style(birdnet-pi-zach): blank lines around the new CHANGELOG entry

Codacy flagged 3 new issues on this PR while the byte-identical 99-run.sh change
passed on #2972, which narrowed it to the CHANGELOG entry I wrote by hand.

The entry had no blank line after its heading and none before the heading below
it — MD022 (headings surrounded by blank lines) and MD032 (lists surrounded by
blank lines). Neither is disabled in .markdownlint.yaml; only MD001, MD002,
MD012, MD013, MD025, MD033 and MD041 are. The birdnet-pi entry for the same fix
has the blank line, which is why it passed.

The rest of this file has the same missing blank lines throughout, but those are
pre-existing lines that Codacy does not count and this change does not touch.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/prompts/issue-execute-plan.md

@@ -11,21 +11,10 @@ Read:
   diff, verification, risk). This is your spec.
 - `/tmp/ai-exec/issue.json` — the issue it fixes (for `Closes #<n>` and context).
 
-## Hard limits (identical to the fix sweep; only limit 1 is machine-enforced)
+## Hard limits (identical to the fix sweep — a workflow step enforces them)
 
 1. **Never modify `.github/` or `.templates/`.** Repo-wide infrastructure.
-2. **`config.yaml` is yours to edit, except the upstream part of `version`;
-   never edit `updater.json`** — `addons_updater` owns both. (There is no
-   `upstream:` key in `config.yaml`.) You must still
-   bump the local patch counter, or Supervisor never offers the rebuild and the
-   fix ships inert. Read `updater.json` to find the boundary — you cannot tell
-   it from `version` alone, since upstream versions here run to four or five
-   components. With `U` = `upstream_version`: if `version` equals `U`, **append**
-   `.1` (sonarr `4.0.19.3001` -> `4.0.19.3001.1`); if it is `U` + `.` + digits,
-   **increment** those digits (radarr `6.3.0.10514.1` -> `6.3.0.10514.2`);
-   anything else — no `updater.json`, drifted version, LSIO tag, date, nightly —
-   leave `version` alone and say so in the pull request body. A dot, never a
-   hyphen.
+2. **Never touch the `version` or `upstream` fields in `config.yaml`.**
 3. **One add-on, one branch:** `ai-fix/<addon>-<issue-number>`.
 4. **Never merge, never close the issue, never enable auto-merge.** Open the
    pull request **ready for review** — CI (`onpr_check-pr.yaml`) validates it,

.github/prompts/issue-fix.md

@@ -13,52 +13,14 @@ about confidence matters more than the number of pull requests you open.
 
 ## Hard limits
 
-These are not guidelines. Limit 1 is machine-enforced — a workflow step checks
-every pull request you open and blocks and flags anything that violates it. The
-rest are on you: nothing checks them, so breaking one ships silently.
+These are not guidelines. A workflow step enforces them after you finish, and
+anything that violates them gets blocked and flagged.
 
 1. **Never modify `.github/` or `.templates/`.** Those are inherited by every
    add-on in the repo. A change there is a 100-add-on incident, not a fix.
-2. **`config.yaml` is yours to edit, with one carve-out.** Never change the
-   *upstream part* of `version` — the portion that tracks the upstream release
-   — and never edit `updater.json` at all. The `addons_updater` job owns both,
-   and editing them causes merge conflicts you will not be around to resolve.
-   (There is no `upstream:` key in `config.yaml`; upstream tracking lives in
-   `updater.json` as `upstream_repo` / `upstream_version`.)
-
-   The **local patch counter** is a different thing and you must bump it. When
-   you change any file in an add-on, `version` must change too — otherwise
-   Supervisor never offers the rebuild, the add-on keeps running the old image,
-   and your fix ships inert: merged, doing nothing, with the issue looking
-   closed. That is worse than not fixing it at all.
-
-   **You cannot tell the counter from `version` alone — read `updater.json`.**
-   Upstream versions in this repo have anywhere from one to five components, so
-   a trailing `.1234` is just as likely to belong to upstream as to be a local
-   counter. `updater.json`'s `upstream_version` is the authority. Let `U` be
-   that value, and compare:
-
-   | `version` vs `U` | what to do | example |
-   |---|---|---|
-   | identical | **append** `.1` | sonarr `4.0.19.3001` -> `4.0.19.3001.1` |
-   | `U` + `.` + digits | **increment** those digits | radarr `6.3.0.10514.1` -> `6.3.0.10514.2` |
-   | anything else | **leave it alone** | plex, readarr, joal |
-
-   Getting this backwards corrupts data you do not own: sonarr's `4.0.19.3001`
-   *is* the upstream version, so "increment the last component" would produce
-   `4.0.19.3002` and burn the identifier of a future real release. 82 of the
-   add-ons in this repo are in that first row — appending is the common case,
-   incrementing the rare one.
-
-   Use a dot, never a hyphen: `X.Y.Z-N` parses as a semver pre-release, which
-   Supervisor treats as *older* than `X.Y.Z` and will not offer.
-
-   The third row is not a failure — it is the safe answer whenever the add-on
-   has no `updater.json`, its `version` has drifted from `upstream_version`, or
-   the format is exotic (LSIO tag `1.43.1.10611-1e34174b1-ls301`, a date, a
-   nightly). Do not guess a counter onto those. Leave `version` untouched and
-   say so — in the pull request body, or in the plan if this issue is going out
-   as Outcome B — so a human can decide.
+2. **Never touch the `version` or `upstream` fields in `config.yaml`.** The
+   `addons_updater` job owns those. Editing them causes merge conflicts you
+   will not be around to resolve.
 3. **One add-on per branch, one branch per pull request.** Branch name
    `ai-fix/<addon>-<issue-number>`.
 4. **Never merge, never close an issue, never enable auto-merge.** Opening a

.github/prompts/pr-coderabbit.md

@@ -23,10 +23,7 @@ Consider only comments authored by `coderabbitai[bot]`. Ignore its collapsed
 ## Hard limits (a workflow step enforces the first)
 
 1. **Never modify `.github/` or `.templates/`.** Repo-wide infrastructure.
-2. **Leave `version` in `config.yaml` alone, and never edit `updater.json`.** The rest of
-   `config.yaml` is fair game. Unlike the fix sweep, you are amending a pull
-   request that has *already* bumped the local patch counter — one bump covers
-   the whole PR, so incrementing it again here would just churn the diff.
+2. **Never touch the `version` or `upstream` fields in `config.yaml`.**
 3. **Stay within this PR's scope and branch.** Do not open a new PR, do not
    touch other add-ons, do not merge, do not mark ready/draft.
 

.github/stargazer_countries.csv

@@ -442,7 +442,6 @@ Lolekpolek,,2026-08-10
 LonelySoul7X,,2026-08-10
 Lorsel,Italy,
 Luca2165801154,,2026-08-10
-Lucius-Waverly,,2026-08-16
 LuciusEternal,,2026-08-10
 LuckyTriple7,Germany,
 Luckyfuzz,,2026-08-10
@@ -540,7 +539,6 @@ NoFace3D,,2026-08-10
 Noa3129,,2026-08-10
 Noob25930,,2026-08-10
 NuclearTruck,,2026-08-10
-OXERY,,2026-08-16
 Oberknecht,Germany,
 OdorDecoder,,2026-08-10
 Omega7572,,
@@ -1085,7 +1083,6 @@ cecet23,Italy,
 cecilchurms,,2026-08-10
 celynw,United Kingdom,
 ch4d1,Germany,
-chapliak,Canada,2026-08-16
 charithmadhuranga,Sri Lanka,
 charl3y15,United States,
 charlestephen,United States,
@@ -1115,7 +1112,6 @@ cicishahita,,2026-08-10
 cipector,,2026-08-10
 circasurvivor55,,2026-08-10
 cirf,,2026-08-10
-citizenserious,,2026-08-16
 cityeyes,,2026-08-10
 classhu,,2026-08-10
 clementleroy,France,
@@ -1748,7 +1744,6 @@ lakshanthad,Canada,
 lallinger-tech,Germany,
 laoto1234,,2026-08-10
 larry3,,2026-08-10
-lassepi,,2026-08-16
 laughedelic,Norway,
 lazymule,Türkiye,2026-08-10
 lazytarget,Sweden,
@@ -1765,7 +1760,6 @@ letrouf,,2026-08-10
 levvvy,,2026-08-10
 lexluthors,,2026-08-10
 lguerard,,2026-08-10
-lheinke,,2026-08-16
 lhimo,,2026-08-10
 liangshao200,,2026-08-10
 lichenophile,,2026-08-10
@@ -1848,7 +1842,6 @@ mareklab,,2026-08-10
 marevers,Germany,
 marian-paun,Romania,
 mariusvslprts,Germany,
-mark-219,United States,2026-08-16
 markcshaz,,2026-08-10
 markist,,2026-08-10
 marlonqpa,,2026-08-10
@@ -1892,7 +1885,6 @@ mediaexplorer74,Russian Federation,2026-08-10
 mefisto22,,2026-08-10
 megavolts,United States,
 megawubs,Netherlands,
-meremortals70,,2026-08-16
 meska,,2026-08-10
 methbkts,France,
 mevlutdemirbas,,2026-08-10
@@ -1948,7 +1940,6 @@ mmstano,,2026-08-10
 mmz06,,2026-08-10
 mnex9191,,2026-08-10
 mnpeart,United States,
-mocodev-io,,2026-08-16
 moein805,"Iran, Islamic Republic of",
 mohammedmulazada,Netherlands,
 mohammednafeel,,2026-08-10
@@ -1988,7 +1979,6 @@ natbrood,,2026-08-10
 nate-marshall,,2026-08-10
 nduest,Germany,
 ne7runner,,2026-08-10
-nean,,2026-08-16
 nedsined,,2026-08-10
 neildotwilliams,,2026-08-10
 neilpercy,,2026-08-10
@@ -2177,7 +2167,6 @@ qdominik,,2026-08-10
 qezzo,,2026-08-10
 qianc123,,2026-08-10
 qimingzihaofan233,,2026-08-10
-qtoosha,,2026-08-16
 quank1968,,2026-08-10
 quartzbear,,2026-08-10
 quirbiefe,,2026-08-10
@@ -2380,7 +2369,6 @@ stDragon,,2026-08-10
 stagietek,Australia,
 stanisboiko,Ukraine,
 starbuck93,United States,
-statuscue,Germany,2026-08-16
 steef84,,2026-08-10
 stef-th,,2026-08-10
 stefangries,,2026-08-10
@@ -2467,7 +2455,6 @@ threnard,,2026-08-10
 tianmaozuo,,2026-08-10
 tibonou,,2026-08-10
 tigroff,,2026-08-10
-tijmenvanstraten,,2026-08-16
 tillmannschatz,Germany,
 tim-frensch,,2026-08-10
 timTam97,Australia,

.github/workflows/daily_README.yaml

@@ -228,7 +228,7 @@ jobs:
           echo "... done"
 
       - name: Commit if needed
-        uses: EndBug/add-and-commit@v11
+        uses: EndBug/add-and-commit@v10
         with:
           message: "GitHub bot : README updated"
           default_author: github_actions

.github/workflows/daily_ai_fix.yaml

@@ -125,7 +125,7 @@ jobs:
 
       - name: Analyse and fix
         if: steps.batch.outputs.count != '0'
-        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c  # v1
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Skip the OIDC -> Claude App token exchange. The scheduled path

.github/workflows/helper_stats_graphs.yaml

@@ -237,7 +237,7 @@ jobs:
           # Get stars evolution
           wget -S -O .github/starsevol.svg "https://api.star-history.com/svg?repos=alexbelgium/hassio-addons&type=Date" || true
       - name: Commit if needed
-        uses: EndBug/add-and-commit@v11
+        uses: EndBug/add-and-commit@v10
         with:
           message: "GitHub bot : graphs updated"
           default_author: github_actions

.github/workflows/on_claude_mention.yml

@@ -64,7 +64,7 @@ jobs:
           fetch-depth: 1
 
       - name: Run Claude Code
-        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c  # v1
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # AI_PR_TOKEN, not GITHUB_TOKEN, so a PR Claude opens triggers CI.

.github/workflows/on_issue_approved.yaml

@@ -135,7 +135,7 @@ jobs:
 
       - name: Execute the plan
         if: steps.bundle.outputs.has_plan == 'true'
-        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c  # v1
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Skip the OIDC -> Claude App token exchange, which 401s whenever

.github/workflows/on_issues.yml

@@ -59,7 +59,7 @@ jobs:
         # Remove issues list
         rm issueslist
     - name: Commit if needed
-      uses: EndBug/add-and-commit@v11
+      uses: EndBug/add-and-commit@v10
       with:
         message: "Github bot : issues linked to readme"
         default_author: github_actions

.github/workflows/on_issues_ai_triage.yaml

@@ -166,7 +166,7 @@ jobs:
         id: classify
         if: github.event_name != 'issue_comment' || steps.claim.outputs.go == 'true'
         continue-on-error: true
-        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c  # v1
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Without this the action falls back to the OIDC -> Claude App token

.github/workflows/on_pr_coderabbit.yml

@@ -79,7 +79,7 @@ jobs:
 
       - name: Address CodeRabbit comments
         if: steps.claim.outputs.go == 'true'
-        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c  # v1
+        uses: anthropics/claude-code-action@1623c36729ac1cd5895198cded705a287de7db79  # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           # Skip the OIDC -> Claude App token exchange, which 401s whenever

.github/workflows/onpush_builder.yaml

@@ -95,7 +95,7 @@ jobs:
       - name: Commit sanitize changes
         id: sanitize_commit
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
-        uses: EndBug/add-and-commit@v11
+        uses: EndBug/add-and-commit@v10
         with:
           commit: -u
           message: "GitHub bot: sanitize (spaces + LF endings) & chmod [nobuild]"
@@ -410,7 +410,7 @@ jobs:
           done
 
       - name: Commit changelog changes
-        uses: EndBug/add-and-commit@v11
+        uses: EndBug/add-and-commit@v10
         with:
           commit: -u
           message: "GitHub bot: changelog [nobuild]"

.github/workflows/weekly_crlftolf.yaml

@@ -18,7 +18,7 @@ jobs:
         uses: erclu/check-crlf@v1
 
       - name: Commit if needed
-        uses: EndBug/add-and-commit@v11
+        uses: EndBug/add-and-commit@v10
         with:
           message: "Github bot : CRLF corrected"
           default_author: github_actions
@@ -50,7 +50,7 @@ jobs:
             dos2unix -k "$f"
           done
       - name: Commit if needed
-        uses: EndBug/add-and-commit@v11
+        uses: EndBug/add-and-commit@v10
         with:
           message: "Github bot : CRLF corrected"
           default_author: github_actions

.github/workflows/weekly_reduceimagesize.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: Commit if needed
         if: steps.calibre.outputs.markdown != ''
-        uses: EndBug/add-and-commit@v11
+        uses: EndBug/add-and-commit@v10
         with:
           message: "Github bot : image compressed"
           default_author: github_actions

.github/workflows/weekly_stats.yaml

@@ -109,7 +109,7 @@ jobs:
           #TOTAL3="$(awk '{SUM+=$2}END{print SUM}' Stats)"
 
       - name: Commit if needed
-        uses: EndBug/add-and-commit@v11
+        uses: EndBug/add-and-commit@v10
         with:
           default_author: github_actions
           message : "Github bot : stats updated"

CLAUDE.md

@@ -161,17 +161,7 @@ the sweep), `ai:plan-pending` (plan posted, awaiting `ai:approved`), `ai:fixed`,
 out of the automated tiers but not the manual ones. **Kill switch:** set the
 repo variable `AI_DISABLED=true` to pause every AI workflow with no file edits.
 AI fixes must never touch `.github/` or `.templates/` (enforced by
-`ai_guard_paths.sh`). They may edit `config.yaml` freely except the upstream
-part of `version`, and must never edit `updater.json` — `addons_updater` owns
-both. (There is no `upstream:` key in `config.yaml`; upstream tracking lives in
-`updater.json`.) They must still bump the local patch counter so Supervisor
-offers the rebuild —
-without it the fix ships inert. The counter boundary comes from
-`updater.json`'s `upstream_version`, never from the shape of `version`: append
-`.1` when the two are equal (the common case — upstream versions here run to
-four or five components), increment the trailing digits only when `version` is
-`upstream_version` + `.N`, and otherwise leave `version` alone. This rule is
-prompt-only, not machine-enforced.
+`ai_guard_paths.sh`) or the `version`/`upstream` fields in `config.yaml`.
 
 ## Linting Rules
 

birdnet-go-dev/rootfs/etc/nginx/servers/ingress.conf

@@ -49,7 +49,6 @@ server {
       sub_filter `/asset `%%ingress_entry%%/asset;
       sub_filter "'/asset" "'%%ingress_entry%%/asset";
       sub_filter \"/asset \"%%ingress_entry%%/asset;
-      sub_filter \"/auth \"%%ingress_entry%%/auth;
       sub_filter window.location.origin} window.location.origin}%%ingress_entry%%;
     }
 }

birdnet-go/rootfs/etc/nginx/servers/ingress.conf

@@ -49,7 +49,6 @@ server {
       sub_filter `/asset `%%ingress_entry%%/asset;
       sub_filter "'/asset" "'%%ingress_entry%%/asset";
       sub_filter \"/asset \"%%ingress_entry%%/asset;
-      sub_filter \"/auth \"%%ingress_entry%%/auth;
       sub_filter window.location.origin} window.location.origin}%%ingress_entry%%;
     }
 }

birdnet-pi-zach/CHANGELOG.md

@@ -1,7 +1,7 @@
 ## 2026.08.15 (15-08-2026)
 
 - Fix: `ALSA_CARD` now really selects the microphone. Its value was copied as-is into `REC_CARD`, but BirdNET-Pi hands `REC_CARD` to `arecord -D` / `ffmpeg -f alsa -i`, which expect an ALSA PCM name: a card index such as `1` gave `Unknown PCM 1` and no recording at all. It is now converted to `plughw:CARD=<value>,DEV=0`, while a value that already is a PCM name (`dsnoop:CARD=Audio,DEV=0`, `default`, `null`, `pulse`, `pipewire`, ...) is used as provided
-- Fix: setting `ALSA_CARD` no longer replaces the `~/BirdNET-Pi/birdnet.conf` symlink with a detached copy of `/config/birdnet.conf` (now only `/config/birdnet.conf`, which the symlink points to, is updated)
+- Fix: writing `REC_CARD` no longer detaches `birdnet.conf` from `/config`. `sed -i` replaced the `$HOME/BirdNET-Pi/birdnet.conf` symlink with a regular file, so later edits from the WebUI went to a different file than the one the add-on had written; it now edits `/config/birdnet.conf` with `--follow-symlinks`
 
 ## 2026.07.10-2 (10-07-2026)
 - Minor bugs fixed

birdnet-pi-zach/README_standalone.md

@@ -101,17 +101,6 @@ Ensure you have the following installed on your system:
 
 If rtsp feed doesn't work, perhaps you need to add "-rtsp-transport tcp" to your ffmpeg instruction, or allow udp on your network
 
-### Selecting the microphone
-
-By default the container records through PulseAudio (`REC_CARD=default` in `birdnet.conf`). To record directly from a USB microphone instead, find it on the host with `arecord -l`, then pass its card number (or its card id) as `ALSA_CARD`:
-
-```yaml
-    environment:
-      - ALSA_CARD=1  # "card 1: Audio [KT USB Audio]" in the output of "arecord -l"
-```
-
-At startup this writes `REC_CARD=plughw:CARD=1,DEV=0` into your `birdnet.conf`. A value that already is a full ALSA PCM name, as listed by `arecord -L`, is used as provided - for example `ALSA_CARD=dsnoop:CARD=Audio,DEV=0`, which allows the recording and the livestream services to read the same microphone at the same time.
-
 ## Updating to the Latest Version
 
 To check for new versions of the container and update:

birdnet-pi-zach/rootfs/etc/cont-init.d/99-run.sh

@@ -70,9 +70,8 @@ if [ -n "${ALSA_CARD:-}" ]; then
     # "ffmpeg -f alsa -i" (scripts/livestream.sh), so it must be an ALSA PCM name.
     # ALSA_CARD holds a card index (1) or a card id (Audio), which are not PCM names:
     # writing them as-is gives "Unknown PCM 1" and no recording at all. Build a PCM
-    # name from them, unless the value already is one of ALSA's own PCM names
-    # (checked against "arecord -L", e.g. default, null, pulse, sysdefault, front...).
-    if [[ "$ALSA_CARD" == *:* ]] || arecord -L 2> /dev/null | grep -qx "$ALSA_CARD"; then
+    # name from them, and pass through a value that already is one (plughw:...).
+    if [[ "$ALSA_CARD" == *:* ]] || [[ "$ALSA_CARD" =~ ^(default|null|pulse|pipewire)$ ]]; then
         REC_CARD="$ALSA_CARD"
     else
         REC_CARD="plughw:CARD=${ALSA_CARD},DEV=0"

birdnet-pi/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 2026.08.15 (15-08-2026)
-
-- Fix: `ALSA_CARD` now really selects the microphone. Its value was copied as-is into `REC_CARD`, but BirdNET-Pi hands `REC_CARD` to `arecord -D` / `ffmpeg -f alsa -i`, which expect an ALSA PCM name: a card index such as `1` gave `Unknown PCM 1` and no recording at all. It is now converted to `plughw:CARD=<value>,DEV=0`, while a value that already is a PCM name (`dsnoop:CARD=Audio,DEV=0`, `default`, `null`, `pulse`, `pipewire`, ...) is used as provided
-- Fix: setting `ALSA_CARD` no longer replaces the `~/BirdNET-Pi/birdnet.conf` symlink with a detached copy of `/config/birdnet.conf` (now only `/config/birdnet.conf`, which the symlink points to, is updated)
 ## 2026.08.02 (02-08-2026)
 - Fix: ingress returned "502 Bad Gateway" because Caddy never listened on :8082. `91-nginx_ingress.sh` hooked the ingress site into `update_caddyfile.sh` with a sed anchored on `sudo caddy fmt --overwrite`, but 2026.07.10-1 strips `sudo` from every BirdNET-Pi script at build time, so the anchor stopped matching. `update_caddyfile.sh` then rewrote the Caddyfile from scratch just before Caddy started, dropping the ingress site
 - Fix: `caddy_ingress.sh` no longer appends a second `:8082` block when it runs twice (a duplicate site address makes Caddy refuse to start)

birdnet-pi/README_standalone.md

@@ -101,17 +101,6 @@ Ensure you have the following installed on your system:
 
 If rtsp feed doesn't work, perhaps you need to add "-rtsp-transport tcp" to your ffmpeg instruction, or allow udp on your network
 
-### Selecting the microphone
-
-By default the container records through PulseAudio (`REC_CARD=default` in `birdnet.conf`). To record directly from a USB microphone instead, find it on the host with `arecord -l`, then pass its card number (or its card id) as `ALSA_CARD`:
-
-```yaml
-    environment:
-      - ALSA_CARD=1  # "card 1: Audio [KT USB Audio]" in the output of "arecord -l"
-```
-
-At startup this writes `REC_CARD=plughw:CARD=1,DEV=0` into your `birdnet.conf`. A value that already is a full ALSA PCM name, as listed by `arecord -L`, is used as provided - for example `ALSA_CARD=dsnoop:CARD=Audio,DEV=0`, which allows the recording and the livestream services to read the same microphone at the same time.
-
 ## Updating to the Latest Version
 
 To check for new versions of the container and update:

birdnet-pi/config.yaml

@@ -116,5 +116,5 @@ tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pi
 usb: true
-version: 2026.08.15
+version: 2026.08.02
 video: true

birdnet-pi/rootfs/etc/cont-init.d/99-run.sh

@@ -66,26 +66,12 @@ fi || true
 
 # Use ALSA CARD defined in add-on options if available
 if [ -n "${ALSA_CARD:-}" ]; then
-    # REC_CARD is passed as-is to "arecord -D" (scripts/birdnet_recording.sh) and to
-    # "ffmpeg -f alsa -i" (scripts/livestream.sh), so it must be an ALSA PCM name.
-    # ALSA_CARD holds a card index (1) or a card id (Audio), which are not PCM names:
-    # writing them as-is gives "Unknown PCM 1" and no recording at all. Build a PCM
-    # name from them, unless the value already is one of ALSA's own PCM names
-    # (checked against "arecord -L", e.g. default, null, pulse, sysdefault, front...).
-    if [[ "$ALSA_CARD" == *:* ]] || arecord -L 2> /dev/null | grep -qx "$ALSA_CARD"; then
-        REC_CARD="$ALSA_CARD"
-    else
-        REC_CARD="plughw:CARD=${ALSA_CARD},DEV=0"
-    fi
-    bashio::log.warning "ALSA_CARD is defined, the birdnet.conf is adapted to use device $REC_CARD"
-    # --follow-symlinks : $HOME/BirdNET-Pi/birdnet.conf is a symlink to /config/birdnet.conf
-    # (01-structure.sh), and sed -i would replace it with a regular file, detaching it from
-    # the file the WebUI writes to. Only /config/birdnet.conf is updated directly, since the
-    # home-path symlink is writable by the pi/caddy user and could be repointed before this
-    # root-run script gets to it.
-    if [ -f /config/birdnet.conf ]; then
-        sed -i --follow-symlinks "/^REC_CARD/c\REC_CARD=$REC_CARD" /config/birdnet.conf
-    fi
+    bashio::log.warning "ALSA_CARD is defined, the birdnet.conf is adapt to use device $ALSA_CARD"
+    for file in "$HOME"/BirdNET-Pi/birdnet.conf /config/birdnet.conf; do
+        if [ -f "$file" ]; then
+            sed -i "/^REC_CARD/c\REC_CARD=$ALSA_CARD" "$file"
+        fi
+    done
 fi
 
 # Define permissions for audio

claude_desktop/CHANGELOG.md

@@ -1,25 +1,4 @@
-## 07308545.1 (17-08-2026)
-- Minor bugs fixed
  
-## 07308543.1 (17-08-2026)
-- Fix the "For your security, sign in again" prompt recurring on every restart again. The v1.37
-  `safeStorage` patch (`86-claude_safestorage.sh` / `claude-safestorage-patch.js`) only knew how
-  to inject its opt-in after a leading `"use strict"` directive in the app's main bundle, and
-  refused to patch anything else. Confirmed live on the running add-on (Claude Desktop
-  1.30096.1): the shipped main bundle (`.vite/build/index.pre.js`) no longer opens with a
-  `"use strict"` directive at all — it now opens directly with a bare IIFE — so the patcher has
-  been silently refusing to patch on every boot, `safeStorage.isEncryptionAvailable()` stayed
-  `false`, and the app's own log kept showing `Encryption not available, returning empty env
-  vars` exactly as before v1.37. `applyPatch()` now falls back to inserting the opt-in as the
-  bundle's first real statement when no directive is present, skipping past any leading BOM,
-  hashbang, or banner comment first so a directive hidden behind a comment is still found and
-  protected rather than pushed out of position zero. Verified by copying the live production
-  `app.asar` and running the patcher against it directly: the previously-refused bundle now
-  patches successfully, the marker lands correctly, a second run reports "Already patched", and
-  targeted unit tests cover the bare-IIFE, comment-hidden-directive, hashbang, and
-  unterminated-comment cases.
-- One-time step after upgrading, same as v1.37: the previously-stored session is already stale,
-  so complete one sign-in from a computer; it then persists across restarts.
 ## 07308545 (2026-08-15)
 - Update to latest version from aaddrick/claude-desktop-debian (changelog : https://github.com/aaddrick/claude-desktop-debian/releases)
 - Upstream tag : v3.2.2+claude1.30096.1

claude_desktop/SIGN_IN.md

@@ -13,10 +13,8 @@ streamed desktop.
   offline until a fresh sign-in was done from a computer). v1.35 switched to
   `--password-store=basic` plus a cont-init script that re-syncs the persistent openbox
   `autostart` from the image on every boot — **but that flag alone does nothing**, and the bug
-  survived it untouched. v1.37 added the application-side opt-in the `basic` backend requires;
-  see "Why v1.35 did not work" below. That patcher then regressed silently when upstream's
-  bundle output changed shape — fixed again in 07308543.1; see "Why v1.37 stopped working"
-  below.
+  survived it untouched. Actually fixed in v1.37, which adds the application-side opt-in the
+  `basic` backend requires; see "Why v1.35 did not work" below.
 - **Planned only:** Problem A (in-desktop browser for OAuth) is intentionally not implemented.
   The image ships no browser; complete the login with the user-side workaround below.
 
@@ -172,40 +170,10 @@ The third row is the one that matters: it is the restart survival this add-on ne
    reaches upgrades, not just fresh installs.
 4. `gnome-keyring` stays out of the Dockerfile.
 
-### Why v1.37 stopped working
-
-`claude-safestorage-patch.js` only knew how to inject its opt-in *after* a leading
-`"use strict"` directive in the app's main bundle, and refused to patch (leaving the app
-unpatched and the session un-persisted) if that directive wasn't there. Confirmed live on the
-running add-on: Claude Desktop 1.30096.1's main bundle (`.vite/build/index.pre.js`) no longer
-opens with a `"use strict"` directive — it now opens directly with a bare IIFE
-(`(function(){try{var e=typeof window...`). Upstream's build output changed shape at some point
-after v1.37 shipped, the patcher's one injection point stopped existing, and it had been
-silently refusing to patch on every boot since — the app's `main.log` kept showing exactly the
-same `Encryption not available, returning empty env vars` warning documented above, and the
-session went back to not surviving restarts.
-
-`applyPatch()` now falls back to inserting the opt-in as the bundle's first real statement when
-no `"use strict"` directive is found, rather than refusing outright. It skips past any leading
-BOM, hashbang, or banner comment first (`skipPrologue()`), so a directive hidden behind a
-comment is still found and protected instead of being pushed out of the first-statement
-position by a naive prepend — Vite/esbuild banners commonly put a license comment ahead of the
-directive. A bundle with no directive at all has nothing to protect, so prepending the opt-in
-there is unconditionally safe: the injected code is a complete `try{}catch(e){}` statement, and
-a statement can never merge with what follows it via ASI the way a bare expression could.
-
-Verified by copying the live production `app.asar` and running the patcher against it directly
-(outside the container's boot sequence): the previously-refused bundle now patches
-successfully, the marker lands at the front of the main entry, a second run correctly reports
-"Already patched" (idempotent), and unit tests cover the bare-IIFE, comment-hidden-directive,
-hashbang, and unterminated-comment cases.
-
 ### One-time step after upgrading
 The previously-stored session is already stale. Complete **one** sign-in from a computer
 (mobile still can't finish the OAuth flow itself, per Problem A) — the session then persists
-normally and dispatch stays online regardless of which device connects first afterward. This
-applies again after the 07308543.1 fix above, since the affected sessions were never persisted
-in the first place.
+normally and dispatch stays online regardless of which device connects first afterward.
 
 ---
 
@@ -217,10 +185,7 @@ in the first place.
 - `claude_desktop/rootfs/etc/cont-init.d/86-claude_safestorage.sh` and
   `claude_desktop/rootfs/usr/local/bin/claude-safestorage-patch.js` — new in v1.37; the
   app-side `safeStorage` opt-in that makes `--password-store=basic` actually take effect.
-  `claude-safestorage-patch.js` updated again in 07308543.1 to also patch bundles with no
-  leading `"use strict"` directive, and to look past leading comments/hashbang when deciding
-  whether one is present.
 - `claude_desktop/Dockerfile` — corrected stale comment (gnome-keyring is not installed).
-- `claude_desktop/CHANGELOG.md` / `config.yaml` — v1.35, then v1.37, then 07308543.1.
+- `claude_desktop/CHANGELOG.md` / `config.yaml` — v1.35, then v1.37.
 
 Problem A (in-desktop browser for OAuth) remains planned-only; not touched by this change.

claude_desktop/config.yaml

@@ -136,5 +136,5 @@ schema:
 slug: claude_desktop
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "07308545.1"
+version: "07308545"
 video: true

claude_desktop/rootfs/usr/local/bin/claude-safestorage-patch.js

@@ -128,98 +128,24 @@ function integrityOf(buf, blockSize) {
   return { algorithm: 'SHA256', hash: sha256(buf), blockSize, blocks };
 }
 
-// Any of the four ECMAScript LineTerminator code points — not just "\n". A //-comment or an ASI
-// boundary ends at the first of these, and using a bare "\n" search for that would let a CR- or
-// U+2028/U+2029-terminated line swallow real code as "still the comment/still on this line" and
-// misplace the insertion point deep inside the bundle instead of before it.
-const LINE_TERMINATOR = /[\n\r\u2028\u2029]/;
-
-/* Skip a leading BOM and hashbang line. Only meaningful at byte 0 — called once, before any
- * directive scanning. */
-function skipBomAndHashbang(source) {
-  let i = source.charCodeAt(0) === 0xfeff ? 1 : 0; // BOM
-  if (source.startsWith('#!', i)) {
-    const m = LINE_TERMINATOR.exec(source.slice(i));
-    i += m ? m.index + 1 : source.length - i;
-  }
-  return i;
-}
-
-/* Skip whitespace and comments starting at i. Returns the next index, or -1 for an unterminated
- * block comment (caller refuses rather than guesses). */
-function skipWhitespaceAndComments(source, i) {
-  for (;;) {
-    const rest = source.slice(i);
-    const ws = /^\s+/.exec(rest);
-    if (ws) {
-      i += ws[0].length;
-      continue;
-    }
-    if (rest.startsWith('//')) {
-      const m = LINE_TERMINATOR.exec(rest);
-      i += m ? m.index + 1 : rest.length;
-      continue;
-    }
-    if (rest.startsWith('/*')) {
-      const end = rest.indexOf('*/');
-      if (end === -1) return -1;
-      i += end + 2;
-      continue;
-    }
-    return i;
-  }
-}
-
-// A single-line string literal: no raw line terminator in its content (a real one would need an
-// escaped line continuation, which this deliberately doesn't special-case — failing to match
-// just means the prologue scan below stops there, which is always safe, see applyPatch).
-const STRING_LITERAL = /^(['"])(?:\\.|(?!\1)[^\\\n\r\u2028\u2029])*\1/;
-
-/* Scan the bundle's full leading directive prologue: every consecutive ExpressionStatement made
- * of nothing but a string literal, per how ECMAScript directives actually work. A directive
- * prologue can hold more than one entry, and "use strict" only has to appear *somewhere* in it,
- * not first — so this treats every leading directive as needing protection, not just one
- * specifically named "use strict". Returns the index right after the full prologue (which is
- * also correct as "no prologue, insert here" when there wasn't one), or -1 when a leading string
- * literal isn't cleanly terminated as its own statement — ambiguous whether it's a directive at
- * all, refused rather than guessed at. */
-function scanDirectivePrologue(source, start) {
-  let i = start;
-  for (;;) {
-    const next = skipWhitespaceAndComments(source, i);
-    if (next === -1) return -1;
-    const rest = source.slice(next);
-    const m = STRING_LITERAL.exec(rest);
-    if (!m) return next; // not a directive; prologue (possibly empty) ends here
-    const after = rest.slice(m[0].length);
-    if (after[0] === ';') {
-      i = next + m[0].length + 1;
-    } else if (after === '' || LINE_TERMINATOR.test(after[0])) {
-      i = next + m[0].length;
-    } else {
-      return -1; // "use strict" + x and friends: not unambiguously a directive
-    }
-  }
-}
-
-/* Insert the opt-in right after the bundle's full leading directive prologue (BOM/hashbang, then
- * any run of string-literal-only statements — "use strict" among them if present). It must go
- * *after* the whole prologue, not just after the first entry: a directive prologue only takes
- * effect when its members are the very first statements, so inserting between two of them, or
- * ahead of all of them, would silently drop the file out of strict mode just as surely as
- * inserting ahead of a lone "use strict" would.
+/* Insert the opt-in after the bundle's leading "use strict" directive. It must go *after* it: a
+ * directive prologue only takes effect as the very first statement, so prepending would silently
+ * drop the whole main process out of strict mode.
  *
- * When there is no prologue at all (observed from Claude Desktop 1.30096.1 onward, whose main
- * entry opens with a bare IIFE instead), there is nothing to preserve: PATCH lands at the same
- * position anyway, as the file's first real statement. A `try{}catch(e){}` statement can never
- * merge with whatever follows via ASI — unlike a bare expression, a statement is not a valid
- * left-hand side for anything a following token could continue — so this is unconditionally
- * safe once placed after any banner comment / hashbang / directive prologue. */
+ * Returns null — meaning "refuse to patch" — for anything that is not unambiguously a directive.
+ * `"use strict" + x` is an expression, not a directive, and injecting into it would produce a
+ * syntax error, so the directive is only accepted when it is terminated by its own semicolon, a
+ * line break, or end of input. */
 function applyPatch(source) {
-  const start = skipBomAndHashbang(source);
-  const end = scanDirectivePrologue(source, start);
-  if (end === -1) return null;
-  return source.slice(0, end) + PATCH + source.slice(end);
+  const m = /^\s*(['"])use strict\1(;?)/.exec(source);
+  if (!m) return null;
+  const rest = source.slice(m[0].length);
+  const terminated = m[2] === ';' || rest === '' || /^[\r\n]/.test(rest);
+  if (!terminated) return null;
+  // Supply the terminator when the directive relied on ASI; without it the injected code would
+  // continue the string-literal expression instead of following it.
+  const sep = m[2] === ';' ? '' : ';';
+  return source.slice(0, m[0].length) + sep + PATCH + rest;
 }
 
 function writeAll(fd, buf) {
@@ -277,7 +203,7 @@ function main() {
 
   const patchedSource = applyPatch(original);
   if (patchedSource === null) {
-    fail(`${mainRel} opens with an ambiguous "use strict"-like string literal; refusing to patch`);
+    fail(`${mainRel} does not begin with a recognized "use strict" directive; refusing to patch`);
   }
   const patched = Buffer.from(patchedSource, 'utf8');
 

filebrowser_quantum/CHANGELOG.md

@@ -1,10 +1,4 @@
  
-## 1.5.1.1 (2026-08-16)
-- Expose the web UI on host port 8071, reachable at `<your-ip>:8071`
-  (redirects to `/filebrowser_quantum/`). Direct access is served by a new,
-  separate nginx vhost that proxies to the same backend Ingress already uses;
-  Ingress itself, and the app's own base URL, are unchanged.
-
 ## 1.5.1 (2026-08-08)
 - Update to latest version from gtsteffaniak/filebrowser (changelog : https://github.com/gtsteffaniak/filebrowser/releases)
  

filebrowser_quantum/README.md

@@ -42,11 +42,11 @@ comparison to installing any other Home Assistant add-on.
 1. Click the `Save` button to store your configuration.
 1. Start the add-on.
 1. Check the logs of the add-on to see if everything went well.
-1. Access the web UI through the sidebar or at `<your-ip>:8071/filebrowser_quantum/`.
+1. Access the web UI through the sidebar or at `<your-ip>:8071`.
 
 ## Configuration
 
-The web UI can be found at `<your-ip>:8071` (redirects to `/filebrowser_quantum/`) or through the Home Assistant sidebar when using Ingress.
+The web UI can be found at `<your-ip>:8071` or through the Home Assistant sidebar when using Ingress.
 
 **Default credentials:**
 - Username: `admin`

filebrowser_quantum/config.yaml

@@ -97,10 +97,6 @@ options:
   default_user_scope: "/"
 panel_admin: false
 panel_icon: mdi:file-search
-ports:
-  8072/tcp: 8071
-ports_description:
-  8072/tcp: Web UI port
 privileged:
   - SYS_ADMIN
   - DAC_READ_SEARCH
@@ -118,4 +114,4 @@ schema:
 slug: filebrowser_quantum
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.5.1.1"
+version: "1.5.1"

filebrowser_quantum/rootfs/etc/cont-init.d/99-run.sh

@@ -43,13 +43,6 @@ declare ingress_interface
 declare ingress_port
 #declare keyfile
 
-# The app's own baseURL is always the Supervisor ingress-entry path — this is
-# unchanged from before. FileBrowser Quantum has no known "ignore baseURL for
-# routing" leniency the way classic filebrowser's app does, so ingress access
-# is left completely untouched here. Direct ip:port access is handled below by
-# a second, separate nginx vhost (direct.conf) that rewrites a fixed public
-# path onto this same ingress-entry baseURL, instead of changing the baseURL
-# itself.
 FB_BASEURL=$(bashio::addon.ingress_entry)
 export FB_BASEURL
 
@@ -66,15 +59,6 @@ sed -i "s|%%protocol%%|${ADDON_PROTOCOL}|g" /etc/nginx/servers/ingress.conf
 sed -i "s|%%port%%|${ingress_port}|g" /etc/nginx/servers/ingress.conf
 sed -i "s|%%interface%%|${ingress_interface}|g" /etc/nginx/servers/ingress.conf
 sed -i "s|%%subpath%%|${FB_BASEURL}/|g" /etc/nginx/servers/ingress.conf
-
-# --- Direct ip:port access (separate from ingress, see comment above) ---
-# Publishes a second nginx vhost on a fixed internal port (published to the
-# host as 8071 via config.yaml's `ports:`), at a fixed public path
-# (/filebrowser_quantum/), that proxies to the same backend the ingress vhost
-# uses. This keeps the app's own baseURL, and therefore ingress, unchanged.
-sed -i "s|%%protocol%%|${ADDON_PROTOCOL}|g" /etc/nginx/servers/direct.conf
-sed -i "s|%%subpath%%|${FB_BASEURL}/|g" /etc/nginx/servers/direct.conf
-
 mkdir -p /var/log/nginx && touch /var/log/nginx/error.log
 
 ############################

filebrowser_quantum/rootfs/etc/nginx/servers/direct.conf

@@ -1,24 +0,0 @@
-server {
-    listen 0.0.0.0:8072 default_server;
-
-    include /etc/nginx/includes/server_params.conf;
-    include /etc/nginx/includes/proxy_params.conf;
-
-    client_max_body_size 0;
-
-    location = / {
-        return 302 /filebrowser_quantum/;
-    }
-
-    location = /filebrowser_quantum {
-        return 301 /filebrowser_quantum/;
-    }
-
-    location /filebrowser_quantum/ {
-        add_header Access-Control-Allow-Origin *;
-        proxy_connect_timeout 30m;
-        proxy_send_timeout 30m;
-        proxy_read_timeout 30m;
-        proxy_pass         %%protocol%%://backend%%subpath%%;
-    }
-}