Expose Claude Desktop headroom dashboard

Merge pull request #2830 from ToledoEM/fix/manyfold-assume-ssl-redirect
Fix/manyfold assume ssl redirect
2026-10-26 15:54:17 +00:00 · 2026-07-08 14:31:22 +02:00 · 2026-07-08 13:57:20 +02:00 · 2026-07-08 13:32:01 +02:00 · 2026-07-08 13:30:06 +02:00 · 2026-07-08 12:26:06 +01:00
49 changed files with 1636 additions and 5 deletions
@@ -56,7 +56,7 @@ If you want to do add the repository manually, please follow the procedure highl

 ### Number of addons

- In the repository : 133
+- In the repository : 135
 - Installed : 508490

 ### Top 3
@@ -247,6 +247,14 @@ If you want to do add the repository manually, please follow the procedure highl
 ![amd64][amd64-badge]
 ![ingress][ingress-badge]

+&#10003; ![image](https://api.iconify.design/mdi/robot-happy.svg) [Claude Desktop](claude_desktop/) : Claude Desktop streamed through a browser with LinuxServer Selkies
+
+&emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fclaude_desktop%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fclaude_desktop%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+![ingress][ingress-badge]
+
 &#10003; ![image](https://api.iconify.design/mdi/movie-search.svg) [Cleanuparr](cleanuparr/) : Automatically removes stuck and unwanted downloads from your *arr and download clients

 &emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fcleanuparr%2Fconfig.yaml)
@@ -909,6 +917,13 @@ If you want to do add the repository manually, please follow the procedure highl
 ![smb][smb-badge]
 ![localdisks][localdisks-badge]

+&#10003; ![image](https://api.iconify.design/mdi/spotify.svg) [Spotify to Plex](spotify_to_plex/) : Sync Spotify playlists to Plex
+
+&emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fspotify_to_plex%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fspotify_to_plex%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+
 &#10003; ![image](https://api.iconify.design/mdi/chart-timeline.svg) [Spotweb](spotweb/) : Spotweb is a decentralized usenet community based on the Spotnet protocol

 &emsp;&emsp;![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fspotweb%2Fconfig.yaml)
@@ -1,3 +1,11 @@
+## source-20260708-2 (08-07-2026)
+- Minor bugs fixed
+## source-20260708 (08-07-2026)
+- Minor bugs fixed
+## source-20260706-update (06-07-2026)
+- Minor bugs fixed
+## source-20260706 (06-07-2026)
+- Minor bugs fixed
 ## source-20260705-3 (05-07-2026)
 - Harden the `output.sqlite.path` rewrite added for the persistence fix: reject paths containing `..` traversal segments (shared `validate_safe_path` check), and create the destination's parent directory under `/config` when the relative path includes a subdirectory (e.g. `db/birdnet.db`), since SQLite does not create missing parent directories itself.

@@ -127,5 +127,5 @@ slug: birdnet-go-dev
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
 usb: true
-version: "source-20260705-3"
+version: "source-20260708-2"
 video: true
@@ -0,0 +1,53 @@
+## 1.8 (08-07-2026)
+
+- Expose the Headroom live savings dashboard on mapped port `8787` when `install_headroom` is enabled, while keeping the proxy local-only if the port mapping is disabled.
+- Map `8787/tcp` by default and document the dashboard URL.
+
+## 1.7 (07-07-2026)
+
+- Add an hourly rtk + headroom token-savings report to the add-on log (`claude-gains-report.sh`, seeded via `/defaults/crontabs/root` and run by the base image's cron). Lets you confirm at a glance that both tools keep running and see accumulated gains — if the numbers stop growing, the tool has stopped working.
+- Run the Headroom optimization proxy as a supervised local backend (`svc-headroom` on 127.0.0.1:8787) so the `headroom_compress`/`headroom_retrieve` MCP tools can actually store/retrieve compressed content and record savings. It is a **backend only** — no client's `ANTHROPIC_BASE_URL` is routed through it, so the Claude Desktop app (which force-overrides it, [headroom #869](https://github.com/headroomlabs-ai/headroom/issues/869)) is unaffected. Previously the MCP server was registered but had no backend, so it recorded no savings.
+- Nudge Claude to use the headroom compression tools via a managed, idempotent block appended to the user's `CLAUDE.md` (removed automatically when `install_headroom` is disabled).
+
+## 1.6 (07-07-2026)
+
+- Fix default desktop launch failing when `install_headroom` is enabled (the default): the code rewrote the launch to `headroom wrap claude-desktop …`, but `headroom wrap` only supports coding-agent CLIs (`claude`, `codex`, ...) with arguments after `--`, so it produced an invalid command that left the app unlaunched. Leave the plain launch intact and instead register the `headroom` MCP server (`headroom mcp serve`) in Claude Desktop's config, exposing the `headroom_compress`/`headroom_retrieve`/`headroom_stats` tools inside the app. This is the supported headroom integration for Desktop, which overrides `ANTHROPIC_BASE_URL` so transparent proxy compression is not possible ([headroom #869](https://github.com/headroomlabs-ai/headroom/issues/869)). Disabling the option removes the entry again.
+- Make the autostart resilient: if the launch command fails to start, fall back to the plain Claude Desktop launch so the app always comes up.
+
+## 1.5 (07-07-2026)
+
+- Change the default Claude Desktop data location to `/data/data`.
+- Add Home Assistant smart context, Home Assistant MCP, and dangerous permission skip options.
+
+## 1.4 (07-07-2026)
+
+- Persist Claude Desktop sign-in: bundle gnome-keyring/libsecret/dbus-x11 and start an unlocked Secret Service in the desktop session, and launch with --password-store=gnome-libsecret. Fixes "Your sign-in won't be saved on this device. Install and unlock a system keyring". The keyring DB lives on persistent storage (/config/data), so the session survives restarts.
+
+## 1.3 (07-07-2026)
+
+- Fix startup crash loop ("All subprocesses terminated. Exiting."):
+  - Make the Selkies desktop init oneshots (init-video, init-selkies-config) tolerant so a partially-permitted device/permission op in the HA sandbox no longer fails add-on bringup.
+  - Pre-create /tmp/selkies_js.log so the base image's "chmod 777 /tmp/selkies*" calls never fail on an empty glob.
+  - Reconcile XDG_RUNTIME_DIR to the tmpfs runtime dir instead of persistent storage.
+- Run Claude Desktop with --disable-dev-shm-usage and drop the misplaced shm_size env var (Home Assistant ignores shm_size), fixing Electron renderer crashes on the default 64 MB /dev/shm.
+
+## 1.2 (07-07-2026)
+- Add baked-in git/GitHub CLI support with optional startup credential configuration.
+
+- Fix Selkies startup by creating the s6 environment directory and XDG runtime directory before services start.
+
+## 1.0 (07-07-2026)
+- Minor bugs fixed
+# Changelog
+
+## 1.1
+
+- Fix build failure: set HOME=/root when running rtk install script to ensure binary is installed to /root/.local/bin instead of /config/.local/bin (caused by LSIO base image overriding HOME)
+
+## 1.0
+
+- Fix build failure: remove separate `npm` apt package (already bundled in NodeSource nodejs)
+
+## debianbookworm-1ae1f8ff-ls13
+
+- Initial Claude Desktop add-on using LinuxServer Selkies, Home Assistant ingress, persistent sign-in data, runtime Claude Desktop updates, optional apt/pip additions, custom scripts, and bundled Claude Code optimization tools.
@@ -0,0 +1,142 @@
+#============================#
+#  ALEXBELGIUM'S DOCKERFILE  #
+#============================#
+#=== Home Assistant Addon ===#
+
+#################
+# 1 Build Image #
+#################
+
+ARG BUILD_FROM
+ARG BUILD_VERSION
+FROM ${BUILD_FROM}
+
+##################
+# 2 Modify Image #
+##################
+
+# Set S6 wait time
+ENV S6_CMD_WAIT_FOR_SERVICES=1 \
+    S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
+    S6_SERVICES_GRACETIME=0
+
+USER root
+
+# load volume
+VOLUME [ "/sys/fs/cgroup" ]
+
+# Set shell
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+# Allow UID and GID setting
+# hadolint ignore=SC2015,DL4006,SC2013,SC2086
+RUN \
+    usermod --home /data/data abc && \
+    if [[ -d /etc/services.d ]] && ls /etc/services.d/*/run 1> /dev/null 2>&1; then sed -i "1a set +e" /etc/services.d/*/run; fi
+
+# Global LSIO modifications
+COPY ha_lsio.sh /ha_lsio.sh
+ARG CONFIGLOCATION="/data/data"
+RUN chmod 744 /ha_lsio.sh && if grep -qr "lsio" /etc; then /ha_lsio.sh "$CONFIGLOCATION"; fi && rm /ha_lsio.sh
+
+##################
+# 3 Install apps #
+##################
+
+# Add rootfs
+COPY rootfs/ /
+RUN find . -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -exec chmod +x {} \;
+
+# Uses /bin for compatibility purposes
+# hadolint ignore=DL4005
+RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; fi && \
+    if [ ! -f /bin/bash ] && [ -f /usr/bin/bash ]; then ln -s /usr/bin/bash /bin/bash; fi
+
+# Install Claude Desktop and Python tooling
+RUN curl -fsSLo /usr/share/keyrings/claude-desktop-archive-keyring.asc https://downloads.claude.ai/claude-desktop/key.asc && \
+    echo "deb [arch=amd64,arm64 signed-by=/usr/share/keyrings/claude-desktop-archive-keyring.asc] https://downloads.claude.ai/claude-desktop/apt/stable stable main" > /etc/apt/sources.list.d/claude-desktop.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends \
+        claude-desktop \
+        python3-pip \
+        libsecret-1-0 \
+        dbus-x11 \
+        git gh && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install token-optimization tool prerequisites and binaries at build time
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends nodejs && \
+    pip3 install --break-system-packages "headroom-ai[all]" && \
+    curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh -o /tmp/rtk-install.sh && \
+    HOME=/root sh /tmp/rtk-install.sh && \
+    rm /tmp/rtk-install.sh && \
+    if [ -x /root/.local/bin/rtk ] && [ ! -x /usr/local/bin/rtk ]; then mv /root/.local/bin/rtk /usr/local/bin/rtk; fi && \
+    if [ -x /usr/local/bin/rtk ]; then chmod +x /usr/local/bin/rtk; else echo "rtk binary was not installed on PATH"; exit 1; fi && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* /root/.cache
+
+# Modules
+ARG MODULES="00-banner.sh 00-global_var.sh 01-custom_script.sh 00-local_mounts.sh 00-smb_mounts.sh 90-dns_set.sh"
+
+# Automatic modules download
+COPY ha_automodules.sh /ha_automodules.sh
+RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
+
+# Manual apps
+ENV PACKAGES="nginx"
+
+# Automatic apps & bashio
+COPY ha_autoapps.sh /ha_autoapps.sh
+RUN chmod 744 /ha_autoapps.sh && /ha_autoapps.sh "$PACKAGES" && rm /ha_autoapps.sh
+
+################
+# 4 Entrypoint #
+################
+
+# Add entrypoint
+COPY ha_entrypoint.sh /ha_entrypoint.sh
+RUN chmod 777 /ha_entrypoint.sh
+
+# Install bashio
+COPY bashio-standalone.sh /usr/local/lib/bashio-standalone.sh
+RUN chmod 0755 /usr/local/lib/bashio-standalone.sh
+
+ENTRYPOINT [ "/usr/bin/env" ]
+CMD [ "/ha_entrypoint.sh" ]
+
+############
+# 5 Labels #
+############
+
+ARG BUILD_ARCH
+ARG BUILD_DATE
+ARG BUILD_DESCRIPTION
+ARG BUILD_NAME
+ARG BUILD_REF
+ARG BUILD_REPOSITORY
+ARG BUILD_VERSION
+ENV BUILD_VERSION="${BUILD_VERSION}"
+LABEL \
+    io.hass.name="${BUILD_NAME}" \
+    io.hass.description="${BUILD_DESCRIPTION}" \
+    io.hass.arch="${BUILD_ARCH}" \
+    io.hass.type="addon" \
+    io.hass.version=${BUILD_VERSION} \
+    maintainer="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.title="${BUILD_NAME}" \
+    org.opencontainers.image.description="${BUILD_DESCRIPTION}" \
+    org.opencontainers.image.vendor="Home Assistant Add-ons" \
+    org.opencontainers.image.authors="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.licenses="MIT" \
+    org.opencontainers.image.url="https://github.com/alexbelgium" \
+    org.opencontainers.image.source="https://github.com/${BUILD_REPOSITORY}" \
+    org.opencontainers.image.documentation="https://github.com/${BUILD_REPOSITORY}/blob/main/README.md" \
+    org.opencontainers.image.created=${BUILD_DATE} \
+    org.opencontainers.image.revision=${BUILD_REF} \
+    org.opencontainers.image.version=${BUILD_VERSION}
+
+####################
+# 6 HealthcheckNOT #
+####################
@@ -0,0 +1,73 @@
+# Home assistant add-on: Claude Desktop
+
+![Supports aarch64 Architecture][aarch64-shield]
+![Supports amd64 Architecture][amd64-shield]
+![Project Maintenance][maintenance-shield]
+
+Run the Claude Desktop Linux app inside a LinuxServer.io Selkies container and stream it through Home Assistant ingress.
+
+## Installation
+
+1. Add this repository to the Home Assistant add-on store.
+2. Install **Claude Desktop**.
+3. Start the add-on and open the web UI from the sidebar.
+4. Sign in with your Claude account from the Desktop app.
+
+Claude Desktop sign-in requires a claude.ai plan that supports the Desktop app. API keys are not accepted by the Desktop application. Anthropic's Linux beta does not include Computer Use or dictation.
+
+## Features
+
+- Claude Desktop in single-app Selkies mode.
+- Home Assistant ingress support.
+- Persistent `$HOME` under `/data/data`, preserving Claude Desktop and Claude Code sign-in state across restarts.
+- Optional runtime Claude Desktop updates from Anthropic's apt repository.
+- Optional extra apt and pip package installation.
+- Baked-in `git` and GitHub CLI (`gh`) with optional startup credential configuration.
+- Custom script support through the repository standard `claude_desktop.sh` script.
+- Optional bundled Claude Code optimization tools: headroom, rtk, and caveman.
+- Headroom dashboard exposed on mapped port `8787` when `install_headroom` is enabled.
+- Low-power defaults: GPU device mapping, `AUTO_GPU=1`, `SELKIES_FRAMERATE=30`, `/tmp` tmpfs, and `$HOME/.cache` redirected to `/tmp/cache`.
+
+## Options
+
+| Option | Default | Description |
+| ------ | ------- | ----------- |
+| `PUID` / `PGID` | `0` / `0` | User and group used for persistent data ownership. |
+| `TZ` | | Optional timezone, for example `America/New_York`. |
+| `KEYBOARD` | | Optional Selkies keyboard layout. |
+| `PASSWORD` | | Optional password for direct Selkies ports. Set this before exposing ports `3000` or `3001`. |
+| `DRINODE` | | Optional GPU device override for Selkies. |
+| `DNS_server` | `8.8.8.8` | DNS server used by the standard DNS module. |
+| `auto_update` | `true` | Check Anthropic's apt repository and upgrade `claude-desktop` at add-on startup. |
+| `install_headroom` | `true` | Register the baked-in `headroom` MCP server in Claude Desktop, start the Headroom proxy backend, and expose the Headroom dashboard on mapped port `8787` at `/dashboard` when that port is open. This exposes the `headroom_compress`/`headroom_retrieve`/`headroom_stats` context-compression tools inside the app. (Claude Desktop overrides `ANTHROPIC_BASE_URL`, so transparent proxy compression is not possible — MCP is the supported path; see [headroom #869](https://github.com/headroomlabs-ai/headroom/issues/869).) Disabling removes the MCP entry and stops the backend/dashboard service. |
+| `install_rtk` | `true` | Configure the rtk Claude Code `PreToolUse` hook in the persistent Claude Code settings. |
+| `install_caveman` | `true` | Install the caveman Claude Code plugin into the persistent Claude Code home. |
+| `install_github_cli` | `true` | Enable first-start checks and setup for the baked-in `git` and `gh` commands. |
+| `github_token` | | Optional GitHub personal access token used to authenticate `gh` and configure Git credentials for GitHub. |
+| `github_username` | | Optional global Git author name. |
+| `github_email` | | Optional global Git author email. |
+| `ha_smart_context` | `true` | Enable Home Assistant smart context support for Claude tooling. |
+| `enable_ha_mcp` | `true` | Enable Home Assistant MCP support for Claude tooling. |
+| `dangerously_skip_permissions` | `false` | Expose Claude Code's dangerous permission skip mode option. Only enable if you understand the risk. |
+| `additional_apps` | | Comma-separated Debian apt packages to install at startup, for example `htop,git`. |
+| `additional_pip` | | Comma-separated pip packages to install at startup. Installs use `--break-system-packages`. |
+| `data_location` | `/data/data` | Persistent home directory location. Keep this persistent so Claude sign-in survives restarts. |
+| `networkdisks`, `cifsusername`, `cifspassword`, `cifsdomain` | | Standard SMB mount options. |
+| `localdisks` | | Standard local disk mount option. |
+| `env_vars` | `[]` | Extra environment variables to export into the container. This can override `SELKIES_*` defaults. |
+
+## Custom scripts
+
+The add-on includes the repository standard custom-script executor. On first start, it seeds a `claude_desktop.sh` file in the add-on config directory from the shared template. Commands in that script run during startup, allowing local customization without rebuilding the image.
+
+## Data and cache locations
+
+Persistent state is stored in the configured `data_location`. Claude Desktop stores sign-in data below `~/.config/Claude`, and Claude Code/tool configuration is stored below `~/.claude`. Volatile cache data is redirected to `/tmp/cache` through `$XDG_CACHE_HOME` and `$HOME/.cache`.
+
+## Headroom dashboard
+
+When `install_headroom` is enabled, the add-on starts the local Headroom proxy backend and maps port `8787` by default. Open `http://<home-assistant-host>:8787/dashboard` to view the Headroom live savings dashboard. If you disable the `8787/tcp` port mapping, the backend binds to localhost for MCP use only and the dashboard is not externally exposed.
+
+[aarch64-shield]: https://img.shields.io/badge/aarch64-yes-green.svg
+[amd64-shield]: https://img.shields.io/badge/amd64-yes-green.svg
+[maintenance-shield]: https://img.shields.io/maintenance/yes/2026.svg
@@ -0,0 +1,118 @@
+# Claude Desktop sign-in — shipped fixes and planned work
+
+Two related sign-in problems when Claude Desktop runs inside the LinuxServer Selkies
+streamed desktop.
+
+**Status:**
+- **Shipped:** Problem B (keyring persistence) is implemented in v1.4 (Dockerfile + `rootfs/defaults/autostart`).
+- **Planned only:** Problem A (in-desktop browser for OAuth) is intentionally not implemented.
+  The image ships no browser; complete the login with the user-side workaround below.
+
+---
+
+## Problem A — Cannot complete login
+
+Symptoms:
+- **"Continue with Google"** does nothing.
+- **"Continue with email"** sends a link that "must be opened from the same machine".
+
+### Root cause
+Claude Desktop signs in through an **external web page** (Google OAuth or the email magic
+link) and then hands the token back to the app via the **`claude://` URL scheme**
+(auto-registered on first launch). Both paths need:
+1. a **web browser inside the streamed desktop** to render the auth page, and
+2. a **default-browser association** so the app's `xdg-open <url>` call goes somewhere.
+
+The Selkies base image ships **no browser** and no default handler, so `xdg-open` has
+nothing to dispatch to → Google "does nothing", and the email link's final `claude://…`
+redirect only works on the machine running the app (the container), which currently can't
+render/handle it.
+
+### Fix (image level)
+In `claude_desktop/Dockerfile`, install a browser and register defaults so the whole flow
+completes inside the session:
+- `apt-get install -y --no-install-recommends chromium` (Debian bookworm package name;
+  `firefox-esr` is an alternative).
+- Set the default browser and confirm the scheme handlers, e.g. as an s6 oneshot or in the
+  desktop `autostart` (runs as the session user with `$DISPLAY`/dbus available):
+  ```sh
+  xdg-settings set default-web-browser chromium.desktop
+  xdg-mime default claude-desktop.desktop x-scheme-handler/claude
+  ```
+- Verifying expectations (for reference, not a test step):
+  `x-scheme-handler/https` → `chromium.desktop`, `x-scheme-handler/claude` →
+  `claude-desktop.desktop`.
+
+Then login is done entirely in the streamed desktop: **Continue with Google** opens
+Chromium in-session and the `claude://` redirect lands back in the app; or paste the email
+magic link into the in-session Chromium (not a phone).
+
+### User-side workaround (no rebuild)
+- Add-on Configuration → `additional_apps: chromium`, restart (installed by
+  `rootfs/etc/cont-init.d/80-configuration.sh`).
+- Run the two `xdg-settings`/`xdg-mime` commands once in an in-session terminal, or add them
+  to the custom script `/addon_configs/db21ed7f_claude-desktop/claude-desktop.sh`.
+
+---
+
+## Problem B — "Your sign-in won't be saved on this device"
+
+Symptom:
+> Install and unlock a system keyring (such as GNOME Keyring), then restart the app.
+
+### Root cause
+Claude Desktop (Electron) persists its auth token with `safeStorage`, which on Linux
+encrypts via the **Secret Service API** (`org.freedesktop.secrets`) provided by
+gnome-keyring/kwallet. The Selkies base runs only a **system** D-Bus
+(`svc-dbus` → `dbus-daemon --system`) and has **no keyring daemon**, so `safeStorage` is
+unavailable and the token cannot be stored → the app warns and forgets the session on
+restart.
+
+Note: the desktop itself already runs under a **session** bus —
+`root/defaults/startwm.sh` launches `dbus-launch --exit-with-session openbox-session`, so
+apps started from the openbox `autostart` inherit `DBUS_SESSION_BUS_ADDRESS`. The keyring
+must be started **inside that session** so it registers the secrets service on the same bus
+Claude Desktop uses. No extra `dbus-launch` is needed.
+
+### Fix (image level)
+1. `claude_desktop/Dockerfile`: install
+   `gnome-keyring libsecret-1-0 dbus-x11` (dbus-x11 provides `dbus-launch`, already used by
+   startwm; libsecret-1-0 is the backend Electron dlopens).
+2. `claude_desktop/rootfs/defaults/autostart`: start & unlock an empty-password keyring
+   before launching the app, and force the libsecret backend. Proposed content:
+   ```sh
+   # Start + unlock a gnome-keyring secrets service so Claude Desktop can persist sign-in.
+   # Runs inside the openbox session's dbus (startwm.sh: dbus-launch --exit-with-session).
+   eval "$(printf '' | gnome-keyring-daemon --login)" 2>/dev/null || true
+   eval "$(gnome-keyring-daemon --start --components=secrets)" 2>/dev/null || true
+   dbus-update-activation-environment --all >/dev/null 2>&1 || true
+
+   claude-desktop --no-sandbox --disable-dev-shm-usage --password-store=gnome-libsecret
+   ```
+   - `--login` reads the password from stdin (empty here), creating and unlocking the login
+     keyring on first run and starting the daemon in login mode; `--start --components=secrets`
+     then exposes the Secret Service and exports `GNOME_KEYRING_CONTROL`/`SSH_AUTH_SOCK`.
+   - `--password-store=gnome-libsecret` forces Electron to use the libsecret backend instead
+     of falling back to plaintext.
+3. Persistence: the keyring DB lives in `$HOME/.local/share/keyrings/` and `HOME=/config/data`
+   (persistent add-on storage), so the empty-password login keyring survives restarts and is
+   re-unlocked automatically each boot by the same `autostart` line — the sign-in then sticks.
+
+### User-side workaround (no rebuild)
+- Add-on Configuration → `additional_apps: gnome-keyring, libsecret-1-0, dbus-x11`, restart.
+- Add the keyring-start lines above to the custom script
+  `/addon_configs/db21ed7f_claude-desktop/claude-desktop.sh`, and relaunch Claude Desktop
+  with `--password-store=gnome-libsecret` (e.g. edit the in-session openbox autostart).
+
+---
+
+## Files this plan would touch (when implemented)
+- `claude_desktop/Dockerfile` — install `chromium`, `gnome-keyring`, `libsecret-1-0`,
+  `dbus-x11`; set default browser + scheme handlers.
+- `claude_desktop/rootfs/defaults/autostart` — keyring bootstrap + `--password-store` flag.
+- `claude_desktop/CHANGELOG.md` / `config.yaml` version bump.
+
+## Open questions before implementing
+- Bundle **chromium** vs **firefox-esr** as the in-image browser?
+- Empty-password keyring (fully unattended) vs. reuse the add-on `PASSWORD` option to lock
+  the keyring with the same password?
@@ -0,0 +1,72 @@
+#include <tunables/global>
+
+profile claude_desktop_addon flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  capability chown,
+  capability dac_override,
+  capability dac_read_search,
+  capability fowner,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_admin,
+  file,
+  signal,
+  mount,
+  umount,
+  remount,
+  network udp,
+  network tcp,
+  network dgram,
+  network stream,
+  network inet,
+  network inet6,
+  network netlink raw,
+  network unix dgram,
+
+
+# S6-Overlay
+  /init ix,
+  /run/{s6,s6-rc*,service}/** ix,
+  /package/** ix,
+  /command/** ix,
+  /run/{,**} rwk,
+  /dev/tty rw,
+  /bin/** ix,
+  /usr/bin/** ix,
+  /usr/lib/bashio/** ix,
+  /etc/s6/** rix,
+  /run/s6/** rix,
+  /etc/services.d/** rwix,
+  /etc/cont-init.d/** rwix,
+  /etc/cont-finish.d/** rwix,
+  /init rix,
+  /var/run/** mrwkl,
+  /var/run/ mrwkl,
+  /dev/i2c-1 mrwkl,
+  # Files required
+  /dev/fuse mrwkl,
+  /dev/sda1 mrwkl,
+  /dev/sdb1 mrwkl,
+  /dev/nvme0 mrwkl,
+  /dev/nvme0n1 mrwkl,
+  /dev/nvme1 mrwkl,
+  /dev/mmcblk0p1 mrwkl,
+  /dev/* mrwkl,
+  /udev/* mrwkl,
+  /tmp/** mrkwl,
+  /dev/fuse/** mrkwl,
+  /dev/** mrkwl,
+  /sys/firmware/** mrkwl,
+
+  # Data access
+  /data/** rw,
+
+  # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
+  ptrace (trace,read) peer=docker-default,
+
+  # docker daemon confinement requires explict allow rule for signal
+  signal (receive) set=(kill,term) peer=/usr/bin/docker,
+
+}
@@ -0,0 +1,6 @@
+{
+  "build_from": {
+    "aarch64": "ghcr.io/linuxserver/baseimage-selkies:arm64v8-debianbookworm",
+    "amd64": "ghcr.io/linuxserver/baseimage-selkies:amd64-debianbookworm"
+  }
+}
@@ -0,0 +1,94 @@
+arch:
+  - aarch64
+  - amd64
+audio: true
+description: Claude Desktop streamed through a browser with LinuxServer Selkies
+devices:
+  - /dev/dri
+  - /dev/dri/card0
+  - /dev/dri/card1
+  - /dev/dri/renderD128
+  - /dev/fuse
+environment:
+  AUTO_GPU: "1"
+  FM_HOME: /data/data
+  HOME: /data/data
+  PGID: "0"
+  PUID: "0"
+  SELKIES_FRAMERATE: "30"
+  START_DOCKER: "false"
+  TITLE: Claude Desktop
+image: ghcr.io/alexbelgium/claude_desktop-{arch}
+ingress: true
+init: false
+hassio_api: true
+hassio_role: manager
+homeassistant_api: true
+auth_api: true
+map:
+  - addon_config:rw
+  - share:rw
+  - media:rw
+  - ssl
+name: Claude Desktop
+options:
+  env_vars: []
+  DNS_server: 8.8.8.8
+  data_location: /data/data
+  PGID: 0
+  PUID: 0
+  additional_apps: ""
+  additional_pip: ""
+  auto_update: true
+  github_email: ""
+  ha_smart_context: true
+  enable_ha_mcp: true
+  dangerously_skip_permissions: false
+  github_token: ""
+  github_username: ""
+  install_caveman: true
+  install_github_cli: true
+  install_headroom: true
+  install_rtk: true
+panel_admin: false
+panel_icon: mdi:robot-happy
+ports:
+  3001/tcp: null
+  8787/tcp: 8787
+ports_description:
+  3001/tcp: Web interface https
+  8787/tcp: Headroom dashboard and proxy
+privileged:
+  - SYS_ADMIN
+  - DAC_READ_SEARCH
+schema:
+  env_vars:
+    - name: match(^[A-Za-z0-9_]+$)
+      value: str?
+  DNS_server: str?
+  data_location: str?
+  DRINODE: list(/dev/dri/card0|/dev/dri/card1|/dev/dri/card2|/dev/dri/renderD128|/dev/dri/renderD129|)?
+  KEYBOARD: list(da-dk-qwerty|de-de-qwertz|en-gb-qwerty|en-us-qwerty|es-es-qwerty|fr-ch-qwertz|fr-fr-azerty|it-it-qwerty|ja-jp-qwerty|pt-br-qwerty|sv-se-qwerty|tr-tr-qwerty)?
+  PASSWORD: str?
+  PGID: int
+  PUID: int
+  TZ: match([A-Z][a-z]*./[A-Z][a-z]*.)?
+  additional_apps: str?
+  additional_pip: str?
+  auto_update: bool?
+  github_email: str?
+  ha_smart_context: bool?
+  enable_ha_mcp: bool?
+  dangerously_skip_permissions: bool?
+  github_token: password?
+  github_username: str?
+  install_caveman: bool
+  install_github_cli: bool
+  install_headroom: bool
+  install_rtk: bool
+slug: claude_desktop
+tmpfs: true
+udev: true
+url: https://github.com/alexbelgium/hassio-addons
+version: "1.8"
+video: true
@@ -0,0 +1,34 @@
+#!/usr/bin/env sh
+# Persist Claude Desktop sign-in across restarts.
+# Claude Desktop (Electron) stores its auth token via safeStorage, which on Linux needs the
+# Secret Service API (org.freedesktop.secrets). Provide it with gnome-keyring on the openbox
+# session bus (startwm.sh runs `dbus-launch --exit-with-session`), unlocked with an empty
+# password so it comes back automatically after a restart. The keyring DB lives under
+# $HOME/.local/share/keyrings, and HOME=/data/data is persistent add-on storage, so the
+# saved sign-in survives add-on restarts.
+eval "$(gnome-keyring-daemon --start --components=secrets 2>/dev/null)" || true
+printf '' | gnome-keyring-daemon --unlock 2>/dev/null || true
+export GNOME_KEYRING_CONTROL SSH_AUTH_SOCK
+dbus-update-activation-environment --all >/dev/null 2>&1 || true
+
+# --password-store=gnome-libsecret forces Electron onto the libsecret backend instead of
+# falling back to plaintext (and warning that the sign-in will not be saved).
+CLAUDE_DESKTOP_COMMAND_FILE="/tmp/claude-desktop-command"
+DEFAULT_CLAUDE_DESKTOP_COMMAND="claude-desktop --no-sandbox --disable-dev-shm-usage --password-store=gnome-libsecret"
+if [ -s "$CLAUDE_DESKTOP_COMMAND_FILE" ]; then
+    CLAUDE_DESKTOP_COMMAND="$(cat "$CLAUDE_DESKTOP_COMMAND_FILE")"
+else
+    CLAUDE_DESKTOP_COMMAND="$DEFAULT_CLAUDE_DESKTOP_COMMAND"
+fi
+if bashio::config.true 'install_headroom'; then
+    export ANTHROPIC_BASE_URL="http://127.0.0.1:8787"
+fi
+
+# Launch the configured command. If a custom/wrapped command fails to start, fall back to
+# the plain Claude Desktop launch so the desktop app still comes up for the user.
+if ! sh -c "$CLAUDE_DESKTOP_COMMAND"; then
+    if [ "$CLAUDE_DESKTOP_COMMAND" != "$DEFAULT_CLAUDE_DESKTOP_COMMAND" ]; then
+        echo "autostart: '$CLAUDE_DESKTOP_COMMAND' failed; falling back to default Claude Desktop launch" >&2
+        exec sh -c "$DEFAULT_CLAUDE_DESKTOP_COMMAND"
+    fi
+fi
@@ -0,0 +1,4 @@
+# Hourly rtk + headroom token-savings report to the add-on log (heartbeat + gains).
+# Seeded to /data/data/crontabs/root by init-crontab-config and run by svc-cron; edit the
+# persistent copy to customize. Output goes to /proc/1/fd/1 so it shows in the add-on log.
+0 * * * * /usr/local/bin/claude-gains-report.sh > /proc/1/fd/1 2>&1
@@ -0,0 +1,107 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+# shellcheck disable=SC2046
+set -e
+
+# Define user
+PUID=$(bashio::config "PUID")
+PGID=$(bashio::config "PGID")
+
+# Check data location
+LOCATION="$(bashio::config 'data_location')"
+
+if [[ "$LOCATION" = "null" || -z "$LOCATION" ]]; then
+    LOCATION="/data/data"
+else
+    LOCATIONOK=""
+    for location in "/share" "/config" "/data" "/mnt"; do
+        if [[ "$LOCATION" == "$location"* ]]; then
+            LOCATIONOK=true
+        fi
+    done
+
+    if [ -z "$LOCATIONOK" ]; then
+        LOCATION="/data/data"
+        bashio::log.fatal "Your data_location value can only be set in /share, /config, /data or /mnt. It will be reset to the default location : $LOCATION"
+    fi
+fi
+
+bashio::log.info "Setting data location to $LOCATION"
+
+# LinuxServer Selkies services expect the s6 envdir at /run/s6/container_environment.
+# Home Assistant add-on startup can run without s6-overlay PID1, so create the envdir
+# ourselves before those services start and before scripts write required variables.
+S6_ENVDIR="/run/s6/container_environment"
+mkdir -p "$S6_ENVDIR"
+chmod 755 /run/s6 "$S6_ENVDIR"
+
+XDG_RUNTIME_DIR="/run/user/$PUID"
+mkdir -p "$XDG_RUNTIME_DIR"
+chmod 700 "$XDG_RUNTIME_DIR"
+
+for file in /etc/s6-overlay/s6-rc.d/*/run; do
+    if [ "$(sed -n '1{/bash/p};q' "$file")" ] && ! grep -q '^export XDG_CACHE_HOME=/tmp/cache$' "$file"; then
+        sed -i "1a export HOME=$LOCATION" "$file"
+        sed -i "1a export FM_HOME=$LOCATION" "$file"
+        sed -i "1a export XDG_CACHE_HOME=/tmp/cache" "$file"
+    fi
+done
+
+for folders in /defaults /etc/cont-init.d /etc/services.d /etc/s6-overlay/s6-rc.d; do
+    if [ -d "$folders" ]; then
+        find "$folders" -type f -exec sed -i "s|/data/data|$LOCATION|g" {} + &> /dev/null || true
+    fi
+done
+
+sed -i "s|^\(abc:[^:]*:[^:]*:[^:]*:[^:]*:\)[^:]*|\1$LOCATION|" /etc/passwd
+
+printf "%s" "$LOCATION" > "$S6_ENVDIR/HOME"
+printf "%s" "$LOCATION" > "$S6_ENVDIR/FM_HOME"
+printf "%s" "/tmp/cache" > "$S6_ENVDIR/XDG_CACHE_HOME"
+printf "%s" "$XDG_RUNTIME_DIR" > "$S6_ENVDIR/XDG_RUNTIME_DIR"
+grep -qxF "export HOME=\"$LOCATION\"" ~/.bashrc 2>/dev/null || {
+    printf "%s\n" "export HOME=\"$LOCATION\""
+    printf "%s\n" "export FM_HOME=\"$LOCATION\""
+    printf "%s\n" "export XDG_CACHE_HOME=\"/tmp/cache\""
+} >> ~/.bashrc
+
+bashio::log.info "Creating $LOCATION"
+mkdir -p "$LOCATION" /tmp/cache "$XDG_RUNTIME_DIR"
+chmod 755 /tmp/cache
+chmod 700 "$XDG_RUNTIME_DIR"
+
+# Pre-create the Selkies joystick log so the base image's "chmod 777 /tmp/selkies*"
+# calls (in init-selkies-config and svc-de) never fail on an empty glob.
+touch /tmp/selkies_js.log
+chmod 777 /tmp/selkies_js.log
+
+if [ -e "$LOCATION/.cache" ] && [ ! -L "$LOCATION/.cache" ]; then
+    rm -rf "$LOCATION/.cache"
+fi
+ln -sfn /tmp/cache "$LOCATION/.cache"
+
+bashio::log.info "Setting ownership to $PUID:$PGID"
+chown -R "$PUID":"$PGID" "$LOCATION" /tmp/cache "$XDG_RUNTIME_DIR"
+chmod -R 700 "$LOCATION"
+
+# The base init-selkies-config script overrides XDG_RUNTIME_DIR to $HOME/.XDG, which lands
+# on persistent storage and conflicts with the tmpfs runtime dir set above. Re-assert the
+# tmpfs value at the end of that oneshot so the app and desktop agree on one valid dir.
+SELKIES_CONFIG_RUN="/etc/s6-overlay/s6-rc.d/init-selkies-config/run"
+if [ -f "$SELKIES_CONFIG_RUN" ]; then
+    sed -i '/^# XDG_RUNTIME_DIR override reconciled$/,+1d' "$SELKIES_CONFIG_RUN"
+    printf '\n# XDG_RUNTIME_DIR override reconciled\nprintf "%%s" "%s" > /run/s6/container_environment/XDG_RUNTIME_DIR\n' "$XDG_RUNTIME_DIR" >> "$SELKIES_CONFIG_RUN"
+fi
+
+# The Selkies desktop init oneshots do best-effort device/permission setup (mknod
+# /dev/input/*, chmod /tmp/selkies*, /dev/dri perms) that is only partially permitted in the
+# HA add-on sandbox. A non-zero exit from a oneshot fails add-on bringup and crash-loops the
+# container, so make these two tolerant and always report success. Longruns (svc-*) are left
+# untouched so s6 keeps supervising them with their real exit codes.
+for oneshot in init-video init-selkies-config; do
+    run="/etc/s6-overlay/s6-rc.d/$oneshot/run"
+    if [ -f "$run" ] && ! grep -q '^set +e$' "$run"; then
+        sed -i "1a set +e" "$run"
+        printf '\nexit 0\n' >> "$run"
+    fi
+done
@@ -0,0 +1,54 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+# shellcheck disable=SC2015
+set -e
+
+if bashio::config.has_value 'additional_apps'; then
+    bashio::log.info "Installing additional apps :"
+    NEWAPPS=$(bashio::config 'additional_apps')
+    if command -v "apt-get" &> /dev/null; then
+        apt-get update -o Acquire::http::Timeout=10 -o Acquire::https::Timeout=10 &> /dev/null || bashio::log.warning "Unable to update apt package lists"
+    fi
+    for packagestoinstall in ${NEWAPPS//,/ }; do
+        bashio::log.green "... $packagestoinstall"
+        if command -v "apk" &> /dev/null; then
+            apk add --no-cache "$packagestoinstall" &> /dev/null || (bashio::log.fatal "Error : $packagestoinstall not found")
+        elif command -v "apt-get" &> /dev/null; then
+            apt-get install -yqq --no-install-recommends "$packagestoinstall" &> /dev/null || (bashio::log.fatal "Error : $packagestoinstall not found")
+        elif command -v "pacman" &> /dev/null; then
+            pacman --noconfirm -S "$packagestoinstall" &> /dev/null || (bashio::log.fatal "Error : $packagestoinstall not found")
+        fi
+    done
+fi
+
+if bashio::config.has_value 'additional_pip'; then
+    for p in $(bashio::config 'additional_pip' | tr ',' ' '); do
+        bashio::log.green "... pip: $p"
+        pip3 install --break-system-packages "$p" || bashio::log.fatal "Error: pip package $p failed"
+    done
+fi
+
+if bashio::config.has_value 'TZ'; then
+    TIMEZONE=$(bashio::config 'TZ')
+    bashio::log.info "Setting timezone to $TIMEZONE"
+    ln -snf /usr/share/zoneinfo/"$TIMEZONE" /etc/localtime
+    echo "$TIMEZONE" > /etc/timezone
+fi || (bashio::log.fatal "Error : $TIMEZONE not found. Here is a list of valid timezones : https://manpages.ubuntu.com/manpages/focal/man3/DateTime::TimeZone::Catalog.3pm.html")
+
+if bashio::config.has_value 'KEYBOARD'; then
+    KEYBOARD=$(bashio::config 'KEYBOARD')
+    bashio::log.info "Setting keyboard to $KEYBOARD"
+    if [ -d /var/run/s6/container_environment ]; then printf "%s" "$KEYBOARD" > /var/run/s6/container_environment/KEYBOARD; fi
+grep -qxF "KEYBOARD=\"$KEYBOARD\"" ~/.bashrc 2>/dev/null || printf "%s\n" "KEYBOARD=\"$KEYBOARD\"" >> ~/.bashrc
+fi || true
+
+if bashio::config.has_value 'PASSWORD'; then
+    bashio::log.info "Setting password to the value defined in options"
+    PASSWORD=$(bashio::config 'PASSWORD')
+    passwd -d abc
+    echo -e "$PASSWORD\n$PASSWORD" | passwd abc
+elif ! bashio::config.has_value 'PASSWORD' && { [[ -n "$(bashio::addon.port "3000")" ]] || [[ -n "$(bashio::addon.port "3001")" ]] }; then
+    bashio::log.warning "SEVERE RISK IDENTIFIED"
+    bashio::log.warning "You are opening an external port but your password is not defined"
+    bashio::log.warning "You risk being hacked ! Please disable the external ports, or use a password"
+fi
@@ -0,0 +1,12 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+
+if bashio::config.true 'auto_update'; then
+    bashio::log.info "Checking for Claude Desktop updates..."
+    if apt-get update -o Acquire::http::Timeout=10 -o Acquire::https::Timeout=10 &> /dev/null && apt-get install -y --only-upgrade claude-desktop &> /dev/null; then
+        bashio::log.info "Claude Desktop version: $(dpkg-query -W -f='${Version}' claude-desktop)"
+    else
+        bashio::log.warning "Update check failed (offline?), keeping current version"
+    fi
+fi
@@ -0,0 +1,172 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+mkdir -p "$HOME/.claude"
+
+CLAUDE_DESKTOP_COMMAND_FILE="/tmp/claude-desktop-command"
+DEFAULT_CLAUDE_DESKTOP_COMMAND='claude-desktop --no-sandbox --disable-dev-shm-usage --password-store=gnome-libsecret'
+printf '%s\n' "$DEFAULT_CLAUDE_DESKTOP_COMMAND" > "$CLAUDE_DESKTOP_COMMAND_FILE"
+
+# headroom's "wrap"/proxy routing works by setting ANTHROPIC_BASE_URL, which the Claude Desktop
+# Electron app force-overrides to the production endpoint (headroom #869), so transparent
+# compression cannot be applied to the desktop launch. The integration that does work with
+# Claude Desktop is headroom's MCP server, which exposes the headroom_compress/headroom_retrieve/
+# headroom_stats tools inside the app. Register it in Claude Desktop's MCP config, leaving the
+# plain launch untouched. The merge is idempotent and preserves any other MCP servers.
+CLAUDE_DESKTOP_CONFIG="$HOME/.config/Claude/claude_desktop_config.json"
+if bashio::config.true 'install_headroom'; then
+    if command -v headroom &> /dev/null; then
+        bashio::log.info "headroom $(headroom --version 2> /dev/null || true) available; registering the headroom MCP server for Claude Desktop"
+        HEADROOM_BIN="$(command -v headroom)" CLAUDE_DESKTOP_CONFIG="$CLAUDE_DESKTOP_CONFIG" python3 - <<'PY' || bashio::log.warning "Unable to register the headroom MCP server automatically"
+import json
+import os
+from pathlib import Path
+
+path = Path(os.environ["CLAUDE_DESKTOP_CONFIG"])
+try:
+    data = json.loads(path.read_text()) if path.exists() else {}
+    if not isinstance(data, dict):
+        data = {}
+except Exception:
+    if path.exists():
+        path.rename(path.with_suffix(path.suffix + ".bak"))
+    data = {}
+servers = data.get("mcpServers")
+if not isinstance(servers, dict):
+    servers = {}
+    data["mcpServers"] = servers
+servers["headroom"] = {"command": os.environ.get("HEADROOM_BIN", "headroom"), "args": ["mcp", "serve"]}
+path.parent.mkdir(parents=True, exist_ok=True)
+path.write_text(json.dumps(data, indent=2) + "\n")
+PY
+    else
+        bashio::log.warning "headroom is not available"
+    fi
+elif [ -f "$CLAUDE_DESKTOP_CONFIG" ]; then
+    bashio::log.info "Removing the headroom MCP server from Claude Desktop"
+    CLAUDE_DESKTOP_CONFIG="$CLAUDE_DESKTOP_CONFIG" python3 - <<'PY' || bashio::log.warning "Unable to remove the headroom MCP server automatically"
+import json
+import os
+from pathlib import Path
+
+path = Path(os.environ["CLAUDE_DESKTOP_CONFIG"])
+data = json.loads(path.read_text())
+if isinstance(data, dict):
+    servers = data.get("mcpServers")
+    if isinstance(servers, dict) and servers.pop("headroom", None) is not None:
+        if not servers:
+            data.pop("mcpServers", None)
+        path.write_text(json.dumps(data, indent=2) + "\n")
+PY
+fi
+
+# Guide Claude to actually use the headroom compression tools so the MCP integration produces
+# real savings (otherwise the tools sit unused and `headroom savings` stays empty). Managed,
+# idempotent block appended to the user's global CLAUDE.md; removed when headroom is disabled.
+CLAUDE_MD="$HOME/.claude/CLAUDE.md"
+HEADROOM_GUIDE_BEGIN="<!-- BEGIN headroom (managed by claude_desktop addon) -->"
+if bashio::config.true 'install_headroom'; then
+    mkdir -p "$(dirname "$CLAUDE_MD")"
+    if ! { [ -f "$CLAUDE_MD" ] && grep -qF "$HEADROOM_GUIDE_BEGIN" "$CLAUDE_MD"; }; then
+        bashio::log.info "Adding headroom usage guidance to CLAUDE.md"
+        {
+            [ -s "$CLAUDE_MD" ] && printf '\n'
+            cat <<'MD'
+<!-- BEGIN headroom (managed by claude_desktop addon) -->
+## Headroom context compression
+
+A local Headroom proxy (127.0.0.1:8787) backs the `headroom` MCP tools. To save context tokens:
+when you produce or read a **large, structured** blob you will keep referring to — file listings,
+search results, JSON/config dumps, big command outputs, roughly >500 tokens — call
+`mcp__headroom__headroom_compress` on it and keep the returned compressed text + `hash` instead of
+the raw content. Call `mcp__headroom__headroom_retrieve` with that hash when you need the full
+original back. Skip compression for error/stack-trace output (Headroom deliberately protects it)
+and for small or one-off content. Use `mcp__headroom__headroom_stats` to check savings.
+<!-- END headroom (managed by claude_desktop addon) -->
+MD
+        } >> "$CLAUDE_MD"
+    fi
+elif [ -f "$CLAUDE_MD" ] && grep -qF "$HEADROOM_GUIDE_BEGIN" "$CLAUDE_MD"; then
+    bashio::log.info "Removing headroom usage guidance from CLAUDE.md"
+    CLAUDE_MD="$CLAUDE_MD" python3 - <<'PY' || bashio::log.warning "Unable to remove headroom guidance automatically"
+import os
+import re
+from pathlib import Path
+
+path = Path(os.environ["CLAUDE_MD"])
+text = path.read_text()
+pattern = re.compile(
+    r"\n*<!-- BEGIN headroom \(managed by claude_desktop addon\) -->.*?"
+    r"<!-- END headroom \(managed by claude_desktop addon\) -->\n?",
+    re.DOTALL,
+)
+new = pattern.sub("", text)
+if new != text:
+    path.write_text(new)
+PY
+fi
+
+if bashio::config.true 'install_rtk'; then
+    if command -v rtk &> /dev/null; then
+        if [ -f "$HOME/.claude/settings.json" ] && grep -q 'rtk hook claude' "$HOME/.claude/settings.json"; then
+            bashio::log.info "rtk Claude Code hook already configured"
+        else
+            bashio::log.info "Configuring rtk Claude Code hook"
+            RTK_NONINTERACTIVE=1 rtk init -g || bashio::log.warning "rtk global files configuration failed"
+            python3 - <<'PY' || bashio::log.warning "Unable to configure rtk hook automatically"
+import json
+from pathlib import Path
+path = Path.home() / ".claude" / "settings.json"
+try:
+    data = json.loads(path.read_text()) if path.exists() else {}
+    if not isinstance(data, dict):
+        data = {}
+except Exception:
+    if path.exists():
+        path.rename(path.with_suffix(path.suffix + ".bak"))
+    data = {}
+hooks = data.setdefault("hooks", {})
+pre = hooks.setdefault("PreToolUse", [])
+rtk_entry = {"matcher": "Bash", "hooks": [{"type": "command", "command": "rtk hook claude"}]}
+if not any("rtk hook claude" in json.dumps(entry) for entry in pre if isinstance(entry, dict)):
+    pre.append(rtk_entry)
+path.parent.mkdir(parents=True, exist_ok=True)
+path.write_text(json.dumps(data, indent=2) + "\n")
+PY
+        fi
+    else
+        bashio::log.warning "rtk is not available"
+    fi
+elif [ -f "$HOME/.claude/settings.json" ] && grep -q 'rtk' "$HOME/.claude/settings.json"; then
+    bashio::log.info "Removing rtk Claude Code hook"
+    python3 - <<'PY' || bashio::log.warning "Unable to remove rtk hook automatically"
+import json
+from pathlib import Path
+path = Path.home() / ".claude" / "settings.json"
+data = json.loads(path.read_text())
+hooks = data.get("hooks", {})
+for event, entries in list(hooks.items()):
+    if isinstance(entries, list):
+        hooks[event] = [entry for entry in entries if "rtk" not in json.dumps(entry)]
+        if not hooks[event]:
+            hooks.pop(event, None)
+if hooks:
+    data["hooks"] = hooks
+else:
+    data.pop("hooks", None)
+path.write_text(json.dumps(data, indent=2) + "\n")
+PY
+fi
+
+if bashio::config.true 'install_caveman'; then
+    if [ -d "$HOME/.claude/plugins/caveman" ] || find "$HOME/.claude" -maxdepth 4 -iname '*caveman*' -print -quit | grep -q .; then
+        bashio::log.info "caveman Claude Code plugin already configured"
+    else
+        bashio::log.info "Installing caveman Claude Code plugin"
+        curl --connect-timeout 10 --max-time 60 -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.sh | bash >/dev/null || bashio::log.warning "caveman install failed (offline?)"
+    fi
+else
+    bashio::log.info "Disabling caveman Claude Code plugin"
+    find "$HOME/.claude" -maxdepth 4 -iname '*caveman*' -exec rm -rf {} + 2> /dev/null || true
+fi
@@ -0,0 +1,41 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+if ! bashio::config.true 'install_github_cli'; then
+    bashio::log.info "GitHub CLI setup disabled"
+    exit 0
+fi
+
+if ! command -v git > /dev/null 2>&1; then
+    bashio::log.warning "git is not available"
+fi
+
+if ! command -v gh > /dev/null 2>&1; then
+    bashio::log.warning "gh is not available"
+    exit 0
+fi
+
+if bashio::config.has_value 'github_username'; then
+    git config --global user.name "$(bashio::config 'github_username')"
+fi
+
+if bashio::config.has_value 'github_email'; then
+    git config --global user.email "$(bashio::config 'github_email')"
+fi
+
+if bashio::config.has_value 'github_token'; then
+    token="$(bashio::config 'github_token')"
+    mkdir -p "$HOME/.config/gh"
+    chmod 700 "$HOME/.config/gh"
+    if env -u GH_TOKEN -u GITHUB_TOKEN gh auth status --hostname github.com > /dev/null 2>&1; then
+        bashio::log.info "GitHub CLI already authenticated for github.com"
+    else
+        bashio::log.info "Configuring GitHub CLI authentication for github.com"
+        printf '%s\n' "$token" | env -u GH_TOKEN -u GITHUB_TOKEN gh auth login --hostname github.com --with-token || bashio::log.warning "GitHub CLI authentication failed"
+    fi
+    env -u GH_TOKEN -u GITHUB_TOKEN gh auth setup-git --hostname github.com || bashio::log.warning "GitHub CLI git credential setup failed"
+else
+    bashio::log.info "GitHub CLI available. Set github_token to authenticate gh and git operations."
+fi
@@ -0,0 +1,37 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+
+NGINX_CONFIG=/etc/nginx/sites-available/ingress.conf
+SUBFOLDER="$(bashio::addon.ingress_entry)"
+
+# Ensure subfolder ends with a trailing slash (except for root)
+if [[ -n "${SUBFOLDER}" && "${SUBFOLDER}" != "/" ]]; then
+    [[ "${SUBFOLDER}" == */ ]] || SUBFOLDER="${SUBFOLDER}/"
+else
+    SUBFOLDER="/"
+fi
+
+cp /defaults/default.conf "${NGINX_CONFIG}"
+
+# Keep only the first (non-SSL) server block
+awk -v n=2 '/^[[:space:]]*server[[:space:]]*\{/{n--} n>0' "${NGINX_CONFIG}" > tmpfile
+mv tmpfile "${NGINX_CONFIG}"
+
+# Disable IPv6 listeners for ingress proxying
+sed -i '/listen \[::\]/d' "${NGINX_CONFIG}"
+
+# Adapt ports and upstream paths for Home Assistant ingress
+sed -i "s|3000|$(bashio::addon.ingress_port)|g" "${NGINX_CONFIG}"
+sed -i "s|SUBFOLDER|/|g" "${NGINX_CONFIG}"
+sed -i "s|CWS|8082|g" "${NGINX_CONFIG}"
+sed -i "s|REPLACE_HOME|${HOME:-/root}|g" "${NGINX_CONFIG}"
+sed -i "s|REPLACE_DOWNLOADS_PATH|${HOME:-/config}|g" "${NGINX_CONFIG}"
+sed -i '/proxy_buffering/a proxy_set_header Accept-Encoding "";' "${NGINX_CONFIG}"
+sed -i '/proxy_buffering/a sub_filter_once off;' "${NGINX_CONFIG}"
+sed -i '/proxy_buffering/a sub_filter_types *;' "${NGINX_CONFIG}"
+sed -i '/proxy_buffering/a sub_filter "vnc/index.html?autoconnect" "vnc/index.html?path=%%path%%/websockify?autoconnect";' "${NGINX_CONFIG}"
+sed -i "s|%%path%%|${SUBFOLDER:1}|g" "${NGINX_CONFIG}"
+
+# Avoid content encoding on proxied responses to keep Selkies happy (handled by proxy_set_header Accept-Encoding insertion above)
+cp "${NGINX_CONFIG}" /etc/nginx/sites-enabled
@@ -0,0 +1,96 @@
+types {
+    text/html                                        html htm shtml;
+    text/css                                         css;
+    text/xml                                         xml;
+    image/gif                                        gif;
+    image/jpeg                                       jpeg jpg;
+    application/javascript                           js;
+    application/atom+xml                             atom;
+    application/rss+xml                              rss;
+
+    text/mathml                                      mml;
+    text/plain                                       txt;
+    text/vnd.sun.j2me.app-descriptor                 jad;
+    text/vnd.wap.wml                                 wml;
+    text/x-component                                 htc;
+
+    image/png                                        png;
+    image/svg+xml                                    svg svgz;
+    image/tiff                                       tif tiff;
+    image/vnd.wap.wbmp                               wbmp;
+    image/webp                                       webp;
+    image/x-icon                                     ico;
+    image/x-jng                                      jng;
+    image/x-ms-bmp                                   bmp;
+
+    font/woff                                        woff;
+    font/woff2                                       woff2;
+
+    application/java-archive                         jar war ear;
+    application/json                                 json;
+    application/mac-binhex40                         hqx;
+    application/msword                               doc;
+    application/pdf                                  pdf;
+    application/postscript                           ps eps ai;
+    application/rtf                                  rtf;
+    application/vnd.apple.mpegurl                    m3u8;
+    application/vnd.google-earth.kml+xml             kml;
+    application/vnd.google-earth.kmz                 kmz;
+    application/vnd.ms-excel                         xls;
+    application/vnd.ms-fontobject                    eot;
+    application/vnd.ms-powerpoint                    ppt;
+    application/vnd.oasis.opendocument.graphics      odg;
+    application/vnd.oasis.opendocument.presentation  odp;
+    application/vnd.oasis.opendocument.spreadsheet   ods;
+    application/vnd.oasis.opendocument.text          odt;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation
+                                                     pptx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                                                     xlsx;
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                                                     docx;
+    application/vnd.wap.wmlc                         wmlc;
+    application/x-7z-compressed                      7z;
+    application/x-cocoa                              cco;
+    application/x-java-archive-diff                  jardiff;
+    application/x-java-jnlp-file                     jnlp;
+    application/x-makeself                           run;
+    application/x-perl                               pl pm;
+    application/x-pilot                              prc pdb;
+    application/x-rar-compressed                     rar;
+    application/x-redhat-package-manager             rpm;
+    application/x-sea                                sea;
+    application/x-shockwave-flash                    swf;
+    application/x-stuffit                            sit;
+    application/x-tcl                                tcl tk;
+    application/x-x509-ca-cert                       der pem crt;
+    application/x-xpinstall                          xpi;
+    application/xhtml+xml                            xhtml;
+    application/xspf+xml                             xspf;
+    application/zip                                  zip;
+
+    application/octet-stream                         bin exe dll;
+    application/octet-stream                         deb;
+    application/octet-stream                         dmg;
+    application/octet-stream                         iso img;
+    application/octet-stream                         msi msp msm;
+
+    audio/midi                                       mid midi kar;
+    audio/mpeg                                       mp3;
+    audio/ogg                                        ogg;
+    audio/x-m4a                                      m4a;
+    audio/x-realaudio                                ra;
+
+    video/3gpp                                       3gpp 3gp;
+    video/mp2t                                       ts;
+    video/mp4                                        mp4;
+    video/mpeg                                       mpeg mpg;
+    video/quicktime                                  mov;
+    video/webm                                       webm;
+    video/x-flv                                      flv;
+    video/x-m4v                                      m4v;
+    video/x-mng                                      mng;
+    video/x-ms-asf                                   asx asf;
+    video/x-ms-wmv                                   wmv;
+    video/x-msvideo                                  avi;
+}
@@ -0,0 +1,15 @@
+proxy_http_version          1.1;
+proxy_ignore_client_abort   off;
+proxy_read_timeout          86400s;
+proxy_redirect              off;
+proxy_send_timeout          86400s;
+proxy_max_temp_file_size    0;
+
+proxy_set_header Accept-Encoding "";
+proxy_set_header Connection $connection_upgrade;
+proxy_set_header Host $http_host;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-NginX-Proxy true;
+proxy_set_header X-Real-IP $remote_addr;
@@ -0,0 +1 @@
+resolver 127.0.0.11 ipv6=off;
@@ -0,0 +1,6 @@
+root            /dev/null;
+server_name     $hostname;
+
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+add_header X-Robots-Tag none;
@@ -0,0 +1,9 @@
+ssl_protocols TLSv1.2;
+ssl_prefer_server_ciphers on;
+ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA;
+ssl_ecdh_curve secp384r1;
+ssl_session_timeout  10m;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off;
+ssl_stapling on;
+ssl_stapling_verify on;
@@ -0,0 +1,3 @@
+upstream backend {
+    server 127.0.0.1:8080;
+}
@@ -0,0 +1,25 @@
+#!/usr/bin/with-contenv bashio
+# Headroom optimization proxy — runs ONLY as a local backend for the headroom MCP tools
+# (headroom_compress / headroom_retrieve, registered in 82-claude_tools.sh). It is NOT a
+# traffic router: no client's ANTHROPIC_BASE_URL is pointed at it, so the Claude Desktop
+# Electron app (which force-overrides ANTHROPIC_BASE_URL — headroom #869) and every other
+# client are unaffected. Without this backend the MCP tools cannot store/retrieve compressed
+# content and no savings are ever recorded.
+declare port=8787
+declare host=127.0.0.1
+
+# Expose the built-in Headroom dashboard only when the add-on option is enabled
+# and Home Assistant has mapped the Headroom port. The port is mapped by default
+# in config.yaml, so users can open http://<ha-host>:8787/dashboard to inspect
+# live savings, while disabling install_headroom still leaves the service idle.
+if [[ -n "$(bashio::addon.port "${port}")" ]]; then
+    host=0.0.0.0
+fi
+
+if bashio::config.true 'install_headroom' && command -v headroom >/dev/null 2>&1; then
+    bashio::log.info "svc-headroom: starting headroom proxy on ${host}:${port}; dashboard available at /dashboard when the port is mapped (MCP backend only; no client routing)"
+    exec headroom proxy --host "${host}" --port "${port}" --code-aware
+fi
+
+bashio::log.info "svc-headroom: install_headroom disabled or headroom not found; idling"
+exec sleep infinity
@@ -0,0 +1 @@
+longrun
@@ -0,0 +1,34 @@
+#!/usr/bin/with-contenv bashio
+# Hourly rtk + headroom token-savings snapshot for the add-on log.
+# Invoked by cron (see /defaults/crontabs/root); its stdout is redirected to /proc/1/fd/1,
+# so the report appears in the add-on log. Doubles as a heartbeat: if the numbers stop
+# growing, the corresponding tool has stopped working.
+# with-contenv supplies HOME from the s6 envdir, so this honors a custom `data_location`
+# (see 20-folders.sh) instead of hardcoding /data/data; it also makes bashio::config
+# available for the install_headroom gate below.
+export NO_COLOR=1                                   # keep the add-on log free of ANSI color codes
+export PATH="/lsiopy/bin:/usr/local/bin:/usr/bin:/bin:${PATH}"
+
+have_rtk=false;      command -v rtk >/dev/null 2>&1      && have_rtk=true
+have_headroom=false; command -v headroom >/dev/null 2>&1 && have_headroom=true
+
+# headroom is pip-installed unconditionally at build time, so its binary is on PATH even
+# when install_headroom is off — gate on the same config svc-headroom checks, and only
+# fall back to have_headroom as a secondary availability guard.
+headroom_enabled=false
+if bashio::config.true 'install_headroom' && $have_headroom; then
+    headroom_enabled=true
+fi
+
+# Nothing to report if neither tool is active — stay quiet.
+if ! $have_rtk && ! $headroom_enabled; then exit 0; fi
+
+echo "===== claude gains report $(date '+%Y-%m-%d %H:%M:%S') ====="
+if $headroom_enabled; then
+    echo "--- headroom savings ---"
+    headroom savings 2>&1 || echo "[warn] headroom savings failed"
+elif $have_rtk; then
+    echo "--- rtk gain ---"
+    rtk gain 2>&1 || echo "[warn] rtk gain failed"
+fi
+echo "===== end gains report ====="
@@ -0,0 +1,7 @@
+{
+  "source": "github",
+  "upstream_repo": "linuxserver/docker-baseimage-selkies",
+  "github_fulltag": true,
+  "slug": "claude_desktop",
+  "paused": false
+}
@@ -1,4 +1,14 @@
+## 0.146.1-3 (2026-07-08)
+- Fix forced HTTPS redirect loop on the plain-HTTP UI by re-adding the `assume_ssl` disable workaround.
+- Export `PUBLIC_PORT` alongside `public_hostname` so generated links point at port 3214.
+- Document `public_hostname` in README (accepts hostname or server IP).
+
+## 0.146.1-2 (06-07-2026)
+- Minor bugs fixed
 
+## 0.146.1 (2026-07-06)
+- Add configurable Manyfold public hostname with Home Assistant external URL and homeassistant.local fallbacks.
+
 ## 0.146.0 (2026-07-04)
 - Update to latest version from manyfold3d/manyfold (changelog : https://github.com/manyfold3d/manyfold/releases)
 ## 0.145.1 (24-06-2026)
@@ -1,4 +1,4 @@
-ARG BUILD_FROM=ghcr.io/manyfold3d/manyfold-solo:0.135.0
+ARG BUILD_FROM=ghcr.io/manyfold3d/manyfold-solo:latest
 FROM ${BUILD_FROM}

 # hadolint ignore=DL3041
@@ -53,6 +53,7 @@ Local development alternative on the HA host:
 ## Options

 - `secret_key_base`: App secret used by Rails to sign/encrypt sessions and tokens. See [Secret Key Base](#secret-key-base) below.
+- `public_hostname`: Hostname or server IP used to generate links (mailer and "Open in slicer" download URLs). Leave blank to auto-detect from Home Assistant's configured external URL, falling back to `homeassistant.local`.
 - `puid` / `pgid`: Ownership applied to writable mapped directories (`/config` paths).
 - `multiuser`: Toggle Manyfold multiuser mode.
 - `library_path`: Scanned/indexed path.
@@ -1,7 +1,7 @@
 name: "Manyfold"
 slug: manyfold
 description: "Manyfold 3D model manager as a Home Assistant add-on, using the upstream image with configurable library/index paths."
-version: "0.146.0"
+version: "0.146.1-3"
 url: "https://github.com/alexbelgium/hassio-addons/tree/master/manyfold"
 image: ghcr.io/alexbelgium/manyfold-{arch}
 arch:
@@ -9,6 +9,8 @@ arch:
  - aarch64
 startup: services
 init: false
+hassio_api: true
+homeassistant_api: true

 ports:
  3214/tcp: 3214
@@ -41,6 +43,7 @@ schema:
  secret_key_base: str
  puid: int
  pgid: int
+  public_hostname: str?
  multiuser: bool
  library_path: str
  thumbnails_path: str
@@ -14,6 +14,7 @@ DEFAULT_DEFAULT_WORKER_CONCURRENCY="4"
 DEFAULT_PERFORMANCE_WORKER_CONCURRENCY="1"
 DEFAULT_MAX_FILE_UPLOAD_SIZE="1073741824"
 DEFAULT_MAX_FILE_EXTRACT_SIZE="1073741824"
+DEFAULT_PUBLIC_HOSTNAME="homeassistant.local"

 log() {
  echo "[manyfold-addon] $*"
@@ -26,7 +27,46 @@ die() {

 read_opt() {
  local key="$1"
-  jq -er --arg k "$key" '.[$k]' "$OPTIONS_JSON" 2>/dev/null || true
+  jq -er --arg k "$key" '.[$k] // empty' "$OPTIONS_JSON" 2>/dev/null || true
+}
+
+strip_hostname() {
+  local raw="$1"
+
+  raw="${raw#http://}"
+  raw="${raw#https://}"
+  raw="${raw%%/*}"
+
+  if [[ "$raw" =~ ^(\[[^]]+\])(:[0-9]+)?$ ]]; then
+    raw="${BASH_REMATCH[1]}"
+  else
+    raw="${raw%%:*}"
+  fi
+
+  printf '%s\n' "$raw"
+}
+
+detect_ha_public_hostname() {
+  local supervisor_url="${SUPERVISOR:-http://supervisor}"
+  local response external_url external_host
+
+  if [[ -z "${SUPERVISOR_TOKEN:-}" ]] || ! command -v curl >/dev/null 2>&1; then
+    printf '%s\n' "$DEFAULT_PUBLIC_HOSTNAME"
+    return
+  fi
+
+  response="$(curl -fsSL \
+    -H "Authorization: Bearer ${SUPERVISOR_TOKEN}" \
+    "${supervisor_url}/core/api/config" 2>/dev/null || true)"
+  external_url="$(jq -er '.external_url // empty' <<< "$response" 2>/dev/null || true)"
+  external_host="$(strip_hostname "$external_url")"
+
+  if [[ -n "$external_host" && "$external_host" != "null" ]]; then
+    printf '%s\n' "$external_host"
+    return
+  fi
+
+  printf '%s\n' "$DEFAULT_PUBLIC_HOSTNAME"
 }

 normalize_path() {
@@ -113,16 +153,39 @@ generate_secret() {
  head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n'
 }

+# Manyfold's production.rb sets config.assume_ssl = PUBLIC_HOSTNAME.present?,
+# with no separate env var to opt out. assume_ssl makes Rails treat every
+# request as if it arrived over HTTPS (for a proxy that terminates SSL
+# upstream), which is wrong here: this add-on serves plain HTTP directly on
+# port 3214 with no TLS termination, so it produces bad https:// redirects
+# (e.g. to /users/sign_in) that browsers can't complete. Force it back off
+# via an initializer dropped into whichever app directory is found, since we
+# still need PUBLIC_HOSTNAME set for correct link generation elsewhere.
+disable_assume_ssl() {
+  local app_dir="$1"
+  local initializer_dir="${app_dir}/config/initializers"
+  [[ -d "$initializer_dir" ]] || return 0
+
+  cat > "${initializer_dir}/manyfold_addon_disable_assume_ssl.rb" << 'EOF'
+# Added by the Manyfold Home Assistant add-on: this add-on has no
+# SSL-terminating reverse proxy in front of it, so assuming SSL produces
+# incorrect https:// redirects on a plain-HTTP port.
+Rails.application.config.assume_ssl = false
+EOF
+}
+
 start_manyfold() {
  if [[ -x /usr/src/app/bin/docker-entrypoint.sh ]]; then
    log "Starting Manyfold via /usr/src/app/bin/docker-entrypoint.sh foreman start"
    cd /usr/src/app
+    disable_assume_ssl /usr/src/app
    exec ./bin/docker-entrypoint.sh foreman start
  fi

  if [[ -x /app/bin/docker-entrypoint.sh ]]; then
    log "Starting Manyfold via /app/bin/docker-entrypoint.sh foreman start"
    cd /app
+    disable_assume_ssl /app
    exec ./bin/docker-entrypoint.sh foreman start
  fi

@@ -149,8 +212,10 @@ start_manyfold() {

  if [[ -d /usr/src/app ]]; then
    cd /usr/src/app
+    disable_assume_ssl /usr/src/app
  elif [[ -d /app ]]; then
    cd /app
+    disable_assume_ssl /app
  fi

  if command -v bundle >/dev/null 2>&1; then
@@ -176,6 +241,7 @@ PERFORMANCE_WORKER_CONCURRENCY="$(read_opt performance_worker_concurrency)"; PER
 MAX_FILE_UPLOAD_SIZE="$(read_opt max_file_upload_size)"; MAX_FILE_UPLOAD_SIZE="${MAX_FILE_UPLOAD_SIZE:-$DEFAULT_MAX_FILE_UPLOAD_SIZE}"
 MAX_FILE_EXTRACT_SIZE="$(read_opt max_file_extract_size)"; MAX_FILE_EXTRACT_SIZE="${MAX_FILE_EXTRACT_SIZE:-$DEFAULT_MAX_FILE_EXTRACT_SIZE}"
 SECRET_KEY_BASE="$(read_opt secret_key_base)"; SECRET_KEY_BASE="${SECRET_KEY_BASE:-}"
+PUBLIC_HOSTNAME_RAW="$(read_opt public_hostname)"; PUBLIC_HOSTNAME_RAW="${PUBLIC_HOSTNAME_RAW:-}"

 [[ "$PUID" =~ ^[0-9]+$ ]] || die "puid must be a non-negative integer"
 [[ "$PGID" =~ ^[0-9]+$ ]] || die "pgid must be a non-negative integer"
@@ -189,6 +255,13 @@ SECRET_KEY_BASE="$(read_opt secret_key_base)"; SECRET_KEY_BASE="${SECRET_KEY_BAS
 LIBRARY_PATH="$(require_mapped_path "library_path" "$LIBRARY_PATH_RAW")"
 THUMBNAILS_PATH="$(require_mapped_path "thumbnails_path" "$THUMBNAILS_PATH_RAW")"

+if [[ -n "$PUBLIC_HOSTNAME_RAW" ]]; then
+  PUBLIC_HOSTNAME="$(strip_hostname "$PUBLIC_HOSTNAME_RAW")"
+else
+  PUBLIC_HOSTNAME="$(detect_ha_public_hostname)"
+fi
+[[ -n "$PUBLIC_HOSTNAME" && "$PUBLIC_HOSTNAME" != "null" ]] || PUBLIC_HOSTNAME="$DEFAULT_PUBLIC_HOSTNAME"
+
 case "$THUMBNAILS_PATH" in
  /config|/config/*) ;;
  *) die "thumbnails_path must resolve under /config for persistence" ;;
@@ -223,6 +296,8 @@ export MULTIUSER
 export MANYFOLD_MULTIUSER="$MULTIUSER"
 export MANYFOLD_LIBRARY_PATH="$LIBRARY_PATH"
 export MANYFOLD_THUMBNAILS_PATH="$THUMBNAILS_PATH"
+export PUBLIC_HOSTNAME
+export PUBLIC_PORT="3214"
 export RAILS_LOG_LEVEL="$LOG_LEVEL"
 export MANYFOLD_LOG_LEVEL="$LOG_LEVEL"
 export WEB_CONCURRENCY
@@ -11,6 +11,9 @@ configuration:
  multiuser:
    name: Multiuser mode
    description: Enable or disable Manyfold multiuser login.
+  public_hostname:
+    name: Public hostname
+    description: Public hostname used by Manyfold for generated links. Leave blank to use Home Assistant external URL host, or homeassistant.local if unavailable.
  library_path:
    name: Library path
    description: Folder scanned/indexed by Manyfold. Must be under /share, /media, or /config.
@@ -0,0 +1,2 @@
+## 1.0.104 (2026-07-06)
+- Initial release: Spotify to Plex add-on based on jjdenhertog/spotify-to-plex
@@ -0,0 +1,135 @@
+#============================#
+#  ALEXBELGIUM'S DOCKERFILE  #
+#============================#
+#           _.------.
+#       _.-`    ('>.-`"""-.
+# '.--'`       _'`   _ .--.)
+#    -'         '-.-';`   `
+#    ' -      _.'  ``'--.
+#        '---`    .-'""`
+#               /`
+#=== Home Assistant Addon ===#
+
+#################
+# 1 Build Image #
+#################
+
+ARG BUILD_FROM
+
+FROM ${BUILD_FROM}
+
+##################
+# 2 Modify Image #
+##################
+
+# Set S6 wait time
+ENV S6_CMD_WAIT_FOR_SERVICES=1 \
+    S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
+    S6_SERVICES_GRACETIME=0
+
+USER root
+
+##################
+# 3 Install apps #
+##################
+
+# Copy local files
+COPY rootfs/ /
+RUN find . -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -exec chmod +x {} \;
+
+# Uses /bin for compatibility purposes
+# hadolint ignore=DL4005
+RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; fi && \
+    if [ ! -f /bin/bash ] && [ -f /usr/bin/bash ]; then ln -s /usr/bin/bash /bin/bash; fi
+
+# Modules
+ARG MODULES="00-banner.sh 00-global_var.sh 01-custom_script.sh"
+
+# Automatic modules download
+COPY ha_automodules.sh /ha_automodules.sh
+RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
+
+# Manual apps
+ENV PACKAGES="jq"
+
+# Automatic apps & bashio
+COPY ha_autoapps.sh /ha_autoapps.sh
+RUN chmod 744 /ha_autoapps.sh && /ha_autoapps.sh "$PACKAGES" && rm /ha_autoapps.sh
+
+EXPOSE 9030
+
+################
+# 4 Entrypoint #
+################
+
+# Add entrypoint
+ENV S6_STAGE2_HOOK=/ha_entrypoint.sh
+COPY ha_entrypoint.sh /ha_entrypoint.sh
+RUN chmod 777 /ha_entrypoint.sh
+
+# Install bashio
+COPY bashio-standalone.sh /usr/local/lib/bashio-standalone.sh
+RUN chmod 0755 /usr/local/lib/bashio-standalone.sh
+
+ENTRYPOINT [ "/usr/bin/env" ]
+CMD [ "/ha_entrypoint.sh" ]
+
+############
+# 5 Labels #
+############
+
+ARG BUILD_ARCH
+ARG BUILD_DATE
+ARG BUILD_DESCRIPTION
+ARG BUILD_NAME
+ARG BUILD_REF
+ARG BUILD_REPOSITORY
+ARG BUILD_VERSION
+ENV BUILD_VERSION="${BUILD_VERSION}"
+LABEL \
+    io.hass.name="${BUILD_NAME}" \
+    io.hass.description="${BUILD_DESCRIPTION}" \
+    io.hass.arch="${BUILD_ARCH}" \
+    io.hass.type="addon" \
+    io.hass.version=${BUILD_VERSION} \
+    maintainer="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.title="${BUILD_NAME}" \
+    org.opencontainers.image.description="${BUILD_DESCRIPTION}" \
+    org.opencontainers.image.vendor="Home Assistant Add-ons" \
+    org.opencontainers.image.authors="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.licenses="MIT" \
+    org.opencontainers.image.url="https://github.com/alexbelgium" \
+    org.opencontainers.image.source="https://github.com/${BUILD_REPOSITORY}" \
+    org.opencontainers.image.documentation="https://github.com/${BUILD_REPOSITORY}/blob/main/README.md" \
+    org.opencontainers.image.created=${BUILD_DATE} \
+    org.opencontainers.image.revision=${BUILD_REF} \
+    org.opencontainers.image.version=${BUILD_VERSION}
+
+#################
+# 6 Healthcheck #
+#################
+
+# Avoid spamming logs
+# hadolint ignore=SC2016
+RUN \
+    # Handle Apache configuration
+    if [ -d /etc/apache2/sites-available ]; then \
+        for file in /etc/apache2/sites-*/*.conf; do \
+            sed -i '/<VirtualHost/a \ \n    # Match requests with the custom User-Agent "HealthCheck" \n    SetEnvIf User-Agent "HealthCheck" dontlog \n    # Exclude matching requests from access logs \n    CustomLog ${APACHE_LOG_DIR}/access.log combined env=!dontlog' "$file"; \
+        done; \
+    fi && \
+    \
+    # Handle Nginx configuration
+    if [ -f /etc/nginx/nginx.conf ]; then \
+        awk '/http \{/{print; print "map $http_user_agent $dontlog {\n  default 0;\n  \"~*HealthCheck\" 1;\n}\naccess_log /var/log/nginx/access.log combined if=$dontlog;"; next}1' /etc/nginx/nginx.conf > /etc/nginx/nginx.conf.new && \
+        mv /etc/nginx/nginx.conf.new /etc/nginx/nginx.conf; \
+    fi
+
+ENV HEALTH_PORT="9030" \
+    HEALTH_URL=""
+HEALTHCHECK \
+    --interval=5s \
+    --retries=5 \
+    --start-period=30s \
+    --timeout=25s \
+    CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || exit 1
@@ -0,0 +1,75 @@
+# Home assistant add-on: Spotify to Plex
+
+
+I maintain this and other Home Assistant add-ons in my free time: keeping up with upstream changes, HA changes, and testing on real hardware takes a lot of time (and some money). I use around 5-10 of my >110 addons so regularly I install test machines (and purchase some test services such as vpn) that I don't use myself to troubleshoot and improve the addons
+
+If this add-on saves you time or makes your setup easier, I would be very grateful for your support!
+
+[![Buy me a coffee][donation-badge]](https://www.buymeacoffee.com/alexbelgium)
+[![Donate via PayPal][paypal-badge]](https://www.paypal.com/donate/?hosted_button_id=DZFULJZTP3UQA)
+
+## Addon informations
+
+![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fspotify_to_plex%2Fconfig.yaml)
+![Ingress](https://img.shields.io/badge/dynamic/yaml?label=Ingress&query=%24.ingress&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fspotify_to_plex%2Fconfig.yaml)
+![Arch](https://img.shields.io/badge/dynamic/yaml?color=success&label=Arch&query=%24.arch&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fspotify_to_plex%2Fconfig.yaml)
+
+[![Codacy Badge](https://app.codacy.com/project/badge/Grade/9c6cf10bdbba45ecb202d7f579b5be0e)](https://www.codacy.com/gh/alexbelgium/hassio-addons/dashboard?utm_source=github.com&utm_medium=referral&utm_content=alexbelgium/hassio-addons&utm_campaign=Badge_Grade)
+[![GitHub Super-Linter](https://img.shields.io/github/actions/workflow/status/alexbelgium/hassio-addons/weekly-supelinter.yaml?label=Lint%20code%20base)](https://github.com/alexbelgium/hassio-addons/actions/workflows/weekly-supelinter.yaml)
+[![Builder](https://img.shields.io/github/actions/workflow/status/alexbelgium/hassio-addons/onpush_builder.yaml?label=Builder)](https://github.com/alexbelgium/hassio-addons/actions/workflows/onpush_builder.yaml)
+
+[donation-badge]: https://img.shields.io/badge/Buy%20me%20a%20coffee-%23d32f2f?logo=buy-me-a-coffee&style=flat&logoColor=white
+[paypal-badge]: https://img.shields.io/badge/Buy%20me%20a%20coffee%20Paypal-%23d32f2f?logo=buy-me-a-coffee&style=flat&logoColor=white
+
+_Thanks to everyone having starred my repo! To star it click on the image below, then it will be on top right. Thanks!_
+
+[![Stargazers repo roster for @alexbelgium/hassio-addons](https://raw.githubusercontent.com/alexbelgium/hassio-addons/master/.github/stars2.svg)](https://github.com/alexbelgium/hassio-addons/stargazers)
+
+## About
+
+This addon is based on the [docker image](https://hub.docker.com/r/jjdenhertog/spotify-to-plex) from [jjdenhertog/spotify-to-plex](https://github.com/jjdenhertog/spotify-to-plex).
+
+It keeps your Spotify playlists synced to Plex automatically: syncing any Spotify playlist (including Spotify-owned ones), supporting multiple Spotify users, scheduled automatic synchronization, smart caching and optional downloading of missing tracks via Lidarr, SLSKD or Tidal.
+
+## Configuration
+
+Before starting the add-on you need a Spotify developer application (https://developer.spotify.com/dashboard):
+
+1. Create an app and note its `Client ID` and `Client Secret`.
+1. In the app settings, add the redirect URI `https://jjdenhertog.github.io/spotify-to-plex/callback.html` (this is the default `SPOTIFY_API_REDIRECT_URI`; change it only if you self-host the callback page).
+
+Fill the add-on options:
+
+| Option | Description |
+|--------|-------------|
+| `SPOTIFY_API_CLIENT_ID` | Client ID of your Spotify developer application |
+| `SPOTIFY_API_CLIENT_SECRET` | Client secret of your Spotify developer application |
+| `SPOTIFY_API_REDIRECT_URI` | OAuth redirect URI (must match the one configured in your Spotify app) |
+| `ENCRYPTION_KEY` | Key used to encrypt stored secrets. **Leave empty** to have the add-on generate a random key on first start and persist it in the add-on config folder. Provide your own only if you want to reuse an existing configuration. |
+
+Use the add-on `env_vars` option to pass any extra upstream environment variables (for example Tidal, SLSKD, Lidarr or Plex settings). See https://github.com/alexbelgium/hassio-addons/wiki/Add-Environment-variables-to-your-Addon-2 for details.
+
+The configuration and cache are stored in the add-on config folder (`/addon_configs/<slug>`), so they survive restarts and updates.
+
+Webui can be found at `<your-ip>:9030`.
+
+## Installation
+
+The installation of this add-on is pretty straightforward and not different in
+comparison to installing any other Hass.io add-on.
+
+1. Add my add-ons repository to your home assistant instance (in supervisor addons store at top right, or click button below if you have configured my HA)
+   [![Open your Home Assistant instance and show the add add-on repository dialog with a specific repository URL pre-filled.](https://my.home-assistant.io/badges/supervisor_add_addon_repository.svg)](https://my.home-assistant.io/redirect/supervisor_add_addon_repository/?repository_url=https%3A%2F%2Fgithub.com%2Falexbelgium%2Fhassio-addons)
+1. Install this add-on.
+1. Set the required options (Spotify Client ID and Secret).
+1. Click the `Save` button to store your configuration.
+1. Start the add-on.
+1. Check the logs of the add-on to see if everything went well.
+1. Open the webui, where you will finish the setup and connect your Spotify and Plex accounts.
+
+## Support
+
+For issues related to the add-on packaging, open an issue on [alexbelgium/hassio-addons](https://github.com/alexbelgium/hassio-addons/issues).
+For issues related to the application itself, refer to the [upstream project](https://github.com/jjdenhertog/spotify-to-plex).
+
+[repository]: https://github.com/alexbelgium/hassio-addons
@@ -0,0 +1,6 @@
+{
+  "build_from": {
+    "aarch64": "jjdenhertog/spotify-to-plex:1.0.104",
+    "amd64": "jjdenhertog/spotify-to-plex:1.0.104"
+  }
+}
@@ -0,0 +1,34 @@
+arch:
+  - amd64
+  - aarch64
+description: "Sync Spotify playlists to Plex"
+environment:
+  STORAGE_DIR: /config
+image: ghcr.io/alexbelgium/spotify_to_plex-{arch}
+init: false
+map:
+  - addon_config:rw
+name: Spotify to Plex
+options:
+  env_vars: []
+  SPOTIFY_API_CLIENT_ID: ""
+  SPOTIFY_API_CLIENT_SECRET: ""
+  SPOTIFY_API_REDIRECT_URI: "https://jjdenhertog.github.io/spotify-to-plex/callback.html"
+  ENCRYPTION_KEY: ""
+panel_icon: mdi:spotify
+ports:
+  9030/tcp: 9030
+ports_description:
+  9030/tcp: Web interface
+schema:
+  env_vars:
+    - name: match(^[A-Za-z0-9_]+$)
+      value: str?
+  SPOTIFY_API_CLIENT_ID: str?
+  SPOTIFY_API_CLIENT_SECRET: str?
+  SPOTIFY_API_REDIRECT_URI: str?
+  ENCRYPTION_KEY: str?
+slug: spotify_to_plex
+url: https://github.com/alexbelgium/hassio-addons/tree/master/spotify_to_plex
+version: "1.0.104"
+webui: "http://[HOST]:[PORT:9030]"
@@ -0,0 +1,40 @@
+#!/usr/bin/env bashio
+# shellcheck shell=bash
+
+bashio::log.info "Starting Spotify to Plex"
+
+# Persist the app's /app/config into the HA add-on config dir (/config)
+CONFIG_TARGET="/config"
+mkdir -p "$CONFIG_TARGET"
+
+if [ -d /app/config ] && [ ! -L /app/config ]; then
+    if cp -rn /app/config/. "$CONFIG_TARGET/"; then
+        rm -rf /app/config
+    else
+        bashio::exit.nok "Failed to migrate /app/config to $CONFIG_TARGET; refusing to start with a non-persistent config"
+    fi
+fi
+
+if [ ! -e /app/config ] || [ -L /app/config ]; then
+    ln -sfn "$CONFIG_TARGET" /app/config
+fi
+
+# Auto-generate a persistent ENCRYPTION_KEY when the user leaves it blank.
+# Upstream reads this via Buffer.from(ENCRYPTION_KEY, 'hex') for aes-256-cbc,
+# so it must be exactly 64 hex characters (not base64).
+if [ -z "${ENCRYPTION_KEY:-}" ]; then
+    KEY_FILE="$CONFIG_TARGET/.encryption_key"
+    if [ -f "$KEY_FILE" ]; then
+        ENCRYPTION_KEY="$(cat "$KEY_FILE")"
+    else
+        ENCRYPTION_KEY="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+        printf '%s' "$ENCRYPTION_KEY" > "$KEY_FILE"
+        chmod 600 "$KEY_FILE"
+        bashio::log.info "Generated a new ENCRYPTION_KEY (stored in the add-on config dir)"
+    fi
+    export ENCRYPTION_KEY
+fi
+
+# Hand off to the upstream supervisord (web + scraper + scheduler)
+cd /app || bashio::exit.nok "Cannot find /app (upstream image layout may have changed)"
+exec /docker-entrypoint.sh supervisord -n -c /etc/supervisor/conf.d/supervisord.conf
@@ -0,0 +1,8 @@
+{
+  "last_update": "2026-07-06",
+  "repository": "alexbelgium/hassio-addons",
+  "slug": "spotify_to_plex",
+  "source": "dockerhub",
+  "upstream_repo": "jjdenhertog/spotify-to-plex",
+  "upstream_version": "1.0.104"
+}
Author	SHA1	Message	Date
Alexandre	0030556525	Expose Claude Desktop headroom dashboard	2026-07-08 14:31:22 +02:00
Alexandre	905ce7bc0f	Merge pull request #2830 from ToledoEM/fix/manyfold-assume-ssl-redirect Fix/manyfold assume ssl redirect	2026-07-08 13:57:20 +02:00
Alexandre	19fe564e17	Add conditional export for ANTHROPIC_BASE_URL	2026-07-08 13:32:01 +02:00
Alexandre	6248cb3c21	Reorder gain report checks for better logic	2026-07-08 13:30:06 +02:00
ToledoEM	eff8577e37	Use latest tag for manyfold base image	2026-07-08 12:26:06 +01:00
github-actions	1bd0c6f054	GitHub bot: changelog [nobuild]	2026-07-08 11:22:49 +00:00
Alexandre	976e9bcc03	nobuild Removed 3000/tcp port configuration from YAML.	2026-07-08 13:14:40 +02:00
Alexandre	1dab8b9344	Update config.yaml	2026-07-08 13:14:25 +02:00
ToledoEM	7667605e6b	Fix manyfold HTTPS redirect loop	2026-07-08 12:11:09 +01:00
GitHub Actions	03e470a83a	Revert "Update config.yaml" This reverts commit `b922673192`.	2026-07-08 10:43:39 +00:00
Alexandre	b922673192	Update config.yaml	2026-07-08 12:41:24 +02:00
github-actions	ba37ee203e	GitHub bot: changelog [nobuild]	2026-07-08 08:54:47 +00:00
Alexandre	55035b4ee8	Update config.yaml	2026-07-08 10:48:28 +02:00
Alexandre	fffec89eaf	Update run	2026-07-08 07:33:47 +02:00
Alexandre	0073339f8c	Merge pull request #2829 from alexbelgium/claude_desktop/hourly-gains-and-headroom-backend Claude Desktop: hourly rtk + headroom gains report + headroom proxy backend	2026-07-07 22:10:45 +02:00
alexbelgiumandClaude Opus 4.8	e1a0f01fb9	claude_desktop: fix gains report headroom gating + data_location - Gate the headroom section on install_headroom (bashio::config.true), same as svc-headroom, instead of only checking whether the binary is on PATH (it's pip-installed unconditionally at build time, so it's always present). have_headroom is now just a secondary availability guard. Fixes noisy/stale headroom output when the option is disabled. - Switch the shebang to with-contenv bashio so HOME comes from the s6 envdir instead of a hardcoded /data/data. 20-folders.sh only rewrites /data/data references under /defaults, /etc/cont-init.d, /etc/services.d and /etc/s6-overlay/s6-rc.d — not /usr/local/bin — so a custom data_location previously left this script reading/writing the wrong home directory. Verified live: real cron firing confirms with-contenv correctly resolves HOME and bashio::config from the s6 envdir when invoked by cron; isolated gating-logic test covers all four enabled/binary-present combinations. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-07 22:09:11 +02:00
alexbelgiumandClaude Opus 4.8	66b91278b9	claude_desktop: hourly rtk+headroom gains report + headroom proxy backend - Add claude-gains-report.sh + /defaults/crontabs/root: an hourly rtk gain + headroom savings snapshot to the add-on log (heartbeat + accumulated gains). - Add svc-headroom longrun: run the headroom proxy as a local MCP backend (127.0.0.1:8787, no client routing) so headroom_compress/headroom_retrieve actually store/retrieve content and record savings. Backend only, so the Claude Desktop app's traffic is untouched (headroom #869). - Nudge headroom tool usage via a managed, idempotent CLAUDE.md block. - Bump version 1.6 -> 1.7 and update CHANGELOG. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-07 21:49:58 +02:00
github-actions	a70bf0f0f4	GitHub bot : README updated	2026-07-07 17:38:51 +00:00
Alexandre	1a128d62f2	Suppress output during caveman plugin installation Redirect output of caveman plugin installation to /dev/null.	2026-07-07 18:11:29 +02:00
Alexandre	0fc40f339c	Merge pull request #2827 from alexbelgium/claude/desktop-headroom-wrap-fix-r4qaqe claude_desktop: don't wrap desktop launch with invalid headroom command	2026-07-07 16:52:41 +02:00
Claude	86395a85a0	claude_desktop: surface headroom MCP removal failures instead of swallowing them The removal block's json.loads() was wrapped in a bare try/except that set data = None on any parse error, then silently no-op'd (isinstance(data, dict) is False) with exit 0 -- so a malformed claude_desktop_config.json meant the headroom entry was never removed and bashio::log.warning never fired. Drop the try/except so parse errors propagate naturally and the script exits non-zero, matching the sibling rtk removal block's existing convention and triggering the bashio::log.warning fallback. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MgMcG1QjsSHcDQBxgPpRUw	2026-07-07 14:35:52 +00:00
Claude	a9cf84077b	claude_desktop: register headroom MCP server instead of proxy launch headroom's proxy/wrap routing relies on ANTHROPIC_BASE_URL, which Claude Desktop force-overrides (headroom #869), so it cannot transparently compress the desktop app. Register headroom's MCP server (headroom mcp serve) in Claude Desktop's claude_desktop_config.json instead -- the supported integration -- exposing the headroom_compress/headroom_retrieve/headroom_stats tools inside the app. The plain desktop launch is left untouched. The JSON merge is idempotent, preserves any other MCP servers and top-level keys, backs up malformed config, and removes the entry again when install_headroom is disabled. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MgMcG1QjsSHcDQBxgPpRUw	2026-07-07 14:24:38 +00:00
Claude	f65d5af969	claude_desktop: launch through headroom proxy instead of invalid wrap headroom "wrap" only accepts coding-agent CLIs (claude, codex, cursor, ...) with agent args after "--", so it cannot wrap the claude-desktop Electron app. Route the launch through headroom's standalone compression proxy instead: the command file now starts "headroom proxy" and points Claude Desktop at it via ANTHROPIC_BASE_URL, while the autostart still falls back to a plain launch if that fails. Claude Desktop currently force-overrides ANTHROPIC_BASE_URL (headroom #869), so transparent compression only engages once upstream adds Desktop support; until then the app launches normally. Update the README/CHANGELOG accordingly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MgMcG1QjsSHcDQBxgPpRUw	2026-07-07 14:05:53 +00:00
Claude	74e25ba41b	claude_desktop: don't wrap desktop launch with invalid headroom command install_headroom defaults to true and headroom is baked into the image, so 82-claude_tools.sh rewrote the desktop launch to "headroom wrap claude-desktop --no-sandbox ...". headroom "wrap" only accepts coding-agent CLIs (claude, codex, cursor, ...) and expects agent arguments after a "--" separator, so "claude-desktop" plus the Electron flags is an invalid wrap target/options. The autostart ran only that command with no fallback, leaving the desktop app unlaunched for default users. - Keep the plain claude-desktop launch; just expose headroom with a usage hint (matches the documented "make headroom available and log a usage hint"). - Harden autostart to fall back to the default launch if a custom/wrapped command fails to start. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MgMcG1QjsSHcDQBxgPpRUw	2026-07-07 13:18:11 +00:00
Alexandre	4d768ae1fa	Merge pull request #2826 from alexbelgium/codex/fix-default-settings-for-claude-addon Fix Claude Desktop optional tool startup	2026-07-07 15:03:18 +02:00
Alexandre	cc5d04c0f5	Fix Claude Desktop optional tool startup	2026-07-07 15:02:51 +02:00
Alexandre	f4343a6af4	Update Dockerfile	2026-07-07 14:42:25 +02:00
Alexandre	f5c6851344	Update Dockerfile	2026-07-07 13:46:08 +02:00
Alexandre	b873d57dca	Update Dockerfile	2026-07-07 13:44:56 +02:00
Alexandre	4fc8f309f8	Merge pull request #2825 from alexbelgium/codex/add-default-local-folder-and-new-options claude_desktop: switch default data_location to /data/data; add HA smart context, MCP and dangerous-permissions option; bump to v1.5	2026-07-07 13:39:31 +02:00
Alexandre	582d05815d	Address Claude Desktop review comments	2026-07-07 13:37:54 +02:00
Alexandre	7ce85f9265	Merge pull request #2823 from alexbelgium/fix/claude-desktop-startup-and-keyring fix(claude_desktop): fix startup crash loop and persist sign-in via g…	2026-07-07 13:25:38 +02:00
Alexandre	43a25654d0	Merge branch 'master' into fix/claude-desktop-startup-and-keyring	2026-07-07 13:25:14 +02:00
Alexandre	421101d7fe	Merge pull request #2824 from alexbelgium/codex/review-and-enhance-claude_desktop-addon Improve Claude Desktop tooling setup: add git/gh and ensure rtk/headroom ready	2026-07-07 13:24:21 +02:00
Alexandre	43fd7c8917	Improve Claude Desktop tooling setup	2026-07-07 13:23:52 +02:00
Alexandre ParyandClaude Opus 4.8	a3c226320d	fix(claude_desktop): fix startup crash loop and persist sign-in via gnome-keyring Startup crash loop ("All subprocesses terminated. Exiting."): - Drop the misplaced shm_size env var (Home Assistant ignores it) and run Claude Desktop with --disable-dev-shm-usage so the Electron renderer survives the default 64 MB /dev/shm. - Make the Selkies desktop init oneshots (init-video, init-selkies-config) tolerant so a partially-permitted device/permission op in the HA sandbox no longer fails add-on bringup and crash-loops the container. - Pre-create /tmp/selkies_js.log so the base image's "chmod 777 /tmp/selkies*" calls never fail on an empty glob; reconcile XDG_RUNTIME_DIR to the tmpfs runtime dir. Sign-in persistence ("Your sign-in won't be saved on this device"): - Bundle gnome-keyring/libsecret-1-0/dbus-x11 and start an unlocked Secret Service in the desktop session, launching with --password-store=gnome-libsecret. The keyring DB lives on persistent storage (/config/data), so the session survives restarts. Docs: add SIGN_IN.md documenting both problems and the (deferred) in-desktop browser option needed to complete the initial OAuth login. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XycVEAj8oZgmQszn9gdQ2E	2026-07-07 13:09:11 +02:00
Alexandre	0bdfd371ca	Merge pull request #2822 from alexbelgium/codex/fix-claude-desktop-addon-startup-issues Fix Claude Desktop Selkies startup by creating s6 envdir and XDG runtime dir	2026-07-07 11:44:17 +02:00
Alexandre	a13f5a4259	Fix Claude Desktop Selkies startup	2026-07-07 11:43:50 +02:00
Alexandre	5b0c60370f	Add files via upload	2026-07-07 10:24:47 +02:00
Alexandre	5ede162a72	Add files via upload	2026-07-07 10:24:32 +02:00
github-actions	6d8a15d249	GitHub bot: changelog [nobuild]	2026-07-07 08:21:51 +00:00
Alexandre	3bf20b4c5a	Update 20-folders.sh	2026-07-07 10:08:37 +02:00
Alexandre	5c12288d68	Update config.yaml	2026-07-07 10:07:54 +02:00
Alexandre	4bfe3e4f9f	Update config.yaml	2026-07-07 10:07:40 +02:00
Alexandre	a4560496be	Update config.yaml	2026-07-07 10:07:22 +02:00
Alexandre	690abc8efe	Merge pull request #2821 from alexbelgium/copilot/fix-failing-github-actions-job fix(claude_desktop): set HOME=/root when running rtk install script	2026-07-07 10:06:56 +02:00
copilot-swe-agent[bot]	3c51a4176e	Fix rtk binary install path in claude_desktop Dockerfile	2026-07-07 08:01:56 +00:00
GitHub Actions	dd5a8d0099	Revert "Update config.yaml" This reverts commit `24fed3cb7c`.	2026-07-07 07:59:42 +00:00
copilot-swe-agent[bot]	cf070880c8	Initial plan	2026-07-07 07:59:13 +00:00
Alexandre	24fed3cb7c	Update config.yaml	2026-07-07 09:54:18 +02:00
Alexandre	9a3edd7b69	Merge pull request #2820 from alexbelgium/copilot/fix-failing-github-actions-job Fix claude_desktop build: remove conflicting npm apt package	2026-07-07 09:53:40 +02:00
copilot-swe-agent[bot]	09a94d5b3b	Fix claude_desktop build: remove conflicting npm apt package	2026-07-07 07:52:34 +00:00
copilot-swe-agent[bot]	8f325722cf	Initial plan	2026-07-07 07:48:50 +00:00
GitHub Actions	a5ea1739c4	Revert "Update config.yaml" This reverts commit `95d75d2acd`.	2026-07-07 07:43:53 +00:00
Alexandre	95d75d2acd	Update config.yaml	2026-07-07 09:41:12 +02:00
Alexandre	1eb403f44a	nobuild Add Claude Desktop Home Assistant add-on (Selkies)	2026-07-07 09:40:29 +02:00
Alexandre	b3bebb63f1	Update config.yaml	2026-07-07 09:40:11 +02:00
AlexandreandCopilot Autofix powered by AI	3703e6d599	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-07 09:38:19 +02:00
AlexandreandCopilot Autofix powered by AI	1ffc609b50	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-07 09:38:08 +02:00
AlexandreandCopilot Autofix powered by AI	e452f51957	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-07 09:38:01 +02:00
AlexandreandCopilot Autofix powered by AI	0438f41630	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-07 09:37:48 +02:00
AlexandreandCopilot Autofix powered by AI	10b0a80991	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-07 09:37:38 +02:00
AlexandreandCopilot Autofix powered by AI	74e2736c08	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-07 09:37:26 +02:00
AlexandreandCopilot Autofix powered by AI	7fb1989343	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-07 09:37:15 +02:00
AlexandreandCopilot Autofix powered by AI	e1cf37ff29	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-07 09:36:58 +02:00
Alexandre	20c7889a4e	Remove binary assets from Claude Desktop add-on	2026-07-07 09:29:56 +02:00
Alexandre	f1daaa2ef6	Update config.yaml	2026-07-06 22:20:39 +02:00
github-actions	94c875b3d3	GitHub bot : README updated	2026-07-06 17:51:46 +00:00
github-actions	2d7054c2d2	GitHub bot: changelog [nobuild]	2026-07-06 11:36:07 +00:00
Alexandre	8abbaf00d5	Update config.yaml	2026-07-06 13:29:47 +02:00
github-actions	76464ed663	GitHub bot: sanitize (spaces + LF endings) & chmod [nobuild]	2026-07-06 07:28:38 +00:00
Alexandre	6ab3ded3da	Update config.yaml	2026-07-06 09:27:48 +02:00
Alexandre	6f6bb17f0a	Merge pull request #2816 from alexbelgium/claude/spotify-to-plex-addon-3blmet Add Spotify to Plex add-on	2026-07-06 09:27:16 +02:00
Claude	15c0c296f4	Fail safely instead of degrading silently in spotify_to_plex startup - Exit with a clear error if the /app/config migration fails, rather than continuing to run against the non-persistent source directory (user changes would otherwise silently vanish on the next restart). - Exit with a clear error if /app is missing instead of swallowing a broken upstream image layout with `\|\| true`. Addresses further review feedback from PR #2816. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZTfSk3GQRU7oD85TnjsmW	2026-07-06 07:20:09 +00:00
Alexandre	f60574d6f8	Merge branch 'master' into claude/spotify-to-plex-addon-3blmet	2026-07-06 09:16:51 +02:00
Claude	00e5e20175	Fix encryption key format and config migration safety in spotify_to_plex - Generate ENCRYPTION_KEY as 64 hex chars instead of base64: upstream reads it via Buffer.from(ENCRYPTION_KEY, 'hex') for aes-256-cbc, so a base64 value silently broke Spotify token encryption for anyone leaving the option blank (the default path). - Store the key without a trailing newline and chmod 600 it. - Only delete /app/config after a successful copy into /config, so a failed migration (permissions, disk full) can't silently wipe the upstream default config. Addresses review feedback from PR #2816. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZTfSk3GQRU7oD85TnjsmW	2026-07-06 07:15:35 +00:00
Alexandre	725f42932d	Add files via upload	2026-07-06 09:14:01 +02:00
github-actions	d32117dab6	GitHub bot: changelog [nobuild]	2026-07-06 07:12:33 +00:00
Alexandre	610c21b55e	Update version to 0.146.1-2 in config.yaml	2026-07-06 09:10:17 +02:00
Alexandre	d9a62fa14e	Update run.sh	2026-07-06 09:09:12 +02:00
Alexandre	91096f29da	Merge pull request #2815 from alexbelgium/codex/add-public-host-name-option Add Manyfold public hostname option	2026-07-06 09:02:59 +02:00
Claude	c1965de873	Add Spotify to Plex add-on New add-on wrapping the upstream jjdenhertog/spotify-to-plex Docker image (requested in issue #2814). Keeps Spotify playlists synced to Plex. - Wraps the multi-arch upstream image via BUILD_FROM (amd64 + aarch64) - Uses the shared ha_entrypoint framework with 00-global_var.sh so add-on options (Spotify credentials, redirect URI, encryption key) become the environment variables the app expects - 99-run.sh persists /app/config into the add-on config dir, auto-generates and stores a stable ENCRYPTION_KEY when left blank, then hands off to the upstream supervisord - Web UI exposed directly on port 9030 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZTfSk3GQRU7oD85TnjsmW	2026-07-06 07:01:05 +00:00
Alexandre	b36ebeab59	Fix Manyfold public hostname detection	2026-07-06 08:52:51 +02:00
github-actions	3b57934ef2	GitHub bot: changelog [nobuild]	2026-07-06 05:48:31 +00:00
Alexandre	9513420051	Add Manyfold public hostname option	2026-07-06 07:44:05 +02:00
Alexandre	2255ec8259	Update config.yaml	2026-07-06 07:42:14 +02:00