fix(filebrowser_quantum): remove doubled status-bar inset in the HA app (#3111)

* fix(filebrowser_quantum): drop the doubled status-bar inset in the HA app

2.0 sets viewport-fit=cover and pads its header by env(safe-area-inset-top);
inside the ingress panel HA's toolbar already handles that inset. Rewrite it
to viewport-fit=auto on the ingress listener only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(filebrowser_quantum): zero only the top safe-area inset on ingress

Replace the viewport-fit rewrite with --safe-area-top: 0px set on <html>
from the existing nonce script. It touches only the top inset (bottom and
side insets keep upstream behaviour) and works whether or not the browser
passes the parent's insets into the ingress iframe.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

filebrowser_quantum/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.0.0.2 (2026-10-11)
+- Remove the empty band above the search bar in the Home Assistant app (portrait): 2.0 padded its header for the phone status bar, which HA already does. The top inset is set to 0 on ingress only.
+
 ## 2.0.0.1 (2026-10-11)
 - ⚠️ **Back up before updating.** FileBrowser 2.0 changes the config format and the database. This add-on converts both automatically, but you should first create a Home Assistant backup of the add-on, or copy `/addon_configs/*filebrowser_quantum*/` (`config.yaml` and `database.db`). Your 1.x `database.db` is left untouched, but downgrading after the migration loses any changes made in 2.0.
 - Fix startup on 2.0.0, for fresh installs and upgrades (#3109).
@@ -11,7 +14,6 @@
   - Users, shares and settings in `/config/database.db` are migrated to `/config/database.sqlite` on first start.
 - `http.trustProxyHeaders` is set to `true`, because the add-on always runs behind nginx on a subpath.
 - The container healthcheck now checks FileBrowser directly on port 8080 instead of an nginx stub.
-- Remove the empty band above the search bar in the Home Assistant app: 2.0 padded its header for the phone status bar, which HA already does. This applies to ingress only.
 - Direct access on port 8071 no longer passes on a client-supplied `X-Forwarded-For`, so the IP-based login lockout cannot be bypassed now that proxy headers are trusted. Ingress keeps the forwarded chain.
 
 ## 2.0.0 (2026-10-10)

filebrowser_quantum/config.yaml

@@ -117,4 +117,4 @@ schema:
 slug: filebrowser_quantum
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2.0.0.1"
+version: "2.0.0.2"

filebrowser_quantum/rootfs/etc/nginx/servers/ingress.conf

@@ -13,12 +13,12 @@ server {
        proxy_read_timeout 30m;
        proxy_pass         %%protocol%%://backend%%subpath%%;
 
-       # Two things the ingress panel needs that a plain browser tab does not.
+       # Three things the ingress panel needs that a plain browser tab does not.
        # Both are injected into the page's existing nonce-carrying inline script
        # rather than next to <div id="app">: FileBrowser sends
        # script-src 'self' 'nonce-<random>', so a standalone inline <script>
        # would be blocked. If upstream ever drops that
-       # window.__pwaDeferredPrompt line the filter stops matching and both
+       # window.__pwaDeferredPrompt line the filter stops matching and all three
        # behaviours revert, which is the state before either fix.
        #
        # 1. Opening a folder. The tool views (Tools -> File Size Analyzer and
@@ -106,12 +106,12 @@ server {
        # links inside a document FileBrowser renders in its own iframe -- the
        # pdf viewer, the srcdoc markdown/html preview, OnlyOffice -- because a
        # listener on this document never sees another document's clicks.
-       # 2.0 asks for viewport-fit=cover and pads its header by
-       # env(safe-area-inset-top). In the Home Assistant app the panel already
-       # sits below HA's toolbar, which handles that inset, so it was applied
-       # twice (an empty band above the search bar). The direct port is untouched.
-       sub_filter "viewport-fit=cover" "viewport-fit=auto";
-       sub_filter "window.__pwaDeferredPrompt = null;" "window.__pwaDeferredPrompt = null;(function(){var o=window.open;window.open=function(u,n,f){try{var b=(window.globalVars||{}).baseURL;if(u&&n==='_blank'&&!f&&b){if(b.slice(-1)!=='/')b+='/';var t=new URL(u,location.href);if((t.protocol==='http:'||t.protocol==='https:')&&t.origin===location.origin&&(t.pathname.indexOf(b+'files/')===0||t.pathname.indexOf(b+'public/share/')===0)){location.assign(t.href);return window}}}catch(e){}return o.apply(window,arguments)};document.addEventListener('click',function(e){try{if(e.button||e.metaKey||e.ctrlKey||e.shiftKey||e.altKey)return;var a=e.target&&e.target.closest?e.target.closest('a'):null;if(!a||!a.href)return;var b=(window.globalVars||{}).baseURL;if(!b)return;if(b.slice(-1)!=='/')b+='/';var t=new URL(a.href,location.href);if(t.origin!==location.origin)return;if(!a.hasAttribute('download')&&t.searchParams.get('inline')!=='true'&&(t.pathname===b+'api/resources/download'||t.pathname===b+'public/api/resources/download')){a.download='';a.removeAttribute('target');return}if(a.target==='_blank'&&t.pathname.indexOf(b)===0&&navigator.userAgent.indexOf('Mobile/HomeAssistant')!==-1){a.removeAttribute('target')}}catch(err){}},true)})();";
+       # 3. The status-bar inset. 2.0 pads its header by env(safe-area-inset-top)
+       # (--safe-area-top), but inside the Home Assistant app the panel already
+       # sits below HA's toolbar, which handles that inset, so in portrait it
+       # was applied twice: an empty band above the search bar. Zero it on
+       # <html>, which overrides the :root rule; the direct port is untouched.
+       sub_filter "window.__pwaDeferredPrompt = null;" "window.__pwaDeferredPrompt = null;document.documentElement.style.setProperty('--safe-area-top','0px');(function(){var o=window.open;window.open=function(u,n,f){try{var b=(window.globalVars||{}).baseURL;if(u&&n==='_blank'&&!f&&b){if(b.slice(-1)!=='/')b+='/';var t=new URL(u,location.href);if((t.protocol==='http:'||t.protocol==='https:')&&t.origin===location.origin&&(t.pathname.indexOf(b+'files/')===0||t.pathname.indexOf(b+'public/share/')===0)){location.assign(t.href);return window}}}catch(e){}return o.apply(window,arguments)};document.addEventListener('click',function(e){try{if(e.button||e.metaKey||e.ctrlKey||e.shiftKey||e.altKey)return;var a=e.target&&e.target.closest?e.target.closest('a'):null;if(!a||!a.href)return;var b=(window.globalVars||{}).baseURL;if(!b)return;if(b.slice(-1)!=='/')b+='/';var t=new URL(a.href,location.href);if(t.origin!==location.origin)return;if(!a.hasAttribute('download')&&t.searchParams.get('inline')!=='true'&&(t.pathname===b+'api/resources/download'||t.pathname===b+'public/api/resources/download')){a.download='';a.removeAttribute('target');return}if(a.target==='_blank'&&t.pathname.indexOf(b)===0&&navigator.userAgent.indexOf('Mobile/HomeAssistant')!==-1){a.removeAttribute('target')}}catch(err){}},true)})();";
   }
 
 }