test: align release v2 contracts

* Add Homarr provider proxy foundation

* Complete Homarr provider integration

* Harden Homarr provider integration

* Address Homarr provider review feedback

* Address CodeRabbit provider feedback

* Localize provider errors

* Handle provider activity load failures

* docs: improve workshop and homepage

* Harden Homarr provider limits

* fix: harden the Homarr provider

* fix: address provider review feedback

* fix: clarify provider request accounting

* feat: complete the Homarr provider endpoint

* fix: terminate invalid provider streams

.agents/skills/documentation-sync/SKILL.md

@@ -1,44 +0,0 @@
----
-name: documentation-sync
-description: Keep Homarr documentation in sync with code changes. Use when modifying code that affects user-facing behavior, or when adding/modifying widgets, integrations, cron jobs, API routes, env vars, permissions, auth providers, or UI in apps/docs. Covers the docs/ mapping table, integration doc pattern, and widget doc pattern.
----
-
-# Documentation Sync
-
-When modifying code that affects user-facing behavior, you MUST also update the documentation in `apps/docs/`.
-
-## What triggers a doc update
-
-| Code change            | Doc location                                                |
-| ---------------------- | ----------------------------------------------------------- |
-| New integration        | `apps/docs/docs/integrations/<slug>/index.mdx` + `index.ts` |
-| New widget             | `apps/docs/docs/widgets/<slug>/index.mdx` + `index.ts`      |
-| Changed API surface    | `apps/docs/docs/management/api.mdx`                         |
-| New/changed env vars   | `apps/docs/docs/advanced/`                                  |
-| New CLI commands       | `apps/docs/docs/advanced/command-line/`                     |
-| Changed auth providers | `apps/docs/docs/advanced/` SSO pages                        |
-| UI/UX changes          | Relevant getting-started or management pages                |
-| New cron job           | `apps/docs/docs/management/tasks.mdx`                       |
-| Changed permissions    | `apps/docs/docs/management/users.mdx`                       |
-
-## Integration doc pattern
-
-Each integration has a folder under `apps/docs/docs/integrations/<slug>/`:
-
-- `index.ts` — exports a typed `IntegrationDefinition` with name, description, iconUrl, path
-- `index.mdx` — uses shared components: `IntegrationHeader`, `IntegrationCapabilites`, `IntegrationSecrets`
-- Import metadata from `@homarr/definitions` where possible
-
-## Widget doc pattern
-
-Each widget has a folder under `apps/docs/docs/widgets/<slug>/`:
-
-- `index.ts` — exports a typed `WidgetDefinition` with icon, name, description, path, configuration
-- `index.mdx` — uses shared components: `WidgetHeader`, `WidgetConfig`, `WidgetAdding`
-
-## Development
-
-- Run docs locally: `pnpm dev:docs` from root
-- Build docs: `pnpm turbo build --filter=@homarr/docs`
-- The docs app can import from `@homarr/definitions` for type-safe integration/widget metadata
-- Docusaurus strict mode throws on broken links — fix any broken references before committing

.agents/skills/homarr-custom-widget/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: homarr-custom-widget
+description: Author safe Homarr Custom JSX v2 widgets from API documentation.
+---
+
+# Homarr Custom Widget
+
+Author one widget at a time. When connected to Homarr, retrieve `homarr://custom-widgets/schema` and only the component resources needed for the design. The live resources are authoritative for the installed release.
+
+Keep documentation retrieval targeted: fetch at most eight named component documents before the first validation, or at most four after loading a complete example. Fetch another component only when a validation issue or a concrete missing interaction requires it; never load the catalog component-by-component.
+
+1. Read the API documentation.
+2. Create one credential-free widget with keyed `sources`, keyed `requests`, optional keyed `options`, and safe JSX `template`.
+3. Validate, preview, test queries and simulated actions, visually inspect, and iterate.
+4. Configure deployment-specific source URLs and request credentials through Homarr; never repeat plaintext.
+5. Save only after narrow/wide, light/dark, loading, empty, error, and success states work. When connected through MCP, persist the exact final tested preview with `customWidget_createFromPreview`; do not resend a large template through `customWidget_create` unless no preview session is available.
+
+Treat a supplied sample or successful preview response as the binding contract. Render every core requested field, guard optional arrays and nested values before indexing, and do not silently drop returned items. Show concise freshness context when the API supplies a timestamp. Give recoverable load errors and empty states a clear refresh or retry path.
+
+Use `{option:name}` or `$option` for saved options. Use `{param:name}` or `$param` for values supplied by `SubFetch`, `ActionButton`, or `ToggleSwitch`. Load queries cannot use invocation parameters. Templates read `data`, `status`, `options`, and temporary `inputs`.
+
+`SubFetch` with `trigger="manual"` renders its own load button. Pass a card or image through `triggerContent` with `triggerAriaLabel` when that content should launch the request. Its callback is `(result, meta)`; never author `onClick` or a fetch callback.
+
+Use standard Mantine compound names and deliberate visual hierarchy, spacing, restrained semantic color, and responsive layouts. Avoid excessive nested cards.
+
+Aim for distinctive polish without decorative gradients or fragile custom styling: use one semantic accent, clear surface contrast, purposeful typography, and compact rows that remain scannable in narrow tiles. Give standalone icons an accessible label or pair them with visible text.
+
+Make initial states actionable with an example, useful hint, or clear next step. Use wrapping groups for variable-length labels and values on narrow tiles. Do not use an unlabeled decorative icon as an empty state.
+
+Do not use imports, hooks, refs, raw HTML, raw event callbacks, browser requests, arbitrary functions, eval, bigint, npm packages, authored statement blocks, IIFEs, or recursion. Do not pretend MCP tools exist in an offline chat session.
+
+To install an existing widget, use `customWidget_workshopSearch`, inspect it with `customWidget_workshopGet`, then use `customWidget_workshopInstall`. Configure each self-hosted source afterward with `customWidget_sourceConfigure`, or call `customWidget_configurationRequestUser` so the user can enter the server URL and credentials directly in Homarr.
+
+Preview-scoped configuration expires with the preview. To persist user-entered values for a new widget, create the widget first, request configuration for its definition ID, then create a final preview with that definition ID so Homarr loads the stored credentials.
+
+When this skill is installed from the repository, optional offline details are in `references/schema.md`, `references/runtime.md`, and `references/security.md`. MCP-only clients should use the live Homarr resources instead.

.agents/skills/homarr-custom-widget/references/runtime.md

@@ -0,0 +1,16 @@
+# Runtime
+
+Templates read `data.requestId`, `status.requestId`, `options.name`, and temporary `inputs.name`. Status contains `loading`, `ok`, `status`, `statusText`, and `error`.
+
+`bind="search"` creates an in-memory input. It is never persisted. Supply invocation values only through `params`, for example:
+
+```jsx
+<TextInput bind="search" label="Search" />
+<SubFetch requestId="search" params={{ query: inputs.search }}>
+  {(items) => <Stack>{(items ?? []).map(item => <Text key={item.id}>{item.name}</Text>)}</Stack>}
+</SubFetch>
+```
+
+`SubFetch` with `trigger="manual"` renders its own load button. To make a card or image launch the request, pass that node through `triggerContent` and provide `triggerAriaLabel`; Homarr supplies the click and keyboard behavior. Its optional second callback argument contains `{ ok, status, statusText, loading: false }`; loading and request failures are rendered by `SubFetch` before the callback runs. Do not author `onClick` or a fetch callback.
+
+Use expression callbacks for supported collection methods and trusted slots. Do not use callback blocks, IIFEs, authored recursion, or raw events. Bounded regex literals work only with safe string matching/replacement operations.

.agents/skills/homarr-custom-widget/references/schema.md

@@ -0,0 +1,22 @@
+# Schema
+
+```ts
+interface HomarrCustomWidgetV2 {
+  $schema: "homarr-custom-widget-v2";
+  name: string;
+  description?: string;
+  iconUrl?: string;
+  sources: Record<string, CustomWidgetSource>;
+  requests: Record<string, CustomWidgetRequest>;
+  options?: Record<string, CustomWidgetOption>;
+  template: string;
+}
+```
+
+Sources require `default`. A request defaults to the default source, query, GET, load, inherited auth, and view permission. An action defaults to manual and modify permission. DELETE uses full permission and confirmation.
+
+Use stable real URLs for public APIs and clear suggested URLs for self-hosted services. Homarr collects the installer's server URL, network scope, and credentials as source setup; credentials remain outside the manifest.
+
+Paths use `{option:name}` and `{param:name}`. Query/body data uses `{ "$option": "name" }` and `{ "$param": "name" }`. Load queries cannot use params. Runtime parameter names and primitive values are inferred from references.
+
+Every option has `label`, `control`, and `default`. Optional fields are `description`, `choices`, `choicesFrom`, `min`, `max`, `step`, `advanced`, and `group`.

.agents/skills/homarr-custom-widget/references/security.md

@@ -0,0 +1,7 @@
+# Security
+
+All requests use Homarr's protected server executor. Source origin, network scope, DNS, redirects, SSRF, rate limits, permissions, size limits, timeouts, and encrypted credential injection remain enforced.
+
+The JSX interpreter blocks imports, hooks, refs, raw event callbacks, browser requests, eval, arbitrary functions, prototype access, unsafe URLs, global CSS escape, arbitrary portals, bigint, statement blocks, IIFEs, and recursion. Regex literals must be bounded and reject backreferences, lookbehind, nested quantifiers, excessive length, and unsupported flags.
+
+Credentials are stored separately and never exported or returned to an agent. A published self-hosted source URL is only a suggestion: installers must confirm or replace private and loopback URLs for their own Homarr deployment. Source origins cannot be controlled through widget options.

.claude/skills

@@ -1 +0,0 @@
-../.agents/skills

.cursor/rules/codebase-context.mdc

@@ -1,6 +1,6 @@
 ---
-name: codebase-context
-description: Comprehensive Homarr codebase architecture and conventions reference. Use when orienting in the monorepo, understanding package dependency layers, the three runtime services and ports, tRPC router structure, multi-database support, widget/integration/cron system architecture, routing, auth providers, env vars, or key patterns before writing code.
+description: Comprehensive Homarr codebase architecture and conventions reference
+alwaysApply: true
 ---
 
 # Homarr Codebase Context
@@ -27,7 +27,7 @@ Homarr is an open-source, self-hosted dashboard for managing homelab services. I
 
 ## Repository Structure
 
-```text
+```
 homarr/
 ├── apps/
 │   ├── nextjs/          # Main Next.js application (port 3000)
@@ -77,11 +77,11 @@ homarr/
 
 ## Three Runtime Services
 
-| Service   | Port | Role                                         |
-| --------- | ---- | -------------------------------------------- |
-| Next.js   | 3000 | Main web app (SSR + API routes)              |
-| WebSocket | 3001 | tRPC subscriptions via `ws`                  |
-| Tasks     | 3002 | Cron job runner + management API via Fastify |
+| Service | Port | Role |
+|---------|------|------|
+| Next.js | 3000 | Main web app (SSR + API routes) |
+| WebSocket | 3001 | tRPC subscriptions via `ws` |
+| Tasks | 3002 | Cron job runner + management API via Fastify |
 
 In Docker, nginx listens on **7575** and proxies to all three. The tasks service authenticates via `CRON_JOB_API_KEY` header.
 
@@ -110,7 +110,6 @@ In Docker, nginx listens on **7575** and proxies to all three. The tasks service
 ### Multi-Database Support
 
 Drizzle schemas exist in three parallel implementations:
-
 - `packages/db/schema/sqlite.ts`
 - `packages/db/schema/mysql.ts`
 - `packages/db/schema/postgresql.ts`
@@ -120,7 +119,6 @@ Selected at runtime via `DB_DRIVER` env (`better-sqlite3` | `mysql2` | `node-pos
 ### Widget System
 
 Widgets are registered in `packages/widgets/src/index.tsx` as `widgetImports` (must satisfy `Record<WidgetKind, ...>`). Each widget:
-
 - Has a `definition` created via `createWidgetDefinition(kind, { icon, createOptions, supportedIntegrations? })`
 - Uses `optionsBuilder.from(factory => ({ ... }))` for typed options
 - Loads dynamically via `next/dynamic`
@@ -133,7 +131,6 @@ Integrations are defined in `packages/definitions/src/integration.ts` (`integrat
 ### Cron Job System
 
 Jobs defined in `packages/cron-jobs/src/jobs/`. Each job:
-
 - Uses `createCronJob` with a cron expression
 - Publishes results to Redis channels
 - Widget subscriptions consume those channels via tRPC subscriptions
@@ -161,7 +158,6 @@ Configured via `AUTH_PROVIDERS` env. Supports: `credentials` (local), `ldap`, `o
 ## Environment Variables
 
 Key env vars (from `.env.example`):
-
 - `DB_DRIVER`: `better-sqlite3` | `mysql2` | `node-postgres`
 - `DB_URL`: Database connection string
 - `AUTH_SECRET`: NextAuth secret
@@ -193,3 +189,16 @@ Key env vars (from `.env.example`):
 - Drag-and-drop via `@dnd-kit/*`
 - `typescript.ignoreBuildErrors: true` in next.config (types checked separately via `typecheck`)
 - `serverExternalPackages`: `dockerode`, `isomorphic-dompurify`, `jsdom`
+
+## Documentation (`apps/docs`)
+
+Docusaurus 3 site at `apps/docs/`, package name `@homarr/docs`.
+
+- Run with `pnpm dev:docs` from root
+- Build with `pnpm turbo build --filter=@homarr/docs`
+- Uses Tailwind CSS 3 for custom pages (not Mantine)
+- Imports `@homarr/definitions` for type-safe integration/widget metadata
+- When adding or modifying widgets, integrations, cron jobs, API routes, env vars, or user-facing features, you MUST also update corresponding docs in `apps/docs/docs/`
+- Integration docs: `apps/docs/docs/integrations/<slug>/index.mdx` + `index.ts`
+- Widget docs: `apps/docs/docs/widgets/<slug>/index.mdx` + `index.ts`
+- Strict link checking: broken links/anchors cause build failure

.cursor/rules/documentation-sync.mdc

@@ -0,0 +1,50 @@
+---
+description: Keep documentation in sync with code changes
+globs:
+  - packages/definitions/src/**
+  - packages/widgets/src/**
+  - packages/integrations/src/**
+  - packages/api/src/**
+  - apps/nextjs/src/**
+  - apps/docs/**
+---
+
+# Documentation Sync Rule
+
+When modifying code that affects user-facing behavior, you MUST also update the documentation in `apps/docs/`.
+
+## What triggers a doc update
+
+| Code change | Doc location |
+|---|---|
+| New integration | `apps/docs/docs/integrations/<slug>/index.mdx` + `index.ts` |
+| New widget | `apps/docs/docs/widgets/<slug>/index.mdx` + `index.ts` |
+| Changed API surface | `apps/docs/docs/management/api.mdx` |
+| New/changed env vars | `apps/docs/docs/advanced/` |
+| New CLI commands | `apps/docs/docs/advanced/command-line/` |
+| Changed auth providers | `apps/docs/docs/advanced/` SSO pages |
+| UI/UX changes | Relevant getting-started or management pages |
+| New cron job | `apps/docs/docs/management/tasks.mdx` |
+| Changed permissions | `apps/docs/docs/management/users.mdx` |
+
+## Integration doc pattern
+
+Each integration has a folder under `apps/docs/docs/integrations/<slug>/`:
+
+- `index.ts` — exports a typed `IntegrationDefinition` with name, description, iconUrl, path
+- `index.mdx` — uses shared components: `IntegrationHeader`, `IntegrationCapabilites`, `IntegrationSecrets`
+- Import metadata from `@homarr/definitions` where possible
+
+## Widget doc pattern
+
+Each widget has a folder under `apps/docs/docs/widgets/<slug>/`:
+
+- `index.ts` — exports a typed `WidgetDefinition` with icon, name, description, path, configuration
+- `index.mdx` — uses shared components: `WidgetHeader`, `WidgetConfig`, `WidgetAdding`
+
+## Development
+
+- Run docs locally: `pnpm dev:docs` from root
+- Build docs: `pnpm turbo build --filter=@homarr/docs`
+- The docs app can import from `@homarr/definitions` for type-safe integration/widget metadata
+- Docusaurus strict mode throws on broken links — fix any broken references before committing

.cursor/rules/mantine-datatable-migration.mdc

@@ -1,8 +1,3 @@
----
-name: datatable-migration
-description: Playbook for migrating tables from mantine-react-table (MRT) to mantine-datatable. Use when converting any table component from mantine-react-table to mantine-datatable, working on DataTable column/sort/expansion/context-menu code, or implementing responsive column visibility, column persistence, or transparent tables in widgets.
----
-
 # Migrating Tables from mantine-react-table to mantine-datatable
 
 This document captures every pattern, fix, and decision from the downloads widget rework (PR #6430). Use it as a playbook when porting other tables.
@@ -12,12 +7,10 @@ This document captures every pattern, fix, and decision from the downloads widge
 Current `mantine-react-table` consumers that could be migrated:
 
 **Widgets (in `packages/widgets/`):**
-
 - `docker/component.tsx` — Docker container table
 - `media-server/component.tsx` — Media server sessions
 
 **Admin pages (in `apps/nextjs/src/app/[locale]/manage/`):**
-
 - `tools/docker/docker-table.tsx`
 - `tools/tasks/_components/tasks-table.tsx`
 - `tools/api/components/api-keys.tsx`
@@ -26,13 +19,13 @@ Current `mantine-react-table` consumers that could be migrated:
 - `tools/kubernetes/` — 8 Kubernetes resource tables
 
 **Modals:**
-
 - `packages/modals-collection/src/search-engines/request-media-modal.tsx`
 
 **Shared hook to remove once all migrated:**
-
 - `packages/ui/src/hooks/use-translated-mantine-react-table.ts`
 
+---
+
 ## 1. Core Migration: mantine-react-table → mantine-datatable
 
 ### Import changes
@@ -74,7 +67,6 @@ const columns: DataTableColumn<MyRow>[] = [
 ```
 
 Key differences:
-
 - `accessorKey` → `accessor`
 - `header` → `title`
 - `size` → `width`
@@ -126,6 +118,8 @@ const sortedData = useMemo(() => {
 <DataTable records={sortedData} sortStatus={sortStatus} onSortStatusChange={setSortStatus} />
 ```
 
+---
+
 ## 2. Making Tables Transparent (Widget Context)
 
 Widgets sit inside board cards that have user-controlled opacity. The table must be fully transparent so the card background shows through. mantine-datatable defaults to `var(--mantine-color-body)` which is opaque.
@@ -150,21 +144,13 @@ Create a CSS file alongside the component:
 
 /* Hover: translucent instead of opaque */
 .my-table .mantine-datatable-table tbody tr:hover {
-  background-color: color-mix(
-    in srgb,
-    var(--mantine-color-default-hover) 40%,
-    transparent
-  ) !important;
+  background-color: color-mix(in srgb, var(--mantine-color-default-hover) 40%, transparent) !important;
 }
 
 /* Headers: frosted glass effect */
 .my-table th {
   white-space: nowrap;
-  background-color: color-mix(
-    in srgb,
-    var(--mantine-color-body) 60%,
-    transparent
-  ) !important;
+  background-color: color-mix(in srgb, var(--mantine-color-body) 60%, transparent) !important;
   backdrop-filter: blur(8px);
 }
 
@@ -186,16 +172,14 @@ Create a CSS file alongside the component:
 
 /* Row expansion area */
 .my-table .mantine-datatable-row-expansion-cell {
-  background-color: color-mix(
-    in srgb,
-    var(--mantine-color-body) 40%,
-    transparent
-  ) !important;
+  background-color: color-mix(in srgb, var(--mantine-color-body) 40%, transparent) !important;
 }
 ```
 
 Import it: `import "./styles.css";` and apply via `className="my-table"`.
 
+---
+
 ## 3. Responsive Column Visibility
 
 Use a lookup table of width breakpoints instead of media queries. The widget receives `width` as a prop.
@@ -211,38 +195,11 @@ interface SizeConfig {
 }
 
 const SIZE_BREAKPOINTS: { maxWidth: number; config: SizeConfig }[] = [
-  {
-    maxWidth: 300,
-    config: {
-      fontSize: "xs",
-      iconSize: 12,
-      cellPadding: 2,
-      showSpeedColumns: false,
-      showTimeColumn: false,
-      showStateColumn: false,
-    },
-  },
-  {
-    maxWidth: 500,
-    config: {
-      fontSize: "xs",
-      iconSize: 14,
-      cellPadding: 4,
-      showSpeedColumns: false,
-      showTimeColumn: true,
-      showStateColumn: false,
-    },
-  },
+  { maxWidth: 300, config: { fontSize: "xs", iconSize: 12, cellPadding: 2, showSpeedColumns: false, showTimeColumn: false, showStateColumn: false } },
+  { maxWidth: 500, config: { fontSize: "xs", iconSize: 14, cellPadding: 4, showSpeedColumns: false, showTimeColumn: true, showStateColumn: false } },
 ];
 
-const DEFAULT_SIZE_CONFIG: SizeConfig = {
-  fontSize: "sm",
-  iconSize: 14,
-  cellPadding: 4,
-  showSpeedColumns: true,
-  showTimeColumn: true,
-  showStateColumn: true,
-};
+const DEFAULT_SIZE_CONFIG: SizeConfig = { fontSize: "sm", iconSize: 14, cellPadding: 4, showSpeedColumns: true, showTimeColumn: true, showStateColumn: true };
 
 function getSizeConfig(width: number): SizeConfig {
   for (const { maxWidth, config } of SIZE_BREAKPOINTS) {
@@ -258,9 +215,7 @@ const size = useMemo(() => getSizeConfig(width), [width]);
 Then use a visibility check lookup table for columns:
 
 ```typescript
-const columnVisibilityChecks: Partial<
-  Record<string, (ctx: ColumnContext) => boolean>
-> = {
+const columnVisibilityChecks: Partial<Record<string, (ctx: ColumnContext) => boolean>> = {
   upSpeed: (ctx) => ctx.hasTorrents && ctx.size.showSpeedColumns,
   downSpeed: (ctx) => ctx.size.showSpeedColumns,
   time: (ctx) => ctx.size.showTimeColumn,
@@ -275,6 +230,8 @@ function shouldIncludeColumn(accessor: string, ctx: ColumnContext): boolean {
 }
 ```
 
+---
+
 ## 4. Column Persistence (Drag/Resize → Server)
 
 `useDataTableColumns` stores column order and widths in localStorage by default. For widgets, this must persist server-side so it works across devices.
@@ -319,13 +276,8 @@ const storeKey = `mytable-${itemId ?? "preview"}-${[...options.columns].toSorted
 On mount, seed `useDataTableColumns` with server-persisted values. Use a `hydrated` ref to prevent the persist effect from immediately writing defaults back:
 
 ```typescript
-const {
-  effectiveColumns,
-  columnsOrder,
-  columnsWidth,
-  setColumnsOrder,
-  setMultipleColumnWidths,
-} = useDataTableColumns<MyRow>({ key: storeKey, columns });
+const { effectiveColumns, columnsOrder, columnsWidth, setColumnsOrder, setMultipleColumnWidths } =
+  useDataTableColumns<MyRow>({ key: storeKey, columns });
 
 const lastStoreKey = useRef(storeKey);
 const hydrated = useRef(false);
@@ -339,22 +291,11 @@ useEffect(() => {
   if (savedOrder.length > 0) setColumnsOrder(savedOrder);
   if (Object.keys(savedWidths).length > 0) {
     setMultipleColumnWidths(
-      Object.entries(savedWidths).map(([accessor, w]) => ({
-        accessor,
-        width: w,
-      })),
+      Object.entries(savedWidths).map(([accessor, w]) => ({ accessor, width: w })),
     );
   }
-  requestAnimationFrame(() => {
-    hydrated.current = true;
-  });
-}, [
-  storeKey,
-  savedOrder,
-  savedWidths,
-  setColumnsOrder,
-  setMultipleColumnWidths,
-]);
+  requestAnimationFrame(() => { hydrated.current = true; });
+}, [storeKey, savedOrder, savedWidths, setColumnsOrder, setMultipleColumnWidths]);
 ```
 
 ### Persist localStorage → server
@@ -367,26 +308,22 @@ const prevWidths = useRef(columnsWidth);
 
 useEffect(() => {
   if (!hydrated.current) return;
-  const orderChanged =
-    JSON.stringify(columnsOrder) !== JSON.stringify(prevOrder.current);
-  const widthsChanged =
-    JSON.stringify(columnsWidth) !== JSON.stringify(prevWidths.current);
+  const orderChanged = JSON.stringify(columnsOrder) !== JSON.stringify(prevOrder.current);
+  const widthsChanged = JSON.stringify(columnsWidth) !== JSON.stringify(prevWidths.current);
   prevOrder.current = columnsOrder;
   prevWidths.current = columnsWidth;
 
   if (!orderChanged && !widthsChanged) return;
 
-  if (orderChanged)
-    persistOption({ columnOrder: JSON.stringify(columnsOrder) });
+  if (orderChanged) persistOption({ columnOrder: JSON.stringify(columnsOrder) });
   if (widthsChanged) {
     const widthMap: Record<string, number> = {};
     for (const entry of columnsWidth) {
       const key = Object.keys(entry)[0];
       if (!key) continue;
-      const v = entry[key as keyof typeof entry];
-      if (typeof v === "number") widthMap[key] = v;
-      else if (typeof v === "string" && v.endsWith("px"))
-        widthMap[key] = parseInt(v, 10);
+      const w = entry[key as keyof typeof entry];
+      if (typeof w === "number") widthMap[key] = w;
+      else if (typeof w === "string" && w.endsWith("px")) widthMap[key] = parseInt(w, 10);
     }
     persistOption({ columnWidths: JSON.stringify(widthMap) });
   }
@@ -395,6 +332,8 @@ useEffect(() => {
 
 The `persistOption` helper calls both `setOptions` (local state) and `saveItemOptions` (server mutation).
 
+---
+
 ## 5. Context Menu (Right-Click)
 
 Do NOT install `mantine-contextmenu`. Use Mantine's `Menu` + `Portal` directly:
@@ -426,41 +365,15 @@ const handleContextMenu = useCallback(
 The menu component uses `Portal` for correct z-index:
 
 ```tsx
-function RowContextMenu({
-  state,
-  onClose,
-}: {
-  state: ContextMenuState;
-  onClose: () => void;
-}) {
+function RowContextMenu({ state, onClose }: { state: ContextMenuState; onClose: () => void }) {
   return (
     <Portal>
-      <Menu
-        opened
-        onClose={onClose}
-        closeOnItemClick={false}
-        position="right-start"
-        offset={0}
-      >
+      <Menu opened onClose={onClose} closeOnItemClick={false} position="right-start" offset={0}>
         <Menu.Target>
-          <Box
-            style={{
-              position: "fixed",
-              left: state.x,
-              top: state.y,
-              width: 0,
-              height: 0,
-            }}
-          />
+          <Box style={{ position: "fixed", left: state.x, top: state.y, width: 0, height: 0 }} />
         </Menu.Target>
         <Menu.Dropdown>
-          <Menu.Item
-            onClick={() => {
-              /* action */ onClose();
-            }}
-          >
-            Action
-          </Menu.Item>
+          <Menu.Item onClick={() => { /* action */ onClose(); }}>Action</Menu.Item>
         </Menu.Dropdown>
       </Menu>
     </Portal>
@@ -470,6 +383,8 @@ function RowContextMenu({
 
 **Key fix:** Use `closeOnItemClick={false}` if any menu item needs a two-step confirmation (like delete → confirm). Close the menu on scroll: `onScroll={() => { if (contextMenu) closeContextMenu(); }}`.
 
+---
+
 ## 6. Row Expansion
 
 ```typescript
@@ -489,6 +404,8 @@ function RowContextMenu({
 
 **Critical:** Do NOT set `onRowClick` when using `rowExpansion` with `trigger: "click"`. They conflict and the expansion won't work.
 
+---
+
 ## 7. Common Pitfalls & Fixes
 
 ### Status indicator dots
@@ -549,11 +466,8 @@ Always wrap in try/catch:
 ```typescript
 function parseJsonOption<T>(value: string | undefined, fallback: T): T {
   if (!value) return fallback;
-  try {
-    return JSON.parse(value) as T;
-  } catch {
-    return fallback;
-  }
+  try { return JSON.parse(value) as T; }
+  catch { return fallback; }
 }
 ```
 
@@ -571,19 +485,20 @@ If the widget has configurable default sort, sync it:
 
 ```typescript
 useEffect(() => {
-  setSortStatus({
-    columnAccessor: options.defaultSort,
-    direction: defaultSortDirection,
-  });
+  setSortStatus({ columnAccessor: options.defaultSort, direction: defaultSortDirection });
 }, [options.defaultSort, defaultSortDirection]);
 ```
 
+---
+
 ## 8. Accessibility
 
 - All `ActionIcon` components need `aria-label`
 - Filter toggles (client badges, status badges) need `aria-pressed={isActive}`
 - `textSelectionDisabled` on DataTable prevents accidental text selection during drag/resize
 
+---
+
 ## 9. Error Handling
 
 - Every mutation needs an `onError` callback with `showErrorNotification`
@@ -594,14 +509,12 @@ useEffect(() => {
 ```typescript
 const mutationOptions = {
   onSettled: () => void utils.myQuery.invalidate(),
-  onError: () =>
-    showErrorNotification({
-      title: t("errors.actionFailed"),
-      message: t("errors.actionFailedMessage"),
-    }),
+  onError: () => showErrorNotification({ title: t("errors.actionFailed"), message: t("errors.actionFailedMessage") }),
 };
 ```
 
+---
+
 ## 10. i18n
 
 - No hardcoded strings. Every user-visible string goes through `useScopedI18n`
@@ -612,6 +525,8 @@ const mutationOptions = {
 - Errors: `t("errors.{errorKey}")`
 - Hidden options still need `.label` translation keys
 
+---
+
 ## 11. Edit Mode
 
 Disable pointer events on the table during edit mode to prevent conflicts with the board's drag-and-drop:
@@ -626,6 +541,8 @@ if (isEditMode) rowContextMenuHandler = undefined;
 <DataTable style={{ pointerEvents: tablePointerEvents }} />
 ```
 
+---
+
 ## 12. DataTable Props Reference (Commonly Used)
 
 ```typescript
@@ -664,6 +581,8 @@ if (isEditMode) rowContextMenuHandler = undefined;
 />
 ```
 
+---
+
 ## 13. Layout Stability
 
 - Don't use `table-layout: fixed` — it fights mantine-datatable's resize logic
@@ -672,6 +591,8 @@ if (isEditMode) rowContextMenuHandler = undefined;
 - Names should truncate at the cell boundary, not a character count, so the layout is stable regardless of content length
 - `flexShrink: 0` on badges/icons prevents them from being squeezed by long names
 
+---
+
 ## 14. Checklist for Each Migration
 
 1. Replace imports (`mantine-react-table` → `mantine-datatable`)

.cursor/rules/mcp-integration.mdc

@@ -1,14 +1,13 @@
 ---
-name: mcp-integration
-description: Expose tRPC procedures as MCP tools for AI clients. Use when modifying procedures in packages/api/src/router, adding a new tRPC procedure or router, or deciding what to expose via Homarr's MCP interface. Covers .meta({ mcp }), router registration in packages/api/src/mcp.ts, input schema rules, and what to expose vs skip.
+description: How to expose tRPC procedures as MCP tools for AI clients
+globs: packages/api/src/router/**/*.ts
+alwaysApply: false
 ---
 
-# MCP Integration
+# MCP Integration Guide
 
 Every new tRPC procedure that provides useful functionality should be exposed as an MCP tool so AI assistants (Claude, Cursor, etc.) can use it. This is a first-class feature of Homarr.
 
-Exposing a procedure makes it callable by any AI client with an API key. Before adding `.meta({ mcp })`, review what the tool exposes: authorization requirements, sensitive data, tenant isolation, auditability, and whether the action is destructive. Prefer exposing read-only queries over mutations unless the mutation is safe and permission-scoped. When in doubt, ask for a security review before shipping a new MCP tool.
-
 ## Adding MCP to a procedure
 
 Add `.meta({ mcp: { enabled: true, description: "..." } })` to the procedure chain:
@@ -17,7 +16,7 @@ Add `.meta({ mcp: { enabled: true, description: "..." } })` to the procedure cha
 // Read-only tool (query)
 myProcedure: protectedProcedure
   .meta({ mcp: { enabled: true, description: "Get all items with their status and metadata" } })
-  .input(z.object({ limit: z.number().default(10) }))
+  .input(z.object({ limit: z.number().default(50) }))
   .query(async ({ ctx, input }) => { ... })
 
 // Write tool (mutation)
@@ -39,27 +38,23 @@ The `.meta()` call must come **before** `.input()` and `.query()`/`.mutation()`
 The description is the **only thing** an AI sees to decide when and how to use the tool. Write it like you're explaining to a colleague who has never used Homarr.
 
 **Must include:**
-
 - What the tool returns or does
 - Which integrations/services it works with (if applicable)
 - How to get required IDs (e.g., "Use integration_all to get the integrationId")
 - Permission requirements (if non-obvious)
 
 **Good:**
-
-```text
+```
 "Get calendar events for upcoming and recent media releases. Fetches from all connected Sonarr (TV), Radarr (movies), Lidarr (music), and Readarr (books) integrations. Requires integrationIds from integration_all"
 ```
 
 **Bad:**
-
-```text
+```
 "Get calendar events"
 ```
 
 **For tools that return permission fields**, explain what they mean:
-
-```text
+```
 "List all integrations. Returns permissions.hasUseAccess (read) and permissions.hasInteractAccess (actions) — false means the API key lacks that permission, not an error"
 ```
 
@@ -82,13 +77,11 @@ export const mcpRouter = createTRPCRouter({
 ## What to expose vs. what to skip
 
 **Expose:**
-
 - Data queries (list, search, get by ID)
 - Actions users would ask an AI to do (toggle, create, delete, approve)
 - Status checks (health, stats, summaries)
 
 **Skip:**
-
 - Subscriptions (WebSocket-only, not supported by MCP)
 - Internal procedures (session management, onboarding steps)
 - File upload/download procedures

.env.example

@@ -61,9 +61,30 @@ TURBO_TELEMETRY_DISABLED=1
 # Enable mock integration
 UNSAFE_ENABLE_MOCK_INTEGRATION=true
 
+# Public URL contract. Values must be absolute HTTP(S) URLs without credentials,
+# query strings, or fragments. Trailing slashes are normalized at startup.
+HOMARR_WEBSITE_URL=https://homarr.dev
+# PocketBase API used by Homarr and by the standalone documentation site.
+# Defaults to HOMARR_WEBSITE_URL.
+# WORKSHOP_API_URL=https://homarr.dev
+# Public Workshop page opened from Homarr. Defaults to HOMARR_WEBSITE_URL/workshop.
+# WORKSHOP_WEB_URL=https://homarr.dev/workshop
+
+# Documentation and PocketBase deployment settings.
+# WORKSHOP_PUBLIC_ORIGIN=https://homarr.dev
+# PB_ALLOWED_ORIGINS=*
+
+# Local Workshop stack:
+# HOMARR_WEBSITE_URL=http://127.0.0.1:3003
+# WORKSHOP_API_URL=http://127.0.0.1:8090
+# WORKSHOP_WEB_URL=http://127.0.0.1:3003/workshop
+# WORKSHOP_PUBLIC_ORIGIN=http://127.0.0.1:3003
+# Optional: GITHUB_CLIENT_ID=
+# Optional: GITHUB_CLIENT_SECRET=
+
 # Enable demo mode (seeds a demo user "demo"/"demo", a sample board and a mock integration)
 # DEMO_MODE=true
 
 # Whether demo mode is read-only. Defaults to true (the public demo blocks all mutations).
 # Set to false for writable preview deployments so the demo user can modify the dashboard.
-# DEMO_READ_ONLY=false
+# DEMO_READ_ONLY=false

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -33,7 +33,6 @@ body:
       options:
         # The below comment is used to insert a new version with on-release.yml
         #NEXT_VERSION#
-        - 1.75.0
         - 1.74.0
         - 1.73.0
         - 1.72.0

.github/pull_request_template.md

@@ -16,6 +16,6 @@
 **When contributing a new integration or widget:**
 
 - [ ] I confirmed manually that the integration or widget is working with a real system and performed basic smoke
-  tests (e.g. what happens if it is offline)
+      tests (e.g. what happens if it is offline)
 - [ ] Optional but recommended: I confirm that I am willing to be added to the `CODEOWNERS` of this feature and will
-  provide support and maintain the integration (e.g. in case of breaking or failure)
+      provide support and maintain the integration (e.g. in case of breaking or failure)

.github/workflows/autofix.yml

@@ -1,4 +1,4 @@
-name: Auto-fix lint and format
+name: Formatting
 
 on:
   pull_request:
@@ -6,42 +6,30 @@ on:
     branches: ["*"]
 
 permissions:
-  contents: write
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 jobs:
-  autofix:
-    name: Auto-fix
-    if: github.event.pull_request.head.repo.id == github.repository_id
+  format:
+    name: Check formatting
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-          ref: ${{ github.head_ref }}
+          persist-credentials: false
 
       - name: Setup
         uses: ./tooling/github/setup
 
-      - name: Get changed files
-        id: changed
+      - name: Check changed files
         env:
           BASE_REF: ${{ github.base_ref }}
         run: |
-          git diff --name-only --diff-filter=ACMR "origin/${BASE_REF}...HEAD" -- '*.ts' '*.tsx' '*.js' '*.jsx' > /tmp/changed-files
-          echo "count=$(wc -l < /tmp/changed-files | tr -d '[:space:]')" >> $GITHUB_OUTPUT
-
-      - name: Auto-fix lint + format
-        if: steps.changed.outputs.count != '0'
-        run: |
-          xargs -r -a /tmp/changed-files pnpm exec oxlint --fix || true
-          xargs -r -a /tmp/changed-files pnpm exec oxfmt --write
-
-      - name: Commit fixes
-        uses: stefanzweifel/git-auto-commit-action@v7
-        with:
-          commit_message: "style: auto-fix lint and format"
+          git diff --name-only --diff-filter=ACMR -z "origin/${BASE_REF}...HEAD" -- \
+            '*.css' '*.js' '*.json' '*.jsonc' '*.jsx' '*.md' '*.mdx' '*.scss' '*.ts' '*.tsx' '*.yaml' '*.yml' \
+            | xargs -0 -r pnpm exec oxfmt --check --

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ on:
     types: [closed]
     branches: ["*"]
   push:
-    branches: [main, dev, beta, next]
+    branches: [main, dev, beta, next, v2]
   merge_group:
   workflow_dispatch:
     inputs:
@@ -34,8 +34,10 @@ permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || inputs.pr_number || github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  # Every event for a PR shares one group so a close event cancels stale image
+  # publication and a newer synchronize run cannot be overwritten by an older run.
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || inputs.pr_number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' || github.event_name == 'workflow_dispatch' || github.ref != 'refs/heads/main' }}
 
 env:
   FORCE_COLOR: 3
@@ -87,6 +89,23 @@ jobs:
       - name: Validate workspace configuration
         run: pnpm lint:ws
 
+      - name: Validate Custom Widget architecture
+        run: pnpm check:custom-widgets
+
+      - name: Validate checked-in OpenAPI schema
+        run: pnpm check:openapi
+
+      - name: Validate feature contracts
+        run: pnpm check:feature-contracts
+
+      - name: Test feature platform
+        run: pnpm test:feature-platform
+
+      - name: Validate Custom Widget bundle budget
+        run: |
+          pnpm --filter nextjs build
+          pnpm check:custom-widget-bundle
+
       - name: Run unit tests
         run: pnpm test
 
@@ -102,6 +121,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+    outputs:
+      digest: ${{ steps.preview-build.outputs.digest }}
     steps:
       - uses: actions/checkout@v7
         if: "!env.ACT"
@@ -184,38 +205,166 @@ jobs:
           path: e2e/test-results/
           retention-days: 7
 
-      - name: Determine preview tag
-        id: preview
+      - name: Log in to GHCR for preview publication
         if: |
           !env.ACT &&
           (
             (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
             (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
           )
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
-        run: echo "tag=pr-${PR_NUMBER}" >> "$GITHUB_OUTPUT"
-
-      - name: Log in to GHCR
-        if: steps.preview.outputs.tag != ''
         uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Push preview image
-        if: steps.preview.outputs.tag != ''
-        env:
-          PREVIEW_TAG: ${{ steps.preview.outputs.tag }}
-        run: |
-          docker tag homarr-ci "${PREVIEW_IMAGE}:${PREVIEW_TAG}"
-          docker push "${PREVIEW_IMAGE}:${PREVIEW_TAG}"
+      - name: Push amd64 preview image by digest
+        id: preview-build
+        if: |
+          !env.ACT &&
+          (
+            (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
+            (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
+          )
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          network: host
+          platforms: linux/amd64
+          outputs: type=image,"name=${{ env.PREVIEW_IMAGE }}",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=homarr-linux-amd64
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
 
       - name: Show Act publication result
         if: env.ACT
         run: echo "Act validated the publication path; external GHCR writes are disabled locally."
 
+  preview-arm64:
+    name: Build arm64 preview image
+    needs: fast-gate
+    if: |
+      (
+        (github.event_name == 'pull_request' && github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository) ||
+        (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
+      )
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      digest: ${{ steps.preview-build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@v7
+        if: "!env.ACT"
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Log in to GHCR
+        if: "!env.ACT"
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        if: "!env.ACT"
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push arm64 preview image by digest
+        id: preview-build
+        if: "!env.ACT"
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          network: host
+          platforms: linux/arm64
+          outputs: type=image,"name=${{ env.PREVIEW_IMAGE }}",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=homarr-linux-arm64
+          cache-to: type=gha,scope=homarr-linux-arm64,mode=max
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+  publish-preview:
+    name: Publish multi-platform preview image
+    needs: [container, preview-arm64]
+    if: |
+      (
+        (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
+        (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      packages: write
+      pull-requests: read
+    env:
+      PREVIEW_TAG: pr-${{ github.event.pull_request.number || inputs.pr_number }}
+    steps:
+      - name: Log in to GHCR
+        if: "!env.ACT"
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        if: "!env.ACT"
+        uses: docker/setup-buildx-action@v4
+
+      - name: Verify PR head before publication
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v8
+        env:
+          EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        with:
+          script: |
+            const { data: pull } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+            if (pull.state !== "open") {
+              core.setFailed(`PR #${pull.number} is ${pull.state}; refusing to publish its preview.`);
+              return;
+            }
+            if (pull.head.sha !== process.env.EXPECTED_HEAD_SHA) {
+              core.setFailed(`PR #${pull.number} moved from ${process.env.EXPECTED_HEAD_SHA} to ${pull.head.sha}.`);
+            }
+
+      - name: Publish preview manifest
+        if: "!env.ACT"
+        env:
+          AMD64_DIGEST: ${{ needs.container.outputs.digest }}
+          ARM64_DIGEST: ${{ needs.preview-arm64.outputs.digest }}
+        run: |
+          docker buildx imagetools create -t "${PREVIEW_IMAGE}:${PREVIEW_TAG}" \
+            "${PREVIEW_IMAGE}@${AMD64_DIGEST}" \
+            "${PREVIEW_IMAGE}@${ARM64_DIGEST}"
+
+      - name: Verify preview manifest platforms
+        if: "!env.ACT"
+        run: |
+          image="${PREVIEW_IMAGE}:${PREVIEW_TAG}"
+          manifest="$(docker buildx imagetools inspect "$image" --raw)"
+          for architecture in amd64 arm64; do
+            jq --exit-status --arg architecture "$architecture" \
+              'any(.manifests[]; .platform.os == "linux" and .platform.architecture == $architecture)' \
+              <<<"$manifest" >/dev/null
+          done
+          docker buildx imagetools inspect "$image"
+
   cleanup:
     name: Clean up preview image
     if: github.event_name == 'pull_request_target' || (github.event_name == 'workflow_dispatch' && inputs.operation == 'cleanup')

.github/workflows/workshop.yml

@@ -0,0 +1,63 @@
+name: Workshop
+
+on:
+  pull_request:
+  push:
+    branches: [dev, v2, main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24.18.0
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: false
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter @homarr/workshop typecheck
+      - run: pnpm --filter @homarr/docs typecheck
+      - run: docker compose --env-file apps/workshop/.env.staging.example -f apps/workshop/docker-compose.staging.yml config --quiet
+      - run: pnpm test:workshop
+      - run: pnpm test:workshop-image
+
+  publish:
+    if: github.event_name == 'push' && (github.ref_name == 'v2' || github.ref_name == 'main')
+    needs: validate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/metadata-action@v6
+        id: metadata
+        with:
+          images: ghcr.io/homarr-labs/workshop
+          tags: |
+            type=sha,prefix=sha-,format=long
+            type=raw,value=v2,enable=${{ github.ref_name == 'v2' }}
+            type=raw,value=latest,enable=${{ github.ref_name == 'main' }}
+      - uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: apps/workshop/Dockerfile
+          target: production
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}

.gitignore

@@ -16,6 +16,7 @@ out/
 next-env.d.ts
 
 # artifacts
+.ai-evaluations/
 packages/db/migrations/*/migrate.cjs
 
 # nitro
@@ -73,6 +74,9 @@ apps/nextjs/public/images/background.png
 .opencode
 .agents/*
 !.agents/skills/
+.agents/skills/*
+!.agents/skills/homarr-custom-widget/
+!.agents/skills/homarr-custom-widget/**
 skills-lock.json
 
 # docusaurus
@@ -80,3 +84,11 @@ apps/docs/.docusaurus
 apps/docs/build
 .pnpm-store
 benchmark-results
+
+# local performance investigation (never ship benchmark data or restored backups)
+.widget-performance/
+.bench/
+homarr-backup*.zip
+*.sqlite-wal
+*.sqlite-shm
+/scripts/benchmarks/

.impeccable/critique/2026-07-21T11-32-50Z__apps-docs-src-components-workshop.md

@@ -0,0 +1,116 @@
+---
+target: Workshop store in the docs
+total_score: 20
+p0_count: 1
+p1_count: 3
+timestamp: 2026-07-21T11-32-50Z
+slug: apps-docs-src-components-workshop
+---
+
+# Workshop Store Critique
+
+## Design Health Score
+
+| #         | Heuristic                           |     Score | Key issue                                                                                                                                                        |
+| --------- | ----------------------------------- | --------: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1         | Visibility of system status         |       1/4 | Fetch failure can show beside an empty-store message, so the system communicates two incompatible states.                                                        |
+| 2         | Match between system and real world |       3/4 | Widget, CSS, voting, revisions, and comments use familiar language.                                                                                              |
+| 3         | User control and freedom            |       2/4 | Filters are reversible, but the crashed route and failed fetch state offer no useful recovery.                                                                   |
+| 4         | Consistency and standards           |       2/4 | The submission editor uses CodeMirror, while revision editing falls back to a textarea; several tiny custom controls do not follow the shared button vocabulary. |
+| 5         | Error prevention                    |       2/4 | Submission validation exists, but disabled progression does not explain what is missing and destructive actions use a brief inline confirmation.                 |
+| 6         | Recognition rather than recall      |       3/4 | Labels, type choices, and the submission stepper are understandable without documentation.                                                                       |
+| 7         | Flexibility and efficiency          |       2/4 | Search covers titles only, signed-out users can select Yours, and installation is reduced to ambiguous Copy and Download actions.                                |
+| 8         | Aesthetic and minimalist design     |       3/4 | The restrained visual system is clean, but the browse toolbar and card action rows become dense.                                                                 |
+| 9         | Help users recover from errors      |       0/4 | The production route crashes with React error 130; the fetch error has no retry action or useful context.                                                        |
+| 10        | Help and documentation              |       2/4 | The editor explains its fields, but the store does not teach the full inspect, trust, download, and install journey.                                             |
+| **Total** |                                     | **20/40** | **Needs work before release**                                                                                                                                    |
+
+## Anti-Patterns Verdict
+
+The surface does not look like obvious AI-generated decoration. Its visual restraint, familiar controls, and practical editor are credible product UI. The weakness is product behavior rather than styling: contradictory states, tiny action controls, an overloaded responsive toolbar, and a primary installation journey that is not explicit.
+
+The deterministic Impeccable scan returned zero findings for `apps/docs/src/components/workshop`. This is useful but incomplete. The detector did not catch runtime failures, semantic state conflicts, touch-target sizing, or responsive grouping. Browser evidence found a full route crash, React error 130, and an earlier state that rendered both `Something went wrong.` and `No submissions yet`.
+
+No visual overlay was injected because the available browser evaluation surface is read-only. Screenshots, DOM snapshots, console logs, and source inspection were used instead.
+
+## Overall Impression
+
+The submission modal is now one of the stronger parts of the Workshop. The store around it is not release-ready. The single biggest opportunity is to make discovery and installation a dependable, explicit path: load reliably, show one truthful state, help users evaluate a submission, and give them one obvious next action.
+
+## What Is Working
+
+1. The visual system is restrained and consistent with the Homarr documentation. Typography, color, radii, and spacing do not compete with the content.
+2. The submission flow chunks a complex task into Type, Details, and Media. The shared JSON/CSS editor, drag-and-drop import, metadata autofill, and capped media previews reduce creator effort.
+3. The detail design exposes revision, author, reports, changelog, source content, and comments. This supports inspection rather than treating community code as a blind install.
+
+## Priority Issues
+
+### P0: The Workshop route crashes in the production docs build
+
+**Why it matters:** No visual polish matters if the store becomes a Docusaurus error page. A fresh independent tab consistently reached `This page crashed` with React error 130. The console attributed the thrown error to the Kapa widget bundle.
+
+**Fix:** Isolate or disable the Kapa script on Workshop routes, prevent third-party widget failures from reaching the Docusaurus route boundary, and add a route-level Workshop boundary that preserves navigation and retry. Reproduce against the built Docker docs image, not only the development server.
+
+**Suggested command:** `$impeccable harden`
+
+### P1: Failure and empty states contradict each other
+
+**Why it matters:** Showing `Something went wrong.` followed by `No submissions yet` makes users believe the store is both broken and empty. The generic message gives no cause and no recovery.
+
+**Fix:** Make loading, failure, empty, and results mutually exclusive. The failure state should say that listings could not be loaded, preserve the current filters, and provide `Try loading again`. Do not render filters or an empty store as authoritative data after the initial request fails.
+
+**Suggested command:** `$impeccable harden`
+
+### P1: Mobile discovery controls are too dense and do not form a responsive hierarchy
+
+**Why it matters:** The toolbar's inner row contains four type choices, sorting, and outdated visibility without wrapping. Most controls are 24 to 28 pixels tall. At narrow widths this is difficult to scan, easy to clip, and below a comfortable touch target.
+
+**Fix:** Put a full-width search first on mobile, keep All, Widgets, and CSS as the primary segmented choice, move sorting and outdated visibility into a compact secondary row or popover, and hide Yours when signed out or make it a sign-in affordance. Use at least 40 to 44 pixel touch targets. Add `aria-pressed` or proper tab semantics to the type filter.
+
+**Suggested command:** `$impeccable adapt`
+
+### P1: The store does not make the install journey obvious
+
+**Why it matters:** A first-time user sees Copy and Download without knowing which is recommended, what will be copied, how to inspect safety, or where the file goes in Homarr. This weakens the store's main purpose.
+
+**Fix:** Make the detail page the decision surface. Use one primary action named for its result, such as `Download widget JSON` or `Copy CSS`, with a short `Install in Homarr` explanation linked to the correct in-app flow. Cards should prioritize title, preview, compatibility, score, and `View details`; secondary utilities should not compete with evaluation.
+
+**Suggested command:** `$impeccable clarify`
+
+### P2: Card and moderation actions are too small and too numerous
+
+**Why it matters:** Vote, copy, download, comment, delete, and report controls compete in a compact footer. Low-contrast icon buttons are hard to discover and hard to use by touch. CSS columns also create a top-to-bottom visual reading order that can differ from the expected row order.
+
+**Fix:** Use a regular responsive grid, remove hover scaling, keep one or two visible card actions, and move owner/moderation actions to a menu. Keep voting visible but increase its target size. Correct the report copy: reports and reporter identities are moderation data, not public social proof.
+
+**Suggested command:** `$impeccable distill`
+
+## Persona Red Flags
+
+### Jordan, first-time self-hoster
+
+Jordan opens Workshop to install a widget. The route can crash before any listing appears. In the partial failure state, Jordan sees both an error and an empty store. If listings load, Copy and Download do not explain the Homarr destination or recommended path. Jordan is likely to leave before installing anything.
+
+### Alex, experienced Homarr administrator
+
+Alex can understand the JSON and appreciates the source viewer, but title-only search and limited filtering make a larger catalog inefficient. Compatibility and required secret information are not prominent at browse time. Tiny moderation and owner controls slow repeated management tasks.
+
+### Morgan, mobile user
+
+Morgan encounters a toolbar with more controls than fit comfortably in one decision group, 24 to 28 pixel targets, and a signed-out Yours filter that leads to an unhelpful no-results state. Submission cards add another dense row of small actions.
+
+## Minor Observations
+
+- Future submission steps are focusable buttons even when clicking them does nothing. Disable them or render non-interactive progress markers.
+- The report textarea relies on placeholder text and needs a persistent accessible label.
+- The revision editor should reuse the same JSON/CSS CodeMirror component as creation.
+- Search should include title, description, and author at minimum.
+- The timed inline `Confirm?` deletion pattern is easy to miss and weak for keyboard and touch users.
+- The detail-page changelog uses an uppercase tracked label, which is unnecessary in this otherwise restrained interface.
+- Loading comments should use the same skeleton vocabulary as listings rather than centered status text.
+
+## Questions to Consider
+
+1. Is Workshop primarily a catalog for discovery, or a technical exchange for copying source? The primary card and detail actions should commit to one answer.
+2. Should users evaluate compatibility and required secrets before opening a listing, or only on the detail page?
+3. Does Workshop need every moderation and ownership action visible inline, or should those actions live behind a menu?

.impeccable/critique/2026-07-21T12-29-41Z__apps-docs-src-components-workshop.md

@@ -0,0 +1,64 @@
+---
+target: Workshop store in the docs
+total_score: 38
+p0_count: 0
+p1_count: 0
+timestamp: 2026-07-21T12-29-41Z
+slug: apps-docs-src-components-workshop
+---
+
+# Workshop Store Critique — Post-Polish
+
+## Design Health Score
+
+| #         | Heuristic                           |     Score | Evidence                                                                                                                                                         |
+| --------- | ----------------------------------- | --------: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1         | Visibility of system status         |       4/4 | Loading, initial failure, stale refresh failure, empty, and results states are mutually exclusive; recovery actions are visible.                                 |
+| 2         | Match between system and real world |       4/4 | Actions describe their result: Download widget JSON, Copy CSS, View details, and Install in Homarr.                                                              |
+| 3         | User control and freedom            |       4/4 | Filters can be cleared, errors retried, dialogs cancelled, and destructive submission deletion requires explicit confirmation.                                   |
+| 4         | Consistency and standards           |       4/4 | Creation and revision editing share CodeMirror, buttons follow the shared system, and cards use a predictable responsive grid.                                   |
+| 5         | Error prevention                    |       3/4 | Validation, disabled progression, pending states, RLS, and confirmations are strong; disabled form progression could explain unmet requirements more explicitly. |
+| 6         | Recognition rather than recall      |       4/4 | Persistent labels, type descriptions, step status, source previews, and installation instructions minimize recall.                                               |
+| 7         | Flexibility and efficiency          |       4/4 | Search spans title, description, and author; signed-in filtering, sorting, responsive controls, and direct detail actions support repeat use.                    |
+| 8         | Aesthetic and minimalist design     |       3/4 | The catalog is restrained and scannable; long source documents and the complete creator form necessarily remain dense on small screens.                          |
+| 9         | Help users recover from errors      |       4/4 | Route, listing, edit, report, copy, OAuth, and detail failures remain local and provide a clear next action.                                                     |
+| 10        | Help and documentation              |       4/4 | The detail page explains the exact Homarr destination and links to updated Workshop documentation.                                                               |
+| **Total** |                                     | **38/40** | **Release-quality; minor polish remains**                                                                                                                        |
+
+## Anti-Patterns Verdict
+
+The surface is product-led rather than decorative. The redesign removes the overloaded card footer, hover scaling, tiny touch controls, public moderation details, contradictory states, and ambiguous install actions. The deterministic Impeccable detector reports zero findings.
+
+## What Improved
+
+1. The production route no longer collapses into the Docusaurus crash screen without recovery. A route-local boundary protects navigation, and the fresh-volume production path renders without console errors.
+2. Loading, failure, empty, stale-results, and populated states are truthful and mutually exclusive.
+3. Search and filters form a clear responsive hierarchy. Mobile targets are 40–44 pixels, signed-out users do not see Yours, and cards no longer overflow at 390 pixels.
+4. Cards prioritize evaluation: title, author, type, score, description, comments, and View details. Copy, download, reporting, editing, and deletion moved to the detail page.
+5. The detail page now teaches the installation journey and names its primary action precisely.
+6. Reports and reporter identities are admin-only through PocketBase rules. Public catalog UI no longer turns reports into social proof.
+7. The creator and revision dialogs share the CodeMirror editor, use bounded internal scrolling, expose pending/error states, and avoid step-selection layout shifts.
+
+## Remaining Minor Opportunities
+
+### P2: Explain disabled progression inline
+
+The Type and Details steps are understandable, but a disabled Next button could state the missing requirement for keyboard and first-time users. This is a refinement, not a blocker, because required fields and validation messages are already present.
+
+### P2: Consider a compact source summary on very small screens
+
+The read-only source viewer is intentionally complete and horizontally scrollable. A future collapse/expand summary could reduce page length for nontechnical visitors without hiding inspection entirely.
+
+## Verification Evidence
+
+- Fresh Docker Compose PocketBase volume and production docs image.
+- Populated catalog with widget, CSS, and outdated examples.
+- Desktop and 390px mobile layouts in light and dark themes.
+- Widget detail, installation instructions, CodeMirror source view, and comments.
+- Signed-in submission wizard through Type and Details, including the shared editor.
+- Zero browser console errors after the final fixes.
+- Impeccable deterministic detector: zero findings.
+
+## Compatibility Note
+
+An existing local development volume created from an earlier unreleased version of the reset migration still has a stale Workshop view. It is intentionally not migrated or deleted. A fresh volume created from the current unreleased migration is the supported validation target and works correctly.

.impeccable/critique/2026-07-22T15-58-15Z__apps-docs-src-components-workshop.md

@@ -0,0 +1,106 @@
+---
+target: Homarr Workshop docs UI
+total_score: 27
+p0_count: 0
+p1_count: 2
+timestamp: 2026-07-22T15-58-15Z
+slug: apps-docs-src-components-workshop
+---
+
+## Design Health Score
+
+| #         | Heuristic                       |     Score | Key Issue                                                                                                                                     |
+| --------- | ------------------------------- | --------: | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1         | Visibility of System Status     |         3 | Strong loading, retry, stale-data, pending, and copy states; successful report/edit actions still end silently.                               |
+| 2         | Match System / Real World       |         3 | Core Workshop language is clear, but `networkScope`, query/action, and schema terminology assumes technical fluency.                          |
+| 3         | User Control and Freedom        |         3 | Back, cancel, clear filters, vote toggling, and destructive confirmations are present; destructive actions have no undo.                      |
+| 4         | Consistency and Standards       |         3 | Shared primitives are coherent, though Docusaurus chrome and the denser app-store vocabulary still feel slightly stitched together.           |
+| 5         | Error Prevention                |         2 | Validation and confirmations are good, but install safety and credential context appears after download/copy actions on small screens.        |
+| 6         | Recognition Rather Than Recall  |         3 | Author, revision, source, filters, and capabilities are visible; installation still asks users to remember a separate Homarr navigation path. |
+| 7         | Flexibility and Efficiency      |         2 | Search, filters, sort, drag-and-drop, autofill, and comment shortcuts help; the install handoff remains manual.                               |
+| 8         | Aesthetic and Minimalist Design |         2 | Hierarchy is clear, but repeated panels, badges, uppercase metadata labels, and overlapping install actions add noise.                        |
+| 9         | Error Recognition and Recovery  |         3 | Errors are plain-language and usually preserve work; the global action error can be detached from the failed control.                         |
+| 10        | Help and Documentation          |         3 | The installation guide and source explanation are useful; security terminology lacks inline definitions.                                      |
+| **Total** |                                 | **27/40** | **Acceptable, significant improvements needed**                                                                                               |
+
+## Anti-Patterns Verdict
+
+**LLM assessment:** Moderate AI-assisted feel, not outright slop. Domain-specific copy, extensive state coverage, and transparent source/capability information make the feature credible. The generic card grid, repeated rounded panels, icon tiles, uppercase tracked labels, and decorative changelog stripe still expose a component-recipe grammar. It looks competent but not fully edited into a distinctive Homarr store.
+
+**Deterministic scan:** `detect.mjs --json apps/docs/src/components/workshop` exited 0 with exact output `[]`: zero findings, zero triggered rules, and no false positives. The scan found none of Impeccable's deterministic anti-patterns.
+
+**Visual overlays:** No reliable user-visible overlay is available. The independent detector agent had no browser backend. The parent fallback opened a fresh browser tab and visually inspected the listing, but the browser API did not expose a mutable evaluation method for the required preflight, so injection and `[Human]` visibility were correctly skipped. Browser/source evidence was used instead.
+
+## Overall Impression
+
+The Workshop is already substantially better than a generic gallery: it communicates authorship, source code, API capabilities, secrets, revision history, reports, and discussion. The biggest opportunity is to turn that information into a deliberate trust sequence. Today the interface lets the user act first and understand safety later, especially on mobile.
+
+## What's Working
+
+- **State coverage is unusually strong.** Listing failures, stale data, loading skeletons, empty results, filter recovery, comment errors, pending actions, and destructive confirmations have explicit UI.
+- **Pre-install transparency is excellent.** API hosts, methods, configurable options, network scope, and credential requirements are visible instead of hidden behind a download.
+- **The new primitive layer is coherent.** Search, filters, menus, switches, dialogs, and code presentation share one restrained interaction vocabulary across light and dark themes.
+
+## Priority Issues
+
+### [P1] Safety context arrives after the install action on mobile
+
+**Why it matters:** Download and copy actions appear in the header, while source capabilities, credential requirements, and installation guidance live in an aside that drops below the long source and discussion sections under the desktop breakpoint. A first-time mobile user can commit before understanding what the widget contacts or what secrets it needs.
+
+**Fix:** Put a compact “Before you install” summary immediately below the header on small screens: API hosts, network scopes, credential count, and action/query counts. Keep the full sticky details panel on desktop.
+
+**Suggested command:** `$impeccable layout`
+
+### [P1] Primary button and own-comment contrast misses AA
+
+**Why it matters:** The requested theme's primary red with white foreground is about 3.4:1, below 4.5:1 for small text. The same pairing affects primary buttons and the author's comment bubbles.
+
+**Fix:** Darken the primary red or use a dark foreground in light mode, then verify default buttons and comment bubbles in both themes.
+
+**Suggested command:** `$impeccable colorize`
+
+### [P2] The listing's server-rendered fallback is blank
+
+**Why it matters:** Before hydration, the listing renders an empty block instead of preserving the page's hierarchy and indicating progress. This creates a visible dead zone on slower self-hosted deployments.
+
+**Fix:** Render the listing heading, toolbar silhouette, and shared skeleton cards as the `BrowserOnly` fallback, matching the detail page's loading treatment.
+
+**Suggested command:** `$impeccable harden`
+
+### [P2] Download, copy, source, and install compete for the same task
+
+**Why it matters:** “Download widget,” “Copy JSON,” a full source viewer, and a separate installation panel all appear as parallel paths. Users must infer the recommended workflow.
+
+**Fix:** Make “Download widget JSON” the single primary header action. Keep copy beside the source viewer and place the next import step directly beside or immediately after download.
+
+**Suggested command:** `$impeccable clarify`
+
+### [P2] Repeated metadata scaffolding creates visual noise
+
+**Why it matters:** Card shells, badges, icon tiles, uppercase tracked labels, and the changelog stripe make the detail page feel assembled from recipes and slow scanning.
+
+**Fix:** Flatten the widget details into a compact definition list, reserve badges for status, and remove the decorative changelog stripe.
+
+**Suggested command:** `$impeccable distill`
+
+## Persona Red Flags
+
+**Jordan, first-timer:** “Network scope,” queries, actions, options, and the manifest schema appear without inline explanation. Download versus copy has no stated recommendation. On mobile, credential and installation context arrives after source and discussion.
+
+**Sam, accessibility-dependent user:** Primary controls and author comment bubbles miss small-text contrast. Copy, optimistic votes, filter result changes, and successful report/edit completion do not expose explicit live-region behavior. Gallery controls and dots are below comfortable touch-target sizes.
+
+**Casey, distracted mobile user:** The most important safety panel falls to the bottom, while primary actions stay at the top. Long source and discussion content separate the decision from its explanation. The submit type selector remains dense at narrow widths.
+
+## Minor Observations
+
+- The internal installation guide uses an external-link icon.
+- The final publication action says “Submit” rather than “Publish submission.”
+- Dark-theme tokens are declared in two blocks, increasing drift risk.
+- Screenshot dots rely on opacity alone and lack `aria-current`.
+- Successful report and edit actions deserve a small confirmation instead of silent dismissal.
+
+## Questions to Consider
+
+- If source review is important enough to say “Review exactly what will be installed,” why can users download before seeing the capability and credential summary?
+- Is Workshop primarily a code catalog or a safety-conscious app store? The current action hierarchy tries to be both.
+- Should the successful end state be a downloaded file, or a confident handoff into Homarr with the next step already visible?

.mcp.json

@@ -1,8 +0,0 @@
-{
-  "mcpServers": {
-    "mantine": {
-      "command": "npx",
-      "args": ["-y", "@mantine/mcp-server"]
-    }
-  }
-}

.oxfmtrc.json

@@ -3,5 +3,15 @@
   "printWidth": 120,
   "endOfLine": "lf",
   "sortPackageJson": true,
-  "ignorePatterns": ["**/*.cjs", "**/lang/**", "static-data/**", "CHANGELOG.md", "apps/docs/.docusaurus/**", "apps/docs/build/**", "apps/docs/blog/**"]
+  "ignorePatterns": [
+    "**/*.cjs",
+    "**/lang/**",
+    "static-data/**",
+    "CHANGELOG.md",
+    "apps/docs/.docusaurus/**",
+    "apps/docs/build/**",
+    "apps/docs/blog/**",
+    "packages/custom-widgets/src/core/component-catalog.generated.json",
+    "apps/docs/static/custom-widgets/component-catalog-v1.json"
+  ]
 }

.oxlintrc.json

@@ -30,7 +30,15 @@
   "options": {
     "reportUnusedDisableDirectives": "off"
   },
-  "ignorePatterns": ["**/*.config.js", "**/*.config.mjs", "**/*.cjs", "**/lang/*.d.json.ts", ".next/**", "apps/docs/.docusaurus/**", "apps/docs/build/**"],
+  "ignorePatterns": [
+    "**/*.config.js",
+    "**/*.config.mjs",
+    "**/*.cjs",
+    "**/lang/*.d.json.ts",
+    ".next/**",
+    "apps/docs/.docusaurus/**",
+    "apps/docs/build/**"
+  ],
   "settings": {
     "react": { "version": "19" }
   }