* test(inspector): concept comparison for the panel and viewer details
Compare the Images side panel and the viewer's full details with the
concept (1600x1100 and 390x844, both themes): structure, tokens, geometry
and controls, plus copy, the acknowledged pair send, the tag chip filter
and Prompt history. mapInspectorConcept applies only D3, D20, D21 and D22;
a mutation test shows the comparison notices a changed role label and a
removed footer.
The comparison showed the role copy and send names lacked the concept's
": <title>" subject, so the inspector now passes its title to the prompt
blocks. It also showed that a recipe-linked image shows its recipe's own
category and tags (#224), which the concept fixture's recipes lack; that
is recorded as D38, and the fixture's new positive_links option links the
compared image to its positive alone.
* docs(inspector): renumber the recipe-category decision to D39
* feat(images): local-only Show in folder route
POST /prompt_manager/images/reveal takes the listing identity
{root_index, root_scope, path} and opens this computer's file manager at
that file. It answers 403 not-local unless the client is loopback, no
proxy header is present and Host/Origin name this computer; the scope is
checked with _gallery_scope_error (409) and the path resolves only inside
that root to a regular media file. Openers run as argv lists with an
absolute executable, no shell and DEVNULL streams (D38).
* feat(inspector): Show in folder after the File & provenance path
The viewer's File & provenance offers "Show in folder" right after the
Path value for a listed file only, POSTs its listing identity and toasts
the outcome (opened, not-local, unavailable or failed). The browser test
server stubs the opener; TESTING.md records the decision as D38.
* fix(images): keep the discovery alert clear of the Rescan toast
A rescan that leaves the Images discovery alert visible could show its
fixed bottom toast over the alert on a short window. The concept's toast
keeps its placement; the production-only alert now scrolls into view only
as far as needed, with a 96px block-end scroll margin (D42).
* docs(inspector): concept panel and viewer details
* fix(images): open Windows folders through the shell API, not an Explorer command line
Explorer splits its own command line on commas, so a gallery path such as
output\a,\Windows\System32\calc.exe,b\x.png escaped the roots through
[explorer, "/select,", path] (security review H1). Windows now selects the
file with ILCreateFromPathW and SHOpenFolderAndSelectItems, and on any shell
failure falls back to os.startfile on the folder. No process is started.
* fix(images): re-check, isolate and reap the Show in folder opener
- re-check that the real path is still a regular file inside its root
right before launching; a changed target answers 404 (review L4)
- run openers on a dedicated single worker, not ComfyUI's default
executor, and make dbus-send wait for the FileManager1 reply
(--print-reply --reply-timeout=2000) so a missing service falls back
to xdg-open (L1)
- reap launched processes on a daemon thread, give them a minimal
environment with a fixed system PATH, and use /usr/bin/open on macOS
and dbus-send/xdg-open resolved only on that PATH (L5)
* fix(images): accept Show in folder only as a same-origin JSON request, one at a time
- require an Origin equal to the request's own scheme://host:port and,
when sent, Sec-Fetch-Site: same-origin; refuse every forwarding-style
header (Via, X-Forwarded-*, X-Original-*, *-Client-IP, CF-Connecting-IP
and the rest) as remote (security review M1, L2)
- answer a non-JSON body with 415, so a cross-origin request always needs
a CORS preflight (L2)
- single flight plus a 1 s cooldown per process: 429 code busy (L1)
- path resolution errors such as ENAMETOOLONG are a JSON 404, and neither
that nor a start failure logs the client's path at error level (L3)
* fix(inspector): say the folder is already opening on a busy Show in folder
A 429 busy from the reveal route now toasts "The folder is already
opening." The browser workflow checks that the reveal POST carries the
page's own Origin and an application/json body, and TESTING.md D38 records
the tightened route, the toast table and the accepted residual risk of a
header-less local proxy.
* test(inspector): compare the viewer details under a coarse pointer and prove its mutations
The touch project measured production's D34 40px disclosure targets against
the concept's fine-pointer summaries. The concept's plain-chip copy now also
carries the recorded D34 coarse rule, so both documents are measured under the
same emulation. The open File & provenance is compared too (D38 Show in folder
and D20 Download original mapped), and the mutation check now removes the
viewer's pair actions and Show in folder.
* refactor(inspector): attach Show in folder to the Path value it follows
The button was placed on the second fact row by position; the Path dd is now
built by the caller and kept, so reordering the facts cannot move it.
* test(inspector): let the uncertain-file send check fail again
Inspector send buttons are named "... to ComfyUI: <title>", so the anchored
regex could never match and the no-send assertion always passed.
* fix(images): run the Windows folder fallback inside COM and keep desktop session variables
Show in folder's os.startfile fallback now runs inside the same
CoInitializeEx/CoUninitialize bracket as the shell selection, as ShellExecute
callers should. The Linux opener keeps XAUTHORITY, DESKTOP_SESSION,
XDG_SESSION_DESKTOP and XDG_CONFIG_HOME, so a file manager can reach the X11
display under GDM or SDDM and honour the user's mimeapps.list.
A Windows-only test calls the real ILCreateFromPathW and ILFree on a temp file
and pairs CoInitializeEx with CoUninitialize through the module's helper,
without SHOpenFolderAndSelectItems, so no window opens on CI.
* fix(images): scroll to the rescan's discovery alert only when the toast band covers it
D42 scrolled the alert into view after every rescan, so a user scrolled down
the grid was sent back to the top. It now scrolls only when the alert
intersects the toast's band (its scroll-margin-block-end).
* refactor(inspector): name prompt actions as PR #263 does
The title option keeps its name, default and output ("Copy positive prompt:
<title>") and now uses #263's actionName helper; the region-name arrow no
longer shadows the title option.
* test(inspector): the comparison opens Filters by its D44 active-count name
After a tag chip applies its filter, the shared toolbar's Filters button reads
"Filters · 1" (D44, #263), so the comparison opens it by that name.
* fix(images): POSIX opener paths stay absolute under Python 3.13 on Windows
Python 3.13 on Windows no longer counts "/usr/bin/x" as absolute, so the
faked-Linux reveal tests failed on windows-latest py3.13 (the Linux and macOS
openers are POSIX paths whatever host evaluates them). Use posixpath.isabs for
those lookups.
Vito
3476f8ede9