[Ugoyo]

What does this change?

Filee now reads Windows animated cursors (.ani). Closes #1365

An .ani is a RIFF ACON file whose frames are whole .cur/.ico files. ImageMagick doesn't read ANI but reads CUR/ICO, so a small reader of Filee's own (src/Filee.Engines/Magick/Ani.cs) takes the frames out, has ImageMagick decode each one at its largest size, and builds the animation step by step:

• To GIF, APNG, WebP and the other animated targets: every step, in the order of the seq chunk (frames can repeat), for the time given by the rate chunk or the header (jiffies of 1/60 s, rounded to hundredths), looping forever. Frames of different sizes share one canvas.
• To PNG, JPG, ICO, PDF, …: the first step.
• To CUR: the first frame as stored, with every size and its hotspot, unless the preset changes the picture. In that case the hotspot follows a resize, turn or mirror. If the picture is trimmed or set on a background, the hotspot goes to the top left corner, because its new position isn't known.
• Also fixes every → CUR conversion. ImageMagick writes "CUR" as an icon: the header says type 1, and each directory entry holds colour planes and bits per pixel where Windows reads the hotspot. So until now a PNG → CUR from Filee was an .ico named .cur that clicked at (1, 32). The new CursorFile makes every .cur Filee writes (normal conversions and Merge images) a real cursor (type 2) clicking at the top left corner. From a CUR or ANI source, the hotspot follows the picture. It is in this PR because the ANI → CUR fix needed exactly this code.
• Defensive reading: the file is read in memory with bounded size (64 MB), frames (1,024), steps (4,096) and frame dimensions (1,024 px). Truncated or damaged files, and the rare raw-bitmap frames (no AF_ICON), are refused with a clear message.

Classification (docs/FORMAT-RULES.md): read only (Writable: false, like kra/livp), so rule 5 admits it as an input. It is graded specialist in the Developer field, the same as cur: animated cursors are made by people who make cursor themes, the same people who make static cursors, so the reasoning that put CUR there applies unchanged.

Settings schema 84: the images donut learns .ani; custom claims stay put. The number follows the last one on main (83) and may need renumbering depending on merge order: #1384 (Paint.NET) also takes 84 for now. Whichever lands second also needs one more in the Specialist count of FormatFieldsTests.

Type of change

• Bug fix
• New feature or improvement
• New format or engine
• Translation
• Documentation
• Build, CI or dependencies

How was it tested?

• dotnet format --verify-no-changes
• dotnet test: new AniTests (28, Engines; files built by AniBuilder: no seq/rate, seq repeating frames, per-step rate, short rate chunk, several sizes per frame, frames of different sizes, hotspot kept as is / after resize and turn, truncated / fake / damaged / raw-bitmap files, detection by extension), CursorFileTests (3, Engines: PNG → CUR is type 2 clicking at 0,0; a CUR resized or mirrored keeps its hotspot; a trimmed one goes to 0,0) and AniFormatTests (Core: detection, classification, schema 80 migration). Full Engines and Core suites run in a Linux container: the only failures are ones that already fail there on main (Pandoc, FFmpeg and LibreOffice not installed; FolderCopyTests running as root). The Engines suite was run again after the CUR fix (3,062 passed, the same 18 known failures); Core was not, as that commit touches only the engines. App tests were run only by filter (DefaultPlacement, FieldsPage, PaletteChipTip, FormatRequest, ToolbarEditor, LocalizationResource), before the CUR fix; all passed.
• Tried it in the app: not done. I converted real cursors from the GPL-3.0 Bibata theme (Windows release, Busy.ani and Work.ani, 3 sizes; not committed) with filee-cli on Linux. To GIF/WebP/APNG they keep 54 frames at their timing; to PNG, PDF, ICNS, SVG, TIFF, AVIF, JXL and BMP they convert; to CUR the result is byte-identical to the stored first frame (14 sizes, hotspots kept). Not tested on Windows, and ANI → video was not tried (no FFmpeg in the container).

Checklist

• New UI strings are in all src/Filee.App/Assets/i18n/*.json files (none added; errors are English messages, as for KRA)
• New third-party code or binaries are listed in THIRD-PARTY-NOTICES.md (none)
• The PR does one thing (unrelated changes go in a separate PR) (the CUR fix is the code ANI → CUR needed, see above)
• [ ]

[KnifeLemon]

Thanks a lot for this one: the ANI reader is careful and the tests build every file themselves. Nice catch on ImageMagick's CUR writer, too.

One change before we merge:

1. Check the pixel budget before decoding. Read and Hotspot call Decode(frames) first, and only then compare against MaxAnimationPixels. Decode has ImageMagick read every directory entry of every frame. Entries checks each entry's side, but not how many entries a frame has, or whether several entries point at the same bytes. A small file can therefore list tens of thousands of entries that all point at one well-compressed 1024×1024 PNG, and ImageMagick would decode all of them. Could you add the budget in Entries/Parse, before anything is decoded? For example: the sum of width × height over all entries of all frames, held to the same limit, and a small cap on entries per frame (real cursors have only a few).

Two notes, nothing to do on your side:

• Schema 80 and the specialist count: we'll renumber when we merge, depending on what lands first (#1384, #1349 and #1372 all want 79).
• CI hasn't run yet because your first PRs need a maintainer to approve the workflow. We'll start it.

[Ugoyo]

Thanks for the review! Done in 3d12ba1 (and a doc note in 302b38d): each frame's directory is now read when the frame is parsed, with at most 32 sizes per frame, and before anything is decoded both the sum of width × height over every size of every frame and steps × the largest canvas are held to the same limit. New tests cover 33 sizes in a frame, a small file whose 3 × 32 sizes all point at one 1024 px PNG, and 4,096 steps of a 256 px frame; all are refused before ImageMagick decodes anything.

[KnifeLemon]

Thanks, that's exactly it. Reading each frame's directory while parsing, capping the sizes per frame, and checking both pixel budgets before ImageMagick decodes anything closes the gap, and the three new tests pin it down nicely.

We merged main into your branch, moved the migration to schema 85 (main has taken up to 84 since) and updated the format counts. Thanks again for the ANI reader and the CUR fix!