Add task preset feature with security review docs and UX improvements

.conductor/settings.toml

@@ -0,0 +1,41 @@
+"$schema" = "https://conductor.build/schemas/settings.repo.schema.json"
+
+# PowerNight serves the built React UI from Flask. Preview opens the active
+# workspace's web interface (health: /health).
+[[preview_urls]]
+name = "PowerNight"
+url = "http://localhost:$CONDUCTOR_PORT"
+
+[scripts]
+# Matches CI: editable Python install + locked npm deps, then frontend build.
+# Creates workspace-local data/logs and seeds .env from the example when missing.
+setup = '''pip install -e ".[dev]" && npm ci && mkdir -p data logs && (test -f .env || cp .env.example .env) && ./build.sh --no-docker --skip-validation'''
+
+# Dev servers are workspace-local; SQLite lives under ./data with no Docker services.
+archive = "echo 'PowerNight uses workspace-local SQLite under ./data; no external resources to clean up.'"
+
+# Backend (Flask) and Vite dev server can run side by side in different workspaces.
+run_mode = "concurrent"
+
+# Full app: Flask API + built React assets. POWERNIGHT_WEB_PORT maps to CONDUCTOR_PORT.
+[scripts.run.app]
+command = "POWERNIGHT_WEB_PORT=$CONDUCTOR_PORT python -m powernight.main"
+default = true
+icon = "zap"
+
+# Frontend hot-reload (Vite). API proxy in vite.config.ts targets localhost:8020;
+# run the app script on 8020 in another terminal when exercising live API calls.
+[scripts.run.ui]
+command = "npm run dev -- --port $CONDUCTOR_PORT --strictPort"
+icon = "layout"
+available_in = "local"
+
+# Quick backend verification (same pytest scope as CI).
+[scripts.run.test-backend]
+command = 'pytest -q -m "not slow"'
+icon = "test-tube"
+
+# Frontend unit tests (vitest, one-shot).
+[scripts.run.test-frontend]
+command = "npm run test:run"
+icon = "braces"

.env.example

@@ -0,0 +1,19 @@
+# PowerNight environment configuration
+# Copy to .env and fill in real values; docker-compose reads this file.
+
+# OPTIONAL: API key protecting the web interface and API. Leave unset for a
+# trusted-LAN deployment. Any nonempty key automatically enables authentication.
+# Generate a strong key with: openssl rand -hex 32
+# POWERNIGHT_API_KEY=
+
+# Optional explicit switch. Setting this to true without a key (or complete
+# username/password configuration) makes startup fail closed.
+# POWERNIGHT_AUTH_ENABLED=true
+
+# Tesla account email used for the Powerwall cloud connection
+TESLA_EMAIL=
+
+# Optional overrides
+# POWERNIGHT_LOG_LEVEL=INFO
+# POWERNIGHT_AUTOMATION_ENABLED=true
+# FLASK_SECRET_KEY=

.github/workflows/ci.yml

@@ -0,0 +1,77 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  backend:
+    name: Backend (pytest + ruff)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Ruff (syntax errors and undefined names)
+        run: ruff check src/ tests/ --select E9,F63,F7,F82
+
+      - name: Run tests
+        run: pytest -q -m "not slow" --cov=src/powernight --cov-report=term
+
+  frontend:
+    name: Frontend (lint + type-check + vitest + build)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Unit tests
+        run: npm run test:run
+
+      - name: Build
+        run: npm run build
+
+  mypy:
+    name: Type check backend (informational)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+
+      - name: mypy
+        run: mypy src/

.github/workflows/docker-health-test.yml

@@ -36,19 +36,19 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'npm'
           cache-dependency-path: 'package-lock.json'
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: '3.11'
+          python-version: '3.13'
 
       - name: Install backend dependencies
         run: |
@@ -86,10 +86,10 @@ jobs:
           echo "✓ Frontend build successful"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Build Docker image (amd64 only for speed)
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64

.github/workflows/docker-hub-readme-sync.yml

@@ -15,10 +15,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Update Docker Hub description
-        uses: peter-evans/dockerhub-description@v4
+        uses: peter-evans/dockerhub-description@v5
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/docker-publish.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0  # Full history for version info
 
@@ -43,16 +43,16 @@ jobs:
           echo "Extracted version: $VERSION"
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: '20'
+          node-version: '24'
           cache: 'npm'
           cache-dependency-path: 'package-lock.json'
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: '3.11'
+          python-version: '3.13'
 
       - name: Install backend dependencies
         run: |
@@ -90,27 +90,27 @@ jobs:
           echo "✓ Frontend build successful"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract metadata for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ${{ env.GHCR_IMAGE }}
@@ -126,7 +126,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: ${{ env.PLATFORMS }}
@@ -141,7 +141,7 @@ jobs:
             VCS_REF=${{ github.sha }}
 
       - name: Update Docker Hub description
-        uses: peter-evans/dockerhub-description@v4
+        uses: peter-evans/dockerhub-description@v5
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/docker-security-scan.yml

@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Determine image tag
         id: tag

.gitignore

@@ -420,4 +420,6 @@ __marimo__/
 # Build Metadata
 # =============================================================================
 # Generated version info (created during build)
-version-info.json
+version-info.json
+# Config backups may contain credentials
+.config_backups/