Library changes outside the platform's own dependencies (those came with the platform commits above). libs/asset and libs/flow move to the Stage repository with the apps that use them.
Covers work 6f1e44649..2b1a41df4 for libs:
- wm: the Android super-app compiles tiles on the phone against the host engine
- cargo-makepad: the super-app APK is packed by `android dyn-pack`, in Rust
- cef: a page's audio can be captured instead of played
- flow: the flow-ui app and the flowgraph canvas return to the workspace, with staged progress in libs/flow
- svg: a stroke that bends tighter than its half width collapses its inner edge to the corner
- the accent a name is written with stops deciding whether search finds it
- ai stems: LaneDemixer, VocalsModel and the platform Stage origin/main needs
- The regex engine accepts \b and \B, reports the earliest match so a scan can resume after it, and can decide word boundaries on ASCII so a code sear
- workspace: Scope's settings carry the code map's tab width and the directories each prepared project hides from its map
- cef, video, platform: what Stage's browser needs from the shared layers
- platform, wm: work builds again on iOS, tvOS and wasm, and the window manager is warning-free on Windows
- ci: tools/ci, a Splash runtime that watches a branch and runs every ci.splash it finds
- stitch: the crate says what the rest of the repository says about its license
- ci: a run is one target dir and one cargo batch per target, and the wall draws
- apps: what the CI box found
- Remove Flow, asset and VJ applications moved into Stage
- tests: the workspace suite, run as a whole for the first time, passes outside the example UI tests
- libs: no warnings in the workspace check on any row
- tests: the last three failures of the CI box's night
- gif: the crate's doc examples compile
- cef: a hosted browser survives its host's exit
- tests: the three binaries over ten seconds in release come under it
- git: the memory ledger can take what it is asked for
- script: re-entrant dispatch, thread index validation, Any-based handle downcasts, UTF-8 previews; regex: never_loop fix
- fix(text): enable ttf-parser gvar-alloc for many-tuple variable fonts
- platform, widgets, wm: a touch that is taken away is cancelled, never released
- platform, wm: hosted apps ask the WM for what they cannot do themselves
- wm on Android: apps build on the phone
- task, cargo-makepad, widgets, audio: the task manager chooses its columns, graphs every process' network and disk traffic and installs itself as a D
- flowgraph: ordered ports take many wires, sockets can override their icon, and the canvas embeds as a viewport
- cef: captured frames and audio carry callback clocks and a navigation epoch
- git: timings read a portable clock
- ai: the hub's rig-fixture tests find the asset library without the asset client
- ai llm: a Metal main buffer is filled in 32 MB chunks
- diskmap: a scan lists each macOS directory in one getattrlistbulk call and classifies files without allocating or locking
- platform, widgets, audio_route, ai: window crossfades and whole-frame presents, caption controls that click, themed menus, a stereo-pair audio tap,
- builder: the Builder TUI matches the new terminal design, Windows executables carry app icons, and every app has one
- sheets, score, git, home: saves cannot cut a file short or overwrite another one, and checkouts cannot write outside the repository
- git: worktree status matches git on real repositories and can be cancelled
- cuda: builds link only the CUDA toolkit they are given, never a system install
- audio_route: one API on macOS, Windows and Linux, monitoring by default and processing only when asked, plus shaders that discard a value compile to
- platform, widgets, ai: a restyle recompiles nothing it already has, shows only complete frames, and a window can own its caption
- audio_route example: print the samples that reached the processor each second
- widgets, builder: the big widget families are features, all on by default, and the Builder takes none of them
- ai hub: a local chat with no model says so once, plainly
- ai: Claude Desktop drives any app with the F10 panel
- wm: children open no console windows on Windows
- ai: Connect hands the .mcpb to Claude Desktop itself
- civil-time: one local wall clock for every app, and it knows the zone on Windows
- ai-speech: makepad-ai-sfx (and with it ai-h3) is built only for IndexTTS
- script + wasm_bridge: no build script that reruns on every file
- build: the AI stack, csg, Scope and Source Library join the one workspace
- ai chat: the chat's backends are the CLI, MCP and cloud providers; the local model is the `localai` feature
- widgets: every widget family is a crate of its own under widgets/families, and makepad-widgets links, re-exports and registers the ones its features
- apps, examples, libs: each crate builds only the widget families it uses, and the design overlay is each app's own default feature
- livepipe: takes makepad-widgets without its default families, now that the AI stack is in the one workspace
- ai chat: a build without local AI starts on the first provider that answers here, not on "No model"
- thiserror: RUSTC_BOOTSTRAP no longer turns on the unstable generic member access API
- builder: makepad-builder.exe declares itself like a well-formed Windows program and stops a stalled build through a job object instead of taskkill
- builder + ai-cuda: the CUDA kernel progress shows in the Builder's Compile row, not scribbled over its screen
- repo: no third-party comic archive, generated models or sample asset in the tree
- builder: the Windows Builder ships as source, runs in its own console, and apps compile with Rust's GNU toolchain or Microsoft's
- win_resource: PNG decode and encode on makepad-fast-inflate instead of zune-png
- builder: one folder layout everywhere, makepad-builder.zip with only the files a Windows build reads, a Rust download over parallel connections, and
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Squash of 25 work commits (Sep 1–12):
237da90 render: the sprite lane hands the screen draw back the way it found it
895b9a7 particles: an emitter can ride a body's own frame
914471f ai-hub: a feed session whose last socket left ends on its idle timeout; skin: parent, skinned centroid and a nodes-only rig for retargets
3fcccf3 sim: the whole world is implicitly editable, and one seam says where the ground is
5692fab sim: the landform world proves itself — walker through the tunnel included
f4af6df sim: terrain knows who changed it — a plan layer over player history
adbb078 render: a water volume can be physics without a picture
c17480f render: a non-rigid body may carry its own orientation
acad401 sim: an agent with no route holds and retries instead of walking into the wall
22b2bf9 sim + chat: the composed world surface takes a map floor; the chat gets plan tools
faf8112 web path: the tessellator's lap timer, the trace span and the fusion cycle timer have no clock on the web
d3472eb tsdf: the clock-taking XR helpers are native-only — the browser has no depth camera and no Instant
4946c9e sim + render: a repaint is not a world edit — colour and glow restyles never rebake the lightmap
4317f58 sim + render + chat: walk decks as a surface, the filmed body is no obstruction, the brief never asks
9791279 render: support rigged models and custom materials across viewers
3ce2792 sim: use deck geometry for collision and sensing
c8b79ff Add portable PBR, rig and soft-body authoring support
108d423 Add transactional polygon modeling and editable asset documents
38f4d3b Refine editable modeling and firm yarn character behavior
08a2637 sim: add entity-owned lights and vehicle headlights
00d96a7 render: add clustered lights, local shadows and incremental GI
cf916af render: import glTF asset extensions and wire clustered GI
c6d2cca model: cut transaction memory and raise capacity limits
41af47a raytrace: add a CPU probe-ray BVH budget example
c963d0a libs: the game sim splits into makepad-scene and makepad-soft-body; render, model, fab and the asset importer retarget
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Squashed from work; the fine-grained history is under tag archive/work-2026-08-29:
- mp* wave: mpwm window manager + the mp app family, WM API, theme bridge, PDF engine fix
- mpwm polish wave: terminal key focus, focus-history close order, pop-back-to-origin, occupied-workspace cycling, demo
- work: land the sources the last commits reference
- route: the assistant icon the committed UI references
- fast_inflate: the benches name their dev-deps
- gif/weezl: drop the vendored benches nobody can run
- weezl: the decode tests generate their own LZW fixture
Committed together: both streams landed in libs/game/script, so splitting
them would produce two commits that don't compile.
M6 — packaging and sharing
- libs/zip_file gains a writer (store + deflate); real `unzip -t` validates
our archives in an interop test. Packing is deterministic (fixed
timestamps, sorted entries), so a package can be addressed by its own
sha256 — which is what makes the registry's digest check mean anything
- libs/game/pkg: .arcade format (game.splash + manifest.toml + assets),
total manifest parsing (attacker bytes always yield a Manifest or an
error, never a panic; non-finite numbers refused rather than defaulted),
registry client that verifies sha256 INSIDE download so tampered bytes
never reach the extractor
- Hardened extraction: absolute paths, drive letters (C:x is absolute on
Windows), UNC, backslashes, .., NUL/control chars, symlink members (via
mode bits), duplicate names (the ambiguity IS the attack), declared-size
caps checked before decompressing plus a post-decompress check, entry/
total/archive caps, and a post-join re-check that the resolved parent is
still inside the destination — which catches a pre-existing symlink the
name test cannot see. 4000-round mutation fuzz with a canary file beside
the destination; a 320 MB deflate bomb under 1 MB on the wire is refused
- Capability stripping rebinds fs/run/net to FRESH EMPTY OBJECTS rather
than shadowing known verbs, so there is no hole the day someone adds one.
Applied before the game handle is registered. Vacuity guard: an unstripped
isolate genuinely reads a file, so the sandbox tests can't pass for
unrelated reasons. Browser-installed games load Trust::Downloaded
M7 — pretty pass
- GameSun adopts draw::SceneSun (axis-converted: SceneSun is map-space
y-south/z-up, games are y-up). Shaders compute hemisphere ambient +
direct instead of each hardcoding its own split; defaults collapse the
new formula to the old constants exactly, so unifying did not restyle
existing games. write_into is the single write path — "one sun" is
compiler-enforced
- Projected shadow geometry: the caster's silhouette along the sun, fitted
in the sun's own (u,v) frame, so it stretches as the sun swings. Nearest
N casters get projection, the rest blobs; one instance in the existing
alpha batch, no extra pass. 0.6us for 24 casters
- Two pre-existing shadow bugs found via capture: the pipeline blends
premultiplied, so unpremultiplied dark RGB ADDED light instead of
removing it; and shadows were fogged, mixing them toward the bright
horizon so a distant shadow came out lighter than the ground it darkened
- Particles are structurally isolated from the sim: GameWorld has no
particle field and step_world has no particle code — the renderer owns
simulation and its own RNG. particles_never_advance_the_world_rng
interleaves particle verbs with real rand() draws over 32 rounds and
asserts both the RNG state and the drawn stream are identical
- game.sfx_at with listener-relative gain/pan and a near-field ease so a
sound at your feet doesn't flip channels; 2D verbs unchanged
- apps/arcade/BUDGETS.md: measured particle/sim costs, Quest columns marked
as estimates (the real particle limit is fill rate, not CPU)
Tape probe BYTE_IDENTICAL. Not done: arcade has no audio backend, so
positional sound is implemented and tested but not audible there yet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
