Merge branch 'dev' into feat/homarr-assistant

packages/api/src/router/app.ts

@@ -173,7 +173,7 @@ export const appRouter = createTRPCRouter({
       mcp: {
         enabled: true,
         description:
-          "Create a new app (bookmark/shortcut to a service). REQUIRED: name (string), iconUrl (icon URL string), href (app URL, http/https or blank). OPTIONAL: description (string or null), pingUrl (URL to check reachability, or empty string)",
+          "Create a new app (bookmark/shortcut to a service). REQUIRED: name (string), iconUrl (icon URL string), href (app URL or custom URI scheme such as vscode://, or blank). OPTIONAL: description (string or null), pingUrl (URL to check reachability, or empty string)",
       },
     })
     .mutation(async ({ ctx, input }) => {

packages/api/src/router/home.ts

@@ -92,7 +92,7 @@ export const homeRouter = createTRPCRouter({
       });
     }
 
-    if (ctx.session?.user.permissions.includes("integration-full-all")) {
+    if (ctx.session?.user.permissions.includes("integration-create")) {
       statistics.push({
         titleKey: "integration",
         subtitleKey: "resources",

packages/api/src/router/integration/integration-router.ts

@@ -62,13 +62,12 @@ export const integrationRouter = createTRPCRouter({
         requiredSecrets: def.secretKinds,
       }));
     }),
-  all: permissionRequiredProcedure
-    .requiresPermission("integration-full-all")
+  all: protectedProcedure
     .meta({
       mcp: {
         enabled: true,
         description:
-          "List all configured integrations (connections to services like Sonarr, Radarr, Plex, etc.). Requires integration-full-all permission. Returns each integration's id, name, kind, url, and permissions. Use the 'id' field as 'integrationId' in other tools. Check permissions.hasUseAccess before reading data and permissions.hasInteractAccess before performing actions — false means the API key owner lacks that permission level for this integration, not an error",
+          "List all configured integrations (connections to services like Sonarr, Radarr, Plex, etc.). Returns each integration's id, name, kind, url, and permissions. Use the 'id' field as 'integrationId' in other tools. Check permissions.hasUseAccess before reading data and permissions.hasInteractAccess before performing actions — false means the API key owner lacks that permission level for this integration, not an error",
       },
     })
     .query(async ({ ctx }) => {

packages/integrations/src/overseerr/overseerr-integration.ts

@@ -185,9 +185,15 @@ export class OverseerrIntegration
       }),
     );
 
-    return settled
+    const fulfilled = settled
       .filter((result): result is PromiseFulfilledResult<MediaRequest> => result.status === "fulfilled")
       .map((result) => result.value);
+
+    if (fulfilled.length === 0) {
+      throw new Error("Failed to resolve any media request information");
+    }
+
+    return fulfilled;
   }
 
   protected mapRequestStatus(status: UpstreamMediaRequestStatus): MediaRequestStatus {

packages/spotlight/src/modes/command/global-group.tsx

@@ -95,9 +95,7 @@ export const globalCommandGroup = createGroup<Command>({
         icon: IconPlug,
         name: tOption("newIntegration.label"),
         useInteraction: interaction.children(newIntegrationChildrenOptions),
-        hidden:
-          !session?.user.permissions.includes("integration-full-all") ||
-          !session?.user.permissions.includes("integration-create"),
+        hidden: !session?.user.permissions.includes("integration-create"),
       },
       {
         commandKey: "newUser",

packages/spotlight/src/modes/page/pages-search-group.tsx

@@ -82,7 +82,7 @@ export const pagesSearchGroup = createGroup<{
         icon: IconPlug,
         path: "/manage/integrations",
         name: t("manageIntegration.label"),
-        hidden: !session?.user.permissions.includes("integration-full-all"),
+        hidden: !session,
       },
       {
         icon: IconSearch,

packages/validation/src/app.ts

@@ -3,12 +3,7 @@ import { z } from "zod/v4";
 export const appHrefSchema = z
   .string()
   .trim()
-  .url()
-  .regex(/^(?!javascript)[a-zA-Z]*:\/\//i) // javascript: is not allowed, i for case insensitive (so Javascript: is also not allowed)
-  .or(z.string().trim().includes("[homarr_base]"))
-  .or(z.string().trim().includes("[homarr_hostname]"))
-  .or(z.string().trim().includes("[homarr_domain]"))
-  .or(z.string().trim().includes("[homarr_protocol]"))
+  .refine((val) => !/^javascript:/i.test(val), "JavaScript URIs are not permitted")
   .or(z.literal(""))
   .transform((value) => (value.length === 0 ? null : value))
   .nullable();