v0.21.0

Fixed

• Stop the import sanitizer from rewriting the editor's own snapshots: undo, redo, transaction rollback, project open, and recovery restore now preserve multi-line text, text longer than 500 characters, and base64 image sources exactly

• Keep selection overlays out of PNG, JPEG, WebP, PDF, PSD, flatten, crop, and before/after captures; the tint no longer bakes into exported or flattened pixels at any zoom level

• Stop a second command started during an in-flight asynchronous command from rolling back the first command's work

• Keep the document marked unsaved when an edit lands while a project save is clearing recovery generations

• Confirm before replacing a document that has unsaved changes, from New Image, templates, Open Image, Open Project, Open PSD, drag and drop, and installed-app launches, with a Save first option

• Show the crash-recovery offer above the welcome launcher instead of behind it, so it is visible on the first run after a crash

• Stop the hosted offline shell from rolling back an update after a single unconfirmed navigation; opening a second tab, refreshing during load, or closing the tab early no longer discards a healthy update, the rolled-back shell cache is retained, and a Rebuild Offline Shell action can re-stage without waiting for a new revision

• Report a cached shell against the asset manifest that populated it, so changing the pinned asset list no longer reports a complete shell as incomplete forever

• Make the Midnight and OLED themes apply to the whole studio: the precision-studio chrome now draws from the design tokens instead of ~170 hardcoded literals, so the topbar, toolbar, panels, dialogs, status bar, and canvas well all follow the selected theme, and the canvas-drawn rulers, curves grid, histogram, navigator, and before/after chrome repaint on a theme change

• Persist the selected theme across reloads and apply it during startup rather than after the welcome screen is dismissed

• Validate numeric dialog input instead of silently substituting defaults: New Image, Resize Canvas, and Preferences now clamp to their declared ranges, so a negative or empty value can no longer create an invalid canvas or disable undo by setting a non-positive history limit

• Reject invalid amounts in Expand, Contract, and Border Selection, and keep the existing selection when the operation would clear it, instead of wiping it and reporting "expanded by NaNpx"

• Show the accent colour currently in effect when Preferences opens, so applying an unrelated preference no longer resets a customised accent

• Keep toasts readable: errors stay on screen long enough to read, long messages wrap instead of overflowing, hovering pauses dismissal, clicking dismisses, and toasts are no longer hidden behind the timeline, macro, Liquify, or before/after surfaces

• Close filter panels, Liquify, and before/after with Escape instead of falling through to the canvas and clearing the selection while the panel stays open

• Keep modeless workspace panels below modal dialogs so a dialog is never overlapped by an un-dimmed panel

• Stop the status bar from re-announcing on every pointer move, and announce each toast once instead of twice

• Replace version-control jargon in the save-state and offline chips with plain language

• Report images that fail to decode instead of doing nothing at all, and stop renaming the open document when an open fails

• Bound animated GIF import by frame count and decoded size, close the decoder on every path, and discard a slow import if the document changed meanwhile

• Accept PSD and .openshop files dropped anywhere in the window, not only over the canvas, and say when extra dropped files are ignored

• Allow SVG in the Open Image picker, which previously advertised SVG but greyed it out

• Walk one step per undo when undo or redo is triggered faster than a restore completes; overlapping restores no longer interleave or mis-map layer membership

• Preserve layer masks, per-object opacity, blend mode, skew, shadow, and the object's own name when a filter or AI operation commits pixels

• Report filter failures instead of leaving the dialog open with no feedback when a worker errors

• Make Ctrl+K work on the welcome screen where it is advertised, and stop advertising Ctrl+Shift+P and Ctrl+N, which the browser reserves; the fullscreen shortcut is now listed consistently as F

• Confirm dialogs with Enter, matching the existing Escape-to-cancel behaviour

• Explain when the command palette has no matches and when its list is truncated

• Report the real outcome of Batch Export instead of always claiming success, and say when no format is selected

• Offer an inline undo when clearing the palette or recorded actions, which canvas history cannot recover

• Warn once that animation frames are flattened snapshots before the timeline replaces a multi-layer stack

• Translate the renamed Save Project menu item in Simplified Chinese

• Restore the previous document when opening a project or recovery generation fails partway through, instead of leaving a half-replaced canvas whose layers panel, history, and save state disagree

• Enforce the PSD decode budget before any pixels are allocated by reading the layer structure first; the previous totalMemoryLimit option does not exist in ag-psd and was silently ignored, so a small crafted file could exhaust memory during decode

• Export eraser strokes as erased pixels rather than solid black in PSD layers

• Release sticky-note drag listeners when a note is deleted instead of leaving document-level handlers behind for the session

• Retry a lazily loaded runtime library once bypassing the HTTP cache when its integrity check fails, so a poisoned cache entry no longer disables that feature until the cache expires

• Make template cards, New Image size presets, and the zoom indicator real buttons so they can be reached and activated from the keyboard, and give the layer visibility and lock controls accessible names

• Keep the export dialog's alpha preference when the JPEG format button is clicked more than once

• Report GIF export failures, clamp the frame rate to a usable range, and release the exported blob

• Explain why recovery actions are unavailable for a corrupt generation instead of showing an unexplained disabled button

Performance

• Stop encoding a full-resolution PNG of the whole document on every edit and every zoom step: the navigator now renders at thumbnail scale, zoom and pan update only the viewport rectangle, and minimap and histogram refreshes coalesce into one frame and skip entirely while their panels are hidden

Removed

• Delete unreachable code: the unused layer-rebuild, legacy recovery-restore, duplicate new-document and background-removal wrappers, and a PSD branch that could never run

Changed

• Reimagine the editor as a high-contrast precision studio with a floating tool dock, structured inspector cards, technical canvas workspace, local-only trust indicator, and compact ready state
• Replace the welcome screen with a responsive local-first workspace launcher whose templates and primary actions remain reachable from phone through desktop widths
• Make mobile inspector groups independently usable through a bounded, scrollable drawer with no horizontal page overflow
• Unify project save/open, recovery, and history on document schema v1 with stable layer/object identity, masks, guides, selections, animation, active-state preservation, and legacy OpenShop/Fabric migration
• Make project and recovery writes transactional with visible clean/dirty/saving/saved/error states, acknowledged worker autosaves, revision-safe concurrent edits, and stale file-handle resets on new/open/recovery flows
• Move the complete PSD decode into a cancellable worker and atomically prepare every decoded layer before replacing the open document
• Keep all onboarding actions and dialog footers reachable at supported phone, tablet, portrait, and landscape sizes with safe-area spacing, touch-sized controls, and keyboard dismissal
• Keep layer ownership, panel order, Fabric stacking, export order, and edit eligibility synchronized; lock, visibility, opacity, blend, rename, and reorder changes now round-trip through history and project files
• Replace label-based macros with validated schema-v1 commands and atomic action replay; initialize history without a fake edit, coalesce live previews, and make crop, flatten, canvas rotation/flip, and frame changes fail-safe and exactly undoable
• Make raster export alpha/matte behavior explicit with real previews and format-loss guidance; keep checker pixels out of PNG, WebP, JPEG, SVG, and PDF output, restore temporary canvas state on failure, and leave project dirty state untouched
• Preserve nested PSD groups, supported blends, 0–1 opacity, visibility, locks, and basic editable text across import/export/reimport; avoid composite-layer duplication and report precise whole-document or per-layer raster fallbacks for unsupported semantics
• Replace the singleton autosave with checksum-verified immutable OPFS generations, staged promotion, bounded retention, corrupt-newest fallback, legacy migration, quota/durability UI, per-generation recovery actions, and cross-tab ownership forks
• Split distribution into a truthful network-first standalone file and a hosted PWA with a verified offline shell, health-confirmed updates, automatic rollback, install/cache diagnostics, and installed-app image/PSD/.openshop launch handling; project saves now use the dedicated extension while legacy .json remains readable
• Route PSD import, worker filters, AI inference, and chunked pixel post-processing through cancellable document jobs that reject pending work, terminate disposable workers, discard stale replies, and commit pixels/history only while the original document revision and target remain current

Security

• Upgrade Fabric.js from 5.3.1 to 7.4.0 with legacy project adapters and browser regressions for stored-SVG injection through object IDs and gradient colors
• Refresh the contributor lock to PostCSS 8.5.25 and Nano ID 3.3.16, synchronize its root version, and add a release test command that fails on high or critical npm advisories
• Enforce a 256 MB aggregate PSD decoded-pixel budget in addition to existing file, canvas, layer-count, nesting, and per-layer bounds
• Replace 380 executable HTML event attributes with opaque actions backed by a frozen 288-entry listener registry
• Remove unsafe-inline and unrestricted unsafe-eval from script policy, hash both reviewed inline scripts, and add a release check that rejects stale hashes or handler regressions
• SHA-384 verify every lazy PSD, Photon, GIF, Transformers.js, and ONNX runtime payload before executing it; poisoned responses fail closed and are not retained