v1.0.19

Highlights

• The door opens with your plant's own command (#58): the lock, the Open Door button, HomeKit and open_door now send the door actuator's MSG from your phonebook, as the VIEW app does, instead of a fixed OPEN_2F. It takes effect on update, with no new import. If your door stops opening, see the note under Fixed and please report it on #58.
• /av key (#63, @m4r1k's idea): plain /av (which calls the panel) now wants a Home Assistant user or the installation's key. The integration's camera adds it by itself; passive URLs for go2rtc, Frigate and Scrypted keep working without it for now (docs/EXTERNAL.md).
• Rings end when the panel gives up (#60): on local UDP an unanswered ring no longer goes on for 90 s.
• No call again after a hang-up when a dashboard is left open (#57).
• Passive /av stream (#87, @Apeiv): no frozen panel frame after a call, smoother cloud video, a lighter decoder, no more "bind failed".
• Sharper video from the 40515 (2 Mbit/s instead of 256 kbit/s) and correct colours in the card.
• Away message upload from the integration settings and from the card, and a Test ring button.
• Security: the low findings of #46 (SRTP replay window, bounded regexes, no links followed in the snapshot folder) and admin-only Test ring and upload.

Before you update: if you filter debug logs on custom_components.vimar_intercom.hub, the plant messages and ring media now log under ...plant_messages and ...ring_media.

Added

• Docs: clear the ring notification on the other phones (#99): a recipe in
  docs/ENTITIES.md (and the Italian page) that sends the ring notification with a fixed tag and clears it
  with clear_notification when the ringing binary sensor goes off, so nobody taps a ring that is already taken.
• Test ring button (diagnostic, on the device page): a 20 s test ring in one tap, the same as the
  simulate_ring service, to try your ring automations and notifications without writing YAML. It reports an
  error if a real call or ring is in progress.
• Upload the away message from the settings: a file field next to Message if nobody answers (audio file)
  takes an mp3, wav or m4a (max 5 MB), saves it in <media folder>/citofono/messaggi and makes it the away
  message. Only the file name is kept (no paths); a different file with the same name gets -2 added instead of
  being overwritten.
• Upload the away message from the card: in the card's Intercom settings, under Away message audio file,
  an Upload button (Replace when a file is already chosen) sends the file to the new admin-only
  POST /api/vimar_intercom/away_upload, with the same rules as the settings upload, and selects it. The old file
  stays in the folder. The file list now shows None (use the text) instead of none.

Changed

• Debug logs: the plant message parsing now logs under custom_components.vimar_intercom.plant_messages and
  the ring media under custom_components.vimar_intercom.ring_media, no longer under ...hub. Adjust your
  logger: entry if you filter on the old name.
• README: an Open in HACS button (My Home Assistant) and a last-commit badge; the release, downloads and
  stars badges are gone, since HACS already shows them at the top of the page.

Fixed

• Card popup, iPhone: closing it no longer taps the card underneath. The tap on X or Hang up also landed on the compact card that takes the popup's place: during a ring it hit Answer (the popup came back and the card answered), after a hang-up it reopened the popup and called the panel. For 0.8 s after the popup closes, taps on the compact card are ignored.
• Card popup: X during a ring means "not now". It sends nothing to the panel (the ring goes on for everyone else) and the popup no longer opens by itself again for that ring, whatever follows (answered elsewhere, call ended, the card rebuilt). A new ring opens it as before.
• Card: no black box while waiting for video. Until the first frame arrives the live view shows the doorbell icon and "In attesa del video…".
• Away message upload errors (#91): an expired upload showed the raw text
  "File does not exist" in the form; any failure other than a wrong type or a too big file now shows the
  translated File not saved error. An empty file or a name over 200 bytes is refused as a wrong file instead of
  failing with an error in the log.
• Live video from the 40515 was soft and choppy (16 fps, ~14 KB keyframes) because we asked the panel for 256 kbit/s. We now ask for 2 Mbit/s: it sends 25 fps at about 1.5 Mbit/s, same 720x576 picture. A keyframe is now a burst of about 40 packets, which filled the 64-packet cap of the reorder buffer before the 80 ms wait ran out and dropped the picture until the next keyframe, so the cap is now 512.
• Card video colours looked off (skin and sky tints): the panel's SD H.264 carries no colour info, so browsers assumed BT.709. The decoder is now configured with BT.601.
• A dashboard left open no longer calls the panel again ~10 s after a hang-up (#57): go2rtc and the stream worker reconnect to /av with a growing back-off, and each refused reconnect moved the 5 s quick-reopen window forward, so the first one more than 5 s apart placed a call. Now a reconnect from a viewer that was watching /av when the call ended waits the full 60 s pause. Opening the camera within the minute still calls if /av was not open at the end (for example after answering from the card), and HomeKit is unchanged. So a viewer that was watching /av when the call ended now gets 503 for up to 60 s instead of about 5 s, for example when reopening the camera right after the panel closes a view at 120 s. That is intended.
• An unanswered ring now ends when the panel stops ringing (#60): on local UDP the panel
  gives up without a CANCEL, so HA kept ringing up to 90 s and a late answer opened a dead call. The panel
  does stop its ring preview when it gives up: 3 s without any preview RTP now ends the ring (ring_ended, end
  webhook, the card closes) and a late answer finds no ring. A panel that sends no preview keeps the 90 s limit.
  Cloud TLS is unchanged: the relay sends CANCEL, and a gap in the preview there must not end the ring.
• Passive stream stuck on the last panel frame (#87) (/av?autocall=0&idle=image): after a call the stream could keep the panel's last frame until restart; the standby frame now comes back one second after the video ends.
• Choppy or frozen /av video on cloud plants (#87): the RTP forward reaches ffmpeg in arrival order, and with
  its default 0.1 s max_delay ffmpeg gave up on late packets ("max delay reached") and dropped frames. The
  input now waits up to 0.3 s (-max_delay 300000 -reorder_queue_size 1024). This can add up to 0.3 s of latency to /av.
• Passive stream load on Home Assistant (#87): the live decoder now hands over the 10 fps the encoder uses, not all 25 (about 11 MB/s of raw video on the event loop).
• "bind failed" after an /av client left mid-start (#87): an /av client leaving while ffmpeg was starting could leave that ffmpeg running with the UDP ports, and
  the next call's ffmpeg failed with "bind failed". It is now killed, and the next one waits until it is gone.
• /audio_ws state messages carry ringing: a client that connects while the panel is ringing (an Echo
  Show through Scrypted) now knows it and can watch instead of placing a call over the ring.
• Live video froze for up to 3 s after each keyframe on cloud plants: packets the relay delivered a few milliseconds out of order were treated as lost. The reorder buffer now waits up to 80 ms for a gap.
• The door is opened with your plant's own command (#58): the lock, the Open Door button,
  HomeKit's gate and open_door without command now send the MSG of the phonebook's door actuator for that
  panel, as the VIEW app does, instead of a fixed OPEN_2F. The body is taken only together with its panel, since
  a relay module can use the same body towards another one. Without a door actuator in the phonebook nothing
  changes (OPEN_2F, with a log line saying so). The Last Door Open sensor shows the command sent and where it
  came from (phonebook, default, explicit). Takes effect on update, without a new import: if the
  phonebook you already imported has a door actuator, its MSG is used from now on (for example OPEN instead
  of OPEN_2F). If the door stops opening, set that actuator's msg back to OPEN_2F in Options → Actuators
  (JSON), and please report it on #58. A row naming the panel wins over an AUTO row, and the "no door
  actuator" line is logged once per panel.

Security

• Test ring button is admin only (#85): it starts the same fake ring as the admin-only
  simulate_ring service (ring webhooks, announcements, automations), but any user could press it. Now a
  non-admin user gets Unauthorized; automations and scripts (no user) can still press it, like they can call the
  service.
• Away message upload never writes through a link (#91): the file is created with
  O_CREAT|O_EXCL|O_NOFOLLOW, so a dangling symlink (or a file that appears in the meantime, including a
  concurrent upload with the same name) is never written through or overwritten; the upload gets the next -n
  name instead.
• /av key (#63): plain /api/vimar_intercom/av places a call to the panel, and
  until now any client that looked local got it (a port-forward with SNAT, a guest Wi-Fi device). It now
  also wants an authenticated Home Assistant user or the installation's key in ?auth=<key>. The key is
  created at first start, stored in the entry, never expires (the stream worker reuses its URL on every
  reconnect) and the integration's camera adds it by itself. Refusals are 403, not 401, so Home Assistant's
  "invalid authentication" warning never prints the URL; auth is also the name HA masks in its stream
  logs, and the integration masks it in its own. Options → /av stream key shows it and regenerates it.
  Passive URLs (autocall=0, go2rtc/Frigate/Scrypted) keep working without it for now; a wrong key is
  refused everywhere. See docs/EXTERNAL.md.
• Symlink in the snapshot folder (#46): a symlink or hard link left in the ring photo folder at
  the name of ultimo_squillo.jpg (or of a ring photo) was followed, so the photo overwrote another file, and the
  camera could show any file Home Assistant can read. Photos are now written to a new file and renamed over the
  name, and the last photo is read only if it is a regular file. The ring clip (and its audio remux), which
  ffmpeg opens by name, now goes to a file the integration creates first, after removing whatever was at that
  name. A photo or clip with more than one name (a hard link) is no longer served.
• Slow patterns on SIP headers (#46): the Tab 5S/7S Plus model patterns and the SIP user and host
  patterns of the device inventory could take seconds on a crafted header (a long run of spaces, or sip:
  repeated without an @), stalling Home Assistant. The patterns no longer backtrack that way, and the
  User-Agent is cut at 256 characters before it is matched. Real headers match as before.
• SRTP replay window (#46): the receiving side of the call media had no replay protection, so one
  captured voice or video packet, sent again, was accepted every time. An index already received among the
  last 128 per stream is now dropped after authentication; packets merely out of order still pass. A lone
  packet far from the window never moves it, and passes once if ahead (one stray on a cloud ring stalled the
  stream). Three in a row move it (50 past half a wrap): a sender restarting lower loses 2. Known gaps: 3
  captured old packets in a row move it back too, and far-ahead ones sent in turn, not in a row, pass every
  time.