Session recovery: more than one pending snapshot adds a 'Restore all'
button to the Recover Drawing modal — every snapshot goes through the
exact same guarded path as a single restore (deleted only after its
own open succeeds). The open-tab list and active tab persist to
localStorage on web (open/save/close) and the remembered tab is
re-selected once a restore batch settles; the modal notes how many
drawings the session had. Nothing is auto-opened.
Deep links: ?file=<url|name> opens a drawing at boot. http(s) URLs
must end in .dwg/.dxf and are fetched with the same streaming,
64 MB-capped, 8 s-deadline reader the remote images use, then go
through the guarded open queue; cross-origin opens announce the
origin first. Bare names resolve from the browser's recent storage,
with a hint when absent. Everything else (file:, javascript:, drive
letters, non-drawing tails) is refused with a console note.
Offline PWA: the app was installable (manifest) but downloaded its
55 MB bundle on every visit. A cache-first service worker now serves
the whole bundle from Cache Storage after one online visit —
navigations network-first so updates land, hashed assets
stale-while-revalidate, non-GET/cross-origin passthrough, old caches
cleaned on activate, and the waiting-worker update flow documented.
The Pages workflow stamps the cache version from the bundle hash and
fails if sw.js is missing or unstamped.
(cherry picked from commit 5f9b345e)
Ported onto main (#1717 review): the cache-version stamp moved from the
skipped build-web.sh wrapper into the Pages workflow; the tab-close hook
lands in main's on_tab_close, which also cancels pinned control requests.
Tests previously ran on Ubuntu only, so Windows- and macOS-specific breakage went unseen. Add a 3-OS test matrix and a separate lint job for rustfmt and clippy. Lint is continue-on-error because the tree is not yet fmt-clean or clippy-clean.
Also add BEDIT characterization tests that pin current session, undo and refusal behavior ahead of the editor refactor. Locked tests guard behavior that must survive; documenting tests record questionable behavior expected to change.
The v2026.40 rebuild was dispatched with a separate `commit` input copied
from a stale local tag, so Windows/macOS assets were built from 20803948
instead of 8e122a4e. Dispatch now takes only `tag` and checks the tag out.
Reverts 4700e263: the skipped Python plugin was a symptom of that commit.
Fixes#1612
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs the official MCP Inspector against a fresh release build on every push and PR: initialize purity, four titled tools, headless resources/list, both resource templates. Headless-safe methods only; drawing-dependent coverage stays in unit tests and the pinned digest. Server addressed via config file (positional CLI targets break on Windows shells); TTL assertions stay at unit level (the CLI normalizes result envelopes on output).
A dispatched rebuild checks out the tag's commit but runs main's
workflow; v2026.40 has no stage-bundled.sh, so the macOS bundle step
failed. Skip the plugin with a warning in that case only.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
rustc 1.99 overflows its default 8 MB stack compiling the crate in
release on Windows and macOS. Raise RUST_MIN_STACK to 64 MB in the cargo
config and the release workflow (the latter also covers rebuilding older
commits). The Windows Build step now runs in bash so a failed cargo build
stops the job instead of surfacing later as a missing exe at signing.
workflow_dispatch gains tag/commit inputs to rebuild a published release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Runs the plugin API tests, the plugin crate and Python model tests, and the host's
real-IPC plugin tests against a freshly staged plugin and built runner, and fails
if either environment variable target is missing so the tests cannot skip silently.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- .github/workflows/ci.yml runs `cargo test --workspace --locked` on
pushes to main and on pull requests, with the Linux libraries the
release build installs. No formatter check: the tree is not
rustfmt-clean and stays that way.
- flake.nix, flake.lock and the direnv hook are removed. Nothing used
them, and their pinned dependency hashes were already stale after the
codec and kernel bumps.
- Under cfg(test) the "system" language resolves to en-US. The unit
tests compare English text through one process-wide loader, and every
apply_config of a default config asked for the system language, so a
Turkish locale failed 22 tests and parallel tests raced each other
through a language switch (the thickness-row test found its section
under one language and looked it up under another).
- The arc grip test follows #1352: the start, end and midpoint grips
drive the whole arc.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Portable builds (executable plus plugins/opencad.python where the host looks for
it) and the real-IPC plugin tests on ubuntu and windows. Started by pushing a
fork-build-* tag or by hand; publishes nothing. release.yml stages the plugin
only in the macOS bundle.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
codesign -d --entitlements - on current macOS runner images prefixes the
plist with text headers, so the sandbox entitlement assertion died with
plistlib InvalidFileException and took the .dmg build down with it.
--xml prints the bare plist on both old and new codesign builds.
The web bundle is only built when a release is published, so a desktop-only
call in shared code can reach main unnoticed and fail the next release at
the wasm step (#1224, #1347). Run cargo check for wasm32-unknown-unknown on
the app and the web worker instead.
Step-level if: conditions cannot read the secrets context, which made
GitHub reject the workflow file outright (startup failure, zero jobs).
The signing waterfall now keys off job-level env booleans mirrored from
the credential secrets - a pattern actionlint accepts.
Forks do not inherit repository secrets, and the previous hardwired
Azure Trusted Signing steps failed the Windows job outright on a fork.
Each signing step is now gated on its credentials being present and the
pipeline falls through: Azure Trusted Signing (upstream setup, unchanged
when the secrets exist) -> PFX certificate from WINDOWS_PFX_BASE64 /
WINDOWS_PFX_PASSWORD via signtool with RFC-3161 timestamping -> unsigned
with a note in the job summary. The build and installer assembly always
complete.
Builds from main reported only the release version (2026.36) even when
HEAD was hundreds of commits past the tag. build.rs now also emits
OCS_TAG_DISTANCE, OCS_COMMIT_DATE, OCS_BUILD_METADATA and
OCS_FULL_VERSION: a clean checkout of the release tag stays "2026.36",
anything else becomes "2026.36+194.gef189d77", with ".dirty" appended
for uncommitted changes and only the hash when no tag can be counted
from (shallow clone, tarball). OCS_APP_VERSION is unchanged so the
update check, donation gate, User-Agents and window title keep working.
The About dialog gains Build / Commit date / Profile cards, Copy Info,
the REPORT issue template and recovery reports carry the full version,
and `-V`/`--version` print it instead of Cargo's 2026.36.0. Release
workflows check out full history so release binaries see the tag.
Also fixes the build being marked dirty when there is no repository:
diff-index exits 128 there, not 1.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The previous commit's Apple Event handler only ever catches an open
sent to an already-running process. A cold double-click (app not
running yet) still failed: every registration point tried inside the
real binary — before app::run(), on the Subscription's first poll,
even the literal first statement of main() — reliably caught a warm
open but never the original cold-launch event. A raw
AEInstallEventHandler in a separate, minimal, non-AppKit process (no
winit/iced, just a manual CFRunLoopRunInMode pump) still missed it
too, ruling out "the real binary's heavy dependency graph loading
before main() wins the race" as the explanation.
What does reliably catch a cold launch, verified against real
Finder-equivalent opens: a from-scratch NSApplication with its own
delegate implementing application:openURLs: — in a process where we
own setDelegate: from the start, with no contention over the single
delegate slot winit already claims. That has to be a separate process
from the real GUI binary (only one -[NSApplication run] call can own a
process), so src/bin/ocs_launcher.rs is now the .app's actual
CFBundleExecutable: a small, dependency-light binary (no iced, wgpu,
or cadkernel) whose only job is to catch the open and relay it.
Relaying by replacing this process's image (exec, same PID) or by
spawning a child and exiting turned out to both be dead ends: Launch
Services tracks "the running instance of this bundle" by the
Application Serial Number it handed out to whichever process it
actually launched — this launcher, not whatever it execs into or
spawns. Once the launcher's own ASN stopped pointing at a live,
listening process, every later open Finder tried to deliver silently
went nowhere (measured with lsappinfo against a real second "Open
With", not assumed). So the launcher now stays running for the app's
session — invisible, via NSApplicationActivationPolicyAccessory, since
it owns no window — and relays every open (cold or warm) over the same
channel a second CLI invocation already uses: io::single_instance.
That relay only worked once single_instance's rendezvous key stopped
being computed from the running executable's own path. That was fine
when one binary always did the job, but the launcher and the real
binary are different executables and independently computed different
ports, so they could never find each other. Anchor the key on the
enclosing .app bundle instead, shared by both.
packaging/build_macos_signed.sh and .github/workflows/release.yml now
build ocs_launcher and place it at Contents/MacOS/OpenCADStudio (the
CFBundleExecutable Info.plist already names), with the real GUI binary
renamed to Contents/MacOS/OpenCADStudio-App alongside it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Reuse the application library from the binary entry point instead of compiling the module tree twice. Keep desktop-only transports and caches out of web builds, remove unused test code, and check executable targets in CI.
Snapcraft strips the sole usr directory from tar sources, so extract the artifact directly and retain its desktop-file path.\n\nAdd a snap-only manual target to avoid rebuilding other platforms while validating packaging fixes.
Requested in review: this repo's working language is English, so the
comments carried over from the OpenAEC sibling repos have been
translated. No functional changes -- only comments and log/error strings.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The feature existed for one reason: truck's mesh and boolean crates reach
`vtkio → xz2 → lzma-sys`, a C library that cannot cross-compile to wasm32. So
the web build dropped it, and with it the Model tab, solid tessellation and
ACIS import — all of which quietly did nothing in the browser.
cadkernel is pure Rust and has no C dependency, so none of that holds any
more. The feature gated exactly two things by the end, `acis_export` and the
save-path sync that calls it, and both are as portable as everything around
them. Removing it means the web build makes primitives, runs booleans, draws
ACIS solids read from a file, and writes them back out as exact geometry — the
same as the desktop build.
Verified against all three: native, `--no-default-features`, and an actual
`wasm32-unknown-unknown` check rather than an assumption about one.
The docs claimed otherwise in four places and are corrected. `tessellation.md`
in particular was organised around whether an entity "goes through truck",
which is no longer a question anything can be asked — the three paths are now
a kernel B-rep mesh, a curve sampled through `entities::curve`, or geometry
emitted directly, and the per-entity table is updated to match.
`index.html` no longer passes `data-cargo-no-default-features`; there are no
features left to turn off.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The job deleted its own run once the comment was posted, so a failure to
post left nothing behind to look at. Keep the run, and drop the
`actions: write` permission it needed only in order to delete itself.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Afonsop