Add xatlas native library and improve tool robustness

.claude/skills/skills-overhaul-plan.md

@@ -522,19 +522,15 @@ if [ -n "$NAMESPACE" ] && ! echo "$NAMESPACE" | grep -qE '^SashaRX\.'; then
   echo "WARN: namespace '$NAMESPACE' does not match SashaRX.<Package> — migration required in Phase 2."
 fi
 
-# 0.7 Write the parameter file used by later phases
-cat > /tmp/skills-overhaul.env <<EOF
-REPO_NAME=$REPO_NAME
-PACKAGE_ID=$PACKAGE_ID
-DISPLAY_NAME=$DISPLAY_NAME
-NAMESPACE=$NAMESPACE
-UNITY_MIN=$UNITY_MIN
-DEFAULT_BRANCH=$DEFAULT_BRANCH
-EOF
+# 0.7 Write shell-escaped parameters used by later phases.
+# `declare -p` produces Bash syntax that cannot reinterpret repository values
+# (for example, command substitutions in package.json) when the file is sourced.
+declare -p REPO_NAME PACKAGE_ID DISPLAY_NAME NAMESPACE UNITY_MIN DEFAULT_BRANCH \
+  > /tmp/skills-overhaul.env
 cat /tmp/skills-overhaul.env
 ```
 
-**Verification:** `/tmp/skills-overhaul.env` is non-empty; working tree either clean or known-dirty; git tag created.
+**Verification:** `/tmp/skills-overhaul.env` is non-empty and contains only `declare -- NAME=...` records; working tree either clean or known-dirty; git tag created.
 
 **Rollback:** `git reset --hard <pre-overhaul-sha>` (SHA saved in `/tmp/pre-overhaul-sha.txt`), and `git tag -d pre-skills-overhaul-<date>`.
 
@@ -895,4 +891,4 @@ The overhaul is successful when, in each of the three repos:
 
 1. **Run Phase 0 in each of the three repos and paste back the `/tmp/skills-overhaul.env` output for each.** This resolves the repo-identity question (are `UnityLodUvLightmapTransfer` / `lightmap-uv-tool` the same as `UnityMeshLab`?) and gives the plan the parameter values it needs. Estimated time: 3 minutes per repo.
 2. **Decide the two policy questions in §5.2**: (a) namespace Stance A vs B and (b) whether to include directive "ALWAYS invoke" phrasing on the three most-critical skills. These decisions change only a handful of lines in `_shared/naming-conventions.md` and in three frontmatter descriptions.
-3. **Execute Phase 1 (scaffold) in one repo as a pilot**, then Phase 2.1 (`_shared/` and `_checklists/` files) — these are repo-agnostic and can be copied identically to the other two repos once validated. Commit per the sub-commit plan. Only after that pilot runs cleanly through Phase 4 validation do you replicate to the remaining repos.
+3. **Execute Phase 1 (scaffold) in one repo as a pilot**, then Phase 2.1 (`_shared/` and `_checklists/` files) — these are repo-agnostic and can be copied identically to the other two repos once validated. Commit per the sub-commit plan. Only after that pilot runs cleanly through Phase 4 validation do you replicate to the remaining repos.

.github/workflows/build-native.yml

@@ -1,5 +1,11 @@
 name: Build Native Libraries
 
+# Default for every job: read-only. The `commit` job below opts into
+# `contents: write` for itself, so only the step that publishes the built
+# binaries carries a writable token — the compile jobs never see one.
+permissions:
+  contents: read
+
 on:
   push:
     paths:
@@ -33,7 +39,9 @@ jobs:
     name: Build (${{ matrix.os }})
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Configure CMake
         run: cmake -S 'Native~' -B build ${{ matrix.cmake_args }} -DCMAKE_BUILD_TYPE=Release
@@ -42,12 +50,17 @@ jobs:
         run: cmake --build build --config Release
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: native-${{ matrix.os }}
           path: ${{ matrix.plugin_dir }}/${{ matrix.artifact }}
           if-no-files-found: error
 
+  # Publishes the freshly built binaries back into Plugins/ so a native
+  # source change lands in the package without anyone copying files by hand.
+  # Only runs for pushes to this repository (never for pull_request, so a
+  # fork can never reach a writable token), and the commit carries [skip ci]
+  # so it cannot retrigger this workflow.
   commit:
     needs: build
     runs-on: ubuntu-latest
@@ -56,12 +69,12 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.ref }}
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: artifacts
 

.github/workflows/meta-check.yml

@@ -84,12 +84,15 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Check package.json is valid JSON
-        run: python3 -c "import json; json.load(open('package.json'))"
+        # `jq empty` succeeds on a stream of several root values ("{...}{...}"),
+        # which every JSON consumer but jq rejects. Slurping and asserting a
+        # single object root is what "valid package.json" actually means.
+        run: jq -e -s 'length == 1 and (.[0] | type == "object")' package.json
 
       - name: Check version format (semver)
         run: |
-          VERSION=$(python3 -c "import json; print(json.load(open('package.json'))['version'])")
-          if echo "$VERSION" | grep -qP '^\d+\.\d+\.\d+$'; then
+          VERSION=$(jq -er '.version | select(type == "string")' package.json)
+          if [[ "$VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
             echo "Version: $VERSION"
           else
             echo "::error::Invalid version format: $VERSION (expected semver X.Y.Z)"

.github/workflows/version-bump.yml

@@ -22,36 +22,53 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: main
-          token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: false
 
       - name: Bump patch version in package.json
         id: bump
         run: |
-          CURRENT=$(python3 -c "import json; print(json.load(open('package.json'))['version'])")
+          # A file with several root values ("{...}{...}") passes `jq empty` but
+          # makes `jq -er .version` emit one line per document — validate the
+          # single-object root before anything reads or rewrites the manifest.
+          if ! jq -e -s 'length == 1 and (.[0] | type == "object")' package.json > /dev/null; then
+            echo "::error::package.json is not a single JSON object"
+            exit 1
+          fi
+          CURRENT=$(jq -er '.version | select(type == "string")' package.json)
+          if [[ ! "$CURRENT" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+            echo "::error::Invalid version format: $CURRENT (expected semver X.Y.Z)"
+            exit 1
+          fi
           IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
+          # $((PATCH + 1)) wraps silently at the 64-bit boundary (it would turn
+          # 9223372036854775807 into a negative patch), so bound the input
+          # first. Compare digit count, not value: a numeric [ -ge ] test on a
+          # 20-digit patch is itself an "integer expression expected" error.
+          if [ "${#PATCH}" -gt 9 ]; then
+            echo "::error::Patch component out of range: $PATCH (expected < 1000000000)"
+            exit 1
+          fi
           NEW_PATCH=$((PATCH + 1))
           NEW_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}"
-          python3 -c "
-          import json
-          with open('package.json', 'r') as f:
-              data = json.load(f)
-          data['version'] = '${NEW_VERSION}'
-          with open('package.json', 'w') as f:
-              json.dump(data, f, indent=2)
-              f.write('\n')
-          "
+          TEMP_FILE=$(mktemp)
+          jq --arg version "$NEW_VERSION" '.version = $version' package.json > "$TEMP_FILE"
+          mv "$TEMP_FILE" package.json
           echo "old=$CURRENT" >> "$GITHUB_OUTPUT"
           echo "new=$NEW_VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Commit version bump
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OLD_VERSION: ${{ steps.bump.outputs.old }}
+          NEW_VERSION: ${{ steps.bump.outputs.new }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add package.json
           if git diff --cached --quiet; then
             echo "No version change"
           else
-            git commit -m "Bump version to ${{ steps.bump.outputs.new }} [skip ci]"
-            git push
-            echo "Bumped: ${{ steps.bump.outputs.old }} → ${{ steps.bump.outputs.new }}"
+            git commit -m "Bump version to ${NEW_VERSION} [skip ci]"
+            git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:main
+            echo "Bumped: ${OLD_VERSION} → ${NEW_VERSION}"
           fi

.npmignore

@@ -5,6 +5,12 @@ CLAUDE.md
 CLAUDE.md.meta
 REVIEW.md
 REVIEW.md.meta
+.claude/
+.codex/
+
+# Editor/workspace config — git only
+.vscode/
+.prettierignore
 
 # CI/CD & GitHub
 .github/
@@ -18,3 +24,39 @@ CONFLICT_CHECK_LAST_5_PRS.md
 CONFLICT_CHECK_LAST_5_PRS.md.meta
 .gitignore
 *.bat
+
+# Local Unity-generated files (mirrors .gitignore because npm stops using it
+# whenever this file exists)
+[Ll]ibrary/
+[Tt]emp/
+[Oo]bj/
+[Bb]uild/
+[Bb]uilds/
+[Ll]ogs/
+[Uu]ser[Ss]ettings/
+*.csproj
+*.sln
+*.suo
+*.user
+*.pidb
+*.booproj
+*.svd
+*.pdb
+*.mdb
+*.opendb
+*.VC.db
+
+# Local OS and IDE files
+.DS_Store
+Thumbs.db
+.idea/
+.vs/
+*.swp
+
+# Build intermediates and temporary files
+*.obj
+*.lib
+*.exp
+test.txt
+.commitmsg
+commitmsg.txt

CHANGELOG.md

@@ -24,6 +24,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
   - Repack tab: the `Advanced (debug)` section (manual texels-per-UV-unit, post-pack density correction, SymSplit threshold mode).
   - Unity top menu: `Mesh Lab ▸ Export FBX Metrics (Selected Assets)` and `(Scene LODGroup)`.
   - Assets ▸ Create context menu: `Mesh Lab ▸ Sweep Test Suite` (was always-visible `Lightmap UV Tool/Test Suite` via `[CreateAssetMenu]`).
+  - On-disk transfer-analysis artefacts: `BenchmarkRecorder.NewRun` returns a no-op scope when the toggle is off, so Run Full Pipeline / Repack / Transfer All no longer create `<projectRoot>/BenchmarkReports/` and its per-mesh `*_png/` subfolder on a production run. Existing report folders on disk are left untouched.
 - **In-flight gate + `FireAndForget` helper** for fire-and-forget async UI actions. The "Run Full Pipeline" / "Run Repack only" / "Run Transfer only" / "Repack All" / "Transfer All Targets" buttons now sit inside an `EditorGUI.DisabledScope` on `_pipelineInFlight` so a second click can't launch an interleaving run; `FireAndForget` attaches `ContinueWith` on the Unity sync context to log Task faults through `UvtLog.Error`, release the gate, and call `UvProgress.Fail` so a thrown exception can't leave the strip stuck on a stale phase.
 - **Cancel-aware benchmark recording** in `ExecTransferAllImpl` — mirrors the `completedSuccessfully` guard `ExecFullPipelineImpl` already uses. Cancelled transfers no longer emit stale `shellTransferResult` / validation rows that taint sweep aggregates.
 
@@ -37,6 +38,22 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - `[CreateAssetMenu(menuName = "Lightmap UV Tool/Test Suite")]` from `TestSuiteAsset` — replaced with a gated `[MenuItem("Assets/Create/Mesh Lab/Sweep Test Suite")]`.
 - Transfer tab decluttered: removed the misplaced `Generate LODs` section (full LOD-Gen UI lives in the dedicated LOD Gen tab), the `FBX Export` block (Export as New / Overwrite Source — both duplicates of the sidebar footer's `Export New FBX` / `Overwrite FBX`), and the `Save FBX from main (_main)` button (duplicate of the footer's `Backup from main`). Transfer tab now reads: per-LOD status list → `Transfer All Targets` → `Quality Report` → `Validation Overlay` → `Apply UV2` actions.
 
+### Security
+Consolidated hardening sweep — incorporates PRs #122–#123, #125–#129, #131, #134–#140, #142–#145, #147–#149, #151–#152, #156–#159, #161–#164, #168 and #170–#190.
+
+- **CI and build tooling** — release/version workflows no longer interpolate untrusted values straight into inline Python; the native build workflow pins every action to a verified SHA and defaults to a read-only token, with `contents: write` scoped to the publish job alone, which still commits the freshly built binaries into `Plugins/` automatically on push; `gen.bat` and the skills-overhaul parameter file quote/escape their arguments; `.npmignore` mirrors `.gitignore` so ignored artifacts can't leak into a published tarball (#123, #125, #135, #136, #164).
+- **Vendored xatlas** — `Native~/CMakeLists.txt` builds a pinned, vendored xatlas source tree instead of `FetchContent`-ing a moving upstream branch (#127).
+- **Sidecar replay validation** — `Uv2DataAsset` payloads are now treated as untrusted input: UV channel dimensions and lengths, submesh triangle counts, collision entries, vertex-color arrays, xatlas settings and the sidecar-supplied save path are validated before use, stale/incomplete remap rebuilds abort instead of half-applying, and remap work is bounded (#126, #139, #151, #182, #185, #188, #189).
+- **Resource limits** — bounded or overflow-checked work budgets across Vertex/GPU AO (bake workload, seam matching, 3D and 2D blur, face-area correction, NaN-safe atomic accumulation, deferred GPU cleanup), repack (atlas oversample sizing, pack cost, exclusive native xatlas sessions, cached area preview), grouped transfer and spatial overlap scans, SceneView hover raycasts, benchmark sweep parameters and UV PNG generation, ARAP UV ranges, FBX backup path hashing, V-HACD recursion depth and triangle indices, and the meshoptimizer packing buffers feeding the unsafe/native path (#122, #128–#129, #131, #134, #137–#138, #140, #143–#144, #147–#149, #152, #162–#163, #184, #186–#187, #190).
+- **Output escaping** — a shared `CsvUtil.Escape` neutralises formula prefixes in every CSV writer (sweep summaries, FBX metrics, benchmark records) and the gallery generator escapes model names before embedding them in HTML hrefs (#157–#159, #161).
+
+### Fixed
+- **UV transfer / repack correctness** — Repack normalizes UV0 shell winding at its own API boundary instead of assuming the optional Weld stage ran; source meshes with incomplete (non-empty but short) UV0/UV2 channels are rejected before indexing; cancelled transfers drop their partial UV2 output; post-pack density correction stays inside each packed chart; `RepackUv` forwards its rotate flag to xatlas; the UV2 clamp toggle is independently editable; `Apply UV2` is reachable after a source-only repack; cross-LOD hints are isolated per mesh group (#128, #156, #170–#173, #180–#181, #183).
+- **Undo and preview handling** — undo/redo restores preview-swapped meshes before rebuilding `MeshEntries` so a preview mesh can't become the cached baseline; Vertex AO no longer takes duplicate preview backups and clears stale results before loading new mesh data; the shell colour hash survives `int.MinValue`; Inverted triangles are rendered in the validation overlay instead of drawing clean or vanishing under the filter (#145, #168, #174, #176–#177).
+- **LOD parsing and generation** — LOD indices parsed from object names are bounded, and LOD0's transition height is normalized before generating the remaining levels (#142, #179).
+- **FBX export** — `NormalizeExportHierarchy` bakes each node's transform into a per-node mesh copy, so a shared FBX sub-asset is no longer mutated cumulatively (#175).
+- **Collision meshes** — `StripCollisionMesh` calls `mesh.Clear(false)`; with the default `keepVertexLayout=true` the extra tangent/color/UV channels were retained and the strip was a no-op (#178).
+
 ## [1.0.5] - 2026-05-13
 
 ### Added