refactor: let integrations own HTTP authentication

fix: make integration types searchable
feat: reuse authentication for all HTTP integrations
2026-09-12 23:57:33 +02:00 · 2026-09-12 23:39:10 +02:00 · 2026-09-12 23:33:23 +02:00 · 2026-09-12 22:45:52 +02:00 · 2026-09-12 20:32:03 +02:00 · 2026-09-12 20:26:39 +02:00
265 changed files with 30091 additions and 25032 deletions
@@ -37,4 +37,4 @@ Orient from the current checkout before editing. Treat package manifests, export
 - Cron jobs: `packages/cron-jobs/src/jobs/`
 - App routes: `apps/nextjs/src/app/[locale]/`

-When a code change affects users, invoke `documentation-sync`. When exposing tRPC through MCP, invoke `mcp-integration`.
+Invoke `documentation-sync` when hidden capabilities or information not evident to an advanced user change, or existing guidance becomes inaccurate; follow the Documentation Sync criteria in `AGENTS.md`. When exposing tRPC through MCP, invoke `mcp-integration`.
@@ -1,13 +1,17 @@
 ---
 name: documentation-sync
-description: Keep Homarr's Docusaurus documentation aligned with user-facing code. Use when adding or changing integrations, widgets, APIs, environment variables, CLI commands, authentication, permissions, cron jobs, settings, or UI behavior that users must understand.
+description: Write concise Homarr docs for advanced users, covering only hidden capabilities and information not evident from the UI. Use when that information changes or existing guidance becomes inaccurate; skip obvious controls and routine fixes.
 ---

 # Documentation Sync

-Update `apps/docs/` in the same change as user-facing behavior. Inspect adjacent pages and the docs types before copying a pattern; the source and docs evolve together.
+Apply the audience and scope rules in `AGENTS.md` first. Before adding a passage, identify what an advanced user could not learn directly from the interface. If there is no such information, omit it.

-## Map the change
+For hidden capabilities such as the advanced widget feature, explain discovery, activation, and non-obvious behavior. For visible standard controls such as Delete, omit narration of what the label already conveys. Use the shortest explanation that preserves necessary technical detail; remove redundant prose in the passage being edited.
+
+When an update is warranted, inspect adjacent pages for structure and types, not as a verbosity target. The mappings below locate needed information; they do not require a page for every feature or code change.
+
+## Locate a needed update

 | Code change                         | Documentation target                                                 |
 | ----------------------------------- | -------------------------------------------------------------------- |
@@ -40,11 +44,11 @@ For a widget:

 - Add or update `apps/docs/docs/widgets/<slug>/index.ts` with the local `WidgetDefinition` pattern.
 - Add or update `index.mdx` with the established `WidgetHeader`, `WidgetConfig`, and `AddingWidget` components as applicable.
- Document options, required integrations, permissions, empty states, and changed behavior that affect setup or use.
+- Explain only non-obvious option semantics, integration prerequisites, permission constraints, or behavior that the interface does not make clear.

 ## Completion criteria

-1. Describe the shipped behavior, not an implementation plan.
+1. Every passage adds information an advanced user cannot reasonably infer from the interface. Remove obvious, repetitive, or unnecessary prose.
 2. Keep names, defaults, paths, screenshots, links, and prerequisites consistent with code.
 3. Update every affected page and remove superseded guidance.
 4. Run the narrowest useful docs validation. Use `pnpm turbo build --filter=@homarr/docs` when links, MDX, generated definitions, or navigation can fail; otherwise run the docs package formatter on touched files.
@@ -13,7 +13,7 @@ interface HomarrCustomWidgetV2 {
 }
 ```

-The object key `default` is the required source ID; `default` is not a property on a source. Source properties are `name?`, `baseUrl`, `networkScope`, and `auth?`:
+`sources.default` is required. HTTP source properties: `name?`, `baseUrl`, `networkScope`, and `auth?`:

 ```json
 {
@@ -40,10 +40,12 @@ The object key `default` is the required source ID; `default` is not a property
 }
 ```

-Auth is `none`, `bearer`, `basic`, `{ "type": "apiKeyHeader", "name": "X-Api-Key" }`, or `{ "type": "apiKeyQuery", "name": "api_key" }`. A request defaults to source `default`, kind `query`, method `GET`, trigger `load`, inherited auth, and view permission. Set `trigger: "manual"` for a parameterized query. An action defaults to manual and modify permission. DELETE uses full permission and confirmation. Do not use `load: false`.
+Integration sources use `{"type":"integration","integrationKind":"sonarr"}`. Bind `integrationId` from `integration_all`; exports omit it. Calls require full integration access. Omit URL/auth fields. Paths append to the integration URL; non-GET requests must be actions.

-Use stable real URLs for public APIs and clear suggested URLs for self-hosted services. Homarr collects the installer's server URL, network scope, and credentials as source setup; credentials remain outside the manifest.
+Auth: `none`, `bearer`, `basic`, `{ "type": "apiKeyHeader", "name": "X-Api-Key" }`, or `{ "type": "apiKeyQuery", "name": "api_key" }`. Requests default to source `default`, kind `query`, method `GET`, trigger `load`, inherited auth, and view permission. Parameterized queries need `trigger: "manual"`. Actions default to manual/modify; DELETE requires full permission and confirmation. Do not use `load: false`.

-Paths use `{option:name}` and `{param:name}`; query/body references use `{ "$option": "name" }` and `{ "$param": "name" }`. Constants stay primitive (`take: 10`); `$param` is only for manual helpers, never load queries. Names and types are inferred.
+HTTP sources declare public URLs or self-hosted suggestions; installers configure their URL, network scope, and credentials separately.

-Every option has `label`, `control`, and `default`. Optional fields are `description`, `choices`, `choicesFrom`, `min`, `max`, `step`, `advanced`, and `group`.
+Paths bind `{option:name}` and `{param:name}`; query/body references bind `{ "$option": "name" }` and `{ "$param": "name" }`. Use primitive constants (`take: 10`). `$param` is only for manual requests.
+
+Options require `label`, `control`, and `default`. Optional fields: `description`, `choices`, `choicesFrom`, `min`, `max`, `step`, `advanced`, `group`.
@@ -16,9 +16,10 @@ LOG_LEVEL='info'

 # This is how you can use the sqlite driver:
 DB_DRIVER='better-sqlite3'
-# Safe local source-development path. SQLite files are ignored by Git.
+# Set an absolute writable SQLite path so migrations and the app use the same file.
+# Their working directories differ; do not use a relative path here.
 # Container images use /appdata/db/db.sqlite by default instead.
-DB_URL='./db.sqlite'
+DB_URL=

 # Those are the two ways to use the mysql2 driver:
 # 1. Using the URL format:
@@ -25,6 +25,18 @@ body:
    attributes:
      label: Additional information
      description: Add any other information related to the bug here, screenshots if applicable.
+  - type: input
+    id: exactBuild
+    attributes:
+      label: Exact build or image
+      description: For preview or development builds, include the commit SHA or image digest. A moving tag such as v2 is not enough to identify the build.
+      placeholder: "Commit SHA, image digest, or release version"
+  - type: input
+    id: lastWorkingVersion
+    attributes:
+      label: Last working version
+      description: If this worked before, include the last version or build where you tried the same action. Leave blank if unknown.
+      placeholder: "Version or commit SHA"
  - type: dropdown
    id: version
    attributes:
@@ -33,6 +45,7 @@ body:
      options:
        # The below comment is used to insert a new version with on-release.yml
        #NEXT_VERSION#
+        - 1.77.0
        - 1.76.2
        - 1.76.1
        - 1.76.0
@@ -97,17 +97,16 @@ jobs:

      - name: Validate Custom Widget bundle budget
        run: |
-          pnpm --filter nextjs build
+          pnpm turbo run build --filter=@homarr/nextjs
          pnpm check:custom-widget-bundle

-      - name: Run unit tests
-        run: pnpm test
-
  container:
-    name: Container and E2E
+    name: Container build
+    # Same-repository previews already build amd64; only build a fallback when no digest is available.
    needs: [fast-gate, preview-amd64]
    if: |
      !cancelled() && needs.fast-gate.result == 'success' &&
+      needs.preview-amd64.result != 'failure' && needs.preview-amd64.outputs.digest == '' &&
      (
        github.event_name == 'merge_group' ||
        (github.event_name == 'push' && github.ref == 'refs/heads/release/v2') ||
@@ -115,10 +114,9 @@ jobs:
        (github.event_name == 'workflow_dispatch' && (inputs.operation == 'validate' || inputs.operation == 'publish'))
      )
    runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 20
    permissions:
      contents: read
-      packages: read
    steps:
      - uses: actions/checkout@v7
        if: "!env.ACT"
@@ -126,23 +124,10 @@ jobs:
          persist-credentials: false
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}

-      - name: Setup
-        uses: ./tooling/github/setup
-
      - name: Set up Docker Buildx
-        if: "!env.ACT"
+        if: needs.preview-amd64.outputs.digest == '' && !env.ACT
        uses: docker/setup-buildx-action@v4

-      - name: Reuse amd64 preview image
-        if: needs.preview-amd64.outputs.digest != '' && !env.ACT
-        env:
-          DIGEST: ${{ needs.preview-amd64.outputs.digest }}
-        run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-          docker pull "${PREVIEW_IMAGE}@${DIGEST}"
-          docker tag "${PREVIEW_IMAGE}@${DIGEST}" homarr-ci
-          docker tag "${PREVIEW_IMAGE}@${DIGEST}" homarr-e2e
-
      - name: Build container once
        if: needs.preview-amd64.outputs.digest == '' && !env.ACT
        uses: docker/build-push-action@v7
@@ -152,9 +137,7 @@ jobs:
          platforms: linux/amd64
          load: true
          push: false
-          tags: |
-            homarr-ci
-            homarr-e2e
+          tags: homarr-ci
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
@@ -182,37 +165,7 @@ jobs:
            fi
          done
          DOCKER_BUILDKIT=1 docker build --platform linux/amd64 \
-            --tag homarr-ci --tag homarr-e2e "${secret_args[@]}" .
-
-      - name: Cache Playwright browsers
-        if: "!env.ACT"
-        id: playwright-cache
-        uses: actions/cache@v6
-        with:
-          path: ~/.cache/ms-playwright
-          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
-
-      - name: Install Playwright Chromium
-        if: steps.playwright-cache.outputs.cache-hit != 'true' || env.ACT
-        run: pnpm exec playwright install --with-deps chromium
-
-      - name: Install Playwright system deps
-        if: steps.playwright-cache.outputs.cache-hit == 'true'
-        run: pnpm exec playwright install-deps chromium
-
-      - name: Run E2E tests
-        env:
-          NODE_ENV: development
-          CI: "true"
-        run: pnpm exec vitest e2e --retry 1 --maxWorkers 4
-
-      - name: Upload E2E artifacts
-        if: failure() && !env.ACT
-        uses: actions/upload-artifact@v7
-        with:
-          name: playwright-report
-          path: e2e/test-results/
-          retention-days: 7
+            --tag homarr-ci "${secret_args[@]}" .

  preview-amd64:
    name: Build amd64 preview image
@@ -320,10 +273,10 @@ jobs:

  publish-preview:
    name: Publish multi-platform preview image
-    needs: [container, preview-amd64, preview-arm64]
+    needs: [fast-gate, preview-amd64, preview-arm64]
    if: |
      !cancelled() &&
-      needs.container.result == 'success' &&
+      needs.fast-gate.result == 'success' &&
      needs.preview-amd64.result == 'success' &&
      needs.preview-arm64.result == 'success' &&
      (
@@ -16,10 +16,10 @@ permissions:
 jobs:
  create-and-merge-pr:
    runs-on: ubuntu-latest
-    timeout-minutes: 2
+    timeout-minutes: 10
    steps:
      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
+        if: ${{ inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
@@ -37,11 +37,22 @@ jobs:
          branch: next
      - name: Create pull request
        id: create-pull-request
-        run: 'gh pr create --title "chore(release): release ${{ steps.semver.outputs.next }}-beta" --body "Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}-beta``" --base beta --head next --label automerge'
+        run: |
+          pr_url="$(gh pr list --base beta --head next --state open --json url --jq '.[0].url // empty')"
+          if [[ -z "$pr_url" ]]; then
+            pr_url="$(gh pr create \
+              --title "chore(release): release ${{ steps.semver.outputs.next }}-beta" \
+              --body "Detected change to be ${{ steps.semver.outputs.bump }}<br/>Bump version from ${{ steps.semver.outputs.current }} to ${{ steps.semver.outputs.next }}-beta" \
+              --base beta \
+              --head next \
+              --label automerge)"
+          fi
+          echo "url=$pr_url" >> "$GITHUB_OUTPUT"
+          echo "pr_number=${pr_url##*/}" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
+        if: ${{ inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
@@ -58,7 +69,7 @@ jobs:
        env:
          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
        run: |
-          gh pr review --approve --body "Automatically approved by GitHub Action"
+          gh pr review "${{ steps.create-pull-request.outputs.url }}" --approve --body "Automatically approved by GitHub Action"
      - name: Obtain token
        id: obtainMergeToken
        uses: actions/create-github-app-token@v3
@@ -82,21 +93,21 @@ jobs:
          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals

      - name: Merged Discord notification
-        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.event.inputs.send-notifications }}
+        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
        with:
          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
      - name: Major Bump Discord notification
-        if: ${{ steps.semver.outputs.bump == 'major' && github.event.inputs.send-notifications }}
+        if: ${{ steps.semver.outputs.bump == 'major' && inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
        with:
          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
      - name: Discord Fail Notification
-        if: failure() && github.event.inputs.send-notifications
+        if: ${{ failure() && inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
@@ -2,8 +2,36 @@ name: Workshop

 on:
  pull_request:
+    paths:
+      - ".github/workflows/workshop.yml"
+      - "apps/workshop/**"
+      - "apps/docs/**"
+      - "packages/custom-widgets/**"
+      - "packages/definitions/**"
+      - "packages/workshop/**"
+      - "tooling/typescript/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - ".npmrc"
  push:
    branches: [dev, v2, release/v2, main]
+    paths:
+      - ".github/workflows/workshop.yml"
+      - "apps/workshop/**"
+      - "apps/docs/**"
+      - "packages/custom-widgets/**"
+      - "packages/definitions/**"
+      - "packages/workshop/**"
+      - "tooling/typescript/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - ".npmrc"

 permissions:
  contents: read
@@ -15,21 +43,10 @@ concurrency:
 jobs:
  validate:
    runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24.18.0
-      - uses: pnpm/action-setup@v6
-        with:
-          run_install: false
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter @homarr/workshop typecheck
-      - run: pnpm --filter @homarr/docs typecheck
      - run: docker compose --env-file apps/workshop/.env.staging.example -f apps/workshop/docker-compose.staging.yml config --quiet
-      - run: pnpm test:workshop
-      - run: pnpm test:workshop-image

  publish-amd64:
    if: github.event_name == 'push' && (github.ref_name == 'v2' || github.ref_name == 'release/v2' || github.ref_name == 'main')
@@ -59,7 +59,13 @@ homarr/

 The documentation site lives at `apps/docs/` (Docusaurus 3, `@homarr/docs`).

-When modifying user-facing code, you MUST also update the corresponding documentation:
+Write for smart, curious, advanced users. Documentation should contain only information they cannot reasonably discover or understand directly from the interface: hidden capabilities, non-obvious behavior, prerequisites, constraints, configuration contracts, and migration requirements.
+
+Keep docs concise. Every paragraph must add knowledge beyond visible labels and standard UI conventions. Explain how to discover and use a hidden advanced widget feature; omit explanations that the Delete button deletes an item in edit mode. Avoid UI walkthroughs, exhaustive control descriptions, and repetition. When editing a passage, remove obvious or redundant prose rather than preserving verbosity as a precedent.
+
+Update docs only when a change introduces or alters that non-obvious information, or makes existing guidance inaccurate. Routine fixes and self-explanatory UI changes need no docs update. A new feature alone does not require a page; apply the same reader-value test.
+
+When documentation is needed, use these locations:

 - New integration → `apps/docs/docs/integrations/<slug>/index.mdx` + `index.ts`
 - New widget → `apps/docs/docs/widgets/<slug>/index.mdx` + `index.ts`
@@ -86,7 +92,7 @@ When modifying user-facing code, you MUST also update the corresponding document
 - Lint: oxlint (not ESLint)
 - Format: oxfmt (not Prettier)
 - UI: Mantine (not Tailwind) — Tailwind is only used in docs app
- Mantine: use the project-scoped MCP server in `.mcp.json` for current v9 APIs, and check `packages/ui/` before creating a new primitive.
+- Mantine: use the `mantine` MCP server in `.mcp.json` for current v9 APIs before writing component code. Prefer built-in primitives (`Combobox`/`useCombobox`, the polymorphic `component` prop, `@mantine/hooks`) and check `packages/ui/` for existing conventions first.
 - Icons: @tabler/icons-react
 - Docs app can import from `@homarr/definitions` for shared types
 - Run `pnpm dev:cli -- dev` to browse local `homarr:*` images and remote PR images.
@@ -94,11 +100,15 @@ When modifying user-facing code, you MUST also update the corresponding document
 - Run `pnpm dev:cli -- build --pr <number>` to build a PR locally from a temporary checkout.
 - Run Go checks from `tools/homarr-dev` with `go test ./...` and `go vet ./...`.

+## MCP servers
+
+`.mcp.json` declares project-scoped MCP servers. Keep only keyless definitions there; credentials belong in local dotfiles. See [Mantine LLM tooling](https://mantine.dev/guides/llms/) for client-specific setup.
+
 ## Agent Skills

 Portable skills live in `.agents/skills/`. Read the relevant `SKILL.md` before working in that domain; detailed references are loaded only when needed. Claude-compatible discovery is provided through `.claude/skills`.

 - `codebase-context` — architecture, package boundaries, and shared utilities
- `documentation-sync` — required user-facing documentation updates
+- `documentation-sync` — documentation for changes users need explained
 - `mcp-integration` — safe tRPC-to-MCP exposure
 - `homarr-custom-widget` — safe Custom JSX v2 authoring
@@ -1,3 +1,7 @@
+## [1.77.1](https://github.com/homarr-labs/homarr/compare/v1.77.0...v1.77.1) (2026-09-11)
+
+## [1.77.0](https://github.com/homarr-labs/homarr/compare/v1.76.2...v1.77.0) (2026-09-06)
+
 ## [1.76.2](https://github.com/homarr-labs/homarr/compare/v1.76.1...v1.76.2) (2026-08-27)

 ## [1.76.1](https://github.com/homarr-labs/homarr/compare/v1.76.0...v1.76.1) (2026-08-26)
@@ -15,19 +15,13 @@ Many of you used the v2 demo when it was still rough, found bugs and came back t

 We are also planning a small batch of **free, limited-edition Homarr swag** for Workshop contributors and a few randomly picked community members. It is not for sale and it is not for profit. No Homarr merch empire, sorry.

-Homarr 2.0 is an upgrade, not a brand-new app wearing the same logo. Here is what actually changed.
+Homarr 2.0 builds on the dashboard you already use. Here is what changed.

 ![A populated Homarr 2.0 dashboard with compact widgets, an Assistant, and an application rail](./img/homarr-v2-dashboard.webp)

 <!-- truncate -->

-:::warning Back up before upgrading
-
-Follow the [v1 to v2 upgrade guide](/docs/getting-started/upgrade-v2) and create a
-[Homarr backup](/docs/management/backup) first. Do not test a prerelease image on your only production volume.
-Backups are boring. Restores are worse.
-
-:::
+Update your Homarr image as usual. Homarr runs database migrations automatically when the updated container starts; no manual database migration or separate v2 upgrade procedure is needed. Workshop uses the production service by default, with no preview URL configuration required.

 ## Custom Widgets v2 and Workshop

@@ -150,9 +144,8 @@ Groups use a new Viewer, Editor and Admin matrix. The API, Assistant and MCP fol

 Board startup work runs in parallel, heavy screens load when opened, and identical integration requests share work instead of doing it twice.

-## Before upgrading
+## Compatibility notes

- Keep a backup and use the final release image, not a prerelease tag.
 - Legacy Custom JSX definitions enter a migration state. Homarr keeps encrypted credentials and an archived copy until the v2 definition validates.
 - Mobile layouts place rail content in the main flow instead of displaying rails.
 - Custom Widgets remain Beta.
@@ -160,8 +153,7 @@ Board startup work runs in parallel, heavy screens load when opened, and identic

 ## Links

- Try the [Homarr 2.0 preview](https://app-v2.preview.homarr.dev).
- Follow the [v1 to v2 upgrade guide](/docs/getting-started/upgrade-v2).
- Follow the [v2 release pull request](https://github.com/homarr-labs/homarr/pull/6545) and [public beta thread](https://github.com/homarr-labs/homarr/issues/6600).
- Compare [v1.76.2 with the release/v2 branch](https://github.com/homarr-labs/homarr/compare/v1.76.2...release/v2).
+- Try the [live demo](https://demo.homarr.dev/).
+- See [installation and update instructions](/docs/getting-started/installation/docker).
+- Browse [Workshop](https://homarr.dev/workshop).
 - Read the guides for [Boards](/docs/management/boards), [Custom Widgets](/docs/management/custom-widgets), [Assistant](/docs/management/assistant), [MCP](/docs/management/mcp) and [Docker labels](/docs/integrations/docker-labels).
@@ -90,7 +90,7 @@ homarr run dev
 homarr run --detach dev
 homarr run --pr 6441
 homarr run --pr 6441 --demo
-homarr --pr 6441 --env WORKSHOP_WEB_URL=https://app-v2.preview.homarr.dev/
+homarr --pr 6441 --env WORKSHOP_WEB_URL=https://workshop.example.com/workshop
 ```

 - `--pr <number>`: Pull and run a PR image from GHCR (shorthand: `homarr --pr <number>`).
@@ -31,9 +31,13 @@ pnpm install --frozen-lockfile
 ### Run the Homarr application

 1. Copy `.env.example` to `.env`.
-2. Set `DB_URL` to an absolute writable SQLite file path.
-3. Keep Redis and the optional local databases running in one terminal.
-4. Apply migrations and start Next.js in another terminal.
+2. Run `openssl rand -hex 32` twice. Set `AUTH_SECRET` and `SECRET_ENCRYPTION_KEY` to the two different generated
+   values in `.env`; the example leaves both empty. Keep this file private and preserve `SECRET_ENCRYPTION_KEY`
+   when reusing a database.
+3. Set `DB_URL` to an absolute writable SQLite file path. Migration and application commands run from different
+   workspace directories, so a relative path can point them at different databases.
+4. Keep Redis and the optional local databases running in one terminal.
+5. Apply migrations and start Next.js in another terminal.

 ```sh
 cp .env.example .env
@@ -57,6 +61,20 @@ Homarr becomes the instance administrator.
 Use `pnpm docker:dev:up` instead when you only need Redis in the background. Running the migration also seeds the
 default data; use `pnpm db:seed` to seed it explicitly later.

+`pnpm dev` starts only Next.js. When your work needs scheduled tasks or live subscriptions, run the relevant service
+in a separate terminal alongside it:
+
+```sh
+pnpm --filter @homarr/tasks dev
+```
+
+```sh
+pnpm --filter @homarr/websocket dev
+```
+
+The WebSocket service listens on port 3001. Production startup embeds both services, so these extra commands are
+only needed for development.
+
 Workshop contributors can set up PocketBase and Docusaurus with the dedicated
 [Workshop development guide](./workshop).

@@ -80,5 +98,27 @@ Workshop contributors can set up PocketBase and Docusaurus with the dedicated
 - `pnpm typecheck` — typecheck all workspaces.
 - `pnpm test` — unit and contract suites.
 - `pnpm build` — production monorepo build.
- `docker build -t homarr .` — build a production Docker image.
- `docker run -p 7575:7575 -e SECRET_ENCRYPTION_KEY='your_64_character_hex_string' homarr:<name>` — run it.
+- `docker build -t homarr:local .` — build a production Docker image.
+- `docker run -p 7575:7575 -e SECRET_ENCRYPTION_KEY='your_64_character_hex_string' homarr:local` — run it.
+
+## CI and focused validation
+
+The main CI workflow runs lint, typechecking, affected workspace builds, workspace configuration checks, OpenAPI validation, and Custom Widget architecture and bundle checks. Unit and E2E suites do not run in CI. Preview images publish after the Fast gate and both architecture builds succeed; browser tests do not block publication. The container job builds an amd64 image when no preview image was built.
+
+Workshop CI runs only when its workflow or Docker build inputs change. It validates Compose configuration and publishes production images on its configured release branches. Its Docker integration and image tests are manual; workspace typechecks run in the main Fast gate.
+
+Choose the smallest relevant suite when changing behavior:
+
+| Command                                           | Scope                                                          | Requirements                                                          |
+| ------------------------------------------------- | -------------------------------------------------------------- | --------------------------------------------------------------------- |
+| `pnpm test <file>`                                | Focused unit or contract tests                                 | Workspace dependencies                                                |
+| `pnpm test`                                       | All unit and contract tests, without Docker integration suites | Workspace dependencies                                                |
+| `pnpm test:coverage`                              | Unit and contract tests with coverage                          | Workspace dependencies                                                |
+| `pnpm test:integration <file>`                    | Docker-backed service and database compatibility tests         | Docker                                                                |
+| `pnpm test:e2e <file>`                            | Browser and container scenarios                                | Docker; Playwright Chromium and system dependencies for browser tests |
+| `pnpm test:docs-screenshots`                      | Regenerate Assistant documentation screenshots                 | Same browser prerequisites                                            |
+| `pnpm test:workshop` / `pnpm test:workshop-image` | Workshop integration / production-image validation             | Docker                                                                |
+
+Omit `<file>` to run all tests in that command's scope. E2E and screenshot commands use a local image tagged `homarr-e2e`, or an image selected with `HOMARR_E2E_IMAGE`. The default commands run once without automatic retries; coverage is opt-in. The screenshot generator is excluded from both unit and E2E commands.
+
+Keep behavioral coverage for authorization, migrations, persistence, and widget execution. Avoid tests that only search source code for particular component names, JSX, CSS, or documentation wording.
@@ -13,7 +13,8 @@ You can change the user and group by using the `PUID` and `PGID` environment var
 Important to note is, that you'll also need to change the permissions for the mounted directories accordingly.

 :::info
-When starting up an updated version of the container it will have about **10 seconds longer to start** as it has to change the permissions of the app directories
+At startup, Homarr updates ownership of its data directories and runtime caches for the selected user and group.
+Startup time depends on the amount of persistent data; application code and dependencies do not need ownership changes.
 :::

 ## Without mounted Docker socket
@@ -24,6 +24,10 @@ see [Managing integrations](/docs/management/integrations#configuration).

 ### Update

+Update the image and recreate the container with the same configuration. Homarr runs database migrations automatically
+at startup, including when moving from v1 to v2; no separate upgrade procedure is needed. Keep the `/appdata` mount and
+`SECRET_ENCRYPTION_KEY` unchanged. Workshop connects to the production service by default.
+
 ```sh
 docker compose pull
 docker compose up -d
@@ -21,8 +21,8 @@ This method is only useful, when you want to develop on Homarr or extend it with

 ## Prerequisites

- [Node.js](https://nodejs.org/en/download/)
- [pnpm](https://pnpm.io/installation)
+- [Node.js](https://nodejs.org/en/download/) 24.18 or newer
+- [pnpm](https://pnpm.io/installation) at the version pinned in the repository's `package.json`
 - [Redis](https://redis.io/download)

 ## Steps
@@ -38,9 +38,9 @@ This method is only useful, when you want to develop on Homarr or extend it with
    Install all dependencies using <code>pnpm install</code>
  </li>
  <li>
-    Copy the `.env.example` file to `.env`. Its `DB_URL='./db.sqlite'` value is ready for local use and stores the
-    database in the cloned repository. Replace it with an absolute writable path such as
-    `DB_URL='/home/username/homarr/db.sqlite'` if you want to store the database elsewhere.
+    Copy `.env.example` to `.env` and set `DB_URL` to an absolute writable path, such as
+    `DB_URL='/home/username/homarr/db.sqlite'`. Migration and application commands run from different workspace
+    directories, so a relative path can point them at different databases.
  </li>
  <li>
    Run `openssl rand -hex 32` twice and set `AUTH_SECRET` and `SECRET_ENCRYPTION_KEY` to the two different generated
@@ -1,74 +0,0 @@
---
-title: Upgrade from v1 to v2
-sidebar_position: 2
-tags:
-  - Getting started
-  - Upgrade
-  - Migration
-  - Backup
---
-
-Homarr v2 upgrades the existing v1 database in place. Keep the same data storage, database configuration, and
-`SECRET_ENCRYPTION_KEY`; only change the Homarr image or package version for the first start.
-
-:::danger Back up before starting v2
-
-In Homarr v1, go to **Management → Tools → Backup**, export a backup, and keep the downloaded file somewhere safe
-before starting v2. See [Backup and restore](/docs/management/backup) for details.
-
-:::
-
-## Upgrade
-
-1. Pin the Homarr image to `ghcr.io/homarr-labs/homarr:v2.0.0` for the first v2 start.
-2. Keep the existing `/appdata` mount, database variables, Redis configuration, and `SECRET_ENCRYPTION_KEY` unchanged.
-3. Start one Homarr replica and follow its logs. Startup must reach `Migration complete`; Homarr aborts startup when a
-   database migration fails.
-4. Open Homarr and sign in. Confirm **Management → About** reports v2 before starting additional replicas.
-5. After validation, keep the version pinned or return to your normal stable release policy.
-
-For Docker Compose, the change is limited to the image tag before the usual update:
-
-```yaml
-services:
-  homarr:
-    image: ghcr.io/homarr-labs/homarr:v2.0.0
-```
-
-```sh
-docker compose pull
-docker compose up -d
-docker compose logs --follow homarr
-```
-
-Do not add `-v` when stopping the Compose deployment; that can remove named volumes.
-
-## What v2 migrates
-
-The startup migration:
-
- creates the Custom Widget v2, Assistant, header preference, and branding storage;
- adds Base/Mobile layout roles and left/right board gutters;
- converts legacy Categories and dynamic sections into Containers and rails;
- preserves legacy Custom Widget definitions, encrypted secrets, and board references for explicit migration.
-
-Legacy Custom Widgets are not silently rewritten. In **Management → Custom Widgets**, entries marked
-**Migration required** provide a credential-free migration prompt. Review and test the resulting v2 definition before
-removing the archived v1 version. See [Custom Widgets: Import and Workshop](/docs/management/custom-widgets#import-and-workshop).
-
-## Verify the upgraded instance
-
- Sign in with each enabled authentication method and verify administrator access.
- Open every important board on desktop and mobile. Check Containers, former Categories, rails, item placement, and
-  home-board assignments.
- Test at least one read and one permitted action for each critical integration. Recheck integration and board access
-  for representative Viewer, Editor, and Admin groups.
- Check Docker or Podman endpoints, search engines, uploaded media, trusted certificates, scheduled tasks, WebSockets,
-  and external Redis when used.
- Review every legacy Custom Widget and migrate it only after its v2 preview and requests work.
- Restart Homarr once more and confirm the logs contain no migration, database, Redis, authentication, or task errors.
-
-## Roll back
-
-Use the backup exported before the upgrade if you need to restore your v1 installation. Do not reuse a database that
-v2 has already migrated with v1.
@@ -28,6 +28,8 @@ import { smartHomeExecuteAutomationWidget } from "@site/docs/widgets/smart-home-
  ]}
 />

+Entity toggles and automation triggers send JSON requests to Home Assistant. A rejected action is shown as a failure.
+
 ### Adding the integration

 <AddingIntegration />
@@ -0,0 +1,55 @@
+---
+title: "llama.cpp"
+description: "Connect Homarr to a llama.cpp llama-server to monitor your local LLM: health, loaded model, generation speed and request status."
+hide_title: true
+---
+
+import { IntegrationHeader } from "@site/src/components/integrations/header";
+import { IntegrationCapabilites } from "@site/src/components/integrations/widgets";
+import { AddingIntegration } from "@site/src/components/integrations/adding";
+import { IntegrationSecrets } from "@site/src/components/integrations/secrets";
+import { llamacppIntegration } from ".";
+import { llamacppWidget } from "@site/docs/widgets/llama-cpp";
+
+<IntegrationHeader integration={llamacppIntegration} categories={["System Monitoring"]} />
+
+The llama.cpp integration lets Homarr connect to a [llama-server](https://github.com/ggml-org/llama.cpp) instance so you can see the health of your local LLM, which model is loaded, and how fast it is generating — all from your dashboard.
+
+### Widgets & Capabilities
+
+<IntegrationCapabilites items={[{ widget: llamacppWidget }]} />
+
+### Adding the integration
+
+<AddingIntegration />
+
+:::info URL configuration
+Use the root URL of your `llama-server`, for example `http://192.168.1.50:8080`. Homarr calls the `/health`, `/v1/models`, `/metrics` and `/slots` endpoints under that URL automatically.
+:::
+
+:::tip Metrics
+Generation speed and token counters are read from the Prometheus endpoint at `/metrics`. Start `llama-server` with the `--metrics` flag so these values are available:
+
+```shell
+llama-server --model /path/to/model.gguf --metrics
+```
+
+Without `--metrics` the widget still shows health, model information, and active-request speed from `/slots`; metrics-backed counters and aggregate speed stay empty.
+:::
+
+:::info Context and per-request speed
+Context (KV cache) usage and the in-flight request data are read from the `/slots` endpoint, which is available on every recent llama-server build and requires no extra flags. The per-request generation speed shown while a request is running is derived by tracking the request's decoded token count across polls, so it reflects the average speed of the request that is currently being generated.
+:::
+
+### Secrets
+
+llama-server does not require authentication by default. The integration only needs the URL of your server.
+
+<IntegrationSecrets
+  secrets={[
+    {
+      credentials: [],
+      steps: [],
+    },
+  ]}
+/>
@@ -0,0 +1,9 @@
+import { IntegrationDefinition } from "@site/src/types";
+
+export const llamacppIntegration: IntegrationDefinition = {
+  name: "llama.cpp",
+  description:
+    "Connect to a local llama.cpp llama-server to show model, throughput and request status on your dashboard.",
+  iconUrl: "https://cdn.jsdelivr.net/gh/selfhst/icons/svg/llama-cpp.svg",
+  path: "../../integrations/llama-cpp",
+};
@@ -30,6 +30,8 @@ import { systemResourcesWidget } from "@site/docs/widgets/system-resources";
  ]}
 />

+Disk temperatures are matched to filesystem partitions, including device names without the `/dev/` prefix.
+
 ### Adding the integration

 <AddingIntegration />
@@ -19,6 +19,9 @@ import Alert from "@theme/Admonition";

 <IntegrationCapabilites items={[{ widget: healthMonitoringWidget }, { widget: systemResourcesWidget }]} />

+Disk space uses each pool's root dataset to account for RAIDZ parity and dataset limits. If dataset space is unavailable,
+Homarr falls back to physical pool space, which reads higher on RAIDZ, and keeps reporting pool health.
+
 ### Adding the integration

 <AddingIntegration />
@@ -23,6 +23,8 @@ import imgSelectApikeyPreset from "./imgs/unraid-select-api-key-preset.png";

 <IntegrationCapabilites items={[{ widget: healthMonitoringWidget }, { widget: systemResourcesWidget }]} />

+CPU usage is averaged across logical processors, including SMT threads.
+
 ### Adding the integration

 <AddingIntegration />
@@ -24,12 +24,14 @@ The What's Up Docker integration lets Homarr connect to your [WUD](https://githu
 <AddingIntegration />

 :::info URL configuration
-Use the root URL of your WUD instance, for example `https://wud.example.com`. Homarr calls the `/api/app` and `/api/containers` endpoints under that URL automatically.
+Use the root URL of your WUD instance, for example `https://wud.example.com`. Homarr uses `/api/containers` under that URL for both connection testing and widget data.
 :::

 ### Secrets

-WUD does not require authentication by default. If your instance is protected with [Basic Authentication](https://github.com/getwud/wud/blob/main/docs/configuration/authentications/basic/README.md), you can provide a username and password.
+WUD 9 requires authentication. Enter your WUD username and password in Homarr; the initial admin credentials configured with `WUD_AUTH_ADMIN_USER` and `WUD_AUTH_ADMIN_PASSWORD` work with Basic authentication. Older WUD versions without authentication can leave both fields empty.
+
+Credentials are sent to the configured URL over HTTP or HTTPS. Use HTTPS outside a trusted internal network.

 <IntegrationSecrets
  secrets={[
@@ -40,7 +42,7 @@ WUD does not require authentication by default. If your instance is protected wi
    {
      credentials: ["username", "password"],
      steps: [
-        "Open your WUD instance's configuration and configure a WUD_AUTH_BASIC_* user as described in the WUD documentation",
+        "Use your WUD account credentials; older versions can use a configured WUD_AUTH_BASIC_* user",
        "Enter that username and password in Homarr — Basic authentication is handled automatically",
      ],
    },
@@ -27,6 +27,12 @@ session cookie.
 API keys do not expire automatically and act as the user that created them. Every request uses that user's group and
 resource permissions.

+## Invitation dates
+
+`POST /api/invites` and the tRPC `invite.createInvite` procedure accept `expirationDate` as an ISO 8601 timestamp with a
+timezone, for example `2026-12-01T18:00:00Z`. Homarr validates the timestamp and stores it as a date. tRPC callers should
+send the ISO string rather than a JavaScript `Date` object.
+
 ## Health probes

 The liveness endpoint does not require authentication:
@@ -64,3 +64,8 @@ Below you can find instructions for some of the integrations.
 Since version 6 of Pi-hole, the web interface can be accessed through HTTPS.
 The certificate can be found in the path `/etc/pihole/tls_ca.crt`. To add the certificate, this file needs to be copied and uploaded to Homarr.
 You can find more details regarding SSL / TLS for Pi-hole [here](https://docs.pi-hole.net/api/tls/).
+
+### Proxmox
+
+For the default Proxmox VE cluster certificates, trust the cluster CA from `/etc/pve/pve-root-ca.pem` on any node.
+See [Proxmox certificate management](https://pve.proxmox.com/wiki/Certificate_Management).
@@ -57,5 +57,5 @@ Legacy definitions show **Migration required**. The migration prompt excludes cr
 describe the visible behavior separately, import the returned v2 definition, and verify it before removing the archived
 version.

-Back up the database and `SECRET_ENCRYPTION_KEY` before upgrading or rolling back. Multi-replica installations must use
-the same Redis service so cached responses invalidate consistently.
+Keep `SECRET_ENCRYPTION_KEY` unchanged when updating Homarr so existing credentials remain readable. Multi-replica
+installations must use the same Redis service so cached responses invalidate consistently.
@@ -3,10 +3,28 @@
 Most widgets use a single source named `default`; the manifest must contain it. Extra keyed sources are available for widgets
 that combine APIs. Source IDs are case-insensitively unique. Base URLs must use HTTP(S), contain no embedded credentials,
 query string, or fragment, and sources can be `public`, `private`, or `loopback`. Authentication is `none`, `bearer`,
-`basic`, an API-key header, or an API-key query parameter. Credentials belong to the widget but remain outside its manifest.
+`basic`, an API-key header, or an API-key query parameter. HTTP source credentials belong to the widget but remain outside its manifest.
 Source origins are fixed by the definition and source-setup flow; widget options and invocation parameters cannot redirect a
 request to a different origin.

+## Existing integrations
+
+Sources can reuse any configured HTTP integration, including its saved credentials and login session. WebSocket-only integrations and the internal mock integration are excluded:
+
+```json
+{
+  "sources": { "default": { "type": "integration", "integrationKind": "sonarr" } },
+  "requests": { "queue": { "path": "/api/v3/queue" } }
+}
+```
+
+Select the local instance during source setup. Homarr uses its current URL, API key, and trusted certificates;
+paths append to the saved URL, including reverse-proxy subpaths. Changing the integration updates all sources bound to it.
+Deleting it leaves the widget unconfigured until another instance is selected. The binding is shared by every placement
+of that widget definition. Exports and Workshop submissions retain the required type and omit the local integration ID.
+
+Arbitrary integration requests require integration `full` access, including GET requests: service APIs can expose credentials or change state through reads. Board permissions still apply separately. Saved credentials are redacted from upstream responses. Non-GET integration requests must be actions. Requests and redirects stay within the configured URL path. Expired sessions are refreshed; queries can retry once, while actions require another explicit invocation.
+
 ## Named requests

 Requests are keyed by ID. `source`, `kind`, `method`, `trigger`, `auth`, and `permission` have sensible defaults, so a load query can be as small as:
@@ -8,18 +8,17 @@ tags:

 # Model Context Protocol (MCP)

-Homarr exposes a stateless [Model Context Protocol](https://modelcontextprotocol.io) server at `/api/mcp`. It maps the
-current Homarr API to tools for compatible AI clients.
+Connect an AI client to Homarr to manage boards, apps, integrations, and other services through MCP tools.
+
+Homarr uses MCP v2 (protocol `2026-07-28`) at `/api/mcp`, with compatibility for 2025 Streamable HTTP clients.
+Requests are stateless: each request authenticates independently, without an MCP session ID.

 ![The AI / MCP management tab](./img/mcp.png)

-The endpoint implements MCP `2026-07-28` and accepts 2025 Streamable HTTP clients through a compatibility path. The old
-`/api/mcp/mcp` route remains as an alias; use `/api/mcp` for new clients.
+## Connect a client

-## Configure a client
-
-Create an API key under **Management → Tools → API → Authentication**, then add the endpoint and header to the client's
-MCP configuration:
+Create an API key under **Management → Tools → API → Authentication**. Add this configuration to your client,
+replacing the URL and API key:

 ```json
 {
@@ -34,7 +33,10 @@ MCP configuration:
 }
 ```

-Clients without Streamable HTTP support can use `mcp-remote` over STDIO:
+Use the complete key, including the ID, dot, and token. Keep it private and use HTTPS for remote connections.
+The **AI / MCP** tab on Homarr's API page provides your endpoint, configuration, and available tools.
+
+For clients that only support STDIO, use `mcp-remote`:

 ```json
 {
@@ -47,26 +49,30 @@ Clients without Streamable HTTP support can use `mcp-remote` over STDIO:
 }
 ```

-The **AI / MCP** tab on Homarr's API page shows the current endpoint, configuration, and generated tool catalog. Filter
-the catalog by namespace, tool name, or description; matching categories expand automatically.
+### OAuth

-## Authentication and permissions
+Clients with OAuth support can authorize through OAuth 2.1 with PKCE instead of an API key.
+Homarr publishes discovery metadata under `/.well-known/`.

-MCP supports API keys and OAuth 2.1 with PKCE. API keys are simpler for direct client configuration; OAuth is available
-for clients that support dynamic authorization.
+If your reverse proxy does not preserve the public host and protocol, set `BASE_URL` to your public origin,
+such as `https://homarr.example.com`, without a path.

-When Homarr is behind a reverse proxy that does not preserve the public host and protocol, set `BASE_URL` to the exact
-public origin, for example `https://homarr.example.com`. Do not include a path. OAuth clients discover the authorization
-server and protected resource through Homarr's `/.well-known/` routes.
+## Permissions and tools

-Tools use the permissions of the API key owner or authorized user. Creating a key does not grant additional access.
-Custom Widget and Workshop authoring tools, prompts, and resources are visible only to administrators.
+Tools use the permissions of the API key owner or OAuth user. Queries read data; mutations change it.
+Inspect the **AI / MCP** tab or your client's tool list for available actions.

-Use HTTPS when the endpoint crosses an untrusted network.
+Custom Widget and Workshop authoring tools, prompts, and resources require administrator access.
+For Custom Widgets, install the official skill and follow the preview-and-evidence workflow described in
+[Connect an agent](./custom-widgets/agent-authoring). Secret values are configured in Homarr and are never returned
+through MCP.

-## Verify the endpoint
+The built-in [Assistant](./assistant) uses the same tool catalog with the current Homarr session and asks for approval
+before mutations by default.

-The 2025 compatibility path accepts a compact `tools/list` request:
+## Verify the connection
+
+This request lists tools through the older-client compatibility path. It checks authentication and tool discovery:

 ```sh
 curl -X POST \
@@ -77,17 +83,14 @@ curl -X POST \
  https://homarr.example.com/api/mcp
 ```

-The removed HTTP+SSE `/sse` and `/message` transports return `410 Gone`.
+A successful discovery or initialization response alone does not verify that tools can be listed.

-## Tools and resources
+## Troubleshooting

-The generated catalog includes available board, app, integration, Docker, Kubernetes, media, DNS, download, and other
-Homarr procedures. Queries are read-only; mutations change state. The exact catalog depends on the release and current
-user permissions, so inspect `tools/list` or the table in Homarr instead of relying on a static list.
-
-For Custom Widgets, install the official skill and follow the preview-and-evidence workflow described in
-[Connect an agent](./custom-widgets/agent-authoring). Secret values are configured in Homarr and are never returned
-through MCP.
-
-The built-in [Assistant](./assistant) uses the same tool catalog with the current Homarr session and asks for approval
-before mutations by default.
+- **`invalid_token`**: copy the complete API key in `<id>.<token>` format.
+- **Missing tools**: check the user's permissions. Invalid tool schemas and duplicate names are omitted; check server
+  logs for `MCP tool omitted from catalog` and report the diagnostic with your Homarr version. Exclude API keys.
+- **`Date cannot be represented in JSON Schema`**: update Homarr. Older versions could fail to list all tools because
+  of an unsupported date schema.
+- **`410 Gone` on `/sse` or `/message`**: use `/api/mcp` with a Streamable HTTP client. The old `/api/mcp/mcp` URL remains
+  an alias.
@@ -18,6 +18,10 @@ password. Decimal units are the default. Change them from the user form or **Com
 Preferences → Data size units**. Byte rates follow the same preference; bit rates stay decimal and use labels such as
 Mb/s. Deleting a user does not delete boards they created.

+In demo mode (`DEMO_MODE=true`), user deletion, password changes, and local username changes are disabled for everyone,
+including administrators, even when `DEMO_READ_ONLY=false` allows other changes. With demo editing enabled, other
+profile preferences remain editable. This applies to the UI and API.
+
 ![The Users management page](../img/users.png)

 ## Groups
@@ -12,7 +12,7 @@ import { appWidget } from ".";
 <WidgetHeader widget={appWidget} categories={["Links", "Apps"]} />

 The App widget opens an application or website and can show whether Homarr can reach it. Configure the target and status
-check from the tile's edit actions.
+check from the tile's edit actions. In view mode, right-click uses the browser's link menu; Homarr's widget menu remains available in edit mode.

 ### Adding the widget

@@ -22,6 +22,8 @@ one-row widgets. Horizontal, vertical, compact-grid, and icon-only layouts keep
 preserves its configured columns when the dashboard is scaled. Bookmark cards, icons, text, and gaps keep the same
 visual density when a low-column dashboard is enlarged to fill the screen.

+Right-click a bookmark link in view mode to use the browser menu, including opening it in a new tab or copying its address.
+
 ### Screenshots

 import gridIconsOnly from "./img/grid-icons-only.png";
@@ -0,0 +1,43 @@
+---
+title: "llama.cpp"
+description: "Displays the health, loaded model and generation speed of a local llama.cpp llama-server."
+hide_title: true
+---
+
+import { WidgetHeader } from "@site/src/components/widgets/header";
+import { AddingWidget } from "@site/src/components/widgets/adding";
+import { WidgetConfig } from "@site/src/components/widgets/configuration";
+import { WidgetIntegrations } from "@site/src/components/widgets/integrations";
+import { llamacppWidget } from ".";
+import { llamacppIntegration } from "@site/docs/integrations/llama-cpp";
+
+<WidgetHeader widget={llamacppWidget} categories={["System Monitoring"]} />
+
+This widget shows the live status of your local [llama.cpp](https://github.com/ggml-org/llama.cpp) `llama-server`: whether it is online, which model is loaded (with quantization, context size, file size and parameter count), the generation speed in tokens per second, and how many requests are being processed. When the server is started with `--metrics`, it also reports total token counts and the prompt cache hit rate.
+
+### Generation speed
+
+The widget picks the most meaningful speed for the current state (hover the speed for an explanation of which one is shown):
+
+- **While a request is being generated** — the average speed of that request since it started, derived from the token count reported by `/slots`.
+- **While the server is busy but the per-request data is unavailable** — the live speed from the `/metrics` rate gauge.
+- **While the server is idle** — the average generation speed since the server started (cumulative tokens ÷ seconds), so the value stays meaningful instead of dropping to zero.
+
+### Supported Integrations
+
+<WidgetIntegrations
+  items={[
+    {
+      integration: llamacppIntegration,
+      note: "Displays health, model details, generation speed and request status",
+    },
+  ]}
+/>
+
+### Adding the widget
+
+<AddingWidget />
+
+### Configuration
+
+<WidgetConfig configuration={llamacppWidget.configuration} />
@@ -0,0 +1,37 @@
+import { WidgetDefinition } from "@site/src/types";
+import { IconCpu } from "@tabler/icons-react";
+
+export const llamacppWidget: WidgetDefinition = {
+  icon: IconCpu,
+  name: "llama.cpp",
+  description: "Shows the health, loaded model and generation speed of a local llama.cpp llama-server.",
+  path: "../../widgets/llama-cpp",
+  configuration: {
+    items: [
+      {
+        name: "Show title",
+        description: "Displays the llama.cpp label and status badge at the top of the widget",
+        values: { type: "boolean" },
+        defaultValue: "yes",
+      },
+      {
+        name: "Show model info",
+        description: "Displays the loaded model name, quantization, context size and file size",
+        values: { type: "boolean" },
+        defaultValue: "yes",
+      },
+      {
+        name: "Show cache hit rate",
+        description: "Displays the prompt cache hit rate as a percentage bar",
+        values: { type: "boolean" },
+        defaultValue: "yes",
+      },
+      {
+        name: "Show context usage",
+        description: "Displays the context (KV cache) token usage as a progress bar",
+        values: { type: "boolean" },
+        defaultValue: "yes",
+      },
+    ],
+  },
+};
@@ -41,6 +41,7 @@ import temperature from "./img/temperature.png";
 ### Interactions

 - Toggle entity state by clicking on the entity (only when clickable enabled).
+- After a successful toggle, the displayed state refreshes immediately.
 - If Homarr cannot refresh an entity, the last known state stays visible but toggling is disabled until the connection recovers.

 <WidgetInteractionGuide />
@@ -51,4 +51,6 @@ import withDisplayname from "./img/with-displayname.png";

 ### Configuration

+Use the Home Assistant entity ID (for example, `automation.turn_on_lights`) in the **Automation ID** field, not the automation's internal ID.
+
 <WidgetConfig configuration={smartHomeExecuteAutomationWidget.configuration} />
@@ -32,6 +32,7 @@ import type { WorkshopSubmission, WorkshopVote } from "@site/src/lib/pocketbase"
 import { getWorkshopBackend } from "@site/src/lib/pocketbase";
 import { getRuntimeWorkshopApiUrl } from "@site/src/lib/runtime-config";
 import type { SubmissionType } from "@site/src/lib/workshop-schema";
+import { integrationDefs, isHttpIntegrationKind } from "@homarr/definitions";
 import type { HomarrCustomWidgetV2 } from "@homarr/custom-widgets/core";
 import {
  githubAvatarUrl,
@@ -96,7 +97,15 @@ const isNotFound = (caught: unknown) =>

 const avatarFallback = (name: string) => name.trim().slice(0, 1).toUpperCase() || "?";

-const sourceHost = (baseUrl: string) => {
+type WidgetSource = HomarrCustomWidgetV2["sources"][string];
+
+const sourceHost = (source: WidgetSource) => {
+  if (source.type === "integration") {
+    if (isHttpIntegrationKind(source.integrationKind))
+      return `${integrationDefs[source.integrationKind].name} integration`;
+    return `${source.integrationKind} integration`;
+  }
+  const { baseUrl } = source;
  try {
    return new URL(baseUrl).host;
  } catch {
@@ -104,26 +113,30 @@ const sourceHost = (baseUrl: string) => {
  }
 };

-const sourceAuthLabel = (auth: HomarrCustomWidgetV2["sources"][string]["auth"]) => {
-  if (typeof auth === "string")
-    return auth === "none" ? "No credentials" : auth === "basic" ? "Basic auth" : "Bearer token";
-  return auth.type === "apiKeyHeader" ? `API key header · ${auth.name}` : `API key query · ${auth.name}`;
+const sourceAuthLabel = (source: WidgetSource) => {
+  if (source.type === "integration") return "Uses stored integration credentials";
+  const { auth } = source;
+  if (auth === "none") return "No credentials";
+  if (auth === "basic") return "Basic auth";
+  if (auth === "bearer") return "Bearer token";
+  if (auth.type === "apiKeyHeader") return `API key header · ${auth.name}`;
+  return `API key query · ${auth.name}`;
 };

-const sourceNeedsSecret = (auth: HomarrCustomWidgetV2["sources"][string]["auth"]) => auth !== "none";
+const sourceNeedsSecret = (source: WidgetSource) => source.type === "integration" || source.auth !== "none";

 const WidgetSafetySummary = ({ widget }: { widget: HomarrCustomWidgetV2 }) => {
  const sources = Object.entries(widget.sources);
  const requests = Object.values(widget.requests);
-  const protectedSources = sources.filter(([, source]) => sourceNeedsSecret(source.auth));
+  const protectedSources = sources.filter(([, source]) => sourceNeedsSecret(source));
  const queryCount = requests.filter((request) => request.kind === "query").length;
  const actionCount = requests.filter((request) => request.kind === "action").length;
  const credentialLabel =
    protectedSources.length === 0
      ? "None required"
      : protectedSources.length === 1
-        ? sourceAuthLabel(protectedSources[0][1].auth)
-        : `${protectedSources.length} credentials required`;
+        ? sourceAuthLabel(protectedSources[0][1])
+        : `${protectedSources.length} authenticated sources`;

  return (
    <section
@@ -152,9 +165,9 @@ const WidgetSafetySummary = ({ widget }: { widget: HomarrCustomWidgetV2 }) => {
          <dd className="mt-1.5 space-y-1.5">
            {sources.slice(0, 2).map(([id, source]) => (
              <span key={id} className="flex min-w-0 items-center justify-between gap-2">
-                <span className="truncate font-mono text-xs font-medium">{sourceHost(source.baseUrl)}</span>
+                <span className="truncate font-mono text-xs font-medium">{sourceHost(source)}</span>
                <Badge variant="secondary" className="shrink-0 font-normal">
-                  {source.networkScope}
+                  {source.networkScope ?? "integration"}
                </Badge>
              </span>
            ))}
@@ -536,7 +549,7 @@ const MarketplaceDetail = ({ workshopUrl }: { workshopUrl: string }) => {
  const sources = widgetDefinition ? Object.entries(widgetDefinition.sources) : [];
  const requests = widgetDefinition ? Object.entries(widgetDefinition.requests) : [];
  const options = widgetDefinition ? Object.entries(widgetDefinition.options) : [];
-  const protectedSources = sources.filter(([, source]) => sourceNeedsSecret(source.auth));
+  const protectedSources = sources.filter(([, source]) => sourceNeedsSecret(source));
  const displayedContent = formatWorkshopContent(submission.type, submission.content);
  const socialTitle = `${submission.title} · Homarr Workshop`;
  const socialDescription = `${typeSocialLabels[submission.type]} for Homarr. ${submission.description}`.trim();
@@ -779,11 +792,11 @@ const MarketplaceDetail = ({ workshopUrl }: { workshopUrl: string }) => {
                        <div className="flex items-center justify-between gap-2 text-sm">
                          <span className="truncate font-medium">{source.name || id}</span>
                          <Badge variant="secondary" className="shrink-0">
-                            {source.networkScope}
+                            {source.networkScope ?? "integration"}
                          </Badge>
                        </div>
-                        <p className="truncate text-xs text-muted-foreground">{sourceHost(source.baseUrl)}</p>
-                        <p className="mt-0.5 text-xs text-muted-foreground">{sourceAuthLabel(source.auth)}</p>
+                        <p className="truncate text-xs text-muted-foreground">{sourceHost(source)}</p>
+                        <p className="mt-0.5 text-xs text-muted-foreground">{sourceAuthLabel(source)}</p>
                      </div>
                    ))}
                  </div>
@@ -2304,7 +2304,8 @@
                      "traefik",
                      "customApi",
                      "assistant",
-                      "wud"
+                      "wud",
+                      "llamacpp"
                    ]
                  },
                  "options": {
@@ -2572,7 +2573,9 @@
                "type": "object",
                "properties": {
                  "expirationDate": {
-                    "type": "string"
+                    "type": "string",
+                    "format": "date-time",
+                    "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
                  }
                },
                "required": [
@@ -16,6 +16,9 @@ import {
 } from "@mantine/core";
 import { IconCheck, IconKey, IconLock } from "@tabler/icons-react";

+import type { CustomWidgetSource } from "@homarr/custom-widgets/core";
+import { IntegrationSourceSelect } from "~/components/custom-widgets/integration-source-select";
+
 import { useI18n } from "@homarr/translation/client";

 interface RequestDetails {
@@ -24,10 +27,7 @@ interface RequestDetails {
  kinds: Array<"apiKey" | "username" | "password">;
  expiresAt: number;
  status: "pending" | "completed";
-  source: {
-    baseUrl: string;
-    networkScope: "public" | "private" | "loopback";
-  };
+  source: CustomWidgetSource;
 }

 export function CustomWidgetConfigurationEntry({ token }: { token: string }) {
@@ -35,6 +35,7 @@ export function CustomWidgetConfigurationEntry({ token }: { token: string }) {
  const tSecret = useI18n("customWidget.secret");
  const [details, setDetails] = useState<RequestDetails | null>(null);
  const [values, setValues] = useState<Record<string, string>>({});
+  const [integrationId, setIntegrationId] = useState<string>();
  const [baseUrl, setBaseUrl] = useState("");
  const [networkScope, setNetworkScope] = useState<"public" | "private" | "loopback">("public");
  const [error, setError] = useState<string | null>(null);
@@ -47,8 +48,9 @@ export function CustomWidgetConfigurationEntry({ token }: { token: string }) {
        const body = (await response.json()) as RequestDetails | { error: string };
        if (!response.ok || "error" in body) throw new Error("error" in body ? body.error : t("unavailable"));
        setDetails(body);
-        setBaseUrl(body.source.baseUrl);
-        setNetworkScope(body.source.networkScope);
+        setBaseUrl(body.source.baseUrl ?? "");
+        setNetworkScope(body.source.networkScope ?? "public");
+        setIntegrationId(body.source.integrationId);
      })
      .catch((cause: unknown) => setError(cause instanceof Error ? cause.message : t("unavailable")))
      .finally(() => setLoading(false));
@@ -58,10 +60,12 @@ export function CustomWidgetConfigurationEntry({ token }: { token: string }) {
    setSaving(true);
    setError(null);
    try {
+      let configuration: unknown = { baseUrl, networkScope, secrets: values };
+      if (details?.source.type === "integration") configuration = { integrationId, secrets: {} };
      const response = await fetch(`/api/custom-widgets/configuration-request/${encodeURIComponent(token)}`, {
        method: "POST",
        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ baseUrl, networkScope, secrets: values }),
+        body: JSON.stringify(configuration),
      });
      const body = (await response.json()) as { status?: string; error?: string };
      if (!response.ok) throw new Error(body.error ?? t("saveError"));
@@ -102,20 +106,31 @@ export function CustomWidgetConfigurationEntry({ token }: { token: string }) {
                  {t("source", { name: details.sourceName })}
                </Text>
              </Card>
-              <TextInput
-                label={t("baseUrl")}
-                type="url"
-                value={baseUrl}
-                onChange={(event) => setBaseUrl(event.currentTarget.value)}
-                required
-              />
-              <Select
-                label={t("networkScope")}
-                data={["public", "private", "loopback"]}
-                value={networkScope}
-                allowDeselect={false}
-                onChange={(value) => value && setNetworkScope(value as typeof networkScope)}
-              />
+              {details.source.type === "integration" && (
+                <IntegrationSourceSelect
+                  kind={details.source.integrationKind}
+                  integrationId={integrationId}
+                  onChange={setIntegrationId}
+                />
+              )}
+              {details.source.type !== "integration" && (
+                <>
+                  <TextInput
+                    label={t("baseUrl")}
+                    type="url"
+                    value={baseUrl}
+                    onChange={(event) => setBaseUrl(event.currentTarget.value)}
+                    required
+                  />
+                  <Select
+                    label={t("networkScope")}
+                    data={["public", "private", "loopback"]}
+                    value={networkScope}
+                    allowDeselect={false}
+                    onChange={(value) => value && setNetworkScope(value as typeof networkScope)}
+                  />
+                </>
+              )}
              {details.kinds.map((kind) => {
                const Input = kind === "username" ? TextInput : PasswordInput;
                return (
@@ -132,7 +147,10 @@ export function CustomWidgetConfigurationEntry({ token }: { token: string }) {
              })}
              <Button
                loading={saving}
-                disabled={!URL.canParse(baseUrl) || details.kinds.some((kind) => !values[kind])}
+                disabled={
+                  (details.source.type === "integration" ? !integrationId : !URL.canParse(baseUrl)) ||
+                  details.kinds.some((kind) => !values[kind])
+                }
                onClick={() => void submit()}
              >
                {t("save")}
@@ -1,43 +1,12 @@
-import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";

 import { buildCustomWidgetAiPrompt } from "@homarr/custom-widgets/authoring-prompt";

 describe("Copy AI prompt", () => {
-  it("uses one self-contained prompt without an embedded-skill branch", () => {
-    const source = readFileSync(
-      `${process.cwd()}/apps/nextjs/src/app/[locale]/manage/custom-widgets/_copy-ai-prompt-button.tsx`,
-      "utf8",
-    );
-    expect(source).toContain("buildCustomWidgetAiPrompt");
-    expect(source).not.toContain("embedded-authoring-prompt");
-    expect(source).not.toContain("Menu");
-  });
-
  it("copies a complete prompt within the public size limit", () => {
    const prompt = buildCustomWidgetAiPrompt(undefined, null, null, "Create a Pokédex");
    expect(prompt.length).toBeLessThanOrEqual(12_000);
    expect(prompt).toContain("exactly one complete `json` fenced block");
    expect(prompt).toContain("Put the complete JSX source directly in the `template` string");
  });
-
-  it("keeps AI actions and section navigation readable on narrow screens", () => {
-    const card = readFileSync(
-      `${process.cwd()}/apps/nextjs/src/app/[locale]/manage/custom-widgets/_custom-widget-ai-card.tsx`,
-      "utf8",
-    );
-    const styles = readFileSync(
-      `${process.cwd()}/apps/nextjs/src/app/[locale]/manage/custom-widgets/_custom-widget-form.module.css`,
-      "utf8",
-    );
-    const actions = readFileSync(
-      `${process.cwd()}/apps/nextjs/src/app/[locale]/manage/custom-widgets/_copy-ai-prompt-button.tsx`,
-      "utf8",
-    );
-    expect(card).toContain('<Accordion variant="contained">');
-    expect(card).not.toContain("defaultValue");
-    expect(actions).toContain("<ActionIcon");
-    expect(styles).toContain(".sectionNav > a");
-    expect(styles).toContain("flex: 0 0 auto");
-  });
 });
@@ -1,36 +0,0 @@
-import { readFileSync } from "node:fs";
-import { describe, expect, it } from "vitest";
-
-const readSource = (path: string) => readFileSync(`${process.cwd()}/${path}`, "utf8");
-
-describe("legacy custom widget migration UI", () => {
-  it("keeps legacy definitions visible and exposes the redacted LLM workflow", () => {
-    const list = readSource("apps/nextjs/src/app/[locale]/manage/custom-widgets/_custom-widget-list.tsx");
-    const actions = readSource("apps/nextjs/src/app/[locale]/manage/custom-widgets/_custom-widget-actions.tsx");
-
-    expect(list).toContain("widget.migrationRequired");
-    expect(list).toContain('t("page.list.migrationInstructions")');
-    expect(actions).toContain("legacyMigrationPrompt.fetch");
-    expect(actions).toContain("navigator.clipboard.writeText(result.prompt)");
-    expect(actions).toContain("navigator.clipboard.readText()");
-    expect(actions).toContain('t("action.pasteMigration")');
-    expect(actions).toContain("parseCustomWidgetClipboardDetailed");
-    expect(actions).toContain("legacyId={widget.id}");
-  });
-
-  it("replaces the legacy record through migration and refreshes every consumer", () => {
-    // The import pipeline is shared by the dialog and the Workshop install page.
-    const importer = readSource("apps/nextjs/src/components/custom-widgets/use-custom-widget-import.ts");
-    const dialog = readSource("apps/nextjs/src/components/custom-widgets/custom-widget-import-dialog.tsx");
-
-    expect(importer).toContain("customWidget.migrateLegacy.useMutation");
-    expect(importer).toMatch(
-      /migrateMutation\.mutate\(\{\s*id: legacyId,\s*widget: configuredWidget,\s*secrets,?\s*\}\)/u,
-    );
-    expect(importer).toContain("utils.customWidget.list.invalidate()");
-    expect(importer).toContain("utils.customWidget.available.invalidate()");
-    expect(importer).toContain("utils.widget.customApi.getData.invalidate()");
-    expect(dialog).toContain("useCustomWidgetImport({");
-    expect(dialog).toContain("legacyId,");
-  });
-});
@@ -1,6 +1,5 @@
 // @vitest-environment jsdom

-import { readFileSync } from "node:fs";
 import { act } from "react";
 import { createRoot } from "react-dom/client";
 import type { Root } from "react-dom/client";
@@ -76,16 +75,6 @@ afterEach(async () => {
 });

 describe("Custom Widget preview panel", () => {
-  test("inherits the application theme instead of forcing a reload-sensitive preview theme", () => {
-    const source = readFileSync(
-      `${process.cwd()}/apps/nextjs/src/app/[locale]/manage/custom-widgets/_custom-widget-preview-panel.tsx`,
-      "utf8",
-    );
-
-    expect(source).not.toContain("forceColorScheme");
-    expect(source).not.toContain("onThemeChange");
-  });
-
  test("contains invalid definitions inside the widget canvas while keeping every inspection tab", async () => {
    await act(async () => {
      root.render(
@@ -4,9 +4,15 @@ import { Button, Fieldset, Group, PasswordInput, Select, Stack, TextInput } from
 import { IconKey, IconTrash } from "@tabler/icons-react";

 import { getCustomWidgetSourceUrlIssue } from "@homarr/custom-widgets/core";
-import type { CustomWidgetSource, CustomWidgetSourceUrlIssue } from "@homarr/custom-widgets/core";
+import type {
+  CustomWidgetHttpSource,
+  CustomWidgetSource,
+  CustomWidgetSourceUrlIssue,
+} from "@homarr/custom-widgets/core";
 import { useI18n } from "@homarr/translation/client";

+import { IntegrationSourceSelect } from "~/components/custom-widgets/integration-source-select";
+
 import type { CustomWidgetWorkbenchForm } from "./_custom-widget-form-utils";
 import { CustomWidgetIdentifierInput } from "./_custom-widget-identifier-input";

@@ -52,9 +58,6 @@ export function CustomWidgetSourceField({
  onRemove,
 }: CustomWidgetSourceFieldProps) {
  const t = useI18n("customWidget.workbench.sources");
-  const tSecret = useI18n("customWidget.secret");
-  const baseUrlIssue = getCustomWidgetSourceUrlIssue(source.baseUrl);
-  const authType = typeof source.auth === "string" ? source.auth : source.auth.type;

  return (
    <Fieldset legend={index === 0 ? t("primary") : source.name}>
@@ -73,72 +76,41 @@ export function CustomWidgetSourceField({
            onChange={(event) => onUpdate(index, { name: event.currentTarget.value })}
          />
        </Group>
-        <TextInput
-          label={t("baseUrl")}
-          type="url"
-          value={source.baseUrl}
-          error={baseUrlIssue ? t(sourceUrlErrorKeys[baseUrlIssue]) : undefined}
-          onChange={(event) => onUpdate(index, { baseUrl: event.currentTarget.value })}
+        <Select
+          label={t("sourceType")}
+          data={[
+            { value: "http", label: t("manualSource") },
+            { value: "integration", label: t("existingIntegration") },
+          ]}
+          value={source.type ?? "http"}
+          allowDeselect={false}
+          onChange={(type) => {
+            if (type === "integration") onUpdate(index, { type, integrationKind: "sonarr" });
+            else if (type === "http")
+              onUpdate(index, { type, baseUrl: "https://example.com", networkScope: "public", auth: "none" });
+          }}
        />
-        <Group grow align="start">
-          <Select
-            label={t("networkScope")}
-            data={["public", "private", "loopback"]}
-            value={source.networkScope}
-            onChange={(value) =>
-              value && onUpdate(index, { networkScope: value as CustomWidgetSource["networkScope"] })
-            }
-            allowDeselect={false}
-          />
-          <Select
-            label={t("authentication")}
-            data={["none", "bearer", "basic", "apiKeyHeader", "apiKeyQuery"]}
-            value={authType}
-            onChange={(value) => onSetAuthentication(index, value ?? "none")}
-            allowDeselect={false}
-          />
-        </Group>
-        {typeof source.auth === "object" && source.auth.type === "apiKeyHeader" && (
-          <TextInput
-            label={t("headerName")}
-            value={source.auth.name}
-            onChange={(event) => onUpdate(index, { auth: { type: "apiKeyHeader", name: event.currentTarget.value } })}
+        {source.type === "integration" && (
+          <IntegrationSourceSelect
+            kind={source.integrationKind}
+            integrationId={source.integrationId}
+            onChange={(integrationId) => onUpdate(index, { integrationId })}
+            onKindChange={(integrationKind) => onUpdate(index, { integrationKind, integrationId: undefined })}
          />
        )}
-        {typeof source.auth === "object" && source.auth.type === "apiKeyQuery" && (
-          <TextInput
-            label={t("queryParameter")}
-            value={source.auth.name}
-            onChange={(event) => onUpdate(index, { auth: { type: "apiKeyQuery", name: event.currentTarget.value } })}
+        {source.type !== "integration" && (
+          <CustomWidgetHttpSourceFields
+            source={source}
+            index={index}
+            form={form}
+            definitionId={definitionId}
+            clearSecretPending={clearSecretPending}
+            onUpdate={onUpdate}
+            onSetAuthentication={onSetAuthentication}
+            onSetSecret={onSetSecret}
+            onClearSecret={onClearSecret}
          />
        )}
-        {(secretFields[authType] ?? []).map(({ kind }) => {
-          const secret = form.values.secrets.find((entry) => entry.sourceId === source.id && entry.kind === kind);
-          const Input = kind === "username" ? TextInput : PasswordInput;
-          return (
-            <Group key={kind} align="end" wrap="nowrap">
-              <Input
-                style={{ flex: 1 }}
-                label={tSecret(kind)}
-                value={secret?.value ?? ""}
-                placeholder={secret?.hasValue ? t("configured") : undefined}
-                leftSection={<IconKey size={15} />}
-                onChange={(event) => onSetSecret(source.id, kind, event.currentTarget.value)}
-              />
-              {definitionId && secret?.hasValue && (
-                <Button
-                  type="button"
-                  color="red"
-                  variant="subtle"
-                  loading={clearSecretPending}
-                  onClick={() => void onClearSecret(source.id, kind)}
-                >
-                  {t("clear")}
-                </Button>
-              )}
-            </Group>
-          );
-        })}
        {index > 0 && (
          <Button
            type="button"
@@ -154,3 +126,88 @@ export function CustomWidgetSourceField({
    </Fieldset>
  );
 }
+
+function CustomWidgetHttpSourceFields({
+  source,
+  index,
+  form,
+  definitionId,
+  clearSecretPending,
+  onUpdate,
+  onSetAuthentication,
+  onSetSecret,
+  onClearSecret,
+}: Omit<CustomWidgetSourceFieldProps, "source" | "onRemove"> & { source: CustomWidgetHttpSource & { id: string } }) {
+  const t = useI18n("customWidget.workbench.sources");
+  const tSecret = useI18n("customWidget.secret");
+  const baseUrlIssue = getCustomWidgetSourceUrlIssue(source.baseUrl);
+  const authType = typeof source.auth === "string" ? source.auth : source.auth.type;
+  return (
+    <>
+      <TextInput
+        label={t("baseUrl")}
+        type="url"
+        value={source.baseUrl}
+        error={baseUrlIssue ? t(sourceUrlErrorKeys[baseUrlIssue]) : undefined}
+        onChange={(event) => onUpdate(index, { baseUrl: event.currentTarget.value })}
+      />
+      <Group grow align="start">
+        <Select
+          label={t("networkScope")}
+          data={["public", "private", "loopback"]}
+          value={source.networkScope}
+          onChange={(value) => value && onUpdate(index, { networkScope: value as CustomWidgetSource["networkScope"] })}
+          allowDeselect={false}
+        />
+        <Select
+          label={t("authentication")}
+          data={["none", "bearer", "basic", "apiKeyHeader", "apiKeyQuery"]}
+          value={authType}
+          onChange={(value) => onSetAuthentication(index, value ?? "none")}
+          allowDeselect={false}
+        />
+      </Group>
+      {typeof source.auth === "object" && source.auth.type === "apiKeyHeader" && (
+        <TextInput
+          label={t("headerName")}
+          value={source.auth.name}
+          onChange={(event) => onUpdate(index, { auth: { type: "apiKeyHeader", name: event.currentTarget.value } })}
+        />
+      )}
+      {typeof source.auth === "object" && source.auth.type === "apiKeyQuery" && (
+        <TextInput
+          label={t("queryParameter")}
+          value={source.auth.name}
+          onChange={(event) => onUpdate(index, { auth: { type: "apiKeyQuery", name: event.currentTarget.value } })}
+        />
+      )}
+      {(secretFields[authType] ?? []).map(({ kind }) => {
+        const secret = form.values.secrets.find((entry) => entry.sourceId === source.id && entry.kind === kind);
+        const Input = kind === "username" ? TextInput : PasswordInput;
+        return (
+          <Group key={kind} align="end" wrap="nowrap">
+            <Input
+              style={{ flex: 1 }}
+              label={tSecret(kind)}
+              value={secret?.value ?? ""}
+              placeholder={secret?.hasValue ? t("configured") : undefined}
+              leftSection={<IconKey size={15} />}
+              onChange={(event) => onSetSecret(source.id, kind, event.currentTarget.value)}
+            />
+            {definitionId && secret?.hasValue && (
+              <Button
+                type="button"
+                color="red"
+                variant="subtle"
+                loading={clearSecretPending}
+                onClick={() => void onClearSecret(source.id, kind)}
+              >
+                {t("clear")}
+              </Button>
+            )}
+          </Group>
+        );
+      })}
+    </>
+  );
+}
@@ -28,6 +28,12 @@ export function CustomWidgetSourcesEditor({
  const clearSecretMutation = clientApi.customWidget.secretClear.useMutation();
  const sources = parseSources(form.values.sources);
  const update = (index: number, changes: Partial<CustomWidgetSource> & { id?: string }) => {
+    if (changes.type) {
+      form.setFieldValue(
+        "secrets",
+        form.values.secrets.filter((secret) => secret.sourceId !== sources[index]?.id),
+      );
+    }
    const previousId = sources[index]?.id;
    const nextId = changes.id ?? previousId;
    if (nextId && sources.some((source, sourceIndex) => sourceIndex !== index && source.id === nextId)) {
@@ -42,7 +48,7 @@ export function CustomWidgetSourcesEditor({
        Object.fromEntries(
          sourceEntries.map(([id, source], i) => [
            i === index ? nextId : id,
-            i === index ? { ...source, ...changes, id: undefined } : source,
+            i === index ? { ...(changes.type ? { name: source.name } : source), ...changes, id: undefined } : source,
          ]),
        ),
        null,
@@ -1,5 +1,6 @@
 "use client";

+import { SourceSetupPanel } from "~/components/custom-widgets/integration-source-select";
 import { useRouter } from "next/navigation";
 import { useMemo } from "react";
 import {
@@ -22,7 +23,7 @@ import { IconAlertTriangle, IconArrowLeft, IconDownload, IconExternalLink, IconF

 import { CUSTOM_WIDGET_SCHEMA } from "@homarr/custom-widgets/core";
 import type { HomarrCustomWidgetV2 } from "@homarr/custom-widgets/core";
-import { CustomWidgetSourceSetupPanel, ImportReviewContent } from "@homarr/custom-widgets/workbench";
+import { ImportReviewContent } from "@homarr/custom-widgets/workbench";
 import { useI18n } from "@homarr/translation/client";
 import { Link } from "@homarr/ui";
 import { useWorkshopReportSummariesQuery, useWorkshopSubmissionQuery } from "@homarr/workshop/backend";
@@ -190,7 +191,7 @@ export function WorkshopDetail({ id }: { id: string }) {
                </Text>
              </Box>
              <ImportReviewContent review={importer.review} messages={importer.reviewMessages}>
-                <CustomWidgetSourceSetupPanel
+                <SourceSetupPanel
                  setups={importer.setups}
                  values={importer.values}
                  onChange={importer.setValue}
@@ -45,7 +45,7 @@ export const InviteCreateForm = ({ onClose }: InviteCreateFormProps) => {
      onSubmit={form.onSubmit((values) => {
        mutate(
          {
-            expirationDate: new Date(values.expirationDate),
+            expirationDate: new Date(values.expirationDate).toISOString(),
          },
          {
            onSuccess: (result) => {
@@ -7,7 +7,7 @@ import { createUIMessageStream, createUIMessageStreamResponse, jsonSchema, stepC
 import { cookies } from "next/headers";
 import { z } from "zod/v4";

-import { createTRPCContext, mcpRouter } from "@homarr/api/mcp";
+import { callMcpTool, createTRPCContext, mcpRouter } from "@homarr/api/mcp";
 import {
  createAssistantGenerationAccessToken,
  getAssistantRequestContextEntitiesAsync,
@@ -547,19 +547,7 @@ export async function POST(request: Request) {
            }
            if (contextRequestKey !== null) loadedCustomWidgetContextRequests.add(contextRequestKey);
            try {
-              const procedure = mcpTool.pathInRouter.reduce<unknown>(
-                (current, segment) =>
-                  (typeof current === "object" || typeof current === "function") && current !== null
-                    ? (current as Record<string, unknown>)[segment]
-                    : undefined,
-                caller,
-              );
-              if (typeof procedure !== "function") {
-                throw new Error("Procedure not callable");
-              }
-              const result = await (procedure as (value: unknown) => Promise<unknown>)(
-                executionInput && Object.keys(executionInput as object).length > 0 ? executionInput : undefined,
-              );
+              const result = await callMcpTool(caller, mcpTool, executionInput);
              customWidgetDiscoveryPhase.observe(mcpTool.name, result);
              return toAssistantToolOutput(result, {
                maxCharacters: getAssistantToolOutputMaxCharacters(mcpTool.name),
@@ -3,6 +3,7 @@ import { NextResponse } from "next/server";

 import {
  claimCustomWidgetConfigurationRequest,
+  assertCustomWidgetIntegrationBindings,
  completeCustomWidgetConfigurationRequest,
  configureCustomWidgetSourceFromRequest,
  configurePreviewSessionSource,
@@ -12,6 +13,7 @@ import {
 import { customWidgetSourceSchema } from "@homarr/custom-widgets/core";
 import { invalidateCustomWidgetResponseCache } from "@homarr/custom-widgets/server";
 import { db } from "@homarr/db";
+import { auth } from "@homarr/auth/next";

 import { adminRoute } from "../../admin";
 import { readConfigurationRequestBody } from "../body";
@@ -52,17 +54,40 @@ const completeConfigurationRequest = async (request: NextRequest, context: Route
    return NextResponse.json({ error: "Enter a valid source configuration." }, { status: 400 });
  }
  const body = parsedBody.data;
-  const sourceResult = customWidgetSourceSchema.safeParse({
-    ...pending.source,
-    baseUrl: body.baseUrl,
-    networkScope: body.networkScope,
-  });
+  let candidate: unknown;
+  if (pending.source.type === "integration") {
+    if (
+      !body.integrationId ||
+      body.baseUrl !== undefined ||
+      body.networkScope !== undefined ||
+      Object.keys(body.secrets).length > 0
+    ) {
+      return NextResponse.json({ error: "Select an existing integration." }, { status: 400 });
+    }
+    candidate = { ...pending.source, integrationId: body.integrationId };
+  } else {
+    if (body.integrationId)
+      return NextResponse.json({ error: "HTTP sources cannot bind an integration." }, { status: 400 });
+    candidate = { ...pending.source, baseUrl: body.baseUrl, networkScope: body.networkScope };
+  }
+  const sourceResult = customWidgetSourceSchema.safeParse(candidate);
  if (!sourceResult.success) {
    return NextResponse.json(
      { error: sourceResult.error.issues[0]?.message ?? "Enter a valid server URL." },
      { status: 400 },
    );
  }
+  try {
+    await assertCustomWidgetIntegrationBindings(
+      { db, session: await auth() },
+      { [pending.sourceId]: sourceResult.data },
+    );
+  } catch {
+    return NextResponse.json(
+      { error: "The selected integration is unavailable or has a different type." },
+      { status: 400 },
+    );
+  }
  const secrets = pending.kinds.flatMap((kind) => {
    const value = body.secrets[kind];
    return typeof value === "string" && value.length > 0 && value.length <= 8192
@@ -95,6 +120,7 @@ const completeConfigurationRequest = async (request: NextRequest, context: Route
      const result = await configureCustomWidgetSourceFromRequest(db, {
        definitionId: claimed.target.id,
        sourceId: claimed.sourceId,
+        integrationId: sourceResult.data.integrationId,
        baseUrl: sourceResult.data.baseUrl,
        networkScope: sourceResult.data.networkScope,
        secrets,
@@ -1,11 +1,17 @@
 import { z } from "zod/v4";

 export const MAX_CONFIGURATION_REQUEST_BODY_BYTES = 24 * 1024;
-const configurationRequestBodySchema = z.strictObject({
-  baseUrl: z.string(),
-  networkScope: z.enum(["public", "private", "loopback"]),
-  secrets: z.record(z.string(), z.string()),
-});
+const configurationRequestBodySchema = z
+  .strictObject({
+    baseUrl: z.string().optional(),
+    integrationId: z.string().min(1).max(100).optional(),
+    networkScope: z.enum(["public", "private", "loopback"]).optional(),
+    secrets: z.record(z.string(), z.string()),
+  })
+  .refine(
+    (value) => Boolean(value.integrationId) || (value.baseUrl !== undefined && value.networkScope !== undefined),
+    "Provide an integration or HTTP connection",
+  );

 export async function readConfigurationRequestBody(
  request: Request,
@@ -2,8 +2,11 @@

 import { beforeEach, describe, expect, test, vi } from "vitest";

+import type * as CatalogModule from "../_extract-tools";
+
 const mocks = vi.hoisted(() => ({
  authenticate: vi.fn(),
+  extractCatalog: vi.fn(),
  ipAddress: vi.fn(() => "127.0.0.1"),
  toolProcedure: vi.fn(),
  loggerWarn: vi.fn(),
@@ -14,7 +17,9 @@ const mocks = vi.hoisted(() => ({
 }));

 vi.mock("next/server", () => ({ userAgent: () => ({ ua: "MCP route test" }) }));
-vi.mock("@homarr/api/mcp", () => ({
+vi.mock("@homarr/api/mcp", async () => ({
+  callMcpTool: (await import("../../../../../../../packages/api/src/mcp-tools")).callMcpTool,
+  extractMcpToolsFromProcedures: mocks.extractCatalog,
  createTRPCContext: vi.fn(() => ({})),
  mcpRouter: { createCaller: vi.fn(() => ({ board: { getAllBoards: mocks.toolProcedure } })) },
 }));
@@ -54,6 +59,7 @@ vi.mock("../_extract-tools", () => ({
      description: "List boards",
      type: "query",
      pathInRouter: ["board", "getAllBoards"],
+      inputMode: "none",
      inputSchema: { type: "object", properties: {} },
    },
    {
@@ -61,6 +67,7 @@ vi.mock("../_extract-tools", () => ({
      description: "List Custom Widgets",
      type: "query",
      pathInRouter: ["customWidget", "list"],
+      inputMode: "none",
      inputSchema: { type: "object", properties: {} },
    },
    {
@@ -68,6 +75,7 @@ vi.mock("../_extract-tools", () => ({
      description: "Search Workshop",
      type: "query",
      pathInRouter: ["customWidget", "workshopSearch"],
+      inputMode: "none",
      inputSchema: { type: "object", properties: {} },
    },
  ],
@@ -305,3 +313,21 @@ describe("MCP protocol errors", () => {
    expect(metadata).not.toHaveProperty("message");
  });
 });
+
+test("logs catalog omissions only when the shared catalog is first built", async () => {
+  const diagnostic = { name: "broken", path: "broken", reason: "invalid_schema" };
+  const tools = [{ name: "valid" }];
+  mocks.extractCatalog.mockReturnValue({ tools, diagnostics: [diagnostic] });
+  const { extractMcpTools } = await vi.importActual<typeof CatalogModule>("../_extract-tools");
+  expect(extractMcpTools()).toBe(tools);
+  expect(extractMcpTools()).toBe(tools);
+  expect(mocks.extractCatalog).toHaveBeenCalledTimes(1);
+  expect(mocks.loggerWarn).toHaveBeenCalledExactlyOnceWith("MCP tool omitted from catalog", diagnostic);
+});
+
+test("rejects unauthenticated tool calls before execution", async () => {
+  mocks.authenticate.mockResolvedValue(null);
+  const { response } = await callMcp("tools/call", { name: "board_getAllBoards", arguments: {} });
+  expect(response.status).toBe(401);
+  expect(mocks.toolProcedure).not.toHaveBeenCalled();
+});
@@ -1,11 +1,12 @@
 import { extractMcpToolsFromProcedures, mcpRouter } from "@homarr/api/mcp";
+import { createLogger } from "@homarr/core/infrastructure/logs";

+const logger = createLogger({ module: "mcp-catalog" });
 let cache: ReturnType<typeof extractMcpToolsFromProcedures> | null = null;

 export function extractMcpTools() {
-  if (cache) return cache;
-
+  if (cache) return cache.tools;
  cache = extractMcpToolsFromProcedures(mcpRouter);
-
-  return cache;
+  for (const diagnostic of cache.diagnostics) logger.warn("MCP tool omitted from catalog", diagnostic);
+  return cache.tools;
 }
@@ -1,12 +1,18 @@
 // @vitest-environment node

+import { initTRPC, TRPCError } from "@trpc/server";
 import { describe, expect, test, vi } from "vitest";
 import { z } from "zod/v4";

 import type { McpTool } from "@homarr/api/mcp";
+import { appManageSchema } from "@homarr/validation/app";
+import { extractMcpToolsFromProcedures } from "@homarr/api/mcp";
+import type { McpMeta } from "../../../../../../packages/api/src/mcp-tools";

 import { createMcpProtocolHandler } from "./_protocol";

+vi.mock("@homarr/api/mcp", async () => import("../../../../../../packages/api/src/mcp-tools"));
+
 const modernMetadata = {
  "io.modelcontextprotocol/protocolVersion": "2026-07-28",
  "io.modelcontextprotocol/clientInfo": { name: "homarr-test", version: "1.0.0" },
@@ -52,7 +58,7 @@ const echoTool: McpTool = {
  description: "Echo a message",
  type: "query",
  pathInRouter: ["echo"],
-  inputValidator: echoValidator,
+  inputMode: "object",
  inputSchema: z.toJSONSchema(echoValidator),
 };

@@ -163,3 +169,197 @@ describe("MCP v2 protocol", () => {
    expect((await parseResponse(listResponse)).result.tools).toEqual([expect.objectContaining({ name: "echo" })]);
  });
 });
+
+describe.each([false, true])("MCP argument dispatch (modern=%s)", (modern) => {
+  const trpc = initTRPC.context<{ user: string }>().meta<McpMeta>().create();
+  const exposed = trpc.procedure.meta({ mcp: { enabled: true } });
+
+  const call = async (
+    handler: ReturnType<typeof createMcpProtocolHandler>,
+    name: string,
+    argumentsValue: Record<string, unknown>,
+  ) => {
+    let request = createRequest("tools/call", { name, arguments: argumentsValue }, name);
+    if (!modern) {
+      request = new Request("http://homarr.test/api/mcp", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 1,
+          method: "tools/call",
+          params: { name, arguments: argumentsValue },
+        }),
+      });
+    }
+    const response = await handler.fetch(request);
+    expect(response.headers.has("Mcp-Session-Id")).toBe(false);
+    return (await parseResponse(response)).result;
+  };
+
+  test("transforms once and does not coerce, insert defaults, or remove properties before tRPC", async () => {
+    const transform = vi.fn((value: string) => `${value}!`);
+    const execution = vi.fn((input: unknown) => input);
+    const router = trpc.router({
+      update: exposed
+        .input(
+          z.looseObject({
+            name: z.string().transform(transform),
+            limit: z.number().default(7),
+          }),
+        )
+        .mutation(({ input }) => execution(input)),
+    });
+    const catalog = extractMcpToolsFromProcedures(router);
+    expect(catalog.diagnostics).toEqual([]);
+    const realCaller = router.createCaller({ user: "one" });
+    const dispatch = vi.fn(realCaller.update);
+    const handler = createMcpProtocolHandler({
+      caller: { update: dispatch },
+      tools: catalog.tools,
+      version: "test",
+      instructions: "test",
+      formatToolError: () => "Invalid input",
+    });
+    const argumentsValue = { name: "hello", extra: "preserved" };
+    const result = await call(handler, "update", argumentsValue);
+    expect(result.isError).not.toBe(true);
+    expect(dispatch).toHaveBeenCalledWith(argumentsValue);
+    expect(transform).toHaveBeenCalledTimes(1);
+    expect(execution).toHaveBeenCalledWith({ name: "hello!", limit: 7, extra: "preserved" });
+    await call(handler, "update", { name: "hello", limit: "7" });
+    expect(dispatch).toHaveBeenCalledTimes(1);
+    expect(execution).toHaveBeenCalledTimes(1);
+  });
+
+  test("retains overlapping chained constraints, refinements, and empty object defaults", async () => {
+    const execution = vi.fn((input: unknown) => input);
+    const router = trpc.router({
+      bounded: exposed
+        .input(z.object({ count: z.number().min(2) }))
+        .input(z.object({ count: z.number().max(5) }))
+        .mutation(({ input }) => execution(input)),
+      refined: exposed
+        .input(z.object({ value: z.string().refine((value) => value !== "blocked") }))
+        .mutation(({ input }) => execution(input)),
+      defaults: exposed.input(z.object({ count: z.number().default(3) })).query(({ input }) => input),
+      none: exposed.query(({ input }) => ({ absent: input === undefined })),
+    });
+    const catalog = extractMcpToolsFromProcedures(router);
+    expect(catalog.diagnostics).toEqual([]);
+    const handler = createMcpProtocolHandler({
+      caller: router.createCaller({ user: "one" }),
+      tools: catalog.tools,
+      version: "test",
+      instructions: "test",
+      formatToolError: () => "Invalid input",
+    });
+    for (const count of [1, 6]) expect((await call(handler, "bounded", { count })).isError).toBe(true);
+    expect((await call(handler, "refined", { value: "blocked" })).isError).toBe(true);
+    expect(execution).not.toHaveBeenCalled();
+    expect((await call(handler, "bounded", { count: 3 })).isError).not.toBe(true);
+    expect(execution).toHaveBeenCalledWith({ count: 3 });
+    expect((await call(handler, "defaults", {})).content).toEqual([{ type: "text", text: '{"count":3}' }]);
+    expect((await call(handler, "none", {})).content).toEqual([{ type: "text", text: '{"absent":true}' }]);
+  });
+
+  test("accepts app inputs that tRPC normalizes before checking constraints", async () => {
+    const mutation = vi.fn((input: unknown) => input);
+    const router = trpc.router({ create: exposed.input(appManageSchema).mutation(({ input }) => mutation(input)) });
+    const { tools, diagnostics } = extractMcpToolsFromProcedures(router);
+    expect(diagnostics).toEqual([]);
+    const handler = createMcpProtocolHandler({
+      caller: router.createCaller({ user: "admin" }),
+      tools,
+      version: "test",
+      instructions: "test",
+      formatToolError: () => "Invalid input",
+    });
+    const argumentsValue = {
+      name: `${" ".repeat(64)}App `,
+      description: " description ",
+      iconUrl: " icon ",
+      href: null,
+      pingUrl: " https://example.com ",
+    };
+    expect((await call(handler, "create", argumentsValue)).isError).not.toBe(true);
+    expect(mutation).toHaveBeenCalledExactlyOnceWith({
+      name: "App",
+      description: "description",
+      iconUrl: "icon",
+      href: null,
+      pingUrl: "https://example.com",
+    });
+    expect((await call(handler, "create", { ...argumentsValue, pingUrl: " javascript:alert(1) " })).isError).toBe(true);
+    expect(mutation).toHaveBeenCalledTimes(1);
+  });
+
+  test("accepts Zod ISO timestamps without seconds while rejecting invalid dates", async () => {
+    const mutation = vi.fn((input: unknown) => input);
+    const router = trpc.router({
+      invite: exposed
+        .input(z.object({ expirationDate: z.iso.datetime({ offset: true }) }))
+        .mutation(({ input }) => mutation(input)),
+    });
+    const { tools, diagnostics } = extractMcpToolsFromProcedures(router);
+    expect(diagnostics).toEqual([]);
+    const handler = createMcpProtocolHandler({
+      caller: router.createCaller({ user: "admin" }),
+      tools,
+      version: "test",
+      instructions: "test",
+      formatToolError: () => "Invalid input",
+    });
+    for (const expirationDate of ["2026-12-01T18:00Z", "2026-12-01T19:00+01:00"]) {
+      expect((await call(handler, "invite", { expirationDate })).isError).not.toBe(true);
+      expect(mutation).toHaveBeenLastCalledWith({ expirationDate });
+    }
+    for (const expirationDate of ["2026-02-30T18:00Z", "not-a-date"]) {
+      expect((await call(handler, "invite", { expirationDate })).isError).toBe(true);
+    }
+    expect(mutation).toHaveBeenCalledTimes(2);
+  });
+
+  test("enforces tRPC permissions before executing mutations", async () => {
+    const mutation = vi.fn(() => "changed");
+    const router = trpc.router({
+      restricted: exposed
+        .use(({ ctx, next }) => {
+          if (ctx.user !== "admin") throw new TRPCError({ code: "FORBIDDEN" });
+          return next();
+        })
+        .input(z.object({}))
+        .mutation(mutation),
+    });
+    const { tools, diagnostics } = extractMcpToolsFromProcedures(router);
+    expect(diagnostics).toEqual([]);
+    const handler = createMcpProtocolHandler({
+      caller: router.createCaller({ user: "guest" }),
+      tools,
+      version: "test",
+      instructions: "test",
+      formatToolError: () => "Forbidden",
+    });
+    expect((await call(handler, "restricted", {})).isError).toBe(true);
+    expect(mutation).not.toHaveBeenCalled();
+  });
+
+  test("isolates authenticated callers when reusing catalog schemas", async () => {
+    const router = trpc.router({ who: exposed.query(({ ctx }) => ctx.user) });
+    const { tools } = extractMcpToolsFromProcedures(router);
+    const handlers = ["alice", "bob"].map((user) =>
+      createMcpProtocolHandler({
+        caller: router.createCaller({ user }),
+        tools,
+        version: "test",
+        instructions: "test",
+        formatToolError: () => "Failed",
+      }),
+    );
+    const results = await Promise.all(handlers.map((handler) => call(handler, "who", {})));
+    expect(results.map((result) => result.content)).toEqual([
+      [{ type: "text", text: '"alice"' }],
+      [{ type: "text", text: '"bob"' }],
+    ]);
+  });
+});
@@ -1,8 +1,10 @@
-import { createMcpHandler, McpServer } from "@modelcontextprotocol/server";
+import { createMcpHandler, fromJsonSchema, McpServer } from "@modelcontextprotocol/server";

+import { callMcpTool } from "@homarr/api/mcp";
 import type { McpTool } from "@homarr/api/mcp";

 import { toAssistantToolOutput } from "../assistant/chat/assistant-tool-output";
+import { serializeMcpToolResult } from "./_serialize-result";

 interface CreateMcpProtocolHandlerOptions {
  caller: unknown;
@@ -15,15 +17,6 @@ interface CreateMcpProtocolHandlerOptions {
  onProtocolError?: (error: Error) => void;
 }

-const resolveProcedure = (caller: unknown, path: string[]) =>
-  path.reduce<unknown>(
-    (current, segment) =>
-      (typeof current === "object" || typeof current === "function") && current !== null
-        ? (current as Record<string, unknown>)[segment]
-        : undefined,
-    caller,
-  );
-
 export const createMcpProtocolHandler = ({
  caller,
  tools,
@@ -52,25 +45,16 @@ export const createMcpProtocolHandler = ({
          tool.name,
          {
            description: tool.description,
-            inputSchema: tool.inputValidator,
+            inputSchema: fromJsonSchema(tool.inputSchema as Parameters<typeof fromJsonSchema>[0]),
          },
          async (args) => {
            try {
-              const procedure = resolveProcedure(caller, tool.pathInRouter);
-              if (typeof procedure !== "function") {
-                return {
-                  content: [{ type: "text" as const, text: `Tool "${tool.name}" is not callable` }],
-                  isError: true,
-                };
-              }
-
-              const input = Object.keys(args).length > 0 ? args : undefined;
-              const result = await (procedure as (value: unknown) => Promise<unknown>)(input);
+              const result = await callMcpTool(caller, tool, args);
              return {
                content: [
                  {
                    type: "text" as const,
-                    text: JSON.stringify(toAssistantToolOutput(result)),
+                    text: serializeMcpToolResult(toAssistantToolOutput(result)),
                  },
                ],
              };
@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+
+import { serializeMcpToolResult } from "./_serialize-result";
+
+describe("serializeMcpToolResult", () => {
+  it("serializes objects as JSON strings", () => {
+    expect(serializeMcpToolResult({ boardId: "1" })).toBe('{"boardId":"1"}');
+  });
+
+  it("serializes primitive values", () => {
+    expect(serializeMcpToolResult("hello")).toBe('"hello"');
+    expect(serializeMcpToolResult(42)).toBe("42");
+    expect(serializeMcpToolResult(true)).toBe("true");
+  });
+
+  it("serializes null as the string null", () => {
+    expect(serializeMcpToolResult(null)).toBe("null");
+  });
+
+  it("serializes void results as the string null so MCP content text is always a string", () => {
+    expect(serializeMcpToolResult(undefined)).toBe("null");
+  });
+});
@@ -0,0 +1,3 @@
+export function serializeMcpToolResult(result: unknown): string {
+  return JSON.stringify(result) ?? "null";
+}
@@ -5,10 +5,9 @@ import { IconCopy, IconDotsVertical, IconLayoutKanban, IconPencil, IconTrash } f
 import { useSession } from "@homarr/auth/client";
 import { useEditMode } from "@homarr/boards/edit-mode";
 import { getWidgetName } from "@homarr/definitions";
-import { useModalAction } from "@homarr/modals";
+import { useConfirmModal, useModalAction } from "@homarr/modals";
 import { useSettings } from "@homarr/settings";
 import { useI18n } from "@homarr/translation/client";
-import { InlineConfirmMenuItem } from "@homarr/ui";
 import type { WidgetDefinition } from "@homarr/widgets/definition";
 import type { WidgetPreviewDimensions } from "@homarr/widgets/modals";

@@ -40,6 +39,7 @@ const BoardItemMenuInner = ({ item, definition, previewDimensions, resetErrorBou
  const tItem = useI18n("item");
  const t = useI18n();
  const { openModal } = useModalAction(LazyWidgetEditModal);
+  const { openConfirmModal } = useConfirmModal();
  const openMoveModal = useOpenItemMoveModal();
  const [isMenuOpen, setIsMenuOpen] = useState(false);
  const { updateItemOptions, updateItemAdvancedOptions, updateItemIntegrations, duplicateItem, removeItem } =
@@ -143,14 +143,21 @@ const BoardItemMenuInner = ({ item, definition, previewDimensions, resetErrorBou
          </Menu.Item>
        )}
        <Menu.Divider />
-        <InlineConfirmMenuItem
+        <Menu.Item
          color="red"
-          confirmLabel={tItem("remove.message")}
          leftSection={<IconTrash size={16} />}
-          onConfirm={() => removeItem({ itemId: item.id })}
+          onClick={() => {
+            setIsMenuOpen(false);
+            openConfirmModal({
+              title: tItem("remove.message"),
+              children: label,
+              labels: { confirm: tItem("action.remove") },
+              onConfirm: () => removeItem({ itemId: item.id }),
+            });
+          }}
        >
          {tItem("action.remove")}
-        </InlineConfirmMenuItem>
+        </Menu.Item>
      </Menu.Dropdown>
    </Menu>
  );
@@ -244,7 +244,13 @@ export const WidgetContextMenu = ({
    setMenuOpened(false);
  }, []);

-  if (!session || !settings.enableRightClickOnWidgets || isEditMode || item.kind === "app") {
+  if (
+    !session ||
+    !settings.enableRightClickOnWidgets ||
+    isEditMode ||
+    item.kind === "app" ||
+    item.kind === "bookmarks"
+  ) {
    return <>{children}</>;
  }

@@ -11,6 +11,7 @@ import type { ContainerSectionItem } from "~/app/[locale]/boards/_types";
 import { COLLAPSED_SECTION_ROW_COUNT } from "~/components/board/layout";
 import { SectionGrid } from "./grid/section-grid";
 import { useSectionCollapse } from "./section-collapse";
+import { useSectionContext } from "./section-context";
 import { useOpenSectionApps } from "./use-open-section-apps";
 import classes from "./item.module.css";

@@ -25,6 +26,7 @@ interface Props {

 export const BoardContainerSection = ({ section }: Props) => {
  const board = useRequiredBoard();
+  const { section: parentSection } = useSectionContext();
  const [isEditMode] = useEditMode();
  const t = useI18n("section.container");
  const tSection = useI18n("section");
@@ -39,8 +41,26 @@ export const BoardContainerSection = ({ section }: Props) => {
  });
  const label = options.title.trim() || t("untitled");
  const contentId = `board-container-${section.id}-content`;
-  const labelLeft = 8;
-  const labelRight = isEditMode ? 48 : options.showOpenAll ? 40 : 8;
+  let labelLeft = 8;
+  let labelRight = 8;
+  if (isEditMode) {
+    // Match the root/nested menu offsets in BoardContainerMenu, plus its width and gap.
+    labelLeft = 36;
+    if (parentSection.kind === "container") labelLeft = 68;
+  } else if (options.showOpenAll) {
+    labelRight = 40;
+  }
+  // Expanded controls sit on the border like the ordinary label, without reserving a header row.
+  const toggleLayout = isVisuallyCollapsed
+    ? { top: 0, left: 0, w: "100%", h: "100%", maw: "100%" }
+    : {
+        top: "calc(var(--mantine-spacing-xs) * -1)",
+        left: labelLeft,
+        w: "auto",
+        h: 20,
+        maw: `calc(100% - ${labelLeft + labelRight}px)`,
+      };
+  const toggleIcon = isVisuallyCollapsed ? <IconChevronDown size={16} /> : <IconChevronUp size={16} />;

  return (
    <Box className="board-grid-item-content" data-grid-item-content w="100%" h="100%" style={{ overflow: "visible" }}>
@@ -68,24 +88,14 @@ export const BoardContainerSection = ({ section }: Props) => {
          <Button
            className={classes.containerToggle}
            pos="absolute"
-            top={0}
-            left={0}
-            w="100%"
-            h={isVisuallyCollapsed ? "100%" : 24}
-            px={12}
-            pe={isEditMode ? 48 : options.showOpenAll ? 40 : 12}
+            {...toggleLayout}
+            px={6}
+            ps={isVisuallyCollapsed ? labelLeft : 6}
+            pe={isVisuallyCollapsed ? labelRight : 6}
            radius="sm"
            variant="default"
            justify={options.showLabel ? "flex-start" : "center"}
-            leftSection={
-              options.showLabel ? (
-                isVisuallyCollapsed ? (
-                  <IconChevronDown size={16} />
-                ) : (
-                  <IconChevronUp size={16} />
-                )
-              ) : undefined
-            }
+            leftSection={options.showLabel && toggleIcon}
            onClick={toggle}
            aria-expanded={!isVisuallyCollapsed}
            aria-controls={contentId}
@@ -94,13 +104,7 @@ export const BoardContainerSection = ({ section }: Props) => {
            data-board-container-label
            title={options.showLabel ? label : undefined}
          >
-            {options.showLabel ? (
-              label
-            ) : isVisuallyCollapsed ? (
-              <IconChevronDown size={16} />
-            ) : (
-              <IconChevronUp size={16} />
-            )}
+            {options.showLabel ? label : toggleIcon}
          </Button>
        )}
        {!isVisuallyCollapsed && !options.collapsible && options.showLabel && options.title && (
@@ -133,6 +133,21 @@ body[data-board-grid-interacting="resize"] .board-grid-entry[data-dnd-active="tr
  background: color-mix(in srgb, var(--mantine-primary-color-filled) 10%, transparent);
 }

+.board-grid-placeholder[data-grid-placeholder-type="section"] {
+  clip-path: none;
+  background: none;
+  border: 0;
+}
+
+.board-grid-placeholder[data-grid-placeholder-type="section"]::after {
+  position: absolute;
+  inset: var(--board-container-inset, 0px);
+  content: "";
+  background: color-mix(in srgb, var(--mantine-primary-color-filled) 16%, transparent);
+  border: 2px dashed var(--mantine-primary-color-filled);
+  border-radius: inherit;
+}
+
 .board-grid-resize-outline {
  z-index: 1002;
  clip-path: inset(var(--board-grid-item-inset, 0px));
@@ -136,6 +136,7 @@ export const GridPreviewLayer = ({
      style={getLogicalItemStyle(targetPlacement)}
      data-grid-placeholder-for={interaction?.activeId}
      data-grid-placeholder-mode={interaction?.mode}
+      data-grid-placeholder-type={targetPlacement.type}
      data-grid-x={targetPlacement.x}
      data-grid-y={targetPlacement.y}
      data-grid-w={targetPlacement.w}
@@ -10,9 +10,9 @@
   while growing during a drag happening anywhere else on the board - any container (not just
   a scrollable one - a non-scrollable, e.g. collapsible, container is just as capped) sits
   inside that section's DOM tree, so the stray value cascades straight through and silently
-   defeats the `var(--board-grid-drag-height, ...px)` fallback in section-grid.tsx (including
-   its collapsibleHeaderInset adjustment), which only kicks in when the property is entirely
-   unset, not merely inherited. Reset it here so every container can never inherit a stray
+   defeats the `var(--board-grid-drag-height, ...px)` fallback in section-grid.tsx, which only
+   kicks in when the property is entirely unset, not merely inherited. Reset it here so every
+   container can never inherit a stray
   value from anywhere above it, no matter what any ancestor's own drag state is doing.
   https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_cascading_variables#custom_properties_and_inheritance */
 .viewport[data-section-kind="container"] {
@@ -62,9 +62,9 @@
  overflow: visible;
 }

-/* Containers provide their own inner item gap, so their card must keep the full grid aspect ratio. */
+/* SectionGrid fits its content to the same inset in both view and edit mode. */
 .staticItem[data-type="section"] > .contentMount {
-  inset: 0;
+  inset: var(--board-container-inset, 0px);
 }

 .staticItem[data-type="item"] > .contentMount {
@@ -1,7 +1,7 @@
 "use client";

 import type { CSSProperties, KeyboardEvent, PointerEvent } from "react";
-import { useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
+import { createContext, useContext, useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
 import { Box } from "@mantine/core";
 import combineClasses from "clsx";

@@ -29,6 +29,9 @@ import { useSectionItems } from "../use-section-items";
 import { useBoardGridPortalHost } from "./grid-portal-host";
 import classes from "./section-grid.module.css";

+const GridContentScaleContext = createContext(1);
+const CONTAINER_CARD_INSET = 5;
+
 interface SectionGridProps {
  section: Exclude<Section, { kind: "container" }> | ContainerSectionItem;
  columnCount: number;
@@ -50,6 +53,7 @@ export const SectionGrid = ({
 }: SectionGridProps) => {
  const [isEditMode] = useEditMode();
  const canvasScale = useBoardCanvasScale();
+  const parentContentScale = useContext(GridContentScaleContext);
  const editorRuntimeStatus = useGridEditorRuntimeStatus();
  const editorRegistry = useGridEditorRegistry();
  const editorHostRef = useRef<HTMLDivElement>(null);
@@ -143,36 +147,37 @@ export const SectionGrid = ({
  const isScrollableContainer = section.kind === "container" && section.options.scrollable;
  const viewportRowCount =
    viewportRowCountOverride ?? (isScrollableContainer ? Math.max(requestedRowCount, 1) : rowCount);
-  const effectiveCanvasScale = Number.isFinite(canvasScale) && canvasScale > 0 ? canvasScale : 1;
-  // The collapsible label keeps a fixed physical height while the grid uses logical canvas pixels.
-  // Convert that height so the label reserves the same space at every board scale.
-  const collapsibleHeaderInset =
-    section.kind === "container" && section.options.collapsible ? CONTAINER_HEADER_HEIGHT / effectiveCanvasScale : 0;
+  const parentScale = canvasScale * parentContentScale;
+  const effectiveCanvasScale = Number.isFinite(parentScale) && parentScale > 0 ? parentScale : 1;
+  // Match the card's inset without changing its persisted grid footprint. Include ancestor
+  // container zoom so equally sized nested containers keep distinct borders at every depth.
+  let outerCardInset = 0;
+  if (section.kind === "container") {
+    outerCardInset = (2 * CONTAINER_CARD_INSET) / effectiveCanvasScale;
+  }
  const fullGridWidth = getLogicalGridSize(columnCount);
  const fullGridHeight = getLogicalGridSize(rowCount);
-  const logicalWidth = fullGridWidth;
-  const viewportHeight = Math.max(1, getLogicalGridSize(viewportRowCount) - collapsibleHeaderInset);
-  // For a scrollable container, rowCount covers *all* content rows, not just the visible card -
-  // fullGridHeight grows right along with it, so a ratio built from it drifts toward 1 as content
-  // grows regardless of the (fixed) inset, under-scaling relative to what the actually-visible
-  // viewport needs and clipping the bottom of the visible rows. viewportHeight/viewportRowCount
-  // describe the real visible card size in both cases (they equal the non-scrollable values when
-  // rowCount and viewportRowCount are the same), so use those instead.
  const fullViewportHeight = getLogicalGridSize(viewportRowCount);
-  // A collapsible container reserves a fixed-height label above the square-cell grid. Keep the
-  // nested content uniformly scaled within the remaining height so labels and icons retain their
-  // proportions; ordinary containers use the original unscaled, edge-aligned grid geometry.
-  const containerContentScale =
-    section.kind === "container" && fullGridWidth > 0 && fullViewportHeight > 0
-      ? Math.max(0.01, Math.min(logicalWidth / fullGridWidth, viewportHeight / fullViewportHeight, 1))
-      : 1;
+  const logicalWidth = Math.max(1, fullGridWidth - outerCardInset);
+  const viewportHeight = Math.max(1, fullViewportHeight - outerCardInset);
+  // Fit square cells into the inset card. Scrollable grids use the visible row count,
+  // not their full content height. Collapse controls never change this geometry.
+  let containerContentScale = 1;
+  if (section.kind === "container" && fullGridWidth > 0 && fullViewportHeight > 0) {
+    containerContentScale = Math.max(
+      0.01,
+      Math.min(logicalWidth / fullGridWidth, viewportHeight / fullViewportHeight, 1),
+    );
+  }
+  const contentScale = parentContentScale * containerContentScale;
+  const effectiveContentScale = effectiveCanvasScale * containerContentScale;
  // Compute the combined value in JS rather than a CSS calc() referencing the existing
  // --board-canvas-ui-scale: custom properties declared on the *same* element don't have a
  // sequential/temporal order the way normal variables do, so any calc() on this element that
  // both reads and writes --board-canvas-ui-scale (even indirectly, through another property)
  // is a circular reference - CSS invalidates the whole group rather than using "the old value",
  // silently breaking every icon/text/custom-CSS size that compensates off it for descendants.
-  const combinedUiScale = calculateBoardUiScale(canvasScale) / containerContentScale;
+  const combinedUiScale = calculateBoardUiScale(canvasScale) / contentScale;
  // A collapsed container's compact coordinates are display-only. Its own
  // nested grid stays inactive until an explicit edit interaction expands it.
  const isInteractionDisabled = section.kind === "container" && collapsedSectionIds.has(section.id);
@@ -268,9 +273,9 @@ export const SectionGrid = ({
          {
            width: logicalWidth,
            height: `var(--board-grid-drag-height, ${viewportHeight}px)`,
-            marginTop: collapsibleHeaderInset || undefined,
            "--board-item-radius": `var(--mantine-radius-${board.itemRadius})`,
            "--board-grid-content-scale": containerContentScale,
+            "--board-container-inset": `${CONTAINER_CARD_INSET / effectiveContentScale}px`,
          } as CSSProperties
        }
        data-section-id={section.id}
@@ -289,14 +294,17 @@ export const SectionGrid = ({
              height: fullGridHeight,
              zoom: containerContentScale,
              margin: containerContentScale < 1 ? "0 auto" : undefined,
-              ...(containerContentScale < 1 ? { "--board-canvas-ui-scale": combinedUiScale } : {}),
+              "--board-canvas-inverse-scale": 1 / effectiveContentScale,
+              "--board-canvas-ui-scale": combinedUiScale,
            } as CSSProperties
          }
          data-grid-section-id={section.id}
          data-kind={section.kind}
          data-grid-editor-error={isEditMode && editorRuntimeStatus === "error" ? "true" : undefined}
        >
-          <SectionContent />
+          <GridContentScaleContext.Provider value={contentScale}>
+            <SectionContent />
+          </GridContentScaleContext.Provider>
        </Box>
        <div ref={editorHostRef} className={classes.editorPortalHost} />
      </Box>
@@ -304,9 +312,6 @@ export const SectionGrid = ({
  );
 };

-// Matches the collapsible container toggle's h={24} in container-section.tsx.
-const CONTAINER_HEADER_HEIGHT = 24;
-
 const INTERACTIVE_GRID_SELECTOR =
  'a,button,input,textarea,select,option,[contenteditable="true"],[role="button"],[data-grid-no-drag]';
 const EDIT_ACTIVATION_KEYS = new Set(["Enter", " ", "ArrowLeft", "ArrowRight", "ArrowUp", "ArrowDown"]);
@@ -1,9 +1,10 @@
 "use client";

+import { SourceSetupPanel } from "~/components/custom-widgets/integration-source-select";
 import type { ModalProps } from "@mantine/core";

 import type { HomarrCustomWidgetV2 } from "@homarr/custom-widgets/core";
-import { CustomWidgetSourceSetupPanel, ImportReviewDialog } from "@homarr/custom-widgets/workbench";
+import { ImportReviewDialog } from "@homarr/custom-widgets/workbench";
 import { useI18n } from "@homarr/translation/client";

 import { useCustomWidgetImport } from "./use-custom-widget-import";
@@ -67,7 +68,7 @@ export function CustomWidgetImportDialog({
        confirm: legacyId ? t("importReview.confirmMigration") : (labels?.confirm ?? t("importReview.confirm")),
      }}
    >
-      <CustomWidgetSourceSetupPanel
+      <SourceSetupPanel
        setups={importer.setups}
        values={importer.values}
        onChange={importer.setValue}
@@ -1,5 +1,6 @@
 "use client";

+import { SourceSetupPanel } from "~/components/custom-widgets/integration-source-select";
 import { useRouter } from "next/navigation";
 import { useEffect, useMemo, useState } from "react";
 import { Button, Center, Group, Loader, Modal, Stack, Text } from "@mantine/core";
@@ -8,11 +9,7 @@ import { clientApi } from "@homarr/api/client";
 import { revalidatePathActionAsync } from "@homarr/common/client";
 import { getCustomWidgetSourceSetups } from "@homarr/custom-widgets/core";
 import type { CustomWidgetSecretKind } from "@homarr/custom-widgets/core";
-import {
-  createCustomWidgetSourceSetupValues,
-  CustomWidgetSourceSetupPanel,
-  isCustomWidgetSourceSetupReady,
-} from "@homarr/custom-widgets/workbench";
+import { createCustomWidgetSourceSetupValues, isCustomWidgetSourceSetupReady } from "@homarr/custom-widgets/workbench";
 import type { CustomWidgetSourceSetupMessages, CustomWidgetSourceSetupValue } from "@homarr/custom-widgets/workbench";
 import { showErrorNotification, showSuccessNotification } from "@homarr/notifications";
 import { useI18n } from "@homarr/translation/client";
@@ -68,6 +65,14 @@ export function CustomWidgetSourceSetupDialog({ definitionId, opened, onClose }:
        const secrets = Object.entries(value.secrets).flatMap(([kind, secret]) =>
          secret?.trim() ? [{ sourceId: setup.sourceId, kind: kind as CustomWidgetSecretKind, value: secret }] : [],
        );
+        if (setup.integrationKind) {
+          await configureMutation.mutateAsync({
+            definitionId,
+            sourceId: setup.sourceId,
+            integrationId: value.integrationId,
+          });
+          continue;
+        }
        await configureMutation.mutateAsync({
          definitionId,
          sourceId: setup.sourceId,
@@ -109,7 +114,7 @@ export function CustomWidgetSourceSetupDialog({ definitionId, opened, onClose }:
        </Text>
      ) : (
        <Stack gap="md">
-          <CustomWidgetSourceSetupPanel
+          <SourceSetupPanel
            setups={setups}
            values={values}
            messages={messages}
@@ -0,0 +1,81 @@
+"use client";
+
+import { Alert, Select, Stack, Text } from "@mantine/core";
+
+import { CustomWidgetSourceSetupPanel } from "@homarr/custom-widgets/workbench";
+import type { CustomWidgetSourceSetupPanelProps } from "@homarr/custom-widgets/workbench";
+
+import { clientApi } from "@homarr/api/client";
+import type { CustomWidgetIntegrationSource } from "@homarr/custom-widgets/core";
+import { integrationDefs, integrationKinds, isHttpIntegrationKind } from "@homarr/definitions";
+import { useI18n } from "@homarr/translation/client";
+
+const httpIntegrationKinds = integrationKinds.filter(isHttpIntegrationKind);
+
+interface IntegrationSourceSelectProps {
+  kind: CustomWidgetIntegrationSource["integrationKind"];
+  integrationId?: string;
+  onChange(integrationId: string | undefined): void;
+  onKindChange?(kind: CustomWidgetIntegrationSource["integrationKind"]): void;
+}
+
+export function IntegrationSourceSelect({ kind, integrationId, onChange, onKindChange }: IntegrationSourceSelectProps) {
+  const t = useI18n("customWidget.workbench.sources");
+  const query = clientApi.integration.all.useQuery();
+  const integrations = (query.data ?? []).filter(
+    (integration) => integration.kind === kind && integration.permissions.hasFullAccess,
+  );
+  const unavailable = Boolean(integrationId && query.isSuccess && !integrations.some(({ id }) => id === integrationId));
+  return (
+    <Stack gap="sm">
+      {onKindChange && (
+        <Select
+          label={t("integrationType")}
+          searchable
+          data={httpIntegrationKinds.map((value) => ({ value, label: integrationDefs[value].name }))}
+          value={kind}
+          allowDeselect={false}
+          onChange={(value) => {
+            const selected = httpIntegrationKinds.find((candidate) => candidate === value);
+            if (selected) onKindChange(selected);
+          }}
+        />
+      )}
+      <Select
+        label={t("selectIntegration")}
+        description={isHttpIntegrationKind(kind) ? integrationDefs[kind].name : kind}
+        data={integrations.map(({ id, name }) => ({ value: id, label: name }))}
+        value={integrationId ?? null}
+        searchable
+        clearable
+        disabled={query.isPending}
+        nothingFoundMessage={t("noIntegrations")}
+        error={unavailable && t("integrationUnavailable")}
+        onChange={(value) => onChange(value ?? undefined)}
+      />
+      {query.error && <Alert color="red">{query.error.message}</Alert>}
+      <Text size="xs" c="dimmed">
+        {t("integrationDescription")}
+      </Text>
+    </Stack>
+  );
+}
+
+export function SourceSetupPanel(props: CustomWidgetSourceSetupPanelProps) {
+  return (
+    <CustomWidgetSourceSetupPanel
+      {...props}
+      renderIntegrationSource={(setup, value) => {
+        const kind = httpIntegrationKinds.find((candidate) => candidate === setup.integrationKind);
+        if (!kind) return null;
+        return (
+          <IntegrationSourceSelect
+            kind={kind}
+            integrationId={value.integrationId}
+            onChange={(integrationId) => props.onChange(setup.sourceId, { ...value, integrationId })}
+          />
+        );
+      }}
+    />
+  );
+}
@@ -60,7 +60,7 @@ export function useCustomWidgetImport({ widget, legacyId, onImported }: UseCusto
        Object.fromEntries(
          Object.entries(values).map(([sourceId, value]) => [
            sourceId,
-            { baseUrl: value.baseUrl, networkScope: value.networkScope },
+            { baseUrl: value.baseUrl, networkScope: value.networkScope, integrationId: value.integrationId },
          ]),
        ),
      ),
@@ -1,18 +0,0 @@
-import { readFileSync } from "node:fs";
-import { describe, expect, it } from "vitest";
-
-describe("DynamicBreadcrumb", () => {
-  it("falls back to the raw segment when a path segment has no translation", () => {
-    const source = readFileSync(
-      `${process.cwd()}/apps/nextjs/src/components/navigation/dynamic-breadcrumb.tsx`,
-      "utf8",
-    );
-
-    // Dynamic ids (e.g. /manage/custom-widgets/workshop/<id>) have no message and are
-    // not mapped while their page loads; resolving them must not raise MISSING_MESSAGE.
-    expect(source).toContain("let label = pathnamePart");
-    expect(source).toContain("if (mappedValue !== undefined)");
-    expect(source).toContain("t.has(labelKey)");
-    expect(source).not.toMatch(/\{t\(`\$\{translationKey\}\.label`/u);
-  });
-});
@@ -1,18 +1,9 @@
 // @vitest-environment jsdom

-import { readFileSync } from "node:fs";
 import { afterEach, describe, expect, it } from "vitest";

 import { getWorkshopAssistantProviderUrl, getWorkshopWebUrl } from "./workshop-client";

-const read = (path: string) => readFileSync(`${process.cwd()}/${path}`, "utf8");
-
-const detailPage = "apps/nextjs/src/app/[locale]/manage/custom-widgets/workshop/[id]/_workshop-detail.tsx";
-const browsePage = "apps/nextjs/src/app/[locale]/manage/custom-widgets/workshop/_workshop-browse.tsx";
-const browseRoutePage = "apps/nextjs/src/app/[locale]/manage/custom-widgets/workshop/page.tsx";
-const publishPage = "apps/nextjs/src/app/[locale]/manage/custom-widgets/publish/[id]/_workshop-publish-form.tsx";
-const cssButton = "apps/nextjs/src/components/workshop/workshop-css-import-button.tsx";
-
 describe("Workshop widget install flow", () => {
  afterEach(() => {
    document.head.innerHTML = "";
@@ -39,136 +30,4 @@ describe("Workshop widget install flow", () => {

    expect(getWorkshopAssistantProviderUrl()).toBe("https://api.preview.example/api/ai/v1");
  });
-
-  it("installs from a page with a sticky footer instead of stacked modals", () => {
-    const detail = read(detailPage);
-
-    expect(detail).toContain("ManageStickyFooter");
-    expect(detail).toContain("useCustomWidgetImport");
-    // Review and install happen on one surface, so neither Modal.Stack nor the review dialog is involved.
-    expect(detail).not.toContain("Modal.Stack");
-    expect(detail).not.toContain("useModalsStack");
-    expect(detail).not.toContain("CustomWidgetImportDialog");
-  });
-
-  it("browses the Workshop as a card grid with per-item Workshop links", () => {
-    const browse = read(browsePage);
-    const route = read(browseRoutePage);
-
-    expect(browse).toContain("WorkshopSubmissionGrid");
-    expect(browse).toContain("SearchInput");
-    expect(browse).toContain("TablePagination");
-    expect(browse).toContain("CustomWidgetTabs");
-    expect(route).toContain("resolveHomarrUrlConfig");
-    expect(route).toContain("workshopWebUrl={workshopWebUrl}");
-    expect(browse).toContain("workshopWebUrl: string");
-    expect(browse).toContain("href={workshopWebUrl}");
-    expect(browse).toContain('workshopWebUrl.replace(/\\/+$/u, "")');
-    expect(browse).toContain("encodeURIComponent(item.id)");
-    expect(browse).toContain("WorkshopVoteControl");
-    expect(browse).not.toContain("Modal");
-  });
-
-  it("renders the grid with real cards and screenshot previews", () => {
-    const grid = read("apps/nextjs/src/components/workshop/workshop-submission-grid.tsx");
-    const card = read("apps/nextjs/src/components/workshop/workshop-submission-card.tsx");
-
-    expect(grid).toContain("SimpleGrid");
-    expect(card).toContain("Card.Section");
-    expect(card).toContain("PREVIEW_HEIGHT");
-  });
-
-  it("shows the viewer's own vote as a filled control", () => {
-    const vote = read("apps/nextjs/src/components/workshop/workshop-vote-control.tsx");
-
-    expect(vote).toContain("useWorkshopUserVotesQuery");
-    expect(vote).toContain("IconArrowBigUpFilled");
-    expect(vote).toContain("IconArrowBigDownFilled");
-    expect(vote).toContain('color={upvoted ? "red" : "gray"}');
-    expect(vote).toContain("aria-pressed={upvoted}");
-  });
-
-  it("previews screenshots large with a zoom lightbox", () => {
-    const screenshots = read("apps/nextjs/src/components/workshop/workshop-screenshots.tsx");
-    const detail = read(detailPage);
-
-    expect(screenshots).toContain("1200x800");
-    expect(screenshots).toContain("zoomScreenshot");
-    expect(screenshots).toContain('import { Lightbox } from "@mantine/lightbox"');
-    expect(screenshots).toContain("withThumbnails");
-    expect(screenshots).toContain("withZoom");
-    expect(screenshots).toContain("withKeyboardEvents");
-    expect(screenshots).not.toMatch(/<Modal\b/u);
-    expect(detail).toContain("WorkshopScreenshots");
-  });
-
-  it("publishes from a page with the same sticky footer", () => {
-    const publish = read(publishPage);
-
-    expect(publish).toContain("ManageStickyFooter");
-    expect(publish).not.toContain("useModalsStack");
-    expect(publish).not.toMatch(/<Modal\b/u);
-  });
-
-  it("imports Custom CSS from a single modal", () => {
-    const css = read(cssButton);
-
-    expect(css).toContain("WorkshopSubmissionGrid");
-    expect(css).toContain("useConfirmModal");
-    expect(css).not.toContain("useModalsStack");
-    expect(css).not.toContain("Modal.Stack");
-  });
-
-  it("cannot import the same widget twice and returns to the installed list", () => {
-    const importer = read("apps/nextjs/src/components/custom-widgets/use-custom-widget-import.ts");
-    const detail = read(detailPage);
-
-    // The mutation creates a new record per call, so a second click must be impossible.
-    expect(importer).toContain("if (!configuredWidget || pending || succeeded) return;");
-    expect(importer).toContain("setSucceeded(true)");
-    expect(detail).toContain("router.push(installedHref)");
-    expect(detail).toContain("disabled={!compatible || !importer.ready || importer.succeeded}");
-    // The heavy edit form is no longer the post-install destination.
-    expect(detail).not.toContain("/manage/custom-widgets/edit/");
-  });
-
-  it("keeps typed credentials across a background refetch of the submission", () => {
-    const importer = read("apps/nextjs/src/components/custom-widgets/use-custom-widget-import.ts");
-    const detail = read(detailPage);
-
-    // Voting invalidates the detail query. If the setup reset keyed off the widget
-    // object identity, the refetch would silently clear part-typed API keys.
-    expect(importer).toContain("const sourcesKey = JSON.stringify(widget?.sources ?? {})");
-    expect(importer).toContain("[sourcesKey]");
-    expect(importer).not.toContain("getCustomWidgetSourceSetups(widget?.sources ?? {}), [widget])");
-    expect(detail).toContain("const content = detail.data?.content;");
-    expect(detail).toContain("[content]");
-  });
-
-  it("keeps the sign-in hint reachable when voting is unavailable", () => {
-    const vote = read("apps/nextjs/src/components/workshop/workshop-vote-control.tsx");
-
-    // Mantine tooltips do not fire on disabled controls, so the hint hangs off the wrapper.
-    expect(vote).toContain('canVote ? controls : <Tooltip label={t("signInHint")}>{controls}</Tooltip>');
-  });
-
-  it("cannot publish the same widget twice", () => {
-    const publish = read(publishPage);
-
-    expect(publish).toContain("if (createSubmission.isPending) return;");
-    expect(publish).toContain("createSubmission.isPending ||");
-  });
-
-  it("no longer ships the stacked-modal install components", () => {
-    for (const removed of [
-      "apps/nextjs/src/components/workshop/workshop-browser.tsx",
-      "apps/nextjs/src/components/workshop/workshop-install-button.tsx",
-      "apps/nextjs/src/components/workshop/workshop-installer.tsx",
-      "apps/nextjs/src/components/workshop/workshop-publish-modal.tsx",
-      "apps/nextjs/src/components/workshop/workshop-submission-list.tsx",
-      "apps/nextjs/src/components/workshop/workshop-submission-item.tsx",
-    ]) {
-      expect(() => read(removed)).toThrow();
-    }
-  });
 });
@@ -1,5 +1,5 @@
 interface PublishableWorkshopDefinition {
-  sources: Record<string, { name?: string; networkScope: string }>;
+  sources: Record<string, { name?: string; networkScope?: string }>;
 }

 export const serializeWorkshopDefinition = (definition: unknown): string => {
@@ -29,5 +29,5 @@ export async function publishWorkshopDefinition({

 export const getPrivateWorkshopSourceNames = (definition: PublishableWorkshopDefinition | undefined) =>
  Object.entries(definition?.sources ?? {}).flatMap(([sourceId, source]) =>
-    source.networkScope === "public" ? [] : [source.name ?? sourceId],
+    source.networkScope === undefined || source.networkScope === "public" ? [] : [source.name ?? sourceId],
  );
@@ -77,7 +77,7 @@ pnpm --filter @homarr/docs typecheck
 ```

 The integration suite uses a disposable Compose project. `pnpm test:workshop-image` additionally builds and smoke-tests
-the combined production image.
+the combined production image. Both commands are manual and do not run in CI. Workshop CI validates Compose configuration only when its workflow or Docker build inputs change, then publishes images on release branches. The main Fast gate owns workspace typechecking.

 ## Data safety

@@ -1,48 +1,7 @@
-import { access, readFile } from "node:fs/promises";
-import { resolve } from "node:path";
+import { readFile } from "node:fs/promises";
 import vm from "node:vm";

-const read = (path) => readFile(resolve(path), "utf8");
-
-const packageJson = JSON.parse(await read("packages/workshop/package.json"));
-const clientExport = packageJson.exports?.["./client"];
-if (typeof clientExport !== "string") throw new Error("Workshop client export is missing");
-await access(resolve("packages/workshop", clientExport));
-
-const hook = await read("apps/workshop/pb_hooks/workshop.pb.js");
-if (!hook.includes("require(`${__hooks}/workshop-utils.js`)")) {
-  throw new Error("Workshop handlers must load shared helpers inside their isolated PocketBase contexts");
-}
-if (!hook.includes("onBootstrap") || !hook.includes("users.oauth2.providers = configured")) {
-  throw new Error("Workshop OAuth settings must be synchronized at every bootstrap");
-}
-if (!hook.includes('username: "name"') || hook.includes("onRecordAuthWithOAuth2Request")) {
-  throw new Error("Workshop identity must use PocketBase's direct GitHub username mapping");
-}
-if (hook.includes("validateAndNormalizeSubmission")) {
-  throw new Error("PocketBase must store Workshop submissions without interpreting their content");
-}
-for (const artifact of [
-  "apps/workshop/pb_hooks/widget-validator.js",
-  "apps/workshop/pb_hooks/widget-validator.bundle.cjs",
-  "packages/workshop/src/pocketbase-validator.ts",
-  "scripts/build-workshop-validator.mjs",
-]) {
-  await access(resolve(artifact))
-    .then(() => {
-      throw new Error(`Workshop validator artifact must stay removed: ${artifact}`);
-    })
-    .catch((error) => {
-      if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
-      throw error;
-    });
-}
-if (hook.includes('findAllRecords("users")') || !hook.includes('findRecordsByFilter("users"')) {
-  throw new Error("Workshop report notifications must use a filtered, bounded administrator query");
-}
-if (!hook.includes('routerAdd("GET", "/workshop/{id}"') || !hook.includes('getStringSlice("screenshots")')) {
-  throw new Error("Workshop detail routes must render server-side social metadata with submission screenshots");
-}
+const read = (path) => readFile(path, "utf8");

 const hookUtilsModule = { exports: {} };
 vm.runInNewContext(await read("apps/workshop/pb_hooks/workshop-utils.js"), { module: hookUtilsModule });
@@ -69,73 +28,4 @@ for (const expected of [
 }
 if (socialHtml.includes("Homarr documentation")) throw new Error("Workshop social metadata must replace generic tags");

-const migration = await read("apps/workshop/pb_migrations/1784240000_workshop_widgets.js");
-for (const removedField of ["displayName", "avatarUrl", "githubProfileUrl", "githubUsername"]) {
-  if (migration.includes(removedField)) throw new Error(`Redundant Workshop user field remains: ${removedField}`);
-}
-
-const providerMigration = await read("apps/workshop/pb_migrations/1786500000_homarr_provider.js");
-for (const required of ['name: "assistant_quotas"', 'name: "assistant_global_quota"', "idx_assistant_quotas_user"]) {
-  if (!providerMigration.includes(required)) throw new Error(`Homarr provider migration is missing: ${required}`);
-}
-for (const forbidden of ['name: "assistant_requests"', 'name: "assistant_activity"', 'name: "dailyLimit"']) {
-  if (providerMigration.includes(forbidden)) throw new Error(`Homarr provider must not persist ${forbidden}`);
-}
-
-const dailyQuotaMigration = await read("apps/workshop/pb_migrations/1787670446_daily_assistant_quotas.js");
-for (const required of [
-  'removeIndex("idx_assistant_quotas_user")',
-  'addIndex("idx_assistant_quotas_user_day", true, "user, day", "")',
-]) {
-  if (!dailyQuotaMigration.includes(required)) throw new Error(`Daily quota migration is missing: ${required}`);
-}
-
-const providerBackend = await read("apps/workshop/homarr_provider.go");
-for (const required of [
-  '"homarr/model"',
-  'apis.RequireAuth("users")',
-  "DefaultActivityLoggerMiddlewareId",
-  'os.Getenv("OPENROUTER_API_KEY")',
-  'os.Getenv("HOMARR_AI_DAILY_REQUEST_LIMIT")',
-  'os.Getenv("HOMARR_AI_GLOBAL_DAILY_REQUEST_LIMIT")',
-  'os.Getenv("HOMARR_AI_OPENROUTER_MODEL")',
-  '"data_collection": "deny"',
-  '"zdr": true',
-]) {
-  if (!providerBackend.includes(required)) throw new Error(`Homarr provider backend is missing: ${required}`);
-}
-if (/logger\(\)|\.Logger\(|log\.Print/u.test(providerBackend)) {
-  throw new Error("The Homarr provider must not log request content or user tokens");
-}
-for (const required of [
-  "workshop_migration_state",
-  "addedUserFields",
-  "cloneRule(users.listRule)",
-  "CREATE TRIGGER submissions_revision_cas",
-  "NEW.expectedRevision != OLD.revision",
-  "users.passwordAuth = state.users.passwordAuth",
-  "users.oauth2 = state.users.oauth2",
-  "app.delete(users)",
-]) {
-  if (!migration.includes(required)) throw new Error(`Workshop rollback is missing state restoration: ${required}`);
-}
-
-const workflow = await read(".github/workflows/workshop.yml");
-if (/\n\s+paths:/u.test(workflow)) throw new Error("Workshop workflow must not filter out Docker build inputs");
-
-const entrypoint = await read("apps/workshop/entrypoint.sh");
-if (!entrypoint.includes("/pb_public/workshop-runtime-config.js") || !entrypoint.includes("WORKSHOP_API_URL")) {
-  throw new Error("Workshop must publish its API URL when the container starts");
-}
-
-const docsConfig = await read("apps/docs/docusaurus.config.ts");
-if (!docsConfig.includes('scripts: [{ src: "/workshop-runtime-config.js" }]')) {
-  throw new Error("Workshop must load the container runtime configuration before the documentation bundle");
-}
-if (!docsConfig.includes('path: "/workshop/:id"') || !docsConfig.includes("priority: -1")) {
-  throw new Error("Workshop submission routes must not capture the moderation page");
-}
-await access(resolve("apps/docs/static/workshop-runtime-config.js"));
-await access(resolve("apps/docs/src/pages/workshop/admin/index.tsx"));
-
-console.log("Workshop static contracts passed");
+console.log("Workshop social metadata rendering passed");
@@ -16,8 +16,7 @@ const adminCredentials = {
  password: "Comp(exP4sswOrd",
 };

-// This is an opt-in documentation asset generator, not part of the normal E2E gate.
-// Run it explicitly with UPDATE_DOCS_SCREENSHOTS=true when the documented UI changes.
+// Run this opt-in asset generator with pnpm test:docs-screenshots when the documented UI changes.
 describe.skipIf(process.env.UPDATE_DOCS_SCREENSHOTS !== "true")("Assistant documentation screenshots", () => {
  test("captures the management page and conversation panel", async () => {
    const { db, localMountPath } = await createSqliteDbFileAsync();
@@ -1,114 +0,0 @@
-import { chromium, expect } from "@playwright/test";
-import type { Browser } from "@playwright/test";
-import type { StartedTestContainer } from "testcontainers";
-import { describe, test } from "vitest";
-
-import { createHomarrContainer } from "./shared/create-homarr-container";
-import { createSqliteDbFileAsync } from "./shared/e2e-db";
-import type { MockApiServer } from "./shared/mock-api-server";
-import { startMockApiServerAsync } from "./shared/mock-api-server";
-import { seedAdminUserAsync } from "./shared/seed-admin-user";
-
-const adminCredentials = { username: "admin", password: "Comp(exP4sswOrd" };
-const initialTemplate =
-  "<Stack><Title order={4}>{data.status?.title}</Title><Badge>{data.status?.status}</Badge></Stack>";
-const updatedTemplate = "<Stack><Text fw={700}>{data.status?.title}</Text><Text>{data.status?.value}</Text></Stack>";
-
-describe("Custom JSX v2 workbench", () => {
-  test.skip("creates, previews, edits, and immediately adds a widget to a board", async () => {
-    let mockApi: MockApiServer | undefined;
-    let homarrContainer: StartedTestContainer | undefined;
-    let browser: Browser | undefined;
-
-    try {
-      mockApi = await startMockApiServerAsync({ title: "E2E Widget", status: "online", value: 42 });
-      const { db, localMountPath } = await createSqliteDbFileAsync();
-      await seedAdminUserAsync(db, adminCredentials);
-      homarrContainer = await createHomarrContainer({
-        environment: { AUTH_PROVIDERS: "credentials" },
-        mounts: { "/appdata": localMountPath },
-      }).start();
-      const baseUrl = `http://${homarrContainer.getHost()}:${homarrContainer.getMappedPort(7575)}`;
-      browser = await chromium.launch();
-      const page = await browser.newPage();
-
-      await page.goto(`${baseUrl}/auth/login`);
-      await page.waitForLoadState("networkidle");
-      await page.getByLabel("Username").fill(adminCredentials.username);
-      await page.locator("#password").fill(adminCredentials.password);
-      const signedIn = page.waitForURL((url) => url.origin === baseUrl && url.pathname !== "/auth/login", {
-        waitUntil: "commit",
-        timeout: 60_000,
-      });
-      await page.locator("button[type='submit']").click();
-      await signedIn;
-
-      await page.goto(`${baseUrl}/manage/custom-widgets/new`);
-      await page.locator('input[data-path="name"]:visible').fill("E2E Custom JSX v2");
-      await page.getByRole("textbox", { name: "Base URL" }).fill(mockApi.url);
-      await page.getByRole("combobox", { name: "Network access" }).click();
-      await page.getByRole("option", { name: "private" }).click();
-      await page.getByRole("group", { name: "status" }).getByRole("textbox", { name: "Path" }).fill("/status");
-      await page.getByRole("button", { name: "Add option" }).click();
-      const option = page.getByRole("group", { name: "Option 1" });
-      await option.getByRole("textbox", { name: "Option name" }).fill("label");
-      await option.getByRole("textbox", { name: "Default" }).fill("E2E");
-      const request = page.getByRole("group", { name: "status" });
-      await request.getByRole("button", { name: "Query, body and behavior" }).click();
-      await request.getByRole("button", { name: "Add query value" }).click();
-      await request.getByRole("textbox", { name: "Query key" }).fill("label");
-      await request.getByRole("combobox", { name: "Value source" }).click();
-      await page.getByRole("option", { name: "Widget option" }).click();
-      await request.getByRole("combobox", { name: "Option" }).first().click();
-      await page.getByRole("option", { name: "label" }).click();
-      await page.getByRole("button", { name: "Advanced manifest JSON" }).first().click();
-      await expect(page.locator("#requests-editor")).toContainText('"$option": "label"');
-      await page.locator("#jsx-editor").fill(initialTemplate);
-
-      await page.getByRole("button", { name: "Test and preview" }).last().click();
-      await expect(page.getByRole("complementary", { name: "Widget preview" }).getByText("E2E Widget")).toBeVisible({
-        timeout: 15_000,
-      });
-
-      const editPage = page.waitForURL("**/manage/custom-widgets/edit/**", { timeout: 15_000, waitUntil: "commit" });
-      await page.getByRole("button", { name: "Create", exact: true }).last().click();
-      await editPage;
-
-      await page.locator("#jsx-editor").fill(updatedTemplate);
-      await page.getByRole("button", { name: "Save", exact: true }).last().click();
-      await expect(page.getByText('Widget "E2E Custom JSX v2" updated successfully.')).toBeVisible({ timeout: 15_000 });
-
-      await page.goto(baseUrl);
-      const tourOverlay = page.locator('[data-onboarding-tour-overlay="true"]');
-      const skipTour = page.getByRole("button", { name: "Skip tour", exact: true });
-      try {
-        await skipTour.waitFor({ state: "visible", timeout: 5_000 });
-        await skipTour.click();
-        await expect(tourOverlay).toHaveCount(0);
-      } catch (error) {
-        if ((await tourOverlay.count()) > 0) throw error;
-      }
-      const editToggle = page.getByTestId("board-edit-mode-toggle");
-      await editToggle.click();
-      await expect(editToggle).toHaveAttribute("aria-pressed", "true", { timeout: 15_000 });
-      await page.getByRole("button", { name: "Add board content", exact: true }).click();
-      await page
-        .getByRole("dialog", { name: "Create" })
-        .getByRole("button", { name: /^Add widget / })
-        .click();
-      const picker = page.getByRole("dialog").last();
-      await picker.getByRole("button", { name: /^E2E Custom JSX v2,/ }).click();
-      const addDialog = page.getByRole("dialog").last();
-      await expect(addDialog.getByText("E2E Custom JSX v2")).toBeVisible();
-      await addDialog.getByRole("button", { name: "Save changes", exact: true }).click();
-
-      await expect(page.getByText("Widget definition not found")).not.toBeVisible();
-      await editToggle.click();
-      await expect(editToggle).toHaveAttribute("aria-pressed", "false", { timeout: 15_000 });
-      await expect(page.getByText("E2E Widget")).toBeVisible({ timeout: 15_000 });
-      await expect(page.getByText("42")).toBeVisible({ timeout: 15_000 });
-    } finally {
-      await Promise.allSettled([browser?.close(), homarrContainer?.stop(), mockApi?.close()]);
-    }
-  }, 180_000);
-});
@@ -1,20 +0,0 @@
-import { describe, expect, test } from "vitest";
-
-import { createHomarrContainer } from "./shared/create-homarr-container";
-
-describe("Home", () => {
-  test("should open with status code 200", async () => {
-    // Arrange
-    const homarrContainer = await createHomarrContainer().start();
-
-    try {
-      // Act
-      const homeResponse = await fetch(`http://localhost:${homarrContainer.getMappedPort(7575)}/`);
-
-      // Assert
-      expect(homeResponse.status).toBe(200);
-    } finally {
-      await homarrContainer.stop();
-    }
-  }, 60_000);
-});
@@ -1,11 +1,9 @@
-import { mkdir, readFile, rm } from "node:fs/promises";
+import { mkdir, rm } from "node:fs/promises";
 import path from "node:path";

 import { chromium } from "@playwright/test";
 import type { Page } from "@playwright/test";
 import { createId } from "@paralleldrive/cuid2";
-import AdmZip from "adm-zip";
-import type { StartedTestContainer } from "testcontainers";
 import { describe, expect, test } from "vitest";

 import * as sqliteSchema from "../packages/db/schema/sqlite";
@@ -30,48 +28,6 @@ const cleanupSqliteDbAsync = async ({ db, localMountPath }: SqliteTestDatabase)
  await rm(localMountPath, { recursive: true, force: true });
 };

-const createRestoreArchiveAsync = async () => {
-  const sqlite = await createSqliteDbFileAsync();
-  const { db, localMountPath } = sqlite;
-  try {
-    await db.insert(sqliteSchema.onboarding).values({ id: "onboarding", step: "finish", previousStep: "setup" });
-    await db.insert(sqliteSchema.boards).values({ id: "restored-board", name: "restored", isPublic: true });
-    await db.insert(sqliteSchema.layouts).values({
-      id: "restored-base",
-      boardId: "restored-board",
-      name: "Base",
-      role: "base",
-      columnCount: 10,
-      breakpoint: 768,
-    });
-    await db.insert(sqliteSchema.sections).values({
-      id: "restored-root",
-      boardId: "restored-board",
-      kind: "empty",
-      xOffset: 0,
-      yOffset: 0,
-    });
-    db.$client.close();
-
-    const zip = new AdmZip();
-    zip.addFile("db.sqlite", await readFile(path.join(localMountPath, "db", "db.sqlite")));
-    zip.addFile(
-      "metadata.json",
-      Buffer.from(
-        JSON.stringify({
-          homarrVersion: "e2e",
-          exportedAt: new Date().toISOString(),
-          dbDialect: "sqlite",
-          encryptionKey: "0".repeat(64),
-        }),
-      ),
-    );
-    return zip.toBuffer();
-  } finally {
-    await cleanupSqliteDbAsync(sqlite);
-  }
-};
-
 describe("Onboarding", () => {
  test.each([
    { name: "mobile", width: 320, height: 740 },
@@ -180,61 +136,6 @@ describe("Onboarding", () => {
    90_000,
  );

-  test.skip("SQLite onboarding restores a validated backup and survives the restart", async () => {
-    const restoreArchive = await createRestoreArchiveAsync();
-    const invalidArchive = new AdmZip();
-    invalidArchive.addFile("db.sqlite", Buffer.from("not-a-database"));
-    const sqlite = await createSqliteDbFileAsync();
-    const { localMountPath } = sqlite;
-    const initialContainer = await createHomarrContainer({ mounts: { "/appdata": localMountPath } }).start();
-    let initialContainerStopped = false;
-    let restoredContainer: StartedTestContainer | undefined;
-    const browser = await chromium.launch();
-    const context = await browser.newContext();
-    const page = await context.newPage();
-
-    try {
-      const initialBaseUrl = `http://${initialContainer.getHost()}:${initialContainer.getMappedPort(7575)}`;
-      await page.goto(`${initialBaseUrl}/init`);
-      await page.getByRole("button", { name: "Restore backup" }).click();
-      const fileInput = page.locator('input[type="file"]');
-      await fileInput.setInputFiles({
-        name: "missing-metadata.zip",
-        mimeType: "application/zip",
-        buffer: invalidArchive.toBuffer(),
-      });
-      await page.getByText("Invalid backup: missing metadata.json").waitFor();
-      await page.getByRole("button", { name: "Change file" }).click();
-
-      await fileInput.setInputFiles({ name: "homarr-backup.zip", mimeType: "application/zip", buffer: restoreArchive });
-      await page.getByRole("heading", { name: "Backup Contents" }).waitFor({ timeout: 30_000 });
-      expect(await page.getByText("restored", { exact: true }).isVisible()).toBe(true);
-      await page.getByRole("button", { name: "Continue to restore" }).click();
-      await page.getByPlaceholder("I understand").fill("I understand");
-      const restoreResponse = page.waitForResponse(
-        (response) => response.url().endsWith("/api/backup/import") && response.request().method() === "POST",
-      );
-      await page.getByRole("button", { name: "Restore Database" }).click();
-      expect((await restoreResponse).status()).toBe(200);
-
-      await initialContainer.stop();
-      initialContainerStopped = true;
-      restoredContainer = await createHomarrContainer({ mounts: { "/appdata": localMountPath } }).start();
-      const restoredBaseUrl = `http://${restoredContainer.getHost()}:${restoredContainer.getMappedPort(7575)}`;
-      await page.goto(`${restoredBaseUrl}/boards/restored`);
-      await page.locator('[data-testid="board-canvas"][data-board-hydrated="true"]').waitFor({ timeout: 30_000 });
-      expect(page.url()).toMatch(/\/boards\/restored(?:[/?#]|$)/);
-    } finally {
-      try {
-        await browser.close();
-        if (!initialContainerStopped) await initialContainer.stop();
-        if (restoredContainer) await restoredContainer.stop();
-      } finally {
-        await cleanupSqliteDbAsync(sqlite);
-      }
-    }
-  }, 120_000);
-
  test("Credentials onboarding recovers when automatic sign-in fails after account creation", async () => {
    const sqlite = await createSqliteDbFileAsync();
    const { db, localMountPath } = sqlite;
@@ -1,50 +0,0 @@
-import { createServer } from "node:http";
-import { getContainerRuntimeClient, TestContainers } from "testcontainers";
-
-import type { Server } from "node:http";
-
-const TESTCONTAINERS_SSHD_LABEL = "org.testcontainers.sshd";
-
-export interface MockApiServer {
-  url: string;
-  close: () => Promise<void>;
-}
-
-export async function startMockApiServerAsync(responseBody: unknown): Promise<MockApiServer> {
-  const body = JSON.stringify(responseBody);
-  const server: Server = await new Promise((resolve) => {
-    const candidate = createServer((_request, response) => {
-      response.writeHead(200, { "content-type": "application/json" });
-      response.end(body);
-    });
-    candidate.listen(0, "0.0.0.0", () => resolve(candidate));
-  });
-  const address = server.address();
-  if (!address || typeof address === "string") {
-    server.close();
-    throw new Error("Failed to start mock API server");
-  }
-
-  try {
-    await TestContainers.exposeHostPorts(address.port);
-    const client = await getContainerRuntimeClient();
-    const forwarder = (await client.container.list()).find(
-      (container) => container.State === "running" && container.Labels[TESTCONTAINERS_SSHD_LABEL] === "true",
-    );
-    const forwarderAddress = forwarder
-      ? Object.values(forwarder.NetworkSettings.Networks).find((network) => network.IPAddress)?.IPAddress
-      : undefined;
-    if (!forwarderAddress) throw new Error("Failed to locate the Testcontainers host-port forwarder");
-
-    return {
-      url: `http://${forwarderAddress}:${address.port}`,
-      close: () =>
-        new Promise((resolve, reject) => {
-          server.close((error) => (error ? reject(error) : resolve()));
-        }),
-    };
-  } catch (error) {
-    server.close();
-    throw error;
-  }
-}
@@ -9,7 +9,7 @@ http {

        # Route websockets traffic to port 3001
        location /websockets {
-            proxy_pass http://${HOSTNAME}:3001;
+            proxy_pass http://127.0.0.1:3001;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
@@ -18,7 +18,7 @@ http {

        # Route all other traffic to port 3000
        location / {
-            proxy_pass http://${HOSTNAME}:3000;
+            proxy_pass http://127.0.0.1:3000;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -49,12 +49,15 @@
    "scripts:update-openapi": "tsx ./scripts/check-openapi-schema.mts --write",
    "scripts:update-readme-integrations": "tsx ./scripts/update-integration-list.mts",
    "start": "pnpm -F nextjs start",
-    "test": "cross-env NODE_ENV=development CI=true vitest run --project \"!e2e\" --retry 2 --coverage.enabled ",
-    "test:e2e": "cross-env NODE_ENV=development CI=true vitest e2e --retry 2 --maxWorkers 2",
+    "test": "cross-env NODE_ENV=development CI=true vitest run --project \"!e2e\" --project \"!integration\" --project \"!docs-screenshots\"",
+    "test:coverage": "pnpm test --coverage.enabled",
+    "test:integration": "cross-env NODE_ENV=development CI=true vitest run --project integration --maxWorkers 2",
+    "test:docs-screenshots": "cross-env UPDATE_DOCS_SCREENSHOTS=true NODE_ENV=development CI=true vitest run --project docs-screenshots",
+    "test:e2e": "cross-env NODE_ENV=development CI=true vitest run --project e2e --maxWorkers 2",
    "test:workshop": "sh apps/workshop/test.sh",
    "test:workshop-live-provider": "node apps/workshop/tests/openrouter-live-smoke.mjs",
    "test:workshop-image": "sh apps/workshop/test-image.sh",
-    "test:ui": "cross-env NODE_ENV=development CI=true vitest --project \"!e2e\" --ui --coverage.enabled",
+    "test:ui": "cross-env NODE_ENV=development CI=true vitest --project \"!e2e\" --project \"!integration\" --project \"!docs-screenshots\" --ui",
    "typecheck": "turbo typecheck",
    "with-env": "dotenv -e .env --"
  },
@@ -51,11 +51,13 @@
    "@homarr/validation": "workspace:^0.1.0",
    "@homarr/workshop": "workspace:^0.1.0",
    "@kubernetes/client-node": "catalog:",
+    "@modelcontextprotocol/server": "catalog:",
    "@tanstack/react-query": "catalog:",
    "@trpc/client": "catalog:",
    "@trpc/react-query": "catalog:",
    "@trpc/server": "catalog:",
    "@trpc/tanstack-react-query": "catalog:",
+    "ajv": "catalog:",
    "lodash.clonedeep": "catalog:",
    "next": "catalog:",
    "react": "catalog:",
@@ -5,3 +5,5 @@ export {
  serializeCustomWidgetDefinition,
 } from "./router/custom-widget/stored-definition";
 export { configureCustomWidgetSourceFromRequest } from "./router/custom-widget/secret-persistence";
+
+export { assertCustomWidgetIntegrationBindings } from "./router/custom-widget/source-resolver";
@@ -1,3 +1,5 @@
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { addFormats, AjvJsonSchemaValidator } from "@modelcontextprotocol/server/validators/ajv";
 import type { AnyProcedure, AnyRootTypes, Router, RouterRecord } from "@trpc/server/unstable-core-do-not-import";
 import { z } from "zod/v4";

@@ -15,23 +17,35 @@ export interface McpTool {
  type: "query" | "mutation";
  pathInRouter: string[];
  inputSchema: z.core.JSONSchema.JSONSchema;
-  inputValidator: z.ZodObject;
+  inputMode: "none" | "object";
 }

-const emptyInput = z.object({});
+export interface McpToolDiagnostic {
+  name: string;
+  path: string;
+  reason: "unsupported_input" | "invalid_schema" | "duplicate_name" | "invalid_name";
+}

+export interface McpToolCatalog {
+  tools: McpTool[];
+  diagnostics: McpToolDiagnostic[];
+}
+
+const emptyInput = z.strictObject({});
+const schemaEngine = new Ajv2020({
+  strict: false,
+  validateSchema: true,
+  coerceTypes: false,
+  useDefaults: false,
+  removeAdditional: false,
+});
+addFormats(schemaEngine);
+const schemaValidator = new AjvJsonSchemaValidator(schemaEngine);
 const isProcedure = (value: AnyProcedure | RouterRecord): value is AnyProcedure => typeof value === "function";

-const mergeInputs = (inputs: z.ZodObject[]) => inputs.reduce((merged, input) => merged.extend(input.shape), emptyInput);
-
-const getObjectInput = (input: z.ZodType) => {
+const getObjectInput = (input: unknown): z.ZodObject | null => {
  if (input instanceof z.ZodObject) return input;
-
-  if (input instanceof z.ZodOptional) {
-    const unwrappedInput = input.unwrap();
-    if (unwrappedInput instanceof z.ZodObject) return unwrappedInput;
-  }
-
+  if (input instanceof z.ZodOptional) return getObjectInput(input.unwrap());
  return null;
 };

@@ -50,70 +64,110 @@ const getMcpMetadata = (meta: unknown): McpMeta["mcp"] => {
  return result;
 };

-const getProcedureInput = (inputs: z.ZodType[]) => {
-  if (inputs.length === 0) return emptyInput;
-  if (inputs.length === 1) {
-    const input = inputs[0] ?? emptyInput;
-    return getObjectInput(input) ?? input;
-  }
-
-  const objectInputs = inputs.map(getObjectInput);
-  if (objectInputs.every((input): input is z.ZodObject => input !== null)) return mergeInputs(objectInputs);
-  return null;
-};
-
-const normalizeJsonSchema = (schema: z.core.JSONSchema.JSONSchema): z.core.JSONSchema.JSONSchema => {
-  const properties = schema.properties ?? {};
-  const required = (schema.required ?? []).filter((key) => {
-    const property = properties[key];
-    return !property || typeof property !== "object" || !("default" in property);
-  });
-
-  return {
-    ...schema,
-    type: "object",
-    properties,
-    required,
-  };
-};
-
 export function extractMcpToolsFromProcedures<TRoot extends AnyRootTypes, TRecord extends RouterRecord>(
  router: Router<TRoot, TRecord>,
-): McpTool[] {
+): McpToolCatalog {
  const tools: McpTool[] = [];
+  const diagnostics: McpToolDiagnostic[] = [];
+  const names = new Map<string, string[]>();

  for (const [path, procedure] of Object.entries(router["_def"].procedures)) {
    if (!isProcedure(procedure)) continue;
    const definition = procedure["_def"];
    if (definition.type === "subscription") continue;
-
    const metadata = getMcpMetadata(definition.meta);
    if (!metadata?.enabled) continue;

-    const inputs = definition.inputs.filter((input): input is z.ZodType => input instanceof z.ZodType);
-    const procedureInput = getProcedureInput(inputs);
-
-    if (
-      procedureInput === null ||
-      (!(procedureInput instanceof z.ZodObject) && !procedureInput.safeParse(undefined).success)
-    ) {
-      console.warn(`[MCP] Procedure ${path} does not use an object input schema; using an empty schema`);
+    const name = metadata.name ?? path.replaceAll(".", "_");
+    const paths = names.get(name) ?? [];
+    paths.push(path);
+    names.set(name, paths);
+    if (!/^[a-zA-Z0-9_.-]{1,128}$/.test(name)) {
+      diagnostics.push({ name, path, reason: "invalid_name" });
+      continue;
    }
-    const inputValidator = procedureInput instanceof z.ZodObject ? procedureInput : emptyInput;

-    tools.push({
-      name: metadata.name ?? path.replaceAll(".", "_"),
-      description: metadata.description ?? "",
-      type: definition.type,
-      pathInRouter: path.split("."),
-      inputValidator,
-      inputSchema: normalizeJsonSchema(
-        z.toJSONSchema(inputValidator, {
-          unrepresentable: "any",
-        }),
-      ),
-    });
+    const inputs = definition.inputs;
+    let inputMode: McpTool["inputMode"] = "object";
+    if (inputs.every((input) => input instanceof z.ZodUndefined || input instanceof z.ZodVoid)) inputMode = "none";
+    const objectInputs = inputs.map(getObjectInput);
+    if (inputMode === "object" && !objectInputs.every((input) => input !== null)) {
+      diagnostics.push({ name, path, reason: "unsupported_input" });
+      continue;
+    }
+
+    try {
+      let input: z.ZodType = emptyInput;
+      if (inputMode === "object") {
+        const objects = objectInputs.filter((schema): schema is z.ZodObject => schema !== null);
+        input = objects[0] ?? emptyInput;
+        for (const object of objects.slice(1)) input = z.intersection(input, object);
+      }
+      const inputSchema = z.toJSONSchema(input, {
+        io: "input",
+        override: ({ zodSchema, jsonSchema }) => {
+          if (zodSchema["_zod"].def.type !== "string") return;
+          if (zodSchema["_zod"].def.checks?.some((check) => check["_zod"].def.check === "overwrite")) {
+            // trim/case normalization runs before these checks in tRPC. They cannot constrain raw JSON.
+            delete jsonSchema.minLength;
+            delete jsonSchema.maxLength;
+            delete jsonSchema.pattern;
+            delete jsonSchema.allOf;
+            delete jsonSchema.format;
+          }
+          // Zod's ISO regex permits minute precision; JSON Schema date-time requires seconds.
+          if (jsonSchema.format === "date-time" && typeof jsonSchema.pattern === "string") {
+            delete jsonSchema.format;
+          }
+        },
+      });
+      // Chained tRPC object inputs produce allOf; MCP requires an explicit object root.
+      if (inputSchema.type !== undefined && inputSchema.type !== "object") throw new Error("Invalid root");
+      inputSchema.type = "object";
+      // Zod and the SDK disagree on JSON Schema vocabulary types; compilation checks the actual schema.
+      schemaValidator.getValidator(inputSchema as Parameters<typeof schemaValidator.getValidator>[0]);
+      tools.push({
+        name,
+        description: metadata.description ?? "",
+        type: definition.type,
+        pathInRouter: path.split("."),
+        inputMode,
+        inputSchema,
+      });
+    } catch {
+      // Conversion errors can contain schema metadata. Only expose a stable, safe reason.
+      diagnostics.push({ name, path, reason: "invalid_schema" });
+    }
  }

-  return tools.toSorted((left, right) => left.name.localeCompare(right.name));
+  const duplicates = new Set<string>();
+  for (const [name, paths] of names) {
+    if (paths.length < 2) continue;
+    duplicates.add(name);
+    for (const path of paths) diagnostics.push({ name, path, reason: "duplicate_name" });
+  }
+  return {
+    tools: tools
+      .filter((tool) => !duplicates.has(tool.name))
+      .toSorted((left, right) => left.name.localeCompare(right.name)),
+    diagnostics: diagnostics.toSorted(
+      (left, right) => left.path.localeCompare(right.path) || left.reason.localeCompare(right.reason),
+    ),
+  };
+}
+
+/** Dispatch raw JSON through the caller so tRPC owns parsing, transforms, and authorization. */
+export async function callMcpTool(caller: unknown, tool: McpTool, input: unknown) {
+  let procedure = caller;
+  for (const segment of tool.pathInRouter) {
+    if ((typeof procedure !== "object" && typeof procedure !== "function") || procedure === null) {
+      throw new Error("Tool is not callable");
+    }
+    procedure = (procedure as Record<string, unknown>)[segment];
+  }
+  if (typeof procedure !== "function") throw new Error("Tool is not callable");
+  let procedureInput = input;
+  if (tool.inputMode === "none") procedureInput = undefined;
+  else if (input === undefined) procedureInput = {};
+  return await (procedure as (value: unknown) => Promise<unknown>)(procedureInput);
 }
@@ -1,5 +1,5 @@
 export { createTRPCContext } from "./trpc";
-export { extractMcpToolsFromProcedures } from "./mcp-tools";
+export { callMcpTool, extractMcpToolsFromProcedures } from "./mcp-tools";
 export type { McpTool } from "./mcp-tools";

 import { createTRPCRouter } from "./trpc";
@@ -1,3 +1,4 @@
+import { assertCustomWidgetIntegrationBindings } from "./source-resolver";
 import { TRPCError } from "@trpc/server";
 import { z } from "zod/v4";

@@ -44,6 +45,7 @@ export const creationProcedures = {
    .mutation(async ({ ctx, input }) => {
      const { secrets, ...candidate } = input;
      const definition = parseCustomWidgetAuthoringInput(() => normalizeCustomWidgetAuthoringDefinition(candidate));
+      await assertCustomWidgetIntegrationBindings(ctx, definition.sources);
      assertSecretSources(definition.sources, secrets);
      const id = await insertCustomWidgetDefinition(ctx.db, definition, ctx.session.user.id, secrets);
      logger.info("Created custom widget definition", { id, name: definition.name });
@@ -115,6 +117,7 @@ export const creationProcedures = {
      const secrets = Object.keys(session.sources).flatMap((sourceId) =>
        getPreviewSessionSecrets(session, sourceId).map((secret) => ({ sourceId, ...secret })),
      );
+      await assertCustomWidgetIntegrationBindings(ctx, definition.sources);
      assertSecretSources(definition.sources, secrets);
      const id = await insertCustomWidgetDefinition(ctx.db, definition, ctx.session.user.id, secrets);
      logger.info("Created custom widget definition from tested preview", {
@@ -1,3 +1,5 @@
+import { assertCustomWidgetIntegrationBindings } from "./source-resolver";
+import { getCustomWidgetSourceAuthType } from "@homarr/custom-widgets/core";
 import { TRPCError } from "@trpc/server";
 import { z } from "zod/v4";

@@ -60,6 +62,7 @@ export const customWidgetRouter = createTRPCRouter({
        const changes = normalizeCustomWidgetAuthoringUpdate(authoringChanges);
        return customWidgetDefinitionSchema.parse({ ...current, ...changes });
      });
+      await assertCustomWidgetIntegrationBindings(ctx, definition.sources);
      if (secrets) assertSecretSources(definition.sources, secrets);
      const definitionChanges = { ...serializeCustomWidgetDefinition(definition), updatedAt: new Date() };
      const secretRows = secrets?.map((secret) => ({
@@ -106,7 +109,7 @@ export const customWidgetRouter = createTRPCRouter({
            }

            for (const [sourceId, source] of Object.entries(definition.sources)) {
-              const kinds = [...requiredSecretKinds(typeof source.auth === "string" ? source.auth : source.auth.type)];
+              const kinds = [...requiredSecretKinds(getCustomWidgetSourceAuthType(source))];
              const where = and(
                eq(schema.customWidgetSecrets.definitionId, id),
                eq(schema.customWidgetSecrets.sourceId, sourceId),
@@ -151,7 +154,7 @@ export const customWidgetRouter = createTRPCRouter({
            }

            for (const [sourceId, source] of Object.entries(definition.sources)) {
-              const kinds = [...requiredSecretKinds(typeof source.auth === "string" ? source.auth : source.auth.type)];
+              const kinds = [...requiredSecretKinds(getCustomWidgetSourceAuthType(source))];
              const where = and(eq(customWidgetSecrets.definitionId, id), eq(customWidgetSecrets.sourceId, sourceId));
              transaction
                .delete(customWidgetSecrets)
@@ -1,3 +1,4 @@
+import { resolveCustomWidgetSource } from "./source-resolver";
 import { TRPCError } from "@trpc/server";
 import { z } from "zod/v4";

@@ -153,31 +154,19 @@ export const managementQueryProcedures = {
      });
      try {
        const values = resolveOptionRequestValues(request, input.params);
-        const authType = typeof source.auth === "string" ? source.auth : source.auth.type;
+        const connection = await resolveCustomWidgetSource(ctx, source, request, () =>
+          stored.secrets
+            .filter((secret) => secret.sourceId === request.source)
+            .map((secret) => ({ kind: secret.kind, value: decryptSecret(secret.encryptedValue) })),
+        );
        const response = await executeCustomWidgetRequest({
-          baseUrl: source.baseUrl,
-          targetUrl: renderRequestTarget(source.baseUrl, request, values),
+          ...connection,
+          targetUrl: renderRequestTarget(connection.baseUrl, request, values),
          method: request.method,
          body: renderRequestBody(request, values),
          staticHeaders: request.headers,
-          auth:
-            request.auth === "none" || authType === "none"
-              ? undefined
-              : {
-                  type: authType,
-                  secrets: stored.secrets
-                    .filter((secret) => secret.sourceId === request.source)
-                    .map((secret) => ({ kind: secret.kind, value: decryptSecret(secret.encryptedValue) })),
-                  headerName:
-                    typeof source.auth === "object" && source.auth.type === "apiKeyHeader"
-                      ? source.auth.name
-                      : typeof source.auth === "object" && source.auth.type === "apiKeyQuery"
-                        ? source.auth.name
-                        : undefined,
-                },
-          networkScope: source.networkScope,
          kind: "query",
-          cacheKey: `custom-widget:options:${input.definitionId}:${getCustomWidgetCacheVersion(stored)}:${request.id}:${hashRuntimeParams(values)}`,
+          cacheKey: `custom-widget:options:${input.definitionId}:${getCustomWidgetCacheVersion(stored)}:${request.id}:${hashRuntimeParams(values)}:${connection.cacheVersion}`,
          cacheTtlSeconds: request.cacheSeconds ?? 30,
        });
        return {
@@ -1,3 +1,4 @@
+import { getCustomWidgetSourceAuthType } from "@homarr/custom-widgets/core";
 import type { InferSelectModel } from "drizzle-orm";

 import { createLogger } from "@homarr/core/infrastructure/logs";
@@ -50,12 +51,12 @@ export function mapCustomWidgetListItem(definition: StoredDefinition & { secrets
    name: widget.name,
    description: widget.description,
    iconUrl: widget.iconUrl,
-    sources: Object.entries(widget.sources).map(([id, { name, baseUrl, networkScope, auth }]) => ({
+    sources: Object.entries(widget.sources).map(([id, source]) => ({
      id,
-      name,
-      origin: new URL(baseUrl).origin,
-      networkScope,
-      authType: typeof auth === "string" ? auth : auth.type,
+      name: source.name,
+      origin: source.type === "integration" ? source.integrationKind : new URL(source.baseUrl).origin,
+      networkScope: source.networkScope,
+      authType: source.type === "integration" ? "integration" : getCustomWidgetSourceAuthType(source),
    })),
    requestCount: Object.keys(widget.requests).length,
    missingSecrets: getCustomWidgetSecretRequirements(widget.sources).filter(
@@ -110,11 +111,11 @@ export function mapAvailableCustomWidget(definition: StoredDefinition) {
      options: widget.options,
      defaultOptions: getCustomWidgetDefaultOptions(widget.options),
      template: widget.template,
-      sources: Object.entries(widget.sources).map(([id, { name, networkScope, auth }]) => ({
+      sources: Object.entries(widget.sources).map(([id, source]) => ({
        id,
-        name,
-        networkScope,
-        authType: typeof auth === "string" ? auth : auth.type,
+        name: source.name,
+        networkScope: source.networkScope,
+        authType: source.type === "integration" ? "integration" : getCustomWidgetSourceAuthType(source),
      })),
      requestCapabilities: Object.entries(widget.requests).map(
        ([id, { kind, method, trigger, permission, confirmation, invalidates }]) => ({
@@ -29,10 +29,10 @@ export const previewActionProcedures = {
      if (definition?.kind !== "action")
        throw new TRPCError({ code: "NOT_FOUND", message: "Preview action was not found" });
      const request = { id: input.requestId, ...definition };
-      const resolved = getPreviewRequestSource(session, request.source);
+      const resolved = await getPreviewRequestSource(ctx, session, request);
      if (!resolved) throw new TRPCError({ code: "NOT_FOUND", message: "Preview source was not found" });
      const params = resolveCustomWidgetRequestValues(request, session.options, input.params);
-      const targetUrl = renderRequestTarget(resolved.source.baseUrl, request, params);
+      const targetUrl = renderRequestTarget(resolved.baseUrl, request, params);
      const body = renderRequestBody(request, params);
      if (!session.liveActions) {
        await recordPreviewJournal(session, {
@@ -66,13 +66,12 @@ export const previewActionProcedures = {
      const startedAt = Date.now();
      try {
        const response = await executeCustomWidgetRequest({
-          baseUrl: resolved.source.baseUrl,
+          ...resolved,
          targetUrl,
          method: request.method,
          body,
          staticHeaders: request.headers,
          auth: request.auth === "none" ? undefined : resolved.auth,
-          networkScope: resolved.source.networkScope,
          kind: "action",
        });
        if (response.ok && request.invalidates?.length) {
@@ -1,3 +1,5 @@
+import { assertCustomWidgetIntegrationBindings } from "./source-resolver";
+import { getCustomWidgetSourceAuthType } from "@homarr/custom-widgets/core";
 import { TRPCError } from "@trpc/server";
 import { z } from "zod/v4";

@@ -92,6 +94,7 @@ const previewCreateProcedure = permissionRequiredProcedure
    const definition = parseCustomWidgetAuthoringInput(() =>
      normalizeCustomWidgetAuthoringDefinition(input.definition),
    );
+    await assertCustomWidgetIntegrationBindings(ctx, definition.sources);
    const options = input.options ?? getCustomWidgetDefaultOptions(definition.options);
    const optionIssues = validateCustomWidgetOptions(definition.options, options);
    if (optionIssues.length > 0) {
@@ -115,7 +118,7 @@ const previewCreateProcedure = permissionRequiredProcedure
        const hasStoredSecrets = existing.secrets.some((secret) => secret.sourceId === sourceId);
        if (!submittedSource || !hasStoredSecrets || hasSameSecretBinding(existingSource, submittedSource)) continue;

-        const authType = typeof submittedSource.auth === "string" ? submittedSource.auth : submittedSource.auth.type;
+        const authType = getCustomWidgetSourceAuthType(submittedSource);
        const missingReplacement = requiredSecretKinds(authType).some(
          (kind) => !secrets.some((secret) => secret.sourceId === sourceId && secret.kind === kind),
        );
@@ -142,7 +145,7 @@ const previewCreateProcedure = permissionRequiredProcedure

    const invalid = secrets.find((secret) => {
      const source = definition.sources[secret.sourceId];
-      const authType = typeof source?.auth === "string" ? source.auth : source?.auth.type;
+      const authType = getCustomWidgetSourceAuthType(source);
      const kinds =
        authType === "basic"
          ? ["username", "password"]
@@ -1,3 +1,4 @@
+import { resolveCustomWidgetSource } from "./source-resolver";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import type { CustomJsxRequest } from "@homarr/custom-widgets/core";
 import { z } from "zod/v4";
@@ -33,25 +34,15 @@ export const recordPreviewJournal = async (...args: Parameters<typeof appendPrev
  }
 };

-export const getPreviewRequestSource = (session: CustomWidgetPreviewSession, sourceId: string) => {
-  const source = session.sources[sourceId];
+export async function getPreviewRequestSource(
+  ctx: Parameters<typeof resolveCustomWidgetSource>[0],
+  session: CustomWidgetPreviewSession,
+  request: CustomJsxRequest,
+) {
+  const source = session.sources[request.source];
  if (!source) return null;
-  const authType = typeof source.auth === "string" ? source.auth : source.auth.type;
-  const auth =
-    authType === "none"
-      ? undefined
-      : {
-          type: authType,
-          secrets: getPreviewSessionSecrets(session, sourceId),
-          headerName:
-            typeof source.auth === "object" && source.auth.type === "apiKeyHeader"
-              ? source.auth.name
-              : typeof source.auth === "object" && source.auth.type === "apiKeyQuery"
-                ? source.auth.name
-                : undefined,
-        };
-  return { source, auth };
-};
+  return resolveCustomWidgetSource(ctx, source, request, () => getPreviewSessionSecrets(session, request.source));
+}

 export function resolvePreviewRequestParams(
  request: CustomJsxRequest,
@@ -38,10 +38,10 @@ export const previewQueryProcedures = {
      if (definition?.kind !== "query")
        throw new TRPCError({ code: "NOT_FOUND", message: "Preview query was not found" });
      const request = { id: input.requestId, ...definition };
-      const resolved = getPreviewRequestSource(session, request.source);
+      const resolved = await getPreviewRequestSource(ctx, session, request);
      if (!resolved) throw new TRPCError({ code: "NOT_FOUND", message: "Preview source was not found" });
      const params = resolvePreviewRequestParams(request, session.options, input.params);
-      const targetUrl = renderRequestTarget(resolved.source.baseUrl, request, params);
+      const targetUrl = renderRequestTarget(resolved.baseUrl, request, params);
      const body = renderRequestBody(request, params);
      const release = await acquireCustomWidgetRequestLimit({
        category: "query",
@@ -52,15 +52,14 @@ export const previewQueryProcedures = {
      const startedAt = Date.now();
      try {
        const response = await executeCustomWidgetRequest({
-          baseUrl: resolved.source.baseUrl,
+          ...resolved,
          targetUrl,
          method: request.method,
          body,
          staticHeaders: request.headers,
          auth: request.auth === "none" ? undefined : resolved.auth,
-          networkScope: resolved.source.networkScope,
          kind: "query",
-          cacheKey: `custom-jsx:preview:${session.id}:${request.id}:${hashRuntimeParams(params)}`,
+          cacheKey: `custom-jsx:preview:${session.id}:${request.id}:${hashRuntimeParams(params)}:${resolved.cacheVersion}`,
          cacheTtlSeconds: request.cacheSeconds,
        });
        await recordPreviewJournal(session, {
@@ -15,7 +15,8 @@ type CustomWidgetSecretInput = CustomWidgetCreateInput["secrets"][number];
 type ConfigureCustomWidgetSourceInput = {
  definitionId: string;
  sourceId: string;
-  baseUrl: string;
+  baseUrl?: string;
+  integrationId?: string;
  networkScope?: CustomWidgetSource["networkScope"];
  secrets: CustomWidgetCreateInput["secrets"];
  expectedSource?: CustomWidgetSource;
@@ -220,11 +221,17 @@ function prepareSourceUpdate(
  if (input.expectedSource && !hasSameCustomWidgetSourceAuthentication(previousSource, input.expectedSource)) {
    throw new SourceConfigurationError("binding-changed");
  }
-  const source = customWidgetSourceSchema.parse({
-    ...previousSource,
-    baseUrl: input.baseUrl,
-    networkScope: input.networkScope ?? previousSource.networkScope,
-  });
+  let configuration: unknown;
+  if (previousSource.type === "integration") {
+    configuration = { ...previousSource, integrationId: input.integrationId };
+  } else {
+    configuration = {
+      ...previousSource,
+      baseUrl: input.baseUrl,
+      networkScope: input.networkScope ?? previousSource.networkScope,
+    };
+  }
+  const source = customWidgetSourceSchema.parse(configuration);
  assertSecretSources({ [input.sourceId]: source }, input.secrets);
  return {
    source,
@@ -16,6 +16,7 @@ export function requiredSecretKinds(authType: string) {
 * origin, while the network scope and auth destination are part of the binding.
 */
 export function hasSameSecretBinding(left: CustomWidgetSource, right: CustomWidgetSource) {
+  if (left.type === "integration" || right.type === "integration") return false;
  return (
    new URL(left.baseUrl).origin === new URL(right.baseUrl).origin &&
    left.networkScope === right.networkScope &&
@@ -24,12 +25,12 @@ export function hasSameSecretBinding(left: CustomWidgetSource, right: CustomWidg
 }

 export function assertSecretSources(
-  sources: Record<string, { auth: string | { type: string } }>,
+  sources: Record<string, { auth?: string | { type: string }; type?: string }>,
  secrets: readonly { sourceId: string; kind: "apiKey" | "username" | "password" }[],
 ) {
  const invalid = secrets.find((secret) => {
    const source = sources[secret.sourceId];
-    const authType = typeof source?.auth === "string" ? source.auth : source?.auth.type;
+    const authType = typeof source?.auth === "string" ? source.auth : source?.auth?.type;
    return !source || !authType || !new Set<string>(requiredSecretKinds(authType)).has(secret.kind);
  });
  if (invalid) {
@@ -1,3 +1,5 @@
+import { assertCustomWidgetIntegrationBindings } from "./source-resolver";
+import { getCustomWidgetSourceAuthType } from "@homarr/custom-widgets/core";
 import { TRPCError } from "@trpc/server";
 import { z } from "zod/v4";

@@ -58,12 +60,19 @@ export const secretProcedures = {

  sourceConfigure: permissionRequiredProcedure
    .requiresPermission("admin")
-    .meta({ mcp: { enabled: true, description: "Configure one custom widget API source and its credentials." } })
+    .meta({
+      mcp: {
+        enabled: true,
+        description:
+          "Configure one custom widget source. For an integration source, provide integrationId from integration_all (matching integrationKind); omit URL and secrets. Requires administrator permission.",
+      },
+    })
    .input(
      z.object({
        definitionId: z.string(),
        sourceId: z.string(),
-        baseUrl: z.string(),
+        baseUrl: z.string().optional(),
+        integrationId: z.string().min(1).max(100).optional(),
        networkScope: z.enum(["public", "private", "loopback"]).optional(),
        secrets: customWidgetSecretsInputSchema.default([]),
      }),
@@ -76,22 +85,34 @@ export const secretProcedures = {
      const definition = parseStoredCustomWidgetDefinition(stored);
      const current = definition.sources[input.sourceId];
      if (!current) throw new TRPCError({ code: "NOT_FOUND", message: "Widget source not found" });
-      const source = customWidgetSourceSchema.parse({
-        ...current,
-        baseUrl: input.baseUrl,
-        networkScope: input.networkScope ?? current.networkScope,
-      });
+      let configuration: unknown;
+      if (current.type === "integration") {
+        if (
+          !input.integrationId ||
+          input.baseUrl !== undefined ||
+          input.networkScope !== undefined ||
+          input.secrets.length > 0
+        ) {
+          throw new TRPCError({ code: "BAD_REQUEST", message: "Integration sources require only an integrationId" });
+        }
+        configuration = { ...current, integrationId: input.integrationId };
+      } else {
+        if (input.integrationId)
+          throw new TRPCError({ code: "BAD_REQUEST", message: "HTTP sources cannot bind an integration" });
+        configuration = {
+          ...current,
+          baseUrl: input.baseUrl,
+          networkScope: input.networkScope ?? current.networkScope,
+        };
+      }
+      const source = customWidgetSourceSchema.parse(configuration);
+      await assertCustomWidgetIntegrationBindings(ctx, { [input.sourceId]: source });
      assertSecretSources({ [input.sourceId]: source }, input.secrets);
-      const configuredSource = await configureCustomWidgetSource(ctx.db, {
-        definitionId: input.definitionId,
-        sourceId: input.sourceId,
-        baseUrl: source.baseUrl,
-        networkScope: input.networkScope,
-        secrets: input.secrets,
-      });
+      const configuredSource = await configureCustomWidgetSource(ctx.db, { ...input, expectedSource: current });
      return {
        definitionId: input.definitionId,
        sourceId: input.sourceId,
+        integrationId: configuredSource.integrationId,
        baseUrl: configuredSource.baseUrl,
        networkScope: configuredSource.networkScope,
        configuredSecrets: input.secrets.map(({ kind }) => kind),
@@ -110,7 +131,7 @@ export const secretProcedures = {
      }

      let widgetName: string;
-      let source: { id: string; name: string; auth: string | { type: string }; value: CustomWidgetSource } | undefined;
+      let source: { id: string; name: string; auth: CustomWidgetSource["auth"]; value: CustomWidgetSource } | undefined;
      let target: { type: "definition"; id: string } | { type: "preview"; id: string };
      if (input.definitionId) {
        const stored = await ctx.db.query.customWidgetDefinitions.findFirst({
@@ -144,7 +165,7 @@ export const secretProcedures = {
        target = { type: "preview", id: preview.id };
      }
      if (!source) throw new TRPCError({ code: "NOT_FOUND", message: "Widget source not found" });
-      const kinds = [...requiredSecretKinds(typeof source.auth === "string" ? source.auth : source.auth.type)];
+      const kinds = [...requiredSecretKinds(getCustomWidgetSourceAuthType(source))];
      const request = await createCustomWidgetConfigurationRequest({
        userId: ctx.session.user.id,
        target,
@@ -0,0 +1,85 @@
+import { TRPCError } from "@trpc/server";
+
+import type { CustomJsxRequest, CustomWidgetSource } from "@homarr/custom-widgets/core";
+import { getCustomWidgetSourceAuthType } from "@homarr/custom-widgets/core";
+import type { CustomWidgetHttpRequest } from "@homarr/custom-widgets/server";
+import { isHttpIntegrationKind } from "@homarr/definitions";
+
+import type { IntegrationHttpContext } from "../integration/integration-http";
+import {
+  getIntegrationForHttpRequest,
+  getIntegrationHttpCacheVersion,
+  getIntegrationHttpConnection,
+} from "../integration/integration-http";
+
+export async function assertCustomWidgetIntegrationBindings(
+  ctx: IntegrationHttpContext,
+  sources: Record<string, CustomWidgetSource>,
+) {
+  for (const source of Object.values(sources)) {
+    if (source.type !== "integration" || !source.integrationId) continue;
+    await resolveIntegration(ctx, source);
+  }
+}
+
+async function resolveIntegration(
+  ctx: IntegrationHttpContext,
+  source: Extract<CustomWidgetSource, { type: "integration" }>,
+) {
+  if (!source.integrationId) {
+    throw new TRPCError({
+      code: "PRECONDITION_FAILED",
+      message: "Select an existing integration for this widget source",
+    });
+  }
+  const integration = await getIntegrationForHttpRequest(ctx, source.integrationId);
+  if (!isHttpIntegrationKind(integration.kind) || integration.kind !== source.integrationKind) {
+    throw new TRPCError({
+      code: "PRECONDITION_FAILED",
+      message: "The selected integration is unavailable or has a different type",
+    });
+  }
+  return integration;
+}
+
+export async function resolveCustomWidgetSource(
+  ctx: IntegrationHttpContext,
+  source: CustomWidgetSource,
+  request: Pick<CustomJsxRequest, "kind" | "method" | "auth">,
+  getSecrets: () => Array<{ kind: string; value: string }>,
+): Promise<
+  Pick<
+    CustomWidgetHttpRequest,
+    "baseUrl" | "networkScope" | "auth" | "tls" | "pathPrefix" | "redactSecrets" | "resolveConnectionAsync"
+  > & {
+    cacheVersion: string;
+  }
+> {
+  if (source.type !== "integration") {
+    const authType = getCustomWidgetSourceAuthType(source);
+    let auth: CustomWidgetHttpRequest["auth"];
+    if (request.auth !== "none" && authType !== "none") {
+      auth = { type: authType, secrets: getSecrets() };
+      if (typeof source.auth === "object") auth.headerName = source.auth.name;
+    }
+    return { baseUrl: source.baseUrl, networkScope: source.networkScope, auth, cacheVersion: "" };
+  }
+  const integration = await resolveIntegration(ctx, source);
+  return getIntegrationHttpConnection(integration, request.auth !== "none");
+}
+
+export async function getCustomWidgetIntegrationCacheVersions(
+  ctx: IntegrationHttpContext,
+  sources: Record<string, CustomWidgetSource>,
+) {
+  return Promise.all(
+    Object.entries(sources).flatMap(([sourceId, source]) => {
+      if (source.type !== "integration") return [];
+      return [
+        resolveIntegration(ctx, source)
+          .then((integration) => `${sourceId}:${getIntegrationHttpCacheVersion(integration)}`)
+          .catch(() => `${sourceId}:unavailable`),
+      ];
+    }),
+  );
+}
@@ -1,3 +1,5 @@
+import { exportCustomWidgetDefinition } from "@homarr/custom-widgets/core";
+import { assertCustomWidgetIntegrationBindings } from "./source-resolver";
 import { TRPCError } from "@trpc/server";
 import { parse as parseSuperJson } from "superjson";
 import { z } from "zod/v4";
@@ -24,7 +26,7 @@ export const transferProcedures = {
        where: eq(customWidgetDefinitions.id, input.id),
      });
      if (!definition) throw new TRPCError({ code: "NOT_FOUND" });
-      return parseStoredCustomWidgetDefinition(definition);
+      return exportCustomWidgetDefinition(parseStoredCustomWidgetDefinition(definition));
    }),

  exportLegacy: permissionRequiredProcedure
@@ -57,6 +59,7 @@ export const transferProcedures = {
    .requiresPermission("admin")
    .input(z.object({ widget: customWidgetImportSchema, secrets: customWidgetSecretsInputSchema.default([]) }))
    .mutation(async ({ ctx, input }) => {
+      await assertCustomWidgetIntegrationBindings(ctx, input.widget.sources);
      assertSecretSources(input.widget.sources, input.secrets);
      const id = await insertCustomWidgetDefinition(ctx.db, input.widget, ctx.session.user.id, input.secrets);
      logger.info("Imported custom widget definition", { id, name: input.widget.name });
@@ -80,6 +83,7 @@ export const transferProcedures = {
      }),
    )
    .mutation(async ({ ctx, input }) => {
+      await assertCustomWidgetIntegrationBindings(ctx, input.widget.sources);
      assertSecretSources(input.widget.sources, input.secrets);
      const [legacy, current] = await Promise.all([
        ctx.db.query.legacyCustomWidgetDefinitions.findFirst({
@@ -157,7 +161,7 @@ function canPreserveLegacySecrets(
  widget: z.infer<typeof customWidgetImportSchema>,
 ) {
  const source = widget.sources.default;
-  if (!source || getAuthType(source.auth) !== legacy.authType) return false;
+  if (!source || source.type === "integration" || getAuthType(source.auth) !== legacy.authType) return false;
  if (getOrigin(source.baseUrl) !== getOrigin(legacy.url)) return false;
  const headerName = typeof source.auth === "object" && "name" in source.auth ? source.auth.name : undefined;
  return headerName === (legacy.headerName ?? undefined);
@@ -1,3 +1,5 @@
+import { exportCustomWidgetDefinition } from "@homarr/custom-widgets/core";
+import { assertCustomWidgetIntegrationBindings } from "./source-resolver";
 import { TRPCError } from "@trpc/server";
 import { z } from "zod/v4";

@@ -56,7 +58,7 @@ async function getWorkshopWidget(submissionId: string) {
    if (!validation.success) {
      throw new TRPCError({ code: "BAD_REQUEST", message: validation.error });
    }
-    return { submission, widget: validation.data };
+    return { submission, widget: exportCustomWidgetDefinition(validation.data) };
  } catch (error) {
    if (error instanceof TRPCError) throw error;
    throwWorkshopUnavailable("Workshop widget lookup failed", "workshop_widget_lookup_failed");
@@ -72,7 +74,8 @@ const workshopSearchInputSchema = z.object({
 const sourceOverridesSchema = z.record(
  customWidgetIdentifierSchema,
  z.strictObject({
-    baseUrl: z.string(),
+    baseUrl: z.string().optional(),
+    integrationId: z.string().min(1).max(100).optional(),
    networkScope: z.enum(["public", "private", "loopback"]).optional(),
  }),
 );
@@ -165,12 +168,14 @@ export const workshopProcedures = {
              sourceId,
              {
                baseUrl: source.baseUrl,
+                integrationId: source.integrationId,
                networkScope: source.networkScope ?? widget.sources[sourceId]?.networkScope ?? "public",
              },
            ]),
          ),
        ),
      });
+      await assertCustomWidgetIntegrationBindings(ctx, configured.sources);
      assertSecretSources(configured.sources, input.secrets);
      const id = await insertCustomWidgetDefinition(ctx.db, configured, ctx.session.user.id, input.secrets);
      const configuredSecrets = new Set(input.secrets.map((secret) => `${secret.sourceId}:${secret.kind}`));
@@ -0,0 +1,126 @@
+import { createHash } from "node:crypto";
+import { TRPCError } from "@trpc/server";
+
+import type { Session } from "@homarr/auth";
+import { constructIntegrationPermissions } from "@homarr/auth/shared";
+import { decryptSecret } from "@homarr/common/server";
+import {
+  getAllTrustedCertificatesAsync,
+  getTrustedCertificateHostnamesAsync,
+} from "@homarr/core/infrastructure/certificates";
+import { createCustomCheckServerIdentity } from "@homarr/core/infrastructure/http";
+import { CustomWidgetDomainError } from "@homarr/custom-widgets/server";
+import type { CustomWidgetAuthConfig, CustomWidgetHttpRequest } from "@homarr/custom-widgets/server";
+import type { Database } from "@homarr/db";
+import { eq, inArray } from "@homarr/db";
+import { groupMembers, integrations, integrationGroupPermissions, integrationUserPermissions } from "@homarr/db/schema";
+import { getIntegrationHttpAuthenticationAsync } from "@homarr/integrations/factory";
+import type { IntegrationHttpAuthentication } from "@homarr/integrations/factory";
+
+export interface IntegrationHttpContext {
+  db: Database;
+  session: Session | null;
+}
+
+export async function getIntegrationForHttpRequest(ctx: IntegrationHttpContext, integrationId: string) {
+  const userId = ctx.session?.user.id ?? "";
+  const groups = await ctx.db.query.groupMembers.findMany({ where: eq(groupMembers.userId, userId) });
+  const integration = await ctx.db.query.integrations.findFirst({
+    where: eq(integrations.id, integrationId),
+    with: {
+      secrets: true,
+      userPermissions: { where: eq(integrationUserPermissions.userId, userId) },
+      groupPermissions: {
+        where: inArray(integrationGroupPermissions.groupId, groups.map(({ groupId }) => groupId).concat("")),
+      },
+    },
+  });
+  // An arbitrary read can expose service credentials or perform a mutation. Native
+  // integration use/interact permissions authorize only Homarr's bounded operations.
+  if (!integration || !constructIntegrationPermissions(integration, ctx.session).hasFullAccess) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Arbitrary integration requests require full integration access",
+    });
+  }
+  return integration;
+}
+
+type HttpIntegration = Awaited<ReturnType<typeof getIntegrationForHttpRequest>>;
+
+export function getIntegrationHttpCacheVersion(integration: HttpIntegration) {
+  return createHash("sha256")
+    .update(JSON.stringify([integration.id, integration.kind, integration.url, integration.secrets]))
+    .digest("hex")
+    .slice(0, 16);
+}
+
+export async function getIntegrationHttpConnection(integration: HttpIntegration, authenticate = true) {
+  try {
+    const secrets = integration.secrets.map(({ kind, value }) => ({ kind, value: decryptSecret(value) }));
+    let baseUrl = integration.url;
+    if (integration.kind === "ical") baseUrl = secrets.find(({ kind }) => kind === "url")?.value ?? "";
+    return {
+      baseUrl,
+      networkScope: "loopback" as const,
+      pathPrefix: new URL(baseUrl).pathname,
+      redactSecrets: secrets,
+      cacheVersion: getIntegrationHttpCacheVersion(integration),
+      resolveConnectionAsync: async () => {
+        try {
+          let authentication: IntegrationHttpAuthentication = {};
+          if (authenticate) {
+            authentication = await getIntegrationHttpAuthenticationAsync({
+              ...integration,
+              externalUrl: null,
+              decryptedSecrets: secrets,
+            });
+          }
+          const auth = toWidgetAuth(authentication, secrets);
+          const url = new URL(authentication.baseUrl ?? baseUrl);
+          let tls: CustomWidgetHttpRequest["tls"];
+          if (url.protocol === "https:") {
+            const [ca, hostnames] = await Promise.all([
+              getAllTrustedCertificatesAsync(),
+              getTrustedCertificateHostnamesAsync(),
+            ]);
+            tls = { ca, checkServerIdentity: createCustomCheckServerIdentity(hostnames) };
+          }
+          return { baseUrl: url.href, auth, tls, pathPrefix: url.pathname, redactSecrets: auth.secrets };
+        } catch {
+          throw new CustomWidgetDomainError({
+            code: "BAD_GATEWAY",
+            message: "Integration connection could not be resolved",
+          });
+        }
+      },
+    };
+  } catch {
+    throw new TRPCError({ code: "PRECONDITION_FAILED", message: "Integration connection could not be resolved" });
+  }
+}
+
+function toWidgetAuth(
+  authentication: IntegrationHttpAuthentication,
+  secrets: CustomWidgetAuthConfig["secrets"],
+): CustomWidgetAuthConfig {
+  const authSecrets = [...secrets, ...(authentication.redactValues ?? []).map((value) => ({ kind: "session", value }))];
+  const refresh = authentication.refreshAsync;
+  return {
+    ...authentication,
+    type: "integration",
+    secrets: authSecrets,
+    refreshAsync:
+      refresh &&
+      (async () => {
+        try {
+          return toWidgetAuth(await refresh(), secrets);
+        } catch {
+          throw new CustomWidgetDomainError({
+            code: "BAD_GATEWAY",
+            message: "Integration session could not be refreshed",
+          });
+        }
+      }),
+  };
+}
@@ -56,7 +56,7 @@ export const inviteRouter = createTRPCRouter({
    .requiresPermission("admin")
    .input(
      z.object({
-        expirationDate: z.date(),
+        expirationDate: z.iso.datetime({ offset: true }),
      }),
    )
    .output(z.object({ id: z.string(), token: z.string() }))
@@ -80,7 +80,7 @@ export const inviteRouter = createTRPCRouter({

      await ctx.db.insert(invites).values({
        id,
-        expirationDate: input.expirationDate,
+        expirationDate: new Date(input.expirationDate),
        creatorId: ctx.session.user.id,
        token,
      });
@@ -42,7 +42,8 @@ if (!jellyfin) throw new Error("Jellyfin bundled widget is missing");
 const pokedex = BUNDLED_CUSTOM_WIDGETS.find(({ id }) => id === "seed-pokedex")?.widget;
 if (!pokedex) throw new Error("Pokédex bundled widget is missing");
 const jellyfinDefaultSource = jellyfin.sources.default;
-if (!jellyfinDefaultSource) throw new Error("Jellyfin default source is missing");
+if (!jellyfinDefaultSource || jellyfinDefaultSource.type === "integration")
+  throw new Error("Jellyfin default source is missing");

 function createCaller(db: ReturnType<typeof createDb>) {
  return customWidgetRouter.createCaller({ db, deviceType: undefined, session });
@@ -181,7 +182,7 @@ describe("custom widget definition persistence", () => {
    }

    const defaultSource = previewSession.sources.default;
-    if (!defaultSource) throw new Error("Pokédex preview source is missing");
+    if (!defaultSource || defaultSource.type === "integration") throw new Error("Pokédex preview source is missing");
    await configurePreviewSessionSource(previewSession.id, userId, "default", { ...defaultSource }, []);
    await expect(caller.createFromPreview(createInput)).rejects.toThrow("Test every final preview query successfully");

@@ -675,7 +676,7 @@ describe("custom widget definition persistence", () => {
    const created = await createCaller(db).create({ ...jellyfin, secrets: [secret] });
    const definition = customWidgetDefinitionSchema.parse(jellyfin);
    const defaultSource = definition.sources.default;
-    if (!defaultSource) throw new Error("Jellyfin default source is missing");
+    if (!defaultSource || defaultSource.type === "integration") throw new Error("Jellyfin default source is missing");
    await db
      .update(customWidgetDefinitions)
      .set(
@@ -720,7 +721,7 @@ describe("custom widget definition persistence", () => {
    const created = await createCaller(db).create({ ...jellyfin, secrets: [] });
    const definition = customWidgetDefinitionSchema.parse(jellyfin);
    const expectedSource = definition.sources.default;
-    if (!expectedSource || typeof expectedSource.auth === "string") {
+    if (!expectedSource || expectedSource.type === "integration" || typeof expectedSource.auth === "string") {
      throw new Error("Jellyfin default source must use header authentication");
    }
    await db
@@ -123,7 +123,7 @@ describe("create should create a new invite expiring on the specified date with

    // Act
    const result = await caller.createInvite({
-      expirationDate,
+      expirationDate: expirationDate.toISOString(),
    });

    // Assert
Author	SHA1	Message	Date
ajnart	db4b6bf4b5	refactor: let integrations own HTTP authentication	2026-09-12 23:57:33 +02:00
ajnart	8157a43b9b	fix: make integration types searchable	2026-09-12 23:39:10 +02:00
ajnart	901fd3d940	feat: reuse authentication for all HTTP integrations	2026-09-12 23:33:23 +02:00
ajnart	879a4ae23c	fix: render integration sources in Workshop details	2026-09-12 22:45:52 +02:00
ajnart	d0529079ec	fix: remove unused request type import	2026-09-12 20:32:03 +02:00
ajnart	c2a587bda7	fix: share integration transport and enforce access	2026-09-12 20:26:39 +02:00
ajnart	52c82f72db	feat: reuse integrations in custom widgets	2026-09-12 20:17:07 +02:00
Thomas	c32a5317ca	fix: remove apps multi-select toggle (#6834 )	2026-09-12 16:34:03 +02:00
Thomas	f18033ddaa	fix: sync dev fixes into v2 and improve regression reports (#6821 ) Co-authored-by: Homarr Update Contributors <210161987+homarr-update-contributors[bot]@users.noreply.github.com> Co-authored-by: Crowdin Homarr <190541745+homarr-crowdin[bot]@users.noreply.github.com> Co-authored-by: Releases Homarr <175486441+homarr-releases[bot]@users.noreply.github.com> Co-authored-by: Thomas <thomas@ajnart.fr> Co-authored-by: homarr-releases[bot] <175486441+homarr-releases[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: homarr-update-contributors[bot] <210161987+homarr-update-contributors[bot]@users.noreply.github.com> Co-authored-by: homarr-crowdin[bot] <190541745+homarr-crowdin[bot]@users.noreply.github.com> Co-authored-by: Afonso Jorge Ramos <afonsojorgeramos@gmail.com> Co-authored-by: Danura30082 <danura30082+github@gmail.com> Co-authored-by: Kushie <122986913+kushiemoon-dev@users.noreply.github.com> Closes #6604	2026-09-12 15:31:04 +02:00
Thomas	ff2b589380	fix(board): refine container spacing and collapse layout (#6833 )	2026-09-12 15:23:50 +02:00
Thomas	9bc3802b3b	fix(wud): authenticate HTTP requests and validate container access (#6831 )	2026-09-12 10:57:36 +02:00
Thomas	2049c6ade0	fix: tighten v2 setup and release safeguards (#6824 )	2026-09-12 10:47:35 +02:00
ajnart	e21a0bb6da	fix: refresh OpenAPI widget kinds	2026-09-12 10:46:39 +02:00
Thomas	61f22c8e64	fix: show board removal confirmation in a dialog (#6829 )	2026-09-12 10:36:36 +02:00
leafyelin	6cca757493	feat(plugins): add llama.cpp server integration and widget (#6765 )	2026-09-10 20:06:13 +02:00
Thomas	1102ad8342	fix: protect demo users from deletion and password changes (#6819 )	2026-09-10 19:52:47 +02:00
Thomas	7c00c18a42	docs(mcp): restore custom widget authoring guidance (#6817 )	2026-09-10 19:24:55 +02:00
Thomas	ea3dac752f	fix(mcp): harden tool schemas and dispatch (#6815 )	2026-09-10 19:19:47 +02:00
Thomas	f994d665d2	ci: remove automatic test gates and trim test suites (#6816 ) * ci: remove automatic test gates and trim test suites * docs: remove CI audit report	2026-09-10 19:14:31 +02:00
Thomas	3358b6337f	fix(mcp): use JSON-compatible invitation dates (#6814 )	2026-09-10 17:53:38 +02:00
Thomas	61d3fd5f08	fix(board): restore container grid geometry (#6808 )	2026-09-09 15:04:27 +02:00
Thomas	3aac106156	docs: correct v2 beta installation guidance (#6809 )	2026-09-09 12:09:14 +02:00