App: Try Again also works when the server is up but its page failed to load

The button was accepted only while no server was known. If the server answered
and the page then failed to load, the error page showed with the server still
known, and the button did nothing. It's now accepted from the error page itself
(the window's only data: page).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

app/main.js

@@ -1,7 +1,7 @@
 // Frame Control as a desktop app (macOS, Windows, Linux): starts ui/server.py on
 // a free loopback port and shows it in a native window. The server does all the
 // work over the `frame` SSH alias; this file only hosts it.
-const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, shell } = require("electron");
+const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, nativeImage, shell } = require("electron");
 const { execFile, spawn } = require("child_process");
 const { promisify } = require("util");
 const fs = require("fs");
@@ -149,7 +149,7 @@ async function startServer() {
   const target = `http://127.0.0.1:${port}/`;
   for (let i = 0; i < 100; i++) {
     if (exited !== null) throw new Error(`The server exited (${exited}). See ${LOG}.`);
-    if (await ping(target)) { url = target; return; }
+    if (await ping(target)) { url = target; serverStarted = Date.now(); return; }
     await new Promise((r) => setTimeout(r, 100));
   }
   if (server === child) server = null;
@@ -175,18 +175,27 @@ function stopServer() {
   if (server) endServer(server);
 }
 
-function errorPage(message) {
+function errorPage(message, title = "Frame Control couldn't start") {
   const esc = (s) => s.replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" }[c]));
   const html = `<!doctype html><meta charset="utf-8"><body style="margin:0;height:100vh;display:grid;
     place-items:center;background:${BG};color:#e6edf3;font:14px -apple-system,sans-serif">
-    <div style="max-width:560px;padding:32px;line-height:1.5"><h2>Frame Control couldn't start</h2>
-    <p>${esc(message)}</p><p style="color:#8b98a8">Fix it, then choose Frame → Restart Server.</p></div>`;
+    <div style="max-width:560px;padding:32px;line-height:1.5"><h2>${esc(title)}</h2>
+    <p>${esc(message)}</p>
+    <p><button onclick="this.disabled = true; frameApp.restartServer()" style="font:inherit;padding:6px 16px;
+      border-radius:6px;border:1px solid #30363d;background:#21262d;color:inherit;cursor:pointer">Try Again</button></p>
+    <p style="color:#8b98a8">Frame → Restart Server does the same.</p></div>`;
   return "data:text/html;charset=utf-8," + encodeURIComponent(html);
 }
 
+// A server that had been running starts again by itself (something stopped it: a
+// signal, a crash). One that stops again within a minute shows the error instead,
+// so a server that can't stay up doesn't restart forever.
+let serverStarted = 0;
 function serverDied(why) {
   url = null;
-  if (win) win.loadURL(errorPage(`The server stopped unexpectedly (${why}). See ${LOG}.`));
+  if (!win) return;
+  if (Date.now() - serverStarted > 60000) restartServer();
+  else win.loadURL(errorPage(`Its server stopped unexpectedly (${why}). See ${LOG}.`, "Frame Control stopped"));
 }
 
 // Restarts that overlap share one: two could each start a server, and the one
@@ -263,7 +272,20 @@ function fromUi(e) {
   } catch { return false; }
 }
 
+// The error page's Try Again button. The error page is the only data: page the window
+// shows (`url` can still be set then: the server answered but the page failed to load).
+ipcMain.handle("server:restart", (e) => {
+  if (win && e.sender === win.webContents && e.senderFrame && e.senderFrame.url.startsWith("data:")) restartServer();
+});
 ipcMain.handle("clipboard:read", (e) => fromUi(e) ? clipboard.readText() : "");
+// A PNG or JPEG (a screenshot) onto the clipboard as an image.
+ipcMain.handle("clipboard:writeImage", (e, bytes) => {
+  if (!fromUi(e) || !(bytes instanceof Uint8Array)) return false;
+  const img = nativeImage.createFromBuffer(Buffer.from(bytes));
+  if (img.isEmpty()) throw new Error("not an image");
+  clipboard.writeImage(img);
+  return true;
+});
 ipcMain.handle("connection:setup", (e) => { if (fromUi(e)) setUpConnection(); });
 ipcMain.on("keys:capture", (e, on) => { if (fromUi(e)) win.webContents.setIgnoreMenuShortcuts(on === true); });
 ipcMain.handle("update:get", (e) => fromUi(e) ? publicUpdate() : null);

app/preload.js

@@ -2,8 +2,8 @@
 // to the Frame needs no pbpaste, PowerShell, xclip or wl-clipboard. Also tells
 // the page where a dropped file or folder lives, so a folder can be sideloaded
 // as a title without zipping it (the local server reads it from there).
-// It can open Set Up Connection when the headset can't be reached, and keeps the
-// Frame menu's list of headsets up to date.
+// It can put a screenshot on the clipboard as an image, open Set Up Connection when
+// the headset can't be reached, and keeps the Frame menu's list of headsets up to date.
 // It also receives frame-control://install links (docs/web-install.md): only
 // what the link asked for, never an install; the page asks the user first.
 // And it passes update state both ways: see app/updater.js.
@@ -12,7 +12,9 @@ const { contextBridge, ipcRenderer, webUtils } = require("electron");
 contextBridge.exposeInMainWorld("frameApp", {
   notify: (message, request) => ipcRenderer.invoke("comfort:notify", message, request),
   readClipboard: () => ipcRenderer.invoke("clipboard:read"),
+  writeImage: (bytes) => ipcRenderer.invoke("clipboard:writeImage", bytes),
   setUpConnection: () => ipcRenderer.invoke("connection:setup"),
+  restartServer: () => ipcRenderer.invoke("server:restart"),  // the "couldn't start" page's Try Again
   // The Frame menu's headset switcher: the page tells it the headsets, and hears picks.
   devicesChanged: (list) => ipcRenderer.send("devices:changed", list),
   onUseDevice: (cb) => {

docs/privacy.md

@@ -107,14 +107,7 @@ wrote, a short reference shown after sending, and the diagnostics below. Your
 email address goes with it only if you tick **The maintainer may contact me
 with follow-up questions** (the report then carries `contact_followup: true`);
 it's filled in from **Contact email** below when you've agreed there. It has its own random id, so it isn't linked to
-your analytics events. With that box ticked, the address also becomes your
-**Contact email** below with follow-up questions ticked, so you remove it there
-like any other. If it's a different address from the one saved there, it
-replaces it, and update notices stop until you turn them on again (they were
-agreed for the old address); the form says so before you send. The report then also
-carries this copy's contact id and change number (`contact_id`, `contact_rev`,
-see below), so removing or changing the address later takes back the
-follow-up permission given with the report too.
+your analytics events.
 
 With **Include diagnostics** ticked (the default), the report adds:
 
@@ -148,8 +141,8 @@ are two separate choices, both off until you tick them:
 | **The maintainer may contact me with follow-up questions** | Questions about problem reports you send, mostly |
 
 You're asked once, in a bar at the top of the page, after the Frame has
-connected for the first time, and never in the same visit as the first-run
-privacy notice. **No thanks** hides it for good, and it isn't
+connected for the first time, and never while or straight after the
+first-run privacy notice is showing. **No thanks** hides it for good, and it isn't
 shown again even if you ignore it. **Contact email** in **Privacy & updates**
 is where you add, change or remove the address and either choice at any time.
 
@@ -158,10 +151,7 @@ Frame Control's PostHog project, the same place as problem reports, as a
 `contact_consent` event with `email`, `updates`, `followup`, `action` (`set`
 or `withdraw`) and the common properties above. Only the maintainer can read
 that project, and nothing in it is published or shared. It's sent only when
-you save, or when you send a problem report with follow-up questions ticked,
-whatever the analytics settings are, because you chose to. With a report, the
-address and choices are saved before the report is sent and stay saved if it
-fails; like any change, they're sent as soon as PostHog can be reached. It
+you save, whatever the analytics settings are, because you chose to. It
 carries its own random contact id, not the analytics id, so it isn't linked
 to your usage events, and a `rev` number that goes up with each change, so
 the newest choice always wins. Like everything else sent, it's listed under
@@ -174,11 +164,7 @@ deletes it from this computer, including from the **Show what's been sent**
 log (in earlier contact events and problem reports), and sends a `withdraw`
 event with no address in it. The maintainer's list only uses the newest event from each copy, so from
 then on the address isn't listed for either choice. Unticking one choice
-works the same way for that choice. This also covers problem reports you sent
-from this copy with follow-up questions ticked: if your newest choice since the
-report (by change number, not the clock) no longer agrees to follow-up
-questions at that address, the maintainer's inbox shows the permission as
-withdrawn and leaves the address out. If you're offline, the change waits on
+works the same way for that choice. If you're offline, the change waits on
 this computer and is sent when PostHog can be reached. The earlier event
 stays in PostHog until its data retention removes it; to have it deleted
 sooner, ask the maintainer (for example in a problem report).

tests/test_contact.py

@@ -59,16 +59,6 @@ class Contact(Base):
         self.assertEqual(fc.load()["email"], "")
         self.assertEqual(self.got, [])
 
-    def test_only_a_real_true_counts_as_consent(self):
-        for wrong in ("false", "true", 1, 0, [], {}):
-            with self.assertRaisesRegex(ValueError, "true or false"):
-                fc.save({"email": "me@example.com", "updates": wrong, "followup": True})
-            with self.assertRaisesRegex(ValueError, "true or false"):
-                fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": wrong})
-        self.assertEqual((fc.load()["email"], self.got), ("", []))
-        fc.save({"email": "me@example.com", "updates": True})  # left out is no
-        self.assertEqual((fc.load()["updates"], fc.load()["followup"]), (True, False))
-
     def test_each_choice_is_sent_privately_on_its_own(self):
         fc.save({"email": " me@example.com ", "updates": True})
         fc.save({"email": "me@example.com", "updates": False, "followup": True})
@@ -249,121 +239,15 @@ class Contact(Base):
 
     # ---- reports and the maintainer's list
 
-    def reports(self):
-        return [e["properties"] for e in self.events() if e["event"] == "problem_report"]
-
     def test_a_report_carries_the_address_only_with_follow_up_consent(self):
         fr.send({**REPORT, "contact": "me@example.com"})
-        self.assertFalse(fc.FILE.exists())  # no follow-up: nothing kept, nothing linked
         fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        without, with_ = self.reports()
-        self.assertEqual((without["contact"], without["contact_followup"], without["contact_id"]), ("", False, ""))
+        without, with_ = (e["properties"] for e in self.events())
+        self.assertEqual((without["contact"], without["contact_followup"]), ("", False))
         self.assertEqual((with_["contact"], with_["contact_followup"]), ("me@example.com", True))
-        self.assertEqual((with_["contact_id"], with_["contact_rev"]), (fc.load()["id"], fc.load()["rev"]))
-        self.assertNotEqual(with_["contact_id"], tm.settings()["id"])  # not the analytics id
         with self.assertRaisesRegex(ValueError, "email address"):
             fr.send({**REPORT, "contact": "discord:me", "contactFollowup": True})
 
-    def test_follow_up_given_with_a_report_is_kept_and_removed_in_settings(self):
-        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        s = fc.state()
-        self.assertEqual((s["email"], s["updates"], s["followup"]), ("me@example.com", False, True))
-        consent = [e for e in self.events() if e["event"] == "contact_consent"]
-        self.assertEqual([(e["properties"]["action"], e["properties"]["rev"]) for e in consent], [("set", 1)])
-        self.assertEqual(consent[0]["distinct_id"], self.reports()[0]["contact_id"])
-        fr.send({**REPORT, "contact": "ME@example.com", "contactFollowup": True})  # already agreed
-        self.assertEqual(len([e for e in self.events() if e["event"] == "contact_consent"]), 1)
-        self.assertEqual(self.reports()[1]["contact_rev"], 1)
-        fc.save({"email": ""})  # Remove my email
-        last = self.events()[-1]
-        self.assertEqual((last["properties"]["action"], last["properties"]["email"], last["properties"]["rev"]),
-                         ("withdraw", "", 2))
-        logged = [e["properties"].get("contact") for e in tm._read_lines(tm.SENT) if e["event"] == "problem_report"]
-        self.assertEqual(logged, ["<removed>", "<removed>"])
-
-    def test_a_report_to_another_address_replaces_it_with_follow_up_only(self):
-        """Update notices were agreed for the old address, not the new one (the form says so)."""
-        fc.save({"email": "old@example.com", "updates": True})
-        fr.send({**REPORT, "contact": "new@example.com", "contactFollowup": True})
-        s = fc.state()
-        self.assertEqual((s["email"], s["updates"], s["followup"]), ("new@example.com", False, True))
-        self.assertEqual(self.reports()[0]["contact_rev"], 2)
-        fc.save({"email": "new@example.com", "updates": True, "followup": False})
-        fr.send({**REPORT, "contact": "NEW@example.com", "contactFollowup": True})  # same address: kept
-        s = fc.state()
-        self.assertEqual((s["email"], s["updates"], s["followup"]), ("new@example.com", True, True))
-
-    def test_a_removal_while_the_report_saves_its_address_still_counts(self):
-        """Removed while the report's own consent is on its way: the report keeps that consent's
-        rev (so the removal is newer) and is logged without the address."""
-        post, removed = tm.post, []
-
-        def slow_post(events, **kw):
-            post(events, **kw)
-            if not removed and events[0]["event"] == "contact_consent":
-                removed.append(fc.save({"email": ""}))  # Remove my email, mid-send
-        with mock.patch.object(tm, "post", side_effect=slow_post):
-            fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        report = self.reports()[0]
-        self.assertEqual((report["contact_rev"], fc.load()["rev"], fc.state()["email"]), (1, 2, ""))
-        consents = [[e["distinct_id"], e["properties"]["email"], e["properties"]["followup"], e["properties"]["rev"]]
-                    for e in self.events() if e["event"] == "contact_consent"]
-        row = self.report_row(cid=report["contact_id"], rev=report["contact_rev"])
-        fr.mark_withdrawn([row], consents)
-        self.assertEqual(row[10], "withdrawn")
-        logged = [e["properties"]["contact"] for e in tm._read_lines(tm.SENT) if e["event"] == "problem_report"]
-        self.assertEqual(logged, ["<removed>"])
-
-    def report_row(self, contact="me@example.com", followup=True, cid="copy", rev=1):
-        return ["2026-09-10T10:00:00Z", "AB12CD34", "bug", "RDP", "It never connects.", contact,
-                "0.4.0", "Windows", "", "", followup, cid, rev]
-
-    def test_a_later_change_takes_back_a_reports_follow_up_permission(self):
-        reports = [self.report_row(),                                   # removed later
-                   self.report_row(cid="other"),                        # another copy, still agrees
-                   self.report_row(rev=3),                              # sent after the removal
-                   self.report_row(cid="moved"),                        # address changed later
-                   self.report_row(cid="news-only"),                    # follow-up unticked later
-                   self.report_row(contact="Me@Example.com", cid="case"),  # same address, any case
-                   self.report_row(cid="", followup=True),              # no contact id: left alone
-                   self.report_row(cid="bad", rev="x")]                 # malformed rev: treated as 0
-        consents = [["copy", "me@example.com", True, 1], ["copy", "", False, 2],
-                    ["other", "me@example.com", True, 1], ["other", "me@example.com", True, 2],
-                    ["moved", "new@example.com", True, 2], ["news-only", "me@example.com", False, 2],
-                    ["case", "me@example.com", True, 2], ["bad", "", False, 1], ["short"], ["x", "", False, "?"]]
-        fr.mark_withdrawn(reports, consents)
-        self.assertEqual([r[10] for r in reports],
-                         ["withdrawn", True, True, "withdrawn", "withdrawn", True, True, "withdrawn"])
-
-    def test_the_change_number_decides_not_the_clock(self):
-        """The clock went back between the report and the removal: the removal still counts."""
-        fr.send({**REPORT, "contact": "me@example.com", "contactFollowup": True})
-        with mock.patch.object(fc.time, "gmtime", return_value=time.gmtime(0)):
-            fc.save({"email": ""})
-        report = self.reports()[0]
-        row = self.report_row(cid=report["contact_id"], rev=report["contact_rev"])
-        consents = [[e["distinct_id"], e["properties"]["email"], e["properties"]["followup"], e["properties"]["rev"]]
-                    for e in self.events() if e["event"] == "contact_consent"]
-        self.assertEqual(self.events()[-1]["timestamp"], "1970-01-01T00:00:00Z")
-        fr.mark_withdrawn([row], consents)
-        self.assertEqual(row[10], "withdrawn")
-
-    def test_the_inbox_shows_withdrawn_follow_up_without_the_address(self):
-        reports = [self.report_row(), ["short"]]
-        consents = [["copy", "", False, 2]]
-        with mock.patch.object(db, "_posthog_query", side_effect=[{"results": reports}, {"results": consents}]) as q, \
-             mock.patch.object(sys, "argv", ["frame_report.py", "inbox", "30"]), \
-             mock.patch("builtins.print") as out:
-            fr.main()
-        self.assertIn("properties.contact_rev", q.call_args_list[0].args[0])
-        self.assertIn("event = 'contact_consent'", q.call_args_list[1].args[0])
-        printed = " ".join(str(c.args[0]) for c in out.call_args_list if c.args)
-        self.assertIn("follow-up permission since withdrawn", printed)
-        self.assertNotIn("me@example.com", printed)
-        with mock.patch.object(db, "_posthog_query", return_value={"results": [self.report_row(followup=False)]}) as q:
-            fr.inbox()
-        self.assertEqual(q.call_count, 1)  # nothing to reconcile, no second query
-
     def test_contacts_lists_the_newest_choice_per_copy_by_consent(self):
         rows = [["a", "both@example.com", True, "true", "2026-09-01T10:00:00Z"],
                 ["b", "news@example.com", "true", False, "2026-09-02T10:00:00Z"],
@@ -388,22 +272,6 @@ class Contact(Base):
         self.assertIs(server.POST["/api/contact"], fc.save)
         self.assertIs(server.POST["/api/contact/prompt"], fc.prompt)
 
-    def test_saving_is_not_headset_work(self):
-        """A slow send mustn't hold up switching headsets, nor be refused after a switch."""
-        import io
-        import server
-        seen = []
-        for path in ("/api/contact", "/api/contact/prompt"):
-            h = server.Handler.__new__(server.Handler)
-            body = b'{"prompt": "shown"}' if path.endswith("prompt") else b'{"email": "me@example.com", "updates": true}'
-            h.path, h.rfile = path, io.BytesIO(body)
-            h.headers = {"Content-Length": str(len(body)), "X-Frame-Device": "a-headset-switched-away-from"}
-            h.local_request = lambda: True
-            h.send_json = lambda obj, status=200: seen.append((status, server._work[0]))
-            with mock.patch.object(fc, "_send_pending", side_effect=lambda block=True: seen.append(("send", server._work[0]))):
-                h.do_POST()
-        self.assertEqual(seen, [("send", 0), (200, 0), (200, 0)])
-
 
 # Run these once, in test_telemetry, not again through the import above.
 del Base, ReportProblem

tests/test_server.py

@@ -111,6 +111,8 @@ class ServerGuards(unittest.TestCase):
             ("/api/volume", {"level": 1.5}),
             ("/api/clipboard", {"text": ""}),
             ("/api/open", {"what": "anything-else"}),
+            ("/api/open", {"what": "shot", "id": "1/250820/../../.ssh/id_ed25519"}),
+            ("/api/open", {"what": "shot"}),
             ("/api/shots/save", {"ids": []}),
             ("/api/shots/save", {"ids": "1/250820/20260925225208_1.jpg"}),
             ("/api/shots/save", {"ids": [1]}),
@@ -121,6 +123,10 @@ class ServerGuards(unittest.TestCase):
             status, payload = self.post(path, body)
             self.assertEqual(status, 400, f"{path} {body} -> {payload}")
 
+    def test_showing_a_shot_needs_it_saved_here(self):
+        status, payload = self.post("/api/open", {"what": "shot", "id": "1/250820/19990101000000_1.jpg"})
+        self.assertEqual(status, 404, payload)
+
     def test_screenshot_ids_checked_before_ssh(self):
         for shot in ("../../etc/passwd", "1/250820/x.jpg", "1/2/20260925225208_1.jpg;id", "1/250820/20260925225208_1.gif"):
             status, _, _ = self.request("GET", f"/api/shots/image?id={quote(shot)}", headers={"X-Frame-UI": "1"})
@@ -279,6 +285,18 @@ class OneServer(unittest.TestCase):
         r = conn.getresponse()
         self.assertEqual(r.status, 403, r.read())
 
+    @unittest.skipIf(os.name == "nt", "no SIGTERM on Windows")
+    def test_sigterm_while_the_app_holds_stdin_exits_cleanly(self):
+        """The app keeps stdin open; a stop signal used to abort Python (SIGABRT) at exit."""
+        env = {**os.environ, "FRAME_CONTROL_DATA_DIR": tempfile.mkdtemp(prefix="frame-one-server-"),
+               "FRAME_ALIAS": "frame-control-test.invalid"}
+        proc = subprocess.Popen([sys.executable, str(ROOT / "ui" / "server.py"), "--port", "0", "--exit-on-eof"],
+                                env=env, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
+        self.addCleanup(lambda: (proc.stdin.close(), proc.stdout.close()))
+        self.assertIn("Frame Control on", proc.stdout.readline())
+        proc.terminate()
+        self.assertEqual(proc.wait(30), 0, proc.stdout.read())
+
 
 class ArtworkSettings(unittest.TestCase):
     """The settings panel's endpoints, with and without the page's X-Frame-UI key."""

tests/test_telemetry.py

@@ -391,16 +391,15 @@ class ReportProblem(Base):
     def test_send_is_a_private_posthog_event_whatever_the_settings(self):
         got = self.serve()
         tm.update_settings({"usage": False})  # analytics off: a deliberate report still goes
-        with mock.patch.object(fr.frame_contact, "from_report", return_value=("contact-id", 1)):  # test_contact
-            res = fr.send({"kind": "idea", "title": "Live view stops", "message": "It stops after a minute.",
-                           "contact": "me@example.com", "contactFollowup": True})
+        res = fr.send({"kind": "idea", "title": "Live view stops", "message": "It stops after a minute.",
+                       "contact": "me@example.com", "contactFollowup": True})
         path, body = got[0]
         event = body["batch"][0]
         self.assertEqual((path, body["api_key"], event["event"]), ("/batch/", "phc_test", "problem_report"))
         props = event["properties"]
         self.assertEqual((props["kind"], props["title"], props["message"], props["contact"], props["report_id"]),
                          ("idea", "Live view stops", "It stops after a minute.", "me@example.com", res["id"]))
-        self.assertEqual((props["contact_followup"], props["contact_id"], props["contact_rev"]), (True, "contact-id", 1))
+        self.assertIs(props["contact_followup"], True)
         self.assertEqual((props["$process_person_profile"], props["$geoip_disable"]), (False, True))
         self.assertNotEqual(event["distinct_id"], tm.settings()["id"])  # not linked to the analytics
         self.assertIn(res["id"], res["message"])
@@ -423,8 +422,8 @@ class ReportProblem(Base):
 
     def test_the_inbox_skips_malformed_reports(self):
         good = ["2026-09-28T09:50:00Z", "AB12CD34", "bug", "Live view stops", "It stops.", None,
-                "0.4.0", "macOS", "", "", None, None, None]
-        rows = [["2026-09-28T10:00:00Z", "X", "bug", "Hand-made", None, None, None, None, None, None, None, None, None],
+                "0.4.0", "macOS", "", "", None]
+        rows = [["2026-09-28T10:00:00Z", "X", "bug", "Hand-made", None, None, None, None, None, None, None],
                 ["short"], good]
         with mock.patch.object(db, "_posthog_query", return_value={"results": rows}), \
              mock.patch.object(sys, "argv", ["frame_report.py", "inbox"]), \

ui/frame_contact.py

@@ -71,31 +71,6 @@ def valid_email(email):
     return len(email) <= EMAIL_MAX and bool(EMAIL_RE.fullmatch(email))
 
 
-def flag(body, key):
-    """A consent choice: true only when it really is true (not "false" or 1), left out is no."""
-    v = body.get(key)
-    if v is not None and not isinstance(v, bool):
-        raise ValueError(f'{key} must be true or false')
-    return v is True
-
-
-def from_report(email):
-    """Follow-up questions agreed to with a problem report: the address becomes the contact
-    email with that choice ticked, so it shows in Settings and is removed the same way. Update
-    notices stay on only for the same address: a different one replaces the old address with
-    follow-up questions only (the report form says so before sending). Returns (contact id,
-    rev) for the report to carry, read together with the change itself: a later change from
-    this copy has a higher rev, and the newest such change decides whether the report's
-    follow-up permission still stands, whatever the clocks say."""
-    with _lock:
-        s = load()
-        same = s['email'].lower() == email.lower()
-        changed, cid, rev = _apply({'email': s['email'] if same else email,
-                                    'updates': s['updates'] and same, 'followup': True})
-    _deliver(changed)
-    return cid, rev
-
-
 def state():
     """What the page shows. showPrompt: the one-time prompt hasn't been shown or answered yet,
     and the Frame has connected at least once (setup worked), so it never greets a new install."""
@@ -180,14 +155,8 @@ def redact_removed(event, started):
 def save(body):
     """Set, change or remove the address and the two choices. An address needs at least one
     choice ticked; an empty address (or neither ticked) removes it and withdraws both."""
-    _deliver(_apply(body)[0])
-    return state()
-
-
-def _apply(body):
-    """save()'s change, kept here and waiting to send. Returns (changed, contact id, rev)."""
     email = str(body.get('email') or '').strip()
-    updates, followup = flag(body, 'updates'), flag(body, 'followup')
+    updates, followup = bool(body.get('updates')), bool(body.get('followup'))
     if email and not valid_email(email):
         raise ValueError("that doesn't look like an email address")
     if email and not (updates or followup):
@@ -212,12 +181,9 @@ def _apply(body):
                 _forget_locally(old)
             except OSError:
                 pass
-        return changed, s['id'], s['rev']
-
-
-def _deliver(changed):
     if changed and not _send_pending(block=False):
         _wake.set()  # offline, or a send under way that will take this change with it
+    return state()
 
 
 def prompt(body):

ui/frame_host.py

@@ -153,6 +153,19 @@ def open_path(path):
                      stderr=subprocess.DEVNULL, **DETACHED)
 
 
+def reveal_path(path):
+    """Show a file selected in its folder (Linux file managers vary, so there the folder opens)."""
+    path = Path(path)
+    if MAC:
+        cmd = ["open", "-R", str(path)]
+    elif WINDOWS:
+        cmd = f'explorer /select,"{path}"'  # as one string: Explorer wants the quotes after the comma
+    else:
+        return open_path(path.parent)
+    subprocess.Popen(cmd, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                     stderr=subprocess.DEVNULL, **DETACHED)
+
+
 open_url = open_path  # the same openers hand URLs to the default browser
 
 

ui/frame_report.py

@@ -112,22 +112,18 @@ def send(body):
     """Send the report to PostHog. Returns {"id", "message"}; raises ReportError."""
     kind = body.get('kind') if body.get('kind') in KINDS else 'bug'
     title, text, diag = compose(body)
-    followup = frame_contact.flag(body, 'contactFollowup')
+    followup = bool(body.get('contactFollowup'))
     contact = str(body.get('contact') or '').strip() if followup else ''
     if followup and not frame_contact.valid_email(contact):
         raise ValueError('add your email address for follow-up questions, or untick that box')
-    started = time.time()  # a removal from now on (even while saving the address) is redacted from the log
-    # It becomes the contact email in Settings, where it's changed or removed like any other.
-    contact_id, contact_rev = frame_contact.from_report(contact) if followup else ('', 0)
     ref = uuid.uuid4().hex[:8].upper()
     props = {**frame_telemetry.common(), 'kind': kind, 'title': title, 'message': text,
              'contact': contact, 'contact_followup': followup, 'diagnostics': diag,
-             # Only with an address: a later change from this copy (higher rev) can take it back.
-             'contact_id': contact_id, 'contact_rev': contact_rev,
              'report_id': ref, 'steamos': str(frame.get('build') or '')[:120], 'level': 'report'}
     # Its own random id: a report can carry contact details, so it isn't linked to this copy's analytics.
     event = {'event': 'problem_report', 'distinct_id': str(uuid.uuid4()), 'uuid': str(uuid.uuid4()),
              'timestamp': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()), 'properties': props}
+    started = time.time()
     try:
         frame_telemetry.post([event], timeout=30)
     except frame_telemetry.SendError as e:
@@ -147,50 +143,15 @@ class ReportError(RuntimeError):
 
 def inbox(days=30):
     """The maintainer's recent reports from PostHog, newest first (needs the personal API key
-    frame_compat_db.sync uses). Column 10 is whether the person may be asked follow-up
-    questions now: 'withdrawn' when a later choice from the same copy took it back."""
+    frame_compat_db.sync uses)."""
     import frame_compat_db
-    days = int(days)
     res = frame_compat_db._posthog_query(
         "SELECT timestamp, properties.report_id, properties.kind, properties.title, properties.message, "
         "properties.contact, properties.app_version, properties.os, properties.steamos, properties.diagnostics, "
-        "properties.contact_followup, properties.contact_id, properties.contact_rev "
-        f"FROM events WHERE event = 'problem_report' AND timestamp > now() - INTERVAL {days} DAY "
+        "properties.contact_followup "
+        f"FROM events WHERE event = 'problem_report' AND timestamp > now() - INTERVAL {int(days)} DAY "
         "ORDER BY timestamp DESC LIMIT 200")
-    rows = [r for r in res.get('results') or [] if isinstance(r, list) and len(r) == 13]
-    if any(r[11] and _yes(r[10]) for r in rows):
-        later = frame_compat_db._posthog_query(
-            "SELECT distinct_id, properties.email, properties.followup, ifNull(toInt(properties.rev), 0) "
-            "FROM events WHERE event = 'contact_consent' LIMIT 100000")
-        mark_withdrawn(rows, later.get('results') or [])
-    return rows
-
-
-def mark_withdrawn(reports, consents):
-    """Mark reports whose follow-up permission was taken back: the newest contact choice from
-    the same copy made after the report (a higher rev than it carries, not a later clock) no
-    longer agrees to follow-up questions at that address."""
-    newest = {}
-    for c in consents:
-        if not isinstance(c, list) or len(c) != 4:
-            continue
-        cid, email, followup, rev = c
-        try:
-            rev = int(rev or 0)
-        except (TypeError, ValueError):
-            continue
-        if rev > newest.get(str(cid), (-1,))[0]:
-            newest[str(cid)] = (rev, str(email or ''), followup)
-    for r in reports:
-        if not (r[11] and _yes(r[10])):
-            continue
-        try:
-            sent_at = int(r[12] or 0)
-        except (TypeError, ValueError):
-            sent_at = 0
-        rev, email, followup = newest.get(str(r[11]), (-1, '', None))
-        if rev > sent_at and not (_yes(followup) and email.strip().lower() == str(r[5] or '').strip().lower()):
-            r[10] = 'withdrawn'
+    return res.get('results') or []
 
 
 def _yes(v):
@@ -243,13 +204,14 @@ def main():
     if cmd != 'inbox':
         sys.exit(USAGE)
     for row in inbox(*(args[:1] or [30])):
+        if not isinstance(row, list) or len(row) != 11:
+            continue
         ts, ref, kind, title, text, contact, version, osname, steamos, diag = (str(v or '') for v in row[:10])
         # Reports from before contact_followup existed only carried an address given for a reply.
         reply = contact and (row[10] is None or _yes(row[10]))
         print(f"== {ts[:16].replace('T', ' ')}  {ref}  [{kind}] {title}")
         print(f"   {version} on {osname}, SteamOS {steamos or 'unknown'}"
-              f"{', may follow up at ' + contact if reply else ''}"
-              f"{', follow-up permission since withdrawn' if row[10] == 'withdrawn' else ''}")
+              f"{', may follow up at ' + contact if reply else ''}")
         print('   ' + text.replace('\n', '\n   '))
         if diag:
             print('   --- diagnostics\n   ' + diag.replace('\n', '\n   '))

ui/index.html

@@ -258,7 +258,12 @@
   .shot-card .row { flex-wrap: nowrap; }
   .shot-card .grow { flex: 1; min-width: 0; }
   .shot-card .t { color: var(--bright); font-size: 13px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-  .shot-card .s { color: var(--muted); font-size: 12px; }
+  .shot-card .s { color: var(--muted); font-size: 12px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .ctx-menu { position: fixed; z-index: 1000; min-width: 200px; padding: 4px; border-radius: 4px; background: #232c38;
+              box-shadow: 0 10px 28px rgba(0,0,0,.6), 0 0 0 1px rgba(255,255,255,.08); }
+  .ctx-menu button { display: block; width: 100%; height: 30px; padding: 0 10px; text-align: left; background: none; }
+  .ctx-menu button:hover, .ctx-menu button:focus-visible { background: var(--blue); color: #fff; outline: none; }
+  .ctx-menu hr { border: 0; border-top: 1px solid rgba(255,255,255,.1); margin: 4px 2px; }
 
   /* ---- library shelf (portrait capsules, like Steam's library home) ---- */
   .shelf { display: grid; grid-template-columns: repeat(auto-fill, minmax(150px, 1fr)); gap: 16px; }
@@ -717,6 +722,7 @@
           <button class="action" id="shotBtn">Capture</button>
           <button id="liveBtn" title="Keep updating, as video">Live</button>
           <button id="ctrlBtn" title="Control the Frame by tapping or clicking on the view (C)">Control</button>
+          <button id="copyBtn" disabled title="Copy the image to the clipboard (or right-click it)">Copy</button>
           <button id="saveBtn" disabled>Save</button>
         </span>
       </div>
@@ -883,7 +889,7 @@
       <button class="action small" id="shotsSaveNew" disabled>Save new to this computer</button>
     </div>
     <div class="shot-grid" id="shotGrid"><div class="sub">Loading…</div></div>
-    <div class="hint">Screenshots you take in the headset with Steam's screenshot shortcut. Click one to open it in the viewer; Save copies it to <code>~/Pictures/SteamFrame</code>.</div>
+    <div class="hint">Screenshots you take in the headset with Steam's screenshot shortcut. New ones appear on their own. Click one to open it in the viewer, Copy puts it on the clipboard, and Save copies it to <code>~/Pictures/SteamFrame</code>. Right-click for more.</div>
   </section>
   </div>
 
@@ -1262,9 +1268,8 @@
     <label class="field">What happened?<textarea id="bugText" maxlength="5000" required minlength="10"
       placeholder="What you did, what happened, and what you expected."></textarea></label>
     <label class="popt"><input type="checkbox" id="bugFollowup"><b>The maintainer may contact me with follow-up questions</b>
-      <span class="sub">Optional. Your email address goes with this report only when this is ticked, and is kept as your contact email in Privacy &amp; updates, where you can remove it.</span></label>
+      <span class="sub">Optional. Your email address goes with this report only when this is ticked.</span></label>
     <label class="field">Your email address<input type="email" id="bugContact" maxlength="254" placeholder="you@example.com" disabled></label>
-    <p class="hint" id="bugReplaces" role="status" hidden></p>
     <label class="popt"><input type="checkbox" id="bugDiag" checked><b>Include diagnostics</b>
       <span class="sub">Frame Control's version, your OS and the Frame's SteamOS build.</span></label>
     <label class="popt"><input type="checkbox" id="bugLogs"><b>Also include recent activity and the server log</b>
@@ -1899,7 +1904,7 @@ async function capture() {
     if (source === "panel") $("srcBadge").textContent = `Desktop · ${shotPanel?.name || "panel"}`;
     ctrlShow();
     $("stamp").hidden = false; $("stamp").textContent = new Date().toLocaleTimeString();
-    $("saveBtn").disabled = false;
+    $("saveBtn").disabled = $("copyBtn").disabled = false;
     return true;
   } catch (e) {
     log("Capture failed: " + e.message, "e");
@@ -1981,7 +1986,7 @@ async function startVideo() {
         $("viewer").classList.remove("busy");
         c.hidden = false; $("viewerEmpty").hidden = true; $("zoombar").hidden = false; $("asleep").hidden = true;
         $("srcBadge").hidden = false; $("srcBadge").textContent = `${video.label} · video`;
-        $("stamp").hidden = false; $("saveBtn").disabled = false;
+        $("stamp").hidden = false; $("saveBtn").disabled = $("copyBtn").disabled = false;
       }
       frames++;
       const now = performance.now();
@@ -2050,6 +2055,35 @@ $("saveBtn").onclick = () => lastShot ? download(lastShot.blob, lastShot.file) :
   if (!b) return toast("Couldn't encode the image", true);
   download(b, `frame-${view}-${new Date().toISOString().replace(/[:.]/g, "-")}.png`);
 }, "image/png");
+const copyViewer = () => act("Copy image", () => copyImage(lastShot ? lastShot.blob
+  : new Promise((ok, bad) => $("canvas").toBlob(b => b ? ok(b) : bad(new Error("couldn't encode the image")), "image/png"))));
+$("copyBtn").onclick = copyViewer;
+// Right-click the viewer to copy or save what it shows (in Control, a right-click goes to the Frame).
+$("canvas").oncontextmenu = e => {
+  if (ctrl.on || $("saveBtn").disabled) return;
+  e.preventDefault();
+  showMenu(e, [["Copy image", copyViewer], ["Save image", () => $("saveBtn").click()]]);
+};
+// An image onto the clipboard. The app does it natively (JPEG too); a browser
+// takes PNG only, and the blob is handed over as a promise so the click still counts.
+async function copyImage(blob) {
+  if (window.frameApp?.writeImage) {
+    if (!await window.frameApp.writeImage(new Uint8Array(await (await blob).arrayBuffer()))) throw new Error("the app refused the image");
+    return { message: "Copied the image" };
+  }
+  if (!navigator.clipboard?.write || !window.ClipboardItem) throw new Error("This browser can't copy images here");
+  await navigator.clipboard.write([new ClipboardItem({ "image/png": Promise.resolve(blob).then(pngBlob) })]);
+  return { message: "Copied the image" };
+}
+async function pngBlob(blob) {
+  if (blob.type === "image/png") return blob;
+  const bmp = await createImageBitmap(blob);
+  const c = document.createElement("canvas");
+  c.width = bmp.width; c.height = bmp.height;
+  c.getContext("2d").drawImage(bmp, 0, 0);
+  bmp.close();
+  return new Promise((ok, bad) => c.toBlob(b => b ? ok(b) : bad(new Error("couldn't encode the image")), "image/png"));
+}
 function download(blob, name) {
   if (savesToDevice()) return act("Save image", () => saveToDevice([{ blob, name }]));
   const a = document.createElement("a");
@@ -3527,8 +3561,11 @@ loadReports();
 api("/api/host").then(applyHostWording).catch(() => {});
 
 // ---- Steam screenshots from the headset ----
-const shots = { list: [], urls: [] };
+// thumbs: id -> promise of an object URL, kept across reloads so a refresh
+// that finds a new shot fetches only that one's thumbnail.
+const shots = { list: [], sig: null, thumbs: new Map(), loading: null, gen: 0, fill: 0 };
 const STEAMVR_APPID = "250820";
+const SHOTS_POLL_MS = 8000;
 function shotApp(appid) {
   if (appid === STEAMVR_APPID) return "SteamVR";
   const g = state?.games?.find(x => x.appid === appid);
@@ -3540,35 +3577,85 @@ async function shotBlob(id, thumb) {
   if (!r.ok) throw new Error((await r.json().catch(() => ({}))).error || `HTTP ${r.status}`);
   return r.blob();
 }
-async function loadShots() {
-  $("shotsRefresh").disabled = true;
+function shotThumb(id) {
+  const thumbs = shots.thumbs;  // this headset's: a late failure must not touch the next one's
+  if (!thumbs.has(id)) {
+    const p = shotBlob(id, true).then(b => URL.createObjectURL(b));
+    p.catch(() => { if (thumbs.get(id) === p) thumbs.delete(id); });  // try again next time
+    thumbs.set(id, p);
+  }
+  return thumbs.get(id);
+}
+// quiet: a background check. It keeps what's shown if the Frame can't be read,
+// and redraws only when the shots (or whether they're saved here) changed.
+function loadShots(quiet) {
+  if (shots.loading) {
+    // A check already on its way will do for another check; Refresh, or a save
+    // that just finished, reads again after it so the answer is a fresh one.
+    const again = () => loadShots();
+    return quiet === true ? shots.loading : shots.loading.then(again, again);
+  }
+  const p = readShots(quiet === true).finally(() => { if (shots.loading === p) shots.loading = null; });
+  return shots.loading = p;
+}
+// Forget the shots of a headset we've switched away from, and ignore its answers still on their way.
+function resetShots() {
+  closeMenu();  // its items were about the other headset's shot
+  shots.gen++; shots.fill++; shots.loading = null; shots.list = []; shots.sig = null;
+  for (const p of shots.thumbs.values()) p.then(URL.revokeObjectURL, () => {});
+  shots.thumbs = new Map();
+}
+async function readShots(quiet) {
+  const gen = shots.gen;
+  if (!quiet) $("shotsRefresh").disabled = true;
+  let got;
   try {
-    shots.list = (await api("/api/shots")).shots;
+    got = await api("/api/shots");
   } catch (e) {
-    return failed($("shotGrid"), e);
+    if (!quiet && gen === shots.gen) { shots.sig = null; failed($("shotGrid"), e); }
+    return;
   } finally { $("shotsRefresh").disabled = false; }
-  shots.urls.forEach(URL.revokeObjectURL); shots.urls = [];
+  if (gen !== shots.gen) return;
+  ({ shots: shots.list, folder: shots.folder } = got);
+  const sig = JSON.stringify(shots.list.map(s => [s.id, s.saved, shotApp(s.appid)]));
+  if (sig !== shots.sig) { shots.sig = sig; drawShots(); }
+  fillThumbs(quiet);  // not waited for: the next check, or a save, needn't sit behind the thumbnails
+}
+// Thumbnails one at a time over the shared SSH connection. One that failed is
+// tried again on Refresh, not by every background check.
+async function fillThumbs(quiet) {
+  const run = ++shots.fill;
+  // Refresh puts every failed one back in line first, so a background pass that takes over carries them all on.
+  if (!quiet) for (const img of document.querySelectorAll("#shotGrid img[data-failed]")) delete img.dataset.failed;
+  for (const img of document.querySelectorAll("#shotGrid img[data-shot]:not([src])" + (quiet ? ":not([data-failed])" : ""))) {
+    const s = shots.list[+img.dataset.shot];
+    let url;
+    try { url = await shotThumb(s.id); } catch (e) { img.alt = "Preview failed"; img.dataset.failed = 1; }
+    if (run !== shots.fill) return;  // a newer pass (after a check, a redraw or another headset) has taken over
+    if (url) img.src = url;
+  }
+}
+// "Sep 28, 10:37 PM": short enough to sit beside the card's buttons (the full date is its tooltip).
+function shotTime(t) {
+  return new Date(t * 1000).toLocaleString([], { month: "short", day: "numeric", hour: "numeric", minute: "2-digit" });
+}
+function drawShots() {
+  const ids = new Set(shots.list.map(s => s.id));
+  for (const [id, p] of shots.thumbs) {
+    if (!ids.has(id)) { shots.thumbs.delete(id); p.then(URL.revokeObjectURL, () => {}); }
+  }
   const unsaved = shots.list.filter(s => !s.saved).length;
   $("shotCount").textContent = shots.list.length ? `${shots.list.length} on the Frame` + (unsaved && !HOST.mobile ? ` · ${unsaved} not on this ${HOST.computer}` : "") : "";
   $("shotsSaveNew").disabled = HOST.mobile ? !shots.list.length : !unsaved;
-  $("shotGrid").innerHTML = shots.list.length ? shots.list.map((s, i) => `<div class="shot-card">
-      <img class="thumb" data-shot="${i}" alt="Screenshot from ${esc(shotApp(s.appid))}" title="Open in the viewer">
+  $("shotGrid").innerHTML = shots.list.length ? shots.list.map((s, i) => `<div class="shot-card" data-card="${i}">
+      <img class="thumb" data-shot="${i}" alt="Screenshot from ${esc(shotApp(s.appid))}" title="Open in the viewer (right-click for more)">
       <div class="row"><div class="grow">
           <div class="t">${esc(shotApp(s.appid))}</div>
-          <div class="s">${esc(new Date(s.time * 1000).toLocaleString())}</div></div>
+          <div class="s" title="${esc(new Date(s.time * 1000).toLocaleString())}">${esc(shotTime(s.time))}</div></div>
+        <button class="small" data-shot-copy="${i}" title="Copy the image to the clipboard">Copy</button>
         ${s.saved && !HOST.mobile ? `<span class="tag">On ${HOST.computer}</span>` : `<button class="small" data-shot-save="${i}">Save</button>`}
       </div></div>`).join("")
     : `<div class="sub">No screenshots on the Frame yet.</div>`;
-  // Thumbnails one at a time over the shared SSH connection.
-  for (const img of document.querySelectorAll("#shotGrid img[data-shot]")) {
-    const s = shots.list[+img.dataset.shot];
-    try {
-      const url = URL.createObjectURL(await shotBlob(s.id, true));
-      shots.urls.push(url);
-      img.src = url;
-    } catch (e) { img.alt = "Preview failed"; }
-    if (!img.isConnected) return;  // the list was reloaded meanwhile
-  }
 }
 async function openShot(s) {
   if (live) toggleLive(false);
@@ -3586,7 +3673,7 @@ async function openShot(s) {
     draw();
     $("srcBadge").textContent = `Screenshot · ${shotApp(s.appid)}`;
     $("stamp").hidden = false; $("stamp").textContent = new Date(s.time * 1000).toLocaleString();
-    $("saveBtn").disabled = false;
+    $("saveBtn").disabled = $("copyBtn").disabled = false;
     $("view").scrollIntoView({ behavior: "smooth" });
   } catch (e) {
     toast("Couldn't open the screenshot: " + e.message, true);
@@ -3605,15 +3692,95 @@ async function saveShots(list, btn) {
                         () => api("/api/shots/save", { ids: list.map(s => s.id) }), btn);
   if (res) loadShots();
 }
+const copyShot = (s, btn) => act("Copy screenshot", () => copyImage(shotBlob(s.id, false)), btn);
 $("shotGrid").onclick = e => {
   const img = e.target.closest("img[data-shot]");
   if (img) return openShot(shots.list[+img.dataset.shot]);
+  const c = e.target.closest("[data-shot-copy]");
+  if (c) return copyShot(shots.list[+c.dataset.shotCopy], c);
   const b = e.target.closest("[data-shot-save]");
   if (b) saveShots([shots.list[+b.dataset.shotSave]], b);
 };
-$("shotsRefresh").onclick = loadShots;
+// A small right-click menu. items: [label, fn] pairs, null for a divider.
+// back: the keyboard closed it, so focus returns to where it was.
+function closeMenu(back) {
+  const menu = document.querySelector(".ctx-menu");
+  if (!menu) return;
+  menu.remove();
+  if (back === true && menu.opener?.isConnected) menu.opener.focus();
+}
+function showMenu(e, items) {
+  closeMenu();
+  const menu = document.createElement("div");
+  menu.className = "ctx-menu";
+  menu.setAttribute("role", "menu");
+  menu.opener = document.activeElement;
+  for (const it of items) {
+    if (!it) { menu.append(document.createElement("hr")); continue; }
+    const b = document.createElement("button");
+    b.textContent = it[0];
+    b.setAttribute("role", "menuitem");
+    b.onclick = () => { closeMenu(); it[1](); };
+    menu.append(b);
+  }
+  (document.fullscreenElement || document.body).append(menu);  // in front of a fullscreen viewer
+  const r = menu.getBoundingClientRect();
+  menu.style.left = Math.max(4, Math.min(e.clientX, innerWidth - r.width - 4)) + "px";
+  menu.style.top = Math.max(4, Math.min(e.clientY, innerHeight - r.height - 4)) + "px";
+  menu.querySelector("button").focus();
+}
+document.addEventListener("pointerdown", e => { if (!e.target.closest(".ctx-menu")) closeMenu(); }, true);
+document.addEventListener("keydown", e => {
+  const menu = document.querySelector(".ctx-menu");
+  if (!menu) return;
+  if (e.key === "Escape" || e.key === "Tab") { e.preventDefault(); return closeMenu(true); }  // Tab doesn't wander off behind it
+  if (e.key !== "ArrowDown" && e.key !== "ArrowUp") return;
+  e.preventDefault();  // arrows move through the menu, not the page
+  const items = [...menu.querySelectorAll("button")];
+  const at = items.indexOf(document.activeElement), step = e.key === "ArrowDown" ? 1 : -1;
+  items[at < 0 ? (step > 0 ? 0 : items.length - 1) : (at + step + items.length) % items.length].focus();
+});
+addEventListener("blur", closeMenu);
+document.addEventListener("fullscreenchange", closeMenu);
+addEventListener("scroll", closeMenu, true);
+// Right-click a screenshot for everything it can do.
+$("shotGrid").oncontextmenu = e => {
+  const card = e.target.closest("[data-card]");
+  if (!card) return;
+  e.preventDefault();
+  const s = shots.list[+card.dataset.card];
+  const items = [
+    ["Open in viewer", () => openShot(s)],
+    ["Copy image", () => copyShot(s)],
+  ];
+  if (!s.saved || HOST.mobile) items.push(null, [`Save to ${HOST.computer}`, () => saveShots([s])]);
+  else {
+    const sep = shots.folder.includes("\\") ? "\\" : "/";
+    items.push(null);
+    items.push([`Show in ${!HOST.fileManager || HOST.fileManager === "your file manager" ? "folder" : HOST.fileManager}`,
+                () => act("Show screenshot", () => api("/api/open", { what: "shot", id: s.id }))]);
+    items.push(["Copy file path", () => act("Copy file path", async () => {
+      await copyText(shots.folder + sep + s.file);
+      return { message: "Copied the file path" };
+    })]);
+  }
+  items.push(null, ["Copy file name", () => act("Copy file name", async () => {
+    await copyText(s.file);
+    return { message: "Copied " + s.file };
+  })]);
+  showMenu(e, items);
+};
+function copyText(text) {
+  if (!navigator.clipboard?.writeText) throw new Error("This browser can't copy here");
+  return navigator.clipboard.writeText(text);
+}
+$("shotsRefresh").onclick = () => loadShots();
 $("shotsSaveNew").onclick = e => saveShots(shots.list.filter(s => !s.saved), e.currentTarget);
 $("shotsFolder").onclick = e => act($("shotsFolder").textContent, () => api("/api/open", { what: "shots" }), e.currentTarget);
+// Watch for new shots: a cheap listing over the shared SSH connection while the
+// window is visible and the Frame is reachable, and again on coming back to it.
+setInterval(() => { if (!document.hidden && online) loadShots(true); }, SHOTS_POLL_MS);
+document.addEventListener("visibilitychange", () => { if (!document.hidden && online) loadShots(true); });
 
 // ---- Panel switcher: our UI over SteamVR's panel API ----
 let panelSeq = 0;
@@ -3964,7 +4131,6 @@ async function offerTest(m) {
 
 // ---- privacy: anonymous analytics levels (ui/frame_telemetry.py, docs/privacy.md) ----
 const telemetry = { usage: false, compat: false, blocked: "not loaded" };
-let privacyNoticeShown = false;  // this visit: then the contact prompt waits for another one
 function renderTelemetry(s) {
   Object.assign(telemetry, s);
   setRepHint();
@@ -3975,7 +4141,6 @@ function renderTelemetry(s) {
                                          : "Nothing sent yet.";
   const showNotice = !s.blocked && !s.noticeShown && s.usage;
   $("privacyNotice").hidden = !showNotice;
-  if (showNotice) privacyNoticeShown = true;
   if (showNotice) api("/api/telemetry", { noticeShown: true }).catch(() => {});
 }
 async function loadTelemetry() {
@@ -4018,14 +4183,13 @@ async function loadContact() {
   try { renderContact(await api("/api/contact")); } catch { return; }
   checkContactPrompt();
 }
-// One time only, only once the Frame has connected, and never in a visit that showed the privacy
-// notice (two asks in a row is nagging): checked at load and whenever the Frame connects.
+// One time only, only once the Frame has connected, and never on top of the privacy notice or
+// straight after it (two asks in a row is nagging): checked at load and whenever the Frame connects.
 async function checkContactPrompt() {
-  await telemetryLoaded;
-  if (privacyNoticeShown || !$("contactNotice").hidden) return;
+  if (!$("contactNotice").hidden || !$("privacyNotice").hidden) return;
   let s;
   try { s = await api("/api/contact"); } catch { return; }
-  if (!s.showPrompt || privacyNoticeShown || !$("contactNotice").hidden) return;
+  if (!s.showPrompt || !$("contactNotice").hidden || !$("privacyNotice").hidden) return;
   $("contactNotice").hidden = false;
   api("/api/contact/prompt", { prompt: "shown" }).catch(() => {});
 }
@@ -4093,7 +4257,6 @@ function openBugReport() {
   // A standing yes to follow-up questions (Privacy & updates) fills this in; it can be unticked.
   $("bugFollowup").checked = contact.followup; $("bugContact").value = contact.followup ? contact.email : "";
   $("bugContact").disabled = !contact.followup; $("bugContact").required = contact.followup;
-  bugReplaces();
   $("bugDlg").showModal();
   loadBugPreview();
 }
@@ -4104,17 +4267,7 @@ $("bugFollowup").onchange = () => {
   const on = $("bugFollowup").checked;
   $("bugContact").disabled = !on; $("bugContact").required = on;
   if (on && !$("bugContact").value) { $("bugContact").value = contact.email; $("bugContact").focus(); }
-  bugReplaces();
 };
-// Sending with another address replaces the saved one (ui/frame_contact.py from_report): say so first.
-function bugReplaces() {
-  const email = $("bugContact").value.trim(), old = contact.email;
-  const replaces = $("bugFollowup").checked && email && old && email.toLowerCase() !== old.toLowerCase();
-  $("bugReplaces").hidden = !replaces;
-  $("bugReplaces").textContent = !replaces ? "" : `Sending replaces ${old} as your contact email${contact.updates
-    ? ", and update notices stop until you turn them on again in Privacy & updates" : ""}.`;
-}
-$("bugContact").oninput = bugReplaces;
 $("bugCancel").onclick = () => $("bugDlg").close();
 $("bugCopy").onclick = async () => {
   const { title, body } = bugReportText();
@@ -4137,7 +4290,6 @@ $("bugForm").onsubmit = async e => {
     $("bugMsg").textContent = `Couldn't send it: ${err.message}. Try again later, or use Copy report.`;
     $("bugSend").disabled = false;
   }
-  api("/api/contact").then(renderContact).catch(() => {});  // the report may have saved the address
 };
 if (window.frameApp && window.frameApp.onReportProblem) window.frameApp.onReportProblem(openBugReport);
 
@@ -4292,7 +4444,7 @@ if (window.frameApp && window.frameApp.onInstallLink) {
 }
 
 setView("headset");
-refresh().then(loadShots);  // after status, so app names resolve
+refresh().then(() => loadShots());  // after status, so app names resolve
 document.addEventListener("visibilitychange", () => { if (!document.hidden && online === false) refresh(); });
 </script>
 <script>
@@ -4413,7 +4565,7 @@ function onConnection(s) {
     lastImg = null; lastShot = null;
     $("canvas").hidden = true; $("viewerEmpty").hidden = false; $("zoombar").hidden = true;
     ["stamp", "srcBadge", "asleep"].forEach(id => $(id).hidden = true);
-    $("saveBtn").disabled = true;
+    $("saveBtn").disabled = $("copyBtn").disabled = true;
     // Lists and their buttons (Remove, Launch…) were the other headset's: clear them
     // before anyone clicks one, until the new headset's arrive.
     ["games", "titleList", "andApps", "flatpaks", "shotGrid", "gmGrid"].forEach(id => {
@@ -4422,7 +4574,7 @@ function onConnection(s) {
     disp.list = []; disp.port = null;
     // The lists behind those panels too, so filters can't bring the old ones back.
     gm.owned = null; gm.byId = new Map(); gm.results = []; gm.store = []; gm.storeQ = null; gm.shown = 0; gm.seq++;
-    androidApps = []; shots.list = [];
+    androidApps = []; resetShots();
     titlesSeq++; disp.seq++;  // answers to loads already on their way are ignored
     if (cat.apps) filterCatalog();  // "Installed" tags were the other headset's
     // Confirmations still open were checked against the other headset.

ui/server.py

@@ -134,7 +134,6 @@ LINK = None  # the connector (frame_link.Link); None on the Frame itself
 # install's clean-up) to the other headset.
 _work_lock = threading.Lock()
 _work = [0]
-NOT_HEADSET_WORK = {"/api/devices", "/api/contact", "/api/contact/prompt"}
 
 
 @contextlib.contextmanager
@@ -1194,6 +1193,12 @@ def open_thing(body):
             SHOTS_DIR.mkdir(parents=True, exist_ok=True)
             frame_host.open_path(SHOTS_DIR)
             return {"message": f"Opened {SHOTS_DIR} in {frame_host.FILE_MANAGER}"}
+        if what == "shot":
+            saved = SHOTS_DIR / shot_path(body.get("id")).rsplit("/", 1)[-1]
+            if not saved.exists():
+                raise Failure("That screenshot isn't saved on this computer yet", 404)
+            frame_host.reveal_path(saved)
+            return {"message": f"Showed {saved.name} in {frame_host.FILE_MANAGER}"}
     except frame_host.HostError as e:
         raise Failure(str(e), 500)
     raise Failure("unknown target", 400)
@@ -2441,8 +2446,7 @@ class Handler(BaseHTTPRequestHandler):
             body = json.loads(self.rfile.read(length) or b"{}")
             if not isinstance(body, dict):
                 raise Failure("request body must be a JSON object", 400)
-            # Not headset work: switching headsets mustn't wait for (or refuse) these.
-            with (contextlib.nullcontext() if path in NOT_HEADSET_WORK else working(meant)):
+            with (contextlib.nullcontext() if path == "/api/devices" else working(meant)):
                 result = handler(body)
             self.send_json(result)
         except Failure as e:
@@ -2663,12 +2667,16 @@ def main():
         signal.signal(signal.SIGTERM, lambda *_: (_ for _ in ()).throw(KeyboardInterrupt))
     if args.exit_on_eof:
         def watch_stdin():
-            sys.stdin.buffer.read()
+            # os.read, not sys.stdin.buffer.read: a buffered read holds stdin's lock,
+            # and if a signal stops the server first, Python aborts (SIGABRT) at exit
+            # when it can't take that lock back from this thread.
+            while os.read(0, 4096):
+                pass
             threading.Thread(target=httpd.shutdown, daemon=True).start()
         threading.Thread(target=watch_stdin, daemon=True).start()
-    # The real port, which --port 0 leaves to the system (the iPhone app reads it from here).
-    print(f"Frame Control on http://127.0.0.1:{httpd.server_address[1]}  (alias: {FRAME}; Ctrl-C to stop)", flush=True)
     try:
+        # The real port, which --port 0 leaves to the system (the iPhone app reads it from here).
+        print(f"Frame Control on http://127.0.0.1:{httpd.server_address[1]}  (alias: {FRAME}; Ctrl-C to stop)", flush=True)
         httpd.serve_forever()
     except KeyboardInterrupt:
         pass