2 commits

Author	SHA1	Message	Date
Arena Agent	f20ba795c0	fix(cad): time-box script evaluation so a runaway cannot wedge the worker ... Phase 2.4, which I deferred during Phase 2 on a wrong assumption. An unterminated CAD script hung the evaluator permanently. vm.eval is a single blocking call, so `while true { s = s.translate(..) }` never returns: the rebuild worker blocks forever, every later edit queues behind it, and the UI sits on "Computing 3D model..." until the app is killed. The source is user- and AI-authored, and an LLM will emit a loop like that without much provocation. Reproduced before fixing. A probe test was still running at 60 seconds, and again at 90 with the budget removed. I deferred this originally saying it needed "a cooperative check inside the Makepad script VM or a watchdog that can kill and respawn the worker thread", and called it a VM design decision. That was wrong, and I should have read the VM before concluding it. makepad_script already provides ScriptRunBudget::from_durations(soft, hard, sample_interval), checked in run_core against a sampled Instant. The CAD module simply never set it. The fix is six lines in eval_cad_script_in_vm. PHASE2_STATUS.md now records the bad call rather than quietly marking the item done. Only the hard deadline is used. A soft hit sets TimeBudgetYield, which expects a host that drives the VM back to completion; there is no such driver here, so a soft deadline would present as a script that silently produced nothing at all. Soft is set equal to hard so the budget can only ever produce a real, reported error. The previous budget is saved and restored, so one evaluation cannot starve the next. 5 seconds, sampled every 4096 instructions. Generous deliberately: a real document is a few hundred CSG ops and finishes in milliseconds, so anything still running is a runaway rather than a slow model. Result: the same script now returns "script time budget exceeded" in 5.2s. Three tests. The runaway case is #[ignore]d because it burns the whole budget by design; the other two guard the ways a timeout typically breaks things -- that a normal script is unaffected across repeated evaluations (catching a budget that is not reset), and that a syntax error still reports itself rather than being misattributed to the timeout. CI gate added and negative-tested: losing the budget line reintroduces a hang that no test failure announces, only a frozen app. 617 lib + 154 integration, 0 failed.	2026-07-28 19:26:26 +00:00
Arena Agent	b5471e32e3	fix(cad): make the crate buildable, testable and safe to ship ... Phases 0-2 of CAD_ASSESSMENT_AND_PLAN.md. The crate did not compile and no test had ever run; it now builds clean with a green suite. Build and CI (Phase 0) - Pin all 33 git dependency manifests to an explicit rev. A branch dependency re-resolves on every build and is a code-execution path into CI if force-pushed. - Commit Cargo.lock (540 packages). Producing it required fixing three resolution failures the workspace had always had: a non-existent makepad-widgets feature, two rusqlite versions both linking sqlite3, and four missed CellId call sites in spreadsheet-ui. - Add .forgejo/workflows/nigig-build.yml. - Replace five stale CAD docs that contradicted the code with one ARCHITECTURE.md; add PHASE0/1/2_STATUS.md and TEST_BASELINE.md. Correctness (Phase 1) - Rotation units: transform_point bound sin_cos() backwards, transposed X and Z, and applied axes in reverse order, so every exported STL was wrong even at zero rotation. It now shares the renderer's matrix helpers. - GLB quaternions had norm 0.125 (half-angle applied to cos/sin, degrees read as radians) - invalid per the glTF spec. - PDF wall/door/window yaw fed degrees to cos/sin. - Fix a TOCTOU unwrap in touch picking; viewport.rs now has no unwrap(). - CommandContext gains update_node/insert_node_at/node_index: resize and modify were delete+create, silently moving nodes to the end of the scene. - Wire MAX_UNDO_LEVELS (defined, exported, never read) and switch the undo stack to VecDeque; this also made the existing drag-merge logic reachable. - CadNode::size() returned a fake 1x1x1 for CSG and extruded solids, making them unpickable outside a 1x1x1 box at their origin. - Reject non-finite script input; makepad_csg clamps NaN rather than propagating it, so bad input produced silently wrong geometry. Test baseline: 0 -> 722 passing, 0 failing - 17 pre-existing failures fixed: 10 real defects (dependency-cycle detection, over-allocation of unassigned tasks, quote/backslash corruption on save, default rooms lost for all but the first region, RGA text ordering) and 7 tests that were themselves wrong, each checked against its production caller first. Security (Phase 2) - env!("CARGO_MANIFEST_DIR") was used as a runtime path in three places, including as the AI agent's working directory. All runtime data now goes under app_data_dir(). - Remove the hardcoded LAN LLM endpoint. It is now opt-in via NIGIG_CAD_LOCAL_OPENAI_URL/_MODEL and refuses plaintext HTTP to anything but loopback. - Bound and content-sniff AI image attachments (8 MB cap, magic bytes); the MIME type came from the filename extension. - Escape SVG/HTML output, and add SRI to the exported viewer's script tag. The pinned model-viewer@3.5.1 does not exist, so every exported viewer was silently broken; now 4.0.0 with a verified hash. - Stop embedding $USER in exported PDFs and logging document content in release builds. - CI now rejects reintroducing the runtime-path and hardcoded-endpoint classes; both gates were verified to fail on a reintroduced defect. Add system_prompt.md and embed it with include_str!. The file was missing from the repository, so the agent silently used a one-line fallback.	2026-07-28 16:49:30 +00:00