v1.23.0 "Clap"

Facet 1.23.0, "Clap", after the clapperboard that tells the whole crew a take is starting, for the release where an assistant joins the crew: an MCP endpoint so AI assistants can search, organise and cull your library and drive your open tab, the assistant's culling plan on /culling, semantic search with every gallery filter, manual face marks and saved GPS places.

Added

• MCP endpoint for AI assistants (viewer.mcp, on by default): read, write and darkroom tools behind personal fct_ tokens, each capped at readonly, user or edition and at its owner's live level. Destructive tools dry-run first and need a single-use confirm. See docs/AGENTS.md.
• An assistant can drive your open tab (viewer.mcp.bridge): ui_* tools navigate, filter, select, open albums and timeline months, and read back what every page shows, and they refuse to act under an open dialog. Searches show up in the tab, and the assistant's writes refresh the open tabs live. Connect an assistant in the account menu mints a token and gives a ready-to-paste prompt.
• The assistant's culling plan opens on /culling: groups start with the plan's keepers selected, ui_suggest_culling badges the photos it disagrees with, the strictness slider re-plans while keeping your flips, and an apply leaves alone any photo you changed since the preview (skipped_user_changed).
• Assistants can explain, preview and apply scoring weights, correct sets and categories, compare frames, build smart or fixed albums in one call, and see thumbnails and contact sheets.
• Semantic search works with every gallery filter, with a new Relevance sort as the default for a semantic query.
• /culling: a date-range filter, and a keyboard photo cursor (Left / Right, Space, Shift+Space).
• Mark a face the detector missed from photo detail; the mark survives rescans and viewer synchronisation (#247).
• Saved GPS places, recent points and a "No geolocation" filter; manual GPS edits survive rescans (#245).
• An "Assistant active" chip with the session's activity panel, and a floating selection card in the gallery.

Changed

• The scan button moved into the header.
• Web client on Angular 22.2 and TypeScript 6.0.
• viewer.trusted_local_editing now also covers scanning and a local assistant's Full-editing token, still only for requests from the same computer.
• viewer.performance.face_cache_size is ignored; face crops revalidate access on every request.

Fixed

• Going back from a photo to the gallery is near instant (#239).
• The darkroom and Compare show sharp frames before you zoom (#230).
• The photo page follows Back and Forward (#243), its arrows load the next page (#242), and it no longer offers a caption it cannot generate (#241).
• Cold searches stop waiting when Apple Silicon is busy (#246).
• Cancel in the location and caption dialogs no longer clears them.
• A burst confirm on /culling no longer rejects frames you were not shown.
• The culling feed no longer lags up to 45 s behind the library.
• A stalled request no longer hangs the viewer's restart.
• The map loads in the installed app, and the photo tooltip stays on screen.

Security

• Sessions are refused while the configuration cannot be read (#240), instead of an open-install session still reading the library.
• Purpose-bound tokens (scan stream, face-frame) no longer authenticate general viewer routes.
• An open-install token can no longer drive an edition tab, and token management on an open install is local-only.
• Dependency updates: cryptography 50.0.0, filelock 4.2.1, virtualenv 21.14.9, setuptools 84.1.0, undici 7.30.1, fast-uri 3.1.9.

Thanks

• @veyxov for eight pull requests in this release: manual face marks (#247), saved GPS places (#245), the instant return to the gallery (#239), sharp darkroom and compare frames (#230), the photo page's Back / Forward (#243), arrow-key paging (#242) and caption button (#241), and the Apple Silicon search wait (#246).

Upgrading

• Reload open Facet tabs after upgrading: the UI tool contract changed, and older tabs answer tab_outdated.
• The MCP endpoint is on by default. Set viewer.mcp.enabled to false to turn it off. Behind a reverse proxy, forward WebSocket upgrades for /api/mcp/bridge (docs/DEPLOYMENT.md).
• Remove viewer.performance.face_cache_size from a custom configuration.

Not verified

• Apple Silicon (#246, the MPS lock): CI and the release checks ran on Linux and Windows only, and Windows runs a subset of the Python suites.
• The tab bridge behind nginx or Synology reverse proxies: the WebSocket forwarding steps are documented but were not exercised for this release.

Full changelog: v1.22.1...v1.23.0