[kh0pper]

Frigate bundle 1.2.0. Fixes three problems seen when using the Frigate panel from a phone.

What changes

• Live pictures in the panel. Each camera card on the Overview shows the camera's latest picture through the gateway's authenticated route (/api/frigate/<camera>/latest.jpg, sent with no-store).

  • It refreshes every 2 s while the page is visible and pauses when hidden.
  • Each new image is swapped in only after it loads, and a camera is skipped while its previous load is still in flight.
  • Exactly one refresh timer and listener exists per page across Turbo visits. They live in a single window state, and turbo:before-cache and turbo:before-visit stop them.

• A working Web UI tab. The tab used to iframe FRIGATE_URL (http://localhost:8971), which a phone resolves to itself, so it was blocked. It now offers a new-tab link to a new optional FRIGATE_UI_URL (for example a Tailscale Serve HTTPS address), showing only its origin as text. Only http(s) is accepted, and the loopback address is never rendered.

• One login at a time. Parallel requests tripped Frigate's 1-per-second login limit, and the client reported that as wrong credentials. Both login paths (server/frigate-api.js and panel/routes.js) now:

  • share one in-flight login;
  • retry a 429 (bounded at 3 retries);
  • hold a failed login for 5 s, so wrong credentials don't hammer Frigate.

  A rate-limit error now has its own message.

• Example config: config.yml.example turns detection on per camera, which Frigate 0.18 needs.

• Docs and registry: the docs (en and es), the registry entry, and a port-allocation row for a tailnet Serve port used for the Frigate UI.

Tests

tests/frigate-panel.test.js covers:

• the escaped and encoded stills;
• the client refresh, visibility, swap-after-load and in-flight behaviour, with a stub-browser check that two visits leave one timer and one listener;
• the Web UI link with and without FRIGATE_UI_URL, including that the loopback address never renders;
• login coalescing (5 concurrent calls make one login);
• a 429 retry, then the rate-limit message;
• the 5 s failure hold;
• the cache headers;
• the manifest version.

Result: 248 pass, 0 fail in the sandboxed runner, together with the bundle contract, server-deps, installed-copy and add-on widget tests. The port check and the public hygiene check pass.

Review

A sonnet review asked for six fixes (the Turbo timer leak, a stale first picture, overlapping loads, damped failed logins, origin-only text, and a trailing newline). All six are in the second commit, and a scoped re-review approved.

Implemented by the Pi coding agent from controller briefs.

https://claude.ai/code/session_01N9fXzvNy8rCEArj1y5p6fp