security+robustness(py/gui): thread-safety, upload hardening, keyring

macro_manager:
- All macro reads/writes guarded by a lock; macros.json written atomically
  (temp + fsync + os.replace). Commands are copied under the lock and executed
  outside it so wait/keyboard steps don't block other threads.
- last_used disk writes debounced (>=5s) instead of a full rewrite per press.
- Validate key/hotkey names against pyautogui.KEYBOARD_KEYS and clamp wait ms;
  invalid input is skipped/logged, not blindly executed.

web_server:
- WebSocket receive loop always disconnects (fixes dead-socket leak); broadcast
  prunes failed sockets.
- POST /api/execute offloaded to a thread executor so a long macro no longer
  blocks the event loop.
- Image upload hardened: 5MB cap (413), real-image validation via Pillow,
  server-generated name under macro_images/, returns a relative path only,
  cleans up on failure.

gui:
- Execute macros off the Qt main thread (signal back to status bar); debounce
  resizeEvent and only rebuild when the column count changes.
- Relay password stored in the OS keyring when available (plaintext JSON blanked;
  graceful fallback if no backend); delete dialogs name the macro; honor the
  minimize-to-tray setting; surface save failures.
- Add media/system keys (volume, play/pause, track nav) to the macro editor.
- THEME gains shared danger/accent-hover colors; drop dead imports.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

gui/main_window.py

@@ -21,11 +21,11 @@ def get_resource_path(relative_path):
 from PySide6.QtWidgets import (
     QMainWindow, QWidget, QVBoxLayout, QHBoxLayout,
     QLabel, QPushButton, QTabWidget, QGridLayout,
-    QScrollArea, QFrame, QMenu, QMenuBar, QStatusBar,
+    QScrollArea, QMenu, QStatusBar,
     QMessageBox, QApplication, QSystemTrayIcon, QStyle
 )
-from PySide6.QtCore import Qt, Signal, QTimer, QSize, QEvent
-from PySide6.QtGui import QIcon, QPixmap, QAction, QFont
+from PySide6.QtCore import Qt, Signal, QTimer, QEvent
+from PySide6.QtGui import QIcon, QPixmap, QAction
 
 from config import VERSION, THEME, DEFAULT_PORT, SETTINGS_FILE
 from macro_manager import MacroManager
@@ -127,6 +127,8 @@ class MainWindow(QMainWindow):
     relay_session_received = Signal(str)
     relay_connected_signal = Signal()
     relay_disconnected_signal = Signal()
+    # Report macro execution result back to the GUI thread (success flag).
+    macro_execution_finished = Signal(bool)
 
     def __init__(self, app_dir: str):
         super().__init__()
@@ -174,6 +176,14 @@ class MainWindow(QMainWindow):
         self.relay_session_received.connect(self._handle_relay_session)
         self.relay_connected_signal.connect(lambda: self._update_relay_status(True))
         self.relay_disconnected_signal.connect(lambda: self._update_relay_status(False))
+        self.macro_execution_finished.connect(self._on_macro_execution_finished)
+
+        # Debounce timer for resize-driven grid rebuilds.
+        self._resize_timer = QTimer(self)
+        self._resize_timer.setSingleShot(True)
+        self._resize_timer.setInterval(150)
+        self._resize_timer.timeout.connect(self._apply_resize)
+        self._last_col_count = None
 
         # Load initial data
         self.refresh_tabs()
@@ -209,7 +219,7 @@ class MainWindow(QMainWindow):
                 font-weight: bold;
             }}
             QPushButton:hover {{
-                background-color: #0096ff;
+                background-color: {THEME['accent_hover']};
             }}
         """)
         add_btn.clicked.connect(self.add_macro)
@@ -555,7 +565,8 @@ class MainWindow(QMainWindow):
         filtered = self.macro_manager.filter_macros_by_tab(macro_list, tab_name)
 
         # Add macro buttons
-        cols = max(1, (self.width() - 40) // 130)
+        cols = self._compute_columns()
+        self._last_col_count = cols
         for i, (macro_id, macro) in enumerate(filtered):
             btn = MacroButton(macro_id, macro, self.app_dir)
             btn.clicked.connect(lambda checked, mid=macro_id: self.execute_macro(mid))
@@ -568,8 +579,25 @@ class MainWindow(QMainWindow):
         self.refresh_macros()
 
     def execute_macro(self, macro_id: str):
-        """Execute a macro."""
-        success = self.macro_manager.execute_macro(macro_id)
+        """Execute a macro off the GUI thread so the UI doesn't freeze.
+
+        pyautogui presses and wait steps are blocking; running them on the Qt
+        main thread would freeze the window. Run in a worker thread and report
+        the result back via a signal (thread-safe).
+        """
+        self.status_bar.showMessage("Executing macro...", 2000)
+
+        def run():
+            try:
+                success = self.macro_manager.execute_macro(macro_id)
+            except Exception:
+                success = False
+            self.macro_execution_finished.emit(success)
+
+        threading.Thread(target=run, daemon=True).start()
+
+    def _on_macro_execution_finished(self, success: bool):
+        """Report macro execution result on the GUI thread."""
         if success:
             self.status_bar.showMessage("Macro executed", 2000)
         else:
@@ -593,9 +621,16 @@ class MainWindow(QMainWindow):
 
     def delete_macro(self, macro_id: str):
         """Delete a macro with confirmation."""
+        macro = self.macro_manager.get_macro(macro_id)
+        macro_name = macro.get("name", "") if macro else ""
+        prompt = (
+            f"Are you sure you want to delete \"{macro_name}\"?"
+            if macro_name else
+            "Are you sure you want to delete this macro?"
+        )
         reply = QMessageBox.question(
             self, "Delete Macro",
-            "Are you sure you want to delete this macro?",
+            prompt,
             QMessageBox.Yes | QMessageBox.No
         )
         if reply == QMessageBox.Yes:
@@ -738,7 +773,8 @@ class MainWindow(QMainWindow):
 
     def _handle_relay_session(self, session_id: str):
         """Handle relay session on main thread."""
-        self.settings_manager.set_relay_session_id(session_id)
+        if not self.settings_manager.set_relay_session_id(session_id):
+            self.status_bar.showMessage("Warning: failed to save relay session", 3000)
         self.update_ip_label()
 
     def _update_relay_status(self, connected: bool):
@@ -825,15 +861,27 @@ class MainWindow(QMainWindow):
 
         event.accept()
 
+    def _compute_columns(self) -> int:
+        """Compute how many macro columns fit at the current width."""
+        return max(1, (self.width() - 40) // 130)
+
+    def _apply_resize(self):
+        """Rebuild the grid only if the column count actually changed."""
+        if self._compute_columns() != self._last_col_count:
+            self.refresh_macros()
+
     def resizeEvent(self, event):
-        """Handle window resize."""
+        """Handle window resize (debounced to coalesce rapid resize events)."""
         super().resizeEvent(event)
-        self.refresh_macros()
+        # Coalesce a burst of resize events; only rebuild after things settle
+        # and only when the computed column count changed.
+        self._resize_timer.start()
 
     def changeEvent(self, event):
         """Handle window state changes - minimize to tray."""
         if event.type() == QEvent.Type.WindowStateChange:
-            if self.windowState() & Qt.WindowMinimized:
+            if (self.windowState() & Qt.WindowMinimized
+                    and self.settings_manager.get_minimize_to_tray()):
                 # Hide instead of minimize (goes to tray)
                 event.ignore()
                 self.hide()