Hauser v0.4.0-beta.10

Release identity

Version	0.4.0-beta.10
Git tag	v0.4.0-beta.10 (annotated, ad73b5dc)
Source commit	f5fda5460a5df7eaa2c8eb58e7ed9aefcad38eed
Image	ghcr.io/ralleur/hauser@sha256:ae87b24af625e49ad211f11e22881393523150f9c28f36e0b615ba5e2b98ce84
Also tagged	:v0.4.0-beta.10 and :0.4.0-beta.10 (same manifest; the Supervisor resolves the unprefixed tag)
Platforms	linux/amd64, linux/arm64
Container smoke	verify-container.sh against the published digest: setup_required=PASS, migration_v1_to_v4=PASS, cycles=2, backup_restore=PASS, invalid_config=PASS, invalid_migration=PASS
Source offer	/api/build-info on the published image returns revision=f5fda5460a5df7eaa2c8eb58e7ed9aefcad38eed, sourceUrl=https://github.com/ralleur/hauser, license=AGPL-3.0-only
Build run	https://github.com/ralleur/hauser/actions/runs/33063271176

What changed

This release makes the room-image assistant work inside the Home Assistant
App, and gives rooms that have no background or no devices yet somewhere to
start.

Fixed — the room-image assistant failed with a 403 in the Home Assistant App

Every write the assistant makes — starting a ChatGPT sign-in, uploading a
photograph, creating variants — was answered with HTTP 403 ORIGIN_FORBIDDEN
when Hauser ran as a Home Assistant App. The App can only configure the
loopback origins (http://localhost:4173,http://127.0.0.1:4173), while the
browser reaches Hauser under the host's own address, so a legitimate request
never matched the static allowlist and the assistant was unusable for anyone
who had not edited the origin list by hand.

The room-image origin check now accepts, in addition to the configured list, a
request whose Origin matches its own effective origin — protocol, host and
port, compared exactly, using the same same-origin comparison the rest of the
server already applies. The security boundary is unchanged in every other
respect: foreign origins, a differing port or protocol, null, malformed
values, a missing Origin on a write, and duplicate Origin headers all stay
rejected. Nothing is hard-coded to a particular address or hostname.

Fixed — room-image errors appeared in German in an English install

The assistant, the image-set library and the access panel displayed the
server's error text verbatim, and the server writes German only. They now show
the translated message for the operation that failed.

Fixed — a published image set could break the next server start

The expiry pass marked already published variant_set jobs as expired without
detaching the asset, which the metadata validation forbids — so the service
refused to start with "incoherent room-image job metadata". Records that carry
an asset are now left untouched.

Added — rooms without a background explain how to get one

A room with no image set assigned showed an empty tile. The home screen now
carries an onboarding card with a before/after band, the three steps the
assistant takes, and three ways out: generate an image, pick one yourself, or
dismiss the card. The assistant and the library are loaded only when one of
them is opened.

Added — rooms without devices offer a way to add one

Instead of a blank area, an empty room shows an Add device placeholder tile
that opens the same room editor as a long press on the room tile.

Added — the people on the pinboard can be named and added

Tapping a name renames that person, a header button adds another, and each gets
a note colour from a fixed palette. Existing tasks stay with their person.

Changed — the room-image assistant leads with the photograph

The OpenAI access step now appears only when access is missing and stays
reachable as a chip in the header afterwards; the consent text is one line with
the long form behind an info button. Choosing the photograph is the first thing
the assistant asks for, and offers the camera directly on touch devices.
Cropping and zoom moved to step two next to the style variants, because the
perspective correction changes the framing anyway. The focus picker is gone —
the generated sets already match the panel format exactly, so it changed
nothing.

Changed — the standby button sits in the title bar by default

The setting in the long-press menu now switches to the large floating button
instead of away from it.

Upgrading

Home Assistant App users: Settings → Add-ons → Hauser → Update. Docker and
Compose users: pull ghcr.io/ralleur/hauser:0.4.0-beta.10. No configuration
migration is required.