fix: resolve 9 audit issues (#256–#264) and bump to 0.5.14

- #256: formatCJKFile uses view.dispatch() for undo support
- #257: read doc.length inside queued IME callback (stale closure fix)
- #258: listContinuation bails out on multi-cursor
- #259: listSmartIndent/Outdent bail out on multi-cursor
- #260: hot-exit merge only resurrects timed-out windows, not closed ones
- #261: delete_session also removes session.prev.json backup
- #262: add Print menu item to Windows/Linux File menu
- #263: OutlineView defers content processing with useDeferredValue
- #264: StatusBarCounts defers stripMarkdown with useDeferredValue

Closes #256, #257, #258, #259, #260, #261, #262, #263, #264

Author: xiaolai

package.json

@@ -1,7 +1,7 @@
 {
   "name": "vmark",
   "private": true,
-  "version": "0.5.13",
+  "version": "0.5.14",
   "type": "module",
   "scripts": {
     "dev": "vite",

src-tauri/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "vmark"
-version = "0.5.13"
+version = "0.5.14"
 description = "AI friendly markdown editor"
 authors = ["Xiaolai"]
 edition = "2021"

src-tauri/Cargo.toml

@@ -13,6 +13,7 @@ use super::coordinator::{
     get_window_restore_state,
     mark_window_restore_complete,
     clear_pending_restore,
+    CaptureResult,
     RestoreMultiWindowResult,
 };
 
@@ -23,9 +24,11 @@ use super::coordinator::{
 /// instead of being silently dropped.
 #[tauri::command]
 pub async fn hot_exit_capture(app: AppHandle) -> Result<SessionData, String> {
-    let mut session = capture_session(&app).await?;
+    let CaptureResult { mut session, expected_labels } = capture_session(&app).await?;
 
-    // Merge partial captures: keep previous window states for missing windows
+    // Merge partial captures: only resurrect windows that were expected (alive
+    // at capture time) but failed to respond (timed out). Windows that were
+    // intentionally closed are NOT in expected_labels and won't be merged.
     let captured_labels: std::collections::HashSet<String> = session
         .windows
         .iter()
@@ -35,9 +38,11 @@ pub async fn hot_exit_capture(app: AppHandle) -> Result<SessionData, String> {
     if let Ok(Some(prev_session)) = read_session(&app).await {
         let mut merged = false;
         for prev_window in prev_session.windows {
-            if !captured_labels.contains(&prev_window.window_label) {
+            if expected_labels.contains(&prev_window.window_label)
+                && !captured_labels.contains(&prev_window.window_label)
+            {
                 eprintln!(
-                    "[HotExit] Merging previous state for missing window '{}'",
+                    "[HotExit] Merging previous state for timed-out window '{}'",
                     prev_window.window_label
                 );
                 session.windows.push(prev_window);

src-tauri/src/hot_exit/commands.rs

@@ -103,8 +103,15 @@ fn normalize_window_label(state: &mut WindowState, expected_label: &str) {
     }
 }
 
+/// Result of capture_session, including the set of expected window labels
+/// so callers can distinguish "closed window" from "timed-out window".
+pub struct CaptureResult {
+    pub session: SessionData,
+    pub expected_labels: HashSet<String>,
+}
+
 /// Capture session from all windows
-pub async fn capture_session(app: &AppHandle) -> Result<SessionData, String> {
+pub async fn capture_session(app: &AppHandle) -> Result<CaptureResult, String> {
     // Get all document windows (main + doc-*)
     let windows: Vec<String> = app
         .webview_windows()
@@ -251,6 +258,8 @@ pub async fn capture_session(app: &AppHandle) -> Result<SessionData, String> {
         }
     });
 
+    let expected_labels = final_state.expected_windows.clone();
+
     let session = SessionData {
         version: SCHEMA_VERSION,
         timestamp: chrono::Utc::now().timestamp(),
@@ -259,7 +268,7 @@ pub async fn capture_session(app: &AppHandle) -> Result<SessionData, String> {
         workspace: None, // Workspace capture not yet implemented
     };
 
-    Ok(session)
+    Ok(CaptureResult { session, expected_labels })
 }
 
 async fn wait_for_all_responses(state: Arc<Mutex<CaptureState>>, expected: usize) {

src-tauri/src/hot_exit/coordinator.rs

@@ -159,7 +159,7 @@ pub async fn read_session(
     }
 }
 
-/// Delete session file after successful restore
+/// Delete session file (and backup) after successful restore
 pub async fn delete_session(app: &tauri::AppHandle) -> Result<(), String> {
     let session_path = get_session_path(app)?;
 
@@ -169,6 +169,12 @@ pub async fn delete_session(app: &tauri::AppHandle) -> Result<(), String> {
             .map_err(|e| format!("Failed to delete session: {}", e))?;
     }
 
+    // Also clean up backup file
+    let backup_path = get_backup_session_path(app)?;
+    if backup_path.exists() {
+        let _ = tokio::fs::remove_file(&backup_path).await;
+    }
+
     Ok(())
 }
 

src-tauri/src/hot_exit/storage.rs

@@ -150,6 +150,7 @@ pub(crate) fn create_menu_with_shortcuts(
             &MenuItem::with_id(app, "move-to", "Move to...", true, get_accel("move-to", ""))?,
             &PredefinedMenuItem::separator(app)?,
             &export_submenu,
+            &MenuItem::with_id(app, "export-pdf", "Print...", true, get_accel("export-pdf", "CmdOrCtrl+P"))?,
             &PredefinedMenuItem::separator(app)?,
             &history_submenu,
             &PredefinedMenuItem::separator(app)?,

src-tauri/src/menu/custom_menu.rs

@@ -146,6 +146,7 @@ pub fn create_menu(app: &tauri::AppHandle) -> tauri::Result<Menu<tauri::Wry>> {
             &MenuItem::with_id(app, "move-to", "Move to...", true, None::<&str>)?,
             &PredefinedMenuItem::separator(app)?,
             &export_submenu,
+            &MenuItem::with_id(app, "export-pdf", "Print...", true, Some("CmdOrCtrl+P"))?,
             &PredefinedMenuItem::separator(app)?,
             &history_submenu,
             &PredefinedMenuItem::separator(app)?,

src-tauri/src/menu/default_menu.rs

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "VMark",
-  "version": "0.5.13",
+  "version": "0.5.14",
   "identifier": "app.vmark",
   "build": {
     "beforeDevCommand": "pnpm dev",

src-tauri/tauri.conf.json

@@ -4,7 +4,7 @@
  * Displays document heading structure as a tree.
  */
 
-import { useState, useMemo, useRef } from "react";
+import { useState, useDeferredValue, useMemo, useRef } from "react";
 import { ChevronRight, ChevronDown } from "lucide-react";
 import { emit } from "@tauri-apps/api/event";
 import { useUIStore } from "@/stores/uiStore";
@@ -93,16 +93,17 @@ const MAX_OUTLINE_ITEMS = 100; // Limit total visible items
 
 export function OutlineView() {
   const content = useDocumentContent();
+  const deferredContent = useDeferredValue(content);
   const activeHeadingIndex = useUIStore((state) => state.activeHeadingLine);
 
   // Check if document is too large (used after hooks)
-  const isTooLarge = content.length > MAX_CONTENT_FOR_OUTLINE;
+  const isTooLarge = deferredContent.length > MAX_CONTENT_FOR_OUTLINE;
 
   // Create a stable key based only on heading lines.
   // This prevents re-extraction when typing in non-heading content.
   const headingLinesKey = useMemo(
-    () => (isTooLarge ? "" : getHeadingLinesKey(content)),
-    [content, isTooLarge]
+    () => (isTooLarge ? "" : getHeadingLinesKey(deferredContent)),
+    [deferredContent, isTooLarge]
   );
 
   // Cache previous headings to maintain referential stability
@@ -116,12 +117,12 @@ export function OutlineView() {
       return prevHeadingsRef.current;
     }
     perfStart("OutlineView:extractHeadings");
-    const newHeadings = extractHeadings(content);
+    const newHeadings = extractHeadings(deferredContent);
     perfEnd("OutlineView:extractHeadings", { count: newHeadings.length });
     prevHeadingsRef.current = newHeadings;
     prevKeyRef.current = headingLinesKey;
     return newHeadings;
-  }, [headingLinesKey, content, isTooLarge]);
+  }, [headingLinesKey, deferredContent, isTooLarge]);
 
   const tree = useMemo(() => {
     if (isTooLarge) return [];