Merge pull request #460 from storytold/fix/issue-457

Fix #457: paste screenshots from the clipboard on macOS, Windows and the web

ROADMAP.md

@@ -4,7 +4,7 @@ VectorCraft is a clean-room, open-source, pure-Rust reimplementation of the Adob
 
 This file tracks **how far we are and what's left**. Time estimates are wall-clock hours of continuous Claude Opus 5.5 agent work (including builds and the CI gate), given both for **one agent** and for **4–6 parallel agents** on disjoint crates. They are counted from the remaining work (see [Parity estimate](#parity-estimate)), calibrated against measured throughput, and updated as work lands.
 
-_Last updated: 2026-10-08 (after M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458); see [Honest assessment](#honest-assessment-2026-10-05))._
+_Last updated: 2026-10-08 (after M4.14–M4.98, M8.1–M8.20, M14.4–M14.7, the MCP prompts, resource templates, completions and logging, the 2026-10-07 issue fixes, the Layers panel rework and the 2026-10-08 community contributions: Pen and shape-tool modifiers, path editing, Layers, Artboards, Swatches/Brushes and dialogs, Japanese composition and PDF text, Hebrew/Arabic type, interface languages (Spanish among them), the font menu, saved selections, MCP and EPS, the missing-font export warning (#319), open paths in the Shape Builder (#374), PDF/`.ai` import keeping strokes live and hidden and nested layers (#372), per-corner Live Corners (#381), SVG type opening at the size it draws at (#396), the Wayland clipboard with copied-file paste (#398), ruler guides that can be selected, moved and deleted (#414), two batches of Preferences options that were stored but unused (#394), skeleton reads with `document.find` for large documents over MCP (#416) and anchors dragged with Direct Selection snapping to points, segments and smart guides, clipped SVG layers opening as clipping layers (#420), PDF/`.ai` layers read on pages of tens of millions of operators (#419), Document Color Mode putting RGB greys on the black plate on request and converting pattern tiles (#421) and movable dialogs with Offset Path's Joins dropdown (#423) and numeric fields scrubbed by dragging their label (#400), stroke weight presets in the stroke unit (#426), the Appearance panel's Opacity popup (#430), type on a path brackets, flip and Type on a Path Options that keep the type in place (#429), Layers rows dragged with a ghost and dropped on the trash or New Layer (#435), tool flyouts opening on a right or corner press (#436), tool flyouts torn off into floating toolbars (#437), the Shape Builder's erase mode deleting edges too (#439), installed fonts registered outside the font folders and fonts installed while the app runs listed in the font menus (#443), alike circular corners on rectangles that aren't square (#442), tool cursors as OS cursors so the pointer no longer trails over the canvas (#444), artboards copied and pasted with their art (#446), guides dragged out of the rulers snapping to the art's side midpoints and the artboards, artboard guides (#451), the toolbar's double arrow and Window › Toolbars › Double Column switching between one and two columns in any window height (#455), the Smart Guides display options and Snapping Tolerance (#394), Font Size and Leading combo boxes with preset lists in the Character and Properties panels and the Control bar (#458), screenshots pasted from the clipboard on macOS, Windows and the web (#457); see [Honest assessment](#honest-assessment-2026-10-05))._
 
 ## Where we are
 
@@ -153,7 +153,7 @@ grade by behaviour against `plan/illustrator/`, not by whether a menu item exist
   - `.vectorcraft` (lossless JSON, compressed, atomic saves, save down to v1), Save As with a format chooser, Save a Copy, Revert, templates, Data Recovery after a crash (browser tabs hold their copies with Web Locks too, so a background tab's copies are never taken for a crash's, and a tab repairs copies another removed when it resumes: #367), background save and export.
   - SVG/SVGZ in and out with SVG Options, Preserve Editing, symbols, filters, rich text and physical units (SVG type under a transform or `viewBox` scale opens at the size it draws at, the scale moved into its size, leading, baseline shift and strokes, a stretch, skew or rotation kept as its transform: #396; a top-level group with a clip path, such as a clipped Inkscape layer, opens as a layer with a clipping mask, its name kept: #420); PDF and PDF-compatible `.ai` in and out (layers, with hidden ones kept hidden with their art and nested ones as sublayers, on pages of up to 64 million operators, art whose layer can't be told going to a hidden, non-printing layer rather than showing or printing: #419; strokes kept live, a fill and a stroke of one outline as one object; masks, editable text with type set along a curve coming back as type on a path, each artboard's art on its own page only, an `.ai`'s white page under its layers left out rather than coming in as art, spot colours, presets, security, marks and bleed, ICC output intents, raster effects, subset fonts, PDF/X, PDF layers, overprint, page thumbnails, fast web view, PDF 1.3). CMYK images keep their ink amounts from PDF import (and from placed CMYK TIFFs) to PDF export: a CMYK JPEG passes through unchanged, others stay CMYK (DeviceCMYK, or ICC-based CMYK in PDF/X-3/X-4) unless the Output settings convert them; the canvas shows them through the working CMYK profile (#320).
   - EPS and DXF in and out, EMF/WMF in and out; PNG (with PNG-8), JPEG, WebP, GIF, TIFF, BMP, Targa and layered PSD export. EPS import runs Illustrator's AGM/CoolType prologs (resource categories, `resourceforall`, `clipsave`/`cliprestore`, subarrays and substrings that share storage, the standard dictionaries in `systemdict`, `dictstack`, `internaldict`, executable filters, `cshow`, metadata skipped with `flushfile`), so Illustrator 30 EPS files open as vectors, and falls back to its palette TIFF preview. DXF TEXT justified Fit or Aligned spans its two points (stretched, or scaled as a whole).
-  - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398).
+  - Place and the Links panel, Package, File Info, Print with print presets, PostScript output and print tiling, slices and Save for Web, Export for Screens and Asset Export, CSS Properties, PNG/PDF/SVG/text clipboard flavours; files copied in a file manager paste as art (SVG, PDF, EMF/WMF, bitmaps) on every desktop platform, and Linux/Wayland reads the compositor's clipboard (#398); screenshots and other copied pictures paste as embedded images at the view centre everywhere, the web included (#457).
 - **Performance:** 20k shapes + 1k texts render in 27 ms per full-retina frame (7.8 ms zoomed), 7× faster than the first version. The UI thread never blocks. The web build is 7.1 MB gzipped.
 - **Graphics processor:** the canvas is rasterized on the CPU and the GPU only composites it, so the desktop app asks for the power-saving GPU by default (the integrated one on hybrid-graphics laptops, where presenting from the discrete GPU made the window flicker, #306). Preferences › Performance › Graphics Processor (`gpuPreference`) or `WGPU_POWER_PREF` picks the discrete one; Help › About and `ui.inspect` name the adapter in use. When the browser drops the page's WebGPU device or WebGL context, the web build writes recovery copies, starts again on new graphics with the same app and uploads its textures again; if it can't, it removes the stale canvas and says to reload, which offers the copies back. The desktop app writes the copies and says to restart (#369). On Windows and Linux the tools' cursors are OS cursors (bitmaps rasterized once per display scale), which the system moves itself: painted into the window, they trailed the pointer by the frames waiting to be shown, and the window now queues one frame instead of two (#444). macOS and the web still paint them (macOS sizes cursor bitmaps in points, eframe has no bitmap cursors on the web).
 - **Tests and robustness:** ~2,840 automated tests: model-based property tests, a junk-parameter sweep over every command, import fuzzing (SVG, PDF, libraries), golden renders, and MCP end-to-end tests over stdio. Shipped code never panics (workspace lints and a rollback safety net; see `docs/development.md`).

apps/vectorcraft-web/Cargo.toml

@@ -27,4 +27,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage", "Navigator"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlIFrameElement", "HtmlAnchorElement", "Blob", "BlobPropertyBag", "ClipboardEvent", "DataTransfer", "File", "FileList", "Url", "Location", "CssStyleDeclaration", "Event", "EventTarget", "MouseEvent", "DragEvent", "Storage", "Navigator"] }

apps/vectorcraft-web/src/web.rs

@@ -1,11 +1,12 @@
-//! The browser shell: web `Services`, drag-and-drop, the eframe web runner, and starting again
-//! with new graphics when the page loses them (#369).
+//! The browser shell: web `Services`, drag-and-drop, pasted pictures and files, the eframe web
+//! runner, and starting again with new graphics when the page loses them (#369).
 
 use std::cell::{Cell, RefCell};
 use std::rc::Rc;
 use std::sync::{Arc, Mutex};
 
 use vectorcraft_engine::Session;
+use vectorcraft_engine::cmd::clipboard::{FILE_HEAD, Flavour, PASTE_ORDER, file_flavour};
 use vectorcraft_engine::cmd::fileio;
 use vectorcraft_engine::cmd::recovery::{self, Hold, RecoveryStore};
 use vectorcraft_ui_egui::graphics::GraphicsLoss;
@@ -23,6 +24,14 @@ type Inbox = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
 /// whether Shift was held: where dropped files land.
 type DragPos = Rc<Cell<Option<(f32, f32, bool)>>>;
 
+/// A picture or file pasted into the page, read and waiting for the next frame with the modifiers
+/// held at the paste, and the context to wake for it (the current runner's).
+#[derive(Default)]
+struct Pasted {
+    flavour: Option<(Flavour, egui::Modifiers)>,
+    ctx: Option<egui::Context>,
+}
+
 const CANVAS_ID: &str = "vectorcraft_canvas";
 const LOADING_ID: &str = "vectorcraft_loading";
 
@@ -37,6 +46,7 @@ struct Host {
     inbox: Inbox,
     place_inbox: PlaceInbox,
     drag: DragPos,
+    pasted: Rc<RefCell<Pasted>>,
     /// The page's Web Locks for Data Recovery, started once before the first frame: a graphics
     /// restart keeps them, so the tab stays the owner of its recovery area.
     locks: Option<WebLocks>,
@@ -59,9 +69,11 @@ pub fn start() {
             inbox: Arc::default(),
             place_inbox: Arc::default(),
             drag: DragPos::default(),
+            pasted: Rc::default(),
             locks,
             restarts: 0,
         };
+        track_paste(&host.pasted);
         run(host, canvas, None).await;
     });
 }
@@ -94,6 +106,7 @@ async fn run(host: Host, canvas: web_sys::HtmlCanvasElement, moving: Option<Movi
                     let (loss, ctx) = (loss.clone(), ctx.clone());
                     rs.device.set_device_lost_callback(move |reason, msg| loss.report(&ctx, format!("{reason:?}: {msg}")));
                 }
+                host.pasted.borrow_mut().ctx = Some(ctx.clone());
                 let services = services(host.inbox.clone(), host.place_inbox.clone(), ctx.clone(), host.locks.clone());
                 let app = match taken.borrow_mut().take() {
                     Some(mut app) => {
@@ -178,6 +191,50 @@ fn track_drag(canvas: &web_sys::HtmlCanvasElement, pos: &DragPos) {
     on_drag.forget();
 }
 
+/// Take pictures and files pasted into the page (egui reads a paste's text only): a paste without
+/// text hands the first of its files that is art (a bitmap, SVG, PDF, a metafile) to the next
+/// frame. Text, SVG markup among it, is left to egui.
+fn track_paste(pasted: &Rc<RefCell<Pasted>>) {
+    let Some(window) = web_sys::window() else { return };
+    let pasted = pasted.clone();
+    let on_paste = wasm_bindgen::closure::Closure::<dyn FnMut(web_sys::ClipboardEvent)>::new(move |e: web_sys::ClipboardEvent| {
+        let Some(data) = e.clipboard_data() else { return };
+        let Some(files) = data.files().filter(|f| f.length() > 0) else { return };
+        if data.get_data("text").is_ok_and(|t| !t.is_empty()) {
+            return;
+        }
+        e.prevent_default();
+        let held = pasted.borrow().ctx.as_ref().map(|c| c.input(|i| i.modifiers)).unwrap_or_default();
+        let files: Vec<web_sys::File> = (0..files.length()).filter_map(|i| files.get(i)).collect();
+        let pasted = pasted.clone();
+        wasm_bindgen_futures::spawn_local(async move {
+            for file in files {
+                let bytes = match wasm_bindgen_futures::JsFuture::from(file.array_buffer()).await {
+                    Ok(buf) => js_sys::Uint8Array::new(&buf).to_vec(),
+                    Err(e) => {
+                        log::error!("couldn't read the pasted file {}: {}", file.name(), js_err(e));
+                        continue;
+                    }
+                };
+                if let Some(mime) = file_flavour(&file.name(), bytes.get(..FILE_HEAD).unwrap_or(&bytes), &PASTE_ORDER) {
+                    let mut p = pasted.borrow_mut();
+                    p.flavour = Some((Flavour { mime, data: bytes }, held));
+                    if let Some(ctx) = &p.ctx {
+                        ctx.request_repaint();
+                    }
+                    return;
+                }
+            }
+        });
+    });
+    // Captured before eframe's own listener, which stops the event.
+    if let Err(e) = window.add_event_listener_with_callback_and_bool("paste", on_paste.as_ref().unchecked_ref(), true) {
+        log::error!("couldn't follow paste events: {e:?}");
+    }
+    // The listener lives as long as the page.
+    on_paste.forget();
+}
+
 /// Report the loss of `canvas`'s WebGL context to `loss` (WebGPU devices report theirs through
 /// wgpu).
 fn watch_canvas(canvas: &web_sys::HtmlCanvasElement, loss: &GraphicsLoss, ctx: &egui::Context) {
@@ -284,6 +341,10 @@ impl eframe::App for WebShell {
             self.restart(&why);
         }
         let Some(app) = &mut self.app else { return };
+        let pasted = self.host.pasted.borrow_mut().flavour.take();
+        if let Some((f, held)) = pasted {
+            app.paste_from_host(ctx, f, held);
+        }
         let dropped = ctx.input_mut(|i| std::mem::take(&mut i.raw.dropped_files));
         if !dropped.is_empty() {
             let at = self.host.drag.take();

apps/vectorcraft/Cargo.toml

@@ -39,9 +39,9 @@ clipboard-win = { workspace = true }
 [target.'cfg(target_os = "macos")'.dependencies]
 muda = { version = "0.21", default-features = false }
 objc2 = "0.6"
-objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSResponder", "NSTextInputContext"] }
-# Files opened from Finder and the Dock (src/open_documents.rs); both already come with winit, muda and rfd.
-objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSNotification", "NSOperation", "NSString", "NSURL"] }
+objc2-app-kit = { version = "0.3", default-features = false, features = ["std", "NSApplication", "NSPasteboard", "NSResponder", "NSTextInputContext"] }
+# Files opened from Finder and the Dock (src/open_documents.rs) and pasted bitmaps (src/clipboard.rs); both already come with winit, muda and rfd.
+objc2-foundation = { version = "0.3", default-features = false, features = ["std", "block2", "NSArray", "NSData", "NSNotification", "NSOperation", "NSString", "NSURL"] }
 block2 = "0.6"
 
 [build-dependencies]

apps/vectorcraft/src/clipboard.rs

@@ -2,9 +2,11 @@
 //! (`Services::system_clipboard`).
 //!
 //! - Windows: text, SVG, PDF, PNG and an opaque bitmap (for apps that don't read PNG) in one go;
-//!   Paste reads each of them.
+//!   Paste reads each of them, a bitmap as PNG, else as the device-independent bitmap that
+//!   screenshots and most apps copy (`CF_DIBV5`, `CF_DIB`; the system makes them of a `CF_BITMAP`).
 //! - macOS and Linux: one format at a time, the text (a type-only copy's text or the SVG markup),
-//!   else the PNG as a bitmap; Paste reads text and bitmaps. On Wayland, arboard's data-control
+//!   else the PNG as a bitmap; Paste reads text and bitmaps (on macOS the pasteboard's PNG or TIFF
+//!   as they are, as screenshots copy them). On Wayland, arboard's data-control
 //!   backend reads the compositor's clipboard (X11 through XWayland only sees what X11 apps
 //!   copied), falling back to X11 where the compositor lacks the protocol.
 //! - Everywhere: files copied in a file manager paste as the first one that is art (SVG, PDF, a
@@ -30,10 +32,79 @@ fn text_of(flavours: &[Flavour]) -> Option<String> {
     flavours.iter().find(|f| f.mime == TEXT).map(|f| String::from_utf8_lossy(&f.data).into_owned())
 }
 
+/// Most pixels a side of a bitmap another app put on the clipboard (untrusted data).
+const MAX_SIDE: u32 = 32_768;
+
 fn decode_png(png: &[u8]) -> Option<image::RgbaImage> {
     Some(image::load_from_memory_with_format(png, image::ImageFormat::Png).ok()?.to_rgba8())
 }
 
+/// `img` as a PNG flavour.
+fn png_flavour(img: &image::RgbaImage) -> Option<Flavour> {
+    let mut data = vec![];
+    img.write_to(&mut Cursor::new(&mut data), image::ImageFormat::Png).ok()?;
+    Some(Flavour { mime: PNG, data })
+}
+
+/// A Windows device-independent bitmap (`CF_DIB`, `CF_DIBV5`: a BITMAPINFO header, the colour
+/// masks of a BITMAPINFOHEADER, the colour table, then the pixels) as a BMP file, whose header
+/// says where the pixels start. `None` when the header is cut short or out of range.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn dib_file(dib: &[u8]) -> Option<Vec<u8>> {
+    const BI_BITFIELDS: u32 = 3;
+    const BI_ALPHABITFIELDS: u32 = 6;
+    let u16_at = |i: usize| Some(u16::from_le_bytes(dib.get(i..i + 2)?.try_into().ok()?));
+    let u32_at = |i: usize| Some(u32::from_le_bytes(dib.get(i..i + 4)?.try_into().ok()?));
+    let header = u32_at(0)?;
+    // BITMAPCOREHEADER has 16-bit fields and 3-byte colours; the others 32-bit fields, 4-byte
+    // colours and a count of them (0: all a palette of the depth has), the 40-byte one its masks
+    // after it.
+    let (bits, used, entry, masks) = match header {
+        12 => (u16_at(10)?, 0, 3, 0),
+        _ => {
+            let masks = match (header, u32_at(16)?) {
+                (40, BI_BITFIELDS) => 12,
+                (40, BI_ALPHABITFIELDS) => 16,
+                _ => 0,
+            };
+            (u16_at(14)?, u32_at(32)?, 4, masks)
+        }
+    };
+    let colours = match used {
+        0 if bits <= 8 => 1 << bits,
+        n if n <= 256 => n,
+        _ => return None,
+    };
+    let offset = [header, masks, colours * entry].into_iter().try_fold(14u32, u32::checked_add)?;
+    let size = u32::try_from(dib.len()).ok()?.checked_add(14)?;
+    if offset > size {
+        return None;
+    }
+    let mut bmp = Vec::with_capacity(dib.len() + 14);
+    bmp.extend_from_slice(b"BM");
+    bmp.extend_from_slice(&size.to_le_bytes());
+    bmp.extend_from_slice(&[0; 4]);
+    bmp.extend_from_slice(&offset.to_le_bytes());
+    bmp.extend_from_slice(dib);
+    Some(bmp)
+}
+
+/// A device-independent bitmap as an image, at most [`MAX_SIDE`] pixels a side. It is opaque when
+/// its alpha is zero throughout: screenshots and most apps leave the fourth byte of a 32-bit pixel
+/// at zero, even under an alpha mask.
+#[cfg_attr(not(windows), allow(dead_code))]
+fn dib_image(dib: &[u8]) -> Option<image::RgbaImage> {
+    let mut reader = image::ImageReader::with_format(Cursor::new(dib_file(dib)?), image::ImageFormat::Bmp);
+    let mut limits = image::Limits::default();
+    (limits.max_image_width, limits.max_image_height) = (Some(MAX_SIDE), Some(MAX_SIDE));
+    reader.limits(limits);
+    let mut img = reader.decode().ok()?.into_rgba8();
+    if img.pixels().all(|p| p.0[3] == 0) {
+        img.pixels_mut().for_each(|p| p.0[3] = u8::MAX);
+    }
+    Some(img)
+}
+
 /// The first of `paths` (files copied in a file manager) that pastes as one of `mimes`, read
 /// whole. Only its first bytes are read to tell, so other files cost little.
 fn copied_file(paths: Vec<PathBuf>, mimes: &[&'static str]) -> Option<Flavour> {
@@ -71,6 +142,10 @@ mod win {
         }
     }
 
+    /// The device-independent bitmaps, the one that carries alpha first. Each is there whenever the
+    /// other or a `CF_BITMAP` is: the system converts between them.
+    const DIBS: [u32; 2] = [formats::CF_DIBV5, formats::CF_DIB];
+
     fn formats_of(mime: &str) -> impl Iterator<Item = u32> {
         names(mime).iter().filter_map(|n| raw::register_format(n)).map(NonZeroU32::get)
     }
@@ -162,7 +237,7 @@ mod win {
             raw::is_format_avail(formats::CF_HDROP)
                 || mimes.iter().any(|m| match *m {
                     TEXT => raw::is_format_avail(formats::CF_UNICODETEXT),
-                    BITMAP => raw::is_format_avail(formats::CF_BITMAP) || formats_of(PNG).any(raw::is_format_avail),
+                    BITMAP => DIBS.into_iter().chain(formats_of(PNG)).any(raw::is_format_avail),
                     m => formats_of(m).any(raw::is_format_avail),
                 })
         }
@@ -182,9 +257,11 @@ mod win {
         let mime = match mime {
             BITMAP if read_registered(PNG, &mut data) => PNG,
             BITMAP => {
-                data.clear();
-                raw::get_bitmap(&mut data).ok()?;
-                "image/bmp"
+                return DIBS.into_iter().find_map(|id| {
+                    data.clear();
+                    raw::get_vec(id, &mut data).ok()?;
+                    png_flavour(&dib_image(&data)?)
+                });
             }
             TEXT => {
                 raw::get_string(&mut data).ok()?;
@@ -210,13 +287,6 @@ mod portable {
 
     use super::*;
 
-    /// `img` as PNG bytes.
-    fn encode_png(img: &image::RgbaImage) -> Option<Vec<u8>> {
-        let mut out = vec![];
-        img.write_to(&mut Cursor::new(&mut out), image::ImageFormat::Png).ok()?;
-        Some(out)
-    }
-
     /// What our last write put on the clipboard.
     enum Ours {
         Text(String),
@@ -283,21 +353,65 @@ mod portable {
             mimes.iter().find_map(|m| match *m {
                 TEXT => cb.get_text().ok().filter(|t| !t.is_empty()).map(|t| Flavour { mime: TEXT, data: t.into_bytes() }),
                 BITMAP => {
+                    #[cfg(target_os = "macos")]
+                    if let Some(f) = super::mac::bitmap() {
+                        return Some(f);
+                    }
                     let img = cb.get_image().ok()?;
                     let rgba = image::RgbaImage::from_raw(u32::try_from(img.width).ok()?, u32::try_from(img.height).ok()?, img.bytes.into_owned())?;
-                    encode_png(&rgba).map(|data| Flavour { mime: PNG, data })
+                    png_flavour(&rgba)
                 }
                 _ => None,
             })
         }
 
-        /// Text only: reading a bitmap costs as much as pasting it.
+        /// Text, and on macOS a bitmap (by the pasteboard's types). Linux has no cheap way to ask
+        /// for a bitmap (reading one costs as much as pasting it): the paste keys take it, the
+        /// menu item waits for text.
         fn has(&mut self, mimes: &[&'static str]) -> bool {
+            #[cfg(target_os = "macos")]
+            if mimes.contains(&BITMAP) && super::mac::has_bitmap() {
+                return true;
+            }
             mimes.contains(&TEXT) && self.cb().is_ok_and(|cb| cb.get_text().is_ok_and(|t| !t.is_empty()))
         }
     }
 }
 
+/// The macOS pasteboard's bitmaps as they are (arboard reads TIFF only, and decodes it).
+#[cfg(target_os = "macos")]
+mod mac {
+    use objc2::rc::autoreleasepool;
+    use objc2_app_kit::NSPasteboard;
+    use objc2_foundation::{NSArray, NSString};
+
+    use super::*;
+
+    /// The bitmap types Paste reads, best first (the values of `NSPasteboardTypePNG` and
+    /// `NSPasteboardTypeTIFF`), with their MIME types.
+    const TYPES: [(&str, &str); 2] = [("public.png", PNG), ("public.tiff", "image/tiff")];
+
+    /// Does the pasteboard hold a bitmap? Asks for its types only.
+    pub fn has_bitmap() -> bool {
+        autoreleasepool(|_| {
+            let types = TYPES.map(|(t, _)| NSString::from_str(t));
+            let types: Vec<&NSString> = types.iter().map(|t| &**t).collect();
+            NSPasteboard::generalPasteboard().availableTypeFromArray(&NSArray::from_slice(&types)).is_some()
+        })
+    }
+
+    /// The pasteboard's bitmap, PNG before TIFF.
+    pub fn bitmap() -> Option<Flavour> {
+        autoreleasepool(|_| {
+            let pasteboard = NSPasteboard::generalPasteboard();
+            TYPES.into_iter().find_map(|(t, mime)| {
+                let data = pasteboard.dataForType(&NSString::from_str(t))?.to_vec();
+                (!data.is_empty()).then_some(Flavour { mime, data })
+            })
+        })
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use vectorcraft_engine::cmd::clipboard::{PASTE_ORDER, SVG};
@@ -341,4 +455,95 @@ mod tests {
         let with_cr = PathBuf::from(format!("{}\r", red.display()));
         assert_eq!(copied_file(vec![with_cr], &PASTE_ORDER).map(|f| f.mime), Some(PNG));
     }
+
+    /// A DIB of `w`×`h` pixels (top row first when `h` is negative): a `header`-byte header (40,
+    /// or 124 for a BITMAPV5HEADER with BGRA masks), `extra` (the masks after a 40-byte header, a
+    /// colour table), then `rows`, each padded to 4 bytes.
+    fn dib(header: u32, w: i32, h: i32, bits: u16, compression: u32, extra: &[u8], rows: &[u8]) -> Vec<u8> {
+        let mut d = vec![];
+        d.extend(header.to_le_bytes());
+        d.extend(w.to_le_bytes());
+        d.extend(h.to_le_bytes());
+        d.extend(1u16.to_le_bytes());
+        d.extend(bits.to_le_bytes());
+        d.extend(compression.to_le_bytes());
+        d.extend((rows.len() as u32).to_le_bytes());
+        // 96 ppi, every colour of the table used.
+        d.extend([3780u32, 3780, 0, 0].iter().flat_map(|v| v.to_le_bytes()));
+        if header == 124 {
+            d.extend([0x00FF_0000u32, 0xFF00, 0xFF, 0xFF00_0000, 0x7352_4742].iter().flat_map(|v| v.to_le_bytes()));
+            d.resize(124, 0);
+        }
+        d.extend_from_slice(extra);
+        d.extend_from_slice(rows);
+        d
+    }
+
+    /// 32-bit BGRA rows of `px` (top row first).
+    fn bgra(px: &[[u8; 4]]) -> Vec<u8> {
+        px.iter().flat_map(|[r, g, b, a]| [*b, *g, *r, *a]).collect()
+    }
+
+    const RED: [u8; 4] = [255, 0, 0, 255];
+    const BLUE: [u8; 4] = [0, 0, 255, 255];
+
+    fn pixels(img: &image::RgbaImage) -> Vec<[u8; 4]> {
+        img.pixels().map(|p| p.0).collect()
+    }
+
+    #[test]
+    fn a_screenshot_dib_pastes_opaque_and_upright() {
+        // CF_DIB as screenshots copy it: 32-bit BI_RGB, bottom row first, the fourth byte zero.
+        let rows = bgra(&[[0, 0, 255, 0], [0, 0, 255, 0], [255, 0, 0, 0], [255, 0, 0, 0]]);
+        let img = dib_image(&dib(40, 2, 2, 32, 0, &[], &rows)).unwrap();
+        assert_eq!(pixels(&img), [RED, RED, BLUE, BLUE]);
+        // The same bitmap with an alpha mask (CF_DIBV5), alpha still zero throughout: opaque too.
+        let img = dib_image(&dib(124, 2, -2, 32, 3, &[], &bgra(&[[255, 0, 0, 0]; 4]))).unwrap();
+        assert_eq!(pixels(&img), [RED; 4]);
+    }
+
+    #[test]
+    fn a_dibv5_keeps_its_alpha_top_down() {
+        // A negative height: top row first.
+        let rows = bgra(&[[255, 0, 0, 128], [255, 0, 0, 128], [0, 0, 255, 0], [0, 0, 255, 255]]);
+        let img = dib_image(&dib(124, 2, -2, 32, 3, &[], &rows)).unwrap();
+        assert_eq!(pixels(&img), [[255, 0, 0, 128], [255, 0, 0, 128], [0, 0, 255, 0], BLUE]);
+    }
+
+    #[test]
+    fn masks_and_colour_tables_come_before_the_pixels() {
+        // BI_BITFIELDS after a 40-byte header: three masks between it and the pixels.
+        let masks: Vec<u8> = [0x00FF_0000u32, 0xFF00, 0xFF].iter().flat_map(|v| v.to_le_bytes()).collect();
+        let img = dib_image(&dib(40, 1, 1, 32, 3, &masks, &bgra(&[[0, 0, 255, 0]]))).unwrap();
+        assert_eq!(pixels(&img), [BLUE]);
+        // 8-bit, two colours used, rows padded to 4 bytes, bottom row first.
+        let mut table = bgra(&[RED, BLUE]);
+        table[3] = 0;
+        let mut d = dib(40, 3, 2, 8, 0, &table, &[1, 1, 1, 0, 0, 1, 0, 0]);
+        d[32..36].copy_from_slice(&2u32.to_le_bytes());
+        assert_eq!(pixels(&dib_image(&d).unwrap()), [RED, BLUE, RED, BLUE, BLUE, BLUE]);
+        // 24-bit, rows padded.
+        let img = dib_image(&dib(40, 1, 2, 24, 0, &[], &[255, 0, 0, 0, 0, 0, 255, 0])).unwrap();
+        assert_eq!(pixels(&img), [RED, BLUE]);
+    }
+
+    #[test]
+    fn untrusted_dibs_are_refused_not_trusted() {
+        let one = bgra(&[RED]);
+        // Too large a side (the pixels aren't even there), cut short, a header or a colour count
+        // out of range, no pixels.
+        assert!(dib_image(&dib(40, MAX_SIDE as i32 + 1, 1, 32, 0, &[], &one)).is_none());
+        assert!(dib_image(&dib(40, 1, -(MAX_SIDE as i32) - 1, 32, 0, &[], &one)).is_none());
+        assert!(dib_image(&dib(40, 4096, 4096, 32, 0, &[], &one)).is_none());
+        assert!(dib_image(&[40, 0, 0]).is_none());
+        assert!(dib_image(&[]).is_none());
+        let mut d = dib(40, 1, 1, 32, 0, &[], &one);
+        d[0..4].copy_from_slice(&u32::MAX.to_le_bytes());
+        assert!(dib_image(&d).is_none());
+        let mut d = dib(40, 1, 1, 8, 0, &[], &[0; 4]);
+        d[32..36].copy_from_slice(&u32::MAX.to_le_bytes());
+        assert!(dib_file(&d).is_none());
+        assert!(dib_image(&dib(40, 1, 1, 32, 0, &[], &[])).is_none());
+        assert!(dib_image(&dib(40, 0, 0, 32, 0, &[], &[])).is_none());
+    }
 }

crates/ui-egui/src/lib.rs

@@ -303,10 +303,11 @@ pub struct VectorcraftApp {
     /// Hover position in document coordinates.
     pub hover_doc: Option<vectorcraft_geom::Point>,
     /// System clipboard: SVG to publish next frame, the last SVG we published (so pasting it back
-    /// uses the lossless internal clipboard) and text that arrived with a Paste event.
+    /// uses the lossless internal clipboard) and what came with a paste (a Paste event's text, a
+    /// picture or file the host read: [`Self::paste_from_host`]).
     clipboard_out: Option<String>,
     clipboard_published: Option<String>,
-    pub(crate) clipboard_in: Option<String>,
+    pub(crate) clipboard_in: Option<vectorcraft_engine::cmd::clipboard::Flavour>,
     /// A URL to open through egui next frame (when the host has no `open_url` service).
     pending_url: Option<String>,
     /// Windows and Linux: the window has no OS decorations, so the app bar is the title bar (drag,

crates/ui-egui/src/shortcuts.rs

@@ -3,6 +3,7 @@
 
 use egui::{Key, KeyboardShortcut, Modifiers};
 use serde_json::json;
+use vectorcraft_engine::cmd::clipboard::{Flavour, TEXT};
 use vectorcraft_tools::{Mods, ToolKey};
 
 use crate::VectorcraftApp;
@@ -301,7 +302,7 @@ pub fn handle(app: &mut VectorcraftApp, ctx: &egui::Context) {
         clip.push((id, None));
     }
     for (id, text) in clip {
-        app.clipboard_in = text;
+        app.clipboard_in = text.map(|t| Flavour { mime: TEXT, data: t.into_bytes() });
         crate::menus::invoke(app, id, json!({}));
     }
     if busy {

crates/ui-egui/src/sysclip.rs

@@ -4,7 +4,8 @@
 //! or a copied file that is one of them) into the internal clipboard with the `clipboard.import*`
 //! commands. The host installs the platform side as
 //! [`Services::system_clipboard`](crate::Services::system_clipboard); without it (the web) Copy
-//! publishes SVG text through egui and Paste takes SVG text only.
+//! publishes SVG text through egui and Paste takes SVG text, and the pictures and files the host
+//! reads from a paste itself ([`VectorcraftApp::paste_from_host`]).
 
 use serde_json::{Value, json};
 use vectorcraft_engine::cmd::clipboard::{EMF, Flavour, PASTE_ORDER, PDF, SVG, TEXT, looks_like_svg};
@@ -59,14 +60,27 @@ impl VectorcraftApp {
         }
     }
 
+    /// Paste `f`, which the host read from the system clipboard itself (a web page's paste carries
+    /// pictures and files, egui's Paste event text only), as the paste chord `held` pastes:
+    /// unless a field or the Type tool has the keyboard, as with the paste keys.
+    pub fn paste_from_host(&mut self, ctx: &egui::Context, f: Flavour, held: egui::Modifiers) {
+        if ctx.egui_wants_keyboard_input() || self.session.tool_wants_text() {
+            return;
+        }
+        self.clipboard_in = Some(f);
+        crate::menus::invoke(self, crate::shortcuts::paste_command(held), json!({}));
+    }
+
     /// Before a paste: what another app put on the system clipboard replaces the internal
     /// clipboard (centred in the view). What we published ourselves keeps the lossless internal
     /// copy. An error means nothing should be pasted.
     pub(crate) fn adopt_system_clipboard(&mut self) -> Result<(), String> {
-        let event_text = self.clipboard_in.take();
+        let pasted = self.clipboard_in.take();
         let center = self.view().map(|v| [v.center.x, v.center.y]);
-        let (cmd, params) = match self.services.system_clipboard.as_mut() {
-            Some(cb) => {
+        let (cmd, params) = match (pasted, self.services.system_clipboard.as_mut()) {
+            // A picture or file the host read from the paste.
+            (Some(f), _) if f.mime != TEXT => import_command(&f, center),
+            (_, Some(cb)) => {
                 if cb.holds_ours() {
                     return Ok(());
                 }
@@ -74,8 +88,9 @@ impl VectorcraftApp {
                 import_command(&f, center)
             }
             // Text only: SVG markup is art, other text is left alone.
-            None => {
-                let text = event_text.or_else(|| self.services.clipboard_read.as_mut().and_then(|f| f()));
+            (pasted, None) => {
+                let text =
+                    pasted.map(|f| String::from_utf8_lossy(&f.data).into_owned()).or_else(|| self.services.clipboard_read.as_mut().and_then(|f| f()));
                 let Some(text) = text.filter(|t| looks_like_svg(t)) else { return Ok(()) };
                 if self.clipboard_published.as_deref() == Some(text.as_str()) {
                     return Ok(());

crates/ui-egui/src/tests_sysclip.rs

@@ -224,3 +224,29 @@ fn without_the_service_plain_text_is_still_not_pasted() {
     frame(&mut app, vec![egui::Event::Paste("hello".into())]);
     assert_eq!(count(&app), 0);
 }
+
+#[test]
+fn a_picture_the_host_read_from_a_paste_pastes_without_the_service() {
+    // The web: the page's paste event carries the picture, egui's Paste event no text.
+    let mut app = VectorcraftApp::new(Session::new(), Default::default());
+    run(&mut app, "file.new", json!({"width": 400, "height": 300}));
+    let v = app.view_mut().unwrap();
+    (v.center, v.fitted) = (Point::new(250.0, 180.0), true);
+    let ctx = egui::Context::default();
+    app.paste_from_host(&ctx, Flavour { mime: PNG, data: blue_png() }, egui::Modifiers::COMMAND);
+    let n = &pasted(&app)[0];
+    let NodeKind::Image(im) = &n.kind else { panic!("not an image: {:?}", n.kind) };
+    assert!(im.link.is_none() && (im.width, im.height) == (4, 2));
+    assert!((n.geometric_bounds().unwrap().center() - Point::new(250.0, 180.0)).hypot() < 1e-6);
+    // Cmd+Shift+V held: Paste in Place, where the picture was put (the view's centre) again.
+    app.paste_from_host(&ctx, Flavour { mime: PNG, data: blue_png() }, egui::Modifiers::COMMAND | egui::Modifiers::SHIFT);
+    assert_eq!(count(&app), 2);
+    // A picture that isn't one pastes nothing, the stale internal clipboard neither.
+    app.paste_from_host(&ctx, Flavour { mime: PNG, data: b"not a picture".to_vec() }, egui::Modifiers::COMMAND);
+    assert_eq!(count(&app), 2);
+    assert!(app.ui.status.starts_with("Couldn't paste"), "{}", app.ui.status);
+    // A copied SVG file pastes as art.
+    let svg = r#"<svg xmlns="http://www.w3.org/2000/svg"><rect width="10" height="10"/></svg>"#;
+    app.paste_from_host(&ctx, Flavour { mime: SVG, data: svg.as_bytes().to_vec() }, egui::Modifiers::COMMAND);
+    assert!(matches!(pasted(&app)[0].kind, NodeKind::Path { .. }));
+}

docs/control-protocol.md

@@ -304,8 +304,9 @@ the same); the last one runs the paste with `swatchConflict`. `ui.dialog.cancel`
 
 Paste placement: through the app, `edit.paste` and `edit.pasteWithoutFormatting` without `center`, `dx` or `dy`
 paste at the centre of the view. The Paste menu items are enabled while the system clipboard holds something to
-paste (SVG, PDF, text or a bitmap on the desktop; SVG on the web), even with nothing copied in the app (looked at up
-to four times a second; `ui.menu.list` shows it). The Layers panel menu (≡ on
+paste (SVG, PDF, text or a bitmap on Windows; text or a bitmap on macOS; text on Linux, whose paste keys still take a
+bitmap; SVG on the web, whose paste keys also take pictures and files), even with nothing copied in the app (looked
+at up to four times a second; `ui.menu.list` shows it). The Layers panel menu (≡ on
 the dock's tab strip while Layers shows) lists the layer commands (New Layer…, Duplicate and Delete Selection,
 Options for Selection…, clipping mask, isolation, Locate Object, Merge Selected, Flatten Artwork, Collect in New
 Layer, Release to Layers, Reverse Order, Template, Hide/Outline/Lock Others or Show/Preview/Unlock All Layers), Paste
@@ -346,7 +347,8 @@ System clipboard formats: through the desktop app, `edit.copy` and `edit.cut` pu
 lists to the system clipboard, and every Paste command first loads what another app copied (`clipboard.importSvg`,
 `importPdf`, `importText` or `importImage`, centred in the view); an import error answers the Paste with that error
 and pastes nothing. Cmd+V also pastes a bitmap or PDF with no text beside it (on the key's release, as egui sends no
-Paste event for it).
+Paste event for it). Screenshots paste on every platform: Windows reads `PNG`, else `CF_DIBV5`/`CF_DIB`, macOS the
+pasteboard's PNG or TIFF, Linux `image/png`, and the web the picture the browser's paste event carries (#457).
 
 File menu details: `file.openRecent1`…`file.openRecent30` open the recent files the `recentFilesCount` preference
 lists (0 hides them all; `file.recentFiles` returns the listed paths), `file.reveal` shows the document's file in the

docs/mcp.md

@@ -1479,8 +1479,11 @@ physical size) or `clipboard.importText {text}` (point text in the default type
 (default: the first artboard); then any `edit.paste*` command pastes it. The desktop app does this itself: Copy and
 Cut publish the formats to the system clipboard, and a Paste outside text editing first reads what another app
 copied (SVG, then PDF, then text, then a bitmap; SVG markup in text counts as SVG). Pasting what VectorCraft copied
-keeps the lossless internal clipboard. Windows carries every format both ways; macOS and Linux carry one format
-(the text, else the PNG) and paste text and bitmaps. On the web only SVG text goes through the system clipboard.
+keeps the lossless internal clipboard. Windows carries every format both ways and pastes a bitmap from PNG, else
+from the device-independent bitmap screenshots copy (`CF_DIBV5`, then `CF_DIB`; alpha kept, opaque when it is zero
+throughout, at most 32768 px a side); macOS and Linux carry one format (the text, else the PNG) and paste text and
+bitmaps (macOS the pasteboard's PNG, else TIFF, as screenshots copy them). On the web Copy publishes SVG text, and
+Paste takes SVG text and the pictures and files a paste carries (a screenshot pastes as an embedded image).
 
 The `pasteTextFormatting` preference (`keep` or `plain`): with `plain`, text the Type tool copied pastes into type
 without its formatting, taking the style at the caret.