screengraft 0.62.1 → 0.62.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screengraft",
-  "version": "0.62.1",
+  "version": "0.62.3",
   "description": "Put a UI screenshot or screen recording onto a photographed device screen with the perspective exactly right \u2014 a homography you confirm by hand, not a generative guess.",
   "keywords": [
     "mockup",

package/scripts/recents.py

@@ -39,7 +39,16 @@ def _load() -> dict:
         if not isinstance(d, dict):
             raise ValueError
     except (OSError, ValueError):
+        # No store (or an unreadable one): build it from the sessions on disk
+        # and WRITE it, or every read until the first record() walks them again.
         d = _seed()
+        for r in ROLES:
+            d.setdefault(r, [])
+        try:
+            _save(d)
+        except OSError:
+            pass
+        return d
     for r in ROLES:
         d.setdefault(r, [])
     return d
@@ -52,6 +61,10 @@ def _save(d: dict):
     with open(tmp, "w") as f:
         json.dump(d, f, indent=1)
     os.replace(tmp, p)
+    try:
+        os.chmod(p, 0o600)      # paths under the user's home: owner-only
+    except OSError:
+        pass
 
 
 def _seed() -> dict:

package/scripts/ui.py

@@ -28,6 +28,7 @@ stdlib only on the server side; OpenCV via detect/warp.
 """
 import argparse
 import atexit
+import hashlib
 import json
 import mimetypes
 import os
@@ -733,7 +734,10 @@ def _thumb_for(item):
     out_dir = os.path.join(SESSION.dir, "thumbs")
     if item.get("ext") in VIDEO_EXT:
         os.makedirs(out_dir, exist_ok=True)
-        out = os.path.join(out_dir, f"{abs(hash(item['path']))}_{int(item.get('mtime') or 0)}_clip.jpg")
+        # A stable name: hash() is salted per process, so a name built on it
+        # misses the cache on every launch.
+        key = hashlib.sha1(item["path"].encode()).hexdigest()[:16]
+        out = os.path.join(out_dir, f"{key}_{int(item.get('mtime') or 0)}_clip.jpg")
         if not os.path.exists(out):
             try:
                 fr = W.read_frame_at(item["path"], 0)
@@ -981,7 +985,10 @@ class Handler(BaseHTTPRequestHandler):
                 # The folder scan (scan.py) still exists for the CLI and for a
                 # first run with nothing used yet; ?role= selects the list.
                 role = (q.get("role") or ["photo"])[0]
-                limit = int(q.get("limit", ["40"])[0])
+                try:
+                    limit = max(1, min(200, int(q.get("limit", ["40"])[0])))
+                except ValueError:
+                    limit = 40
                 items = RECENT.items(role, limit)
                 for it in items:
                     it["thumb"] = _thumb_for(it)
@@ -1546,6 +1553,11 @@ def _publish_current(payload):
     """
     os.makedirs(os.path.dirname(CURRENT), exist_ok=True)
     _write_json_atomic(CURRENT, payload)
+    # The pointer carries the session token: owner-only, like a credential.
+    try:
+        os.chmod(CURRENT, 0o600)
+    except OSError:
+        pass
 
     def clear():
         cur = None

package/ui/index.html

@@ -574,7 +574,6 @@
   .segbtn[disabled],.segbtn[disabled]:hover{background:var(--raise-low);color:var(--mute)}
   .segbtn:focus-visible{outline-offset:-2px}
   .segbtn svg{width:16px;height:16px;display:block;flex:none}
-  .segbtn svg text{font:600 8px/1 -apple-system,BlinkMacSystemFont,"SF Pro",system-ui,sans-serif;fill:var(--ink)}
   .lrail{position:absolute;left:24px;top:48px;z-index:3;display:flex;flex-direction:column;gap:var(--s2)}
   .lrail .corners{margin-top:var(--s6)}       /* 8 + 24 = the design's 32px between rails */
   .brail{position:absolute;left:0;right:0;bottom:8px;z-index:3;display:flex;justify-content:center;
@@ -1137,7 +1136,7 @@
       <div class="lrail" id="lrail">
         <div class="bgroup" role="group" aria-label="Zoom">
           <button class="segbtn" id="czIn" aria-label="Zoom in" title="Zoom in (⌘ + scroll zooms to the pointer)"><svg viewBox="0 0 16 16" aria-hidden="true"><path fill="var(--icon)" d="M8.5 7.5H12.5V8.5H8.5V12.5H7.5V8.5H3.5V7.5H7.5V3.5H8.5V7.5Z"/></svg></button>
-          <button class="segbtn" id="cz100" aria-label="Actual size, 100%" title="Actual size — one photo pixel per screen pixel"><svg viewBox="0 0 16 16" aria-hidden="true"><path fill="var(--mute)" d="M14.1025 1.00488C14.6067 1.05621 15 1.48232 15 2V14L14.9951 14.1025C14.9472 14.573 14.573 14.9472 14.1025 14.9951L14 15H2C1.48232 15 1.05621 14.6067 1.00488 14.1025L1 14V2C1 1.44772 1.44772 1 2 1H14L14.1025 1.00488ZM2 14H14V2H2V14Z"/><text x="8" y="10.8" text-anchor="middle">1x</text></svg></button>
+          <button class="segbtn" id="cz100" aria-label="Actual size, 100%" title="Actual size — one photo pixel per screen pixel"><svg viewBox="0 0 16 16" aria-hidden="true"><path fill="var(--mute)" d="M14.1025 1.00488C14.6067 1.05621 15 1.48232 15 2V14L14.9951 14.1025C14.9472 14.573 14.573 14.9472 14.1025 14.9951L14 15H2C1.48232 15 1.05621 14.6067 1.00488 14.1025L1 14V2C1 1.44772 1.44772 1 2 1H14L14.1025 1.00488ZM2 14H14V2H2V14Z"/><g transform="translate(2.77 4.245)" fill="var(--ink)"><path d="M4.80713 7.75049L6.78906 4.85547L4.78564 1.96045H5.88672L7.26172 4.11426H7.34766L8.70654 1.96045H9.75391L7.78809 4.81787L9.78076 7.75049H8.68506L7.31543 5.56445H7.22949L5.85449 7.75049H4.80713Z"/><path d="M2.05713 7.75049V1.07422H1.97119L0 2.50293V1.48242L2.0625 0H3.02393V7.75049H2.05713Z"/></g></svg></button>
           <button class="segbtn" id="czOut" aria-label="Zoom out" title="Zoom out"><svg viewBox="0 0 16 16" aria-hidden="true"><path fill="var(--icon)" d="M12.5 8.5H3.5V7.5H12.5V8.5Z"/></svg></button>
         </div>
         <div class="bgroup">