feat(contrib): a Heimdall enhanced-app tile, ready to submit - #287
Conversation
Sergio authorised the Heimdall submission on 2026-08-07. Their process requires
a REQUEST FIRST through a web form on apps.heimdall.site, and the scaffold they
hand back carries a generated appid -- so the submission itself cannot be
scripted. What CAN be prepared is everything around it, which is what this is.
ENHANCED RATHER THAN FOUNDATION, and it costs no server change: Heimdall apps
build their own request attrs and can send an Authorization header (25 apps in
their repo already do), and CashPilot already accepts Bearer auth ahead of the
session cookie.
VERIFIED AGAINST THE LIVE INSTANCE rather than assumed. GET
/api/earnings/summary with a Bearer token returned real values, which is how
two things came to light that reading the code alone would not have shown:
* CASHPILOT_ADMIN_API_KEY is NOT SET on the live server, so the documented
programmatic path does not work there today. The fleet key does.
* neither credential is read-only. A tile showing two numbers needs a key
that can control containers or enrol workers. The config help now says so
plainly instead of pretending otherwise, and the gap is filed separately.
THE RULE THE TILE RESPECTS, carried one step further out than before: it must
not turn our uncertainty into the user's loss. has_readings is false both on a
fresh install and on one whose collection has silently stopped, and
active_services is deliberately null when the count could not be taken -- 0
there reads as "nothing is running" when things are. Heimdall's blade templates
print raw values, so both cases are mapped to an em dash inside livestats().
Kept in contrib/ rather than a fork so it stays versioned with the API it
calls, and outside docs/ so it is not published -- verified: the built site
contains no heimdall files. The PHP is syntax-checked (php -l, clean).
|
Warning Review limit reached
Next review available in: 50 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
You authorised the Heimdall submission. Their process requires a request first through a web form on
apps.heimdall.site, and the scaffold they hand back carries a generatedappid— so the submission itself cannot be scripted. Everything around it can be, and this is that.Enhanced, not foundation — and it costs no server change
Heimdall apps build their own request attrs and can send an
Authorizationheader (25 apps in their repo already do), and CashPilot already accepts Bearer auth ahead of the session cookie. So a live tile needs nothing new server-side.Verified against the live instance, not assumed
GET /api/earnings/summarywith a Bearer token returned real values. That is how two things surfaced that reading the code would not have shown:CASHPILOT_ADMIN_API_KEYis not set on the live server — the documented programmatic path does not work there today. The fleet key does.The rule the tile respects
It must not turn our uncertainty into the user's loss:
has_readingsis false on a fresh install and on one whose collection has silently stopped →$0.00would assert a measurement nobody tookactive_servicesis deliberately null when the count could not be taken →0reads as "nothing is running", the opposite of the truthHeimdall's blade templates print raw values, so both are mapped to an em dash inside
livestats().Housekeeping
Kept in
contrib/rather than a fork so it stays versioned with the API it calls, and outsidedocs/so it is not published — verified: the built site contains no heimdall files. PHP syntax-checked withphp -l, clean. 4370 tests pass.What is left for you
Steps 1–2 in
contrib/heimdall/README.mdare the web form. The field values, licence, description, tile background and icon are all filled in there ready to copy — CashPilot is not among their 660 apps, so a request is required first, and they warn that poorly made requests are deleted.