Render Markdown task checkboxes with HarfBuzz font fallback

.github/lsan.supp

@@ -5,6 +5,8 @@
 leak:drawing::defaultFont
 leak:imgutils::retainFontRefId
 leak:typefaces::registerTypeface
+# The HarfBuzz backend also retains parsed faces in an ARC/ORC threadvar table.
+leak:harfbuzzy::initHarfbuzzTypeface
 leak:libfontconfig.so
 leak:outputs::memoryOutput
 leak:times::newTimezone

.github/scripts/install-msvc-nim.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Start with the complete official distribution, verify both pinned fixes, then
+# compile the corrected compiler once. No Git clone or csources build is needed.
+nimMsvcRevision=705392dc03a3f8233f5f0f048acaa9b5267576f6
+nimMsvcAtomicsChecksum=2d9c6b381ad09b09b64d29f2af5a6da693c7835d574075e238a8d8c4370ef05a
+nimMsvcCompilerChecksum=22e3011e65906288373fc991d2abc9a06e6ebd348c7682f162a14f21b047451b
+projectRoot="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$projectRoot"
+nimMsvcDir="$projectRoot/deps/nim-msvc-2.2.10-705392dc"
+atomicsPath=lib/pure/concurrency/atomics.nim
+compilerPath=compiler/ccgliterals.nim
+stageDir=
+probeDir=
+nimMsvcCandidate="$nimMsvcDir"
+
+cleanup() {
+  if [[ -n "$stageDir" ]]; then rm -rf "$stageDir"; fi
+  if [[ -n "$probeDir" ]]; then rm -rf "$probeDir"; fi
+}
+trap cleanup EXIT
+
+verifyFile() {
+  [[ -f "$1" ]] && [[ "$(sha256sum "$1" | cut -d ' ' -f 1)" == "$2" ]]
+}
+
+fetchPatch() {
+  local relativePath="$1" expectedChecksum="$2"
+  curl --fail --location --retry 3 \
+    "https://raw.githubusercontent.com/elcritch/Nim/$nimMsvcRevision/$relativePath" \
+    --output "$stageDir/$relativePath"
+  if ! verifyFile "$stageDir/$relativePath" "$expectedChecksum"; then
+    echo "The pinned $relativePath checksum does not match." >&2
+    exit 1
+  fi
+}
+
+if [[ ! -e "$nimMsvcDir" ]]; then
+  atlas env 2.2.10 --binary
+  stageDir="$(mktemp -d "$projectRoot/deps/.nim-msvc-XXXXXX")"
+  cp -R "$projectRoot/deps/nim-2.2.10/." "$stageDir/"
+  fetchPatch "$atomicsPath" "$nimMsvcAtomicsChecksum"
+  fetchPatch "$compilerPath" "$nimMsvcCompilerChecksum"
+  # Binary distributions omit the prebuilt MSVC resource used by compiler/nim.nim.
+  (
+    cd "$stageDir/icons"
+    MSYS2_ARG_CONV_EXCL='*' rc.exe /nologo /fo nim-amd64-windows-vcc.res nim.rc
+  )
+  stageWindows="$(cygpath -m "$stageDir")"
+  # Keep compiler/nim.cfg (booting/nimcore), but skip Merenda's parent config.
+  "$projectRoot/deps/nim-2.2.10/bin/nim.exe" c --cc:vcc -d:release --mm:orc \
+    --vcc.exe:cl.exe --vcc.linkerexe:cl.exe \
+    --skipUserCfg:on --skipParentCfg:on --lib:"$stageWindows/lib" \
+    --out:"$stageWindows/bin/nim.exe" "$stageDir/compiler/nim.nim"
+  # Atlas activation scripts contain the original installation's absolute path.
+  # Use the private compiler path printed below instead.
+  rm -f "$stageDir/activate.bat" "$stageDir/activate.ps1" "$stageDir/activate.sh"
+  nimMsvcCandidate="$stageDir"
+fi
+
+if [[ ! -f "$nimMsvcCandidate/bin/nim.exe" ]] ||
+    ! verifyFile "$nimMsvcCandidate/$atomicsPath" "$nimMsvcAtomicsChecksum" ||
+    ! verifyFile "$nimMsvcCandidate/$compilerPath" "$nimMsvcCompilerChecksum"; then
+  echo "Incomplete MSVC Nim environment: remove $nimMsvcDir and retry." >&2
+  exit 1
+fi
+
+# Use the compiler's default library lookup, including on cached installations.
+probeDir="$(mktemp -d "$projectRoot/deps/.msvc-atomics-probe-XXXXXX")"
+probeFile="$probeDir/msvc_atomics_probe.nim"
+cat > "$probeFile" <<'NIM'
+import std/atomics
+static:
+  doAssert declared(nimHasCorrectMsvcAtomics)
+const binary = block:
+  var data = newString(20_000)
+  for i in 0 ..< data.len:
+    data[i] = char(i mod 256)
+  data
+var value = binary
+let original = value
+for i, c in value:
+  doAssert c == char(i mod 256)
+value[0] = 'x'
+doAssert original[0] == '\0'
+NIM
+"$nimMsvcCandidate/bin/nim.exe" c -r --cc:vcc --mm:arc \
+  --vcc.exe:cl.exe --vcc.linkerexe:cl.exe \
+  --skipUserCfg:on --skipParentCfg:on --skipProjCfg:on \
+  --out:"$(cygpath -m "$probeDir")/msvc_probe.exe" "$probeFile"
+
+if [[ -n "$stageDir" ]]; then
+  # Windows may briefly retain a file lock after the compiler/probe exits.
+  for moveAttempt in {1..20}; do
+    # Do not nest the staged compiler if the destination unexpectedly exists.
+    if mv -T "$stageDir" "$nimMsvcDir"; then
+      stageDir=
+      break
+    fi
+    if ((moveAttempt == 20)); then
+      echo "Cannot install the MSVC Nim environment at $nimMsvcDir." >&2
+      exit 1
+    fi
+    sleep 0.5
+  done
+fi
+
+if [[ -n "${GITHUB_PATH:-}" ]]; then
+  cygpath -w "$nimMsvcDir/bin" >> "$GITHUB_PATH"
+fi
+
+nimMsvcCompilerWindows="$(cygpath -w "$nimMsvcDir/bin/nim.exe")"
+echo "Patched MSVC compiler: $nimMsvcCompilerWindows"

.github/workflows/build-full.yml

@@ -10,7 +10,8 @@ jobs:
   tests:
     name: tests (${{ matrix.os }}, ${{ matrix.nimversion }}, ${{ matrix.display }})
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 40
+    # Full GUI and integration coverage can take nearly 40 minutes on macOS.
+    timeout-minutes: 60
     env:
       ATLAS_TEST_NIM_ARGS: ${{ matrix.nimargs }}
     defaults:
@@ -58,6 +59,10 @@ jobs:
     - name: Check shared test runner coverage
       run: nim e --skipParentCfg:on --skipProjCfg:on .github/scripts/check_test_imports.nims
 
+    - name: Install macOS text rendering libraries
+      if: runner.os == 'macOS'
+      run: brew install harfbuzz fribidi
+
     - name: Setup software OpenGL (Mesa)
       if: runner.os == 'Windows'
       uses: ssciwr/setup-mesa-dist-win@v3.0.0
@@ -87,6 +92,8 @@ jobs:
           libgl1-mesa-dev \
           libgles2-mesa-dev \
           libegl1-mesa-dev \
+          libharfbuzz-dev \
+          libfribidi-dev \
           mesa-utils \
           vulkan-tools \
           mesa-vulkan-drivers \
@@ -260,6 +267,8 @@ jobs:
           libgl1-mesa-dev \
           libgles2-mesa-dev \
           libegl1-mesa-dev \
+          libharfbuzz-dev \
+          libfribidi-dev \
           mesa-utils \
           vulkan-tools \
           mesa-vulkan-drivers \
@@ -308,6 +317,30 @@ jobs:
     steps:
     - uses: actions/checkout@v5
 
+    - name: Configure MSVC for x64
+      if: runner.os == 'Windows'
+      uses: ilammy/msvc-dev-cmd@v1
+      with:
+        arch: x64
+
+    - name: Install macOS text rendering libraries
+      if: runner.os == 'macOS'
+      run: brew install harfbuzz fribidi
+
+    - name: Install Linux text rendering libraries
+      if: runner.os == 'Linux'
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y --no-install-recommends libharfbuzz-dev libfribidi-dev
+
+    - name: Install Windows text rendering headers
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        & "$env:VCPKG_INSTALLATION_ROOT/vcpkg.exe" install harfbuzz:x64-windows
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+        "INCLUDE=$env:VCPKG_INSTALLATION_ROOT/installed/x64-windows/include/harfbuzz;$env:INCLUDE" >> $env:GITHUB_ENV
+
     - name: Cache packages
       uses: actions/cache@v4
       with:
@@ -317,9 +350,18 @@ jobs:
     - name: Install latest Atlas and set up Nim
       run: |
         mkdir -p "$HOME/.local/bin"
-        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+        if [[ "$RUNNER_OS" == "Windows" ]]; then
+          cygpath -w "$HOME/.local/bin" >> "$GITHUB_PATH"
+        else
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+        fi
+        export PATH="$HOME/.local/bin:$PATH"
         bash .github/scripts/install-atlas.sh
-        "$HOME/.local/bin/atlas" env "${{ matrix.nimversion }}" --binary --github-path
+        if [[ "$RUNNER_OS" == "Windows" ]]; then
+          bash .github/scripts/install-msvc-nim.sh
+        else
+          "$HOME/.local/bin/atlas" env "${{ matrix.nimversion }}" --binary --github-path
+        fi
 
     - name: Verify Nim
       run: |
@@ -340,5 +382,13 @@ jobs:
       run: bash .github/scripts/clean_generated_examples.sh
 
     - name: Compile Examples
+      if: runner.os != 'Windows'
       run: |
         atlas-run tests --jobs:2 --compile-only --only-errors "examples/all_compile.nim"
+
+    - name: Compile Windows Examples with MSVC
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        atlas-run tests --jobs:2 --compile-only --only-errors "examples/all_compile.nim" -- --cc:vcc --passC:/MT
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }