Sashfold 0.0.3

The first pre-release of Sashfold: a web browser engine, and a Windows browser around it, written from scratch. Every byte that runs is in this repository: the HTML and CSS parsers, layout, text, the font engine, the image decoders, HTTP, cookies, the cache, and the window. It is early. It reads the readable web, and it does not pretend to do the rest.

What's New

• A window that browses the live web over HTTPS — Tabs (Ctrl+T, Ctrl+W, Ctrl+Tab, middle-click on a link), history that keeps each page's bytes so Back never refetches, an address bar, link hit-testing, wheel and keyboard scrolling. Every pixel of the chrome comes from themes/default.json, which reloads while the window is open.
• Your installed fonts — A TrueType reader and a rasterizer written here, a font manager that catalogues the system's fonts by their naming tables alone and matches CSS font-family, weight and slant, and a fallback chain by coverage, so a page mixes its own fonts with whatever the machine has for the characters they lack. Sashfold Mono, an original monospace face, is the last fallback and draws an honest box for anything no font has.
• Images — PNG (every color type, bit depth and filter, interlaced), GIF (LZW, interlace, transparency; the first frame), and JPEG (baseline and progressive), each decoder written and fuzzed here, sized by CSS, attributes or the picture itself, drawn scaled with integer arithmetic.
• A site's own stylesheets — <link rel="stylesheet"> and @import, decoded by the CSS charset rules, with media queries evaluated against the real window size and re-evaluated when it changes.
• Rendering that is the same everywhere — The reference tests render with the built-in face alone and compare PNG bytes, so the same page produces byte-identical pixels on Windows, Linux and macOS, and the outline rasterizer is held to the built-in face's pixels exactly.
• Privacy and safety defaults — Third-party cookies blocked, HTTPS first for typed addresses, strict-origin-when-cross-origin referrers, a certificate error page with no way through, downloads saved with the mark of the web and never opened, no default search, no telemetry, no self-updater.
• Standards scores you can check — The HTML tokenizer at 7032/7032 and tree construction at 1784/1784 on the html5lib suites; the URL parser at 893/893 on WPT's urltestdata. Both are enforced in CI by baselines that only ratchet upward.
• A command line for the engine — sashfold --render page.html -o out.png renders any page or URL to a PNG; --bench times parse, stylesheets, style, layout and paint; --dump-dom prints the tree; --font-info and --font-list show what the font engine sees.

What's Not Written Yet

• Layout gaps — Floats, flexbox, grid, tables and positioning are not written, so pages built on them fall into one column. Nothing stands in for them: what Sashfold cannot do, it does not do.
• No scripting — Pages render as served; JavaScript is not run.
• No text selection or clipboard yet, no find-in-page, no animated GIF — The first frame of a GIF is shown.
• Windows only for the window — The engine and its command line build and test on Linux and macOS in CI; there is no Linux or macOS window yet.
• Loading blocks while it fetches — Each stylesheet and image is fetched in turn; a page with many pictures takes a moment to appear.

Running It

• Unzip and run sashfold.exe — Keep themes beside it. sashfold.exe https://en.wikipedia.org opens the window on a page; with no address it opens the about page. Downloads go to your Downloads folder.
• Requirements — Windows 10 or 11, 64-bit. The binary is statically linked and imports only the operating system's own libraries, which is checked in CI.
• Source — Linux and macOS build from source with CMake and Ninja; the window itself is Windows for now.