Main

.gitattributes

@@ -6,3 +6,8 @@ docs/images/*.gif filter=lfs diff=lfs merge=lfs -text
 
 # Web assets ship in source tarballs (sp-update, release), which never resolve LFS pointers.
 public/** !filter !diff !merge binary
+
+# Hand-authored household UI must retain readable reviews and three-way merges.
+public/household/*.html text diff merge
+public/household/*.js text diff merge
+public/household/*.css text diff merge

.githooks/pre-push

@@ -11,6 +11,12 @@ echo "→ Drizzle schema validation..."
 pnpm drizzle-kit check
 pnpm drizzle-kit check --config=drizzle.biometrics.config.ts
 
+echo "→ Offline migration tests..."
+uv run --project scripts/migration --frozen python -m unittest discover -s scripts/migration -p 'test_*.py'
+python3 -m unittest discover -s scripts/deployment -p 'test_*.py'
+python3 -m unittest discover -s scripts/bedroom -p 'test_*.py'
+node --test scripts/bedroom/homebridge-cache.test.mjs
+
 CHANGED=$(git diff --name-only @{push}.. -- '*.ts' '*.tsx' 2>/dev/null || git diff --name-only origin/dev...HEAD -- '*.ts' '*.tsx' 2>/dev/null || true)
 if [ -n "$CHANGED" ]; then
   echo "→ Tests (changed files)..."

.github/workflows/bedroom-windows.yml

@@ -0,0 +1,28 @@
+name: Bedroom Windows installer
+
+on:
+  pull_request:
+    paths: ['scripts/bedroom/**', '.github/workflows/bedroom-windows.yml']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  installer:
+    runs-on: windows-2025
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+      - name: Validate the Windows PowerShell 5.1 installation
+        shell: powershell
+        run: ./scripts/bedroom/Test-WindowsInstaller.ps1
+      - name: Validate the isolated sensor-reader installation
+        shell: powershell
+        run: ./scripts/bedroom/Test-GoveeInstaller.ps1
+      - name: Test appliance power installation and handoff
+        shell: powershell
+        run: ./scripts/bedroom/Test-GoveeInstaller.ps1 -ReaderProfile AppliancePower

.github/workflows/home-assistant.yml

@@ -0,0 +1,30 @@
+name: Home Assistant Templates
+
+on:
+  pull_request:
+    paths:
+      - 'integrations/home-assistant/**'
+      - 'scripts/home-assistant/**'
+      - '.github/workflows/home-assistant.yml'
+  push:
+    branches: [main, dev]
+    paths:
+      - 'integrations/home-assistant/**'
+      - 'scripts/home-assistant/**'
+      - '.github/workflows/home-assistant.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Home Assistant schemas and actions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+      - name: Validate isolated Home Assistant templates
+        run: uv run --project scripts/home-assistant --frozen python -m unittest discover -s scripts/home-assistant -p 'test_*.py' -v

.github/workflows/openapi.yml

@@ -3,6 +3,13 @@ name: Publish OpenAPI Spec
 on:
   push:
     branches: [main, dev]
+  pull_request:
+    paths:
+      - '.github/workflows/openapi.yml'
+      - 'app/api/openapi.json/**'
+      - 'src/server/openapi.ts'
+      - 'src/auth/**'
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -29,10 +36,18 @@ jobs:
       - name: Build
         run: pnpm build
 
+      # Exercise the same authenticated route as a real client without using
+      # any owner's credentials or weakening production authentication.
+      - name: Create temporary export credential
+        run: |
+          export_token=$(openssl rand -hex 32)
+          echo "::add-mask::$export_token"
+          printf 'SLEEPYPOD_AUTH_TOKEN=%s\n' "$export_token" >> "$GITHUB_ENV"
+
       - name: Start server
         run: |
           mkdir -p /tmp/sleepypod-raw
-          pnpm start > /tmp/server.log 2>&1 &
+          pnpm start --hostname 127.0.0.1 > /tmp/server.log 2>&1 &
           echo "SERVER_PID=$!" >> "$GITHUB_ENV"
         env:
           DATABASE_URL: file:./ci-sleepypod.db
@@ -43,7 +58,8 @@ jobs:
       - name: Wait for server
         run: |
           for i in $(seq 1 90); do
-            if curl -sf http://localhost:3000/api/openapi.json > /dev/null 2>&1; then
+            if curl -sf --max-time 5 -H "Authorization: Bearer $SLEEPYPOD_AUTH_TOKEN" \
+              http://127.0.0.1:3000/api/openapi.json > /dev/null 2>&1; then
               echo "Server ready after ${i}s"
               exit 0
             fi
@@ -55,7 +71,16 @@ jobs:
           exit 1
 
       - name: Download OpenAPI spec
-        run: curl -sf http://localhost:3000/api/openapi.json | jq . > openapi.json
+        run: |
+          curl -sf --max-time 30 -H "Authorization: Bearer $SLEEPYPOD_AUTH_TOKEN" \
+            http://127.0.0.1:3000/api/openapi.json | jq . > openapi.json
+          jq -e '.openapi and .paths and .security' openapi.json > /dev/null
+
+      - name: Verify anonymous access stays blocked
+        run: |
+          status=$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 \
+            http://127.0.0.1:3000/api/openapi.json)
+          test "$status" = 401
 
       - name: Stop server
         if: always()

.github/workflows/python-modules.yml

@@ -121,6 +121,11 @@ jobs:
               uv pip install --python .venv/bin/python ${{ matrix.module.deps }}
             fi
           fi
+          # Probe the production environment before pytest or other test-only deps can mask missing imports.
+          if [ -f uv.lock ]; then
+            python "${{ github.workspace }}/scripts/deployment/probe_modules.py" \
+              --modules-root "${{ github.workspace }}/modules" --module "${{ matrix.module.name }}"
+          fi
           # shellcheck source=/dev/null
           . .venv/bin/activate
           uv pip install pytest pytest-cov

.github/workflows/release.yml

@@ -36,6 +36,18 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # semantic-release pushes tags through the repository's pre-push checks.
+      # Give those checks the same locked Python runtime as the main CI jobs.
+      - name: Setup Python for release validation
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.10'
+
+      - name: Setup uv for release validation
+        uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+
       - name: Build
         run: pnpm build
 
@@ -69,6 +81,12 @@ jobs:
             .
           mv /tmp/sleepypod-core.tar.gz .
 
+      # Create the host-only test environment after packaging, so Linux runner
+      # wheels and interpreter paths never become part of the Pod artifact.
+      - name: Install locked runtime integration dependencies
+        working-directory: modules/piezo-processor
+        run: uv sync --locked --no-install-project
+
       - name: Refresh tags (force, prune)
         # semantic-release runs `git fetch --tags` unconditionally and aborts
         # on any "would clobber existing tag" conflict. Force-prune up front so
@@ -78,4 +96,4 @@ jobs:
       - name: Semantic Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm dlx semantic-release
+        run: pnpm dlx semantic-release

.github/workflows/test.yml

@@ -29,7 +29,9 @@ jobs:
           - { name: "Lint", cmd: "CHANGED=$(git diff --name-only --diff-filter=d origin/${BASE_REF#refs/heads/}...HEAD -- '*.ts' '*.tsx' | head -200); if [ -n \"$CHANGED\" ]; then echo \"$CHANGED\" | xargs -d '\\n' pnpm eslint --; else echo 'No TS/TSX files changed'; fi" }
           - { name: "Typecheck", cmd: "pnpm tsc" }
           - { name: "Unit Tests", cmd: "pnpm test run --coverage --passWithNoTests" }
-          - { name: "Browser Tests", cmd: "NODE_ENV=production CI=1 pnpm build && pnpm test:browser" }
+          # Build workers must not open the same on-disk SQLite file. The browser
+          # runner creates and migrates its own isolated databases after the build.
+          - { name: "Browser Tests", cmd: "NODE_ENV=production CI=1 DATABASE_URL=:memory: BIOMETRICS_DATABASE_URL=:memory: pnpm build && pnpm test:browser" }
 
     steps:
       - name: Checkout
@@ -89,6 +91,22 @@ jobs:
           # A PR carries base.ref; a merge-group run carries refs/heads/<base>.
           BASE_REF: ${{ github.event.pull_request.base.ref || github.event.merge_group.base_ref }}
 
+      - name: Verify offline Free Sleep migration
+        if: matrix.task.name == 'Unit Tests'
+        run: uv run --project scripts/migration --frozen python -m unittest discover -s scripts/migration -p 'test_*.py' -v
+
+      - name: Verify offline deployment packaging
+        if: matrix.task.name == 'Unit Tests'
+        run: |
+          python3 -m unittest discover -s scripts/deployment -p 'test_*.py' -v
+          python3 -m unittest discover -s scripts/bedroom -p 'test_*.py' -v
+          node --test scripts/bedroom/*.test.mjs
+
+      - name: Verify isolated IPv4 and IPv6 failure and recovery
+        if: matrix.task.name == 'Unit Tests'
+        timeout-minutes: 2
+        run: sudo env SLEEPYPOD_NETWORK_NAMESPACE_TEST=1 python3 -m unittest discover -s scripts/deployment -p 'test_network_trial_netns.py' -v
+
       - name: Upload coverage reports to Codecov
         if: github.repository == 'sleepypod/core' && matrix.task.name == 'Unit Tests' && !cancelled()
         uses: codecov/codecov-action@v5

.gitignore

@@ -62,3 +62,6 @@ sleepypod.local.db-wal
 *.db
 .reviews/
 __pycache__/
+
+# Generated isolated personal browser bundle
+/public/household/personal-runtime.js

AGENTS.md

@@ -23,8 +23,9 @@ Next.js App Router runs on the pod and controls its hardware:
 
 - `src/hardware/`: DAC Unix-socket transport to frankenfirmware, status polling,
   gestures, pump-stall protection, and snooze.
-- `src/server/`: tRPC routers and REST endpoints at `/api/*`. The API uses a
-  LAN-only trust model without authentication; see `src/server/openapi.ts`.
+- `src/server/`: tRPC routers and REST endpoints at `/api/*`. Controller APIs
+  require owner authentication through a Bearer connection key or an expiring
+  browser session; see `src/server/openapi.ts`. Use LAN or private Tailscale access.
 - `src/scheduler/`: JobManager for temperature, power, alarms, and system jobs.
 - `src/automation/`: Autopilot rules evaluated in the device timezone.
 - `src/streaming/`: WebSocket sensor stream on port 3001, frame normalization,

app/[lang]/home/page.tsx

@@ -0,0 +1,39 @@
+import Link from 'next/link'
+import { House, MoonStar, Sunrise, Wind } from 'lucide-react'
+import { PageHeader } from '@/src/components/ds'
+import { RoomContext } from '@/src/components/Home/RoomContext'
+import { BedroomSensors } from '@/src/components/Home/BedroomSensors'
+
+export default async function HomePage({ params }: { params: Promise<{ lang: string }> }) {
+  const { lang } = await params
+  return (
+    <>
+      <PageHeader title="Home" />
+      <BedroomSensors />
+      <section className="rounded-card border border-line bg-surface p-4">
+        <House className="mb-5 text-cool" size={36} aria-hidden />
+        <h2 className="text-base font-medium">Connect your room</h2>
+        <p className="mt-3 max-w-xl text-fg-2">Bring your bedroom measurements into sleep insights and reviewable Autopilot rules. Existing Home Assistant entities provide sensor input; house scenes remain separately controlled.</p>
+        <div className="mt-6 flex flex-wrap gap-3">
+          <Link href={`/${lang}/settings?section=mqtt`} className="rounded-ctl border border-line-2 px-4 py-3 text-fg">MQTT connection</Link>
+          <Link href={`/${lang}/settings?section=homekit`} className="rounded-ctl border border-line-2 px-4 py-3 text-fg">Apple Home bridge</Link>
+        </div>
+      </section>
+      <details className="rounded-card border border-line p-4">
+        <summary className="cursor-pointer text-sm text-fg-2">Existing single-source MQTT mappings</summary>
+        <div className="mt-4"><RoomContext /></div>
+      </details>
+      <div className="grid gap-4 sm:grid-cols-3">
+        {[{ icon: MoonStar, title: 'Wind down', text: 'Lighting and shades follow your evening.' }, { icon: Sunrise, title: 'Wake together', text: 'Coordinate your alarm with a Home scene.' }, { icon: Wind, title: 'Room comfort', text: 'Understand humidity, temperature and air quality.' }].map(item => (
+          <section key={item.title} className="rounded-card border border-line bg-surface p-4">
+            <item.icon size={22} className="mb-4 text-warm" aria-hidden />
+            <h2 className="font-medium">{item.title}</h2>
+            <p className="mt-2 text-sm text-fg-2">{item.text}</p>
+            <p className="mt-4 text-xs text-fg-2">Template · inactive</p>
+          </section>
+        ))}
+      </div>
+      <p className="text-sm text-fg-2">Existing Apple Home scenes can be run from the native app after you authorize Home access. Missing room readings never trigger bed adjustments.</p>
+    </>
+  )
+}

app/[lang]/layout.tsx

@@ -3,6 +3,7 @@ import type { Metadata } from 'next'
 import { IBM_Plex_Mono, IBM_Plex_Sans } from 'next/font/google'
 import dynamic from 'next/dynamic'
 import Script from 'next/script'
+import { ConnectionGate } from '@/src/components/AppShell/ConnectionGate'
 import { AppShell } from '@/src/components/AppShell/AppShell'
 import { allMessages, getI18nInstance } from '@/src/lib/i18n/appRouterI18n'
 import { LinguiClientProvider } from '@/src/providers/LinguiClientProvider'
@@ -62,27 +63,29 @@ export default async function LangLayout({
   return (
     <html lang={lang} className={`dark ${plexSans.variable} ${plexMono.variable}`} data-theme="dark" suppressHydrationWarning>
       <head>
-        <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover" />
+        <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
         <meta name="theme-color" content="#0b0b0c" />
         <meta name="color-scheme" content="dark light" />
         <link rel="icon" type="image/png" href="/icon.png" />
         <link rel="apple-touch-icon" href="/apple-touch-icon.png" />
         <Script id="sp-theme-init" strategy="beforeInteractive">{THEME_INIT_SCRIPT}</Script>
       </head>
       <body>
-        <TRPCProvider>
-          <LinguiClientProvider initialLocale={lang} initialMessages={allMessages[lang]}>
-            <PrefsProvider>
-              <TimeFormatProvider>
-                <SideProvider>
-                  <WeekNavigatorProvider>
-                    <AppShell>{children}</AppShell>
-                  </WeekNavigatorProvider>
-                </SideProvider>
-              </TimeFormatProvider>
-            </PrefsProvider>
-          </LinguiClientProvider>
-        </TRPCProvider>
+        <ConnectionGate>
+          <TRPCProvider>
+            <LinguiClientProvider initialLocale={lang} initialMessages={allMessages[lang]}>
+              <PrefsProvider>
+                <TimeFormatProvider>
+                  <SideProvider>
+                    <WeekNavigatorProvider>
+                      <AppShell>{children}</AppShell>
+                    </WeekNavigatorProvider>
+                  </SideProvider>
+                </TimeFormatProvider>
+              </PrefsProvider>
+            </LinguiClientProvider>
+          </TRPCProvider>
+        </ConnectionGate>
         <DemoAnalytics />
       </body>
     </html>

app/[lang]/more/page.tsx

@@ -0,0 +1,7 @@
+import { redirect } from 'next/navigation'
+
+/** Preserve bookmarks from the former five-tab layout. */
+export default async function MorePage({ params }: { params: Promise<{ lang: string }> }) {
+  const { lang } = await params
+  redirect(`/${lang}/settings`)
+}

app/[lang]/page.tsx

@@ -1,11 +1,12 @@
 import type { Metadata } from 'next'
 import { TempScreen } from '@/src/components/TempScreen/TempScreen'
+import { BedroomSummary } from '@/src/components/Home/BedroomSummary'
 import { getI18nInstance } from '@/src/lib/i18n/appRouterI18n'
 import { initLingui } from '@/src/lib/i18n/initLingui'
 import { setI18n } from '@lingui/react/server'
 
 // The layout's title template only applies to child segments, not this page.
-export const metadata: Metadata = { title: { absolute: 'Temp · sleepypod' } }
+export const metadata: Metadata = { title: { absolute: 'Temp · Sleepypod' } }
 
 export default async function Page({
   params,
@@ -17,5 +18,10 @@ export default async function Page({
   initLingui(lang)
   setI18n(i18n)
 
-  return <TempScreen />
+  return (
+    <>
+      <BedroomSummary />
+      <TempScreen />
+    </>
+  )
 }