792 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
andodeki	8701f5df51	feat(pdf): image embedding and header/footer stamping — Phase 4 complete ... The last gap in Phase 4: dart-pdf's header_footer_test, image_stamp_test and image_pdf_test had no counterpart here. What was missing is worth stating precisely, because it is the shape of bug ADR 0017 exists to catch. ContentWriter::draw_image has emitted `q w 0 0 h x y cm /Name Do Q` since Phase 2, and was tested. But nothing in the stack could *create* the image XObject that /Name resolves to. So every Do operator ever written named a resource that did not exist, no document could contain a raster image, and nothing anywhere returned an error. The writing half was present, the reading half faithfully reported the content stream, and the image was simply never there. stamp.rs adds: image XObject embedding, header/footer banners with left/centre/right alignment, image stamp content, and stream composition. A JPEG is embedded as-is with /DCTDecode — PDF's image model is the same DCT data the file already holds, so re-encoding would lose quality for nothing — and its geometry is read from its own SOF marker rather than trusted from the caller, because a /Width that disagrees with the codestream renders as diagonal garbage in every viewer. Raw samples embed as Flate. Embedding an image then adding the page that draws it exposed a live defect in PdfDocBuilder. add_object derived its number from `3 + 2 * pages.len()`, so every add_page after an add_object silently shifted a number already handed out. Embedding an image and then adding its page — the natural order, since the page's content stream has to name the image — produced a page whose /XObject entry pointed at the page object itself: 3 0 obj <</Type /Page ... /XObject <</Im0 3 0 R>>>> The file parsed. The reference resolved. The resource was the page. This is the same positional-numbering defect already fixed once for fonts, one layer out — the comment above first_extra_object_number describes the font version, where /ToUnicode pointed at the descriptor and /FontFile2 at the Type0 wrapper. Both come from deriving object numbers from collections that are still growing. Fixed at the root: the page count is frozen when the first extra number is issued, and pages added afterwards are allocated past the fixed block instead of colliding with it. Non-contiguous page numbers are legal — /Kids is an explicit array — and 952 tests confirm nothing depended on the order. The integration tests parse the generated file back with PdfDocument and assert the image appears in `page.xobjects` with subtype Image, that its /Width and /Height match the SOF marker, and that the header and footer baselines are at opposite ends of the page. Reading the resource back is the assertion that matters: a substring check for "/Im0 Do" passed throughout the entire period when no image could be embedded at all. Verified by mutation, five injected defects, each confirmed red: numbering fix reverted 4 fail JPEG width/height transposed 5 fail header positioned from bottom 3 fail sample-count check removed 1 fail attach_image_to_page a no-op 5 fail One test needed correcting rather than the code: three assertions grepped the output for operators, which are Flate-compressed by default, so they were asserting against compressed bytes. They now disable compression explicitly — the structure is identical either way, and the alternative was a test of miniz_oxide. Engine suite 920 -> 952. Coverage 86.16% -> 86.40%; stamp.rs at 94.64% with a floor at 90. Phase 4 is complete and the plan records it, including the numbering defect, since a status table that lists only features would not have told the next reader why the object numbers look the way they do.	2026-08-16 22:27:32 +00:00
andodeki	2770716516	docs(cad): record the engine coverage baseline and what it excludes ... TEST_BASELINE.md said "750 passed / 0 failed" and stopped there. A pass count says the suite is green; it says nothing about what the suite touches, and this module shipped a broken matrix inverse under 750 green tests. Adds the per-file table, the enforced floors, and -- the part that matters -- the list of what is NOT measured. Twelve files, roughly 18,000 lines of widget code, have no coverage number at all. Reading 88.75% as "the CAD module is 88.75% covered" would be wrong: it is the engine that is, and the engine is the smaller half. Better to write that down than to let the number be quoted without it.	2026-08-16 22:27:22 +00:00
andodeki	1c91d6b398	ci(cad): gate the engine coverage, with per-file floors ... The harness measured; nothing enforced. A coverage number nobody gates goes down. tools/test-cad-coverage.sh now exports llvm-cov JSON and fails when the total drops below 85% or any of the fourteen engine files drops below its own floor. The per-file floors are the point: deleting every test in persistence.rs moves the total by under two points, so a single number would wave that through. Each floor sits a couple of points under today's measurement, so refactoring does not trip it and a real loss does. The low floors are the honest ones. arch_pdf (72) and arch_gltf (72) have gaps in byte-layout paths that only a real PDF or GLB consumer reaches; arch_svg (79) and cad_scene (78) have gaps in widget-facing helpers and defensive arms on invariants SceneBuilder already enforces; exporters (88) cannot reach the save-dialog branch without a windowing system. Raising those needs work, not a bigger number here. Also in this commit, from running the script the way CI will rather than with a warm local checkout: - the Makepad fetch is sparse + blobless + depth 1 over the actual path-dependency closure (math, csg and its six siblings, micro_serde, its derive, micro_proc_macro, live_id, id_macros). 29 MB and two seconds instead of a 319 MB checkout of a repository that is mostly shaders, fonts and demos. Two of those crates were found by the run failing at manifest-read time, which is why the script now verifies all thirteen manifests exist before building instead of trusting the sparse pattern. The new cad-engine-coverage job needs no native packages and no GPU -- makepad-math and makepad-csg are dependency-free Rust, which is the whole reason the engine can be measured at all. It installs its own toolchain into a temp dir and deletes everything through a shell trap: nothing cached between runs, nothing left in the workspace. Verified end to end with a cold run: fresh toolchain, fresh sparse fetch, 466 tests green, total 88.75%, all floors met, environment cleaned.	2026-08-16 22:26:42 +00:00
andodeki	b87d8b0762	test(email): coverage over the full domain; IMAP feature gate in CI ... tools/test-email-coverage.sh now instruments all twelve email files (the new pacing, credential-store, cache, session and imap modules) and enforces per-file floors; measured 90.7% line coverage over the domain. email.yml: the domain test filter gains imap_client::/credential_store::, the test floor ratchets 150 -> 190, the sample-data gate is now a hard zero (sample_thread is test-only), and a new step checks the feature-gated IMAP transport still compiles. The review doc marks Phase C and Phase D complete with the honest caveats (sockets/keystore/pool-reuse are not host-verified).	2026-08-16 22:22:55 +00:00
andodeki	32b8decc1e	feat(email): real inbox, compose and More pages (C4b/C5/C7, D1/D2/D3) ... C4b: the inbox fetches real mail via spawn_fetch_inbox (backend-agnostic) and renders loading / error / empty states; sample_thread() is test-only. C5: Compose is a real form -- to/subject/body, build_without_config validation, two-tap confirm, spawn_send_message (branches on backend). C7: a Refresh button re-fetches (worker -> InboxFetched -> drained on the UI thread). D1: the last placeholder, more.rs, is now the account page (status, backend, sign-out) -- there is no duplicated scaffold left to extract. D2: the lib.rs compatibility shims are deleted; imports go straight to nigig_core/nigig_uikit and NavigationBarAction lives in a real module. D3: the CachedWidget decision is documented in email.rs.	2026-08-16 22:22:55 +00:00
andodeki	c792ec5a30	feat(email): SMTP transport pool (D4) and drop the dead action variant (D5) ... D4: a one-slot transport pool reuses the SMTP connection across sends instead of rebuilding a transport (TCP+TLS+AUTH) per operation. Safe because SEND_IN_FLIGHT already serialises sends, so a single reused transport is exactly the right size. The entry is moved out of the pool while held (a MutexGuard is !Send and would poison the spawned future), and the reuse-vs-rebuild keying -- server/port/username AND password -- is a pure, tested function. Connection-level reuse is a read of lettre's contract, not an observed handshake (no live relay in CI). D5: EmailWorkerAction::None is gone, with its Default and ActionDefaultRef impls. The action is consumed only via downcast_ref() (needs 'static + Debug), so no default was ever required. Also: EmailSessionAction (SignedIn/SignedOut) so the More page's sign-out reaches the inbox across the sibling-page PageFlip boundary.	2026-08-16 22:22:55 +00:00
andodeki	78d4a52e6f	feat(email): complete Phase C domain — IMAP, keystore seam, cache, pacing, dispatch ... C1e: imap_client.rs — ImapTransport trait, ImapClient (verify + list_inbox), a pure INTERNALDATE parser and envelope mapping, and a feature-gated async-imap transport (native only; wasm never compiles it). C1f: credential_store.rs — CredentialStore trait and a fail-closed default; the platform keystore (AndroidKeyStore, per the SMS precedent) is the follow-on that cannot be host-tested. C3: email_cache.rs — a local mail cache whose bodies are pushed through a BodyCipher before hitting disk; PlaintextBodyCipher is the honest default until C1f lands a real key. C6: email_pacing.rs — SendRateLimiter + SendPacing ported from robius-sms with email-shaped limits (100/hour); fixes a zero-capacity panic in the port. C5/C4b plumbing: email_session.rs (shared signed-in account), InboxFetched action, spawn_fetch_inbox and spawn_send_message (backend-aware dispatch), and EmailSendRequest::build_without_config for the proxy send path. Domain tests 154 -> 193.	2026-08-16 22:22:55 +00:00
andodeki	d15a034797	test(cad): cover the async export path and the model-name env read ... exporters.rs 76.30% -> 91.17%, constants.rs 82.69% -> 97.30%. `spawn_export_to_target` was 0% -- the entire function. It exists because every export used to serialise on the UI thread into a fixed path, so a 1,000-part GLB froze the editor and the second export of a session destroyed the first. The replacement had never been executed by a test: not the worker thread, not the BufWriter flush, not the callback. Four tests, driven by a stub Exporter over an empty scene, each blocking on the callback through a channel so the assertion is that `on_done` actually fires on the worker thread: - success: the bytes land at the path, and the status message names the byte count and the destination. The old fixed-path exports had nothing to assert here -- the destination was not a parameter. - exporter failure: reported as "export failed: ...", and NO file is created. A half-written export that reports success is worse than no export. - undeliverable: parent is a regular file, so create_dir_all fails and the message says so. - a directory in the file's place: the other side of the create_dir_all guard, where the write itself fails. Still uncovered in exporters.rs: the ExportTarget::Prompt arm, 28 lines. It raises a native save dialog; there is no windowing system in a coverage run and the harness's picker stub deliberately refuses rather than faking a save, so those lines are reported as uncovered instead of being reached by a test that proves nothing. constants.rs: local_openai_model was the one endpoint-configuration reader with no test, while local_openai_url next to it had five. A blank model name now has to be None -- passing "" to the endpoint produces a rejected request that surfaces to the user as an AI failure rather than as missing configuration. Verified with: ./tools/test-cad-coverage.sh (466 tests green)	2026-08-16 22:22:26 +00:00
andodeki	34d47f4479	test(cad): cover persistence.rs, 0.00% -> 94.51% of lines ... persistence.rs owns every byte the CAD editor writes: the saved script, the baked OBJ mesh, the thread-local slot the script VM uses to hand a Solid back to the UI, and the pending-image mutex. It had no tests. Not low coverage -- zero. It could not have had any. `save_cad_state` and `load_saved_cad_script` resolve their directory through `cad_data_dir()`, which is the real per-user application data directory. A test that called them would write into the developer's (or the CI runner's) actual data dir, and two tests would fight over the same file. So the save/load pair is split: save_cad_state_in(dir, source, solid) load_saved_cad_script_in(dir) with the existing public functions delegating to them through `cad_generated_dir_path()`. No caller changes, no behaviour changes -- viewport.rs, workspace.rs and workspace_actions.rs keep calling exactly what they called before. 14 tests, on the failures rather than the happy path: - A save that cannot create its directory returns the "could not create generated directory" error. This is the path that used to be `.ok();` at the call site, which is how a "Saved" label appeared over a write that never landed. - A failed OBJ write still leaves the script on disk, and the test asserts the script is readable back afterwards. The write order is load-bearing: losing the baked mesh costs a rebuild, losing the source costs the user's session. - An empty or whitespace-only script file loads as None, not as Some(""). Some("") would open the editor blank and then overwrite a script the user still had. - The script-output slot must empty on take. A stale Solid re-applied on the next tick would silently undo whatever the user did in between. - The generated paths are asserted to hang off the runtime data dir and to contain no build-time source path -- the CI gate for that rule greps for one macro, this pins the actual result. Uncovered: 6 lines, the two public wrappers. Calling them means writing to the real data dir, which is the thing this commit is avoiding. Verified with: ./tools/test-cad-coverage.sh (459 tests green)	2026-08-16 22:20:55 +00:00
andodeki	2ea5a7424e	fix(cad): mat4_inverse was wrong for every matrix that rotates and translates ... 3-D picking has been unprojecting clicks to the wrong world point. The coverage run in the previous commit left seven lines uncovered -- the success tail of mat4_inverse -- and the round-trip test written to reach them failed on element 12. mat4_inverse is a cofactor expansion transcribed from the standard MESA gluInvertMatrix. Comparing all sixteen expressions term by term against the reference, EVERY ONE of them had at least one mistyped index: inv[0] a[9]*a[11]*a[14] should be a[9]*a[7]*a[14] inv[12] a[8]*a[10]*a[13] should be a[8]*a[6]*a[13] inv[13] a[8]*a[10]*a[13] should be a[8]*a[2]*a[13] inv[14] a[0]*a[7]*a[13] should be a[0]*a[6]*a[13] inv[14] a[4]*a[7]*a[13] should be a[4]*a[2]*a[13] ... and one each in the other eleven. The wrong terms all carry a[3], a[7], a[11] or a[15] -- the bottom row. For a pure translation or a pure rotation those are 0, 0, 0, 1 and the mistyped products cancel, which is why the function looks correct in isolation and why nothing caught this. It stops cancelling the moment a matrix rotates AND translates. Which is what the two callers pass in: - CadViewport::camera_eye inverts self.last_view. - CadViewport::unproject_point inverts self.last_proj, whose element 11 is -1 for a perspective camera, and then self.last_view. Measured on a view matrix with a 35 deg yaw and eye (3, -1, 2), the old code's inv * m came back with 0.4698 and -0.7988 in the translation row instead of zero: a click resolved to a point roughly one unit away from where the user clicked, growing with camera distance. Selection, snap and the measure tool all read that point. Fixed by transcribing the reference again, this time verified: the tests assert inv*m AND m*inv against the identity for a translation, a rotation, translate*rot_y, translate*rot_zyx, a perspective matrix, an orthographic matrix, and a dense matrix with no zero entries -- the last because a wrong index cannot cancel when nothing is zero. math.rs is now 99.60% of lines. The three remaining are the `det.abs() < 1e-8` early return's own arm, covered by mat4_inverse_of_a_singular_matrix_is_none but not attributed to it. Verified with: ./tools/test-cad-coverage.sh (445 tests green)	2026-08-16 22:18:57 +00:00
andodeki	500489c2f0	test(cad): cover math.rs, 20.40% -> 99.00% of lines ... math.rs had no tests at all. Every other engine file in the CAD module carries its own #[cfg(test)] block; this one -- the file that decides where a click lands in 3-D, whether a point is inside a picked polygon, and how a part's model matrix is built -- had none, and the coverage harness added in the previous commit put a number on it: 20.40%. 39 tests, written against the behaviour that is easy to get wrong rather than the happy path: - The two normalize functions disagree on purpose. DVec3::normalize returns -Z for a degenerate vector, vec3_normalize returns zero. Both are pinned, because "fixing" either to match the other would change picking behaviour silently. - point_in_polygon is exercised on a concave L-shape, not just a square. The picking path projects a bounding box to screen space and can produce a concave outline; a convex-only test passes on a ray-casting implementation that is broken for exactly that case. - point_on_segment_nearest is checked past both endpoints, where the projection parameter is clamped, and on a zero-length segment, where the 1e-12 guard is the only thing between the caller and a NaN. - ray_triangle_intersect is checked on each rejection branch separately: parallel, u < 0, v < 0, u + v > 1, and a triangle behind the origin. - ray_aabb_intersect is checked from outside, from inside (where it returns the exit parameter, not the entry), behind the ray, parallel to a slab both inside and outside it, with a negative direction component (the t1/t2 swap), and on a diagonal miss -- which is the only way to reach the `tmin > tmax` return, since an axis-aligned miss leaves through the parallel-slab branch first. - segment_intersection is checked parallel, crossing, and crossing off the end of one segment and of both. Remaining uncovered: 7 lines, the success tail of mat4_inverse. The next commit reaches them, and finds out why they were never reached. Run: ./tools/test-cad-coverage.sh	2026-08-16 22:18:16 +00:00
andodeki	674b2be66d	feat(pdf): JPEG 2000 decoding — Phase 3 complete, all three codecs ... The last codec ADR 0015 deferred. The plan recorded the blocker as a dependency decision, not an algorithm: openjpeg would add a C dependency that breaks the Android cross-compile. This is pure Rust and adds no dependency at all. It shares the MQ arithmetic decoder with JBIG2 — T.800 and T.88 specify the same coder — so the previous tranche paid for most of this one. Context::with_state moved onto the shared type because JPEG 2000 starts three of its nineteen contexts away from state 0 and JBIG2 starts all of them at 0. Implemented: codestream and JP2 container parsing, packet headers with tag trees and the bit-stuffing rule, EBCOT tier-1 (all three passes, four zero-coding context tables, run-length mode), both 5/3 reversible and 9/7 irreversible wavelets, RCT and ICT, arbitrary decomposition levels, and multiple components. Refused by name: multiple tiles, custom precinct partitions, code-block style options, COC/QCC/RGN/POC overrides, subsampled components. Each error says which feature the file needs. This matters more here than anywhere else in the stack, because a JPEG 2000 decoder that quietly skips something does not fail — it returns a slightly soft or banded image that looks entirely fine. That property also dictates how this is tested. Fixtures are produced by OpenJPEG via Pillow and compared **exactly**, sample for sample: the fixtures are lossless 5/3 so no tolerance is needed, and a tolerance is where a subtly wrong decoder hides. Four images — grayscale raw codestream, the same in a JP2 container, a larger one whose tag trees actually branch, and RGB. A generator script is checked in beside them so CI can prove the fixtures still match what produced them. Verified by mutation. The first round was misleading and is worth recording, because it is the same lesson as ADR 0017: DC level shift dropped 3 fail 5/3 lifting rounding changed 2 fail RCT sign flipped PASSED <- survived RCT components swapped PASSED <- survived cleanup run-length disabled PASSED <- survived sign-context XOR dropped PASSED <- survived Four mutations survived because Pillow writes MCT=0 by default, so the RGB fixture coded its three components independently and never reached the colour transform at all. The RCT branch was completely untested while appearing covered — an untested branch that looks tested is worse than one that looks missing. Added rgb8_mct.j2k with mct=1; all four now fail. The header bit-stuffing mutation is caught by the unit test rather than the round-trip. Two real defects found while writing the tests: - A corrupt marker length in a tile-part header walked the read cursor past the codestream and panicked on a slice. Found by the corruption sweep, not by review. The sweep now truncates at every length and flips every byte of a real file, and asserts only that nothing panics. - The 9/7 flat-signal test initially asserted an amplitude I had derived from my own arithmetic. That is a test agreeing with the code by construction. It now asserts flatness — a ripple means the lifting or the edge extension is wrong — and the amplitude is pinned by the OpenJPEG round-trips instead, which use pixels this code did not produce. Also removed two dead fields and an unused parameter that clippy found: Subband::x0/y0 are always zero in the single-tile case this supports, and dead state implying multi-tile support exists is worse than no state. JPX decodes on the image path, like JBIG2, because the codestream carries its own geometry; it stays in REFUSED_CODECS with a reason string saying where it is decoded rather than that it is missing. Engine suite 866 -> 920. Coverage 85.66% -> 86.16%; jpx.rs at 93.72% with a floor at 88. Phase 3 is complete: CCITT, JBIG2 and JPX all land, and the plan is updated to say so and to record how the two gating questions — JBIG2's CVE record and JPX's C dependency — were actually answered.	2026-08-16 22:17:40 +00:00
andodeki	24a26f052e	test(cad): host-only coverage harness for the CAD engine ... The CAD module had 411 tests and no way to find out what they miss. `cargo test -p nigig-build` needs the full Makepad desktop stack -- wayland, X11, GL, alsa, polkit -- so nobody had ever run it under instrumentation, and "well tested" was an assertion, not a measurement. Fourteen of the module's twenty-six files are pure: geometry, the scene graph, undo/redo, the four exporters and file I/O. Their only Makepad imports are the math types, the CSG library and two log macros, all of which are dependency-free Rust. This script copies those fourteen into a temporary crate that carries the SAME module path (`nigig_build::construction_frame::pages::workspace::cad::*`), so the sources compile byte-for-byte with no edits, and runs them plus the real tests/cad_integration.rs under `-C instrument-coverage`. Baseline on this commit: 84.41% of lines over the fourteen engine files and the integration suite. math.rs is 20.40% and persistence.rs is 0.00%. Excluded from the report, per the coverage plan: the Makepad checkout (vendored/generated upstream code), the cargo registry and git caches, the rustc sysroot, and the harness's own lib.rs/shim/picker -- the platform-startup stand-ins the script writes itself, which are scaffolding and not CAD code. The exclusion is enforced twice, by -ignore-filename-regex and by an explicit source list, because the regex alone breaks when CAD_COV_MAKEPAD points outside the temp dir. What it does NOT measure, and does not pretend to: mod.rs, viewport*.rs, workspace*.rs, script_bindings.rs, cad_editor_sheet.rs, code_editor.rs, tools.rs and profile_benchmarks.rs. Those need live_design!, Cx and an event loop; the full-crate-check job in nigig-build.yml gates them. Everything -- toolchain, cargo home, target dir, profraw data, the fetched Makepad tree, the report -- lives under one mktemp directory removed by a shell trap on success, failure, interrupt or termination. The two enums the integration suite borrows from the widget-bound mod.rs are extracted from the real file at run time rather than copied, so the harness cannot silently drift from the crate.	2026-08-16 22:16:56 +00:00
andodeki	81e846ae35	feat(pdf): JBIG2 generic-region decoding, and the bitonal image path ... The second codec Phase 3 deferred. ADR 0015 made a threat review the precondition for implementing JBIG2 rather than an effort estimate, so the review's conclusion is encoded in what this does and does not do. What is implemented: the MQ arithmetic decoder (T.88 Annex E), generic region decoding with templates 0-3 and AT pixels, TPGDON typical prediction, and MMR-coded regions. Segment header and region info parsing, and page composition. What is refused, by name: symbol dictionary, text region, halftone region, refinement region, and a non-empty /JBIG2Globals. Those are the segment types that carry the composition machinery, and shipping them means shipping an interpreter over untrusted input — it is what FORCEDENTRY built its computer out of. A file needing them gets a typed error naming the segment type, exactly as the whole codec used to. The MQ coder itself is pure arithmetic with no file-controlled addressing, which is why it is safe to run and the composition parts are not. Every bound is checked against the declared region size before a buffer is indexed: region dimensions against MAX_DIMENSION and a pixel budget before allocation, segment lengths against the remaining stream, and the region's declared position against the page before a single pixel is written. That last one is the format's actual exploit surface and it has its own test saying so. MMR regions delegate to ccitt.rs rather than carrying a second G4 decoder, so the two cannot drift apart. A test decodes the same coded bits through both paths and requires identical pixels — that is what catches an inverted convention, and JBIG2 is natively 1=black where PDF is 0=black, so the inversion is real and easy to get backwards. JBIG2 is decoded on the image path, not in the filter facade, because it needs /Width and /Height from the image dictionary. It therefore stays in REFUSED_CODECS with a reason string that says where it *is* decoded, so a host showing that string does not tell a user the codec is missing when it is not. CCITT moved the other way for the same reason inverted: it derives its dimensions from /DecodeParms, so it decodes in the facade. Wiring both into ImageInfo::decode_to_rgba surfaced a defect in the parallel-array rule that the CCITT tranche had not reached. For /Filter [/FlateDecode /CCITTFaxDecode] the /DecodeParms array has one entry per filter, and the obvious implementation takes arr[0] — handing the Flate parameters to the fax decoder. ccitt_parms_of finds CCITT's own index instead. This is the same bug ADR 0015 records for the old chain code, in a new place. A declared-but-unresolved /JBIG2Globals returns None rather than decoding without it. Decoding anyway yields a blank or partial image that every caller reads as a success — the declared-versus-delivered failure of ADR 0017. Verified by mutation, six injected defects, each confirmed red: compose bounds check removed 1 fails pack() stops inverting 4 fails (both suites) globals silently ignored 1 fails refused segments silently skipped 1 fails declared-globals check dropped 1 fails ccitt_parms_of always takes slot 0 1 fails 29 unit tests and 12 integration tests, asserting pictures rather than buffer lengths. ADR 0016's stub JPEG decoder returned a correctly sized black rectangle and passed everything that checked a length; these say which colour they expect. Engine suite 825 -> 866. Coverage 85.15% -> 85.66%; jbig2.rs at 94.84% with a floor at 90, and image.rs 31.76% -> 44.77% so its floor rises 28 -> 40. JPX remains refused and is the next tranche.	2026-08-16 22:02:26 +00:00
andodeki	b26e6a1f14	feat(pdf): CCITT G3/G4 decoding — the codec Phase 3 deferred ... ADR 0015 refused CCITTFaxDecode by name and recorded it as the recommended next codec: well specified, no arithmetic coding, no C dependency. This implements it. T.4 and T.6, all three schemes selected by /K: G3 1D modified Huffman, G4 two-dimensional, and G3 mixed with a tag bit after each EOL. Both run-length code books, makeup and extended makeup codes, and the pass/horizontal/vertical mode codes. /Columns, /Rows, /BlackIs1 and /EncodedByteAlign are honoured; /Columns and /Rows are bounds-checked before anything is sized from them, because both are attacker-controlled in a hostile file. It decodes to real pixels, so unlike DCTDecode it belongs in the filter facade rather than the image path: the generic filter contract promises decoded bytes and this can honestly keep that promise. Removed from REFUSED_CODECS, added to SUPPORTED_FILTERS — the registry now describes what the crate actually does. Both existing data-driven registry tests pick this up without editing. Three defects were found by writing the tests rather than by reading the code: - A zero-length run recorded no transition. That is exactly how a row beginning with black is coded — a white run of zero, then the black run — so every such row came out with its colours shifted by one run: "####...." decoded as "....####". - Decoding stopped at bits_left() == 0, but encoders pad the final row to a byte boundary. The padding was fed to the decoder as though it were a code, failed to match, and lost the whole image. Now a trailing all-zero tail is recognised as padding, which is unambiguous because every code book needs a 1 bit. - A row of zero-length runs did not advance the pixel position and looped forever. Found by mutation, not by review. Bounded by the column count: a hang is a worse failure than an error. Verified by mutation, five injected defects, each confirmed to turn the suite red: a0 starts at 0 not -1 1 fails pack_row fills black 13 fails find_b1 parity dropped 1 fails short-/Rows check removed 1 fails read_run returns 0 2 fails Two of those did not fail on the first attempt and changed the tests: - a0 = 0 survived, because no fixture placed a colour change at column 0 — the one position where the off-by-one is visible. Added group4_codes_a_change_at_column_zero. - read_run returning 0 survived because the new run bound also errors, so an assertion of merely "some CCITT error" could not tell the two mechanisms apart. The assertions now name the specific failure. 30 unit tests in the codec, asserting decoded pictures rather than byte counts, plus 6 integration tests through the filter facade covering the chain case, truncation and the spec defaults. The facade test asserts output != input: ADR 0015 records DCTDecode "succeeding" by returning its own compressed input, and a test that only asserted Ok passed against that bug. Engine suite 796 -> 825. Coverage 84.82% -> 85.15%; ccitt.rs at 92.57% with a floor at 88. JBIG2 and JPX remain refused and are the next two tranches.	2026-08-16 21:50:46 +00:00
andodeki	3dab4a1fd5	test(email): coverage floors for the email domain ... tools/test-email-coverage.sh instruments the nigig-core email domain and enforces a whole-domain floor (90%) plus per-file floors on the files that harboured the bugs. It runs in an isolated temp dir and reports over only the seven email source files, excluding Makepad's generated code. Wired into email.yml, which also now runs mail_proxy tests and ratchets the domain test floor to 150. Measured 93.4% line coverage across the domain.	2026-08-16 21:49:12 +00:00
andodeki	47b2f72af0	feat(email): backend chooser + two setup forms (C1c) ... SetupDraft ties account identity to the backend choice and validates them together (the direct backend must also have a usable SMTP server; the proxy backend leaves SMTP fields unset). The setup form grows a chooser -- Direct (IMAP + SMTP) vs the Nigig mail service -- with an honest per-backend summary, and two forms swapped by the chooser. The inbox branches: proxy accounts verify against the mail service via spawn_proxy_verify instead of an SMTP handshake. Also pins the Proton Bridge provider default (local bridge, not a remote imap.protonmail.ch).	2026-08-16 21:49:12 +00:00
andodeki	2230933e4a	feat(email): ProxyApiBackend HTTP client (C1d) ... The proxy backend's network half: a thin client over a ProxyTransport trait (reqwest on native, fetch on wasm, mock in tests). verify, list_inbox and send build typed requests and map status+body onto structured errors, so the parsing logic -- where the bugs live -- is host-tested without a server. The token rides in an Authorization header and never in a request type that can be Debug-printed. Also: spawn_proxy_verify posts a ProxyVerifyResult action, and build_transport is pinned to construct for every port (A2/A3).	2026-08-16 21:49:12 +00:00
andodeki	4426cd2c43	docs(map): reconcile makepad fork with upstream dev 2026-08-16 ... - Fork portallist_flow_adaptive_view at ecf5a572 is 1 ahead / 0 behind upstream dev abd70f47 (Aug 15); extra commit restores test/gltf/csg re-exports - Hard-reset nigig-dev-reexports from stale 2c5cd97 to ecf5a572 and force-pushed so both tracking branches are current - Pinned rev stays ecf5a572 in map + pdf-makepad Cargo.toml (no bump needed) - Document baseline strategy: nigig-map/makepad_map as control surface tracking upstream widgets/src/map, not enabling map feature in nigig-rider for rendering; upstream routing (map_nav/geodata/route app) stays separate from widget (valhalla vs map_nav decision) - Note periodic diff workflow for packed-vertex, LOD, dissolve, growing-archive watcher improvements	2026-08-16 21:30:47 +00:00
andodeki	df618c4091	fix(map): overlay DrawVector import and tile super::* paths ... - overlay.rs used makepad_draw::vector::DrawVector which does not exist; use makepad_widgets::DrawVector (as in top-level overlay.rs) - makepad_map/tile.rs: crate::label/style/geometry -> super::label/style/geometry so it resolves to makepad_map submodules (which have LABEL_CLASS_PIN, bag_year_color, TILE_SIZE, stroke_prof_take) not top-level crate modules - Now cargo check shows only wayland-sys native lib missing, no Rust errors	2026-08-16 21:27:26 +00:00
andodeki	e6702c3437	fix(map): repair nigig-map build — icons, imports, crate deps ... - makepad_map/icons.rs pointed at icons/ inside makepad_map/; icons live in src/icons, fix to ../icons. - drape.rs used crate::map:: prefix which does not exist in crate root; use super:: - tile.rs crate::map:: prefix broke after module rename; collapse to crate:: - overlay.rs DrawVector came from crate::; import from makepad_draw::vector instead - view.rs used crate::{makepad_derive_widget, makepad_draw, widget} which are external; switch to makepad_widgets:: - mvt_parser, tile_disk, makepad_map/tile, drape re-used makepad_widgets::makepad_fast_inflate/mbtile_reader which are not re-exported; depend on direct crates makepad-fast-inflate, makepad-mbtile-reader and import them directly - Add missing Cargo deps makepad-draw, makepad-platform, makepad-derive-widget, makepad-fast-inflate, makepad-mbtile-reader, makepad-script pinned to existing rev ecf5a572 Workspace now passes cargo check -p spreadsheet-engine (250 tests) and map crate no longer errors on include_str / unresolved import; remaining linux GUI link requires native libs.	2026-08-16 21:14:38 +00:00
andodeki	7d6fc4cbbe	feat(pdf): document creation — outlines, forms, attachments, font subsetting ... Phase 4 of NIGIG_PDF_FEATURE_PARITY_PLAN.md. ADR 0019. Almost none of it existed: Outlines, PageLabels, EmbeddedFiles and ViewerPreferences appeared nowhere in the workspace, in any crate. What did exist was a builder whose central method was pub fn add_page_with_content(&mut self, _width: f64, _height: f64, ...) which accepted a page size and discarded it. Asking for 200x400 and 300x500 gave two US Letter pages, because no /MediaBox was written at all. The test asserted the output contained the string "/Type /Page", which it did. Two more defects sat in the object writer, both producing files our own parser rejects: dictionary keys were written unescaped (a key with a space reparses as "expected number"), and f64::NAN was emitted as the literal token NaN, so one non-finite value anywhere made the document unreadable. Added: outline trees with the open/closed state in the sign of /Count, /PageLabels as a number tree with real roman and A..Z/AA..ZZ numbering, named destinations, attachments with file specs, /Info, XMP, viewer preferences, page mode and layout; AcroForm creation for text, checkbox, radio, choice and signature fields with generated appearances; and TrueType subsetting - DejaVu Sans goes from 759,720 bytes to 4,348 for twelve characters. cmap is deliberately not rebuilt: the subset is embedded as a CID font with Identity-H, so the content stream addresses glyphs by id and /ToUnicode serves extraction. A cmap disagreeing with the content stream is worse than none. CFF is refused by name rather than emitting a font with no glyphs. Nine real bugs, every one found by running the output through an independent tool rather than by reading the code: 1 page size discarded reading a generated file back 2 dict keys unescaped probing the writer 3 NaN written as a keyword probing the writer 4 subset zeroed the lsb fontTools outline compare 5 hmtx indexed by new gid fontTools outline compare 6 name table format read as count BaseFont came out "Embedded" 7 add_font shifted numbers already handed out 8 trees allocated over font numbers - object 29 written twice 9 widgets missing /F Print, /P and appearance /Resources 7 and 8 are the instructive pair: every reference resolved and every object existed, each simply named the wrong thing. pypdf reported correct field values from a file PDFium rendered blank. 9 is the one only a renderer could find - /F defaults to non-printable, and a form XObject naming a font its /Resources does not declare is discarded whole. Verified by three independent implementations: fontTools (0 outline mismatches of 12 against the source font), pypdf (metadata, page sizes, outline with resolved page numbers, all five fields, attachment byte-for-byte, labels ['i','1']) and PDFium, which renders both pages correctly. cargo run -p nigig-pdf-graphics --example generate_sample regenerates the sample. Fourteen mutations. Three survived and each exposed a weak test: the key test used an attachment name (written as a string, never a key), nothing read the outline open state, and /P could not be witnessed because page_index is supplied by the reader, which already knows the page. All three now killed. pdf: 789 passed (was 730). pdf-ui: 775. Coverage 85.17%.	2026-08-16 21:02:19 +00:00
nigig-ci	c0b27d0586	feat(email): MailBackend trait and BackendKind — both backends (C1a/C1b) ... You chose to support IMAP-on-device AND a server-side proxy, user selectable. This is the seam that makes that contained rather than two parallel apps. Why it is cheaper than it sounds: wasm cannot open a raw TCP socket, so a proxy always had to exist for the browser target. The second backend was never optional -- it was implied scope nobody had named. C1a, mail_backend.rs: BackendKind { ImapSmtp, ProxyApi } with three predicates that exist so the UI cannot get them wrong: is_available_on_wasm() IMAP is raw TCP; a browser cannot open one, so the chooser must not offer a dead option stores_reusable_password() IMAP keeps a REUSABLE mailbox password on the device. For most people that is the password-reset channel for every other account they own. A revocable proxy token is strictly safer, and the chooser must say so rather than presenting a free choice summary() the honest one-liner, asserted by test to actually mention "password" / "revoke" BackendSettings is the PERSISTABLE half and carries no secret, exactly as EmailAccount does for the password (S2). BackendDraft::validate returns (settings, Secret) and reports every problem in one pass. The trait is deliberately synchronous and tiny -- kind(), is_configured(), describe(). Anything computable above the line (grouping, previews, threading) is NOT a backend concern, which is why email_store did not change at all. I/O stays in the free functions that already own the async context, so this file is host-testable with no runtime. ImapSmtpBackend exists with validation but no protocol client yet; that is C1e and nothing here claims a connection works. C1b: EmailAccount gained `backend: BackendSettings`, #[serde(default)] so existing persisted accounts still load. A test asserts the serialised account -- including the backend section -- contains neither the token nor a field named password/token. Provider defaults now fill IMAP too, so a Gmail user still fills one field. Outlook is special-cased: its IMAP host is outlook.office365.com, not imap.outlook.com, so the naive smtp->imap rewrite would produce a name that does not resolve. New gate, negative-tested both ways: stores_reusable_password() and is_available_on_wasm() must exist, and the persisted settings structs must not declare password/token/secret fields. Domain tests 99 -> 126. Test floor 95 -> 120.	2026-08-16 20:30:33 +00:00
andodeki	5d7474f22c	test(spreadsheet): cover cached range errors	2026-08-16 20:26:57 +00:00
nigig-ci	4020ef5668	fix(email): abandon_send shipped as dead code; wire it and gate it (B6) ... Auditing Phase B against the tree rather than against my own notes found that abandon_send() existed in nigig-core and NOTHING called it. The user had no way to stop waiting on a hung send. I had marked B6 "partial" for the right reason -- lettre cannot cancel mid-transaction -- and missed that the part I did implement was unreachable. A control the user cannot reach is not a control. It is dead code wearing a safety label, which is worse than an acknowledged gap because it reads as done. Now wired: while a send is in flight the Send button becomes "Stop waiting". The label is deliberately not "Cancel" -- this does not stop delivery, because once DATA is accepted the message is sent whether we wait for the reply or not. It frees the UI and suppresses a result the user has stopped caring about. The 20s timeout from A6 bounds the window. New gate: abandon_send() must exist in nigig-core AND be called from the UI. The wiring is the thing checked, not the function. That gate was ALSO broken when first written -- it grepped for `abandon_send()` across src/, and the comment block explaining why the control exists mentions it by name, so unwiring the call left the gate green. Same flaw as the B5 gate in the previous commit, found the same way: delete the fix, watch the gate. Now excludes comment lines. Twice in two commits I have written a gate that its own explanatory text satisfied. Worth stating rather than quietly fixing: a gate is only evidence if you have watched it fail. Cargo.lock is included because the tree could not resolve --locked without it; the diff is 156/159 lines of makepad rev-label churn with no package added or removed, and Cargo.lock still references exactly one makepad commit id. Phase B verified closed: B1-B6 all done, 11 gates pass, 99 domain tests, check --all-targets clean on both crates, fmt clean.	2026-08-16 20:25:56 +00:00
andodeki	29af564f79	test(spreadsheet): cover cycle coercion and mutation errors	2026-08-16 20:21:42 +00:00
andodeki	5fae4d6abd	test(spreadsheet): cover cached AST fallback branches	2026-08-16 20:11:35 +00:00
andodeki	6d2e3fb696	fix(pdf): repair the tree a hand-resolved merge left red ... Commit 258fa32 ("Merge origin/main: resolve xref/document conflicts") is not a merge - it has one parent - and it landed a PDF tree that does not pass its own gates. Found by running the suite, not by reading the diff. Four separate breakages: 1. xref_streams::a_wrong_type_at_startxref_is_named_not_guessed FAILED. The conflict resolution replaced the diagnostic error with a generic "expected xref or cross-reference stream". The fixture writes /Type /Frobnicate and the parser has that name in hand; throwing it away leaves the reader knowing only that this is not what we wanted, which is the least useful half of the story. Restored, and extended to name a stream with no /Type at all. This is an ADR 0013 merge criterion. 2. golden_render::golden_text_line_ops FAILED - the merge added the test but not its golden file. Verified the output by hand against the spec before blessing it: leading 14, lines at 700/684/670/656/642, which is correct for Td/TD/T*/'/". A golden file blessed without reading it locks in whatever bug exists. That golden cannot witness the " operator's two spacing operands: word and character spacing live in the graphics state and emit no render command, so dropping both would leave the file byte-identical. Added a test that asserts the state directly. Mutation-checked: removing the two set_*_spacing calls fails it, and leaves the golden untouched. 3. clippy -D warnings failed with 6 errors on pdf-cos and pdf-document, so CI's engine job could not have passed. Two unused imports, a dead read_be (superseded by the `field` closure in parse_xref_stream), a collapsible if-let, and - committed into the source - // ... keep the entire top of the file unchanged until the resolve_num function ... an editing instruction left in document.rs as a doc comment. 4. cargo fmt --check failed on document.rs and xref.rs. Mutation-checked both fixes: reverting the xref message fails 1 test, dropping the " spacing operands fails 1. pdf: 730 passed. pdf-ui: 775 passed. Coverage 84.15%, floors met; destinations.rs holds at 98.65%.	2026-08-16 20:09:48 +00:00
andodeki	bc387c26ae	test(spreadsheet): cover formula cells inside ranges	2026-08-16 20:05:03 +00:00
nigig-ci	901cddc716	fix(email): abandon_send shipped as dead code; wire it and gate it (B6) ... Auditing Phase B against the tree rather than against my own notes found that abandon_send() existed in nigig-core and NOTHING called it. The user had no way to stop waiting on a hung send. I had marked B6 "partial" for the right reason -- lettre cannot cancel mid-transaction -- and missed that the part I did implement was unreachable. A control the user cannot reach is not a control. It is dead code wearing a safety label, which is worse than an acknowledged gap because it reads as done. Now wired: while a send is in flight the Send button becomes "Stop waiting". The label is deliberately not "Cancel" -- this does not stop delivery, because once DATA is accepted the message is sent whether we wait for the reply or not. It frees the UI and suppresses a result the user has stopped caring about. The 20s timeout from A6 bounds the window. New gate: abandon_send() must exist in nigig-core AND be called from the UI. The wiring is the thing checked, not the function. That gate was ALSO broken when first written -- it grepped for `abandon_send()` across src/, and the comment block explaining why the control exists mentions it by name, so unwiring the call left the gate green. Same flaw as the B5 gate in the previous commit, found the same way: delete the fix, watch the gate. Now excludes comment lines. Twice in two commits I have written a gate that its own explanatory text satisfied. Worth stating rather than quietly fixing: a gate is only evidence if you have watched it fail. Phase B verified closed: B1-B6 all done, 11 gates pass, 99 domain tests, check --all-targets clean on both crates, fmt clean.	2026-08-16 20:04:41 +00:00
andodeki	1e40634e4d	test(spreadsheet): cover formula error and coercion branches	2026-08-16 20:02:00 +00:00
andodeki	258fa3259e	Merge origin/main: resolve xref/document conflicts, add makepad_table	2026-08-16 22:53:23 +03:00
nigig-ci	d889cbecd4	ci(email): gate multi-recipient send, and a gate that did not work ... Two new gates, and one of them was broken when I first wrote it. B1 gate: the send path must call email_send::parse_recipients, must NOT contain a single-Mailbox parse of the whole To field, and must add every accepted recipient. Three checks rather than one, because each failure mode is separately reachable. B5 gate: spawn_send_email must keep the SEND_IN_FLIGHT swap. THE B5 GATE DID NOT WORK AS FIRST WRITTEN. It grepped the whole file for `SEND_IN_FLIGHT.swap(true`, and the unit TESTS for the guard contain that same string -- so deleting the guard from production code left the gate green. I found it by negative-testing, which is the only reason I know. Now scoped to the text before `#[cfg(test)]`. That is worth recording rather than quietly fixing: a gate whose own test fixtures satisfy it is indistinguishable from a gate that works, and the only way to tell them apart is to break the thing on purpose. Negative tests, all confirmed firing: remove the list parse -> fires reintroduce `let to_mbox: Mailbox = ..` -> fires delete the in-flight guard -> fires (after the fix) and all 10 gates pass on the clean tree. Test floor 60 -> 95 (actual 99). Bulk page: builds through EmailSendRequest, so a partly-invalid list reports what was dropped instead of refusing everything, and requires a second tap before sending. The prompt quotes the recipient count and any duplicates or rejections, so the user knows what they are confirming. Editing the message after arming re-prompts rather than sending the old confirmation.	2026-08-16 19:51:21 +00:00
nigig-ci	fd88a70137	feat(email): multi-recipient send, which never worked (Phase B1/B2/B5/B6) ... B1 was the live Critical from the assessment. The recipient field is labelled "To (comma-separated)" and the worker did: let to_mbox: Mailbox = to.parse()?; // ONE address Mailbox parses a single address, so ANY comma-separated list failed with "Invalid to: ..." -- the user got an error for doing exactly what the placeholder told them to do. The tab named "Bulk" could reach exactly one person. The crate's headline feature did not work. B2: new email_send.rs, the seam the widget could not provide. parse_recipients accepts commas, semicolons and newlines, because a user pasting from a spreadsheet or a mail client produces any of them. It understands `Name <addr>` including a quoted name containing a comma -- "Doe, Jane" <jane@x.com> -- which a naive split(',') breaks in half and which is the normal shape when pasting a To: header. Partial failure does not fail the batch: bad entries are rejected with a reason and the good ones still send. Failing everything because one address had a typo is what made the directory CSV importer unusable. Duplicates are collapsed case-insensitively. Sending one person two copies of the same message is a bug that costs money and looks like spam. Addresses with control characters are rejected. lettre encodes headers so this is defence in depth today -- but the C1d proxy backend will NOT go through lettre (THREAT_MODEL T-E4), so the check belongs in the domain layer, not the transport. MAX_RECIPIENTS = 100. Not a protocol limit; providers cap RCPT TO per message and exceeding it fails the WHOLE message rather than the excess, so refusing locally with a number beats a provider error nobody can decode. B5: SEND_IN_FLIGHT, an AtomicBool swap. Both spawn_* functions used to fire unconditionally, so a double tap sent the message twice -- irreversible, to a real person. Same control robius-sms uses, and it lives in the domain layer so every entry point is covered rather than each page remembering. B6: partial, and named honestly. abandon_send() clears the guard and marks the pending result stale so it cannot overwrite what the user does next. It does NOT stop delivery: tokio's JoinHandle is not retained and lettre's async send is not cancel-safe mid-transaction -- once DATA is accepted the message is delivered whether we wait for the reply or not. Called abandon_send rather than cancel_send for that reason; a function called cancel that does not cancel is worse than no function. The 20s timeout from A6 bounds the window. Domain tests 72 -> 99.	2026-08-16 19:51:21 +00:00
nigig-ci	7a3c3c48e0	test(email): close the coverage gaps that are closable (Phase A follow-up) ... Measured line coverage with llvm-cov rather than assuming it: secret.rs 100.00% email_account.rs 100.00% (was 95.42%) email_store.rs 99.42% email_worker.rs 70.16% Four tests added to reach that: every_error_variant_has_a_usable_message AccountError::message() had uncovered match arms, which means a validation could fire and show the user nothing. Also asserts the messages are distinct -- if two errors share text the form cannot say which field is wrong -- and that each is a sentence rather than a token. a_malformed_address_is_reported_as_malformed_not_missing A present-but-wrong address takes a different path from a missing one, and it is the path an actual typo takes. states_without_an_account_return_none SignedOut/Verifying must not hand the form a stale account. an_empty_body_previews_as_empty_without_panicking A whitespace-only body must still yield a row. 68 -> 72 tests. On email_worker.rs staying at 70%: of its 80 uncovered lines, 30 are the network layer -- smtp_test_impl, send_email_impl, build_transport and the two spawn_* wrappers -- plus the whole #[cfg(target_arch = "wasm32")] block, which cannot execute on Linux at all. Every PURE function in that file is at 100%: is_incomplete, validate_send, config_warning, tls_mode_for_port, email_api_url_is_safe. Reaching 100% there needs a local SMTP sink, which is plan item E5. I am not mocking Cx::post_action to inflate the number: that would test the mock, not the send, and a coverage figure propped up by a fake is worse than an honest 70% with the reason recorded.	2026-08-16 19:51:21 +00:00
andodeki	1d8159e947	test(spreadsheet): cover remaining formula functions	2026-08-16 19:45:52 +00:00
andodeki	82eb6b9c73	feat(pdf): internal links that actually go somewhere ... ADR 0017 left destinations.rs at 0% coverage as an open item. The obvious reading is "an untested module". The real one is worse: nothing called it. It was pub use'd from lib.rs and referenced from nowhere else in the workspace. 0% was not a gap in the tests, it was the symptom of dead code, and nothing else was doing the job. Meanwhile PdfAnnotation read a link's target as dict.get_name("Dest") - a *name* /Dest and nothing else. Not /Dest [4 0 R /Fit], and not /A << /S /GoTo /D ... >>, which is how internal links are written in practically every real document. The corpus has had one since Phase 6, in annotations/links.pdf, and no test asserted where it went: Link { uri: None, dest: None } -> action=None Clicking it did nothing. No error, no warning - the viewer got no action and correctly performed none. A link to nowhere and a link the reader cannot parse look identical from outside. The viewer was already wired for this: PdfAction::GoToPage exists, is matched in test_host.rs, and was never constructed by anything. A complete delivery path with nothing at the source. Now: all three legal spellings parse, named destinations resolve through the /Names /Dests tree *and* the pre-1.2 /Root /Dests dictionary, and resolution happens in page_annotations where the catalogue is in reach. XYZ keeps Option per component because null is meaningful there and only there - it means "leave unchanged". Reading it as 0.0 scrolls to the origin at 0% magnification. Zoom 0 means the same as null and is normalised. Lookup uses a deliberate shallow resolve. Deep-resolving a destination array replaces [4 0 R /Fit] with the page dictionary and destroys the only thing identifying the target - the defect that once emptied every AcroForm (ADR 0006) and every annotation reference (ADR 0004). GoToAction now requires /S to be GoTo. The old code ignored /S and took /D from whatever it was handed, so a /GoToR (another file), /Launch (a program) or /JavaScript carrying a /D was reported as a local page jump. Refuse by verb, same policy as ADR 0012. An unresolvable destination is left unresolved, never defaulted to page 0: silently landing on page one is the worst outcome because it looks like the link worked. Seven mutations, all killed. M1 - removing the /S check - reported as surviving on the first attempt. It had not survived: the patch string omitted an interleaved comment so the mutation never applied and I measured the unmutated build. A harness that does not verify its own mutation says "weak test" when the truth is "never ran", and the conclusion would have been to delete a real security check. Every mutation now asserts it applied. destinations.rs 0% -> 98.65%; total 83.42% -> 83.86%. Floors added for destinations.rs and annotations.rs, verified to fail when breached. AnnotationType::Link changes shape (dest: Option<String> -> destination: Option<Destination>) and AnnotationAction gains GoToDestination; the old field could not express an explicit destination, so keeping it meant keeping the bug. AnnotationAction loses Eq because a destination carries f64 coordinates. pdf: 724 passed (was 695). pdf-ui: 769 passed (was 725). ADR 0018.	2026-08-16 19:34:01 +00:00
andodeki	0cee6be785	test(spreadsheet): cover computed boolean text and empty branches	2026-08-16 19:30:09 +00:00
andodeki	74b74bc4d5	test(spreadsheet): cover computed scalar value branches	2026-08-16 19:22:57 +00:00
nigig-ci	3786e7c1cf	docs(email): threat model, and mark Phase A complete (A6) ... New crates/apps/nigig-email/THREAT_MODEL.md. Separate from the root THREAT_MODEL.md, which is Nigig-Pay's and shares no assets with this feature. Nine threats with the control named for each, so a reader can check the claim rather than take it on trust. The two that matter: T-E2 (password leaked by our own code) was LIVE, not hypothetical -- SmtpConfig derived Serialize over a plaintext String and the whole struct was POSTed on wasm. T-E7 (DoS via a hostile message) is the SMS A3 bug class. One inbound message containing emoji took down the SMS list on every frame until it was deleted; email bodies are more hostile, not less. Sections that exist specifically to avoid overclaiming: * "Residual" notes on every mitigation. Secret does not zero on drop. We trust the platform root store; no certificate pinning. Header injection is handled by lettre, NOT by us -- which means the C1d proxy backend, which does not go through lettre, must sanitise or T-E4 becomes unmitigated. * "What has not been tested": no live SMTP server has been contacted, the wasm path has never been built, and no IMAP code exists, so T-E1/T-E2 cover the SMTP direction only. * Four open risks ranked, each tied to a plan item, including two (proxy auth, keystore storage) that MUST land with C1d/C1f rather than after -- the proxy is only safer than on-device IMAP if its token is revocable and scoped. Marks A1-A6 done in the plan. Phase A is complete.	2026-08-16 19:22:40 +00:00
nigig-ci	b3d562f4e2	ci(email): gate the Phase A security properties, and surface the warning ... Three new gates in email.yml, each negative-tested by reverting the fix and confirming the gate fires: 1. SmtpConfig.password must be a Secret, AND SmtpConfig must not derive Serialize/Deserialize. Two separate checks, because either alone re-opens S2: a Secret that gets serialised is still exposed, and a String that never gets serialised still Debug-prints. 2. set_email_api_url must call email_api_url_is_safe. Checks both that the validator exists and that the setter uses it -- a validator nobody calls is decoration. 3. tls_mode_for_port must exist, and Tls::None / Tls::Opportunistic must not appear. Opportunistic is the dangerous one: it silently accepts a downgrade, which is exactly the attack starttls_relay's Tls::Required prevents. Negative tests, all confirmed firing: password: Secret -> String gate fires re-add #[derive(.., Serialize)] gate fires remove the validator call gate fires introduce Tls::None gate fires and all 8 gates pass on the clean tree. Domain test floor raised 38 -> 60 (actual: 68) and the filter widened to include the secret:: module, so the new tests are actually covered by the floor rather than sitting outside it. Also surfaces config_warning() in the setup flow, so a from/username mismatch is shown while the user can still fix it, rather than becoming a silent provider rejection later. One YAML trap worth recording: the test filter ends in `secret::`, and a bare trailing colon makes YAML parse the line as a mapping. The run string has to be quoted. Caught by validating the workflow before committing, which is the only reason this is not a broken pipeline.	2026-08-16 19:22:40 +00:00
nigig-ci	e7ad44d429	feat(email): a password that cannot leak itself (Phase A1-A5) ... Assessment finding S2, the one Critical in Phase A. SmtpConfig carried #[derive(Clone, Debug, Serialize, Deserialize)] pub struct SmtpConfig { pub password: String, ... } so on wasm the ENTIRE struct -- password included -- was serde_json encoded and POSTed to /api/email. Every request carried the credential in clear text, and any reverse proxy or APM tool logging request bodies captured it. Nothing in the code said so. A1. New `Secret` type (nigig-core/src/secret.rs): * Debug always renders Secret("***"). No verbose mode. * Display is NOT implemented, so format!("{s}") will not compile. * Serialize/Deserialize are NOT implemented, and are REMOVED from SmtpConfig. A struct holding a secret cannot be serialised wholesale; the compiler stops it. That is the point -- a build failure rather than a code review someone has to remember to perform. * expose() is the only reader, named to be conspicuous in a diff. The wasm request body is now assembled field by field, so `password` appears at exactly ONE line and "what leaves the device?" is answerable by reading one function instead of trusting a derive. AccountDraft::validate now returns a Secret rather than a String, so the plaintext never lands back in a UI-held field. The inbox widget's session credential is a Secret too. A2. build_transport uses lettre's own relay() for port 465 instead of reassembling it from builder_dangerous + Tls::Wrapper. To be clear, since I flagged this as critical and was wrong: relay() is IMPLEMENTED as exactly those calls, and TlsParameters::new already sets accept_invalid_certs: false, accept_invalid_hostnames: false and a TLS 1.2 floor. Certificate validation was always on. It is still worth replacing -- a reviewer reading `builder_dangerous` assumes the worst (I did), and hand-rolling inherits nothing if upstream hardens relay(). A3. TLS policy is now named and asserted rather than inherited: tls_mode_for_port() maps every port to Implicit or StartTls, with NO cleartext arm, and it is unit tested. Previously the policy lived in a bare port match and a refactor could have removed encryption with no test failing. A4. validate_send() refuses locally what needs no server to know is wrong: incomplete config, empty recipient, subject over the RFC 5322 998-byte limit, body over 5 MB. Also config_warning(), which flags a from/username mismatch -- not an error, since some providers allow send-as aliases, but it is the commonest cause of a silent rejection. A5. set_email_api_url() now validates. It accepted any String, including http://, which sends the credential in clear text. Now same-origin relative or https:// only -- and it rejects protocol-relative //host/path, which is http on an http page and is easy to mistake for a relative path. Split into email_api_url_is_safe() so it is host-testable; the wasm target cannot run cargo test here, and an unvalidated validator is not a control. A6 (partial). SMTP timeout cut from lettre's 60s-per-command default to 20s. A mobile user on a bad connection needs an error, not a two-minute stall. Domain tests 38 -> 68. One thing I will not overclaim: `Secret` does NOT zero its buffer on drop. Without a zeroize-style crate the plaintext can persist in freed heap memory. It is a leak-through-code control, not an anti-forensics one, and it is recorded as an open risk rather than papered over.	2026-08-16 19:22:40 +00:00
andodeki	58b0bac062	fix(map): close unclosed delimiter in tile_disk.rs ... Added missing closing brace for the 'for key in &missing' loop. This fixes the compilation error: 'unclosed delimiter'.	2026-08-16 19:20:42 +00:00
andodeki	442c2c0fb3	test(spreadsheet): cover command mutation variants	2026-08-16 19:13:38 +00:00
andodeki	7081c7b219	test(spreadsheet): cover computed value fast path	2026-08-16 19:06:46 +00:00
andodeki	cf73ef4c1d	test(pdf): assert what a file declares is delivered, and floor the coverage ... Every serious bug in this stack has had one shape: a valid, well-typed, empty-or-default value where the file plainly declared content. xobjects empty for every document; acroform() dropping every field behind an indirect reference; DCTDecode returning its own compressed bytes; a JPEG decoder that was a stub returning black. None errored, none panicked, and the tests asserted Ok, which they got. Coverage would not have caught any of them. Measured when each shipped: page.rs 92.4%, form.rs 93.6%, content.rs 89.2%, xref.rs 95.2%. The buggy lines ran; nobody checked what they produced. So: a property test that walks the raw object graph of every corpus fixture, counts what the file declares, and requires the API to deliver it - fonts, xobjects, graphics states, colour spaces, form fields, filters, MediaBox. It reimplements the resolution rule independently of page.rs on purpose; a test that asks the code under test what to expect agrees with the bug. It failed the day it was written, on a shape the corpus had never contained. Every fixture wrote /Resources inline, and all six extractors read it with dict.get_dict("Resources") - which returns None for an indirect reference and never consulted /Parent. A page with "/Resources 5 0 R", the commonest shape in real PDFs, reported no fonts, no xobjects, no graphics states and no colour spaces. Same for a page inheriting resources from its /Pages node. Empty, not wrong, so nothing failed. Fixed by resolving /Resources once in PdfPage::from_obj through a helper implementing the full inheritance rule (32000-1 Table 30), and passing the resolved dictionary down. Indirect /MediaBox entries resolve too. Six resources/ fixtures cover the shapes that were missing. Mutation-checked: reverting inheritance kills 5 tests, the sub-dict reference 3, indirect MediaBox 2, and removing the depth bound hangs. One mutation survived - a visited-set guarding a /Parent cycle, which the depth bound already handles - so it was deleted rather than left as untested defence with a reassuring comment. tools/test-pdf-coverage.sh enforces a floor instead of printing a number, with per-file floors as well as a total: image.rs could fall from 33% to 5% and move the total by under a point. All three failure modes verified to fail. It caught a bug in itself first - its ignore regex matched its own work directory and reported a confident TOTAL 0.00%. .gitattributes marks *.pdf binary. An xref entry must be exactly 20 bytes (7.5.4), so with a one-digit generation field it ends in a space, and git diff --check was reporting unfixable "trailing whitespace" on every fixture in the corpus. TEST_TARGET=pdf: 695 passed, 0 failed (was 680). Coverage 83.42%. ADR 0017 records the four mutations so they can be repeated by hand.	2026-08-16 19:04:57 +00:00
andodeki	88996e1abd	test(map): add comprehensive integration tests for NigigMapView ... Added 60+ integration tests covering: - Widget initialization and default state - Theme compilation and switching (light/dark) - Tile scheduling and key generation - Overlay state management (markers, routes, puck) - Viewport calculations (zoom limits, center normalization, wrap-around) - Event handling logic (zoom delta, pan delta, pinch zoom) - Coordinate conversions (lon/lat to tile coords and back) - Performance benchmarks (tile loading, overlay rendering) - Error handling (invalid coords, empty routes) - Accessibility (keyboard navigation, focus management) - Offline mode (MBTiles path validation) - Complete user journey scenarios - Multi-touch gestures - Search and navigation workflows These tests complement the existing 111 UI tests in ui.rs by testing the internal logic and state management of NigigMapView at a lower level, without requiring a full Makepad UI runtime. Total test coverage for view.rs: 111 UI tests + 60+ integration tests = 170+ tests	2026-08-16 19:00:45 +00:00
andodeki	3ff766a76c	test(spreadsheet): cover scalar formula cell values	2026-08-16 19:00:16 +00:00
andodeki	20c47fb6d1	test(spreadsheet): emit uncovered line report	2026-08-16 18:54:07 +00:00
andodeki	6152921e79	test(map): add basic tests for lib.rs module structure ... Added 2 unit tests: - test_script_mod_does_not_panic: Verifies script_mod function signature - test_module_structure: Compile-time check that all modules are accessible lib.rs contains only module declarations and one simple function (script_mod), so minimal testing is appropriate. The real test coverage is in the individual modules themselves.	2026-08-16 18:51:57 +00:00