screengraft 0.65.0 → 0.67.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screengraft",
-  "version": "0.65.0",
+  "version": "0.67.0",
   "description": "Put a UI screenshot or screen recording onto a photographed device screen with the perspective exactly right \u2014 a homography you confirm by hand, not a generative guess.",
   "keywords": [
     "mockup",

package/scripts/ui.py

@@ -1077,6 +1077,35 @@ class Handler(BaseHTTPRequestHandler):
                 except RenderBusy as exc:
                     return self._json({"error": str(exc)}, 409)
 
+            if u.path == "/api/reveal":
+                # Show a saved file in the desktop's file manager. The PAGE
+                # cannot do this -- a browser will not open a Finder window
+                # from an http origin -- and this server is the half of
+                # screengraft that runs on the user's machine, so it is the
+                # only thing that can.
+                #
+                # _safe_local_path is the whole security story and it already
+                # guards /file: it expands ~, resolves symlinks, refuses any
+                # path outside HOME, and requires a file that exists. The
+                # command is an argument LIST handed to the OS, never a string
+                # through a shell, so a path cannot become an argument or a
+                # second command however it is spelled.
+                try:
+                    p = _safe_local_path(b.get("path") or "")
+                except (PermissionError, FileNotFoundError, TypeError) as exc:
+                    return self._json({"error": str(exc)}, 400)
+                if sys.platform == "darwin":
+                    cmd = ["open", "-R", p]            # reveals AND selects it
+                elif os.name == "nt":
+                    cmd = ["explorer", "/select,", p]  # exits 1 even on success
+                else:
+                    cmd = ["xdg-open", os.path.dirname(p)]
+                try:
+                    subprocess.run(cmd, capture_output=True, timeout=10, check=False)
+                except (OSError, subprocess.SubprocessError) as exc:
+                    return self._json({"error": f"could not open the folder: {exc}"}, 500)
+                return self._json({"ok": True})
+
             if u.path == "/api/figma":
                 return self._json(SESSION.enqueue({
                     "type": "figma_export", "url": b["url"],

package/skills/inject-screenshot/SKILL.md

@@ -5,7 +5,7 @@ description: Injects a UI screenshot OR a screen recording onto a photographed d
 
 # Inject a screenshot onto a photographed device
 
-**What ships (v0.65):** a local browser UI (`scripts/ui.py`) that walks the designer through the whole job — pick the photo and the screen source, which may be an image **or a video** (the images you have used before, drag-drop, browse, path, or a **Figma frame link**), auto-detect the screen as a starting position — and when detection cannot tell which region is a screen, **Point at screen**: one click inside it and the detector uses that point — or, if this photograph has been fitted before, **the fit it was saved with comes back** as the starting position instead of a detection, recognised by the photo's own pixels so a rename or a drag-drop still match — and every save also writes a **portable `.fit.json` beside the mockup** that can be dropped back onto the page later, which is how a fit survives a re-export, another machine, or someone else's hands — then **match the four edges** (drag an edge's middle to slide it, near an end to pivot; corners still draggable) with canvas navigation that follows the usual conventions — **hold ⌘ and scroll to zoom to the pointer, hold space and drag to pan** — and a rectified strip loupe. The fit and the composite sit **side by side and always have** — the result pane re-renders as you drag, which is how a corner gets judged, so it is the layout rather than a mode you can switch off. Then an on-by-default realism pass that colour-matches the source to the photo's light, **Save** (or **Render**, for a video) into the project folder (`--out-dir`), and a **Send to Claude** button that reaches you through the plugin's own MCP server. The UI is a hand port of the project's Figma design file — dark only.
+**What ships (v0.67):** a local browser UI (`scripts/ui.py`) that walks the designer through the whole job — pick the photo and the screen source, which may be an image **or a video** (the images you have used before, drag-drop, browse, path, or a **Figma frame link**), auto-detect the screen as a starting position — and when detection cannot tell which region is a screen, **Point at screen**: one click inside it and the detector uses that point — or, if this photograph has been fitted before, **the fit it was saved with comes back** as the starting position instead of a detection, recognised by the photo's own pixels so a rename or a drag-drop still match — and every save also writes a **portable `.fit.json` beside the mockup** that can be dropped back onto the page later, which is how a fit survives a re-export, another machine, or someone else's hands — then **match the four edges** (drag an edge's middle to slide it, near an end to pivot; corners still draggable) with canvas navigation that follows the usual conventions — **hold ⌘ and scroll to zoom to the pointer, hold space and drag to pan** — and a rectified strip loupe. The fit and the composite sit **side by side and always have** — the result pane re-renders as you drag, which is how a corner gets judged, so it is the layout rather than a mode you can switch off. Then an on-by-default realism pass that colour-matches the source to the photo's light, **Save** (or **Render**, for a video) into the project folder (`--out-dir`), and a **Send to Claude** button that reaches you through the plugin's own MCP server. The UI is a hand port of the project's Figma design file — dark only.
 
 The geometry is exact (`warp.py`); the detection is advisory (`detect.py`) and the human corrects it. **When a detection is wrong and you want to know why**, ask for the candidate list: `POST /api/detect {"trace": true}` writes `<session>/candidates.json`, or run `python3 scripts/detect.py --photo P --out-corners /tmp/c.json --trace /tmp/t.json` (add `--click X,Y`). Every candidate quad is in there with its score and whether it was accepted, rejected, never reached, or filtered out by the click — which is what separates "the screen was never proposed" from "it was proposed and something else won".