screengraft 0.62.0 → 0.62.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screengraft",
-  "version": "0.62.0",
+  "version": "0.62.2",
   "description": "Put a UI screenshot or screen recording onto a photographed device screen with the perspective exactly right \u2014 a homography you confirm by hand, not a generative guess.",
   "keywords": [
     "mockup",

package/scripts/recents.py

@@ -39,7 +39,16 @@ def _load() -> dict:
         if not isinstance(d, dict):
             raise ValueError
     except (OSError, ValueError):
+        # No store (or an unreadable one): build it from the sessions on disk
+        # and WRITE it, or every read until the first record() walks them again.
         d = _seed()
+        for r in ROLES:
+            d.setdefault(r, [])
+        try:
+            _save(d)
+        except OSError:
+            pass
+        return d
     for r in ROLES:
         d.setdefault(r, [])
     return d
@@ -52,6 +61,10 @@ def _save(d: dict):
     with open(tmp, "w") as f:
         json.dump(d, f, indent=1)
     os.replace(tmp, p)
+    try:
+        os.chmod(p, 0o600)      # paths under the user's home: owner-only
+    except OSError:
+        pass
 
 
 def _seed() -> dict:

package/scripts/ui.py

@@ -28,6 +28,7 @@ stdlib only on the server side; OpenCV via detect/warp.
 """
 import argparse
 import atexit
+import hashlib
 import json
 import mimetypes
 import os
@@ -733,7 +734,10 @@ def _thumb_for(item):
     out_dir = os.path.join(SESSION.dir, "thumbs")
     if item.get("ext") in VIDEO_EXT:
         os.makedirs(out_dir, exist_ok=True)
-        out = os.path.join(out_dir, f"{abs(hash(item['path']))}_{int(item.get('mtime') or 0)}_clip.jpg")
+        # A stable name: hash() is salted per process, so a name built on it
+        # misses the cache on every launch.
+        key = hashlib.sha1(item["path"].encode()).hexdigest()[:16]
+        out = os.path.join(out_dir, f"{key}_{int(item.get('mtime') or 0)}_clip.jpg")
         if not os.path.exists(out):
             try:
                 fr = W.read_frame_at(item["path"], 0)
@@ -981,7 +985,10 @@ class Handler(BaseHTTPRequestHandler):
                 # The folder scan (scan.py) still exists for the CLI and for a
                 # first run with nothing used yet; ?role= selects the list.
                 role = (q.get("role") or ["photo"])[0]
-                limit = int(q.get("limit", ["40"])[0])
+                try:
+                    limit = max(1, min(200, int(q.get("limit", ["40"])[0])))
+                except ValueError:
+                    limit = 40
                 items = RECENT.items(role, limit)
                 for it in items:
                     it["thumb"] = _thumb_for(it)
@@ -1546,6 +1553,11 @@ def _publish_current(payload):
     """
     os.makedirs(os.path.dirname(CURRENT), exist_ok=True)
     _write_json_atomic(CURRENT, payload)
+    # The pointer carries the session token: owner-only, like a credential.
+    try:
+        os.chmod(CURRENT, 0o600)
+    except OSError:
+        pass
 
     def clear():
         cur = None

package/ui/index.html

@@ -461,7 +461,12 @@
      make it visible", 12 Sep 2026). Its own keyboard stop with its own name
      ("Remove photo"), distinct from the fit bar's Reset -- that resets the
      QUAD; this un-chooses a SOURCE. Only present while the chip is filled. */
-  .chipwrap{position:relative;display:inline-flex;min-width:0}
+  /* Above the scrim (z 50) and beside the popover (z 51): the chip whose
+     popover is open stays visible and lit, so it is clear which source is
+     being chosen; the other chip stays clickable to switch (14 Sep 2026). The
+     top bar creates no stacking context of its own, so this z-index reaches
+     the root. */
+  .chipwrap{position:relative;display:inline-flex;min-width:0;z-index:52}
   .chipwrap .inputchip:not(.is-empty){padding-right:30px}
   .chipclear{position:absolute;right:5px;top:50%;transform:translateY(-50%);
              width:22px;height:22px;padding:0;border-radius:999px;flex:none;