shifathosn
/
photocraft
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
photocraft/book/src
History
skylar taylor-barrick 61b6276c78
Security: harden document exports and automation inputs (#2269) 
* chore: clear strict Clippy simplifications

* security: harden web exports and generated image assets

* security: reject redirected directory bundle writes

* security: quote paths in droplet shell launchers

* security: use private ephemeral print spool files

* security: bound automation file reads and MCP input

* security: bound MCP transport requests before dispatch

* chore: keep current sample checks Clippy clean

* security: preserve safe export roots and print semantics

* security: clear non-sending print state before replay

* security: forget print send overrides between jobs

* chore: keep macOS UI tests and Clippy clean

* Test web export paths portably on Windows
 		2026-10-11 23:18:52 -06:00
..
architecture AF.1: import bounded Affinity previews with fidelity warnings 2026-10-08 17:42:23 +02:00
automation docs: register the MCP server from an installed release (#2185) 2026-10-10 00:59:34 -04:00
development docs: add mdBook and security documentation foundation (#35) 2026-10-04 12:31:18 -04:00
formats TGA: targa options asks for 24 or 32 bits/pixel, same as in Photoshop (#2760) 2026-10-11 06:17:53 -04:00
getting-started fix(docs): Linux build prerequisites only name Debian packages (#2437) 2026-10-10 14:35:12 -04:00
project Progress docs: target-app parity, gaps, alpha gate, readiness by audience (#2696) 2026-10-10 15:09:04 -04:00
security Security: harden document exports and automation inputs (#2269) 2026-10-11 23:18:52 -06:00
README.md docs: add mdBook and security documentation foundation (#35) 2026-10-04 12:31:18 -04:00
SUMMARY.md Merge storytold/main into AF.3 native Affinity import 2026-10-09 04:26:18 +00:00

README.md

PhotoCraft Documentation

PhotoCraft is a native image editor written in Rust. This book is the maintained entry point for installation, architecture, formats, automation, development, and security documentation.

The repository's existing docs/ directory remains authoritative for detailed design notes, parity reports, UI conventions, release procedures, and the complete control-protocol method reference. The book links to those documents instead of copying them.

Start here

Documentation for coding agents

Coding agents should read the following in order:

  1. AGENTS.md for repository rules and verification gates.
  2. README.md for product scope and current entry points.
  3. book/src/architecture/ for crate boundaries and command flow.
  4. book/src/automation/ before driving the CLI, control protocol, or MCP server.
  5. book/src/security/ before changing a parser, file I/O, automation, MCP, the control server, command execution, or serialization/deserialization.

Agents must treat document bytes, paths, command parameters, and automation messages as untrusted input. A page that describes a proposed control does not mean that control is implemented.

Status language

Security pages use four labels consistently:

  • Implemented: behavior confirmed in current source or tests.
  • Known limitation: an exposed risk or missing control in current source.
  • Proposed: a design direction that is not enforced by the current build.
  • Future hardening: useful follow-up work without an accepted implementation yet.