fix(claude_desktop): correct HA MCP endpoint, harden config perms and chmod scope

Home Assistant's MCP Server integration serves stateless Streamable HTTP at
/api/mcp; mcp-proxy defaults to SSE, so the previous registration (SSE at
/mcp_server/sse) could never attach. Pass --transport=streamablehttp
--stateless and default ha_mcp_url to /api/mcp.

Match managed MCP entries by binary basename outside $HOME so a base-image
path change still updates them, while user-installed binaries under $HOME
remain untouched. Resolve tokensave via command -v like the others.

Write Claude config files 0600 (they hold the HA long-lived token in clear
text) and scope the build-time chmod +x pass to the shipped script dirs.

Docs: dashboard reachability wording, stale /config/data HOME, and the
custom-script filename (claude_desktop.sh, per the $slug.sh template).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/stargazer_countries.csv

@@ -162,6 +162,7 @@ DARKNAGAN,France
 DDanii,
 DMurzNN,
 DUC750,
+DY-hub,
 DaFlowah,
 DaJonas94,
 Daafip,Netherlands
@@ -238,6 +239,7 @@ EtienneMD,
 Evel270,
 Everestlion,
 EvertJob,
+Exlatis,
 Extrunder,
 F0264,
 F4bsi,Germany
@@ -563,6 +565,7 @@ PhoenixTwoFive,Germany
 PhysShell,
 PierreNa,France
 PietroSpina,
+Pingmin,
 PiotrKrzyzek,United States
 PiratesGhost,
 Pixelzeus,
@@ -897,10 +900,12 @@ antorimba,
 antx-code,
 anyezhe,
 aorosora,
+araminimichael,
 arbal,United States
 ardemk,
 ared469,
 arethefreshest,
+arozoire,
 arpit-mehra,
 artemave,France
 artemdanielov,
@@ -1156,6 +1161,7 @@ danbruno,
 danctrl,Germany
 danez,United States
 danieldotnl,Netherlands
+danishru,
 dannybeeckman,
 dannybloomfield,United States
 danveitch76,
@@ -1744,6 +1750,7 @@ ljsquare,
 llabourdeth,
 llewy,
 llfjahn,
+llugo,
 lmalmoreno,Brazil
 lnrdmx,
 loc4t3llix,
@@ -2050,6 +2057,7 @@ pedrolicassali,
 pedromfa,
 pedrware,Portugal
 peeetek,
+peggleg,
 pejannl,
 pem884,United States
 pepelatc,
@@ -2273,6 +2281,7 @@ skalingclouds,United States
 skamaleo,
 skavieller,
 skipper00,
+skoducks,United States
 skylidefr,
 skynet-network,
 slimehands,
@@ -2532,6 +2541,7 @@ williamcorsel,Netherlands
 willigenburggihaux,
 willnewcombe,United Kingdom
 wimb0,
+wingerasc,
 witold-gren,Poland
 wonderfulhuber,
 wonkygecko,United States

.github/workflows/onpr_check-pr.yaml

@@ -35,6 +35,7 @@ jobs:
           git fetch origin "${{ github.event.before }}" || true
           changed_changelog_files=$(git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" | grep -iE '^([^/]+/)?changelog\.(md|txt|ya?ml|json)$' || true)
           echo "$changed_changelog_files"
+          echo "changelogs_files=$changed_changelog_files" >> "$GITHUB_OUTPUT"
           changed_config_files=$(git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" | grep -E '^[^/]+/config\.(json|ya?ml)$' || true)
           echo "$changed_config_files"
           all_changed_files=$(echo -e "$changed_config_files\n$changed_changelog_files" | sort -u)
@@ -208,6 +209,7 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: ${{ matrix.addon }}
+          platforms: linux/arm64
           push: false
           load: true
           file: ${{ matrix.addon }}/Dockerfile

.github/workflows/pr2841-diagnostic.yml

@@ -1,51 +0,0 @@
----
-name: Claude Add-on Build Diagnostic
-
-on:
-  pull_request:
-    branches:
-      - master
-
-jobs:
-  diagnose:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Gather add-on information
-        id: information
-        uses: frenck/action-addon-information@v1.4
-        with:
-          path: ./claude_desktop/
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Build aarch64 and capture tail
-        shell: bash
-        run: |
-          set +e
-          BUILD_FROM="$(jq -r '.build_from.aarch64 // empty' '${{ steps.information.outputs.build }}')"
-          docker buildx build \
-            --platform linux/arm64 \
-            --progress=plain \
-            --build-arg "BUILD_FROM=${BUILD_FROM}" \
-            --file claude_desktop/Dockerfile \
-            claude_desktop >build.log 2>&1
-          status=$?
-          tail -n 300 build.log >build-tail.log
-          printf 'build_status=%s\n' "$status" >build-status.txt
-          exit 0
-
-      - name: Upload diagnostic log
-        uses: actions/upload-artifact@v4
-        with:
-          name: claude-aarch64-build-log
-          path: |
-            build-tail.log
-            build-status.txt
-          retention-days: 1

README.md

@@ -56,19 +56,19 @@ If you want to do add the repository manually, please follow the procedure highl
 
 ### Number of addons
 
-- In the repository : 135
-- Installed : 508490
+- In the repository : 136
+- Installed : 626324
 
 ### Top 3
 
-1. Arpspoof (59486x)
-2. Sponsorblockcast (55582x)
-3. Flaresolverr (44486x)
+1. Arpspoof (86665x)
+2. Sponsorblockcast (82801x)
+3. Jellyfin (71957x)
 
 ### Architectures used
 
-- amd64: 88%
-- aarch64: 12%
+- amd64: 90%
+- aarch64: 10%
 
 ### Stars evolution
 
@@ -77,7 +77,7 @@ If you want to do add the repository manually, please follow the procedure highl
 ## Add-ons provided by this repository
 
 %%ADDONS_LIST%%
-✓  [Arpspoof (59486x)](arpspoof/) : block internet connection for local network devices
+✓  [Arpspoof (86665x)](arpspoof/) : block internet connection for local network devices
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Farpspoof%2Fconfig.yaml)
 ![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Farpspoof%2Fupdater.json)
@@ -143,6 +143,17 @@ If you want to do add the repository manually, please follow the procedure highl
 ![amd64][amd64-badge]
 ![ingress][ingress-badge]
 
+✓ ![image](https://api.iconify.design/mdi/bird.svg) [BirdNET-Pi (zach7036)](birdnet-pi-zach/) : Realtime acoustic bird classification system
+
+  ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fbirdnet-pi-zach%2Fconfig.yaml)
+![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fbirdnet-pi-zach%2Fupdater.json)
+![aarch64][aarch64-badge]
+![amd64][amd64-badge]
+![ingress][ingress-badge]
+![mqtt][mqtt-badge]
+![smb][smb-badge]
+![localdisks][localdisks-badge]
+
 ✓ ![image](https://api.iconify.design/mdi/bird.svg) [BirdNET-PiPy](birdnet-pipy/) : BirdNET-PiPy bird detection with a modern web dashboard
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fbirdnet-pipy%2Fconfig.yaml)
@@ -247,7 +258,7 @@ If you want to do add the repository manually, please follow the procedure highl
 ![amd64][amd64-badge]
 ![ingress][ingress-badge]
 
-✓ ![image](https://api.iconify.design/mdi/robot-happy.svg) [Claude Desktop](claude_desktop/) : Claude Desktop streamed through a browser with LinuxServer Selkies
+✓ ![image](https://api.iconify.design/mdi/robot-happy.svg) [Claude Desktop](claude_desktop/) : Claude Desktop and a persistent Claude Code web terminal
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fclaude_desktop%2Fconfig.yaml)
 ![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fclaude_desktop%2Fupdater.json)
@@ -508,7 +519,7 @@ If you want to do add the repository manually, please follow the procedure highl
 ![smb][smb-badge]
 ![localdisks][localdisks-badge]
 
-✓ ![image](https://api.iconify.design/mdi/billiards-rack.svg) [Jellyfin NAS](jellyfin/) : A free Software Media System that puts you in control of managing and streaming your media
+✓ ![image](https://api.iconify.design/mdi/billiards-rack.svg) [Jellyfin (71957x) NAS](jellyfin/) : A free Software Media System that puts you in control of managing and streaming your media
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fjellyfin%2Fconfig.yaml)
 ![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fjellyfin%2Fupdater.json)
@@ -571,7 +582,7 @@ If you want to do add the repository manually, please follow the procedure highl
 ![aarch64][aarch64-badge]
 ![amd64][amd64-badge]
 
-✓ ![image](https://api.iconify.design/mdi/movie-search.svg) [Maintainerr](maintainerr/) : Rule-based media cleanup tool for Plex, Jellyfin and Emby. Creates collections and optionally deletes unwatched content.
+✓ ![image](https://api.iconify.design/mdi/movie-search.svg) [Maintainerr](maintainerr/) : Rule-based media cleanup tool for Plex, Jellyfin (71957x) and Emby. Creates collections and optionally deletes unwatched content.
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fmaintainerr%2Fconfig.yaml)
 ![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fmaintainerr%2Fupdater.json)
@@ -885,7 +896,7 @@ If you want to do add the repository manually, please follow the procedure highl
 ![smb][smb-badge]
 ![localdisks][localdisks-badge]
 
-✓ ![image](https://api.iconify.design/mdi/movie-search.svg) [Seerr](seerr/) : Open-source media request and discovery manager for Jellyfin, Plex, and Emby
+✓ ![image](https://api.iconify.design/mdi/movie-search.svg) [Seerr](seerr/) : Open-source media request and discovery manager for Jellyfin (71957x), Plex, and Emby
 
   ![Version](https://img.shields.io/badge/dynamic/yaml?label=Version&query=%24.version&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fseerr%2Fconfig.yaml)
 ![Update](https://img.shields.io/badge/dynamic/json?label=Updated&query=%24.last_update&url=https%3A%2F%2Fraw.githubusercontent.com%2Falexbelgium%2Fhassio-addons%2Fmaster%2Fseerr%2Fupdater.json)

aurral/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 1.76.52 (2026-07-11)
+- Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
+ 
 ## 1.76.51 (2026-06-17)
 - Update to latest version from lklynet/aurral (changelog : https://github.com/lklynet/aurral/releases)
 ## 1.76.49 (2026-06-05)

aurral/config.yaml

@@ -1,5 +1,5 @@
 name: Aurral
-version: "1.76.51"
+version: "1.76.52"
 slug: aurral
 description: >-
   Self-hosted music discovery, request management, flows, and playlist

aurral/updater.json

@@ -1,9 +1,9 @@
 {
-  "last_update": "2026-06-17",
+  "last_update": "2026-07-11",
   "repository": "alexbelgium/hassio-addons",
   "slug": "aurral",
   "source": "github",
   "upstream_repo": "lklynet/aurral",
-  "upstream_version": "1.76.51",
+  "upstream_version": "1.76.52",
   "github_beta": false
 }

birdnet-go-dev/CHANGELOG.md

@@ -1,3 +1,5 @@
+## source-20260714 (14-07-2026)
+- Minor bugs fixed
 ## source-20260709 (09-07-2026)
 - Minor bugs fixed
 ## source-20260708-4 (08-07-2026)

birdnet-go-dev/config.yaml

@@ -127,5 +127,5 @@ slug: birdnet-go-dev
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
 usb: true
-version: "source-20260709"
+version: "source-20260714"
 video: true

birdnet-go/CHANGELOG.md

@@ -1,3 +1,6 @@
+ 
+## 20260712 (2026-07-13)
+- Update to latest version from tphakala/birdnet-go (changelog : https://github.com/tphakala/birdnet-go/releases)
 ## nightly-20260615-4 (09-07-2026)
 - Minor bugs fixed
 ## nightly-20260615-3 (05-07-2026)

birdnet-go/config.yaml

@@ -128,4 +128,4 @@ slug: birdnet-go
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-go
 usb: true
-version: "nightly-20260615-4"
+version: "20260712"

birdnet-go/updater.json

@@ -2,10 +2,10 @@
   "github_beta": true,
   "github_exclude": "-4",
   "github_fulltag": true,
-  "last_update": "2026-06-17",
+  "last_update": "2026-07-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "birdnet-go",
   "source": "github",
   "upstream_repo": "tphakala/birdnet-go",
-  "upstream_version": "nightly-20260615"
+  "upstream_version": "20260712"
 }

birdnet-pipy/CHANGELOG.md

@@ -1,4 +1,10 @@
  
+## 0.8.4 (2026-07-13)
+- Update to latest version from Suncuss/BirdNET-PiPy (changelog : https://github.com/Suncuss/BirdNET-PiPy/releases)
+ 
+## 0.8.3 (2026-07-11)
+- Update to latest version from Suncuss/BirdNET-PiPy (changelog : https://github.com/Suncuss/BirdNET-PiPy/releases)
+ 
 ## 0.8.2.1 (2026-07-05)
 - Re-tag of 0.8.2-1 with no content change. Home Assistant compares add-on versions with semver semantics, where a `-N` suffix counts as a *pre-release* and sorts **below** the base version — so users already on 0.8.2 saw the 0.8.2-1 nginx fix as "Up-to-date" with the Update button disabled. Four-segment `0.8.2.1` sorts above both `0.8.2` and `0.8.2-1` (and below the next upstream `0.8.3`), so the update becomes installable everywhere.
 

birdnet-pipy/config.yaml

@@ -96,4 +96,4 @@ schema:
   ssl: bool?
 slug: birdnet-pipy
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-pipy
-version: "0.8.2.1"
+version: "0.8.4"

birdnet-pipy/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-07-04",
+  "last_update": "2026-07-13",
   "repository": "alexbelgium/hassio-addons",
   "slug": "birdnet-pipy",
   "source": "github",
   "upstream_repo": "Suncuss/BirdNET-PiPy",
-  "upstream_version": "0.8.2"
+  "upstream_version": "0.8.4"
 }

browser_brave/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 1.92.139-ls112 (2026-07-11)
+- Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)
+ 
 ## 1.92.134-ls109 (2026-07-04)
 - Update to latest version from linuxserver/docker-brave (changelog : https://github.com/linuxserver/docker-brave/releases)
  

browser_brave/config.yaml

@@ -69,5 +69,5 @@ slug: brave
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.92.134-ls109"
+version: "1.92.139-ls112"
 video: true

browser_brave/updater.json

@@ -1,9 +1,9 @@
 {
   "github_fulltag": "true",
-  "last_update": "2026-07-04",
+  "last_update": "2026-07-11",
   "repository": "alexbelgium/hassio-addons",
   "slug": "brave",
   "source": "github",
   "upstream_repo": "linuxserver/docker-brave",
-  "upstream_version": "1.92.134-ls109"
+  "upstream_version": "1.92.139-ls112"
 }

browser_chromium/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## version-30a7c401 (2026-07-11)
+- Update to latest version from linuxserver/docker-chromium (changelog : https://github.com/linuxserver/docker-chromium/releases)
+ 
 ## version-7148c2a3 (2026-07-04)
 - Update to latest version from linuxserver/docker-chromium (changelog : https://github.com/linuxserver/docker-chromium/releases)
  

browser_chromium/config.yaml

@@ -71,5 +71,5 @@ slug: chromium
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "version-7148c2a3"
+version: "version-30a7c401"
 video: true

browser_chromium/updater.json

@@ -1,9 +1,9 @@
 {
   "github_fulltag": "true",
-  "last_update": "2026-07-04",
+  "last_update": "2026-07-11",
   "repository": "alexbelgium/hassio-addons",
   "slug": "chromium",
   "source": "github",
   "upstream_repo": "linuxserver/docker-chromium",
-  "upstream_version": "version-7148c2a3"
+  "upstream_version": "version-30a7c401"
 }

chatgpt_codex/CHANGELOG.md

@@ -0,0 +1,10 @@
+## 0.144.3-2 (14-07-2026)
+
+- Initial ChatGPT Codex add-on.
+- Added a persistent, administrator-only Home Assistant ingress terminal backed by tmux.
+- Made `headroom wrap codex` the default launch path.
+- Configured Docker builds to install the latest stable Codex, Headroom, RTK, ttyd, and Rust toolchain versions without hard-coded tool version pins.
+- Added RTK native Codex initialization and savings reporting.
+- Added device-code authentication and direct Codex fallback helpers.
+- Added persistent configuration, GitHub CLI integration, mount support, and safe defaults.
+- Made the default workspace follow a custom `data_location`.

chatgpt_codex/Dockerfile

@@ -0,0 +1,157 @@
+#============================#
+#  ALEXBELGIUM'S DOCKERFILE  #
+#============================#
+#=== Home Assistant Addon ===#
+
+#################
+# 1 Build Image #
+#################
+
+ARG BUILD_FROM
+ARG BUILD_VERSION
+
+FROM rust:bookworm AS rtk-builder
+RUN set -eux; \
+    rtk_version="$(git ls-remote --tags --refs --sort=-v:refname \
+        https://github.com/rtk-ai/rtk.git 'refs/tags/v*' \
+        | awk -F/ '$3 ~ /^v[0-9]+\.[0-9]+\.[0-9]+$/ { print $3; exit }')"; \
+    test -n "$rtk_version"; \
+    git clone --depth 1 --branch "$rtk_version" https://github.com/rtk-ai/rtk.git /src/rtk; \
+    cd /src/rtk; \
+    cargo build --release --locked; \
+    install -D -m 0755 target/release/rtk /out/rtk; \
+    /out/rtk --version
+
+FROM ${BUILD_FROM}
+
+##################
+# 2 Modify Image #
+##################
+
+ENV S6_CMD_WAIT_FOR_SERVICES=1 \
+    S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0 \
+    S6_SERVICES_GRACETIME=0 \
+    HEADROOM_CONTEXT_TOOL=rtk
+
+USER root
+VOLUME [ "/sys/fs/cgroup" ]
+
+ARG TEMPLATE_BASE_URL="https://raw.githubusercontent.com/alexbelgium/hassio-addons/master/.templates"
+
+##################
+# 3 Install apps #
+##################
+
+COPY rootfs/ /
+RUN find /etc/cont-init.d /etc/s6-overlay /usr/local/bin \
+        -type f \( -name "*.sh" -o -name "run" -o -name "finish" -o -path "/usr/local/bin/*" \) \
+        -print -exec chmod +x {} \;
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        git \
+        gh \
+        jq \
+        less \
+        nano \
+        openssh-client \
+        python3-pip \
+        ripgrep \
+        tmux && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install the latest stable official Codex static binary for the target architecture.
+RUN set -eux; \
+    case "$(dpkg --print-architecture)" in \
+        amd64) codex_arch="x86_64" ;; \
+        arm64) codex_arch="aarch64" ;; \
+        *) echo "Unsupported architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
+    esac; \
+    archive="/tmp/codex.tar.gz"; \
+    curl -fsSL --retry 3 --retry-delay 2 \
+        -o "$archive" \
+        "https://github.com/openai/codex/releases/latest/download/codex-${codex_arch}-unknown-linux-musl.tar.gz"; \
+    tar -xzf "$archive" -C /tmp; \
+    install -m 0755 "/tmp/codex-${codex_arch}-unknown-linux-musl" /usr/local/bin/codex; \
+    rm -f "$archive" "/tmp/codex-${codex_arch}-unknown-linux-musl"; \
+    codex --version
+
+# Install the latest stable ttyd binary for the Home Assistant ingress terminal.
+RUN set -eux; \
+    case "$(dpkg --print-architecture)" in \
+        amd64) ttyd_arch="x86_64" ;; \
+        arm64) ttyd_arch="aarch64" ;; \
+        *) echo "Unsupported architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL --retry 3 --retry-delay 2 \
+        -o /usr/local/bin/ttyd \
+        "https://github.com/tsl0922/ttyd/releases/latest/download/ttyd.${ttyd_arch}"; \
+    chmod 0755 /usr/local/bin/ttyd; \
+    ttyd --version
+
+COPY --from=rtk-builder /out/rtk /usr/local/bin/rtk
+RUN rtk --version && \
+    pip3 install --upgrade --break-system-packages --no-cache-dir "headroom-ai[proxy,code,mcp]" && \
+    headroom --version
+
+ARG MODULES="00-banner.sh 00-global_var.sh 01-custom_script.sh 00-local_mounts.sh 00-smb_mounts.sh 90-dns_set.sh"
+RUN curl -fsSL --retry 3 --retry-delay 2 \
+        -o /ha_automodules.sh "${TEMPLATE_BASE_URL}/ha_automodules.sh" && \
+    chmod 744 /ha_automodules.sh && \
+    /ha_automodules.sh "$MODULES" && \
+    rm /ha_automodules.sh
+
+################
+# 4 Entrypoint #
+################
+
+RUN curl -fsSL --retry 3 --retry-delay 2 \
+        -o /ha_entrypoint.sh "${TEMPLATE_BASE_URL}/ha_entrypoint.sh" && \
+    curl -fsSL --retry 3 --retry-delay 2 \
+        -o /usr/local/lib/bashio-standalone.sh "${TEMPLATE_BASE_URL}/bashio-standalone.sh" && \
+    chmod 0777 /ha_entrypoint.sh && \
+    chmod 0755 /usr/local/lib/bashio-standalone.sh
+
+ENTRYPOINT [ "/usr/bin/env" ]
+CMD [ "/ha_entrypoint.sh" ]
+
+############
+# 5 Labels #
+############
+
+ARG BUILD_ARCH
+ARG BUILD_DATE
+ARG BUILD_DESCRIPTION
+ARG BUILD_NAME
+ARG BUILD_REF
+ARG BUILD_REPOSITORY
+ARG BUILD_VERSION
+ENV BUILD_VERSION="${BUILD_VERSION}"
+LABEL \
+    io.hass.name="${BUILD_NAME}" \
+    io.hass.description="${BUILD_DESCRIPTION}" \
+    io.hass.arch="${BUILD_ARCH}" \
+    io.hass.type="addon" \
+    io.hass.version=${BUILD_VERSION} \
+    maintainer="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.title="${BUILD_NAME}" \
+    org.opencontainers.image.description="${BUILD_DESCRIPTION}" \
+    org.opencontainers.image.vendor="Home Assistant Add-ons" \
+    org.opencontainers.image.authors="alexbelgium (https://github.com/alexbelgium)" \
+    org.opencontainers.image.licenses="MIT" \
+    org.opencontainers.image.url="https://github.com/alexbelgium" \
+    org.opencontainers.image.source="https://github.com/${BUILD_REPOSITORY}" \
+    org.opencontainers.image.documentation="https://github.com/${BUILD_REPOSITORY}/blob/master/chatgpt_codex/README.md" \
+    org.opencontainers.image.created=${BUILD_DATE} \
+    org.opencontainers.image.revision=${BUILD_REF} \
+    org.opencontainers.image.version=${BUILD_VERSION}
+
+#################
+# 6 Healthcheck #
+#################
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s \
+    CMD curl -fsS http://127.0.0.1:7681/ > /dev/null || exit 1

chatgpt_codex/README.md

@@ -0,0 +1,112 @@
+# Home Assistant add-on: ChatGPT Codex
+
+![Supports aarch64 Architecture][aarch64-shield]
+![Supports amd64 Architecture][amd64-shield]
+![Project Maintenance][maintenance-shield]
+
+Run the official OpenAI Codex CLI in a persistent Home Assistant ingress terminal. The optimized path uses `headroom wrap codex`, with RTK handling command-output compression before results reach Codex.
+
+> The repository already contains an unrelated add-on named **Codex** for comic archives. This coding-agent add-on therefore uses the slug `chatgpt_codex`.
+
+## Features
+
+- Latest stable Codex, Headroom, RTK, ttyd, and Rust toolchain versions are resolved during every Docker build; tool versions are not pinned in the Dockerfile.
+- Official Codex CLI static binary for `amd64` and `aarch64`.
+- Home Assistant authenticated, administrator-only ingress; no unauthenticated terminal port is exposed.
+- Persistent `$HOME`, Codex authentication, settings, sessions, Headroom state, and RTK statistics.
+- Persistent `tmux` session that survives browser disconnects.
+- `headroom wrap codex` as the default launch path.
+- Baked-in RTK with native Codex initialization.
+- Optional Headroom output shaping and code-aware compression.
+- Direct Codex fallback for troubleshooting.
+- Device-code login helper designed for a remote or headless container.
+- Baked-in Git, GitHub CLI, ripgrep, jq, SSH client, and common terminal tools.
+- Optional GitHub CLI authentication and Git author configuration.
+- Optional extra apt and pip packages.
+- Local and SMB mount support through the repository standard modules.
+
+## Installation and first login
+
+1. Install **ChatGPT Codex** from this add-on repository.
+2. Keep the default `data_location` and `workspace`, or select writable mounted paths.
+3. Start the add-on and open its web UI.
+4. Codex starts automatically through Headroom.
+5. When prompted to authenticate, follow the device-code instructions. You can also exit Codex and run:
+
+```shell
+codex-login
+```
+
+Codex supports ChatGPT sign-in and API-key authentication. The device-code flow is the recommended option for this headless add-on.
+
+## Launch commands
+
+Optimized default:
+
+```shell
+codex-headroom
+```
+
+This runs:
+
+```shell
+headroom wrap codex
+```
+
+Headroom starts its local proxy, configures Codex routing and MCP support, and uses RTK as the CLI context tool.
+
+Direct troubleshooting path:
+
+```shell
+codex-direct
+```
+
+Check optimization status and measured savings:
+
+```shell
+headroom doctor
+headroom perf
+rtk gain
+```
+
+## Persistence
+
+The terminal attaches every browser connection to the same `tmux` session. Closing the browser detaches the client but does not stop Codex or commands running in the session.
+
+Persistent data is stored below `data_location`:
+
+- Codex state: `~/.codex`
+- Headroom state and metrics: `~/.headroom`
+- RTK state: its normal paths below the persistent home
+- Default workspace: `~/workspace`
+
+## Options
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `data_location` | `/data/data` | Persistent home. Must be below `/data`, `/share`, `/media`, `/config`, or `/mnt`. |
+| `workspace` | `<data_location>/workspace` | Initial project directory. Leave empty to follow `data_location`. |
+| `PUID` / `PGID` | `0` / `0` | Runtime user and group used by the LinuxServer `abc` account. |
+| `TZ` | | Optional timezone, for example `Europe/Brussels`. |
+| `auto_start_codex` | `true` | Start Codex automatically when the tmux session is first created. |
+| `use_headroom` | `true` | Use `headroom wrap codex`; disabling this starts Codex directly. |
+| `headroom_output_shaper` | `true` | Enable Headroom output-token shaping. |
+| `headroom_code_aware` | `true` | Enable Headroom AST-aware code compression. |
+| `github_token` | | Authenticate GitHub CLI and Git operations. |
+| `github_username` / `github_email` | | Configure the global Git author. |
+| `additional_apps` | | Comma-separated Debian packages installed at startup. |
+| `additional_pip` | | Comma-separated Python packages installed at startup. |
+| `localdisks` / `networkdisks` | | Optional local-disk and SMB mounts supported by the repository modules. |
+| `env_vars` | `[]` | Additional environment variables exported in the container. |
+
+Configuration changes affecting the launch command apply to a newly created tmux session. To recreate it, exit Codex and run `tmux kill-session -t codex`, then reopen the add-on web UI.
+
+## Security
+
+The add-on deliberately does not enable Codex approval or sandbox bypass flags. Codex can execute commands and edit files available inside the configured workspace, so only mount locations you intend it to access.
+
+The terminal is exposed only through Home Assistant administrator-only ingress. Do not add an unauthenticated direct port mapping. Treat `github_token`, Codex authentication data, and the persistent home as secrets and include them only in trusted backups.
+
+[aarch64-shield]: https://img.shields.io/badge/aarch64-yes-green.svg
+[amd64-shield]: https://img.shields.io/badge/amd64-yes-green.svg
+[maintenance-shield]: https://img.shields.io/maintenance/yes/2026.svg

chatgpt_codex/build.json

@@ -0,0 +1,6 @@
+{
+  "build_from": {
+    "aarch64": "ghcr.io/linuxserver/baseimage-debian:arm64v8-bookworm",
+    "amd64": "ghcr.io/linuxserver/baseimage-debian:amd64-bookworm"
+  }
+}

chatgpt_codex/config.yaml

@@ -0,0 +1,68 @@
+arch:
+  - aarch64
+  - amd64
+description: "Persistent OpenAI Codex web terminal optimized with Headroom and RTK"
+devices:
+  - /dev/fuse
+environment:
+  HOME: /data/data
+  PGID: "0"
+  PUID: "0"
+  TERM: xterm-256color
+image: ghcr.io/alexbelgium/chatgpt_codex-{arch}
+ingress: true
+ingress_port: 7681
+ingress_stream: true
+init: false
+map:
+  - addon_config:rw
+  - share:rw
+  - media:rw
+  - ssl
+name: ChatGPT Codex
+options:
+  env_vars: []
+  DNS_server: 8.8.8.8
+  data_location: /data/data
+  workspace: ""
+  PUID: 0
+  PGID: 0
+  auto_start_codex: true
+  use_headroom: true
+  headroom_output_shaper: true
+  headroom_code_aware: true
+  github_token: ""
+  github_username: ""
+  github_email: ""
+  additional_apps: ""
+  additional_pip: ""
+panel_icon: mdi:code-braces-box
+privileged:
+  - SYS_ADMIN
+  - DAC_READ_SEARCH
+schema:
+  env_vars:
+    - name: match(^[A-Za-z0-9_]+$)
+      value: str?
+  DNS_server: str?
+  data_location: str?
+  workspace: str?
+  PUID: int
+  PGID: int
+  TZ: match([A-Z][a-z]*./[A-Z][a-z]*.)?
+  auto_start_codex: bool
+  use_headroom: bool
+  headroom_output_shaper: bool
+  headroom_code_aware: bool
+  github_token: password?
+  github_username: str?
+  github_email: str?
+  additional_apps: str?
+  additional_pip: str?
+  localdisks: str?
+  networkdisks: str?
+slug: chatgpt_codex
+tmpfs: true
+udev: true
+url: https://github.com/alexbelgium/hassio-addons
+version: "0.144.3-3"

chatgpt_codex/rootfs/etc/cont-init.d/20-folders.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+PUID="$(bashio::config 'PUID')"
+PGID="$(bashio::config 'PGID')"
+LOCATION="$(bashio::config 'data_location')"
+
+if [ -z "$LOCATION" ] || [ "$LOCATION" = "null" ]; then
+    LOCATION="/data/data"
+fi
+
+case "$LOCATION" in
+    /data/* | /share/* | /media/* | /config/* | /mnt/*)
+        ;;
+    *)
+        bashio::log.fatal "data_location must be below /data, /share, /media, /config, or /mnt"
+        exit 1
+        ;;
+esac
+
+if [ -L "$LOCATION" ]; then
+    bashio::log.fatal "data_location must not be a symbolic link"
+    exit 1
+fi
+
+bashio::log.info "Using persistent home: $LOCATION"
+install -d -m 0750 -o "$PUID" -g "$PGID" "$LOCATION"
+install -d -m 0750 -o "$PUID" -g "$PGID" "$LOCATION/.codex" "$LOCATION/.headroom"
+install -d -m 0755 /tmp/cache /run/s6/container_environment
+
+sed -i "s|^\(abc:[^:]*:[^:]*:[^:]*:[^:]*:\)[^:]*|\1$LOCATION|" /etc/passwd
+
+for variable in HOME CODEX_HOME HEADROOM_WORKSPACE_DIR XDG_CACHE_HOME; do
+    case "$variable" in
+        HOME) value="$LOCATION" ;;
+        CODEX_HOME) value="$LOCATION/.codex" ;;
+        HEADROOM_WORKSPACE_DIR) value="$LOCATION/.headroom" ;;
+        XDG_CACHE_HOME) value="/tmp/cache" ;;
+    esac
+    printf '%s' "$value" > "/run/s6/container_environment/$variable"
+done
+
+chown -R "$PUID:$PGID" "$LOCATION/.codex" "$LOCATION/.headroom"
+chown "$PUID:$PGID" "$LOCATION"

chatgpt_codex/rootfs/etc/cont-init.d/80-configuration.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+if bashio::config.has_value 'additional_apps'; then
+    packages="$(bashio::config 'additional_apps')"
+    apt-get update -o Acquire::http::Timeout=10 -o Acquire::https::Timeout=10
+    for package in ${packages//,/ }; do
+        bashio::log.info "Installing apt package: $package"
+        apt-get install -y --no-install-recommends "$package"
+    done
+    apt-get clean
+    rm -rf /var/lib/apt/lists/*
+fi
+
+if bashio::config.has_value 'additional_pip'; then
+    packages="$(bashio::config 'additional_pip')"
+    for package in ${packages//,/ }; do
+        bashio::log.info "Installing pip package: $package"
+        pip3 install --break-system-packages "$package"
+    done
+fi
+
+if bashio::config.has_value 'TZ'; then
+    timezone="$(bashio::config 'TZ')"
+    if [ ! -e "/usr/share/zoneinfo/$timezone" ]; then
+        bashio::log.fatal "Invalid timezone: $timezone"
+        exit 1
+    fi
+    ln -snf "/usr/share/zoneinfo/$timezone" /etc/localtime
+    printf '%s\n' "$timezone" > /etc/timezone
+fi

chatgpt_codex/rootfs/etc/cont-init.d/82-codex-tools.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+PUID="$(bashio::config 'PUID')"
+PGID="$(bashio::config 'PGID')"
+
+if ! command -v codex > /dev/null 2>&1; then
+    bashio::log.fatal "Codex CLI is not available"
+    exit 1
+fi
+if ! command -v headroom > /dev/null 2>&1; then
+    bashio::log.fatal "Headroom is not available"
+    exit 1
+fi
+if ! command -v rtk > /dev/null 2>&1; then
+    bashio::log.fatal "RTK is not available"
+    exit 1
+fi
+
+bashio::log.info "Codex: $(codex --version 2>&1 | head -n 1)"
+bashio::log.info "Headroom: $(headroom --version 2>&1 | head -n 1)"
+bashio::log.info "RTK: $(rtk --version 2>&1 | head -n 1)"
+
+# Configure RTK's native Codex integration ahead of the first wrapped session.
+if ! s6-setuidgid abc env \
+    HOME="$HOME" \
+    CODEX_HOME="${CODEX_HOME:-$HOME/.codex}" \
+    PATH="$HOME/.local/bin:/usr/local/bin:/usr/bin:/bin" \
+    RTK_NONINTERACTIVE=1 \
+    rtk init -g --codex; then
+    bashio::log.warning "RTK Codex initialization failed; Headroom will retry when wrapping Codex"
+fi
+
+for key in CODEX_AUTO_START CODEX_USE_HEADROOM HEADROOM_OUTPUT_SHAPER HEADROOM_CODE_AWARE_ENABLED; do
+    case "$key" in
+        CODEX_AUTO_START)
+            bashio::config.true 'auto_start_codex' && value="1" || value="0"
+            ;;
+        CODEX_USE_HEADROOM)
+            bashio::config.true 'use_headroom' && value="1" || value="0"
+            ;;
+        HEADROOM_OUTPUT_SHAPER)
+            bashio::config.true 'headroom_output_shaper' && value="1" || value="0"
+            ;;
+        HEADROOM_CODE_AWARE_ENABLED)
+            bashio::config.true 'headroom_code_aware' && value="1" || value="0"
+            ;;
+    esac
+    printf '%s' "$value" > "/run/s6/container_environment/$key"
+done
+printf '%s' 'rtk' > /run/s6/container_environment/HEADROOM_CONTEXT_TOOL
+
+chown -R "$PUID:$PGID" "$HOME/.codex" "$HOME/.headroom"

chatgpt_codex/rootfs/etc/cont-init.d/83-github_cli.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+if bashio::config.has_value 'github_username'; then
+    s6-setuidgid abc git config --global user.name "$(bashio::config 'github_username')"
+fi
+
+if bashio::config.has_value 'github_email'; then
+    s6-setuidgid abc git config --global user.email "$(bashio::config 'github_email')"
+fi
+
+if bashio::config.has_value 'github_token'; then
+    token="$(bashio::config 'github_token')"
+    if s6-setuidgid abc env -u GH_TOKEN -u GITHUB_TOKEN gh auth status --hostname github.com > /dev/null 2>&1; then
+        bashio::log.info "GitHub CLI is already authenticated"
+    else
+        bashio::log.info "Authenticating GitHub CLI"
+        printf '%s\n' "$token" | s6-setuidgid abc env -u GH_TOKEN -u GITHUB_TOKEN \
+            gh auth login --hostname github.com --with-token || \
+            bashio::log.warning "GitHub CLI authentication failed"
+    fi
+    s6-setuidgid abc env -u GH_TOKEN -u GITHUB_TOKEN \
+        gh auth setup-git --hostname github.com || \
+        bashio::log.warning "GitHub CLI git credential setup failed"
+else
+    bashio::log.info "Set github_token to authenticate gh and Git operations"
+fi

chatgpt_codex/rootfs/etc/s6-overlay/s6-rc.d/svc-codex-terminal/run

@@ -0,0 +1,54 @@
+#!/usr/bin/with-contenv bashio
+# shellcheck shell=bash
+set -e
+set -o pipefail
+
+port=7681
+workspace="$(bashio::config 'workspace')"
+
+if [ -z "$workspace" ] || [ "$workspace" = "null" ]; then
+    workspace="$HOME/workspace"
+fi
+
+if [[ "$workspace" != /* ]]; then
+    bashio::log.fatal "workspace must be an absolute path"
+    exec sleep infinity
+fi
+if [ -L "$workspace" ]; then
+    bashio::log.fatal "workspace must not be a symbolic link"
+    exec sleep infinity
+fi
+
+workspace="$(realpath -m -- "$workspace")"
+case "$workspace" in
+    "$HOME" | "$HOME"/* | /share/* | /media/* | /mnt/* | /data/* | /config/*)
+        ;;
+    *)
+        bashio::log.fatal "workspace must be below the persistent home, /share, /media, /mnt, /data, or /config"
+        exec sleep infinity
+        ;;
+esac
+
+if [ ! -e "$workspace" ]; then
+    install -d -m 0750 -o abc -g abc "$workspace"
+elif [ ! -d "$workspace" ]; then
+    bashio::log.fatal "workspace is not a directory: $workspace"
+    exec sleep infinity
+fi
+
+if ! s6-setuidgid abc test -r "$workspace" || \
+    ! s6-setuidgid abc test -w "$workspace" || \
+    ! s6-setuidgid abc test -x "$workspace"; then
+    bashio::log.fatal "workspace must be readable, writable, and searchable by user abc: $workspace"
+    exec sleep infinity
+fi
+
+export CODEX_TERMINAL_WORKSPACE="$workspace"
+bashio::log.info "Starting persistent Codex terminal on Home Assistant ingress port $port"
+exec s6-setuidgid abc ttyd \
+    -p "$port" \
+    -W \
+    -O \
+    -t disableLeaveAlert=true \
+    -t fontSize=14 \
+    /usr/local/bin/codex-terminal-shell

chatgpt_codex/rootfs/usr/local/bin/codex-direct

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+export PATH="${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+exec codex "$@"

chatgpt_codex/rootfs/usr/local/bin/codex-headroom

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export PATH="${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+export HEADROOM_CONTEXT_TOOL="rtk"
+
+if ! command -v headroom > /dev/null 2>&1; then
+    echo "Headroom is unavailable; launching Codex directly." >&2
+    exec codex "$@"
+fi
+
+if [ "$#" -eq 0 ]; then
+    exec headroom wrap codex
+fi
+exec headroom wrap codex -- "$@"

chatgpt_codex/rootfs/usr/local/bin/codex-login

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+export PATH="${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+exec codex login --device-auth "$@"

chatgpt_codex/rootfs/usr/local/bin/codex-terminal-shell

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export SHELL="/bin/bash"
+export PATH="${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
+
+workspace="${CODEX_TERMINAL_WORKSPACE:-${HOME}/workspace}"
+session_name="${CODEX_TMUX_SESSION:-codex}"
+
+if [ ! -d "$workspace" ]; then
+    echo "Codex workspace does not exist: $workspace" >&2
+    exit 1
+fi
+
+new_session=0
+if ! tmux has-session -t "$session_name" 2> /dev/null; then
+    tmux new-session -d -s "$session_name" -c "$workspace" /bin/bash -l
+    new_session=1
+fi
+
+if [ "$new_session" -eq 1 ]; then
+    tmux send-keys -t "$session_name" \
+        "printf '\\nChatGPT Codex add-on\\n  login: codex-login\\n  optimized: codex-headroom\\n  direct: codex-direct\\n  savings: rtk gain && headroom perf\\n\\n'" C-m
+    if [ "${CODEX_AUTO_START:-1}" = "1" ]; then
+        if [ "${CODEX_USE_HEADROOM:-1}" = "1" ]; then
+            tmux send-keys -t "$session_name" "codex-headroom" C-m
+        else
+            tmux send-keys -t "$session_name" "codex-direct" C-m
+        fi
+    fi
+fi
+
+exec tmux attach-session -t "$session_name"

chatgpt_codex/updater.json

@@ -0,0 +1,12 @@
+{
+  "github_beta": false,
+  "github_fulltag": false,
+  "github_havingasset": true,
+  "github_tagfilter": "rust-v",
+  "last_update": "2026-07-14",
+  "repository": "alexbelgium/hassio-addons",
+  "slug": "chatgpt_codex",
+  "source": "github",
+  "upstream_repo": "openai/codex",
+  "upstream_version": "0.144.3"
+}

claude_desktop/CHANGELOG.md

@@ -1,3 +1,32 @@
+## 1.17 (14-07-2026)
+
+- **Breaking:** remove the standalone Claude Code web terminal (ttyd/tmux service, port `7681`, and the `enable_terminal`, `terminal_username`, `terminal_password`, `terminal_workspace` options). The add-on is now built purely around Claude Desktop; Claude Code remains installed and powers Desktop cowork/dispatch sessions with the RTK hook, Caveman, and MCP servers intact. If the add-on refuses to start after the update, open its Configuration tab and re-save to drop the removed options.
+- Remove the `claude-direct` and `claude-headroom` terminal wrapper scripts and the unused `ha_smart_context` and `dangerously_skip_permissions` options.
+- Fix the Headroom dashboard being unreachable at `http://<host>:8787/dashboard`: the supervised proxy only listened on `127.0.0.1`; it now binds `0.0.0.0` so the mapped port works.
+- Fix dispatch/remote sessions and sign-in persistence: install the missing `gnome-keyring` package. The existing keyring bootstrap silently no-oped without it, leaving Electron `safeStorage` unavailable ("cannot store allowlist cache"), so auth tokens and dispatch permission grants were lost on restart.
+- Add the tokensave code-intelligence MCP server (pinned 7.2.0, built from source like RTK), registered for both Claude Desktop and Claude Code; disable with `install_tokensave: false`.
+- Implement the Home Assistant MCP bridge for real: `enable_ha_mcp` plus new `ha_mcp_url`/`ha_mcp_token` options register Home Assistant's MCP Server integration in Claude through `mcp-proxy`, using the integration's stateless Streamable HTTP endpoint (`/api/mcp`).
+- Write the Claude configuration files with `0600` permissions, since they hold the Home Assistant access token in clear text.
+- Restrict the build-time `chmod +x` pass to the directories the add-on actually ships scripts in instead of traversing the whole image.
+- Register add-on-managed MCP servers in Claude Code's `~/.claude.json` as well as Claude Desktop's config, without clobbering user-customized entries.
+- Install `uv` and use it for the `additional_pip` option for much faster package installs.
+
+## 1.16 (14-07-2026)
+- Minor bugs fixed
+## 1.15 (13-07-2026)
+- Minor bugs fixed
+ 
+## ubunturesolute-version-6dc44b0e (2026-07-13)
+- Update to latest version from linuxserver/docker-baseimage-selkies (changelog : https://github.com/linuxserver/docker-baseimage-selkies/releases)
+## 1.14 (10-07-2026)
+
+- Build pinned RTK 0.43.0 source on Debian Bookworm for both architectures instead of installing the upstream arm64 release binary, which requires GLIBC 2.39 and cannot run in the add-on image.
+- Execute `rtk --version` inside the final image during the Docker build so future ABI incompatibilities fail CI instead of surfacing at runtime.
+- Validate the final Bookworm-built RTK binary in a native aarch64 image build.
+- Correct the repository PR checks so changed changelog paths are exported and aarch64 images are built explicitly for `linux/arm64`.
+
+## debiantrixie-version-c55d3809 (2026-07-11)
+- Update to latest version from linuxserver/docker-baseimage-selkies (changelog : https://github.com/linuxserver/docker-baseimage-selkies/releases)
 ## 1.13 (10-07-2026)
 
 - Add the official Claude Code stable package, `tmux`, `ripgrep`, and a pinned upstream `ttyd` binary for both supported architectures.

claude_desktop/Dockerfile

@@ -9,6 +9,30 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
+ARG RTK_VERSION="v0.43.0"
+ARG RTK_COMMIT="5a7880d404db8364d602f2ecdc41dd790f64013f"
+ARG TOKENSAVE_VERSION="7.2.0"
+
+# The upstream aarch64 release is cross-built on ubuntu-latest and requires
+# GLIBC 2.39. Build the pinned source on Bookworm instead so it is compatible
+# with the add-on runtime on both supported architectures.
+FROM rust:1.91-bookworm AS rtk-builder
+ARG RTK_VERSION
+ARG RTK_COMMIT
+RUN git clone --depth 1 --branch "${RTK_VERSION}" https://github.com/rtk-ai/rtk.git /src/rtk && \
+    test "$(git -C /src/rtk rev-parse HEAD)" = "${RTK_COMMIT}" && \
+    cd /src/rtk && \
+    cargo build --release --locked && \
+    install -D -m 0755 target/release/rtk /out/rtk && \
+    /out/rtk --version
+
+# tokensave ships no Bookworm-compatible prebuilt binary either; build the pinned
+# crates.io release from source so GLIBC matches the add-on runtime.
+FROM rust:1.91-bookworm AS tokensave-builder
+ARG TOKENSAVE_VERSION
+RUN cargo install tokensave --version "${TOKENSAVE_VERSION}" --locked --root /out && \
+    /out/bin/tokensave --version
+
 FROM ${BUILD_FROM}
 
 ##################
@@ -45,17 +69,19 @@ RUN curl -fsSL --retry 3 --retry-delay 2 \
 # 3 Install apps #
 ##################
 
-# Add rootfs
+# Add rootfs. Only the directories this add-on ships scripts in are traversed, so the chmod
+# cannot alter executables elsewhere in the image.
 COPY rootfs/ /
-RUN find . -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -exec chmod +x {} \; && \
-    chmod +x /usr/local/bin/claude-direct /usr/local/bin/claude-headroom /usr/local/bin/claude-terminal-shell
+RUN find /etc/cont-init.d /etc/s6-overlay /defaults /usr/local/bin -type f \
+        \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -exec chmod +x {} \;
 
 # Uses /bin for compatibility purposes
 # hadolint ignore=DL4005
 RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; fi && \
     if [ ! -f /bin/bash ] && [ -f /usr/bin/bash ]; then ln -s /usr/bin/bash /bin/bash; fi
 
-# Install Claude Desktop, Claude Code, browser-terminal tooling, and Python tooling
+# Install Claude Desktop, Claude Code, and Python tooling. gnome-keyring provides the
+# Secret Service backend Electron safeStorage needs to persist sign-in and dispatch grants.
 RUN install -d -m 0755 /etc/apt/keyrings && \
     curl -fsSLo /usr/share/keyrings/claude-desktop-archive-keyring.asc https://downloads.claude.ai/claude-desktop/key.asc && \
     curl -fsSLo /etc/apt/keyrings/claude-code.asc https://downloads.claude.ai/keys/claude-code.asc && \
@@ -66,38 +92,27 @@ RUN install -d -m 0755 /etc/apt/keyrings && \
         claude-desktop \
         claude-code \
         python3-pip \
+        gnome-keyring \
         libsecret-1-0 \
         dbus-x11 \
         git \
         gh \
-        ripgrep \
-        tmux && \
+        ripgrep && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
-# ttyd is not packaged in Debian bookworm. Install the pinned upstream static binary.
-ARG TTYD_VERSION="1.7.7"
-RUN set -eux; \
-    case "$(dpkg --print-architecture)" in \
-        amd64) ttyd_arch="x86_64" ;; \
-        arm64) ttyd_arch="aarch64" ;; \
-        *) echo "Unsupported architecture for ttyd: $(dpkg --print-architecture)" >&2; exit 1 ;; \
-    esac; \
-    curl -fsSL --retry 3 --retry-delay 2 \
-        -o /usr/local/bin/ttyd \
-        "https://github.com/tsl0922/ttyd/releases/download/${TTYD_VERSION}/ttyd.${ttyd_arch}"; \
-    chmod 0755 /usr/local/bin/ttyd; \
-    /usr/local/bin/ttyd --version
+# Copy the pinned Bookworm-built RTK and tokensave binaries and execute them in the final
+# image. This makes an ABI mismatch fail the image build instead of surfacing at runtime.
+COPY --from=rtk-builder /out/rtk /usr/local/bin/rtk
+COPY --from=tokensave-builder /out/bin/tokensave /usr/local/bin/tokensave
+RUN /usr/local/bin/rtk --version && /usr/local/bin/tokensave --version
 
-# Install only the Headroom proxy, code-compression, and MCP features used by this add-on.
+# Install only the Headroom proxy, code-compression, and MCP features used by this add-on,
+# plus mcp-proxy (stdio->SSE bridge for the Home Assistant MCP server) and uv (fast
+# installer used for the additional_pip option).
 RUN apt-get update && \
     apt-get install -y --no-install-recommends nodejs && \
-    pip3 install --break-system-packages "headroom-ai[proxy,code,mcp]" && \
-    curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh -o /tmp/rtk-install.sh && \
-    HOME=/root sh /tmp/rtk-install.sh && \
-    rm /tmp/rtk-install.sh && \
-    if [ -x /root/.local/bin/rtk ] && [ ! -x /usr/local/bin/rtk ]; then mv /root/.local/bin/rtk /usr/local/bin/rtk; fi && \
-    if [ -x /usr/local/bin/rtk ]; then chmod +x /usr/local/bin/rtk; else echo "rtk binary was not installed on PATH"; exit 1; fi && \
+    pip3 install --break-system-packages "headroom-ai[proxy,code,mcp]" mcp-proxy uv && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* /root/.cache
 

claude_desktop/README.md

@@ -4,8 +4,9 @@
 ![Supports amd64 Architecture][amd64-shield]
 ![Project Maintenance][maintenance-shield]
 
-Run Claude Desktop and an optional persistent Claude Code web terminal in one
-LinuxServer.io Selkies add-on.
+Run Claude Desktop in a LinuxServer.io Selkies add-on, with Headroom MCP
+context compression, RTK Bash-output acceleration, and code-intelligence
+tooling wired in by default.
 
 ## Installation
 
@@ -20,102 +21,38 @@ currently does not include Computer Use or dictation.
 
 ## Architecture
 
-Claude Desktop and Claude Code run as separate clients inside the same add-on.
-They share the configured persistent home directory, Git credentials,
-repositories, Claude Code configuration, Headroom storage, and RTK
-configuration, but they do not share or hand off a conversation.
+Everything is built around the Claude Desktop app. Claude Code is installed in
+the same image but is not exposed as a standalone service: Claude Desktop's
+cowork and dispatch sessions run it internally, and they pick up the shared
+Claude Code configuration (`~/.claude`), hooks, and MCP servers automatically.
 
 - **Claude Desktop** uses Headroom through its MCP tools.
-- **Claude Code** uses Headroom's supported `headroom wrap claude` integration.
-- **RTK** filters Claude Code Bash output through its `PreToolUse` hook.
-- **tmux** keeps the terminal session running when the browser disconnects.
+- **Claude Code sessions inside Desktop** get the same MCP servers via
+  `~/.claude.json` and RTK's `PreToolUse` Bash hook via
+  `~/.claude/settings.json`.
+- **gnome-keyring** provides the Secret Service backend Electron needs to
+  persist sign-in and dispatch permission grants across restarts.
 
 ## Features
 
-- Claude Desktop in single-app Selkies mode.
-- Home Assistant ingress support for Claude Desktop.
-- Official Claude Code stable package installed in the same image.
-- Optional authenticated `ttyd` web terminal on port `7681`.
-- Persistent `tmux` session shared by reconnecting terminal clients.
+- Claude Desktop in single-app Selkies mode with Home Assistant ingress.
+- Official Claude Code stable package powering Desktop cowork/dispatch
+  sessions.
 - Persistent `$HOME` at the configured `data_location` (default `/data/data`),
   preserving Desktop and Claude Code state across restarts.
+- Persistent sign-in through a bundled, auto-unlocked gnome-keyring.
 - Optional runtime Claude Desktop updates from Anthropic's apt repository.
-- Optional extra apt and pip package installation.
-- Baked-in `git`, GitHub CLI (`gh`), `ripgrep`, and terminal tooling.
+- Optional extra apt and pip package installation (pip installs use `uv` for
+  speed).
+- Baked-in `git`, GitHub CLI (`gh`), and `ripgrep`.
 - Custom script support through the repository standard `claude_desktop.sh`.
-- Optional bundled Claude Code optimization tools: Headroom, RTK, and Caveman.
-- Headroom dashboard exposed on mapped port `8787` when enabled.
+- Bundled optimization tools: Headroom (MCP + local proxy), RTK, tokensave,
+  and Caveman — each individually switchable.
+- Optional Home Assistant MCP bridge so Claude can query and control Home
+  Assistant.
+- Headroom dashboard exposed on mapped port `8787`.
 - Low-power defaults for GPU mapping, Selkies frame rate, and volatile caches.
 
-## Claude Code terminal setup
-
-The terminal service is enabled in the add-on configuration but remains
-unavailable until authentication is configured. Port `7681` is not mapped by
-default.
-
-1. Set a unique `terminal_password`. The existing `PASSWORD` option is accepted
-   only as a compatibility fallback.
-2. Optionally set `terminal_username` and `terminal_workspace`.
-3. Map container port `7681` to a host port in the add-on **Network** section.
-4. Restart the add-on.
-5. Reach `http://<home-assistant-host>:7681` only through an encrypted VPN or an
-   HTTPS reverse proxy, then sign in with the configured terminal credentials.
-
-The terminal opens in a persistent tmux session. Closing the browser detaches
-from tmux rather than terminating commands that are already running.
-
-Start the optimized Claude Code path with:
-
-```shell
-claude-headroom
-```
-
-This reuses the supervised Headroom proxy on `127.0.0.1:8787` and launches
-Claude Code with the required routing. Headroom is told not to install RTK
-because the add-on already maintains the RTK hook in
-`~/.claude/settings.json`.
-
-To bypass Headroom for troubleshooting, run:
-
-```shell
-claude-direct
-```
-
-Running `claude` directly is equivalent to the direct path. The first Claude
-Code launch may require its own account authentication; Desktop and Claude Code
-store separate client credentials even though both use the configured
-persistent home directory.
-
-### Multiple concurrent clients
-
-Every browser connection attaches to the same tmux session. Concurrent clients
-therefore see the same terminal, keystrokes, and resize events. This is useful
-for reconnecting to one long-running session, but it is not an isolated
-multi-user terminal.
-
-### Terminal user and permissions
-
-The service drops privileges to the LinuxServer `abc` account before starting
-ttyd. The effective numeric UID and GID follow the configured `PUID` and `PGID`.
-Using `PUID: 0` can provide root-equivalent access inside the add-on; use a
-non-zero UID/GID where your storage permissions allow it.
-
-The configured workspace must resolve to the persistent home directory or a
-subdirectory of `/share`, `/media`, `/mnt`, `/data`, or `/config`. Existing
-directories are never re-owned by the terminal service and must already be
-readable, writable, and searchable by `abc`.
-
-### Terminal security
-
-The direct ttyd endpoint uses HTTP Basic Authentication without TLS.
-Credentials and terminal traffic are unencrypted on the network. ttyd also
-receives its Basic Authentication credential as a process argument, so it is
-visible to processes with sufficient access inside the container.
-
-Do not expose port `7681` directly to the public internet. Use a VPN such as
-WireGuard or Tailscale, or place the endpoint behind an HTTPS reverse proxy.
-Use a unique `terminal_password` rather than reusing the Selkies `PASSWORD`.
-
 ## Options
 
 | Option | Default | Description |
@@ -123,48 +60,60 @@ Use a unique `terminal_password` rather than reusing the Selkies `PASSWORD`.
 | `PUID` / `PGID` | `0` / `0` | Numeric user and group applied by the LinuxServer initialization. |
 | `TZ` | | Optional timezone, for example `Europe/Brussels`. |
 | `KEYBOARD` | | Optional Selkies keyboard layout. |
-| `PASSWORD` | | Optional password for direct Selkies ports and compatibility fallback for terminal authentication. |
+| `PASSWORD` | | Optional password for direct Selkies ports. |
 | `DRINODE` | | Optional GPU device override for Selkies. |
 | `DNS_server` | `8.8.8.8` | DNS server used by the standard DNS module. |
 | `auto_update` | `true` | Upgrade `claude-desktop` from Anthropic's apt repository at startup. |
-| `enable_terminal` | `true` | Enable the supervised Claude Code web-terminal service. |
-| `terminal_username` | `claude` | Username used by ttyd Basic Authentication. |
-| `terminal_password` | | Dedicated terminal password. The service idles when this and `PASSWORD` are empty. |
-| `terminal_workspace` | | Initial directory; defaults to `<data_location>/workspace`. |
-| `install_headroom` | `true` | Enable Headroom MCP for Desktop and the supervised local proxy reused by `claude-headroom`. |
+| `install_headroom` | `true` | Register the Headroom MCP server and run the supervised local proxy/dashboard. |
 | `install_rtk` | `true` | Configure RTK's Claude Code `PreToolUse` hook. |
+| `install_tokensave` | `true` | Register the tokensave code-intelligence MCP server for Desktop and Claude Code. |
 | `install_caveman` | `true` | Install the Caveman Claude Code plugin in the persistent Claude home. |
 | `install_github_cli` | `true` | Enable setup checks for the baked-in `git` and `gh` commands. |
 | `github_token` | | Optional GitHub token used to authenticate `gh` and Git operations. |
 | `github_username` | | Optional global Git author name. |
 | `github_email` | | Optional global Git author email. |
-| `ha_smart_context` | `true` | Enable Home Assistant smart context support for Claude tooling. |
-| `enable_ha_mcp` | `true` | Enable Home Assistant MCP support for Claude tooling. |
-| `dangerously_skip_permissions` | `false` | Reserved compatibility option; it is not applied by the terminal launcher. |
+| `enable_ha_mcp` | `false` | Register Home Assistant's MCP server in Claude (requires `ha_mcp_token`). |
+| `ha_mcp_url` | `http://homeassistant:8123/mcp_server/sse` | SSE endpoint of Home Assistant's MCP Server integration. |
+| `ha_mcp_token` | | Home Assistant long-lived access token used by the MCP bridge. |
 | `additional_apps` | | Comma-separated Debian apt packages to install at startup. |
-| `additional_pip` | | Comma-separated pip packages installed with `--break-system-packages`. |
-| `data_location` | `/data/data` | Persistent home directory for both Claude clients and tooling. |
+| `additional_pip` | | Comma-separated pip packages installed at startup (via `uv`). |
+| `data_location` | `/data/data` | Persistent home directory for Claude and tooling. |
 | `env_vars` | `[]` | Additional environment variables exported inside the container. |
 
 ## Headroom behavior
 
-When `install_headroom` is enabled, the add-on registers `headroom mcp serve` in
-Claude Desktop and starts a supervised local Headroom backend. Desktop can use
-`headroom_compress`, `headroom_retrieve`, and `headroom_stats` through MCP.
+When `install_headroom` is enabled, the add-on registers `headroom mcp serve`
+in Claude Desktop and Claude Code, and starts a supervised local Headroom
+backend. Claude can use `headroom_compress`, `headroom_retrieve`, and
+`headroom_stats` through MCP.
 
 Claude Desktop overrides `ANTHROPIC_BASE_URL`, so it is deliberately launched
-without proxy injection. The web terminal instead provides `claude-headroom`,
-which reuses the supervised proxy through Headroom's `--no-proxy` mode. RTK
-setup remains owned by the add-on through Headroom's `--no-rtk` mode.
+without proxy injection; the MCP integration is the supported path.
 
-The Headroom dashboard remains available at:
+The Headroom dashboard is available at:
 
 ```text
 http://<home-assistant-host>:8787/dashboard
 ```
 
-when the `8787/tcp` port is mapped. Treat this endpoint as sensitive and do not
-expose it directly to the public internet.
+through the default `8787/tcp` port mapping. The dashboard is unauthenticated
+and is reachable wherever Home Assistant publishes that port, so treat it as
+sensitive: do not expose it directly to the public internet, and unmap the port
+in the add-on **Network** section if you do not want it reachable at all.
+
+## Home Assistant MCP bridge
+
+To let Claude query and control Home Assistant:
+
+1. In Home Assistant, add the **Model Context Protocol Server** integration
+   (Settings → Devices & services → Add integration).
+2. Create a long-lived access token (your profile → Security).
+3. Set `enable_ha_mcp: true` and paste the token into `ha_mcp_token` in the
+   add-on configuration, then restart the add-on.
+
+The add-on bridges Claude to the integration's stateless Streamable HTTP
+endpoint (`/api/mcp`) with `mcp-proxy`. Override `ha_mcp_url` only if your Home
+Assistant instance is not reachable as `homeassistant:8123` from add-ons.
 
 ## Custom scripts
 
@@ -178,10 +127,11 @@ the image.
 Persistent state is stored in the configured `data_location` (default
 `/data/data`):
 
-- Claude Desktop sign-in: `~/.config/Claude`
+- Claude Desktop sign-in: `~/.config/Claude` (token encrypted via
+  gnome-keyring; keyring DB in `~/.local/share/keyrings`)
 - Claude Code settings, hooks, sessions, and plugins: `~/.claude`
-- Default terminal workspace: `~/workspace`
-- Headroom and RTK user state: their standard paths below the shared home
+- Headroom, RTK, and tokensave user state: their standard paths below the
+  shared home
 
 Volatile cache data is redirected to `/tmp/cache` through `$XDG_CACHE_HOME` and
 `$HOME/.cache`.

claude_desktop/SIGN_IN.md

@@ -4,7 +4,10 @@ Two related sign-in problems when Claude Desktop runs inside the LinuxServer Sel
 streamed desktop.
 
 **Status:**
-- **Shipped:** Problem B (keyring persistence) is implemented in v1.4 (Dockerfile + `rootfs/defaults/autostart`).
+- **Shipped:** Problem B (keyring persistence) — the `autostart` bootstrap landed in v1.4, but
+  the `gnome-keyring` package itself was missing from the image until v1.17 (the bootstrap
+  silently no-oped and Electron logged "safeStorage encryption is not available"). Fixed in
+  v1.17: the Dockerfile now installs `gnome-keyring`.
 - **Planned only:** Problem A (in-desktop browser for OAuth) is intentionally not implemented.
   The image ships no browser; complete the login with the user-side workaround below.
 
@@ -50,8 +53,9 @@ magic link into the in-session Chromium (not a phone).
 ### User-side workaround (no rebuild)
 - Add-on Configuration → `additional_apps: chromium`, restart (installed by
   `rootfs/etc/cont-init.d/80-configuration.sh`).
-- Run the two `xdg-settings`/`xdg-mime` commands once in an in-session terminal, or add them
-  to the custom script `/addon_configs/db21ed7f_claude-desktop/claude-desktop.sh`.
+- Add the two `xdg-settings`/`xdg-mime` commands to the custom script
+  `/addon_configs/db21ed7f_claude-desktop/claude_desktop.sh` (the image ships no standalone
+  terminal).
 
 ---
 
@@ -94,14 +98,14 @@ Claude Desktop uses. No extra `dbus-launch` is needed.
      then exposes the Secret Service and exports `GNOME_KEYRING_CONTROL`/`SSH_AUTH_SOCK`.
    - `--password-store=gnome-libsecret` forces Electron to use the libsecret backend instead
      of falling back to plaintext.
-3. Persistence: the keyring DB lives in `$HOME/.local/share/keyrings/` and `HOME=/config/data`
+3. Persistence: the keyring DB lives in `$HOME/.local/share/keyrings/` and `HOME=/data/data`
    (persistent add-on storage), so the empty-password login keyring survives restarts and is
    re-unlocked automatically each boot by the same `autostart` line — the sign-in then sticks.
 
 ### User-side workaround (no rebuild)
 - Add-on Configuration → `additional_apps: gnome-keyring, libsecret-1-0, dbus-x11`, restart.
 - Add the keyring-start lines above to the custom script
-  `/addon_configs/db21ed7f_claude-desktop/claude-desktop.sh`, and relaunch Claude Desktop
+  `/addon_configs/db21ed7f_claude-desktop/claude_desktop.sh`, and relaunch Claude Desktop
   with `--password-store=gnome-libsecret` (e.g. edit the in-session openbox autostart).
 
 ---

claude_desktop/config.yaml

@@ -2,7 +2,7 @@ arch:
   - aarch64
   - amd64
 audio: true
-description: Claude Desktop with a persistent Claude Code web terminal in one add-on
+description: "Claude Desktop with Headroom MCP context compression and RTK acceleration"
 devices:
   - /dev/dri
   - /dev/dri/card0
@@ -41,28 +41,23 @@ options:
   additional_pip: ""
   auto_update: true
   github_email: ""
-  ha_smart_context: true
-  enable_ha_mcp: true
-  dangerously_skip_permissions: false
-  enable_terminal: true
-  terminal_username: claude
-  terminal_password: ""
-  terminal_workspace: ""
+  enable_ha_mcp: false
+  ha_mcp_url: http://homeassistant:8123/api/mcp
+  ha_mcp_token: ""
   github_token: ""
   github_username: ""
   install_caveman: true
   install_github_cli: true
   install_headroom: true
   install_rtk: true
+  install_tokensave: true
 panel_admin: false
 panel_icon: mdi:robot-happy
 ports:
   3001/tcp: null
-  7681/tcp: null
   8787/tcp: 8787
 ports_description:
   3001/tcp: Claude Desktop web interface
-  7681/tcp: HTTP Basic-auth Claude Code terminal (no TLS)
   8787/tcp: Headroom dashboard and proxy
 privileged:
   - SYS_ADMIN
@@ -83,22 +78,19 @@ schema:
   additional_pip: str?
   auto_update: bool?
   github_email: str?
-  ha_smart_context: bool?
   enable_ha_mcp: bool?
-  dangerously_skip_permissions: bool?
-  enable_terminal: bool?
-  terminal_username: match(^[A-Za-z0-9_.-]+$)?
-  terminal_password: password?
-  terminal_workspace: str?
+  ha_mcp_url: str?
+  ha_mcp_token: password?
   github_token: password?
   github_username: str?
   install_caveman: bool
   install_github_cli: bool
   install_headroom: bool
   install_rtk: bool
+  install_tokensave: bool
 slug: claude_desktop
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.13"
+version: "1.17"
 video: true

claude_desktop/rootfs/defaults/autostart

@@ -22,8 +22,7 @@ else
 fi
 
 # Headroom is intentionally not injected into the Desktop process. Claude Desktop overrides
-# ANTHROPIC_BASE_URL, so Desktop uses the registered Headroom MCP tools instead. The Claude Code
-# terminal uses the supported `headroom wrap claude` integration through claude-headroom.
+# ANTHROPIC_BASE_URL, so Desktop uses the registered Headroom MCP tools instead.
 
 # Launch the configured command. If a custom/wrapped command fails to start, fall back to
 # the plain Claude Desktop launch so the app always comes up for the user.

claude_desktop/rootfs/etc/cont-init.d/80-configuration.sh

@@ -24,7 +24,12 @@ fi
 if bashio::config.has_value 'additional_pip'; then
     for p in $(bashio::config 'additional_pip' | tr ',' ' '); do
         bashio::log.green "... pip: $p"
-        pip3 install --break-system-packages "$p" || bashio::log.fatal "Error: pip package $p failed"
+        # Prefer uv (much faster resolver/installer); fall back to pip3 when unavailable.
+        if command -v uv &> /dev/null; then
+            uv pip install --system --break-system-packages "$p" || bashio::log.fatal "Error: pip package $p failed"
+        else
+            pip3 install --break-system-packages "$p" || bashio::log.fatal "Error: pip package $p failed"
+        fi
     done
 fi
 

claude_desktop/rootfs/etc/cont-init.d/82-claude_tools.sh

@@ -15,54 +15,135 @@ printf '%s\n' "$DEFAULT_CLAUDE_DESKTOP_COMMAND" > "$CLAUDE_DESKTOP_COMMAND_FILE"
 # Electron app force-overrides to the production endpoint (headroom #869), so transparent
 # compression cannot be applied to the desktop launch. The integration that does work with
 # Claude Desktop is headroom's MCP server, which exposes the headroom_compress/headroom_retrieve/
-# headroom_stats tools inside the app. Register it in Claude Desktop's MCP config, leaving the
-# plain launch untouched. The merge is idempotent and preserves any other MCP servers.
+# headroom_stats tools inside the app.
+#
+# Register the add-on-managed MCP servers (headroom, tokensave, homeassistant) in both Claude
+# Desktop's config and Claude Code's user config (used by Desktop cowork/dispatch sessions).
+# The merge is idempotent, preserves any other MCP servers, never overwrites a user-customized
+# entry with a different command, and removes only add-on-managed entries when disabled.
 CLAUDE_DESKTOP_CONFIG="$HOME/.config/Claude/claude_desktop_config.json"
+CLAUDE_CODE_CONFIG="$HOME/.claude.json"
+
+HEADROOM_ENABLED=false
 if bashio::config.true 'install_headroom'; then
     if command -v headroom &> /dev/null; then
-        bashio::log.info "headroom $(headroom --version 2> /dev/null || true) available; registering the headroom MCP server for Claude Desktop"
-        HEADROOM_BIN="$(command -v headroom)" CLAUDE_DESKTOP_CONFIG="$CLAUDE_DESKTOP_CONFIG" python3 - <<'PY' || bashio::log.warning "Unable to register the headroom MCP server automatically"
-import json
-import os
-from pathlib import Path
-
-path = Path(os.environ["CLAUDE_DESKTOP_CONFIG"])
-try:
-    data = json.loads(path.read_text()) if path.exists() else {}
-    if not isinstance(data, dict):
-        data = {}
-except Exception:
-    if path.exists():
-        path.rename(path.with_suffix(path.suffix + ".bak"))
-    data = {}
-servers = data.get("mcpServers")
-if not isinstance(servers, dict):
-    servers = {}
-    data["mcpServers"] = servers
-servers["headroom"] = {"command": os.environ.get("HEADROOM_BIN", "headroom"), "args": ["mcp", "serve"]}
-path.parent.mkdir(parents=True, exist_ok=True)
-path.write_text(json.dumps(data, indent=2) + "\n")
-PY
+        HEADROOM_ENABLED=true
+        bashio::log.info "headroom $(headroom --version 2> /dev/null || true) available; registering the headroom MCP server"
     else
         bashio::log.warning "headroom is not available"
     fi
-elif [ -f "$CLAUDE_DESKTOP_CONFIG" ]; then
-    bashio::log.info "Removing the headroom MCP server from Claude Desktop"
-    CLAUDE_DESKTOP_CONFIG="$CLAUDE_DESKTOP_CONFIG" python3 - <<'PY' || bashio::log.warning "Unable to remove the headroom MCP server automatically"
+fi
+
+TOKENSAVE_ENABLED=false
+if bashio::config.true 'install_tokensave'; then
+    if command -v tokensave &> /dev/null; then
+        TOKENSAVE_ENABLED=true
+        bashio::log.info "tokensave $(tokensave --version 2> /dev/null || true) available; registering the tokensave MCP server"
+    else
+        bashio::log.warning "tokensave is not available"
+    fi
+fi
+
+HA_MCP_ENABLED=false
+HA_MCP_URL=""
+HA_MCP_TOKEN=""
+if bashio::config.true 'enable_ha_mcp'; then
+    HA_MCP_URL="$(bashio::config 'ha_mcp_url' 'http://homeassistant:8123/api/mcp')"
+    if bashio::config.has_value 'ha_mcp_token'; then
+        HA_MCP_TOKEN="$(bashio::config 'ha_mcp_token')"
+    fi
+    if [ -z "$HA_MCP_TOKEN" ]; then
+        bashio::log.warning "enable_ha_mcp is on but ha_mcp_token is empty; set a Home Assistant long-lived access token (Profile -> Security) and enable the 'Model Context Protocol Server' integration"
+    elif ! command -v mcp-proxy &> /dev/null; then
+        bashio::log.warning "mcp-proxy is not available; cannot register the Home Assistant MCP server"
+    else
+        HA_MCP_ENABLED=true
+        bashio::log.info "Registering the Home Assistant MCP server (${HA_MCP_URL})"
+    fi
+fi
+
+HEADROOM_ENABLED="$HEADROOM_ENABLED" HEADROOM_BIN="$(command -v headroom || echo headroom)" \
+    TOKENSAVE_ENABLED="$TOKENSAVE_ENABLED" TOKENSAVE_BIN="$(command -v tokensave || echo tokensave)" \
+    HA_MCP_ENABLED="$HA_MCP_ENABLED" HA_MCP_URL="$HA_MCP_URL" HA_MCP_TOKEN="$HA_MCP_TOKEN" \
+    MCP_PROXY_BIN="$(command -v mcp-proxy || echo mcp-proxy)" \
+    CLAUDE_DESKTOP_CONFIG="$CLAUDE_DESKTOP_CONFIG" CLAUDE_CODE_CONFIG="$CLAUDE_CODE_CONFIG" \
+    python3 - <<'PY' || bashio::log.warning "Unable to update the MCP server registrations automatically"
 import json
 import os
 from pathlib import Path
 
-path = Path(os.environ["CLAUDE_DESKTOP_CONFIG"])
-data = json.loads(path.read_text())
-if isinstance(data, dict):
+MANAGED_BASENAMES = {
+    "headroom": "headroom",
+    "tokensave": "tokensave",
+    "homeassistant": "mcp-proxy",
+}
+
+desired = {}
+if os.environ["HEADROOM_ENABLED"] == "true":
+    desired["headroom"] = {"command": os.environ["HEADROOM_BIN"], "args": ["mcp", "serve"]}
+if os.environ["TOKENSAVE_ENABLED"] == "true":
+    desired["tokensave"] = {"command": os.environ["TOKENSAVE_BIN"], "args": ["serve"]}
+if os.environ["HA_MCP_ENABLED"] == "true":
+    # Home Assistant's MCP Server integration speaks stateless Streamable HTTP on /api/mcp;
+    # mcp-proxy defaults to SSE, so the transport flags are required.
+    desired["homeassistant"] = {
+        "command": os.environ["MCP_PROXY_BIN"],
+        "args": ["--transport=streamablehttp", "--stateless", os.environ["HA_MCP_URL"]],
+        "env": {"API_ACCESS_TOKEN": os.environ["HA_MCP_TOKEN"]},
+    }
+
+# An entry is add-on-managed when its command is one of our binaries living outside the
+# persistent home. Matching on the basename (rather than the exact path recorded at write
+# time) keeps entries updatable when a base-image upgrade moves the binary, while commands
+# under $HOME stay untouched because those are user-installed.
+HOME_PREFIX = os.path.expanduser("~") + os.sep
+
+def is_managed(name, entry):
+    if not isinstance(entry, dict):
+        return False
+    command = entry.get("command")
+    if not isinstance(command, str) or command.startswith(HOME_PREFIX):
+        return False
+    return os.path.basename(command) == MANAGED_BASENAMES[name]
+
+for config_var, stdio_type in (("CLAUDE_DESKTOP_CONFIG", False), ("CLAUDE_CODE_CONFIG", True)):
+    path = Path(os.environ[config_var])
+    try:
+        data = json.loads(path.read_text()) if path.exists() else {}
+        if not isinstance(data, dict):
+            data = {}
+    except Exception:
+        if path.exists():
+            path.rename(path.with_suffix(path.suffix + ".bak"))
+        data = {}
     servers = data.get("mcpServers")
-    if isinstance(servers, dict) and servers.pop("headroom", None) is not None:
-        if not servers:
-            data.pop("mcpServers", None)
-        path.write_text(json.dumps(data, indent=2) + "\n")
+    if not isinstance(servers, dict):
+        servers = {}
+    changed = False
+    for name in MANAGED_BASENAMES:
+        existing = servers.get(name)
+        if name in desired:
+            entry = dict(desired[name])
+            if stdio_type:
+                entry["type"] = "stdio"
+            if existing is None or is_managed(name, existing):
+                if existing != entry:
+                    servers[name] = entry
+                    changed = True
+        elif existing is not None and is_managed(name, existing):
+            del servers[name]
+            changed = True
+    if not changed:
+        continue
+    if servers:
+        data["mcpServers"] = servers
+    else:
+        data.pop("mcpServers", None)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(data, indent=2) + "\n")
+    # The Home Assistant long-lived access token is stored here in clear text.
+    path.chmod(0o600)
 PY
-fi
 
 # Guide Claude to actually use the headroom compression tools so the MCP integration produces
 # real savings (otherwise the tools sit unused and `headroom savings` stays empty). Managed,
@@ -216,9 +297,9 @@ else
     find "$HOME/.claude" -maxdepth 4 -iname '*caveman*' -exec rm -rf {} + 2> /dev/null || true
 fi
 
-# Startup configuration runs as root, while Claude Desktop and the web terminal run as abc.
-# Return managed persistent files to the configured runtime UID/GID after all writes complete.
-for managed_path in "$HOME/.claude" "$HOME/.config/Claude"; do
+# Startup configuration runs as root, while Claude Desktop runs as abc. Return managed
+# persistent files to the configured runtime UID/GID after all writes complete.
+for managed_path in "$HOME/.claude" "$HOME/.claude.json" "$HOME/.config/Claude"; do
     if [ -e "$managed_path" ]; then
         chown -R -- "${PUID}:${PGID}" "$managed_path" || bashio::log.warning "Unable to set ownership on $managed_path"
     fi

claude_desktop/rootfs/etc/s6-overlay/s6-rc.d/svc-claude-terminal/run

@@ -1,101 +0,0 @@
-#!/usr/bin/with-contenv bashio
-# shellcheck shell=bash
-set -e
-set -o pipefail
-
-declare port=7681
-declare username
-declare password=""
-declare workspace
-declare canonical_workspace
-
-export PATH="${HOME:-/data/data}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
-
-if bashio::config.has_value 'enable_terminal' && ! bashio::config.true 'enable_terminal'; then
-    bashio::log.info "svc-claude-terminal: terminal disabled; idling"
-    exec sleep infinity
-fi
-
-if [ -z "${HOME:-}" ]; then
-    bashio::log.error "svc-claude-terminal: HOME is not initialized; idling"
-    exec sleep infinity
-fi
-
-if ! command -v ttyd >/dev/null 2>&1 || ! command -v tmux >/dev/null 2>&1 || ! command -v claude >/dev/null 2>&1; then
-    bashio::log.error "svc-claude-terminal: ttyd, tmux, or Claude Code is missing; idling"
-    exec sleep infinity
-fi
-
-username="claude"
-if bashio::config.has_value 'terminal_username'; then
-    username="$(bashio::config 'terminal_username')"
-fi
-
-if bashio::config.has_value 'terminal_password'; then
-    password="$(bashio::config 'terminal_password')"
-elif bashio::config.has_value 'PASSWORD'; then
-    bashio::log.warning "svc-claude-terminal: using PASSWORD as fallback for terminal authentication; prefer a unique terminal_password"
-    password="$(bashio::config 'PASSWORD')"
-fi
-
-if [ -z "$password" ]; then
-    bashio::log.warning "svc-claude-terminal: set terminal_password (or PASSWORD) before mapping port ${port}; terminal will remain disabled"
-    exec sleep infinity
-fi
-
-workspace="${HOME}/workspace"
-if bashio::config.has_value 'terminal_workspace'; then
-    workspace="$(bashio::config 'terminal_workspace')"
-fi
-
-if [[ "$workspace" != /* ]]; then
-    bashio::log.error "svc-claude-terminal: terminal_workspace must be an absolute path; idling"
-    exec sleep infinity
-fi
-
-if [ -L "$workspace" ]; then
-    bashio::log.error "svc-claude-terminal: terminal_workspace must not be a symbolic link; idling"
-    exec sleep infinity
-fi
-
-if ! canonical_workspace="$(realpath -m -- "$workspace")"; then
-    bashio::log.error "svc-claude-terminal: unable to resolve terminal_workspace '$workspace'; idling"
-    exec sleep infinity
-fi
-workspace="$canonical_workspace"
-
-case "$workspace" in
-    "$HOME" | "$HOME"/* | /share/* | /media/* | /mnt/* | /data/* | /config/*)
-        ;;
-    *)
-        bashio::log.error "svc-claude-terminal: terminal_workspace must be the configured data_location or a subdirectory of /share, /media, /mnt, /data, or /config; idling"
-        exec sleep infinity
-        ;;
-esac
-
-if [ ! -e "$workspace" ]; then
-    if ! install -d -m 0750 -o abc -g abc -- "$workspace"; then
-        bashio::log.error "svc-claude-terminal: failed to create workspace '$workspace'; idling"
-        exec sleep infinity
-    fi
-elif [ ! -d "$workspace" ]; then
-    bashio::log.error "svc-claude-terminal: terminal_workspace '$workspace' is not a directory; idling"
-    exec sleep infinity
-fi
-
-if ! s6-setuidgid abc test -r "$workspace" ||
-    ! s6-setuidgid abc test -w "$workspace" ||
-    ! s6-setuidgid abc test -x "$workspace"; then
-    bashio::log.error "svc-claude-terminal: workspace '$workspace' must be readable, writable, and searchable by user abc; idling"
-    exec sleep infinity
-fi
-
-export CLAUDE_TERMINAL_WORKSPACE="$workspace"
-
-bashio::log.info "svc-claude-terminal: starting authenticated ttyd terminal on port ${port}; workspace=${workspace}"
-exec s6-setuidgid abc ttyd \
-    -p "$port" \
-    -W \
-    -O \
-    -c "${username}:${password}" \
-    /usr/local/bin/claude-terminal-shell

claude_desktop/rootfs/etc/s6-overlay/s6-rc.d/svc-headroom/run

@@ -1,7 +1,9 @@
 #!/usr/bin/with-contenv bashio
 # Headroom optimization proxy — local backend for Claude Desktop MCP and Claude Code.
 declare port=8787
-declare host=127.0.0.1
+# Bind all interfaces so the dashboard is reachable on the mapped host port
+# (http://<ha-ip>:8787/dashboard). Local consumers keep using 127.0.0.1.
+declare host=0.0.0.0
 
 if bashio::config.true 'install_headroom' && command -v headroom >/dev/null 2>&1; then
     bashio::log.info "svc-headroom: starting local Headroom proxy on ${host}:${port}"

claude_desktop/rootfs/usr/local/bin/claude-direct

@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-exec claude "$@"

claude_desktop/rootfs/usr/local/bin/claude-headroom

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if ! command -v claude >/dev/null 2>&1; then
-    echo "Claude Code is not installed or is not on PATH." >&2
-    exit 127
-fi
-
-if ! command -v headroom >/dev/null 2>&1; then
-    echo "Headroom is unavailable; start Claude Code directly with claude-direct." >&2
-    exit 127
-fi
-
-if ! curl -fsS --max-time 3 "http://127.0.0.1:8787/readyz" >/dev/null; then
-    echo "The supervised Headroom proxy is not ready on 127.0.0.1:8787. Ensure install_headroom is enabled and check the add-on log." >&2
-    exit 1
-fi
-
-# Reuse the s6-supervised proxy instead of starting a competing proxy. RTK is already managed
-# through the persistent Claude Code PreToolUse hook, so Headroom must not reinstall it.
-exec headroom wrap claude --port 8787 --no-proxy --no-rtk -- "$@"

claude_desktop/rootfs/usr/local/bin/claude-terminal-shell

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [ -z "${HOME:-}" ]; then
-    echo "Claude terminal: HOME is not initialized." >&2
-    exit 1
-fi
-
-export SHELL="/bin/bash"
-export PATH="${HOME}/.local/bin:/usr/local/bin:/usr/bin:/bin:${PATH:-}"
-
-workspace="${CLAUDE_TERMINAL_WORKSPACE:-${HOME}/workspace}"
-session_name="${CLAUDE_TMUX_SESSION:-claude}"
-
-if [ ! -d "$workspace" ]; then
-    echo "Claude terminal: workspace does not exist: $workspace" >&2
-    exit 1
-fi
-
-cd -- "$workspace"
-
-# Reattach every browser connection to the same terminal session. Closing the browser detaches
-# the client but leaves Claude Code and other commands running inside tmux.
-exec tmux new-session -A -s "$session_name" -c "$workspace"

claude_desktop/updater.json

@@ -3,5 +3,7 @@
   "upstream_repo": "linuxserver/docker-baseimage-selkies",
   "github_fulltag": true,
   "slug": "claude_desktop",
-  "paused": false
+  "paused": false,
+  "upstream_version": "ubunturesolute-version-6dc44b0e",
+  "last_update": "2026-07-13"
 }

cleanuparr/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.9.16 (2026-07-11)
+- Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)
+ 
 ## 2.9.14 (2026-06-20)
 - Update to latest version from Cleanuparr/Cleanuparr (changelog : https://github.com/Cleanuparr/Cleanuparr/releases)
 

cleanuparr/Dockerfile

@@ -11,7 +11,7 @@
 #=== Home Assistant Addon ===#
 
 # ARGs used in FROM must be declared before any FROM instruction
-ARG BUILD_UPSTREAM="2.9.14"
+ARG BUILD_UPSTREAM="2.9.16"
 
 #################
 # 1 Build Image #

cleanuparr/config.yaml

@@ -91,5 +91,5 @@ schema:
   TZ: str?
 slug: cleanuparr
 url: https://github.com/alexbelgium/hassio-addons/tree/master/cleanuparr
-version: "2.9.14"
+version: "2.9.16"
 webui: "[PROTO:ssl]://[HOST]:[PORT:11011]"

cleanuparr/updater.json

@@ -1,8 +1,8 @@
 {
-  "last_update": "2026-06-20",
+  "last_update": "2026-07-11",
   "repository": "alexbelgium/hassio-addons",
   "slug": "cleanuparr",
   "source": "github",
   "upstream_repo": "Cleanuparr/Cleanuparr",
-  "upstream_version": "2.9.14"
+  "upstream_version": "2.9.16"
 }

codex/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.1.2 (2026-07-11)
+- Update to latest version from ajslater/codex (changelog : https://github.com/ajslater/codex/releases)
+ 
 ## 2.1.0 (2026-07-04)
 - Update to latest version from ajslater/codex (changelog : https://github.com/ajslater/codex/releases)
  

codex/config.yaml

@@ -101,4 +101,4 @@ schema:
 slug: codex
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2.1.0"
+version: "2.1.2"

codex/updater.json

@@ -1,9 +1,9 @@
 {
   "github_beta": "true",
-  "last_update": "2026-07-04",
+  "last_update": "2026-07-11",
   "repository": "alexbelgium/hassio-addons",
   "slug": "codex",
   "source": "github",
   "upstream_repo": "ajslater/codex",
-  "upstream_version": "2.1.0"
+  "upstream_version": "2.1.2"
 }

elasticsearch/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 8.19.18-3 (14-07-2026)
+- Force a fresh image pull for users left on a stale cached image (some upgrades kept running the old Elasticsearch 7.17.9 image, failing with `mv: cannot move '/data/config' ... Permission denied` and `AccessDeniedException[/usr/share/elasticsearch/data/nodes/0]`). Fully stop and update the add-on so Home Assistant pulls this build.
+- Replaced the cryptic `Permission denied` failure with a clear message when the add-on is not running as root (the state that caused the failure above).
+
+## 8.19.18-2 (14-07-2026)
+- Minor bugs fixed
 ## 8.19.18 (2026-07-14)
 
 - Upgrade to Elasticsearch 8.19.18 (#2849). Note: despite the previous add-on version reading `8.14.3`, the shipped image was still Elasticsearch 7.17.9 — the Dockerfile upstream version was never bumped. This release actually delivers 8.x, making the add-on compatible with the `homeassistant-elasticsearch` integration (requires 8.14+).
@@ -8,9 +14,10 @@
 - Removed the `ingest-attachment` plugin install: it is a bundled module since Elasticsearch 8.0.
 - Startup persistence logic rewritten as a proper init script (`/usr/local/bin/addon-init.sh`) instead of line-number-based entrypoint patching.
 - Added `updater.json` so upstream 8.19.x releases are tracked automatically (pinned to the 8.19 line: 9.x cannot read indices created in 7.x).
-- The upstream 8.x image ends the build as a non-root user with a read-only entrypoint; the Dockerfile now switches to root for the build steps that patch/install into it. The image stays root at runtime too (unchanged from 7.17.9): the upstream entrypoint no longer drops privileges itself, and `addon-init.sh` needs to chown/move pre-existing `/data` content that may be owned by root from earlier installs.
+- The upstream 8.x image ends the build as a non-root user with a read-only entrypoint; the Dockerfile now switches to root for the build steps that patch/install into it. The container also starts as root (unchanged from 7.17.9) so `addon-init.sh` can chown/move pre-existing `/data` content that may be owned by root from earlier installs; unlike 7.17.9's own entrypoint, the upstream 8.x entrypoint no longer drops privileges before starting Elasticsearch (which refuses to run as root), so `addon-init.sh` now does that itself via `chroot --userspec=1000:0` once its root-only work is done.
 - `env_vars` names starting with a digit are now rejected before export instead of crashing the entrypoint.
 - Fixed a startup failure (`mv: cannot move '/data/config' ... Permission denied`) on upgrade from an existing 7.17.9 install, caused by an earlier fix in this same release that switched the runtime user to non-root before this fix was in place.
+- Fixed a second regression from that same fix: without a privilege drop before starting Elasticsearch, both fresh installs and upgrades would fail Elasticsearch's own root-check ("can not run elasticsearch as root").
 
 ## 8.14.3-3 (2026-06-19)
 - Fix startup failing with `chroot: cannot change root directory` by allowing `capability sys_chroot` in the AppArmor profile (#2709)

elasticsearch/Dockerfile

@@ -141,9 +141,10 @@ HEALTHCHECK \
     --timeout=25s \
     CMD curl -A "HealthCheck: Docker/1.0" -s -f "http://127.0.0.1:${HEALTH_PORT}${HEALTH_URL}" &>/dev/null || exit 1
 
-# Stay root at runtime: addon-init.sh must chown/mv pre-existing /data
-# content that may be owned by root from earlier installs, and the upstream
-# entrypoint no longer drops privileges itself, so a non-root container
-# can't touch that data at all. This matches the addon's own AppArmor
-# profile (chown, setuid, setgid, sys_chroot, mount capabilities), which
-# assumes a root process.
+# Start as root: addon-init.sh needs it to chown/move pre-existing /data
+# content that may be owned by root from earlier installs. It drops to
+# uid 1000 itself (via chroot --userspec) before Elasticsearch actually
+# starts, since Elasticsearch refuses to run as root and the upstream 8.x
+# entrypoint no longer does that drop on its own (7.x's did). This matches
+# the addon's own AppArmor profile (chown, setuid, setgid, sys_chroot,
+# mount capabilities).

elasticsearch/config.yaml

@@ -90,4 +90,4 @@ slug: elasticsearch
 startup: services
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/elasticsearch
-version: 8.19.18
+version: 8.19.18-3

elasticsearch/rootfs/usr/local/bin/addon-init.sh

@@ -1,15 +1,25 @@
 #!/bin/bash
 # shellcheck shell=bash
 # Sourced by /usr/local/bin/docker-entrypoint.sh (right after "set -e"),
-# before Elasticsearch starts. Runs as root (the image stays root at
-# runtime - see Dockerfile); the official entrypoint does not drop
-# privileges itself, and Elasticsearch ends up running as root too.
+# before Elasticsearch starts. The container starts as root (see
+# Dockerfile) so this script can chown/move pre-existing /data content
+# that may be owned by root from earlier installs. Elasticsearch itself
+# refuses to run as root, and unlike 7.x the upstream 8.x entrypoint no
+# longer drops privileges on its own, so this script does it at the end
+# (section 6) by re-execing the entrypoint as uid 1000. On that re-exec'd
+# pass this script just returns immediately (see the guard right below).
 #
 # Responsibilities:
 #   1. Export user env_vars from /data/options.json
 #   2. Default xpack.security.enabled=false (7.x behavior) unless user overrides
 #   3. Relocate data & config to /data for persistence (idempotent)
 #   4. Guard major-version data migrations (7.x -> 8.x is automatic)
+#   5. Record the running version once Elasticsearch is confirmed healthy
+#   6. Drop root privileges before Elasticsearch actually starts
+
+if [ -n "${_ADDON_INIT_REEXEC:-}" ]; then
+    return 0
+fi
 
 echo "-----------------------------------------------------------"
 echo " Add-on: Elasticsearch server"
@@ -21,6 +31,17 @@ PERSISTENT_HOME="/data"
 VERSION_MARKER="$PERSISTENT_HOME/.addon-upstream-version"
 OPTIONS_JSON="/data/options.json"
 
+# This first pass must be root so it can relocate and take ownership of
+# pre-existing /data content written by an earlier (root) install. If it
+# is not root (e.g. an old cached image that pinned USER 1000:0, or the
+# container being forced to another user), the moves/chowns below fail
+# with a cryptic "Permission denied"; fail loudly with the real reason.
+if [ "$(id -u)" -ne 0 ]; then
+    echo "FATAL: the Elasticsearch add-on must start as root (currently uid $(id -u))."
+    echo "If you upgraded from an older version, the running image is likely stale - fully stop and update/reinstall the add-on so Home Assistant pulls the current image."
+    exit 1
+fi
+
 ############################
 # 1 Export user env_vars   #
 ############################
@@ -84,7 +105,11 @@ if [ -n "$data_version" ] && [[ $current_major =~ ^[0-9]+$ ]]; then
         if [ -d "$PERSISTENT_HOME/config" ] && [ ! -L "$PERSISTENT_HOME/config" ]; then
             config_backup="$PERSISTENT_HOME/config.bak-$data_version"
             if [ ! -e "$config_backup" ]; then
-                mv "$PERSISTENT_HOME/config" "$config_backup"
+                if ! mv "$PERSISTENT_HOME/config" "$config_backup"; then
+                    echo "FATAL: could not archive the old config to $config_backup."
+                    echo "This add-on must run as root to migrate a previous install. Restore a Home Assistant backup and ensure the add-on is not forced to a non-root user."
+                    exit 1
+                fi
                 echo "NOTICE: previous config archived to $config_backup. Re-apply any custom settings to the new config."
             fi
         fi
@@ -141,3 +166,17 @@ if [ "$data_version" != "$current_version" ]; then
         done
     ) &
 fi
+
+############################
+# 6 Drop privileges        #
+############################
+
+# Elasticsearch refuses to start as root ("can not run elasticsearch as
+# root"). 7.x's own entrypoint dropped to uid 1000 via chroot before
+# launching Elasticsearch; 8.x no longer does that, so do it here instead,
+# then let the entrypoint continue as uid 1000 (matches the sys_chroot /
+# setuid / setgid capabilities already granted in the AppArmor profile).
+if [ "$(id -u)" -eq 0 ]; then
+    export _ADDON_INIT_REEXEC=1
+    exec chroot --userspec=1000:0 / /usr/local/bin/docker-entrypoint.sh "$@"
+fi

emby_beta/CHANGELOG.md

@@ -1,4 +1,10 @@
  
+## 4.10.0.19 (2026-07-13)
+- Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
+ 
+## 4.10.0.18 (2026-07-11)
+- Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
+ 
 ## 4.10.0.17 (2026-07-04)
 - Update to latest version from linuxserver/docker-emby (changelog : https://github.com/linuxserver/docker-emby/releases)
  

emby_beta/Dockerfile

@@ -16,7 +16,7 @@
 
 ARG BUILD_FROM
 ARG BUILD_VERSION
-ARG BUILD_UPSTREAM="4.10.0.17"
+ARG BUILD_UPSTREAM="4.10.0.19"
 FROM ${BUILD_FROM}
 
 ##################

emby_beta/config.yaml

@@ -122,5 +122,5 @@ schema:
 slug: emby_nas
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/emby
-version: "4.10.0.17"
+version: "4.10.0.19"
 video: true