fix: avoid ESM lexer imports in migration bundles

feat: add custom widget flow workbench
fix: remove apps multi-select toggle (#6834 )
2026-09-12 23:56:54 +02:00 · 2026-09-12 22:51:46 +02:00 · 2026-09-12 16:34:03 +02:00 · 2026-09-12 15:31:04 +02:00 · 2026-09-12 15:23:50 +02:00 · 2026-09-12 10:57:36 +02:00
710 changed files with 65378 additions and 35294 deletions
@@ -37,4 +37,4 @@ Orient from the current checkout before editing. Treat package manifests, export
 - Cron jobs: `packages/cron-jobs/src/jobs/`
 - App routes: `apps/nextjs/src/app/[locale]/`

-When a code change affects users, invoke `documentation-sync`. When exposing tRPC through MCP, invoke `mcp-integration`.
+Invoke `documentation-sync` when hidden capabilities or information not evident to an advanced user change, or existing guidance becomes inaccurate; follow the Documentation Sync criteria in `AGENTS.md`. When exposing tRPC through MCP, invoke `mcp-integration`.
@@ -32,24 +32,23 @@ Import only from an exported package entrypoint. Do not deep-import `@homarr/com

 ## Root exports

-| Area              | Public exports                                                                                                                                       | Purpose                                                         |
-| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
-| Objects           | `objectKeys`, `objectEntries`, `hashObjectBase64`                                                                                                    | Typed key/entry iteration and stable query-key hashing          |
-| Strings           | `capitalize`, `isNullOrWhitespace`, `bestMatch`, `normalizeImageName`, `getImageMatchRank`                                                           | Text normalization and matching                                 |
-| Cookies           | `parseCookies`, `setClientCookie`                                                                                                                    | Cookie parsing and browser cookie serialization                 |
-| Arrays            | `splitToNChunks`, `splitToChunksWithNItems`                                                                                                          | Split by number of groups or maximum group size                 |
-| Dates             | `formatDuration`, `toValidDate`, `isDateWithin`                                                                                                      | Duration formatting, safe date coercion, relative-window checks |
-| Timing            | `Stopwatch`                                                                                                                                          | Elapsed-time measurement and formatting                         |
-| React hooks       | `useTimeAgo`, `useIntegrationConnected`                                                                                                              | Relative time and integration freshness state                   |
-| URLs              | `removeTrailingSlash`, `extractBaseUrlFromHeaders`, `getPortFromUrl`, `isAbsoluteUrl`, `SAFE_NEW_TAB_REL`, `getSafeApplicationUrl`, `getSafeAppHref` | URL normalization, safe navigation, ports, and new-tab policy   |
-| Numbers and bytes | `formatNumber`, `randomInt`, `formatBytes`, `formatBytesPair`, `formatByteRate`, `metricToImperial`, `imperialToMetric`                              | Compact numbers, byte displays, rates, and unit conversion      |
-| Legacy bytes      | `humanFileSize`                                                                                                                                      | Deprecated; use the `formatBytes*` helpers in new code          |
-| Byte types        | `ByteUnitSystem`, `FormatBytesOptions`                                                                                                               | Options for byte formatting                                     |
-| Errors            | `extractErrorMessage`, `FlattenError`                                                                                                                | Unknown-error messages and flattenable domain errors            |
-| Theme             | `getMantineColor`                                                                                                                                    | Resolve a Mantine color and shade                               |
-| Functions         | `isFunction`                                                                                                                                         | Unknown-value function guard                                    |
-| Grid              | `GridAlgorithmItem`, `generateResponsiveGridFor`                                                                                                     | Responsive nested-section grid placement                        |
-| IDs               | `createId`                                                                                                                                           | CUID2 ID creation                                               |
+| Area              | Public exports                                                                                                                                       | Purpose                                                                |
+| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
+| Objects           | `objectKeys`, `objectEntries`, `isRecord`, `hashObjectBase64`                                                                                        | Typed key/entry iteration, record guards, and stable query-key hashing |
+| Strings           | `capitalize`, `isNullOrWhitespace`, `bestMatch`, `normalizeImageName`, `getImageMatchRank`                                                           | Text normalization and matching                                        |
+| Cookies           | `parseCookies`, `setClientCookie`                                                                                                                    | Cookie parsing and browser cookie serialization                        |
+| Arrays            | `splitToNChunks`, `splitToChunksWithNItems`                                                                                                          | Split by number of groups or maximum group size                        |
+| Dates             | `formatDuration`, `toValidDate`, `isDateWithin`                                                                                                      | Duration formatting, safe date coercion, relative-window checks        |
+| Timing            | `Stopwatch`                                                                                                                                          | Elapsed-time measurement and formatting                                |
+| React hooks       | `useTimeAgo`, `useIntegrationConnected`                                                                                                              | Relative time and integration freshness state                          |
+| URLs              | `removeTrailingSlash`, `extractBaseUrlFromHeaders`, `getPortFromUrl`, `isAbsoluteUrl`, `SAFE_NEW_TAB_REL`, `getSafeApplicationUrl`, `getSafeAppHref` | URL normalization, safe navigation, ports, and new-tab policy          |
+| Numbers and bytes | `formatNumber`, `formatBytes`, `formatBytesPair`, `formatByteRate`, `formatBitRate`, `defaultByteUnitSystem`, `metricToImperial`                     | Compact numbers, byte displays, byte/bit rates, and unit conversion    |
+| Byte types        | `ByteUnitSystem`, `FormatBytesOptions`, `FormatBitRateOptions`                                                                                       | Options for byte and bit-rate formatting                               |
+| Errors            | `extractErrorMessage`, `FlattenError`                                                                                                                | Unknown-error messages and flattenable domain errors                   |
+| Theme             | `getMantineColor`                                                                                                                                    | Resolve a Mantine color and shade                                      |
+| Functions         | `isFunction`                                                                                                                                         | Unknown-value function guard                                           |
+| Grid              | `GridAlgorithmItem`, `generateResponsiveGridFor`                                                                                                     | Responsive nested-section grid placement                               |
+| IDs               | `createId`                                                                                                                                           | CUID2 ID creation                                                      |

 The root deliberately does not re-export `types`, `server`, `client`, or `env`; use their named entrypoints.

@@ -1,13 +1,17 @@
 ---
 name: documentation-sync
-description: Keep Homarr's Docusaurus documentation aligned with user-facing code. Use when adding or changing integrations, widgets, APIs, environment variables, CLI commands, authentication, permissions, cron jobs, settings, or UI behavior that users must understand.
+description: Write concise Homarr docs for advanced users, covering only hidden capabilities and information not evident from the UI. Use when that information changes or existing guidance becomes inaccurate; skip obvious controls and routine fixes.
 ---

 # Documentation Sync

-Update `apps/docs/` in the same change as user-facing behavior. Inspect adjacent pages and the docs types before copying a pattern; the source and docs evolve together.
+Apply the audience and scope rules in `AGENTS.md` first. Before adding a passage, identify what an advanced user could not learn directly from the interface. If there is no such information, omit it.

-## Map the change
+For hidden capabilities such as the advanced widget feature, explain discovery, activation, and non-obvious behavior. For visible standard controls such as Delete, omit narration of what the label already conveys. Use the shortest explanation that preserves necessary technical detail; remove redundant prose in the passage being edited.
+
+When an update is warranted, inspect adjacent pages for structure and types, not as a verbosity target. The mappings below locate needed information; they do not require a page for every feature or code change.
+
+## Locate a needed update

 | Code change                         | Documentation target                                                 |
 | ----------------------------------- | -------------------------------------------------------------------- |
@@ -40,11 +44,11 @@ For a widget:

 - Add or update `apps/docs/docs/widgets/<slug>/index.ts` with the local `WidgetDefinition` pattern.
 - Add or update `index.mdx` with the established `WidgetHeader`, `WidgetConfig`, and `AddingWidget` components as applicable.
- Document options, required integrations, permissions, empty states, and changed behavior that affect setup or use.
+- Explain only non-obvious option semantics, integration prerequisites, permission constraints, or behavior that the interface does not make clear.

 ## Completion criteria

-1. Describe the shipped behavior, not an implementation plan.
+1. Every passage adds information an advanced user cannot reasonably infer from the interface. Remove obvious, repetitive, or unnecessary prose.
 2. Keep names, defaults, paths, screenshots, links, and prerequisites consistent with code.
 3. Update every affected page and remove superseded guidance.
 4. Run the narrowest useful docs validation. Use `pnpm turbo build --filter=@homarr/docs` when links, MDX, generated definitions, or navigation can fail; otherwise run the docs package formatter on touched files.
@@ -1,20 +1,20 @@
 ---
 name: homarr-custom-widget
-description: Author, validate, preview, test, install, or configure API-backed Homarr Custom JSX v2 widgets.
+description: Author, validate, preview, install, or configure Homarr Custom JSX v2/v3 widgets, including static and native integration widgets.
 ---

 # Homarr Custom Widget

-Author one widget or a coordinated set of widgets. Load only needed release-matched context. Run lifecycle tools alone; independent reads may run together. For a set, research once and finish each widget's validation, evidence, and persistence before the next.
+Load release-matched context. Run lifecycle tools alone; independent reads may run together. For a set, research once, then validate, preview, and persist each widget before the next.

-1. Read primary API documentation. Use web search when documentation is not supplied or may have changed.
+1. For HTTP widgets, read primary API documentation. For native capabilities, discover installed schemas. Static widgets need no service.
 2. Create credential-free definitions with keyed `sources`, `requests`, optional `options`, and safe JSX `template`.
 3. While drafting, use `customWidget_validateTemplate` for focused JSX diagnostics without resending the manifest.
-4. Send the definition once to `customWidget_previewCreate` and test its queries/actions. For a JSX-only fix, validate, call `customWidget_previewReviseTemplate` with its session, and retest; it inherits the manifest and resets evidence. Create a preview only for source/request/option changes.
+4. Send the definition once to `customWidget_previewCreate` and test its HTTP/native queries and simulated actions. For a JSX-only fix, validate, call `customWidget_previewReviseTemplate` with its session, and retest; it inherits the manifest and resets evidence. Other definition changes require a fresh preview.
 5. Configure deployment-specific source URLs and credentials through Homarr; never repeat plaintext.
 6. Persist each exact final tested preview with `customWidget_createFromPreview`. Do not resend a large definition through `customWidget_create` when a preview session is available.

-Treat a supplied sample or successful preview response as the binding contract. Render every core requested field, guard optional arrays and nested values before indexing, and do not silently drop returned items. Humanize numeric enums with indexed literal label arrays, omit absent numeric values instead of inventing zero, and label timestamp timezones. Give recoverable load errors and empty states a clear refresh or retry path.
+Treat sample and preview responses as binding contracts. Render requested fields, guard optional values, humanize enums, and label timezones. Give errors and empty states a retry path.

 Use `{option:name}` or `$option` for saved options. Use `{param:name}` or `$param` for values supplied by `SubFetch`, `ActionButton`, or `ToggleSwitch`. Load queries cannot use invocation parameters. Render load queries from `data` and `status` with `RefreshButton`; reserve `SubFetch` for manual parameterized queries. Templates read `data`, `status`, `options`, and temporary `inputs`.

@@ -24,11 +24,7 @@ For a bound control that depends on another input, declare its default and set `

 Plan capabilities. Use one `customWidget_findComponents` search per job. Batch selected non-obvious binding or interaction documentation with `customWidget_getComponents`; reserve `customWidget_getComponent` for one unknown-prop repair. Failed validation reopens discovery; otherwise search only for a missing capability. The full catalog is for broad exploration; load at most one example. Context never limits composition. Prefer clear hierarchy, responsive grids, divided lists, and aligned actions over nested row cards.

-Do not simplify a useful workflow merely because the template is interpreted. Freely compose any supported installed components with multiple sources, requests, options, `choicesFrom`, bound filters, charts, responsive detail areas, manual queries, and safe actions when they improve the user's job. Complexity must remain purposeful rather than decorative.
-
-Polish with a divided list or responsive media grid. Make one metric/action asymmetrically primary; keep headers compact, identity/state clear, metadata quiet, and one badge. At base artwork fills its row and caps above xs; never combine full-width media and nowrap.
-
-Make initial states actionable and wrap variable labels/values on narrow tiles. Do not use an unlabeled decorative icon as an empty state.
+Compose installed components freely around the requested workflow. Use responsive layouts, clear hierarchy, quiet metadata, and actionable initial states. Wrap variable labels on narrow tiles and label interactive icons.

 Do not use imports, hooks, refs, raw HTML, raw event callbacks, browser requests, arbitrary functions, eval, bigint, npm packages, authored statement blocks, IIFEs, or recursion. Do not pretend MCP tools exist in an offline chat session.

@@ -12,7 +12,7 @@ Templates read `data.requestId`, `status.requestId`, `options.name`, and tempora
 </SubFetch>
 ```

-Manual queries require `trigger: "manual"` on request and `SubFetch`; otherwise they run automatically. `triggerContent` with `triggerAriaLabel` makes custom content the launcher. `SubFetch` owns loading/error/retry; its child receives success plus `{ ok, status, statusText, loading: false }`. Never author `onClick` or fetch callbacks.
+Manual queries require `trigger: "manual"` on request and `SubFetch`. Use `triggerContent` and `triggerAriaLabel` for a custom launcher. `SubFetch` owns loading/error/retry; its child receives success plus `{ ok, status, statusText, loading: false }`.

 `SubFetch`, `ActionButton`, and `ToggleSwitch` need literal `requestId`; validation rejects missing/computed IDs.

@@ -35,3 +35,5 @@ Every stateful control must use `bind`, and its `inputs.<name>` value must feed
 Callback parameters must not shadow the reserved roots `data`, `status`, `options`, or `inputs`. Use `<Icon name="refresh" />` or `<TablerIcon name="refresh" />`; never invent components such as `<IconFoo />`.

 Use expression callbacks for supported collections and trusted slots. No callback blocks, IIFEs, authored recursion, or raw events. Regex is limited to safe string operations.
+
+V3 adds scoped `className` styles, `View` fragments, `WidgetModal`, `WidgetDrawer`, and `AppEmbed`. Bound controls use `persist` for declared browser preferences or `content` for shared drafts saved with `ContentSaveButton`. `NativeQuery` and `NativeActionButton` invoke declared native IDs; actions retain preview simulation and integration permissions. Fetch component contracts before using these helpers.
@@ -13,7 +13,7 @@ interface HomarrCustomWidgetV2 {
 }
 ```

-The object key `default` is the required source ID; `default` is not a property on a source. Source properties are `name?`, `baseUrl`, `networkScope`, and `auth?`:
+Sources are keyed by ID. Empty `sources` and `requests` support static widgets. Each HTTP request must reference an existing source; omitting its source selects `default`. Source properties are `name?`, `baseUrl`, `networkScope`, and `auth?`:

 ```json
 {
@@ -47,3 +47,5 @@ Use stable real URLs for public APIs and clear suggested URLs for self-hosted se
 Paths use `{option:name}` and `{param:name}`; query/body references use `{ "$option": "name" }` and `{ "$param": "name" }`. Constants stay primitive (`take: 10`); `$param` is only for manual helpers, never load queries. Names and types are inferred.

 Every option has `label`, `control`, and `default`. Optional fields are `description`, `choices`, `choicesFrom`, `min`, `max`, `step`, `advanced`, and `group`.
+
+V3 uses `$schema: "homarr-custom-widget-v3"` and optional `extensions`: `stylesheet`, `fragments`, `preferences`, `content`, and `native`. Read `customWidget_schema` for their exact shapes. Integration options use `control: "integration"`, `default: ""`, and optional `integrationKinds`; installations choose local integrations. Discover native input schemas through `customWidget_nativeCapabilities`. Editor layout is separate from the manifest.
@@ -4,4 +4,4 @@ All requests use Homarr's protected server executor. Source origin, network scop

 The JSX interpreter blocks imports, hooks, refs, raw event callbacks, browser requests, eval, arbitrary functions, prototype access, unsafe URLs, global CSS escape, arbitrary portals, bigint, statement blocks, IIFEs, and recursion. Regex literals must be bounded and reject backreferences, lookbehind, nested quantifiers, excessive length, and unsupported flags.

-Credentials are stored separately and never exported or returned to an agent. A published self-hosted source URL is only a suggestion: installers must confirm or replace private and loopback URLs for their own Homarr deployment. Source origins cannot be controlled through widget options.
+Credentials stay local and are never exported. Installers confirm or replace suggested private and loopback URLs for their deployment. Source origins are fixed by configuration.
@@ -1,22 +1,25 @@
 # Since .env is gitignored, you can use .env.example to build a new `.env` file when you clone the repo.
-# Keep this file up-to-date when you add new variables to \`.env\`.
+# Keep this file up-to-date when you add new variables to `.env`.

 # This file will be committed to version control, so make sure not to have any secrets in it.
 # If you are cloning this repo, create a copy of this file named `.env` and populate it with your secrets.

-# The below secret is not used anywhere but required for Auth.js (Would encrypt JWTs and Mail hashes, both not used)
-AUTH_SECRET="supersecret"
+# Generate two different 64-character hex values with `openssl rand -hex 32` before starting Homarr.
+# Never reuse these values or commit the populated `.env` file.
+AUTH_SECRET=

 # The below secret is used to encrypt integration secrets in the database.
-# It should be a 32-byte string, generated by running `openssl rand -hex 32` on Unix
-# or starting the project without any (which will show a randomly generated one).
-SECRET_ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000
+# Homarr will reject an empty or invalid value and print a randomly generated candidate.
+SECRET_ENCRYPTION_KEY=

 LOG_LEVEL='info'

 # This is how you can use the sqlite driver:
 DB_DRIVER='better-sqlite3'
-DB_URL='FULL_PATH_TO_YOUR_SQLITE_DB_FILE'
+# Set an absolute writable SQLite path so migrations and the app use the same file.
+# Their working directories differ; do not use a relative path here.
+# Container images use /appdata/db/db.sqlite by default instead.
+DB_URL=

 # Those are the two ways to use the mysql2 driver:
 # 1. Using the URL format:
@@ -63,6 +66,8 @@ UNSAFE_ENABLE_MOCK_INTEGRATION=true

 # Public URL contract. Values must be absolute HTTP(S) URLs without credentials,
 # query strings, or fragments. Trailing slashes are normalized at startup.
+# Public Homarr origin used by MCP OAuth metadata and redirects behind proxies.
+# BASE_URL=https://homarr.example.com
 HOMARR_WEBSITE_URL=https://homarr.dev
 # PocketBase API used by Homarr and by the standalone documentation site.
 # Defaults to HOMARR_WEBSITE_URL.
@@ -25,6 +25,18 @@ body:
    attributes:
      label: Additional information
      description: Add any other information related to the bug here, screenshots if applicable.
+  - type: input
+    id: exactBuild
+    attributes:
+      label: Exact build or image
+      description: For preview or development builds, include the commit SHA or image digest. A moving tag such as v2 is not enough to identify the build.
+      placeholder: "Commit SHA, image digest, or release version"
+  - type: input
+    id: lastWorkingVersion
+    attributes:
+      label: Last working version
+      description: If this worked before, include the last version or build where you tried the same action. Leave blank if unknown.
+      placeholder: "Version or commit SHA"
  - type: dropdown
    id: version
    attributes:
@@ -33,6 +45,7 @@ body:
      options:
        # The below comment is used to insert a new version with on-release.yml
        #NEXT_VERSION#
+        - 1.77.0
        - 1.76.2
        - 1.76.1
        - 1.76.0
@@ -4,14 +4,14 @@
  <h3>Homarr</h3>
 </div>

-**Thank you for your contribution. Please ensure that your pull request meets the following pull request:**
+**Thank you for your contribution. Please ensure that your pull request meets the following requirements:**

- [ ] Builds without warnings or errors (`pnpm build`, autofix with `pnpm format:fix`)
- [ ] Pull request targets `dev` branch
+- [ ] Relevant checks pass without warnings or errors
+- [ ] Pull request targets the intended base branch (`dev` by default; `release/v2` for v2 release work)
 - [ ] Commits follow the [conventional commits guideline](https://www.conventionalcommits.org/en/v1.0.0/)
- [ ] No shorthand variable names are used (eg. `x`, `y`, `i` or any abbrevation)
- [ ] Documentation is up to date. Create a pull request [here](https://github.com/homarr-labs/documentation/).
- [ ] When using AI; No temp files are checked in, the code style follows the rest of the project
+- [ ] No shorthand variable names are used (for example, `x`, `y`, `i`, or abbreviations)
+- [ ] User-facing changes include matching documentation updates under `apps/docs`
+- [ ] When using AI, no temporary files are checked in and the code style follows the rest of the project

 **When contributing a new integration or widget:**

@@ -20,7 +20,7 @@ jobs:
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          client-id: ${{ vars.RENOVATE_APPROVE_CLIENT_ID }}
          permission-pull-requests: write # required to enable auto-merge

      - name: Install GitHub CLI
@@ -28,7 +28,7 @@ jobs:
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          client-id: ${{ vars.RENOVATE_APPROVE_CLIENT_ID }}
          permission-pull-requests: write # required to approve a pull request and enable auto-merge

      - name: Install GitHub CLI
@@ -97,17 +97,16 @@ jobs:

      - name: Validate Custom Widget bundle budget
        run: |
-          pnpm --filter nextjs build
+          pnpm turbo run build --filter=@homarr/nextjs
          pnpm check:custom-widget-bundle

-      - name: Run unit tests
-        run: pnpm test
-
  container:
-    name: Container and E2E
+    name: Container build
+    # Same-repository previews already build amd64; only build a fallback when no digest is available.
    needs: [fast-gate, preview-amd64]
    if: |
      !cancelled() && needs.fast-gate.result == 'success' &&
+      needs.preview-amd64.result != 'failure' && needs.preview-amd64.outputs.digest == '' &&
      (
        github.event_name == 'merge_group' ||
        (github.event_name == 'push' && github.ref == 'refs/heads/release/v2') ||
@@ -115,10 +114,9 @@ jobs:
        (github.event_name == 'workflow_dispatch' && (inputs.operation == 'validate' || inputs.operation == 'publish'))
      )
    runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 20
    permissions:
      contents: read
-      packages: read
    steps:
      - uses: actions/checkout@v7
        if: "!env.ACT"
@@ -126,23 +124,10 @@ jobs:
          persist-credentials: false
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}

-      - name: Setup
-        uses: ./tooling/github/setup
-
      - name: Set up Docker Buildx
-        if: "!env.ACT"
+        if: needs.preview-amd64.outputs.digest == '' && !env.ACT
        uses: docker/setup-buildx-action@v4

-      - name: Reuse amd64 preview image
-        if: needs.preview-amd64.outputs.digest != '' && !env.ACT
-        env:
-          DIGEST: ${{ needs.preview-amd64.outputs.digest }}
-        run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-          docker pull "${PREVIEW_IMAGE}@${DIGEST}"
-          docker tag "${PREVIEW_IMAGE}@${DIGEST}" homarr-ci
-          docker tag "${PREVIEW_IMAGE}@${DIGEST}" homarr-e2e
-
      - name: Build container once
        if: needs.preview-amd64.outputs.digest == '' && !env.ACT
        uses: docker/build-push-action@v7
@@ -152,9 +137,7 @@ jobs:
          platforms: linux/amd64
          load: true
          push: false
-          tags: |
-            homarr-ci
-            homarr-e2e
+          tags: homarr-ci
          labels: |
            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}
@@ -182,37 +165,7 @@ jobs:
            fi
          done
          DOCKER_BUILDKIT=1 docker build --platform linux/amd64 \
-            --tag homarr-ci --tag homarr-e2e "${secret_args[@]}" .
-
-      - name: Cache Playwright browsers
-        if: "!env.ACT"
-        id: playwright-cache
-        uses: actions/cache@v6
-        with:
-          path: ~/.cache/ms-playwright
-          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
-
-      - name: Install Playwright Chromium
-        if: steps.playwright-cache.outputs.cache-hit != 'true' || env.ACT
-        run: pnpm exec playwright install --with-deps chromium
-
-      - name: Install Playwright system deps
-        if: steps.playwright-cache.outputs.cache-hit == 'true'
-        run: pnpm exec playwright install-deps chromium
-
-      - name: Run E2E tests
-        env:
-          NODE_ENV: development
-          CI: "true"
-        run: pnpm exec vitest e2e --retry 1 --maxWorkers 4
-
-      - name: Upload E2E artifacts
-        if: failure() && !env.ACT
-        uses: actions/upload-artifact@v7
-        with:
-          name: playwright-report
-          path: e2e/test-results/
-          retention-days: 7
+            --tag homarr-ci "${secret_args[@]}" .

  preview-amd64:
    name: Build amd64 preview image
@@ -320,10 +273,10 @@ jobs:

  publish-preview:
    name: Publish multi-platform preview image
-    needs: [container, preview-amd64, preview-arm64]
+    needs: [fast-gate, preview-amd64, preview-arm64]
    if: |
      !cancelled() &&
-      needs.container.result == 'success' &&
+      needs.fast-gate.result == 'success' &&
      needs.preview-amd64.result == 'success' &&
      needs.preview-arm64.result == 'success' &&
      (
@@ -22,7 +22,7 @@ jobs:
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.CROWDIN_APP_PRIVATE_KEY }}
-          client-id: ${{ secrets.CROWDIN_APP_ID }}
+          client-id: ${{ vars.CROWDIN_CLIENT_ID }}
          permission-contents: write # required to commit to crowdin branch
          permission-pull-requests: write # required to create pull request

@@ -16,10 +16,10 @@ permissions:
 jobs:
  create-and-merge-pr:
    runs-on: ubuntu-latest
-    timeout-minutes: 2
+    timeout-minutes: 10
    steps:
      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
+        if: ${{ inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
@@ -37,11 +37,22 @@ jobs:
          branch: next
      - name: Create pull request
        id: create-pull-request
-        run: 'gh pr create --title "chore(release): release ${{ steps.semver.outputs.next }}-beta" --body "Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}-beta``" --base beta --head next --label automerge'
+        run: |
+          pr_url="$(gh pr list --base beta --head next --state open --json url --jq '.[0].url // empty')"
+          if [[ -z "$pr_url" ]]; then
+            pr_url="$(gh pr create \
+              --title "chore(release): release ${{ steps.semver.outputs.next }}-beta" \
+              --body "Detected change to be ${{ steps.semver.outputs.bump }}<br/>Bump version from ${{ steps.semver.outputs.current }} to ${{ steps.semver.outputs.next }}-beta" \
+              --base beta \
+              --head next \
+              --label automerge)"
+          fi
+          echo "url=$pr_url" >> "$GITHUB_OUTPUT"
+          echo "pr_number=${pr_url##*/}" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
+        if: ${{ inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
@@ -52,19 +63,19 @@ jobs:
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          client-id: ${{ vars.RENOVATE_APPROVE_CLIENT_ID }}
          permission-pull-requests: write
      - name: Approve PR
        env:
          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
        run: |
-          gh pr review --approve --body "Automatically approved by GitHub Action"
+          gh pr review "${{ steps.create-pull-request.outputs.url }}" --approve --body "Automatically approved by GitHub Action"
      - name: Obtain token
        id: obtainMergeToken
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          client-id: ${{ vars.RENOVATE_MERGE_CLIENT_ID }}
          permission-contents: write # write to beta branch (due to merge)
          permission-pull-requests: write # merge pull request
      - id: automerge
@@ -82,21 +93,21 @@ jobs:
          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals

      - name: Merged Discord notification
-        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.event.inputs.send-notifications }}
+        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
        with:
          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
      - name: Major Bump Discord notification
-        if: ${{ steps.semver.outputs.bump == 'major' && github.event.inputs.send-notifications }}
+        if: ${{ steps.semver.outputs.bump == 'major' && inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
        with:
          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}-beta"
      - name: Discord Fail Notification
-        if: failure() && github.event.inputs.send-notifications
+        if: ${{ failure() && inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
@@ -40,6 +40,7 @@ jobs:
      version: ${{ steps.read-semver.outputs.version || steps.version-fallback.outputs.version }}
      git_ref: ${{ steps.read-git-ref.outputs.ref || steps.read-semver.outputs.version || github.ref }}
      skipped: ${{ env.SKIP_RELEASE }}
+      upstream_sync: ${{ steps.update-upstream.outcome }}
    steps:
      - run: echo "Manual dispatch redeploys the latest existing release without creating a new one"
        if: env.SKIP_RELEASE == 'true'
@@ -54,7 +55,7 @@ jobs:
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          client-id: ${{ vars.RENOVATE_MERGE_CLIENT_ID }}
          permission-contents: write # required to commit package.json & changelog changes, merge them to dev / next and publish the release

      - uses: actions/checkout@v7
@@ -115,8 +116,10 @@ jobs:
        run: |
          echo "ref=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
      - name: Update dev / next branch
+        id: update-upstream
        if: env.SKIP_RELEASE == 'false'
-        continue-on-error: true # Prevent pipeline from failing when merge fails
+        # Finish publishing the already-created release, then fail in the publish job if synchronization did not work.
+        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
          UPSTREAM_BRANCH: ${{ github.ref_name == 'main' && 'dev' || 'next' }}
@@ -274,7 +277,7 @@ jobs:
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          client-id: ${{ vars.RENOVATE_MERGE_CLIENT_ID }}
          permission-contents: write # required to publish the release

      - name: Log in to the Container registry
@@ -311,6 +314,12 @@ jobs:
        run: |
          gh release edit --repo ${{ github.repository }} ${{ needs.release.outputs.version }} --draft=false

+      - name: Verify dev / next synchronization
+        if: needs.release.outputs.skipped == 'false' && needs.release.outputs.upstream_sync != 'success'
+        run: |
+          echo "::error::The released commit was not synchronized back to the upstream development branch."
+          exit 1
+
      - name: Discord notification
        if: github.event_name != 'workflow_dispatch' || inputs['send-notifications']
        env:
@@ -318,3 +327,17 @@ jobs:
        uses: Ilshidur/action-discord@0.4.0
        with:
          args: "Successfully deployed images for branch **${{ github.ref_name }}**. Tagged as **${{env.NEXT_VERSION}}**."
+
+  notify-failure:
+    name: Notify deployment failure
+    if: ${{ always() && (failure() || cancelled()) && (github.event_name != 'workflow_dispatch' || inputs['send-notifications']) }}
+    needs: [release, build-amd64, build-arm64, extract-asset-amd64, extract-asset-arm64, publish]
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Discord failure notification
+        env:
+          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
+        uses: Ilshidur/action-discord@0.4.0
+        with:
+          args: "The deployment for branch **${{ github.ref_name }}** failed or was cancelled: [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})"
@@ -19,10 +19,10 @@ permissions:
 jobs:
  create-and-merge-pr:
    runs-on: ubuntu-latest
-    timeout-minutes: 2
+    timeout-minutes: 10
    steps:
      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
+        if: ${{ github.event_name == 'schedule' || inputs.send-notifications }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
@@ -38,13 +38,30 @@ jobs:
        with:
          token: ${{ github.token }}
          branch: dev
+          noNewCommitBehavior: silent
+          noVersionBumpBehavior: silent
+      - name: No release needed
+        if: ${{ steps.semver.outputs.bump == '' || steps.semver.outputs.bump == 'none' }}
+        run: echo "No release-worthy commits were found since ${{ steps.semver.outputs.current }}." >> "$GITHUB_STEP_SUMMARY"
      - name: Create pull request
        id: create-pull-request
-        run: 'gh pr create --title "chore(release): automatic release ${{ steps.semver.outputs.next }}" --body "**This is an automatic release**.<br/>Manual action may be required for major bumps.<br/>Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}``" --base main --head dev --label automerge'
+        if: ${{ steps.semver.outputs.bump != '' && steps.semver.outputs.bump != 'none' }}
+        run: |
+          pr_url="$(gh pr list --base main --head dev --state open --json url --jq '.[0].url // empty')"
+          if [[ -z "$pr_url" ]]; then
+            pr_url="$(gh pr create \
+              --title "chore(release): automatic release ${{ steps.semver.outputs.next }}" \
+              --body "**This is an automatic release**.<br/>Manual action may be required for major bumps.<br/>Detected change to be ``${{ steps.semver.outputs.bump }}``<br/>Bump version from ``${{ steps.semver.outputs.current }}`` to ``${{ steps.semver.outputs.next }}``" \
+              --base main \
+              --head dev \
+              --label automerge)"
+          fi
+          echo "url=$pr_url" >> "$GITHUB_OUTPUT"
+          echo "pr_number=${pr_url##*/}" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
      - name: Discord notification
-        if: ${{ github.event.inputs.send-notifications }}
+        if: ${{ steps.create-pull-request.outcome == 'success' && (github.event_name == 'schedule' || inputs.send-notifications) }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
@@ -52,26 +69,29 @@ jobs:
          args: "Created a release PR ${{ steps.create-pull-request.outputs.url }} for version ${{ steps.semver.outputs.next }} (new behaviour: ${{ steps.semver.outputs.bump }})"
      - name: Obtain token
        id: obtainApprovalToken
+        if: ${{ steps.create-pull-request.outcome == 'success' }}
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }}
+          client-id: ${{ vars.RENOVATE_APPROVE_CLIENT_ID }}
          permission-pull-requests: write
      - name: Approve PR
+        if: ${{ steps.create-pull-request.outcome == 'success' }}
        env:
          GITHUB_TOKEN: ${{ steps.obtainApprovalToken.outputs.token }}
        run: |
-          gh pr review --approve --body "Automatically approved by GitHub Action"
+          gh pr review "${{ steps.create-pull-request.outputs.url }}" --approve --body "Automatically approved by GitHub Action"
      - name: Obtain token
        id: obtainMergeToken
+        if: ${{ steps.create-pull-request.outcome == 'success' }}
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          client-id: ${{ vars.RENOVATE_MERGE_CLIENT_ID }}
          permission-contents: write # write to main branch (due to merge)
          permission-pull-requests: write # merge pull request
      - id: automerge
-        if: ${{ steps.semver.outputs.bump != 'major' }}
+        if: ${{ steps.create-pull-request.outcome == 'success' && steps.semver.outputs.bump != 'major' }}
        name: automerge
        uses: "pascalgn/automerge-action@v0.16.4"
        env:
@@ -85,21 +105,21 @@ jobs:
          MERGE_REQUIRED_APPROVALS: 0 # do not require approvals

      - name: Merged Discord notification
-        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && github.event.inputs.send-notifications }}
+        if: ${{ steps.automerge.outputs.mergeResult == 'merged' && (github.event_name == 'schedule' || inputs.send-notifications) }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
        with:
          args: "Merged PR ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}"
      - name: Major Bump Discord notification
-        if: ${{ steps.semver.outputs.bump == 'major' && github.event.inputs.send-notifications }}
+        if: ${{ steps.semver.outputs.bump == 'major' && (github.event_name == 'schedule' || inputs.send-notifications) }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
        with:
          args: "The release PR must be manually merged because the next version is a major version: ${{ steps.create-pull-request.outputs.url }} for release ${{ steps.semver.outputs.next }}"
      - name: Discord Fail Notification
-        if: failure() && github.event.inputs.send-notifications
+        if: ${{ failure() && (github.event_name == 'schedule' || inputs.send-notifications) }}
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        uses: Ilshidur/action-discord@0.4.0
@@ -26,36 +26,8 @@ jobs:
      - name: Copy env
        run: cp .env.example .env

-      - name: Start dev server
-        run: pnpm --filter @homarr/nextjs dev &
-        env:
-          TURBO_TELEMETRY_DISABLED: 1
-          DISABLE_TELEMETRY: 1
-
-      - name: Wait for server and fetch spec
-        run: |
-          set -euo pipefail
-          for i in $(seq 1 30); do
-            if curl -fsS http://localhost:3000/api/openapi -o /tmp/openapi.json 2>/dev/null; then
-              echo "Server is up, spec fetched"
-              break
-            fi
-            echo "Waiting for server... ($i/30)"
-            sleep 3
-          done
-
-          if [ ! -f /tmp/openapi.json ]; then
-            echo "::error::Server failed to start within timeout"
-            exit 1
-          fi
-
-          jq -e '.openapi and .paths' /tmp/openapi.json > /dev/null || {
-            echo "::error::Fetched file is not a valid OpenAPI spec"
-            exit 1
-          }
-
-          cp /tmp/openapi.json apps/docs/static/api/open-api-schema.json
-          echo "OpenAPI spec updated ($(jq '.paths | length' /tmp/openapi.json) paths)"
+      - name: Generate and validate OpenAPI spec
+        run: pnpm scripts:update-openapi

      - name: Commit updated spec
        uses: EndBug/add-and-commit@v10
@@ -5,39 +5,6 @@ on:
    types: [released]

 jobs:
-  trigger-docs-release:
-    name: Trigger Documentation Release
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    steps:
-      - name: Obtain token
-        id: obtainToken
-        uses: actions/create-github-app-token@v3
-        with:
-          private-key: ${{ secrets.HOMARR_DOCS_RELEASE_APP_PRIVATE_KEY }}
-          client-id: ${{ vars.HOMARR_DOCS_RELEASE_APP_ID }}
-          owner: homarr-labs
-          repositories: |
-            documentation
-          permission-contents: write # required to dispatch repository workflow
-      - name: Trigger documentation release
-        env:
-          GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }}
-          SOURCE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          curl -X POST \
-            -H "Authorization: token $GITHUB_TOKEN" \
-            -H "Accept: application/vnd.github+json" \
-            https://api.github.com/repos/homarr-labs/documentation/dispatches \
-            -d @- <<EOF
-          {
-            "event_type": "trigger-release",
-            "client_payload": {
-              "tag": "${SOURCE_TAG}"
-            }
-          }
-          EOF
-
  update-bug-report-template:
    name: Update Bug Report Template
    runs-on: ubuntu-latest
@@ -48,7 +15,7 @@ jobs:
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.RENOVATE_MERGE_PRIVATE_KEY }}
-          client-id: ${{ secrets.RENOVATE_MERGE_APP_ID }}
+          client-id: ${{ vars.RENOVATE_MERGE_CLIENT_ID }}
          permission-contents: write # required to commit to branch
          permission-pull-requests: write # required to create pr & enable automerge
      - name: Checkout code
@@ -21,7 +21,7 @@ jobs:
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.HOMARR_UPDATE_CONTRIBUTORS_PRIVATE_KEY }}
-          client-id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_APP_ID }}
+          client-id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_CLIENT_ID }}
          permission-contents: write # required to commit to branch
          permission-pull-requests: write # required to create pr & enable automerge

@@ -24,7 +24,7 @@ jobs:
        uses: actions/create-github-app-token@v3
        with:
          private-key: ${{ secrets.HOMARR_UPDATE_CONTRIBUTORS_PRIVATE_KEY }}
-          client-id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_APP_ID }}
+          client-id: ${{ vars.HOMARR_UPDATE_CONTRIBUTORS_CLIENT_ID }}
          permission-contents: write # required to commit to branch
          permission-pull-requests: write # required to create pr & enable automerge
      - name: Checkout code
@@ -2,8 +2,36 @@ name: Workshop

 on:
  pull_request:
+    paths:
+      - ".github/workflows/workshop.yml"
+      - "apps/workshop/**"
+      - "apps/docs/**"
+      - "packages/custom-widgets/**"
+      - "packages/definitions/**"
+      - "packages/workshop/**"
+      - "tooling/typescript/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - ".npmrc"
  push:
    branches: [dev, v2, release/v2, main]
+    paths:
+      - ".github/workflows/workshop.yml"
+      - "apps/workshop/**"
+      - "apps/docs/**"
+      - "packages/custom-widgets/**"
+      - "packages/definitions/**"
+      - "packages/workshop/**"
+      - "tooling/typescript/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - ".npmrc"

 permissions:
  contents: read
@@ -15,21 +43,10 @@ concurrency:
 jobs:
  validate:
    runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24.18.0
-      - uses: pnpm/action-setup@v6
-        with:
-          run_install: false
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm --filter @homarr/workshop typecheck
-      - run: pnpm --filter @homarr/docs typecheck
      - run: docker compose --env-file apps/workshop/.env.staging.example -f apps/workshop/docker-compose.staging.yml config --quiet
-      - run: pnpm test:workshop
-      - run: pnpm test:workshop-image

  publish-amd64:
    if: github.event_name == 'push' && (github.ref_name == 'v2' || github.ref_name == 'release/v2' || github.ref_name == 'main')
@@ -10,7 +10,12 @@
    "CHANGELOG.md",
    "apps/docs/.docusaurus/**",
    "apps/docs/build/**",
-    "apps/docs/blog/**",
+    "apps/docs/blog/2022/**",
+    "apps/docs/blog/2023/**",
+    "apps/docs/blog/2024/**",
+    "apps/docs/blog/2025/**",
+    "apps/docs/blog/authors.yml",
+    "apps/docs/static/api/open-api-schema.json",
    "packages/custom-widgets/src/core/component-catalog.generated.json",
    "apps/docs/static/custom-widgets/component-catalog-v1.json"
  ]
@@ -59,7 +59,13 @@ homarr/

 The documentation site lives at `apps/docs/` (Docusaurus 3, `@homarr/docs`).

-When modifying user-facing code, you MUST also update the corresponding documentation:
+Write for smart, curious, advanced users. Documentation should contain only information they cannot reasonably discover or understand directly from the interface: hidden capabilities, non-obvious behavior, prerequisites, constraints, configuration contracts, and migration requirements.
+
+Keep docs concise. Every paragraph must add knowledge beyond visible labels and standard UI conventions. Explain how to discover and use a hidden advanced widget feature; omit explanations that the Delete button deletes an item in edit mode. Avoid UI walkthroughs, exhaustive control descriptions, and repetition. When editing a passage, remove obvious or redundant prose rather than preserving verbosity as a precedent.
+
+Update docs only when a change introduces or alters that non-obvious information, or makes existing guidance inaccurate. Routine fixes and self-explanatory UI changes need no docs update. A new feature alone does not require a page; apply the same reader-value test.
+
+When documentation is needed, use these locations:

 - New integration → `apps/docs/docs/integrations/<slug>/index.mdx` + `index.ts`
 - New widget → `apps/docs/docs/widgets/<slug>/index.mdx` + `index.ts`
@@ -86,7 +92,7 @@ When modifying user-facing code, you MUST also update the corresponding document
 - Lint: oxlint (not ESLint)
 - Format: oxfmt (not Prettier)
 - UI: Mantine (not Tailwind) — Tailwind is only used in docs app
- Mantine: use the project-scoped MCP server in `.mcp.json` for current v9 APIs, and check `packages/ui/` before creating a new primitive.
+- Mantine: use the `mantine` MCP server in `.mcp.json` for current v9 APIs before writing component code. Prefer built-in primitives (`Combobox`/`useCombobox`, the polymorphic `component` prop, `@mantine/hooks`) and check `packages/ui/` for existing conventions first.
 - Icons: @tabler/icons-react
 - Docs app can import from `@homarr/definitions` for shared types
 - Run `pnpm dev:cli -- dev` to browse local `homarr:*` images and remote PR images.
@@ -94,11 +100,15 @@ When modifying user-facing code, you MUST also update the corresponding document
 - Run `pnpm dev:cli -- build --pr <number>` to build a PR locally from a temporary checkout.
 - Run Go checks from `tools/homarr-dev` with `go test ./...` and `go vet ./...`.

+## MCP servers
+
+`.mcp.json` declares project-scoped MCP servers. Keep only keyless definitions there; credentials belong in local dotfiles. See [Mantine LLM tooling](https://mantine.dev/guides/llms/) for client-specific setup.
+
 ## Agent Skills

 Portable skills live in `.agents/skills/`. Read the relevant `SKILL.md` before working in that domain; detailed references are loaded only when needed. Claude-compatible discovery is provided through `.claude/skills`.

 - `codebase-context` — architecture, package boundaries, and shared utilities
- `documentation-sync` — required user-facing documentation updates
+- `documentation-sync` — documentation for changes users need explained
 - `mcp-integration` — safe tRPC-to-MCP exposure
 - `homarr-custom-widget` — safe Custom JSX v2 authoring
@@ -1,3 +1,7 @@
+## [1.77.1](https://github.com/homarr-labs/homarr/compare/v1.77.0...v1.77.1) (2026-09-11)
+
+## [1.77.0](https://github.com/homarr-labs/homarr/compare/v1.76.2...v1.77.0) (2026-09-06)
+
 ## [1.76.2](https://github.com/homarr-labs/homarr/compare/v1.76.1...v1.76.2) (2026-08-27)

 ## [1.76.1](https://github.com/homarr-labs/homarr/compare/v1.76.0...v1.76.1) (2026-08-26)
@@ -0,0 +1,159 @@
+---
+authors:
+  - ajnart
+tags: [homarr, update, version, assistant, custom widgets, dashboards, docker]
+description: Homarr 2.0 introduces Custom Widgets and Workshop, rebuilt board editing, Assistant tooling, responsive layouts, onboarding, and more.
+image: ./img/homarr-v2-dashboard.webp
+draft: false
+---
+
+# Homarr 2.0.0 - Workshop, Custom Widgets and a rebuilt board
+
+First, thank you.
+
+Many of you used the v2 demo when it was still rough, found bugs and came back to test the next build. Others translated Homarr, answered questions, contributed code or simply kept using it. We would not be shipping this without you.
+
+We are also planning a small batch of **free, limited-edition Homarr swag** for Workshop contributors and a few randomly picked community members. It is not for sale and it is not for profit. No Homarr merch empire, sorry.
+
+Homarr 2.0 builds on the dashboard you already use. Here is what changed.
+
+![A populated Homarr 2.0 dashboard with compact widgets, an Assistant, and an application rail](./img/homarr-v2-dashboard.webp)
+
+<!-- truncate -->
+
+Update your Homarr image as usual. Homarr runs database migrations automatically when the updated container starts; no manual database migration or separate v2 upgrade procedure is needed. Workshop uses the production service by default, with no preview URL configuration required.
+
+## Custom Widgets v2 and Workshop
+
+### Build almost any widget
+
+**This is the big one.** We think it is the most important Homarr update we have made.
+
+Custom Widgets v2 lets you build widgets from JSX, API requests, actions and typed settings. Write one yourself or describe it to Assistant, then test it in the workbench. We think this is enough to make almost any dashboard widget—even that oddly specific component only three people need. Those three people no longer have to wait for us.
+
+This was partly inspired by [Google's upcoming Create My Widget feature](https://blog.google/products-and-platforms/platforms/android/gemini-intelligence/): describe a widget in normal language and let AI make it. Coding knowledge is optional. Knowing what the API does still helps; AI has not fixed bad documentation. Yet.
+
+![The Custom Widget v2 workbench after a live exchange-rate request successfully renders its preview](./img/custom-widget-workbench.webp)
+
+A `homarr-custom-widget-v2` definition can use several fixed-origin API sources. Credentials are encrypted separately and stay out of exports and Workshop submissions. Actions support `GET`, `POST`, `PUT`, `PATCH` and `DELETE`; requests have host checks, timeouts, size limits, permissions and rate limits. Custom Widgets remain **Beta** in 2.0.
+
+### Share widgets and Custom CSS
+
+**Workshop is the other half.** Publish and install Custom Widgets, then update, vote on, comment on and report submissions. Workshop is not only for widgets: you can share your **Custom CSS** there too. Deployment URLs and credentials stay on your Homarr instance.
+
+![The Community Workshop catalog inside Custom Widget management](./img/community-workshop.webp)
+
+:::warning Workshop is moderated
+
+AI makes widgets easy to produce. It does not make the first thing it coughs up worth publishing. **Do not dump untested slop into Workshop.** Test it, add a useful screenshot and explain its setup. Workshop is moderated.
+
+:::
+
+### The ultimate Homarr update
+
+We have called this the **"ultimate Homarr update"**. Not because work stops, but because every new service or widget idea no longer needs a full Homarr release; the community can build and share it instead.
+
+## Board editing, rebuilt
+
+### Drag and drop
+
+We threw out the old drag-and-drop system and rebuilt it on [`dnd-kit`](https://dndkit.com/). Moves and eight-direction resizes are transactional: Homarr previews the result, checks collisions and only saves a valid layout. Bad moves roll back instead of wrecking the board. In short: less fighting with your own dashboard.
+
+![A Calendar tile moving across the rebuilt Homarr 2.0 board grid](./img/drag-and-drop.gif)
+
+### Goodbye Groups and sections, bonjour Containers
+
+Groups and dynamic sections did nearly the same job, so **Containers replace both**. They hold apps, widgets and other Containers. Hold <kbd>Ctrl</kbd> or <kbd>Command</kbd> to move several items at once.
+
+### One board, several layouts
+
+Boards also have Base and Mobile layouts, plus optional breakpoints. **Reset from Base** creates a Mobile starting point without duplicating the board.
+
+## Homarr Assistant
+
+### Work with live Homarr data
+
+Assistant reads live Homarr data and has tools for boards, apps, integrations, widgets, Docker and supported services. It can answer questions, make approved changes and build Custom Widgets. It follows your permissions: reads can run automatically, while changes require approval by default.
+
+![The Homarr Assistant expanded over a live dashboard with health, exploration, media, and board actions](./img/assistant-control-surface.webp)
+
+Open it with <kbd>Shift</kbd> + <kbd>A</kbd>. <kbd>Cmd</kbd>/<kbd>Ctrl</kbd> + <kbd>/</kbd> searches it.
+
+### The Homarr provider
+
+:::note
+
+Assistant ships with a **"Homarr provider"**. It is free, will never offer paid plans, and is paid for by [Ajnart](https://github.com/ajnart) using the ad revenue from this website.
+
+It only uses zero-data-retention (ZDR) providers. [The provider is open source](https://github.com/homarr-labs/homarr/blob/release/v2/apps/workshop/homarr_provider.go), and neither prompts nor responses are logged. We are not selling your data. Pinky promise.
+
+:::
+
+### External assistants through MCP
+
+External assistants can use the same permission-checked tools through `/api/mcp`, with an API key or OAuth 2.1 with PKCE.
+
+## The rest (there is a lot)
+
+### Brand-new onboarding
+
+A six-stage setup studio handles the first admin, core settings, Docker discovery, apps, integrations and the first board.
+
+![The Homarr 2.0 setup studio on its Essentials step, with all six setup stages shown](./img/onboarding-studio.webp)
+
+### Board switcher
+
+Boards now live in a searchable gallery with keyboard navigation. Open it from the header or press <kbd>Shift</kbd> + <kbd>C</kbd>.
+
+![A visual board card inside the searchable Homarr board switcher](./img/board-switcher.webp)
+
+### Command menu and keybinds
+
+<kbd>Cmd</kbd>/<kbd>Ctrl</kbd> + <kbd>K</kbd> finds resources, pages, settings, users, groups and commands. More
+keybinds cover Assistant, editing, selection and advanced widget views.
+
+### Customizable header
+
+Pick which buttons appear, put them on the left, center or right, and change their order.
+
+![The Header studio showing left, center, and right zones plus available controls](./img/header-studio.webp)
+
+### Instance branding
+
+Change the name, logo, favicon, colors, corner styles and login page. Global CSS applies instance-wide; board CSS can override it. Only give that power to admins you trust. CSS remains CSS.
+
+![Instance branding controls for application identity, palette, corner style, and global CSS](./img/instance-branding.webp)
+
+### Widgets
+
+Add content without leaving the board. Settings have live previews, and supported widgets have advanced views. Weather and Clock were redesigned; Air Quality, Countdown and Timer are new.
+
+### Docker and Podman
+
+`DOCKER_ENDPOINTS` supports several hosts. Assisted setup and container labels can create apps, integrations, Containers, widgets and health checks.
+
+![Assisted Docker setup listing discovered services that can become apps or integrations](./img/docker-assisted-setup.webp)
+
+Homepage-compatible labels work too.
+
+### Permissions
+
+Groups use a new Viewer, Editor and Admin matrix. The API, Assistant and MCP follow the same rules. LDAP can create users on first sign-in; OIDC can link verified accounts and synchronize groups.
+
+### Performance
+
+Board startup work runs in parallel, heavy screens load when opened, and identical integration requests share work instead of doing it twice.
+
+## Compatibility notes
+
+- Legacy Custom JSX definitions enter a migration state. Homarr keeps encrypted credentials and an archived copy until the v2 definition validates.
+- Mobile layouts place rail content in the main flow instead of displaying rails.
+- Custom Widgets remain Beta.
+- Assistant and MCP do not bypass permissions.
+
+## Links
+
+- Try the [live demo](https://demo.homarr.dev/).
+- See [installation and update instructions](/docs/getting-started/installation/docker).
+- Browse [Workshop](https://homarr.dev/workshop).
+- Read the guides for [Boards](/docs/management/boards), [Custom Widgets](/docs/management/custom-widgets), [Assistant](/docs/management/assistant), [MCP](/docs/management/mcp) and [Docker labels](/docs/integrations/docker-labels).
@@ -90,7 +90,7 @@ homarr run dev
 homarr run --detach dev
 homarr run --pr 6441
 homarr run --pr 6441 --demo
-homarr --pr 6441 --env WORKSHOP_WEB_URL=https://app-v2.preview.homarr.dev/
+homarr --pr 6441 --env WORKSHOP_WEB_URL=https://workshop.example.com/workshop
 ```

 - `--pr <number>`: Pull and run a PR image from GHCR (shorthand: `homarr --pr <number>`).
@@ -148,13 +148,18 @@ homarr images rm feature
 # List data volumes with owner PR/tag and in-use status
 homarr data

-# Delete data volume (safely stops and removes owning container first)
+# Preview deleting a data volume and its owning container
 homarr data rm homarr_feature_data

+# Permanently delete the data after reviewing the preview
+homarr data rm homarr_feature_data --force
+
 # Remove stopped containers (prompts without --force)
 homarr prune --force
 ```

+Forced data deletion removes the derived owner container only when it mounts the exact selected volume. A same-named container that does not own that volume stops the operation.
+
 ### Instance Operations & Diagnostics

 ```bash
@@ -14,4 +14,4 @@ homarr fix-usernames

 This will convert all credential usernames to lowercase and update the database accordingly.

-![](./img/screenshot-cli.png)
+![Terminal output confirming credential usernames were converted to lowercase](./img/screenshot-cli.png)
@@ -4,6 +4,7 @@ The Homarr image includes a recovery CLI for operations that cannot be completed
 application API; use the [API](/docs/management/api) or [MCP endpoint](/docs/management/mcp) for automation.

 Back up the database and stop Homarr before running a command that changes data.
+Failed commands print an error and return a non-zero exit code, so shell scripts can stop safely.

 ## Run the recovery CLI

@@ -14,7 +15,31 @@ docker exec -it <container-id> /bin/bash
 homarr <command>
 ```

-In QNAP Container Station, open the Homarr container's **Execute** action and select `/bin/bash`.
+### QNAP Container Station
+
+1. Open **Container Station**.
+
+![Container Station in the QNAP application menu](./img/334116069-e7ec4726-3df7-4dc6-a3e0-b745e7eef17f.png)
+
+2. Select **Containers**.
+
+![Containers menu in QNAP Container Station](./img/334116205-aa09ce40-0701-4f7d-b9f9-b431b9d207c5.png)
+
+3. Select the Homarr container.
+
+![Homarr container selected in QNAP Container Station](./img/334116303-714b5e07-b9de-4ec0-a2bc-def7ee38750f.png)
+
+4. Select **Execute**.
+
+![Execute action for the Homarr container in QNAP Container Station](./img/334116411-df1482f9-3aa9-4686-b77f-e0dca09e60b2.png)
+
+5. Select `/bin/bash`, then select **Execute**.
+
+![Bash selected in the QNAP execute console](./img/334116518-e1ddb515-99c7-4159-81bf-76e889d1e808.png)
+
+6. Run `homarr <command>` in the console.
+
+![Bash console open for Homarr in QNAP Container Station](./img/334116642-08c4f204-5cd0-4e4e-a785-0142e1b279ca.png)

 See the pages in this section for available commands.

@@ -10,10 +10,10 @@ Using this command, you can forcefully reset the password of a user.
 It will be set to a random value and the hash for the user will be updated.
 All sessions for that user will be terminated and the user must re-login.

-![](./img/screenshot-cli.png)
+![Reset-password command help showing that username is required](./img/screenshot-cli.png)

 Using the `--username` parameter, you can specify who you want to reset the password for.
 Executing the command will create a new random password, update the database and display the new password.
 All sessions for this user will be terminated and they must re-login.

-![](./img/screenshot-cli-result.png)
+![Terminal output confirming a password reset and session deletion](./img/screenshot-cli-result.png)
@@ -31,9 +31,13 @@ pnpm install --frozen-lockfile
 ### Run the Homarr application

 1. Copy `.env.example` to `.env`.
-2. Set `DB_URL` to an absolute writable SQLite file path.
-3. Keep Redis and the optional local databases running in one terminal.
-4. Apply migrations and start Next.js in another terminal.
+2. Run `openssl rand -hex 32` twice. Set `AUTH_SECRET` and `SECRET_ENCRYPTION_KEY` to the two different generated
+   values in `.env`; the example leaves both empty. Keep this file private and preserve `SECRET_ENCRYPTION_KEY`
+   when reusing a database.
+3. Set `DB_URL` to an absolute writable SQLite file path. Migration and application commands run from different
+   workspace directories, so a relative path can point them at different databases.
+4. Keep Redis and the optional local databases running in one terminal.
+5. Apply migrations and start Next.js in another terminal.

 ```sh
 cp .env.example .env
@@ -57,6 +61,20 @@ Homarr becomes the instance administrator.
 Use `pnpm docker:dev:up` instead when you only need Redis in the background. Running the migration also seeds the
 default data; use `pnpm db:seed` to seed it explicitly later.

+`pnpm dev` starts only Next.js. When your work needs scheduled tasks or live subscriptions, run the relevant service
+in a separate terminal alongside it:
+
+```sh
+pnpm --filter @homarr/tasks dev
+```
+
+```sh
+pnpm --filter @homarr/websocket dev
+```
+
+The WebSocket service listens on port 3001. Production startup embeds both services, so these extra commands are
+only needed for development.
+
 Workshop contributors can set up PocketBase and Docusaurus with the dedicated
 [Workshop development guide](./workshop).

@@ -80,5 +98,27 @@ Workshop contributors can set up PocketBase and Docusaurus with the dedicated
 - `pnpm typecheck` — typecheck all workspaces.
 - `pnpm test` — unit and contract suites.
 - `pnpm build` — production monorepo build.
- `docker build -t homarr .` — build a production Docker image.
- `docker run -p 7575:7575 -e SECRET_ENCRYPTION_KEY='your_64_character_hex_string' homarr:<name>` — run it.
+- `docker build -t homarr:local .` — build a production Docker image.
+- `docker run -p 7575:7575 -e SECRET_ENCRYPTION_KEY='your_64_character_hex_string' homarr:local` — run it.
+
+## CI and focused validation
+
+The main CI workflow runs lint, typechecking, affected workspace builds, workspace configuration checks, OpenAPI validation, and Custom Widget architecture and bundle checks. Unit and E2E suites do not run in CI. Preview images publish after the Fast gate and both architecture builds succeed; browser tests do not block publication. The container job builds an amd64 image when no preview image was built.
+
+Workshop CI runs only when its workflow or Docker build inputs change. It validates Compose configuration and publishes production images on its configured release branches. Its Docker integration and image tests are manual; workspace typechecks run in the main Fast gate.
+
+Choose the smallest relevant suite when changing behavior:
+
+| Command                                           | Scope                                                          | Requirements                                                          |
+| ------------------------------------------------- | -------------------------------------------------------------- | --------------------------------------------------------------------- |
+| `pnpm test <file>`                                | Focused unit or contract tests                                 | Workspace dependencies                                                |
+| `pnpm test`                                       | All unit and contract tests, without Docker integration suites | Workspace dependencies                                                |
+| `pnpm test:coverage`                              | Unit and contract tests with coverage                          | Workspace dependencies                                                |
+| `pnpm test:integration <file>`                    | Docker-backed service and database compatibility tests         | Docker                                                                |
+| `pnpm test:e2e <file>`                            | Browser and container scenarios                                | Docker; Playwright Chromium and system dependencies for browser tests |
+| `pnpm test:docs-screenshots`                      | Regenerate Assistant documentation screenshots                 | Same browser prerequisites                                            |
+| `pnpm test:workshop` / `pnpm test:workshop-image` | Workshop integration / production-image validation             | Docker                                                                |
+
+Omit `<file>` to run all tests in that command's scope. E2E and screenshot commands use a local image tagged `homarr-e2e`, or an image selected with `HOMARR_E2E_IMAGE`. The default commands run once without automatic retries; coverage is opt-in. The screenshot generator is excluded from both unit and E2E commands.
+
+Keep behavioral coverage for authorization, migrations, persistence, and widget execution. Avoid tests that only search source code for particular component names, JSX, CSS, or documentation wording.
@@ -30,7 +30,8 @@ Using the `PUID` and `PGID` will require you to set the correct permissions on t
 | `PUID`                   | User ID to run the container as                                                                                                                                                                                                        | Any valid user ID                   | `0`                           |
 | `PGID`                   | Group ID to run the container as                                                                                                                                                                                                       | Any valid group ID                  | `0`                           |
 | `LOG_LEVEL`              | Log level to use                                                                                                                                                                                                                       | `debug` / `info` / `warn` / `error` | `info`                        |
-| `NO_EXTERNAL_CONNECTION` | Disables Homarr's internet-backed requests, including update checks, weather, and RSS feeds                                                                                                                                            | `true` or `false`                   | `false`                       |
+| `BASE_URL`               | Public Homarr origin used by MCP OAuth metadata and redirects. Set this when a reverse proxy does not preserve the public host and protocol.                                                                                           | HTTP(S) origin without a path       | -                             |
+| `NO_EXTERNAL_CONNECTION` | Disables Homarr's internet-backed requests, including update checks, weather, location search, and RSS feeds                                                                                                                           | `true` or `false`                   | `false`                       |
 | `ENABLE_DNS_CACHING`     | Enables dns caching. Enabled by default, but if you experience issues with IPv6 or static IPs, see [#4006](https://github.com/homarr-labs/homarr/issues/4006) or disable this flag                                                     | `true` or `false`                   | `true`                        |
 | `HOMARR_DISABLE_IPV6`    | Disables the IPv6 listener of the internal nginx proxy, even when the host supports IPv6. IPv6 is normally disabled automatically when the host has no IPv6 configured. See [#4596](https://github.com/homarr-labs/homarr/issues/4596) | `true` or `false`                   | `false`                       |
 | `HOMARR_WEBSITE_URL`     | Main Homarr documentation/site base used by runtime links. Must be an absolute HTTP(S) URL.                                                                                                                                            | HTTP(S) URL                         | `https://homarr.dev`          |
@@ -53,20 +53,6 @@ Commands at a grid boundary or at the tile's minimum size are ignored and announ

 On touch screens, press and hold a tile before moving it; a quick tap does not start a drag. Resize handles accept direct touch input. During a pointer or touch move or resize, `Esc` cancels the interaction and restores the layout from before it started.

-## Board editing
-
-When a tile is focused in edit mode:
-
-| Shortcut             | Description                                                                 |
-| -------------------- | --------------------------------------------------------------------------- |
-| `Enter` or `Space`   | Starts or stops keyboard editing                                            |
-| Arrow keys           | Moves the focused tile within its current canvas, rail, or Container        |
-| `Shift` + Arrow keys | Resizes from the tile's lower-right corner: Left/Up shrink; Right/Down grow |
-| `Esc`                | Stops keyboard editing without undoing its changes                          |
-
-Keyboard moves and resizes apply immediately. To move an item between a canvas, rail, or Container, drag it there or use **Move / resize item** for precise numeric placement.
-Commands at a grid boundary or at the tile's minimum size are ignored and announced instead of moving or shrinking the tile.
-
 :::tip

 Here `MOD` refers to the modifier key, which is `Ctrl` on Windows and `Cmd` on macOS.
@@ -40,7 +40,7 @@ services:
    volumes:
      - ./homarr/appdata:/appdata
    environment:
-      - BASE_URL=your.internal.dns.address.here.com
+      - BASE_URL=https://your.internal.dns.address.here.com
      - SECRET_ENCRYPTION_KEY=your_64_character_hex_string # <--- can be generated with `openssl rand -hex 32`
    networks:
      - proxy
@@ -13,7 +13,8 @@ You can change the user and group by using the `PUID` and `PGID` environment var
 Important to note is, that you'll also need to change the permissions for the mounted directories accordingly.

 :::info
-When starting up an updated version of the container it will have about **10 seconds longer to start** as it has to change the permissions of the app directories
+At startup, Homarr updates ownership of its data directories and runtime caches for the selected user and group.
+Startup time depends on the amount of persistent data; application code and dependencies do not need ownership changes.
 :::

 ## Without mounted Docker socket
@@ -202,9 +202,9 @@ Homarr supports multiple authentication options, from internal userbase (credent
    | ``AUTH_OIDC_CLIENT_NAME``   | Display name of provider (in login screen)                 | OIDC          |
    | ``AUTH_OIDC_AUTO_LOGIN``    | Automatically redirect to OIDC login                       | false         |
    | ``AUTH_OIDC_SCOPE_OVERWRITE`` | Overwrite default scopes (openid, profile, email)        | openid email profile groups           |
-    | ``AUTH_OIDC_GROUPS_ATTRIBUTE`` | Attribute used for groups (roles) claim                  | groups        |
+    | ``AUTH_OIDC_GROUPS_ATTRIBUTE`` | Attribute used for groups (roles) claim. Dot-separated paths such as `resource_access.homarr.roles` are supported. | groups        |
    | ``AUTH_OIDC_GROUPS_LOCAL_MANAGEMENT`` | Stop syncing group memberships of OIDC users from the groups claim and manage them locally via the group members page instead | false |
-    | ``AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE`` | Overwrite name attribute. By default it will use preferred_username if it does not contain a `@` and otherwise name. | ---          |
+    | ``AUTH_OIDC_NAME_ATTRIBUTE_OVERWRITE`` | Overwrite name attribute. Dot-separated paths are supported. By default it will use preferred_username if it does not contain a `@` and otherwise name. | ---          |
    | ``AUTH_OIDC_FORCE_USERINFO`` | Force userinfo endpoint to be used for user information.    | false         |
    | ``AUTH_OIDC_ENABLE_DANGEROUS_ACCOUNT_LINKING`` | Enable account linking for OIDC provider. This will link the OIDC accounts by email. Be sure that you have verified emails to prevent stealing accounts. | false |
    | ``AUTH_OIDC_ENABLE_DANGEROUS_CREDENTIALS_LINKING`` | Link an OIDC identity to an existing credentials user with the same email. The credentials login and existing user data are preserved. Requires the OIDC profile to contain `email_verified: true`. | false |
@@ -244,18 +244,21 @@ Homarr supports multiple authentication options, from internal userbase (credent
        - Create a group (e.g., `homarr-admins`) and assign users who require admin access.

        **2. Example .env file:**
+
+        Generate `SECRET_ENCRYPTION_KEY` with `openssl rand -hex 32`; do not copy an example key between installs.
+
        ```env
-        OIDC_CLIENT_ID=identificationid #OIDC client ID
-        OIDC_CLIENT_SECRET=secretsecretsecret #OIDC client secret
+        OIDC_CLIENT_ID=<REPLACE_WITH_OIDC_CLIENT_ID>
+        OIDC_CLIENT_SECRET=<REPLACE_WITH_OIDC_CLIENT_SECRET>
        OIDC_SLUG=homarr #Application slug in Authentik
        AUTH_DOMAIN=auth.example.com #Authentik FQDN
        ADMIN_GROUP=homarr-admins #Authentik group for Homarr admins
        HOMARR_FQDN=homarr.example.com #Homarr FQDN
-        SECRET_ENCRYPTION_KEY=encryptencryptencrypt #Homarr encryption key
+        SECRET_ENCRYPTION_KEY=<REPLACE_WITH_64_HEX_CHARACTERS>
        ```

        **3. Example Docker Compose configuration:**
-        ```yaml {14-26}
+        ```yaml {14-24}
        services:
          homarr:
            image: ghcr.io/homarr-labs/homarr:latest
@@ -269,8 +272,6 @@ Homarr supports multiple authentication options, from internal userbase (credent
            environment:
              - TZ=America/Los_Angeles
              - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY}
-              - BASE_URL=https://${HOMARR_FQDN}
-              - NEXTAUTH_URL=https://${HOMARR_FQDN}
              - AUTH_PROVIDERS=oidc #(optional: include ',credentials' to keep local accounts as fallback)
              - AUTH_OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
              - AUTH_OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
@@ -322,15 +323,18 @@ Homarr supports multiple authentication options, from internal userbase (credent
        - Record the `Client-ID` and `Client Key` (secret).

        **2. Example .env file (Homarr):**
+
+        Generate `SECRET_ENCRYPTION_KEY` with `openssl rand -hex 32`; do not copy an example key between installs.
+
        ```env
-        OIDC_CLIENT_ID=identificationid #Google Client-ID
-        OIDC_CLIENT_SECRET=secretsecretsecret #Google Client Key (secret)
+        OIDC_CLIENT_ID=<REPLACE_WITH_GOOGLE_CLIENT_ID>
+        OIDC_CLIENT_SECRET=<REPLACE_WITH_GOOGLE_CLIENT_SECRET>
        HOMARR_FQDN=homarr.example.com #Homarr FQDN
-        SECRET_ENCRYPTION_KEY=encryptencryptencrypt #Homarr encryption key
+        SECRET_ENCRYPTION_KEY=<REPLACE_WITH_64_HEX_CHARACTERS>
        ```

        **3. Example Docker Compose configuration (Homarr):**
-        ```yaml {16-22}
+        ```yaml {14-20}
        services:
          homarr:
            image: ghcr.io/homarr-labs/homarr:latest
@@ -344,8 +348,6 @@ Homarr supports multiple authentication options, from internal userbase (credent
            environment:
              - TZ=Europe/Berlin
              - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY}
-              - BASE_URL=https://${HOMARR_FQDN}
-              - NEXTAUTH_URL=https://${HOMARR_FQDN}
              - AUTH_PROVIDERS=oidc #(optional: include ',credentials' to keep local accounts as fallback)
              - AUTH_OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
              - AUTH_OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
@@ -1,31 +1,32 @@
 ---
 title: Frequently Asked Questions
+description: Answers to common Homarr questions about installation, customization, connectivity, support, and commercial use.
 tags:
  - Community
  - Help
 ---

-### Can Homarr run on a Raspberry Pi?
+## Can Homarr run on a Raspberry Pi?

 Yes, when the device uses a supported `linux/arm64` operating system. `linux/arm/v7` is not supported. See
 [Prerequisites](/docs/getting-started).

-### Can I use custom app icons?
+## Can I use custom app icons?

 Yes. Use a direct image URL, one of Homarr's icon sources, or upload an image. See [Icons](/docs/advanced/icons).

-### Can I create widgets?
+## Can I create widgets?

 Yes. [Custom Widgets](/docs/management/custom-widgets) use server-side API requests and safe JSX. They can be written in
 the workbench or created with an MCP-connected agent.

-### Can Homarr be exposed to the internet?
+## Can Homarr be exposed to the internet?

 Homarr supports authenticated and public deployments. Terminate HTTPS at a reverse proxy, keep Homarr updated, and grant
 public board access only when anonymous viewing is intended. See [Board access control](/docs/management/boards#access-control)
 and [Single sign-on](/docs/advanced/single-sign-on).

-### Where are the logs?
+## Where are the logs?

 Use **Management → Tools → Logs** for retained and live application logs. Container startup failures and older events are
 available through the deployment platform, for example `docker container logs homarr`.
@@ -33,18 +34,18 @@ available through the deployment platform, for example `docker container logs ho
 Use the browser developer console only for client-side failures. Review logs before sharing them because URLs and other
 deployment details may be present.

-### Why can Homarr not reach a service behind Gluetun?
+## Why can Homarr not reach a service behind Gluetun?

 Gluetun's firewall blocks traffic that is not explicitly allowed. Configure its
 [`FIREWALL_OUTBOUND_SUBNETS`](https://github.com/qdm12/gluetun-wiki/blob/main/setup/options/firewall.md) for the relevant
 LAN or Docker subnet, and use an address reachable from the Homarr container.

-### Where do I report a bug or request a feature?
+## Where do I report a bug or request a feature?

 Use the [GitHub issue templates](https://github.com/homarr-labs/homarr/issues/new/choose). For community support, see
 [Get in touch](/docs/community/get-in-touch).

-### Can Homarr be used commercially?
+## Can Homarr be used commercially?

 Yes. Homarr is licensed under the [Apache License 2.0](/docs/community/license). Commercial users can support development
 through [OpenCollective](/docs/community/donate).
@@ -19,7 +19,7 @@ If onboarding returns after a restart, check that `/appdata` is writable and per
 A **board** is a dashboard page containing apps, widgets, and Containers. Boards can be public or restricted to users
 and groups. Each user can choose a home board.

-![Board management with board previews](./img/after-installation-boards.png)
+![Board management with board previews](./img/after-installation-boards.webp)

 See [Boards](/docs/management/boards) for responsive layouts, access control, appearance, and home-board settings.

@@ -28,7 +28,7 @@ See [Boards](/docs/management/boards) for responsive layouts, access control, ap
 An **app** is a saved shortcut: a name, URL, icon, and optional status check. Add an App tile or a Bookmarks widget to
 show apps on a board.

-![App management with saved shortcuts](./img/after-installation-apps.png)
+![App management with saved shortcuts](./img/after-installation-apps.webp)

 See [Apps](/docs/management/apps) or [Icons](/docs/advanced/icons).

@@ -37,7 +37,7 @@ See [Apps](/docs/management/apps) or [Icons](/docs/advanced/icons).
 An **integration** is a server-side connection from Homarr to a supported service such as Sonarr, Home Assistant, or
 Docker. Integrations provide data and actions to widgets. They can also be linked to apps.

-![Integration catalog with compatible widgets](./img/after-installation-integrations.png)
+![Integration catalog with compatible widgets](./img/after-installation-integrations.webp)

 See [Managing integrations](/docs/management/integrations) and the
 [integration catalog](/docs/category/integrations).
@@ -47,7 +47,7 @@ See [Managing integrations](/docs/management/integrations) and the
 A **widget** is a board tile. Some widgets work on their own; others require one or more integrations. Configuration,
 supported integrations, and non-obvious limitations are documented on each widget page.

-![Board in edit mode with the add-content menu](./img/after-installation-widgets.png)
+![Board in edit mode with the add-content menu](./img/after-installation-widgets.webp)

 See the [widget catalog](/docs/category/widgets).

@@ -56,7 +56,7 @@ See the [widget catalog](/docs/category/widgets).
 A **Container** groups board items and can be nested. A **rail** reserves a fixed area at the left or right of a
 responsive layout. Both are configured in board edit mode.

-![Board layout settings with fixed sidebars](./img/after-installation-containers-rails.png)
+![Board layout settings with fixed sidebars](./img/after-installation-containers-rails.webp)

 See [Boards](/docs/management/boards#containers-and-rails).

@@ -65,7 +65,7 @@ See [Boards](/docs/management/boards#containers-and-rails).
 Users inherit permissions and default boards from their groups. Resource-specific access can further restrict boards
 and integrations.

-![Group permission settings](./img/after-installation-users-permissions.png)
+![Group permission settings](./img/after-installation-users-permissions.webp)

 See [Users and groups](/docs/management/users) and [single sign-on](/docs/advanced/single-sign-on).

@@ -24,6 +24,10 @@ see [Managing integrations](/docs/management/integrations#configuration).

 ### Update

+Update the image and recreate the container with the same configuration. Homarr runs database migrations automatically
+at startup, including when moving from v1 to v2; no separate upgrade procedure is needed. Keep the `/appdata` mount and
+`SECRET_ENCRYPTION_KEY` unchanged. Workshop connects to the production service by default.
+
 ```sh
 docker compose pull
 docker compose up -d
@@ -2,9 +2,9 @@

 <img src="https://raw.githubusercontent.com/homarr-labs/charts/refs/heads/main/charts/homarr/icon.svg" align="right" width="92" alt="homarr logo">

-![Version: 8.28.1](https://img.shields.io/badge/Version-8.28.1-informational?style=flat)
+![Version: 8.28.2](https://img.shields.io/badge/Version-8.28.2-informational?style=flat)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat)
-![AppVersion: v1.76.1](https://img.shields.io/badge/AppVersion-v1.76.1-informational?style=flat)
+![AppVersion: v1.76.2](https://img.shields.io/badge/AppVersion-v1.76.2-informational?style=flat)

 A Helm chart to deploy homarr for Kubernetes

@@ -437,7 +437,7 @@ All available values are listed on the [artifacthub](https://artifacthub.io/pack
 | httproute.rules[0].matches[0].path.value           | string | `"/"`                                                                                                                                                                                                                                            | Path value to match                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | image.pullPolicy                                   | string | `"IfNotPresent"`                                                                                                                                                                                                                                 | Image pull policy                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | image.repository                                   | string | `"ghcr.io/homarr-labs/homarr"`                                                                                                                                                                                                                   | Image repository                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| image.tag                                          | string | `"v1.76.1"`                                                                                                                                                                                                                                      | Overrides the image tag whose default is the chart appVersion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| image.tag                                          | string | `"v1.76.2"`                                                                                                                                                                                                                                      | Overrides the image tag whose default is the chart appVersion                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | imagePullSecrets                                   | list   | `[]`                                                                                                                                                                                                                                             | Secrets for Docker registry                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | ingress.annotations                                | object | `{}`                                                                                                                                                                                                                                             | Ingress annotations                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | ingress.enabled                                    | bool   | `false`                                                                                                                                                                                                                                          | Enable ingress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
@@ -2,4 +2,4 @@

 Pika Pods is a hosting platform for open source apps. You can deploy Homarr on Pika Pods with just a few clicks:

-[_![Deploy on PikaPods](https://www.pikapods.com/static/run-button.svg)_](https://www.pikapods.com/pods?run=homarr-v1)
+[_![Deploy on PikaPods](https://www.pikapods.com/static/run-button.svg)_](https://www.pikapods.com/pods?run=homarr)
@@ -21,8 +21,8 @@ This method is only useful, when you want to develop on Homarr or extend it with

 ## Prerequisites

- [Node.js](https://nodejs.org/en/download/)
- [pnpm](https://pnpm.io/installation)
+- [Node.js](https://nodejs.org/en/download/) 24.18 or newer
+- [pnpm](https://pnpm.io/installation) at the version pinned in the repository's `package.json`
 - [Redis](https://redis.io/download)

 ## Steps
@@ -38,13 +38,14 @@ This method is only useful, when you want to develop on Homarr or extend it with
    Install all dependencies using <code>pnpm install</code>
  </li>
  <li>
-    Copy the `.env.example` file to `.env` and replace `DB_URL` with the full path you want to use for the sqlite
-    database file. For example `DB_URL='/home/username/homarr/db.sqlite`
+    Copy `.env.example` to `.env` and set `DB_URL` to an absolute writable path, such as
+    `DB_URL='/home/username/homarr/db.sqlite'`. Migration and application commands run from different workspace
+    directories, so a relative path can point them at different databases.
  </li>
  <li>
-    Replace `AUTH_SECRET` and `SECRET_ENCRYPTION_KEY` both with a secure random string by using `openssl rand -hex 32`
+    Run `openssl rand -hex 32` twice and set `AUTH_SECRET` and `SECRET_ENCRYPTION_KEY` to the two different generated
+    values. Keep both values secret and preserve `SECRET_ENCRYPTION_KEY` with your backups.
  </li>
-  <li>Replace `CRON_JOB_API_KEY` with a secure random string by using `openssl rand -base64 32`</li>
  <li>Run `pnpm run db:migration:sqlite:run` and wait that it completes</li>
  <li>Build the source using `pnpm build`</li>
  <li>
@@ -30,7 +30,7 @@ You can install Homarr directly from your Unraid Dashboard, no terminal required

 Don't know whether you have the plugin installed or not? Search for this tab in the navigation:

-![](img/unraid-navigation-app-manager.webp)
+![Unraid navigation with the Apps tab highlighted](img/unraid-navigation-app-manager.webp)
 :::

 #### Installing
@@ -41,7 +41,7 @@ After you've installed the Community Apps Plugin, you can install Homarr from th
 2. Search for "Homarr" and click on the result.
 3. Click on "Install" and adjust the settings to your liking.

-![](img/unraid-apps-homarr.webp)
+![Homarr result in Unraid Community Apps with installation actions](img/unraid-apps-homarr.webp)

 After you've installed Homarr, you can find it under the tab "Docker".

@@ -5,6 +5,6 @@
  "link": {
    "type": "generated-index",
    "title": "Integrations",
-    "description": "Integration are a principal part of homarr, it's where you can connect your other apps to interact with them with widgets or other capabilities, Homarr currently integrates with the following applications:"
+    "description": "Connect Homarr to supported services so widgets can display data and run actions. Choose an integration to see its setup requirements and compatible widgets."
  }
 }
@@ -28,6 +28,8 @@ import { smartHomeExecuteAutomationWidget } from "@site/docs/widgets/smart-home-
  ]}
 />

+Entity toggles and automation triggers send JSON requests to Home Assistant. A rejected action is shown as a failure.
+
 ### Adding the integration

 <AddingIntegration />
@@ -0,0 +1,55 @@
+---
+title: "llama.cpp"
+description: "Connect Homarr to a llama.cpp llama-server to monitor your local LLM: health, loaded model, generation speed and request status."
+hide_title: true
+---
+
+import { IntegrationHeader } from "@site/src/components/integrations/header";
+import { IntegrationCapabilites } from "@site/src/components/integrations/widgets";
+import { AddingIntegration } from "@site/src/components/integrations/adding";
+import { IntegrationSecrets } from "@site/src/components/integrations/secrets";
+import { llamacppIntegration } from ".";
+import { llamacppWidget } from "@site/docs/widgets/llama-cpp";
+
+<IntegrationHeader integration={llamacppIntegration} categories={["System Monitoring"]} />
+
+The llama.cpp integration lets Homarr connect to a [llama-server](https://github.com/ggml-org/llama.cpp) instance so you can see the health of your local LLM, which model is loaded, and how fast it is generating — all from your dashboard.
+
+### Widgets & Capabilities
+
+<IntegrationCapabilites items={[{ widget: llamacppWidget }]} />
+
+### Adding the integration
+
+<AddingIntegration />
+
+:::info URL configuration
+Use the root URL of your `llama-server`, for example `http://192.168.1.50:8080`. Homarr calls the `/health`, `/v1/models`, `/metrics` and `/slots` endpoints under that URL automatically.
+:::
+
+:::tip Metrics
+Generation speed and token counters are read from the Prometheus endpoint at `/metrics`. Start `llama-server` with the `--metrics` flag so these values are available:
+
+```shell
+llama-server --model /path/to/model.gguf --metrics
+```
+
+Without `--metrics` the widget still shows health, model information, and active-request speed from `/slots`; metrics-backed counters and aggregate speed stay empty.
+:::
+
+:::info Context and per-request speed
+Context (KV cache) usage and the in-flight request data are read from the `/slots` endpoint, which is available on every recent llama-server build and requires no extra flags. The per-request generation speed shown while a request is running is derived by tracking the request's decoded token count across polls, so it reflects the average speed of the request that is currently being generated.
+:::
+
+### Secrets
+
+llama-server does not require authentication by default. The integration only needs the URL of your server.
+
+<IntegrationSecrets
+  secrets={[
+    {
+      credentials: [],
+      steps: [],
+    },
+  ]}
+/>
@@ -0,0 +1,9 @@
+import { IntegrationDefinition } from "@site/src/types";
+
+export const llamacppIntegration: IntegrationDefinition = {
+  name: "llama.cpp",
+  description:
+    "Connect to a local llama.cpp llama-server to show model, throughput and request status on your dashboard.",
+  iconUrl: "https://cdn.jsdelivr.net/gh/selfhst/icons/svg/llama-cpp.svg",
+  path: "../../integrations/llama-cpp",
+};
@@ -30,6 +30,8 @@ import { systemResourcesWidget } from "@site/docs/widgets/system-resources";
  ]}
 />

+Disk temperatures are matched to filesystem partitions, including device names without the `/dev/` prefix.
+
 ### Adding the integration

 <AddingIntegration />
@@ -19,6 +19,9 @@ import Alert from "@theme/Admonition";

 <IntegrationCapabilites items={[{ widget: healthMonitoringWidget }, { widget: systemResourcesWidget }]} />

+Disk space uses each pool's root dataset to account for RAIDZ parity and dataset limits. If dataset space is unavailable,
+Homarr falls back to physical pool space, which reads higher on RAIDZ, and keeps reporting pool health.
+
 ### Adding the integration

 <AddingIntegration />
@@ -16,7 +16,7 @@ import { networkControllerStatusWidget } from "@site/docs/widgets/network-contro
 <IntegrationHeader integration={unifiControllerIntegration} categories={["Network controller"]} />

 This integration is using the [node-unifi](https://www.npmjs.com/package/node-unifi) library under the hood to connect to the Unifi Controller.
-Therfore it should support CloudKey Gen1, CloudKey Gen2, UnifiOS-based UDM-Pro controllers as well as self-hosted UniFi controllers.
+Therefore it should support CloudKey Gen1, CloudKey Gen2, UnifiOS-based UDM-Pro controllers as well as self-hosted UniFi controllers.

 ### Widgets & Capabilities

@@ -28,6 +28,14 @@ Therfore it should support CloudKey Gen1, CloudKey Gen2, UnifiOS-based UDM-Pro c

 <AddingIntegration />

+Use the local HTTPS address of your controller:
+
+- UniFi OS consoles such as Dream Router, Dream Machine, Cloud Gateway, and CloudKey use `https://<host>` (port 443).
+- Self-hosted UniFi Network Servers normally use `https://<host>:8443`.
+- If you omit the port, Homarr tries port 443 first and then port 8443 when the first port cannot be reached.
+
+Use a local administrator account. Cloud-only accounts and accounts with multi-factor authentication are not supported by the underlying client.
+
 ### Secrets

 <IntegrationSecrets
@@ -23,6 +23,8 @@ import imgSelectApikeyPreset from "./imgs/unraid-select-api-key-preset.png";

 <IntegrationCapabilites items={[{ widget: healthMonitoringWidget }, { widget: systemResourcesWidget }]} />

+CPU usage is averaged across logical processors, including SMT threads.
+
 ### Adding the integration

 <AddingIntegration />
@@ -24,12 +24,14 @@ The What's Up Docker integration lets Homarr connect to your [WUD](https://githu
 <AddingIntegration />

 :::info URL configuration
-Use the root URL of your WUD instance, for example `https://wud.example.com`. Homarr calls the `/api/app` and `/api/containers` endpoints under that URL automatically.
+Use the root URL of your WUD instance, for example `https://wud.example.com`. Homarr uses `/api/containers` under that URL for both connection testing and widget data.
 :::

 ### Secrets

-WUD does not require authentication by default. If your instance is protected with [Basic Authentication](https://github.com/getwud/wud/blob/main/docs/configuration/authentications/basic/README.md), you can provide a username and password.
+WUD 9 requires authentication. Enter your WUD username and password in Homarr; the initial admin credentials configured with `WUD_AUTH_ADMIN_USER` and `WUD_AUTH_ADMIN_PASSWORD` work with Basic authentication. Older WUD versions without authentication can leave both fields empty.
+
+Credentials are sent to the configured URL over HTTP or HTTPS. Use HTTPS outside a trusted internal network.

 <IntegrationSecrets
  secrets={[
@@ -40,7 +42,7 @@ WUD does not require authentication by default. If your instance is protected wi
    {
      credentials: ["username", "password"],
      steps: [
-        "Open your WUD instance's configuration and configure a WUD_AUTH_BASIC_* user as described in the WUD documentation",
+        "Use your WUD account credentials; older versions can use a configured WUD_AUTH_BASIC_* user",
        "Enter that username and password in Homarr — Basic authentication is handled automatically",
      ],
    },
@@ -18,7 +18,7 @@ Create an API key from the **Authentication** tab. Its value has the form `<id>.
 Send it in the `ApiKey` header:

 ```sh
-curl -H 'ApiKey: <id>.<token>' https://homarr.example.com/api/health/live
+curl -H 'ApiKey: <id>.<token>' https://homarr.example.com/api/info
 ```

 The same header authenticates tRPC requests under `/api/trpc`. Without a key, browser requests can use the Homarr
@@ -27,6 +27,27 @@ session cookie.
 API keys do not expire automatically and act as the user that created them. Every request uses that user's group and
 resource permissions.

+## Invitation dates
+
+`POST /api/invites` and the tRPC `invite.createInvite` procedure accept `expirationDate` as an ISO 8601 timestamp with a
+timezone, for example `2026-12-01T18:00:00Z`. Homarr validates the timestamp and stores it as a date. tRPC callers should
+send the ISO string rather than a JavaScript `Date` object.
+
+## Health probes
+
+The liveness endpoint does not require authentication:
+
+```sh
+curl https://homarr.example.com/api/health/live
+```
+
+It returns JSON with overall and per-component status and latency. HTTP `200` means every dependency is healthy; HTTP
+`500` identifies an unhealthy component without exposing its internal error. Health responses are not cached.
+
+## Pagination
+
+General paginated endpoints accept at most 100 records per page, and shared search endpoints accept a limit of at most 100. Request subsequent pages instead of using a larger value.
+
 ## Permission behavior

 Unauthorized operations return `FORBIDDEN`. List endpoints filter records on the server when resource-specific access
@@ -77,3 +98,28 @@ and focused references under `/api/custom-widgets/`.

 Use [Custom Widget agent authoring](../custom-widgets/agent-authoring) for the lifecycle and
 [MCP](../mcp) when the client supports Model Context Protocol.
+
+Workshop installation through `customWidget.workshopInstall` and the in-app catalog uses the same server path. Supply
+`expectedRevision` from `customWidget.workshopGet` to install only the package you reviewed. Source URL overrides and
+credentials are local; the installed definition retains its Workshop provenance.
+For native capabilities, pass local integration selections as `integrations: { "optionId": "integrationId" }`; portable
+defaults do not carry another Homarr instance's integration IDs.
+
+When renaming a saved source through `customWidget.update` or `customWidget.previewCreate`, include
+`sourceRenames: { "previousId": "newId" }` to preserve its credentials. The server checks the original and resulting
+source bindings; changed origin, network scope, or authentication requires re-entered credentials. A rename moves
+encrypted credentials transactionally and does not copy them into the portable definition.
+
+For a linked installation, `customWidget.workshopUpdateReview` returns the current and incoming definitions, source-binding
+changes, local-modification status, and review tokens. Pass its `expectedFingerprint`, `expectedState`,
+`upstreamFingerprint`, and `revision` unchanged to `customWidget.workshopUpdateInstall`. Both procedures require admin
+access and are exposed through MCP with an underscore replacing the dot. An intervening edit or upstream revision
+returns `CONFLICT`; fetch a fresh review instead of retrying the old update. Source/authentication changes and local
+customizations require a separate installation.
+
+Shared widget content uses `customWidget.contentRead({ itemId })` and
+`customWidget.contentWrite({ itemId, name, expectedRevision, value })`. Reads require access to the board; writes require
+authentication and the declaration's `modify` or `full` board permission. Each value has an independent revision; `0`
+means the declared default has not been saved. A stale revision returns `CONFLICT`; read again before saving. Content is
+scoped to the placed item and its selected definition. Workbench previews keep content changes in memory and cannot
+persist them through these procedures. These procedures are not exposed as MCP tools.
@@ -30,8 +30,9 @@ needed to restore encrypted integration credentials.
 Select a Homarr backup ZIP. The browser previews entity counts, board names, and required database migrations before
 the archive is uploaded.

-Restoring replaces the current SQLite database and cannot be undone. After a successful restore, the Next.js process
-restarts and the page reloads when Homarr is ready.
+Restoring replaces the current SQLite database and cannot be undone. It also invalidates the current database session.
+After a successful management restore, Homarr waits for the restarted server and sends the administrator to sign in
+again. The first-run onboarding restore keeps its existing board destination.

 A backup can be restored on another Homarr instance. When its `SECRET_ENCRYPTION_KEY` differs, Homarr re-encrypts stored
 integration secrets for the target instance. Version metadata is used to apply compatible migrations.
@@ -36,6 +36,11 @@ current Base layout.
 A **Container** groups apps, widgets, and nested Containers. It can have a label, collapse control, app-opening action,
 border color, and CSS classes.

+Items can occupy the outermost rows and columns of a Container. The drop preview shows the position where the item
+will remain when released.
+Dragging an item onto another item of the same size swaps their positions. Displaced items snap directly to their
+previewed positions without a movement animation and stay there when you release the pointer.
+
 A **rail** reserves one to three columns at the left or right of a non-Mobile layout. Rails stay fixed while the page
 scrolls and store their contents separately for each layout.

@@ -51,6 +56,8 @@ layout.
 - Press Escape during a pointer or touch interaction to restore the item to its previous position.

 The add-content menu can create an app, integration, widget, or Container without leaving the board.
+When adding apps, click one app to add it immediately, or choose **Select multiple** to add several at once. `Ctrl`/`Cmd`
+click remains available as a shortcut.

 ## Board settings

@@ -17,7 +17,7 @@ The color of the icon indicates how long it is valid.

 ![The Trusted certificates management page](../img/certificates.png)

-![](./img/screenshot.png)
+![Trusted certificates page listing a certificate's subject, filename, and expiry](./img/screenshot.png)

 | Color     | Meaning                     |
 | --------- | --------------------------- |
@@ -34,7 +34,7 @@ Navigate to `Management` > `Tools` > `Certificates`.

 To add a certificate click on the "Add certificate" button. The upload form expands directly on the certificates page.

-![](./img/add-button.png)
+![Add certificate button on the Trusted certificates page](./img/add-button.png)

 Then select the certificate file you want to add and click the "Add" button. You can cancel to collapse the form without
 leaving the page.
@@ -43,7 +43,7 @@ leaving the page.

 To delete a certificate you can click on the trash icon in the certificate card.

-![](./img/card.png)
+![Certificate card with subject, filename, expiry date, and delete action](./img/card.png)

 The first click arms the action and the second click confirms the deletion in place; no confirmation dialog is opened.

@@ -64,3 +64,8 @@ Below you can find instructions for some of the integrations.
 Since version 6 of Pi-hole, the web interface can be accessed through HTTPS.
 The certificate can be found in the path `/etc/pihole/tls_ca.crt`. To add the certificate, this file needs to be copied and uploaded to Homarr.
 You can find more details regarding SSL / TLS for Pi-hole [here](https://docs.pi-hole.net/api/tls/).
+
+### Proxmox
+
+For the default Proxmox VE cluster certificates, trust the cluster CA from `/etc/pve/pve-root-ca.pem` on any node.
+See [Proxmox certificate management](https://pve.proxmox.com/wiki/Certificate_Management).
@@ -26,7 +26,7 @@ Equivalent HTTP resources are available under `/api/custom-widgets/` for authent
 ## Authoring lifecycle

 1. Load the skill and only the references needed for the design.
-2. Read the external API documentation and build the definition.
+2. Read the external API documentation or discover Homarr capabilities with `customWidget_nativeCapabilities`, then build the definition.
 3. Validate the JSX, then create a preview from the complete definition.
 4. Run every returned query and simulate every relevant action against the current preview revision.
 5. Inspect the preview and redacted journal. Revise the existing preview for JSX-only changes.
@@ -34,7 +34,9 @@ Equivalent HTTP resources are available under `/api/custom-widgets/` for authent
 7. Configure deployment-specific source URLs and credentials, then preview the saved definition again.

 Use `templateLines` for multiline JSX tool input. A preview must have current evidence for every query and action before
-it can be saved. Simulation counts as action evidence without performing the mutation.
+it can be saved. Simulation counts as action evidence without performing the mutation. V3 native queries and actions use
+`customWidget_nativeQuery` and `customWidget_nativeAction` with the owned preview session ID; their evidence is recorded
+under `native:<id>`. Native capabilities must also have current evidence before preview-based persistence.

 If the agent does not have a source URL or credential, it can request a short-lived Homarr configuration URL. An
 authenticated administrator completes it in Homarr; the agent receives the status, never the plaintext credential.
@@ -43,3 +45,10 @@ Agents can also search, inspect, install, and configure existing Workshop widget

 See [MCP](/docs/management/mcp) for client configuration and [requests and security](./requests-and-security) for the
 runtime limits.
+
+## Editing an open workbench
+
+Homarr's built-in Assistant can use `workbench_read`, `workbench_patch`, and `workbench_preview` to change the visible draft.
+Read before patching, supply the returned draft ID and revision, and describe one coherent change. Credentials are excluded from these
+tools. The workbench validates the resulting definition and rejects stale patches; one Undo reverses an accepted patch.
+Browser draft tools require an open workbench and do not grant permission to save, publish, or run live actions.
@@ -1,29 +1,67 @@
 # Create a Custom Widget

-The workbench provides editors for general metadata, API sources, requests, widget options, JSX, and preview data. Raw
-JSON is available when direct editing is faster.
+The definition remains the source of truth in the workbench. Existing widgets open without converting or rewriting their
+JSX. Visual changes use targeted source edits; complex expressions remain editable in code.

-## Workflow
+## Definition and layout

-1. Configure each API source, network scope, authentication method, and credential.
-2. Add named queries and actions. Values can reference widget options or invocation parameters.
-3. Define widget options and their defaults.
-4. Write JSX using `data`, `status`, `options`, and temporary `inputs`.
-5. Run **Test and preview**, inspect the response data and redacted request journal, then save.
+A static widget needs only a JSX template: set `sources` and `requests` to `{}`. It makes no service request.

-Changing the definition, options, or credentials invalidates the previous preview. Preview actions are simulated unless
-**Run actions against the configured API** is enabled for that preview session.
+HTTP requests run on the Homarr server. Native capabilities use Homarr's installed integrations and existing
+permissions. Embeds open in the viewer's browser and need a URL reachable from that browser.

-Widget options support text, textarea, number, switch, select, multi-select, slider, date, time, color, icon, URL,
-duration, time zone, and JSON controls. Dynamic choices can come from a load query.
+Node positions and groups are stored separately from the runtime definition. Groups do not change execution. Source
+associations, data references, action invocations, and cache invalidations are distinct relationships; an invalidation edge
+does not create an execution dependency. Referenced objects cannot be removed until their dependants are resolved.

-See the [safe JSX runtime](./custom-jsx), [component reference](./component-reference), and
-[request reference](./requests-and-security) for the authoring contract.
+## Visual bindings

-## Create with another AI service
+Connecting a query, option, or action to the Widget opens a binding configuration. Queries can insert text, JSON, lists,
+or tables; request parameters can use options, temporary controls, or fixed values. Connecting options to a request changes
+its parameter bindings. These edits do not run queries or actions.

-**Create or fix with any AI** copies a self-contained prompt for an ordinary ChatGPT or Claude conversation. The model
-must return one fenced `json` block containing the complete definition. Paste that block into the workbench, add
-credentials separately, and validate it against a real preview.
+Generated JSX includes ownership comments. The canvas can disconnect or replace unchanged generated bindings as one Undo
+operation. Editing a generated block or mixing it with authored references makes the relationship code-owned; resolve it
+in JSX to preserve your changes. Removing ownership comments also removes visual ownership, without changing rendering.

-For an MCP-connected agent, use the [Homarr Custom Widget skill](./agent-authoring) instead.
+## Preview evidence
+
+Moving nodes, zooming, and opening inspectors do not execute requests or invalidate the preview. Editing the definition,
+options, or credentials marks execution evidence stale. Valid JSX renders against the last data; invalid JSX leaves the
+last valid preview visible with a stale label. Queries run deliberately, not on every keystroke.
+
+Preview actions simulate by default. Enabling **Run actions against the configured API** applies only to that preview
+session. Native actions also require declared confirmation and their normal integration permissions. Undo changes the draft;
+it never undoes or repeats a service action.
+
+## Undo and draft recovery
+
+Undo/Redo covers code, structured edits, renames, node movement, and Assistant patches. Typing is grouped and a drag or
+coherent Assistant change is one operation. The bounded history excludes credentials, responses, selection, and viewport
+movement. **Reset to saved** restores the saved definition and layout. Saving from an outdated workbench tab reports a
+conflict rather than overwriting a newer save.
+Temporary test parameters and unfinished request-body JSON keep local input Undo, so editing them does not undo an unrelated
+definition change. Credential fields also retain their own input history.
+
+Optional browser draft recovery keeps a credential-free draft and editor layout. Recovery is local to the browser and
+requires a valid recoverable configuration. It is not a revision archive or a backup of service data.
+
+## Assistant changes
+
+The Assistant reads the visible draft and selection, edits through shared draft commands, and can run preview queries. A stale patch is
+rejected when the draft has changed. Saving, live service actions, and Workshop publication remain separate operations.
+
+Form view retains **Create or fix with any AI** for external AI services. Configure credentials locally after importing
+the returned definition and validate the result.
+
+## Advanced capabilities
+
+Native capabilities, scoped CSS, reusable view fragments, typed preferences, and shared content use
+`homarr-custom-widget-v3`; ordinary HTTP and static widgets remain valid v2 definitions. Native input bindings must match
+the installed capability's schema. See the [runtime](./custom-jsx) for the expression language and extension contracts.
+
+V3 adds an integration picker with optional `integrationKinds`. The integration list respects the
+current user's access. Portable exports clear local integration selections so installers choose their own services.
+
+See the [runtime](./custom-jsx), [component reference](./component-reference),
+[native capabilities](./native-capabilities), and [request reference](./requests-and-security).
@@ -7,7 +7,7 @@ Templates are JSX expressions interpreted inside a widget-local safety and rende
 - `options.name` — saved widget configuration
 - `inputs.name` — temporary values from declarative `bind`

-The v2 manifest requires a `default` source and supports up to eight sources, 64 requests, and 64 options. Source IDs are
+Manifests support up to eight sources, 64 requests, and 64 options. A static widget can use empty `sources` and `requests`; every HTTP request must name an existing source. Source IDs are
 case-insensitively unique. Each request allows up to 32 static headers and 32 invalidation targets; a widget can contain
 up to 24 secrets, each up to 8,192 characters, and templates are limited to 50,000 characters. Validation reports the
 exact field when a limit is exceeded.
@@ -41,7 +41,7 @@ before it reaches `data`, so treat it as untrusted input even when the source is
 </Stack>
 ```

-Bound values live only in React memory while the widget is mounted. They are not saved to the database, board options, exports, browser storage, or `localStorage`. Remounting resets them. Components can share a binding when their adapter types agree.
+Without an explicit v3 `persist` binding, bound values live only in React memory while the widget is mounted. They are not saved to the database, board options, exports, browser storage, or `localStorage`. Remounting resets them. Components can share a binding when their adapter types agree.

 Bindable controls accept a scalar `resetKey`. When it changes, Homarr restores that control to its declared `defaultValue` or `defaultChecked` without running a request. This keeps dependent pagination correct while a manual `SubFetch` waits for the user to submit the new query.

@@ -74,3 +74,38 @@ than one variable quantifier are rejected.
 - `Icon`/`TablerIcon` resolves installed safe icons.

 Always include responsive loading, empty, error, and success states. Runtime failures remain inside the widget tile.
+
+## Version 3 capabilities
+
+Use `$schema: "homarr-custom-widget-v3"` for `extensions`, integration options, scoped classes, and the components below. Version 2 definitions continue to render; opening them in the workbench does not upgrade their runtime schema. Editor positions are Homarr metadata and are excluded from the portable definition.
+
+`extensions.stylesheet` accepts up to 30,000 characters. `className` references local classes; selectors and keyframe names are scoped per widget instance, including content opened through `WidgetModal` and `WidgetDrawer`. Use flat rules, `@media`, `@supports`, `@container`, and local `@keyframes`. Resource-loading CSS (`url()`, imports, fonts), global registration rules, and unresolved animation names are rejected. Theme CSS variables remain available. Inline style restrictions still apply.
+
+Templates can read `theme.colorScheme`, `theme.primaryColor`, `theme.colors`, `theme.spacing`, `theme.radius`, and `theme.fontFamily`. `container.width` and `container.height` report the widget content size in CSS pixels, so responsive composition can follow its tile rather than the browser viewport.
+
+Declare reusable JSX in `extensions.fragments` and render it with `<View name="metric" values={{ label: "CPU" }} />`. The fragment reads `props.label` and inherits the normal data bindings. Fragment names are literal, recursion is rejected, and all expansions share the interpreter's existing operation budget. Up to 32 fragments and 100,000 combined JSX characters are supported.
+
+```json
+{
+  "preferences": {
+    "filter": { "type": "string", "defaultValue": "" }
+  }
+}
+```
+
+The fragment above belongs under `extensions`. A matching `<TextInput bind="filter" persist="filter" label="Filter" />` exposes the value through both `inputs.filter` and `preferences.filter`. Preferences are typed, scoped to the board item, and saved only in that browser; another account or device gets its own values. Preview preferences remain in memory. Exports include the declarations and defaults, never the user's saved values. Storage-disabled browsers retain an in-memory fallback. `resetKey` resets a persisted control to its declared preference default.
+
+`WidgetModal` and `WidgetDrawer` require `title` and `triggerLabel`; Homarr owns their open/close behavior, focus handling, and portal boundary. They allow detailed views without authored callbacks.
+Supported selects, menus, tooltips, and popovers use Homarr-owned dropdown targets to escape tile clipping while preserving
+widget styles and the preview theme. Nested dropdowns stay within their parent overlay. Authored event handlers, refs, and
+portal targets remain blocked; Mantine's own trigger handlers work through the component adapters.
+
+`AppEmbed` requires an absolute HTTP(S) `src` and an accessible `title`. Its URL is reached by the browser, whereas HTTP sources are reached by the Homarr server; a Docker service hostname usually cannot be used for both. The embedded service must permit framing. The iframe uses an isolated origin and restricts navigation; apps requiring same-origin storage or unrestricted browser capabilities need their normal external link instead. `allowForms` explicitly enables embedded form submission.
+
+`extensions.native` maps local IDs to curated Homarr capabilities. Integration-backed entries reference a saved `integration` option through `integrationOption`; the server applies the existing integration and board permissions. `<NativeQuery nativeId="systems">{(systems, meta) => <Text>{systems.length}</Text>}</NativeQuery>` uses the same loading/error behavior as `SubFetch`. Use `trigger="manual"` for invocation parameters and `live` for a supported subscription. Automatic results populate `data` and `status` under their native ID; manual results remain local to the component.
+
+Native action entries require `kind: "action"`, `trigger: "manual"`, a `modify` or `full` permission, and a `confirmation` object containing `title` and `message`. Invoke them through `NativeActionButton`. Preview actions use the existing simulation mode; declaring an action does not authorize a live mutation. Native capability IDs and HTTP request IDs must be distinct.
+
+The [Beszel systems studio definition](/custom-widgets/beszel-systems-studio-v3.json) combines systems, configurable columns, a saved system selection, historical charts, and live detail views. Select a local Beszel integration after importing it. The example uses `preferences` directly for values needed before a control mounts; `inputs` appears only after its bound control mounts. Live failures keep the last received event and expose `meta.stale` alongside Retry.
+
+Shared editable content uses a separate `extensions.content` declaration with the same types/defaults as preferences plus `permission: "modify"` or `"full"`. `<Textarea bind="note" content="note" />` edits a local draft. `<ContentSaveButton name="note">Save note</ContentSaveButton>` commits it to the board item; `<ContentResetButton name="note">Reload note</ContentResetButton>` discards the draft and reloads the current shared value. Templates read `content.note` and `contentStatus.note` (`loading`, `dirty`, `saving`, `error`). Saves use the last read revision, so a stale draft cannot silently replace another saved value. Preview saves stay in memory; exports include declarations/defaults but exclude saved board content.
@@ -15,8 +15,9 @@ Custom Widgets may change during the v2 release cycle. Share feedback in the

 :::

-A **Custom Widget** is a validated `homarr-custom-widget-v2` definition containing API sources, queries and actions,
-optional settings, and a safe JSX template.
+A **Custom Widget** is a validated definition with a safe JSX template, optional settings, and optional HTTP sources,
+queries and actions. Existing definitions use `homarr-custom-widget-v2`; advanced composition and native capabilities use
+`homarr-custom-widget-v3`. Static widgets need no API source.

 Homarr executes requests on the server and renders the template in a restricted runtime. Source credentials are
 encrypted separately and are not included in exports, prompts, browser data, or Workshop submissions.
@@ -29,6 +30,8 @@ encrypted separately and are not included in exports, prompts, browser data, or

 Administrators can create, import, duplicate, enable, export, publish, and delete definitions under
 **Management → Custom Widgets**. Adding or configuring one on a board also requires permission to modify that board.
+Use **Actions → Configure sources** to update deployment-specific URLs, network access, and encrypted credentials
+without reopening the authoring workbench.

 Once placed, normal board permissions control rendering and requests. Queries can run for anonymous viewers on public
 boards; actions require authentication and the permission declared by the request.
@@ -47,7 +50,7 @@ and simulate relevant actions before saving. Live preview actions are opt-in bec

 ## Import and Workshop

-Use **Import from Workshop** while adding board content or import a v2 JSON definition directly. Review the source,
+Use **Import from Workshop** while adding board content or import a supported v2 or v3 JSON definition directly. Review the source,
 requested permissions, API hosts, and actions before installation, then configure deployment-specific URLs and
 credentials in Homarr.

@@ -55,5 +58,5 @@ Legacy definitions show **Migration required**. The migration prompt excludes cr
 describe the visible behavior separately, import the returned v2 definition, and verify it before removing the archived
 version.

-Back up the database and `SECRET_ENCRYPTION_KEY` before upgrading or rolling back. Multi-replica installations must use
-the same Redis service so cached responses invalidate consistently.
+Keep `SECRET_ENCRYPTION_KEY` unchanged when updating Homarr so existing credentials remain readable. Multi-replica
+installations must use the same Redis service so cached responses invalidate consistently.
@@ -0,0 +1,98 @@
+# Native capabilities
+
+V3 Custom Widgets can call a curated set of Homarr capabilities through `NativeQuery` and `NativeActionButton`.
+These use the same integration procedures, caches, partial-failure responses, and permissions as their native counterparts.
+A definition declares each capability explicitly; JSX cannot call arbitrary tRPC procedures.
+
+## Available capabilities
+
+| Capability                                      | Behavior                                                                        | Required input                                             |
+| ----------------------------------------------- | ------------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| `beszel.systems`                                | Systems overview, status, CPU, memory, disk, network and other reported metrics | None                                                       |
+| `beszel.history`                                | Historical system and optional container statistics                             | `systemId`; optional `timePeriod`, `includeDocker`         |
+| `beszel.alerts`                                 | Alerts and optional history                                                     | Optional `includeHistory`, `maxHistoryItems`               |
+| `beszel.live`                                   | Initial short history or a live statistics stream                               | `systemId`                                                 |
+| `calendar.events`                               | Calendar events from supported integrations                                     | `year`, `month`; optional `releaseType`, `showUnmonitored` |
+| `media.requests`                                | Media requests and partial integration errors                                   | Optional `statuses`, `recentDays`                          |
+| `media.stats`                                   | Request totals and users                                                        | None                                                       |
+| `media.respond`                                 | Approve or decline a media request                                              | `requestId`, `answer`                                      |
+| `smartHome.state`                               | Home Assistant entity state                                                     | `entityId`                                                 |
+| `smartHome.details`                             | Entity state, attributes and timestamps                                         | `entityId`                                                 |
+| `smartHome.switch`                              | Toggle an entity                                                                | `entityId`                                                 |
+| `smartHome.automation`                          | Trigger an automation                                                           | `automationId`                                             |
+| `docker.containers`                             | Container inventory and resource use                                            | Optional `endpointIds`                                     |
+| `docker.start`, `docker.stop`, `docker.restart` | Control a container                                                             | `endpointId`, `containerId`                                |
+
+Use `customWidget_nativeCapabilities` to discover the exact input schema for the installed Homarr version.
+Docker capabilities retain the existing administrator requirement and endpoint capability checks.
+
+## Declare and select an integration
+
+```json
+{
+  "$schema": "homarr-custom-widget-v3",
+  "name": "My systems",
+  "sources": {},
+  "requests": {},
+  "options": {
+    "beszel": {
+      "label": "Beszel integration",
+      "control": "integration",
+      "integrationKinds": ["beszel"],
+      "default": ""
+    }
+  },
+  "extensions": {
+    "native": {
+      "systems": {
+        "capability": "beszel.systems",
+        "integrationOption": "beszel",
+        "kind": "query",
+        "trigger": "load",
+        "permission": "view",
+        "input": {}
+      }
+    }
+  },
+  "template": "<NativeQuery nativeId=\"systems\">{(services) => <Stack>{services.map((service) => <Stack key={service.integrationId}><Text fw={600}>{service.integrationName}</Text>{service.systems.map((system) => <Text key={system.id}>{system.name}</Text>)}</Stack>)}</Stack>}</NativeQuery>"
+}
+```
+
+Choose a local integration in the workbench, during installation, or in board configuration. Portable exports clear the
+local selection. `integrationOption` reads saved configuration, not invocation parameters; a browser cannot replace the
+integration ID by sending a different runtime input. An integration still needs to be accessible to the viewer under
+Homarr's integration permissions. Placing a custom widget does not grant general integration access.
+
+## Inputs, detail views and live data
+
+A capability's `input` supports the same recursive `$option` and `$param` references as HTTP request bodies. Invocation
+parameters are primitive values. Use `trigger: "manual"` when an input depends on a selected row or a temporary input;
+load capabilities cannot depend on invocation parameters.
+
+The workbench reads each installed capability's input schema and offers fixed values, saved-option bindings, and invocation
+parameters. Switching an input to a parameter also switches its trigger to manual. Complex nested inputs retain a JSON
+editor; scalar and list inputs do not require editing the extensions manifest.
+
+Use `<NativeQuery nativeId="details" trigger="manual" params={{ systemId: inputs.systemId }}>` for a selected-system
+query. For a declared `beszel.live` capability, add `live` to receive events. Historical and live responses retain the
+underlying Beszel response shapes; a live event contains its event type and record. Compose those results with supported
+charts, tables, fragments, modals, or drawers. Live subscriptions reconnect periodically to renew authorization and bounded
+request capacity, and stop when their widget unmounts or a preview session expires.
+
+## Actions and preview
+
+Native actions require `kind: "action"`, `trigger: "manual"`, `permission: "modify"` or `"full"`, and a `confirmation`
+object containing `title` and `message`. Render them with `NativeActionButton`. The server checks both board permission and
+the native integration's interaction permission; Docker retains its administrator policy.
+
+**Test and preview** runs declared load queries. Manual queries and actions are exercised through preview controls. Native
+actions simulate until live preview actions are explicitly enabled. The journal records native entries as `native:<id>`;
+preview-based creation requires current evidence for every declared HTTP and native capability.
+
+Individual capability tests use the current preview session. Their parameter values and responses remain local to the
+editor and are not saved into the definition. Action tests in the capability inspector always simulate; they are disabled
+while the preview has live actions enabled. Use the rendered preview's confirmation flow to exercise live actions.
+
+This is the initial native capability library. Other self-hosted services can use HTTP sources or browser embeds. Services
+without an accessible HTTP interface, supported embed, or curated Homarr capability need an external bridge. Custom Widgets
+do not run authored backend code, shell commands, imports, or arbitrary event callbacks.
@@ -1,12 +1,18 @@
 # Configure requests and security

-Most widgets use a single source named `default`; the manifest must contain it. Extra keyed sources are available for widgets
-that combine APIs. Source IDs are case-insensitively unique. Base URLs must use HTTP(S), contain no embedded credentials,
+HTTP widgets often use a source named `default`. Every request must reference an existing source; an omitted request source
+resolves to `default`. Static and native-only widgets can use empty `sources` and `requests`. Extra keyed sources let widgets
+combine APIs. Source IDs are case-insensitively unique. Base URLs must use HTTP(S), contain no embedded credentials,
 query string, or fragment, and sources can be `public`, `private`, or `loopback`. Authentication is `none`, `bearer`,
 `basic`, an API-key header, or an API-key query parameter. Credentials belong to the widget but remain outside its manifest.
 Source origins are fixed by the definition and source-setup flow; widget options and invocation parameters cannot redirect a
 request to a different origin.

+Source URLs are fetched by the Homarr server. In a container, `127.0.0.1` refers to that container; Docker service names such
+as `sonarr` must resolve from Homarr. LAN addresses and loopback services are supported with the appropriate explicit scope.
+The workbench suggests a likely local scope from the hostname; server DNS and redirect checks remain authoritative.
+Browser navigation and app embeds use browser-reachable URLs instead.
+
 ## Named requests

 Requests are keyed by ID. `source`, `kind`, `method`, `trigger`, `auth`, and `permission` have sensible defaults, so a load query can be as small as:
Author	SHA1	Message	Date
ajnart	fbde111f01	fix: avoid ESM lexer imports in migration bundles	2026-09-12 23:56:54 +02:00
ajnart	a6bdbbb4ea	feat: add custom widget flow workbench	2026-09-12 22:51:46 +02:00
Thomas	c32a5317ca	fix: remove apps multi-select toggle (#6834 )	2026-09-12 16:34:03 +02:00
Thomas	f18033ddaa	fix: sync dev fixes into v2 and improve regression reports (#6821 ) Co-authored-by: Homarr Update Contributors <210161987+homarr-update-contributors[bot]@users.noreply.github.com> Co-authored-by: Crowdin Homarr <190541745+homarr-crowdin[bot]@users.noreply.github.com> Co-authored-by: Releases Homarr <175486441+homarr-releases[bot]@users.noreply.github.com> Co-authored-by: Thomas <thomas@ajnart.fr> Co-authored-by: homarr-releases[bot] <175486441+homarr-releases[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: homarr-update-contributors[bot] <210161987+homarr-update-contributors[bot]@users.noreply.github.com> Co-authored-by: homarr-crowdin[bot] <190541745+homarr-crowdin[bot]@users.noreply.github.com> Co-authored-by: Afonso Jorge Ramos <afonsojorgeramos@gmail.com> Co-authored-by: Danura30082 <danura30082+github@gmail.com> Co-authored-by: Kushie <122986913+kushiemoon-dev@users.noreply.github.com> Closes #6604	2026-09-12 15:31:04 +02:00
Thomas	ff2b589380	fix(board): refine container spacing and collapse layout (#6833 )	2026-09-12 15:23:50 +02:00
Thomas	9bc3802b3b	fix(wud): authenticate HTTP requests and validate container access (#6831 )	2026-09-12 10:57:36 +02:00
Thomas	2049c6ade0	fix: tighten v2 setup and release safeguards (#6824 )	2026-09-12 10:47:35 +02:00
ajnart	e21a0bb6da	fix: refresh OpenAPI widget kinds	2026-09-12 10:46:39 +02:00
Thomas	61f22c8e64	fix: show board removal confirmation in a dialog (#6829 )	2026-09-12 10:36:36 +02:00
leafyelin	6cca757493	feat(plugins): add llama.cpp server integration and widget (#6765 )	2026-09-10 20:06:13 +02:00
Thomas	1102ad8342	fix: protect demo users from deletion and password changes (#6819 )	2026-09-10 19:52:47 +02:00
Thomas	7c00c18a42	docs(mcp): restore custom widget authoring guidance (#6817 )	2026-09-10 19:24:55 +02:00
Thomas	ea3dac752f	fix(mcp): harden tool schemas and dispatch (#6815 )	2026-09-10 19:19:47 +02:00
Thomas	f994d665d2	ci: remove automatic test gates and trim test suites (#6816 ) * ci: remove automatic test gates and trim test suites * docs: remove CI audit report	2026-09-10 19:14:31 +02:00
Thomas	3358b6337f	fix(mcp): use JSON-compatible invitation dates (#6814 )	2026-09-10 17:53:38 +02:00
Thomas	61d3fd5f08	fix(board): restore container grid geometry (#6808 )	2026-09-09 15:04:27 +02:00
Thomas	3aac106156	docs: correct v2 beta installation guidance (#6809 )	2026-09-09 12:09:14 +02:00
Thomas	9d857377c1	fix: refine release v2 interactions (#6805 )	2026-09-08 11:36:19 +02:00
Thomas	923905c529	fix: keep bookmark density consistent (#6804 ) * fix: keep bookmark density consistent * fix: prioritize bookmark titles in compact rows * fix: preserve compact bookmark text fallback	2026-09-08 10:39:41 +02:00
Thomas	a4a903d7c3	feat: polish release v2 experience (#6800 )	2026-09-07 19:17:37 +02:00
Thomas	925b0fb801	fix: improve bookmark widget density (#6802 ) * fix: improve bookmark widget density * fix: render dense bookmark grids as icons * fix: honor bookmark column density	2026-09-07 13:47:11 +02:00
ajnart	6db26a0d99	docs: restore release article hierarchy	2026-09-06 20:41:55 +02:00
ajnart	bbcbd031fe	docs: clarify Homarr provider terms	2026-09-06 20:37:52 +02:00
ajnart	7024a57f56	docs: tighten Homarr 2.0 release article	2026-09-06 19:57:44 +02:00
Thomas	5121356113	Merge pull request #6794 from homarr-labs/feat/refocus-homarr-v2-article docs: refocus Homarr 2.0 article	2026-09-06 19:20:05 +02:00
ajnart	4f2ab59345	docs: refocus Homarr 2.0 article	2026-09-06 19:19:23 +02:00
Thomas	73bf68c9a8	Merge pull request #6792 from homarr-labs/feat/v2-release-client-ids fix(ci): use GitHub App client IDs	2026-09-06 18:05:28 +02:00
ajnart	dea1de5fee	fix(ci): use GitHub App client IDs	2026-09-06 17:57:35 +02:00
Thomas	2bd538e685	Merge pull request #6791 from homarr-labs/feat/publish-homarr-v2-blog docs: publish Homarr 2.0 article	2026-09-06 17:52:05 +02:00
ajnart	f0c39ea0d2	docs: publish Homarr 2.0 article	2026-09-06 17:51:36 +02:00
Thomas	8a0cf15bf7	docs: finalize Homarr 2.0 release article (#6790 )	2026-09-06 17:48:08 +02:00
Thomas	f1c898efe2	docs: add Homarr 2.0 release article (#6789 )	2026-09-06 15:39:54 +02:00
Thomas	724dee55c5	fix(weather): handle disabled external connections (#6780 )	2026-09-06 15:35:06 +02:00
Thomas	50a3bcce69	fix(ci): restore release automation (#6770 ) * fix(ci): restore release automation * ci: remove obsolete documentation release dispatch * ci: report production deployment failures	2026-09-06 15:32:52 +02:00
Thomasandajnart	ca7be8f3ad	fix(integrations): support UniFi controller default ports (#6787 ) * fix(integrations): use Unifi default port 8443 when no port is given The node-unifi library hardcodes https:// in its base URL and the Unifi controller API only speaks HTTPS. When a user adds the integration with a bare http:// or https:// URL, getPortFromUrl returned 80 or 443, and the library attempted a TLS handshake on the wrong port. The server's plain HTTP response caused 'EPROTO ... wrong version number'. Derive the port from the user's explicit port, or fall back to 8443 (the integration's defaultPort). Closes #6207. * style: auto-fix lint and format * fix(integrations): support UniFi controller default ports * docs(unifi): resolve review leftovers --------- Co-authored-by: ajnart <ajnart@users.noreply.github.com>	2026-09-06 15:32:45 +02:00
Thomas Artur arturict	134ef48848	fix(integrations): preserve Nextcloud subpaths (#6786 ) * fix(integrations): preserve Nextcloud subpaths * Keep existing Nextcloud DAV endpoints intact --------- Co-authored-by: Artur <145776561+arturict@users.noreply.github.com> Co-authored-by: arturict <arturict@users.noreply.github.com>	2026-09-06 15:32:37 +02:00
Thomas Artur arturict	98aa6f01f2	feat(auth): support nested OIDC claim paths (#6785 ) * feat(auth): support nested OIDC claim paths * test(auth): cover OIDC profile name fallbacks * test(auth): cover missing OIDC username fallback * test(auth): preserve OIDC provider guard --------- Co-authored-by: Artur <145776561+arturict@users.noreply.github.com> Co-authored-by: arturict <arturict@users.noreply.github.com>	2026-09-06 15:32:31 +02:00
Thomas	4c88030b0f	fix(downloads): preserve name column width (#6784 )	2026-09-06 15:32:25 +02:00
Thomas	0c11c2785e	docs(helm): sync current chart metadata (#6783 )	2026-09-06 15:32:20 +02:00
Thomas	96a6926b2b	fix(docker): normalize container CPU usage (#6782 )	2026-09-06 15:32:15 +02:00
Thomas	f89487231f	fix(unraid): use byte-based memory metrics (#6781 )	2026-09-06 15:32:09 +02:00
Thomas	a62d11b5cd	fix(mcp): honor public OAuth origin (#6779 )	2026-09-06 15:31:57 +02:00
Thomas	28e242417d	fix(backup): prompt re-login after restore (#6778 )	2026-09-06 15:31:51 +02:00
Thomas	0ffa95c505	docs: make environment examples safe and current (#6777 ) * docs: make SQLite environment example runnable * docs: remove unsafe source secret examples * docs(auth): remove unsafe SSO environment values * docs(auth): clarify OIDC credential placeholders	2026-09-06 15:31:40 +02:00
Thomas	b708f687fa	docs: add v1 to v2 upgrade guide (#6774 ) * docs: add v1 to v2 upgrade guide * docs: simplify v2 backup guidance	2026-09-06 15:31:33 +02:00
Thomas	4fd9b04c61	fix(deps): patch high production advisories (#6788 )	2026-09-06 15:27:14 +02:00
Thomas	378332c8da	docs: update contribution checklist for v2 (#6773 )	2026-09-06 14:31:57 +02:00
Thomas	3d9b8e8ae6	fix(docs): generate valid integration links (#6772 )	2026-09-06 14:31:48 +02:00
Thomas	f7b194fc9f	fix(auth): patch critical Auth.js vulnerabilities (#6775 )	2026-09-06 14:25:09 +02:00
Thomas	eb20b97d5f	fix(deps): patch critical protobufjs vulnerability (#6776 )	2026-09-06 14:25:00 +02:00