Skip to content

Hauser v0.4.0-beta.9

Pre-release
Pre-release

Choose a tag to compare

View all tags
@ralleur ralleur released this 26 Aug 11:11
· 40 commits to main since this release
v0.4.0-beta.9
a52e2c3

Release identity
Version 0.4.0-beta.9
Git tag v0.4.0-beta.9 (annotated, 96a8f27a)
Source commit a52e2c3d19fdda87b41e0365f0e25f81aa7303ac
Image ghcr.io/ralleur/hauser@sha256:bc761b19b79bdab15b3c7ce89b6bc539e80411c8f27f90e310746c88546ca108
Also tagged :v0.4.0-beta.9 and :0.4.0-beta.9 (same manifest; the Supervisor resolves the unprefixed tag)
Platforms linux/amd64, linux/arm64
Config schema v4, with the v1 → v4 migration path included, plus a one-time navigation migration for configurations generated by beta onboarding

What changed

This release answers the feedback in #8, makes the room-image assistant
actually usable, and fixes the source-offer surface the AGPL requires.

v0.4.0-beta.8 was tagged and its image published, but no release was issued
for it: the provenance defect below was found while verifying that exact image
digest. Everything beta.8 contained is in this release. If you are on
v0.4.0-beta.7, update straight to this version.

Fixed — the published container did not say where its source came from

Hauser serves its exact revision and the URL of the corresponding source at
/api/build-info, unauthenticated and before any configuration exists; that is
how the project meets section 13 of the AGPL. In every image published since
the license change, both fields came back empty, because the release workflow's
publish step never passed HAUSER_REVISION and HAUSER_SOURCE_URL into the
build. It also never passed HAUSER_RELEASE=1, the Dockerfile's own guard that
fails a release build instead of publishing an image which cannot back its
source claim — so nothing caught the omission. CI never saw it either, because
it runs the container contract against a locally built, commit-bound image
where those arguments are set. The image labels
(org.opencontainers.image.revision and .source) were always correct; only
what the running container reported about itself was missing.
v0.4.0-beta.7 and v0.4.0-beta.8 are both affected.

Added — Calendar and Notes reach the navigation (#8)

Onboarding produced a navigation with only Home and System (plus Media when a
media player was discovered), while the Calendar and Notes screens existed with
no way to reach them — the README's hero image showed tabs an onboarded install
never had. New installs now get Home, Calendar, Notes, optionally Media, and
System. An existing install whose navigation is still the untouched onboarding
result is migrated to the same set on load; a navigation you customized
yourself is left alone.

Added — a library for generated room backgrounds

Finished image sets were reachable from nowhere once the assistant had produced
them. Settings → Rooms & Devices now lists every set with a preview, its size,
its creation date and the room it is assigned to, and lets you assign a set to
a room, remove that assignment, or delete it after a confirmation. The header
shows how many sets exist and how much storage they occupy.

Added — one room-configuration overlay

Tapping a room under Rooms & Devices now opens the same overlay as a long press
on the home screen, instead of a second route with different capabilities. The
overlay also assigns image sets from the library, and a long press on a device
row moves that device to another room.

Fixed — the room-image assistant did nothing over plain http://

Generating an ID used crypto.randomUUID, which browsers expose only in a
secure context. On a panel reached over http:// in the LAN the request failed
while it was still being assembled — before any network call and before the
error handling — so pressing Create variants produced no request, no status
change and no message at all. It now falls back to getRandomValues, reports
unexpected failures instead of swallowing them, and places error messages
directly above the action buttons. The ChatGPT authorization code can be copied
with a click. The two candidates also differ as intended now: a realistic
composition with corrected perspective, and an illustration.

Fixed — both clocks froze (#8)

The dashboard and ambient clocks stopped advancing and only a manual reload
brought them back. They now resynchronize when the page is restored, the tab
becomes visible or the window regains focus, in addition to their regular tick.

Fixed — Status & Updates showed invented services and updates (#8)

The screen listed six pending updates and five connected services from
hard-coded prototype data, none of it reflecting the connected instance — which
is misleading about security-relevant state. A productive install now shows only
the verified Home Assistant connection and genuine pending update.* entities,
and says No updates available when there are none. The fictional list
remains only in the demo build, which is marked as such.

Fixed — German text in the English interface (#8)

The connection indicator, the Safari Add to Home Screen hint, and the
room-image assistant, its library and its access dialog are translated in all
six languages. The ambient hero text keeps the selected language consistently
instead of switching between English and German across visits.

Fixed — the floating power button covered controls (#8)

While System settings are open, the power control now sits in the title bar
even when the floating button is the general preference, so it no longer
obscures the Scenes Reset button.

Changed — the AI line on the lock screen is off by default

It calls a language model service, which should be a deliberate choice rather
than something that happens on first start. Turning it on is remembered; the
default is off on every install.

Installation or update

Back up before changing images. For the App, create a Home Assistant backup
that includes Hauser; for Compose, run ./scripts/backup.sh.

Fresh Compose install:

git clone https://github.com/ralleur/hauser.git
cd hauser
docker compose up -d

Update from v0.4.0-beta.7 or v0.4.0-beta.8:

./scripts/backup.sh
git pull
docker compose pull
docker compose up -d

The navigation migration runs once when the existing configuration is loaded.
It only applies to a navigation that is still exactly the onboarding result; if
you edited your navigation, nothing changes and Calendar and Notes stay absent.

Previous immutable image for rollback: ghcr.io/ralleur/hauser:v0.4.0-beta.7.
Note that rolling back to beta.7 or beta.8 reintroduces the empty
/api/build-info provenance described above.

Verification evidence

  • Tests, typecheck, production build and static demo build: green in CI on the
    tagged commit (Quality and release image, run
    32960138996);
    the same workflow passed on main for the identical commit as run
    32959066371.
    svelte-check reported 0 errors and 0 warnings; the unit suite ran 1410
    tests across 106 files.
  • Container health, setup-required start, v1 → v4 migration, persistence across
    recreation, backup and destructive restore, and fail-closed behaviour on an
    invalid configuration: all PASS in CI against the commit-bound image
    hauser:ci-a52e2c3d19fd.
  • Post-publish digest pull and smoke: the published multi-architecture
    manifest above was pulled from GHCR and put through the same full container
    contract, producing setup_required=PASS, migration_v1_to_v4=PASS,
    cycles=2, backup_restore=PASS, invalid_config=PASS and
    invalid_migration=PASS. This ran on linux/arm64 only; linux/amd64 was
    built and pushed in the same manifest but not separately smoke-tested after
    publication. This is the first Hauser release whose published digest was
    verified rather than only its commit-bound CI image.
  • Build provenance on the published digest: /api/build-info returns version
    0.4.0-beta.9, revision a52e2c3d19fdda87b41e0365f0e25f81aa7303ac, source
    https://github.com/ralleur/hauser and license AGPL-3.0-only — the
    revision matches the tagged commit above.
  • Release metadata, license boundary and dependency audit: verified in CI by
    verify-release-metadata.sh, verify-license-boundary.sh and
    npm audit --omit=dev --audit-level=high (found 0 vulnerabilities).
    verify-release-metadata.sh v0.4.0-beta.9 was additionally run against a
    fresh clone of the tagged tree: package, lockfile, Docker metadata, changelog,
    App manifest and release-day claims all match.
  • Export and privacy gate: clean. The full public preflight ran in an isolated
    worktree before a52e2c3d was pushed.
  • Landing page and demo: deployed for the same commit (run
    32960012138).
    https://ralleur.github.io/hauser/ reports 0.4.0-beta.9 and
    https://ralleur.github.io/hauser/demo/ answers 200.

Known limitations

  • The vacuum path (beta.5) follows the documented Home Assistant service set
    and is still not verified against real hardware.
  • The room-image assistant needs your own OpenAI account and bills against it.
    Its http:// fix was verified by the maintainer on a real panel; the
    generated-image quality itself remains subjective and unverified by an
    external user.
  • The fixes in this release have unit-test coverage and maintainer verification
    only. None of them has been confirmed on an external, real-home installation.
  • The navigation migration was exercised by unit tests and by the container
    contract's v1 → v4 migration path, not against a hand-edited real
    configuration from an external install.
  • The post-publish digest smoke covered linux/arm64. The linux/amd64 half of
    the manifest carries the same build but was not re-tested after publication.
  • An external, real-home installation covering this release remains the next
    beta-stabilisation evidence gate.
  • This package remains an experimental technical beta without a support SLA.

Security and support

Please report anything security-relevant as described in
SECURITY.md. Hauser is
a hobby project without a support SLA. Do not expose it directly to the internet
without an authentication and TLS boundary in front of it.

Assets 2
Loading