Harden entity watcher reconciliation, theme loading, and CI parallel job
waiting, and fix related UI and documentation issues raised in review.
Co-authored-by: Cursor <cursoragent@cursor.com>
Remove the unconditional field-list exclusion claim, drop the incorrect
#996 release reference, document Docker ID fallback for JSON entities,
and add an explicit entity-details-page anchor for cross-references.
Co-authored-by: Cursor <cursoragent@cursor.com>
Document which fields become entity instance names, clarify JSON vs
docker field names, describe live reload behaviour for entity files and
new config entries, and note Docker Desktop file-watch limitations.
Part of #996
Co-authored-by: Cursor <cursoragent@cursor.com>
Each configured resultsDirectory or outputDirectory produces its own
file; configuring only one directory writes only that file type.
Co-authored-by: Cursor <cursoragent@cursor.com>
stepSaveLog only ran at the end of the full executor chain, so runs
blocked by concurrency, rate limits, or ACL checks never wrote results
or output files even though they appeared in the in-memory logs UI.
Persist logs from finishExecChain so every terminal execution is saved
when saveLogs is configured.
Fixes#1099
Co-authored-by: Cursor <cursoragent@cursor.com>
OliveTin's OAuth2 userinfo parsing only accepted a group claim as a
single string, silently dropping the group entirely if the provider
returned a JSON array (e.g. Authelia's `groups` claim). JWT auth
already handled this case; OAuth2 now matches that behavior via a new
getGroupField(), joining multi-value groups with the configurable
authHttpHeaderUserGroupSep (falling back to a space), while skipping
non-string array elements instead of discarding the whole claim.
jwt.go's parseGroupClaim now also respects that separator instead of
a hardcoded space, so the two auth methods stay consistent.
computeUsergroup's addToUsergroup append was fixed to use the same
separator, avoiding mismatched joins when both a multi-group claim and
addToUsergroup are configured together.
Docs updated: oauth2.adoc documents array support and fixes a stale
allowedUserGroups reference (the real key is matchUsergroups);
oauth2_authelia.adoc gains a full worked group-mapping example;
oauth2_authentik.adoc gets a short note that arrays can now be
returned natively instead of via the comma-join workaround.
Fixes#1103
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VXTEpbe7BSZnYDGKibbf9N
PocketID now requires to explicitly include the `openid` scope in the `scopes` list. PocketID will strictly block user information queries with a `403 Forbidden` if this scope is missing.
The after-completion example put {{ output }} and {{ exitCode }} inside
single-quoted shell arguments, so and never expanded
after substituteShellAfterCompletedEnvRefs runs.
Update the apprise sample to use printf-based quoting that allows env
substitution, document the single-quote pitfall, and extend
TestShellAfterCompletedUsesOutputEnvSafely to assert stdout is
substituted as well as injection being blocked.
Route output and exitCode through OUTPUT/EXITCODE environment variables
instead of shell interpolation, and block shellAfterCompleted for webhook
actions.
Co-authored-by: Cursor <cursoragent@cursor.com>
jamesread