal).
- #71's i18n / theme tests clear the frame's texture delta; egui asserts on
unhandled deltas in debug builds.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Release builds add an arm64 MSI and portable zip, cross-compiled on the x64
runner (signing and WiX as for x64). package.ps1 checks each binary's PE
header before packaging: Machine must match -Arch, the app must be a GUI
program and the CLI a console program. It skips the CLI smoke run when an
ARM64 build can't run on the host. A new Windows ARM64 workflow packages the
ARM64 MSI, installs it on a Windows 11 ARM64 runner, checks both installed
exes are ARM64, runs the CLI, and uninstalls. Ported from printcraft#66.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rust 1.99 renamed AtomicU32::fetch_update to try_update; try_update is not
available on the workspace's minimum Rust (1.95).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
(cherry picked from commit 2232354b902238827b2e80a29ef266c2e5bde272)
(cherry picked from commit 95da7943454ca5b2575993d11f9ba046822ce255)
Fixes the Windows installer: the Start Menu shortcut and Add/Remove Programs icon were blank. The shortcut description was wrong. Release builds no longer open a console window behind the app.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The MSI Icon id had no .ico/.exe extension, which Windows Installer needs for
advertised shortcuts and ARPPRODUCTICON, so both showed a blank icon. Release
builds of the desktop app are now GUI-subsystem (no console window; the CLI stays
a console program), the shortcut/summary description names what EffectCraft does, and
packaging-lint rejects an Icon id without an extension. Found in printcraft#57.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sysctl hw.physmem / hw.pagesize / vm free+inactive page counts, hw.model,
and freebsd-version, with a unit test for the sysctl parser. The FreeBSD
CI workflow itself landed with #69.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
egui-wgpu creates its device on GL with WebGL2's limits (no storage buffers), so the desktop
app on FreeBSD built the compositor's pipelines on it: validation errors (only logged in
release builds) and wrong frames. GpuContext::new now checks the limits its pipelines bind
(storage buffers and textures per stage, bind groups, workgroup sizes) and returns Err, which
keeps the app on the CPU. ui_gpu skips its GPU-vs-CPU comparison when that happens on GL.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD's CI VM (Mesa llvmpipe over GL) failed 22 effectcraft-gpu tests:
- Advanced 3D's camera-depth target was R32Float, which GLES can't render to without
EXT_color_buffer_float: create_render_pipeline failed validation (release builds only log
that and draw nothing). The target is now R32Uint holding the f32 bits (renderable on every
backend, lossless), and GpuContext checks the adapter's format features (render attachment,
blendable colour) and independent blending up front; when they're missing the render
pipelines are never built and Advanced 3D renders on the CPU.
- Signed `%` in the shaders: naga emits GLSL `%`, undefined for negative operands, which broke
the VR effects' horizontal wrap and Cell Pattern's tiling. A shared `imod` never takes `%` of
a negative number.
- asin/acos: Mesa's are coarse approximations (~1e-4 rad), visible in every lens/sphere/cylinder
mapping. `asin_p`/`acos_p` (Cephes' asinf polynomial) are f32-accurate on every backend.
- "Could not lock adapter context": the GL backend has one context lock per adapter with a
timeout, so tests driving devices concurrently panic. Every gpu test helper that hands out a
device holds one process-wide lock for the calling test; ui_web_job_gpu's two device tests
share a lock too.
- On GL, up to 1 % of pixels may flip across a decision boundary (division through a
reciprocal, unfused fma); the GPU-vs-CPU comparisons allow that there only.
Also adds the FreeBSD workflow (from the FreeBSD CI PR) so this branch is checked there.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Real-file test oracles live in storytold/photocraft-corpus, explained in
craftrules standards/test-corpora.md. Never commit large binary fixtures
here; fetch them pinned and sha256-verified.
Co-authored-by: Claude Opus 5.5 <[email protected]>
parity.md's ≈99% measures breadth only. docs/gaps.md assesses real-world
readiness by dimension (fidelity, .aep interop, stability, platform
reliability, performance, media, AI tools, maturity) with evidence, and
sets prioritised workstreams with done criteria. ROADMAP, README, parity.md,
AGENTS.md and CLAUDE.md point agents at it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
These crates have no production panic sites: add the deny attribute so they stay clean
(geom, color, model, automation, host, export, plugin, and the desktop, CLI and web apps). The
plugin's wasm-only test module gets a separate cfg(test) attribute so clippy recognises it as
test code.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
ui-egui without expect()/unreachable!(): the frame pool is optional (rayon's global pool if the
OS refuses threads) and gets a panic_handler, because a panic in a rayon spawn() job aborts the
whole process by default; render-queue progress, the text-edit anchor and the GPU viewer
texture are bound where they're checked; the settings panel's Bool arm no longer panics.
Denies the panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In EPS/PostScript, `0#7` asked i64::from_str_radix for radix 0, which panics (found by
fuzzing). Radixes outside 2..=36 are not numbers now.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
render: the debug-only quantisation check uses debug_assert! instead of panic!. gpu: the
test-only panic on a wgpu validation error is cfg(test) with a narrow allow, and release
builds only log. Test-only unreachable!() calls become panic!(). Denies the panic lints in both
crates.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Tick arithmetic saturates, seconds-to-tick conversion clamps to Tick::MIN..=Tick::MAX (NaN is
zero), zero rates/timebases no longer divide by zero, and timecode / feet+frames parsing and
formatting use checked or saturating math. `layer.timing {"delta": -1e308}` over the control
channel overflowed FrameRate::snap_nearest (found by fuzzing every command), and a timecode
field holding 99999999999999:00:00:00 overflowed parse_timecode. Denies the panic lints.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Effects without expect(): nested parameter groups are looked up with ? (falling back to the
effect's top level), the OCIO effects use named constants for the built-in ACES spaces instead
of expect()ing a table lookup, curve fitting and Path Text no longer expect on just-pushed
vectors. Test-only unreachable!() becomes panic!(). Denies the panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
roxmltree recurses per element and overflowed a 2 MiB stack at a few thousand nested
elements (aborting the app). parse() now scans the element depth first and returns
Error::Xml beyond 256 levels.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FCP 7 XML / FCPXML nested about 1 000 elements deep overflowed an 8 MiB stack in the XML
parser (aborting the app). Import now scans XML and OTIO JSON nesting first and returns
Error::TooDeep beyond 256 levels.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The descriptor depth limit restarted at 0 inside every nested descriptor (Objc / GlbO /
ObAr), so a crafted file of 100 000 nested descriptors (2.4 MB) recursed until the stack
overflowed and aborted the app. The depth now carries through nested descriptors.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
raster: the inpainting pyramid stops at a missing level, and video inpainting falls back to a
plain patch fill if the previous frame is missing, instead of expect(). path: curve fitting of
an empty point list returns a degenerate cubic instead of indexing/unwrapping, and Merge Paths
no longer has an unreachable!() arm. Denies the panic lints in both crates.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Removes the engine's production expect() calls: background-job polling (camera, mask, roto,
point and warp tracking, render queue) uses let-else / if-let instead of take().expect("job"),
command helpers bind what they checked instead of re-reading it with expect, the menu bar falls
back to an empty tree (logged) instead of expect()ing that a constant parses, and
autotrace/text animator group lookups no longer expect a just-inserted group. perf.rs, the
benchmark harness behind `effectcraft-cli bench --ops`, opts out with a module-level allow.
Test-only unreachable!() calls become panic!() (clippy.toml allows panics in tests). Denies the
panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Text layout and font resolution without expect(): an empty line list keeps the default bounds,
the line breaker stops instead of expect()ing a checked option, and font resolution falls back
to the first bundled face. The one remaining expect (the bundled-font database is never empty)
carries the documented narrow allow. Denies the panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Session::execute runs every command (UI, CLI, control channel, MCP, scripts; file import,
export and save are commands too) through guard::guarded, which catch_unwinds a panic that
escapes the command and returns EngineError::Other("command `x` failed with an internal error
(...); it was stopped and your project is still open"). Edits work on a copy of the project, so
a command that panics mid-edit leaves the project untouched. The desktop app also installs a
panic hook that logs every panic through the app logger (then runs the default hook).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Scripts (Script Console, effectcraft-cli script, the MCP run_script tool) are parsed by Boa,
which recurses per nesting level and overflows the stack (aborting the app) at about 200
levels on an 8 MiB thread. run() now rejects a script nested deeper than MAX_NESTING (96)
brackets with a ScriptError before parsing; strings, template literals and comments are
skipped. Also replaces expect("console context") with an error, and denies the panic lints.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The camera solver, KLT pyramid and subspace (warp stabilizer) tracker expect()ed data-structure
invariants: a track point seen in a frame, a solved camera, a pyramid level. A missing value now
skips that point/track (or, for finish(), returns a SolveError: "no frame was solved") instead of
panicking. Denies the panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Lottie stores line cap, line join, merge mode and some text-selector enums 1-based, and the
importer subtracted 1 from whatever number the file held: -1e308 (rounded to i64::MIN)
overflowed, a panic in debug builds (found by structural fuzzing). Use saturating_sub. Denies
the panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
opusenc: the SILK state is used through if-let / let-else instead of expect("SILK state").
vp9enc: the motion-search SAD and inter prediction return early without a reference frame
instead of expect("reference"). Denies the panic lints in both crates.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Replaces the encoder's 8 expect()/unwrap()/unreachable!() calls with handling that can't
panic: coding-unit decisions without a candidate report an infinite cost, inter helpers
without a reference picture return a neutral result, residual_coding of an all-zero block
writes nothing, the impossible Intra arms are no-ops, and the edge padding of an empty row uses
0 instead of unwrapping. Denies the panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Replaces the encoder's 11 expect()/unreachable!() calls on internal invariants with handling
that can't panic: the rate-control state is passed in rather than re-borrowed, inter decisions
without a reference frame fall back to intra, per-plane results are bound directly, and the
writer's impossible branches become debug_asserts. Denies the panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
An expression nested about 60 brackets deep overflowed the stack of a 2 MiB thread in the
JavaScript parser (release and debug; ~200 levels on 8 MiB), which aborts the whole app: it
can't be caught. The array-maths rewrite also nests one call per arithmetic operator, so a long
sum went the same way, and the rewriter itself recursed per bracket. rewrite() now measures the
nesting (brackets plus chains of prefix operators) before and after rewriting and turns an
expression deeper than MAX_NESTING (32) into a RangeError; check_syntax reports the same error.
Also replaces the unreachable!() in the bracket-tree builder with a let-chain, and denies the
panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Layer::motion_trackers_mut expect()ed the group it had just inserted; it returns an Option
now and track.motion reports an error if the group is somehow missing. Denies the panic
lints in the crate (the project model behind .ecproj files).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Layer bounds come straight from the file as four i32s. Rect::width/height subtracted them in
i32 (overflow: a panic in debug builds, garbage sizes in release), and layer_pixels allocated
width x height pixels before reading any data, so a 100-byte file claiming a 2^31-square layer
hit "capacity overflow" (or an out-of-memory abort). Widths are now computed in i64 and
clamped, every decoded image is capped at 2^28 pixels (Error::Unsupported beyond that), zlib
data is inflated with a limit of the expected size, RLE count tables and UTF-16 strings
reserve no more than the remaining bytes, and the per-pixel copy only visits the part of the
layer that lands in the output. Denies the panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The smart-object branch of the layered-file decoder bound the footage layer twice and
re-read it with expect("embedded implies a layer"); bind it once with a let-chain. Denies the
panic lints in the crate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The s, b and b* operators closed the path even when there was no current point, which kurbo
asserts against (a panic in debug builds; found by fuzzing). Close only when a subpath is open.
CFF charstrings that draw before their first rmoveto now start the subpath at the current
point, as Type 1 charstrings already did. Denies the panic lints in the crate (it had no panic
sites).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Path data like "M0 0 L10 0 Z9" repeated Z implicitly for the stray number; Z consumes no
numbers, so the parser looped forever appending close-paths until memory ran out (a 1-byte
change to a valid SVG used 24 GB and was killed). A number after Z is a syntax error, so
parsing now stops there and keeps what was read, as the spec asks. Also denies the panic lints
in the crate (it had no panic sites).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Removes the six expect() calls from timeline export/import and denies the panic lints in the
crate. A precomp layer whose source item is not a composition (a damaged project, or an item
that was deleted) made export panic in Exporter::sequence; it now leaves that layer out.
Exporter::sequence and track_item return Option, the Motion/Opacity/Volume effect defaults
come from effect_or_new (None if FilmCraft's registry lacks one), and import's motion() skips
a layer without a transform group.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- AGENTS.md: a "Never crash" section ahead of the asset rules (the rule, why, the bans,
Result/? patterns, hostile input-derived numbers, bounded recursion, lock poisoning, the
last-resort guard, a regression test per crash fix), linking craftrules
standards/never-crash.md. CLAUDE.md and CONTRIBUTING.md point to it.
- clippy.toml: allow unwrap/expect/panic/indexing in tests, so the restriction lints can be
denied crate by crate without touching test code.
- [workspace.lints.rust] unsafe_code = "forbid" (was "deny"); there is no unsafe or
allow(unsafe_code) in the workspace.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- LICENSE-MIT / LICENSE-APACHE from the Crafting Apps standard: copyright
"ArtCraft Team and the EffectCraft contributors", Apache-2.0 in the
canonical apache.org layout.
- NOTICE (new): copyright, dual licence, brand carve-out, bundled OFL fonts.
- docs/brand/LICENSE-brand.txt (new): ArtCraft brand terms.
- docs/brand sidecars, ATTRIBUTION.md and AGENTS.md §1.8 point to the
brand terms (owner ArtCraft Team; forks and modified versions remove them).
- README: standard "License and credits" section; badge alt text
"License: MIT OR Apache-2.0".
Co-Authored-By: Claude Opus 5.5 <[email protected]>
warp.status solved the stabilization plan (Subspace Warp eigen-decompositions and mesh fits)
on the page the first time it saw an analysis: ~4.9 s blocking the browser's event loop in
the smoke test. The analysis job now sends the plan summary with its result, and a settings
change has a WarpPlan job solve it (status reports stabilizing meanwhile). Desktop unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
contentFill.generate sends its plan (FillPlan) to a browser job worker:
the layer's frames render in passes on the worker's WebGPU device, the PNG
sequence goes back to browser storage (Services::store_file), and the page
adds the fill layer when the plan returns (WorkerReply::Fill). The smoke
test checks it; docs updated.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- GPU in browser job workers: each job worker opens its own WebGPU device
(deferred readbacks); the Render Queue export and the analyses' frame loops
are futures (render::passes, offload::run_request_async) whose frames
render in passes, awaiting the device between them. GPU particles and
Advanced 3D read back under keys too. workers.jobs reports passes and
readbacks; the smoke test measures them.
- Layer buffers in the browser's OPFS disk cache: frame workers back their
layer caches with a PrefetchStore; the page plans what to fetch before a
request from recent misses (LayerPrefetch over the shared DiskIndex).
- Templates embed footage (default on, size-capped with a warning) and
creating from a template extracts it next to the new project / into
browser storage.
- ICC LUT profiles (lut8/lut16/lutAtoB/lutBtoA, from the public ICC spec) in
Simulate Output > My Custom RGB, baked into a 3D LUT for the viewer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The geometry stays on the CPU as per-frame plans shared with the CPU effects (bolts, mask
strokes, scribbles, contour segments, audio marks, glyph strokes, waves, flood-fill region,
eyedropper sample); segments and convex polygons are tile-binned and rasterised on the GPU
with the CPU's coverage functions. CPU output unchanged (gen_golden). CC Threads' exact ties
at round parameter values are a documented exception; Fractal stays on the CPU (needs f64).
Regenerated docs/effects.md, docs/parity.md EFF-5.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GPU render passes for CC Particle World / Systems II, Particle Playground,
CC Ball Action, CC Pixel Polly, CC Scatterize and Curl Noise (fx_particles,
chunked multi-pass raster); Shatter wireframe views, Foam extras, Timewarp
with a Matte Layer, strong Warp Fisheye/Twist (CPU f64 inverse map) and
custom .ocio configs no longer fall back to the CPU. CPU refactors pinned by
particle_golden / timewarp_golden / sim_golden hashes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Inner/Outer Key's trimap and Cleanup strokes, Color Link's sample and CC Glass/Plastic's
light are shared with the CPU effects (CPU output unchanged: gen_golden). CC Plastic now
reads its Bump Layer (it read the nonexistent bumpMap id).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
