Exclude TypeScript and JavaScript from Sonar coverage

The shared SonarCloud workflow only publishes the Rust lcov report, so TS/JS files can never appear covered and trip the 80% new-coverage gate.
api_clients: use tokio::fs inside async functions (Sonar S7493) (#2803 )
2026-11-10 16:06:47 -05:00 · 2026-11-10 20:48:52 +01:00 · 2026-11-10 18:53:57 +01:00 · 2026-11-10 18:36:03 +01:00 · 2026-11-10 16:45:35 +01:00 · 2026-11-10 11:32:48 +01:00
37 changed files with 281 additions and 170 deletions
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
      - uses: storytold/craft-common-actions/actions/install-apt-packages@main
        with:
          packages: rpm jq binutils zsync
@@ -34,7 +34,7 @@ jobs:
      TAURI_FRONTEND_PATH: ${{ github.workspace }}/frontend
      TAURI_APP_PATH: ${{ github.workspace }}/crates/desktop/artcraft
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
      - uses: storytold/craft-common-actions/actions/install-apt-packages@main
        with:
          packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libclang-dev libasound2-dev libxdo-dev libdbus-1-dev build-essential clang file jq perl cmake nasm rpm zsync gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-libav
@@ -63,7 +63,7 @@ jobs:
          PKG_CONFIG_LIBDIR_riscv64gc_unknown_linux_gnu=/usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
          ENV
          echo "CMAKE_TOOLCHAIN_FILE_riscv64gc_unknown_linux_gnu=$GITHUB_WORKSPACE/packaging/linux/riscv64.cmake" >> "$GITHUB_ENV"
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
        with:
          node-version: '22'
          cache: npm
@@ -89,7 +89,7 @@ jobs:
          ARCH: ${{ matrix.arch }}
          TARGET: ${{ matrix.target }}
        run: packaging/linux/package.sh "$ARCH" "$TARGET"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist/release/*
@@ -102,8 +102,8 @@ jobs:
      matrix:
        arch: [x86_64, aarch64]
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist/linux
@@ -126,7 +126,7 @@ jobs:
          for package in dist/release/*.pkg.tar.zst; do
            tar --zstd -xOf "$package" .PKGINFO | grep -Fx 'depend = webkit2gtk-4.1'
          done
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: release-arch-${{ matrix.arch }}
          path: dist/release/*.pkg.tar.zst
@@ -145,8 +145,8 @@ jobs:
          - {arch: x86_64, runner: ubuntu-24.04}
          - {arch: aarch64, runner: ubuntu-24.04-arm}
    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
        with:
          name: release-linux-${{ matrix.arch }}
          path: dist/linux
@@ -161,8 +161,10 @@ jobs:
      - name: Build Flatpak and publish OCI
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        run: packaging/linux/flatpak.sh
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
        with:
          name: release-flatpak-${{ matrix.arch }}
          path: |
@@ -175,7 +177,7 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
      - name: Read version
        id: version
        run: echo "value=$(jq -r .version crates/desktop/artcraft/tauri.conf.json)" >> "$GITHUB_OUTPUT"
@@ -189,6 +191,5 @@ jobs:
          app-title: ArtCraft
          tag-prefix: artcraft-v
          retain: "true"
-          allow-published: "true"
          github-token: ${{ secrets.GITHUB_TOKEN }}
          signing-key: ${{ secrets.LINUX_SIGNING_KEY }}
@@ -10,6 +10,13 @@ on:
 # This workflow creates Universal macOS builds with signing certificate support.
 # On each push to the release branches it will create or update a GitHub release, build your app, and upload the artifacts to the release.

+# One release build per branch at a time. A run in progress is never cancelled, because it may
+# already have created or uploaded to the draft release. If more pushes arrive while one runs,
+# GitHub keeps only the newest as pending, so the next build is of the latest commit.
+concurrency:
+  group: macos-release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
  publish-artcraft:
    permissions:
@@ -28,11 +35,13 @@ jobs:
          #   args: ''

    runs-on: ${{ matrix.platform }}
+    # Successful builds took 10-22 min (2026-04 to 2026-11).
+    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7

      - name: setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
          node-version: lts/*

@@ -10,6 +10,13 @@ on:
 # This workflow creates Windows builds.
 # On each push to the release branches it will create or update a GitHub release, build your app, and upload the artifacts to the release.

+# One release build per branch at a time. A run in progress is never cancelled, because it may
+# already have created or uploaded to the draft release. If more pushes arrive while one runs,
+# GitHub keeps only the newest as pending, so the next build is of the latest commit.
+concurrency:
+  group: windows-release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
  publish-artcraft-windows:
    permissions:
@@ -23,8 +30,10 @@ jobs:
            args: ''

    runs-on: ${{ matrix.platform }}
+    # Successful builds took 17-36 min (2026-04 to 2026-11); one hung run used the full 6-hour default.
+    timeout-minutes: 90
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
@@ -39,7 +48,7 @@ jobs:
        shell: cmd

      - name: setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
        with:
          node-version: lts/*

@@ -21,9 +21,4 @@ jobs:
  freebsd:
    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
    uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
-    with:
-      architectures: '["x86_64"]'
-      craft-fonts-ref: ""
-      cargo-build-extra-args: "--exclude artcraft --exclude artcraft_native --exclude tauri-plugin-http"
-      cargo-test-extra-args: "--exclude artcraft --exclude artcraft_native --exclude tauri-plugin-http"

@@ -553,6 +553,28 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "175571dd1d178ced59193a6fc02dde1b972eb0bc56c892cde9beeceac5bf0f6b"

+[[package]]
+name = "ashpd"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f3f79755c74fd155000314eb349864caa787c6592eace6c6882dad873d9c39"
+dependencies = [
+ "async-fs",
+ "async-net",
+ "enumflags2",
+ "futures-channel",
+ "futures-util",
+ "rand 0.9.2",
+ "raw-window-handle",
+ "serde",
+ "serde_repr",
+ "url",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "zbus",
+]
+
 [[package]]
 name = "assertor"
 version = "0.0.3"
@@ -616,6 +638,17 @@ dependencies = [
 "slab",
 ]

+[[package]]
+name = "async-fs"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5"
+dependencies = [
+ "async-lock",
+ "blocking",
+ "futures-lite",
+]
+
 [[package]]
 name = "async-io"
 version = "2.6.0"
@@ -645,6 +678,17 @@ dependencies = [
 "pin-project-lite",
 ]

+[[package]]
+name = "async-net"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b948000fad4873c1c9339d60f2623323a0cfd3816e5181033c6a5cb68b2accf7"
+dependencies = [
+ "async-io",
+ "blocking",
+ "futures-lite",
+]
+
 [[package]]
 name = "async-process"
 version = "2.5.0"
@@ -6228,6 +6272,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "pollster"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f3a9f18d041e6d0e102a0a46750538147e5e8992d3b4873aaafee2520b00ce3"
+
 [[package]]
 name = "polycool"
 version = "0.4.0"
@@ -6938,6 +6988,7 @@ version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a15ad77d9e70a92437d8f74c35d99b4e4691128df018833e99f90bcd36152672"
 dependencies = [
+ "ashpd",
 "block2 0.6.2",
 "dispatch2",
 "glib-sys",
@@ -6949,7 +7000,9 @@ dependencies = [
 "objc2-app-kit 0.3.2",
 "objc2-core-foundation",
 "objc2-foundation 0.3.2",
+ "pollster",
 "raw-window-handle",
+ "urlencoding",
 "wasm-bindgen",
 "wasm-bindgen-futures",
 "web-sys",
@@ -11956,6 +12009,7 @@ dependencies = [
 "endi",
 "enumflags2",
 "serde",
+ "url",
 "winnow 1.0.0",
 "zcheapstr",
 "zvariant_derive",
@@ -2,6 +2,7 @@

 <p align="center">
  <a href="https://sonarcloud.io/project/overview?id=storytold_artcraft"><img alt="Scanned by SonarCloud" src="https://img.shields.io/badge/Scanned_by-SonarCloud-4b9fd5?style=flat-square&logo=sonarqubecloud&logoColor=white"></a>
+  <a href="https://coderabbit.ai"><img alt="Reviewed by CodeRabbit" src="https://img.shields.io/coderabbit/prs/github/storytold/artcraft?style=flat-square&label=Reviewed%20by%20CodeRabbit&logo=coderabbit"></a>
 </p>
 <p align="center"><strong>The IDE for artists.</strong></p>

@@ -33,6 +33,7 @@ chrono.workspace = true
 cookie.workspace = true
 log.workspace = true
 reqwest = { workspace = true, features = ["multipart", "gzip"] }
+tokio = { workspace = true, features = ["fs"] }
 url.workspace = true

 # Serialization
@@ -60,7 +60,7 @@ pub async fn legacy_upload_media_file_from_file<P: AsRef<Path>>(
      .build()
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;

-  let file_bytes = std::fs::read(args.path.as_ref())
+  let file_bytes = tokio::fs::read(args.path.as_ref()).await
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
  let file_name = args.path.as_ref().file_name()
      .and_then(|n| n.to_str()).unwrap_or("file").to_string();
@@ -69,7 +69,7 @@ pub async fn upload_image_media_file_from_file_with_idempotency_token<P: AsRef<P
      .build()
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;

-  let file_bytes = std::fs::read(args.path.as_ref())
+  let file_bytes = tokio::fs::read(args.path.as_ref()).await
      .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
  let file_name = args.path.as_ref().file_name()
      .and_then(|n| n.to_str()).unwrap_or("file").to_string();
@@ -35,7 +35,7 @@ pub async fn upload_new_engine_asset_from_file<P: AsRef<Path>>(
  let client = storyteller_client_builder(api_host)
      .build()?;

-  let file_bytes = std::fs::read(path.as_ref())?;
+  let file_bytes = tokio::fs::read(path.as_ref()).await?;
  let file_name = path.as_ref().file_name()
      .and_then(|n| n.to_str()).unwrap_or("file").to_string();
  let mut form = Form::new()
@@ -61,7 +61,7 @@ pub async fn upload_video_media_file_from_file<P: AsRef<Path>>(
  let client = storyteller_client_builder(args.api_host)
      .build()?;

-  let file_bytes = std::fs::read(args.path.as_ref())?;
+  let file_bytes = tokio::fs::read(args.path.as_ref()).await?;
  let file_name = args.path.as_ref().file_name()
      .and_then(|n| n.to_str()).unwrap_or("file").to_string();
  let mut form = Form::new()
@@ -1,5 +1,3 @@
-use std::fs;
-use std::io::Write;
 use std::path::{Path, PathBuf};

 use log::{info, warn};
@@ -68,13 +66,7 @@ pub async fn download_media_file<P: AsRef<Path>>(
  let bytes = download_bytes(cdn_url).await?;

  // 4. Write to disk.
-  let mut file = fs::File::create(&output_path)
-    .map_err(|err| StorytellerError::Client(ClientError::IoError(err)))?;
-
-  file.write_all(&bytes)
-    .map_err(|err| StorytellerError::Client(ClientError::IoError(err)))?;
-
-  file.flush()
+  tokio::fs::write(&output_path, &bytes).await
    .map_err(|err| StorytellerError::Client(ClientError::IoError(err)))?;

  info!("Downloaded {} bytes to {:?}", bytes.len(), output_path);
@@ -31,7 +31,7 @@ reqwest.workspace = true
 serde.workspace = true
 wreq.workspace = true
 serde_derive.workspace = true
-tokio.workspace = true
+tokio = { workspace = true, features = ["fs"] }
 uuid.workspace = true

 [dev-dependencies]
@@ -24,7 +24,7 @@ pub(crate) async fn upload_to_kinovi_web(
      .unwrap_or_else(|| "jpg".to_string());

  let file_bytes = match maybe_local_path {
-    Some(local_path) => match std::fs::read(local_path) {
+    Some(local_path) => match tokio::fs::read(local_path).await {
      Ok(bytes) => {
        info!("Reusing predownloaded file for kinovi upload: {}", source_url);
        bytes
@@ -93,7 +93,7 @@ impl MidjourneyCredentialManager {
    let _guard = self.mutation.lock().await;
    // Remove every format, so a later startup cannot migrate a logged-out account.
    for path in self.legacy_paths.iter().chain([&self.credential_path]) {
-      match std::fs::remove_file(path) {
+      match tokio::fs::remove_file(path).await {
        Ok(()) => {},
        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {},
        Err(err) => return Err(err.into()),
@@ -11,7 +11,7 @@ use errors::AnyhowResult;
 use log::{debug, error, warn};
 use serde_derive::{Deserialize, Serialize};
 use std::fmt::{Debug, Display};
-use std::{fs::File, io::Write, path::Path};
+use std::path::Path;
 use url::Url;
 use wreq::Client;

@@ -271,9 +271,7 @@ pub async fn get_image_gen_status(status_request: &StatusRequest, credentials: &

 pub async fn save_generations_to_dir(generations: &[Generation], dir: &str) -> AnyhowResult<()> {
  let dir = Path::new(dir);
-  if !dir.exists() {
-    std::fs::create_dir_all(dir)?;
-  }
+  tokio::fs::create_dir_all(dir).await?;
  for generation in generations {
    let response = wreq::get(generation.url.clone()).send().await?;
    let image_bytes = response.bytes().await?;
@@ -282,15 +280,13 @@ pub async fn save_generations_to_dir(generations: &[Generation], dir: &str) -> A
    let ext = url.path().split(".").last().unwrap_or("png");
    let path = Path::new(dir).join(format!("{}.{}", generation.id, ext));

-    let mut file = File::create(path)?;
-    file.write_all(&image_bytes)?;
+    tokio::fs::write(path, &image_bytes).await?;

    let thumbnail_url = generation.encodings.thumbnail.path.clone();
    let thumbnail_response = wreq::get(thumbnail_url).send().await?;
    let thumbnail_bytes = thumbnail_response.bytes().await?;
    let thumbnail_path = Path::new(dir).join(format!("{}_thumbnail.{}", generation.id, ext));
-    let mut thumbnail_file = File::create(thumbnail_path)?;
-    thumbnail_file.write_all(&thumbnail_bytes)?;
+    tokio::fs::write(thumbnail_path, &thumbnail_bytes).await?;
  }

  Ok(())
@@ -119,7 +119,7 @@ pub(super) async fn upload_midjourney_batch(maybe_app_handle: Option<&AppHandle>
    }
  }

-  if let Err(err) = std::fs::remove_file(MidjourneyUploadCheckpoint::path(app_data_root, local_task)) {
+  if let Err(err) = tokio::fs::remove_file(MidjourneyUploadCheckpoint::path(app_data_root, local_task)).await {
    log::warn!("Could not remove completed Midjourney upload checkpoint: {}", err);
  }
  Ok(())
@@ -2,8 +2,6 @@ use crate::core::state::data_dir::app_data_root::AppDataRoot;
 use crate::core::state::data_dir::trait_data_subdir::DataSubdir;
 use errors::AnyhowResult;
 use midjourney_client::utils::get_image_url::get_image_url;
-use std::fs::File;
-use std::io::Write;
 use std::path::PathBuf;
 use url::Url;
 use midjourney_client::utils::image_downloader_client::ImageDownloaderClient;
@@ -28,8 +26,7 @@ pub async fn download_midjourney_image(
  let download_filename = format!("{}_{}.{}", job_id, index, ext);
  let download_path = tempdir.join(download_filename);

-  let mut file = File::create(&download_path)?;
-  file.write_all(&image_bytes)?;
+  tokio::fs::write(&download_path, &image_bytes).await?;

  Ok(download_path)
 }
@@ -14,7 +14,7 @@ pub async fn initialize_sora_jwt_bearer_token(app_data_root: &AppDataRoot) -> An
    return Ok(()); // Bearer token already exists.
  }

-  let cookie = std::fs::read_to_string(app_data_root.get_sora_cookie_file_path())?
+  let cookie = tokio::fs::read_to_string(app_data_root.get_sora_cookie_file_path()).await?
      .trim()
      .to_string();

@@ -22,7 +22,7 @@ pub async fn initialize_sora_jwt_bearer_token(app_data_root: &AppDataRoot) -> An

  let bearer = generate_bearer_jwt_with_cookie(&cookie).await?;

-  std::fs::write(app_data_root.get_sora_bearer_token_file_path(), bearer)?;
+  tokio::fs::write(app_data_root.get_sora_bearer_token_file_path(), bearer).await?;

  Ok(())
 }
@@ -8,8 +8,7 @@ use openai_sora_client::creds::sora_jwt_bearer_token::SoraJwtBearerToken;
 use openai_sora_client::creds::sora_sentinel::SoraSentinel;
 use openai_sora_client::creds::sora_sentinel_token::SoraSentinelToken;
 use openai_sora_client::recipes::maybe_upgrade_or_renew_session::maybe_upgrade_or_renew_session;
-use std::fs::{read_to_string, OpenOptions};
-use std::io::Write;
+use tokio::fs::{read_to_string, write};

 pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDataRoot) -> AnyhowResult<SoraCredentialSet> {
  let cookie_file = app_data_root.get_sora_cookie_file_path();
@@ -21,7 +20,7 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
    return Err(anyhow!("Cookie file does not exist: {:?}", cookie_file));
  }

-  let value = read_to_string(cookie_file)?
+  let value = read_to_string(cookie_file).await?
      .trim()
      .to_string();

@@ -32,14 +31,14 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
  let mut sentinel_token = None;

  if bearer_file.exists() {
-    let value = read_to_string(&bearer_file)?
+    let value = read_to_string(&bearer_file).await?
        .trim()
        .to_string();
    bearer = Some(SoraJwtBearerToken::new(value)?);
  }

  if legacy_sentinel_file.exists() {
-    let value = read_to_string(&legacy_sentinel_file)?
+    let value = read_to_string(&legacy_sentinel_file).await?
        .trim()
        .to_string();

@@ -47,7 +46,7 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
  }

  if sentinel_token_file.exists() {
-    let value = read_to_string(&sentinel_token_file)?
+    let value = read_to_string(&sentinel_token_file).await?
        .trim()
        .to_string();

@@ -73,14 +72,7 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
      info!("Persisting bearer token value...");
      let value = bearer.token_str();

-      let mut file = OpenOptions::new()
-          .create(true)
-          .write(true)
-          .truncate(true)
-          .open(&bearer_file)?;
-
-      file.write_all(value.as_bytes())?;
-      file.flush()?;
+      write(&bearer_file, value.as_bytes()).await?;
    }
  }

@@ -89,14 +81,7 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
      info!("Persisting sentinel value...");
      let value = sentinel.get_sentinel();

-      let mut file = OpenOptions::new()
-          .create(true)
-          .write(true)
-          .truncate(true)
-          .open(&legacy_sentinel_file)?;
-
-      file.write_all(value.as_bytes())?;
-      file.flush()?;
+      write(&legacy_sentinel_file, value.as_bytes()).await?;
    }
  }
  
@@ -105,14 +90,7 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
      info!("Persisting sentinel token...");
      let value = sentinel_token.to_persistent_storage_json()?;

-      let mut file = OpenOptions::new()
-          .create(true)
-          .write(true)
-          .truncate(true)
-          .open(&sentinel_token_file)?;
-
-      file.write_all(value.as_bytes())?;
-      file.flush()?;
+      write(&sentinel_token_file, value.as_bytes()).await?;
    }
  }

@@ -162,14 +162,7 @@ impl SoraCredentialManager {

    self.holder.set_credentials(&creds)?;

-    let mut file = OpenOptions::new()
-        .create(true)
-        .write(true)
-        .truncate(true)
-        .open(self.app_data_root.get_sora_legacy_sentinel_file_path())?;
-
-    file.write_all(sentinel.as_bytes())?;
-    file.flush()?;
+    tokio::fs::write(self.app_data_root.get_sora_legacy_sentinel_file_path(), sentinel.as_bytes()).await?;

    Ok(creds)
  }
@@ -1,4 +1,4 @@

 /// The version of the ArtCraft desktop app reported in the UI and via Analytics.
 /// This should match the CI builds.
-pub const ARTCRAFT_VERSION: &str = "0.41.1";
+pub const ARTCRAFT_VERSION: &str = "0.42.0";
@@ -1,7 +1,7 @@
 {
  "$schema": "https://schema.tauri.app/config/2.0.0-rc",
  "productName": "ArtCraft",
-  "version": "0.41.1",
+  "version": "0.42.0",
  "identifier": "ai.artcraft.app",
  "build": {
    "frontendDist": "../../../frontend/apps/artcraft/dist",
@@ -1,7 +1,7 @@
 {
  "$schema": "https://schema.tauri.app/config/2.0.0-rc",
  "productName": "ArtCraft",
-  "version": "0.41.1",
+  "version": "0.42.0",
  "identifier": "ai.artcraft.app",
  "build": {
    "frontendDist": "../../../frontend/apps/artcraft/dist",
@@ -1,4 +1,3 @@
-
 /// When downloading a remote file, it makes sense to try to match the same file extension (with reasonable safeguards).
 #[deprecated(note = "Use `Extension` in `url_utils::extension::extension` instead")]
 #[derive(Debug, Copy, Clone, Eq, PartialEq)]
@@ -12,9 +12,7 @@ pub fn extract_download_extension_from_url_str(url: &str) -> Option<DownloadExte
 #[deprecated(note = "Use `extract_extension_from_url` in `url_utils::extension::extract_extension_from_url` instead")]
 pub fn extract_download_extension_from_url(url: &Url) -> Option<DownloadExtension> {
  let path = url.path();
-  let extension = std::path::Path::new(path)
-      .extension()
-      .and_then(|ext| ext.to_str())?;
+  let extension = std::path::Path::new(path).extension().and_then(|ext| ext.to_str())?;
  DownloadExtension::try_from_str(extension)
 }

@@ -26,14 +24,14 @@ mod tests {
  #[test]
  fn success_case() {
    let url = "https://storyteller.ai/example.jpg";
-    let maybe_extension= extract_download_extension_from_url_str(url);
+    let maybe_extension = extract_download_extension_from_url_str(url);
    assert_eq!(maybe_extension, Some(DownloadExtension::Jpg));
  }

  #[test]
  fn difficult_url() {
    let url = "https://videos.youtube.com/foo/bar/files/00000000-f19a-1275-a092-caa60b38f8d2%2Fraw?se=2025-11-21T22%3A26%3A53Z&sp=r&sv=2024-08-09&sr=b&skoid=8cfff87a-01fc-27c1-9091-32999dcd1389&sktid=aa8ccaf6-e6da-484e-ab11-9c7496c21c53&skt=2025-11-17T21%3A09%3A08Z&ske=2025-10-23T21%3A14%3A08Z&sks=b&skv=2024-08-04&sig=T2U6%2Brw9WJdJagBkCL4/GlFr72KhZGP3QPlobIO7JlU%3D&ac=oaisdsorprnorthcentralus";
-    let maybe_extension= extract_download_extension_from_url_str(url);
+    let maybe_extension = extract_download_extension_from_url_str(url);
    assert!(maybe_extension.is_none());
  }
 }
@@ -1,3 +1,4 @@
+#[expect(clippy::module_inception, reason = "Preserve the existing public module path")]
 mod download_extension;
 pub mod extract_download_extension_from_url;

@@ -1,5 +1,6 @@
 use std::borrow::Cow;
 use std::fmt;
+use std::hash::{Hash, Hasher};

 /// A file extension that can be either a compile-time constant or a runtime-parsed value.
 ///
@@ -16,7 +17,7 @@ use std::fmt;
 /// assert_eq!(ext.without_period(), "mp4");
 /// assert_eq!(ext.with_period(), ".mp4");
 /// ```
-#[derive(Clone, Eq, Hash)]
+#[derive(Clone, Eq)]
 pub struct Extension {
  /// The extension without the leading period, e.g. "png", "mp4".
  value: Cow<'static, str>,
@@ -34,20 +35,14 @@ impl Extension {
  /// const MP4: Extension = Extension::from_static("mp4", ".mp4");
  /// ```
  pub const fn from_static(ext: &'static str, dotted: &'static str) -> Self {
-    Self {
-      value: Cow::Borrowed(ext),
-      dotted: Cow::Borrowed(dotted),
-    }
+    Self { value: Cow::Borrowed(ext), dotted: Cow::Borrowed(dotted) }
  }

  /// Creates an `Extension` from a `&str` at runtime.
  /// The input must NOT include a leading period.
  pub fn new(ext: &str) -> Self {
-    let dotted = format!(".{}", ext);
-    Self {
-      value: Cow::Owned(ext.to_string()),
-      dotted: Cow::Owned(dotted),
-    }
+    let dotted = format!(".{ext}");
+    Self { value: Cow::Owned(ext.to_string()), dotted: Cow::Owned(dotted) }
  }

  /// Returns the extension without the leading period, e.g. `"png"`.
@@ -67,6 +62,12 @@ impl PartialEq for Extension {
  }
 }

+impl Hash for Extension {
+  fn hash<H: Hasher>(&self, state: &mut H) {
+    self.value.hash(state);
+  }
+}
+
 impl fmt::Debug for Extension {
  fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
    write!(f, "Extension(\"{}\")", self.value)
@@ -135,12 +136,28 @@ mod tests {

  #[test]
  fn display() {
-    assert_eq!(format!("{}", PNG), "png");
+    assert_eq!(format!("{PNG}"), "png");
    assert_eq!(format!("{}", Extension::new("xyz")), "xyz");
  }

  #[test]
  fn debug() {
-    assert_eq!(format!("{:?}", PNG), "Extension(\"png\")");
+    assert_eq!(format!("{PNG:?}"), "Extension(\"png\")");
+  }
+
+  #[test]
+  fn hash_matches_equality() {
+    let plain = Extension::from_static("png", ".png");
+    let inconsistent = Extension::from_static("png", ".not-a-suffix");
+    assert_eq!(plain, inconsistent);
+    assert_eq!(hash(&plain), hash(&inconsistent));
+  }
+
+  fn hash(extension: &Extension) -> u64 {
+    use std::collections::hash_map::DefaultHasher;
+
+    let mut hasher = DefaultHasher::new();
+    extension.hash(&mut hasher);
+    hasher.finish()
  }
 }
@@ -6,24 +6,13 @@ use url::Url;
 // TODO: Lookups against these as lists will be slow

 /// Known image extensions.
-const KNOWN_IMAGE_EXTENSIONS: &[Extension] = &[
-  Extension::from_static("png", ".png"),
-  Extension::from_static("jpg", ".jpg"),
-  Extension::from_static("jpeg", ".jpeg"),
-  Extension::from_static("webp", ".webp"),
-];
+const KNOWN_IMAGE_EXTENSIONS: &[Extension] = &[Extension::from_static("png", ".png"), Extension::from_static("jpg", ".jpg"), Extension::from_static("jpeg", ".jpeg"), Extension::from_static("webp", ".webp")];

 /// Known audio extensions.
-const KNOWN_AUDIO_EXTENSIONS: &[Extension] = &[
-  Extension::from_static("wav", ".wav"),
-  Extension::from_static("mp3", ".mp3"),
-];
+const KNOWN_AUDIO_EXTENSIONS: &[Extension] = &[Extension::from_static("wav", ".wav"), Extension::from_static("mp3", ".mp3")];

 /// Known video extensions.
-const KNOWN_VIDEO_EXTENSIONS: &[Extension] = &[
-  Extension::from_static("mp4", ".mp4"),
-  Extension::from_static("webm", ".webm"),
-];
+const KNOWN_VIDEO_EXTENSIONS: &[Extension] = &[Extension::from_static("mp4", ".mp4"), Extension::from_static("webm", ".webm")];

 /// Controls which extensions are accepted when extracting from a URL.
 pub enum ExtractExtensions {
@@ -62,9 +51,7 @@ pub fn extract_extension_from_url_str(url: &str, accept: &ExtractExtensions) ->
 /// Extracts a file extension from a parsed `Url`, filtered by `accept`.
 pub fn extract_extension_from_url(url: &Url, accept: &ExtractExtensions) -> Option<Extension> {
  let path = url.path();
-  let raw_ext = std::path::Path::new(path)
-    .extension()
-    .and_then(|ext| ext.to_str())?;
+  let raw_ext = std::path::Path::new(path).extension().and_then(|ext| ext.to_str())?;

  let lower = raw_ext.to_lowercase();
  let candidate = Extension::new(&lower);
@@ -72,27 +59,40 @@ pub fn extract_extension_from_url(url: &Url, accept: &ExtractExtensions) -> Opti
  match accept {
    ExtractExtensions::All => Some(candidate),
    ExtractExtensions::Set(set) => {
-      if set.contains(&candidate) { Some(candidate) } else { None }
-    }
-    ExtractExtensions::KnownImage => {
-      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate) { Some(candidate) } else { None }
-    }
-    ExtractExtensions::KnownAudio => {
-      if slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate) { Some(candidate) } else { None }
-    }
-    ExtractExtensions::KnownVideo => {
-      if slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate) { Some(candidate) } else { None }
-    }
-    ExtractExtensions::KnownMedia => {
-      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate)
-        || slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate)
-        || slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate)
-      {
+      if set.contains(&candidate) {
        Some(candidate)
      } else {
        None
      }
-    }
+    },
+    ExtractExtensions::KnownImage => {
+      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate) {
+        Some(candidate)
+      } else {
+        None
+      }
+    },
+    ExtractExtensions::KnownAudio => {
+      if slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate) {
+        Some(candidate)
+      } else {
+        None
+      }
+    },
+    ExtractExtensions::KnownVideo => {
+      if slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate) {
+        Some(candidate)
+      } else {
+        None
+      }
+    },
+    ExtractExtensions::KnownMedia => {
+      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate) || slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate) || slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate) {
+        Some(candidate)
+      } else {
+        None
+      }
+    },
  }
 }

@@ -190,19 +190,14 @@ mod tests {

  #[test]
  fn set_matches_custom_list() {
-    let accept = ExtractExtensions::from_vec(vec![
-      Extension::from_static("csv", ".csv"),
-      Extension::from_static("tsv", ".tsv"),
-    ]);
+    let accept = ExtractExtensions::from_vec(vec![Extension::from_static("csv", ".csv"), Extension::from_static("tsv", ".tsv")]);
    let ext = extract_extension_from_url_str("https://example.com/data.csv", &accept);
    assert_eq!(ext.unwrap().without_period(), "csv");
  }

  #[test]
  fn set_rejects_non_member() {
-    let accept = ExtractExtensions::from_vec(vec![
-      Extension::from_static("csv", ".csv"),
-    ]);
+    let accept = ExtractExtensions::from_vec(vec![Extension::from_static("csv", ".csv")]);
    let ext = extract_extension_from_url_str("https://example.com/data.png", &accept);
    assert!(ext.is_none());
  }
@@ -215,10 +210,7 @@ mod tests {

  #[test]
  fn query_params_ignored() {
-    let ext = extract_extension_from_url_str(
-      "https://example.com/file.mp4?token=abc&format=hd",
-      &ExtractExtensions::KnownVideo,
-    );
+    let ext = extract_extension_from_url_str("https://example.com/file.mp4?token=abc&format=hd", &ExtractExtensions::KnownVideo);
    assert_eq!(ext.unwrap().without_period(), "mp4");
  }

@@ -230,8 +222,7 @@ mod tests {
  }

  fn extract_extension_all(url: &str) -> Option<String> {
-    extract_extension_from_url_str(url, &ExtractExtensions::All)
-        .map(|ext| ext.without_period().to_string())
+    extract_extension_from_url_str(url, &ExtractExtensions::All).map(|ext| ext.without_period().to_string())
  }

  #[test]
@@ -1,2 +1,3 @@
+#[expect(clippy::module_inception, reason = "Preserve the existing public module path")]
 pub mod extension;
-pub mod extract_extension_from_url;
+pub mod extract_extension_from_url;
@@ -1,2 +1,3 @@
 pub mod extension;
-pub mod download_extension;
+#[expect(deprecated, reason = "Keep the public compatibility module while downstream users migrate to Extension")]
+pub mod download_extension;
@@ -13,9 +13,10 @@ existing `artcraft-v<version>` draft, retaining Windows and macOS assets. The ve
 Native AppImages also include zsync delta-update metadata.

 Flatpak uses native Ubuntu 24.04 runners and GNOME 51 for GTK3/WebKitGTK 4.1. Its build checks
-for missing ELF dependencies inside the sandbox. RISC-V packages require Ubuntu 24.04-era
-libraries; x86_64 and ARM64 use Ubuntu 22.04 as their build baseline. The suite does not publish
-RISC-V AppImages, Arch packages or Flatpaks.
+for missing ELF dependencies inside the sandbox, grants `--persist=Artcraft` so settings and task
+data survive restarts, and provides a launcher wrapper keeping WebKitGTK's accelerated rendering
+path enabled. RISC-V packages require Ubuntu 24.04-era libraries; x86_64 and ARM64 use Ubuntu 22.04
+as their build baseline. The suite does not publish RISC-V AppImages, Arch packages or Flatpaks.

 `package.sh <architecture> <rust-target>` normalizes Tauri's DEB/RPM/AppImage filenames and
 extracts the DEB's `/usr` tree into the suite's `bin/` and `share/` tarball layout. Shared Craft
@@ -2,13 +2,50 @@
 <component type="desktop-application">
  <id>ai.artcraft.app</id>
  <name>ArtCraft Studio</name>
-  <summary>Create AI images and video</summary>
+  <summary>Create images and video with AI</summary>
  <metadata_license>MIT</metadata_license>
  <project_license>MIT OR Apache-2.0</project_license>
-  <description><p>ArtCraft Studio is a desktop workspace for generating AI images and video with connected AI providers.</p></description>
-  <launchable type="desktop-id">ai.artcraft.app.desktop</launchable>
+  <developer id="ai.artcraft">
+    <name>ArtCraft</name>
+  </developer>
  <url type="homepage">https://getartcraft.com</url>
-  <developer id="ai.artcraft"><name>ArtCraft</name></developer>
-  <categories><category>Graphics</category><category>AudioVideo</category></categories>
-  <provides><binary>artcraft</binary></provides>
+  <url type="bugtracker">https://github.com/storytold/artcraft/issues</url>
+  <url type="vcs-browser">https://github.com/storytold/artcraft</url>
+  <url type="contact">https://discord.gg/artcraft</url>
+  <description>
+    <p>ArtCraft Studio is a creative desktop workspace for generating AI images and video with connected AI providers.</p>
+    <ul>
+      <li>Text-to-image and image-to-image creation with state-of-the-art models</li>
+      <li>Video generation and camera motion controls</li>
+      <li>Direct integration with Fal, Grok, Midjourney, Sora, and WorldLabs</li>
+      <li>Local task persistence with an embedded SQLite queue</li>
+    </ul>
+  </description>
+  <launchable type="desktop-id">ai.artcraft.app.desktop</launchable>
+  <categories>
+    <category>Graphics</category>
+    <category>AudioVideo</category>
+  </categories>
+  <keywords>
+    <keyword>ai</keyword>
+    <keyword>image</keyword>
+    <keyword>video</keyword>
+    <keyword>generation</keyword>
+    <keyword>art</keyword>
+  </keywords>
+  <branding>
+    <color type="primary" scheme_preference="light">#2f7bf5</color>
+    <color type="primary" scheme_preference="dark">#1a5bc4</color>
+  </branding>
+  <requires>
+    <display_length compare="ge">760</display_length>
+  </requires>
+  <supports>
+    <control>keyboard</control>
+    <control>pointing</control>
+  </supports>
+  <content_rating type="oars-1.1" />
+  <provides>
+    <binary>artcraft</binary>
+  </provides>
 </component>
@@ -0,0 +1,16 @@
+#!/bin/sh
+set -eu
+
+# ArtCraft Studio is a Tauri (WebKitGTK) desktop app.
+#
+# Keep WebKitGTK's accelerated path on, the opposite of the older recipe of
+# disabling the DMABUF renderer. On org.gnome.Platform//51 the unaccelerated
+# path draws this window wrong.
+#
+# ${VAR:-0} rather than plain assignment, so a user whose driver does need the
+# unaccelerated path can take it back:
+#   flatpak override --user --env=WEBKIT_DISABLE_DMABUF_RENDERER=1 ai.artcraft.app
+export WEBKIT_DISABLE_DMABUF_RENDERER="${WEBKIT_DISABLE_DMABUF_RENDERER:-0}"
+export WEBKIT_DISABLE_COMPOSITING_MODE="${WEBKIT_DISABLE_COMPOSITING_MODE:-0}"
+
+exec /app/bin/artcraft.real "$@"
@@ -8,6 +8,7 @@ trap 'rm -rf "$work"' EXIT
 mkdir -p "$work/stage" dist/release
 tar -xzf "dist/linux/$base.tar.gz" --strip-components=1 -C "$work/stage"
 cp packaging/linux/flatpak.yml "$work/manifest.yml"
+cp packaging/linux/artcraft-wrapper "$work/artcraft-wrapper"
 flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
 sign=()
 keys=()
@@ -21,7 +22,7 @@ flatpak-builder --user --install-deps-from=flathub --disable-rofiles-fuse --forc
 # Fail on missing WebKitGTK or other runtime libraries rather than shipping an unloadable binary.
 # shellcheck disable=SC2016 # Expand these variables inside the Flatpak runtime shell.
 flatpak build --runtime "$work/build" sh -c '
-  dependencies=$(ldd /app/bin/artcraft) || exit 1
+  dependencies=$(ldd /app/bin/artcraft.real) || exit 1
  printf "%s\n" "$dependencies"
  case "$dependencies" in *"not found"*) exit 1 ;; esac
 '
@@ -37,4 +38,13 @@ if [[ -n "${SIGNING_FPR:-}" ]]; then
    skopeo copy --format oci --dest-creds "$creds" "oci:dist/release/$base-oci" "docker://$registry:stable-$arch"
  fi
  skopeo inspect --raw --creds "$creds" "docker://$registry:$version-$arch" >"dist/release/$base.oci-manifest.json"
+
+  if [[ -n "${DOCKERHUB_USERNAME:-}" && -n "${DOCKERHUB_TOKEN:-}" ]]; then
+    dh_registry="docker.io/storytold/${GITHUB_REPOSITORY##*/}"
+    dh_creds="$DOCKERHUB_USERNAME:$DOCKERHUB_TOKEN"
+    skopeo copy --format oci --dest-creds "$dh_creds" "oci:dist/release/$base-oci" "docker://$dh_registry:$version-$arch"
+    if [[ "$version" != *-* && ( "$GITHUB_REF" == refs/heads/release || "$GITHUB_REF" == refs/heads/artcraft-release ) ]]; then
+      skopeo copy --format oci --dest-creds "$dh_creds" "oci:dist/release/$base-oci" "docker://$dh_registry:stable-$arch"
+    fi
+  fi
 fi
@@ -13,6 +13,9 @@ finish-args:
  - --filesystem=xdg-pictures
  - --filesystem=xdg-videos
  - --filesystem=xdg-download
+  # The app hardcodes its data to ~/Artcraft (settings, credentials, state).
+  # Persist it under ~/.var/app/ai.artcraft.app/Artcraft so data survives exits.
+  - --persist=Artcraft
 modules:
  - name: artcraft
    buildsystem: simple
@@ -20,6 +23,10 @@ modules:
      - cp -a . /app/
      - install -Dm644 /app/share/icons/hicolor/128x128/apps/artcraft.png /app/share/icons/hicolor/128x128/apps/ai.artcraft.app.png
      - sed -i 's/^Icon=.*/Icon=ai.artcraft.app/' /app/share/applications/ai.artcraft.app.desktop
+      - mv /app/bin/artcraft /app/bin/artcraft.real
+      - install -Dm755 artcraft-wrapper /app/bin/artcraft
    sources:
      - type: dir
        path: stage
+      - type: file
+        path: artcraft-wrapper
@@ -1,2 +1,8 @@
 sonar.projectKey=storytold_artcraft
 sonar.organization=storytold
+
+# CI only publishes the Rust lcov report, so TypeScript and JavaScript never
+# appear covered. Same idea as anicraft excluding JS/PowerShell/Python, and
+# as filmcraft and lightcraft excluding tools/docs/examples.
+sonar.coverage.exclusions=**/*.ts,**/*.tsx,**/*.js,**/*.jsx
+