Support onvif PasswordText cameras in the add camera wizard (#23365)

* try both onvif WS-Security password encodings when probing in the add camera wizard

* update onvif docs

* add tests

.github/copilot-instructions.md

@@ -1,401 +0,0 @@
-# GitHub Copilot Instructions for Frigate NVR
-
-This document provides coding guidelines and best practices for contributing to Frigate NVR, a complete and local NVR designed for Home Assistant with AI object detection.
-
-## Project Overview
-
-Frigate NVR is a realtime object detection system for IP cameras that uses:
-
-- **Backend**: Python 3.13+ with FastAPI, OpenCV, TensorFlow/ONNX
-- **Frontend**: React with TypeScript, Vite, TailwindCSS
-- **Architecture**: Multiprocessing design with ZMQ and MQTT communication
-- **Focus**: Minimal resource usage with maximum performance
-
-## Code Review Guidelines
-
-When reviewing code, do NOT comment on:
-
-- Missing imports - Static analysis tooling catches these
-- Code formatting - Ruff (Python) and Prettier (TypeScript/React) handle formatting
-- Minor style inconsistencies already enforced by linters
-
-## Python Backend Standards
-
-### Python Requirements
-
-- **Compatibility**: Python 3.13+
-- **Language Features**: Use modern Python features:
-  - Pattern matching
-  - Type hints (comprehensive typing preferred)
-  - f-strings (preferred over `%` or `.format()`)
-  - Dataclasses
-  - Async/await patterns
-
-### Code Quality Standards
-
-- **Formatting**: Ruff (configured in `pyproject.toml`)
-- **Linting**: Ruff with rules defined in project config
-- **Type Checking**: Use type hints consistently
-- **Testing**: unittest framework - use `python3 -u -m unittest` to run tests
-- **Language**: American English for all code, comments, and documentation
-
-### Logging Standards
-
-- **Logger Pattern**: Use module-level logger
-
-  ```python
-  import logging
-
-  logger = logging.getLogger(__name__)
-  ```
-
-- **Format Guidelines**:
-  - No periods at end of log messages
-  - No sensitive data (keys, tokens, passwords)
-  - Use lazy logging: `logger.debug("Message with %s", variable)`
-- **Log Levels**:
-  - `debug`: Development and troubleshooting information
-  - `info`: Important runtime events (startup, shutdown, state changes)
-  - `warning`: Recoverable issues that should be addressed
-  - `error`: Errors that affect functionality but don't crash the app
-  - `exception`: Use in except blocks to include traceback
-
-### Error Handling
-
-- **Exception Types**: Choose most specific exception available
-- **Try/Catch Best Practices**:
-  - Only wrap code that can throw exceptions
-  - Keep try blocks minimal - process data after the try/except
-  - Avoid bare exceptions except in background tasks
-
-  Bad pattern:
-
-  ```python
-  try:
-      data = await device.get_data()  # Can throw
-      # ❌ Don't process data inside try block
-      processed = data.get("value", 0) * 100
-      result = processed
-  except DeviceError:
-      logger.error("Failed to get data")
-  ```
-
-  Good pattern:
-
-  ```python
-  try:
-      data = await device.get_data()  # Can throw
-  except DeviceError:
-      logger.error("Failed to get data")
-      return
-
-  # ✅ Process data outside try block
-  processed = data.get("value", 0) * 100
-  result = processed
-  ```
-
-### Async Programming
-
-- **External I/O**: All external I/O operations must be async
-- **Best Practices**:
-  - Avoid sleeping in loops - use `asyncio.sleep()` not `time.sleep()`
-  - Avoid awaiting in loops - use `asyncio.gather()` instead
-  - No blocking calls in async functions
-  - Use `asyncio.create_task()` for background operations
-- **Thread Safety**: Use proper synchronization for shared state
-
-### Documentation Standards
-
-- **Module Docstrings**: Concise descriptions at top of files
-  ```python
-  """Utilities for motion detection and analysis."""
-  ```
-- **Function Docstrings**: Required for public functions and methods
-
-  ```python
-  async def process_frame(frame: ndarray, config: Config) -> Detection:
-      """Process a video frame for object detection.
-
-      Args:
-          frame: The video frame as numpy array
-          config: Detection configuration
-
-      Returns:
-          Detection results with bounding boxes
-      """
-  ```
-
-- **Comment Style**:
-  - Explain the "why" not just the "what"
-  - Keep lines under 88 characters when possible
-  - Use clear, descriptive comments
-
-### File Organization
-
-- **API Endpoints**: `frigate/api/` - FastAPI route handlers
-- **Configuration**: `frigate/config/` - Configuration parsing and validation
-- **Detectors**: `frigate/detectors/` - Object detection backends
-- **Events**: `frigate/events/` - Event management and storage
-- **Utilities**: `frigate/util/` - Shared utility functions
-
-## Frontend (React/TypeScript) Standards
-
-### Internationalization (i18n)
-
-- **CRITICAL**: Never write user-facing strings directly in components
-- **Always use react-i18next**: Import and use the `t()` function
-
-  ```tsx
-  import { useTranslation } from "react-i18next";
-
-  function MyComponent() {
-    const { t } = useTranslation(["views/live"]);
-    return <div>{t("camera_not_found")}</div>;
-  }
-  ```
-
-- **Translation Files**: Add English strings to the appropriate json files in `web/public/locales/en`
-- **Namespaces**: Organize translations by feature/view (e.g., `views/live`, `common`, `views/system`)
-
-### Code Quality
-
-- **Linting**: ESLint (see `web/.eslintrc.cjs`)
-- **Formatting**: Prettier with Tailwind CSS plugin
-- **Type Safety**: TypeScript strict mode enabled
-- **Testing**: Vitest for unit tests
-
-### Component Patterns
-
-- **UI Components**: Use Radix UI primitives (in `web/src/components/ui/`)
-- **Styling**: TailwindCSS with `cn()` utility for class merging
-- **State Management**: React hooks (useState, useEffect, useCallback, useMemo)
-- **Data Fetching**: Custom hooks with proper loading and error states
-
-### ESLint Rules
-
-Key rules enforced:
-
-- `react-hooks/rules-of-hooks`: error
-- `react-hooks/exhaustive-deps`: error
-- `no-console`: error (use proper logging or remove)
-- `@typescript-eslint/no-explicit-any`: warn (always use proper types instead of `any`)
-- Unused variables must be prefixed with `_`
-- Comma dangles required for multiline objects/arrays
-
-### File Organization
-
-- **Pages**: `web/src/pages/` - Route components
-- **Views**: `web/src/views/` - Complex view components
-- **Components**: `web/src/components/` - Reusable components
-- **Hooks**: `web/src/hooks/` - Custom React hooks
-- **API**: `web/src/api/` - API client functions
-- **Types**: `web/src/types/` - TypeScript type definitions
-
-## Testing Requirements
-
-### Backend Testing
-
-- **Framework**: Python unittest
-- **Run Command**: `python3 -u -m unittest`
-- **Location**: `frigate/test/`
-- **Coverage**: Aim for comprehensive test coverage of core functionality
-- **Pattern**: Use `TestCase` classes with descriptive test method names
-  ```python
-  class TestMotionDetection(unittest.TestCase):
-      def test_detects_motion_above_threshold(self):
-          # Test implementation
-  ```
-
-### Test Best Practices
-
-- Always have a way to test your work and confirm your changes
-- Write tests for bug fixes to prevent regressions
-- Test edge cases and error conditions
-- Mock external dependencies (cameras, APIs, hardware)
-- Use fixtures for test data
-
-## Development Commands
-
-### Python Backend
-
-```bash
-# Run all tests
-python3 -u -m unittest
-
-# Run specific test file
-python3 -u -m unittest frigate.test.test_ffmpeg_presets
-
-# Check formatting (Ruff)
-ruff format --check frigate/
-
-# Apply formatting
-ruff format frigate/
-
-# Run linter
-ruff check frigate/
-```
-
-### Frontend (from web/ directory)
-
-```bash
-# Start dev server (AI agents should never run this directly unless asked)
-npm run dev
-
-# Build for production
-npm run build
-
-# Run linter
-npm run lint
-
-# Fix linting issues
-npm run lint:fix
-
-# Format code
-npm run prettier:write
-```
-
-### Docker Development
-
-AI agents should never run these commands directly unless instructed.
-
-```bash
-# Build local image
-make local
-
-# Build debug image
-make debug
-```
-
-## Common Patterns
-
-### API Endpoint Pattern
-
-```python
-from fastapi import APIRouter, Request
-from frigate.api.defs.tags import Tags
-
-router = APIRouter(tags=[Tags.Events])
-
-@router.get("/events")
-async def get_events(request: Request, limit: int = 100):
-    """Retrieve events from the database."""
-    # Implementation
-```
-
-### Configuration Access
-
-```python
-# Access Frigate configuration
-config: FrigateConfig = request.app.frigate_config
-camera_config = config.cameras["front_door"]
-```
-
-### Database Queries
-
-```python
-from frigate.models import Event
-
-# Use Peewee ORM for database access
-events = (
-    Event.select()
-    .where(Event.camera == camera_name)
-    .order_by(Event.start_time.desc())
-    .limit(limit)
-)
-```
-
-## Common Anti-Patterns to Avoid
-
-### ❌ Avoid These
-
-```python
-# Blocking operations in async functions
-data = requests.get(url)  # ❌ Use async HTTP client
-time.sleep(5)  # ❌ Use asyncio.sleep()
-
-# Hardcoded strings in React components
-<div>Camera not found</div>  # ❌ Use t("camera_not_found")
-
-# Missing error handling
-data = await api.get_data()  # ❌ No exception handling
-
-# Bare exceptions in regular code
-try:
-    value = await sensor.read()
-except Exception:  # ❌ Too broad
-    logger.error("Failed")
-
-# Returning exceptions in JSON responses
-except ValueError as e:
-    return JSONResponse(
-        content={"success": False, "message": str(e)},
-    )
-```
-
-### ✅ Use These Instead
-
-```python
-# Async operations
-import aiohttp
-async with aiohttp.ClientSession() as session:
-    async with session.get(url) as response:
-        data = await response.json()
-
-await asyncio.sleep(5)  # ✅ Non-blocking
-
-# Translatable strings in React
-const { t } = useTranslation();
-<div>{t("camera_not_found")}</div>  # ✅ Translatable
-
-# Proper error handling
-try:
-    data = await api.get_data()
-except ApiException as err:
-    logger.error("API error: %s", err)
-    raise
-
-# Specific exceptions
-try:
-    value = await sensor.read()
-except SensorException as err:  # ✅ Specific
-    logger.exception("Failed to read sensor")
-
-# Safe error responses
-except ValueError:
-    logger.exception("Invalid parameters for API request")
-    return JSONResponse(
-        content={
-            "success": False,
-            "message": "Invalid request parameters",
-        },
-    )
-```
-
-## Project-Specific Conventions
-
-### Configuration Files
-
-- Main config: `config/config.yml`
-
-### Directory Structure
-
-- Backend code: `frigate/`
-- Frontend code: `web/`
-- Docker files: `docker/`
-- Documentation: `docs/`
-- Database migrations: `migrations/`
-
-### Code Style Conformance
-
-Always conform new and refactored code to the existing coding style in the project:
-
-- Follow established patterns in similar files
-- Match indentation and formatting of surrounding code
-- Use consistent naming conventions (snake_case for Python, camelCase for TypeScript)
-- Maintain the same level of verbosity in comments and docstrings
-
-## Additional Resources
-
-- Documentation: https://docs.frigate.video
-- Main Repository: https://github.com/blakeblackshear/frigate
-- Home Assistant Integration: https://github.com/blakeblackshear/frigate-hass-integration

.github/copilot-instructions.md

@@ -0,0 +1 @@
+AGENTS.md

AGENTS.md

@@ -0,0 +1,439 @@
+# Agent Instructions for Frigate NVR
+
+This document provides coding guidelines and best practices for contributing to Frigate NVR, a complete and local NVR designed for Home Assistant with AI object detection.
+
+## Project Overview
+
+Frigate NVR is a realtime object detection system for IP cameras that uses:
+
+- **Backend**: Python 3.13+ with FastAPI, OpenCV, TensorFlow/ONNX
+- **Frontend**: React with TypeScript, Vite, TailwindCSS
+- **Architecture**: Multiprocessing design with ZMQ and MQTT communication
+- **Focus**: Minimal resource usage with maximum performance
+
+## Code Review Guidelines
+
+When reviewing code, do NOT comment on:
+
+- Missing imports - Static analysis tooling catches these
+- Code formatting - Ruff (Python) and Prettier (TypeScript/React) handle formatting
+- Minor style inconsistencies already enforced by linters
+
+## Python Backend Standards
+
+### Python Requirements
+
+- **Compatibility**: Python 3.13+
+- **Language Features**: Use modern Python features:
+  - Pattern matching
+  - Type hints (comprehensive typing preferred)
+  - f-strings (preferred over `%` or `.format()`)
+  - Dataclasses
+  - Async/await patterns
+
+### Code Quality Standards
+
+- **Formatting**: Ruff (configured in `pyproject.toml`)
+- **Linting**: Ruff with rules defined in project config
+- **Type Checking**: Use type hints consistently
+- **Testing**: unittest framework - use `python3 -u -m unittest` to run tests
+- **Language**: American English for all code, comments, and documentation
+
+### Logging Standards
+
+- **Logger Pattern**: Use module-level logger
+
+  ```python
+  import logging
+
+  logger = logging.getLogger(__name__)
+  ```
+
+- **Format Guidelines**:
+  - No periods at end of log messages
+  - No sensitive data (keys, tokens, passwords)
+  - Use lazy logging: `logger.debug("Message with %s", variable)`
+- **Log Levels**:
+  - `debug`: Development and troubleshooting information
+  - `info`: Important runtime events (startup, shutdown, state changes)
+  - `warning`: Recoverable issues that should be addressed
+  - `error`: Errors that affect functionality but don't crash the app
+  - `exception`: Use in except blocks to include traceback
+
+### Error Handling
+
+- **Exception Types**: Choose most specific exception available
+- **Try/Catch Best Practices**:
+  - Only wrap code that can throw exceptions
+  - Keep try blocks minimal - process data after the try/except
+  - Avoid bare exceptions except in background tasks
+
+  Bad pattern:
+
+  ```python
+  try:
+      data = await device.get_data()  # Can throw
+      # ❌ Don't process data inside try block
+      processed = data.get("value", 0) * 100
+      result = processed
+  except DeviceError:
+      logger.error("Failed to get data")
+  ```
+
+  Good pattern:
+
+  ```python
+  try:
+      data = await device.get_data()  # Can throw
+  except DeviceError:
+      logger.error("Failed to get data")
+      return
+
+  # ✅ Process data outside try block
+  processed = data.get("value", 0) * 100
+  result = processed
+  ```
+
+### Async Programming
+
+- **External I/O**: All external I/O operations must be async
+- **Best Practices**:
+  - Avoid sleeping in loops - use `asyncio.sleep()` not `time.sleep()`
+  - Avoid awaiting in loops - use `asyncio.gather()` instead
+  - No blocking calls in async functions
+  - Use `asyncio.create_task()` for background operations
+- **Thread Safety**: Use proper synchronization for shared state
+
+### Documentation Standards
+
+- **Module Docstrings**: Concise descriptions at top of files
+  ```python
+  """Utilities for motion detection and analysis."""
+  ```
+- **Function Docstrings**: Required for public functions and methods
+
+  ```python
+  async def process_frame(frame: ndarray, config: Config) -> Detection:
+      """Process a video frame for object detection.
+
+      Args:
+          frame: The video frame as numpy array
+          config: Detection configuration
+
+      Returns:
+          Detection results with bounding boxes
+      """
+  ```
+
+- **Comment Style**:
+  - Explain the "why" not just the "what"
+  - Keep lines under 88 characters when possible
+  - Use clear, descriptive comments
+
+### File Organization
+
+- **API Endpoints**: `frigate/api/` - FastAPI route handlers
+- **Configuration**: `frigate/config/` - Configuration parsing and validation
+- **Detectors**: `frigate/detectors/` - Object detection backends
+- **Events**: `frigate/events/` - Event management and storage
+- **Utilities**: `frigate/util/` - Shared utility functions
+
+## Frontend (React/TypeScript) Standards
+
+### Internationalization (i18n)
+
+- **CRITICAL**: Never write user-facing strings directly in components
+- **Always use react-i18next**: Import and use the `t()` function
+
+  ```tsx
+  import { useTranslation } from "react-i18next";
+
+  function MyComponent() {
+    const { t } = useTranslation(["views/live"]);
+    return <div>{t("camera_not_found")}</div>;
+  }
+  ```
+
+- **Translation Files**: Add English strings to the appropriate json files in `web/public/locales/en`
+- **Namespaces**: Organize translations by feature/view (e.g., `views/live`, `common`, `views/system`)
+
+### Code Quality
+
+- **Linting**: ESLint (see `web/.eslintrc.cjs`)
+- **Formatting**: Prettier with Tailwind CSS plugin
+- **Type Safety**: TypeScript strict mode enabled
+
+### Component Patterns
+
+- **UI Components**: Use Radix UI primitives (in `web/src/components/ui/`)
+- **Styling**: TailwindCSS with `cn()` utility for class merging
+- **State Management**: React hooks (useState, useEffect, useCallback, useMemo)
+- **Data Fetching**: Custom hooks with proper loading and error states
+
+### ESLint Rules
+
+Key rules enforced:
+
+- `react-hooks/rules-of-hooks`: error
+- `react-hooks/exhaustive-deps`: error
+- `no-console`: error (use proper logging or remove)
+- `@typescript-eslint/no-explicit-any`: warn (always use proper types instead of `any`)
+- Unused variables must be prefixed with `_`
+- Comma dangles required for multiline objects/arrays
+
+### File Organization
+
+- **Pages**: `web/src/pages/` - Route components
+- **Views**: `web/src/views/` - Complex view components
+- **Components**: `web/src/components/` - Reusable components
+- **Hooks**: `web/src/hooks/` - Custom React hooks
+- **API**: `web/src/api/` - API client functions
+- **Types**: `web/src/types/` - TypeScript type definitions
+
+## Testing Requirements
+
+### Backend Testing
+
+- **Framework**: Python unittest
+- **Run Command**: `python3 -u -m unittest`
+- **Location**: `frigate/test/`
+- **Coverage**: Aim for comprehensive test coverage of core functionality
+- **Pattern**: Use `TestCase` classes with descriptive test method names
+  ```python
+  class TestMotionDetection(unittest.TestCase):
+      def test_detects_motion_above_threshold(self):
+          # Test implementation
+  ```
+
+### Test Best Practices
+
+- Always have a way to test your work and confirm your changes
+- Write tests for bug fixes to prevent regressions
+- Test edge cases and error conditions
+- Mock external dependencies (cameras, APIs, hardware)
+- Use fixtures for test data
+
+## Development Commands
+
+### Python Backend
+
+```bash
+# Run all tests
+python3 -u -m unittest
+
+# Run specific test file
+python3 -u -m unittest frigate.test.test_ffmpeg_presets
+
+# Check formatting (Ruff)
+ruff format --check frigate/
+
+# Apply formatting
+ruff format frigate/
+
+# Run linter
+ruff check frigate/
+
+# Type check
+python3 -u -m mypy --config-file frigate/mypy.ini frigate
+```
+
+### Frontend (from web/ directory)
+
+```bash
+# Start dev server (AI agents should never run this directly unless asked)
+npm run dev
+
+# Build for production
+npm run build
+
+# Run linter
+npm run lint
+
+# Fix linting issues
+npm run lint:fix
+
+# Format code
+npm run prettier:write
+
+# E2E: first-time setup
+npm install
+npx playwright install chromium
+
+# E2E: build the app and run all tests
+npm run e2e:build && npm run e2e
+
+# E2E: interactive UI for debugging
+npm run e2e:ui
+
+# E2E: run a specific spec
+npx playwright test --config e2e/playwright.config.ts e2e/specs/live.spec.ts
+
+# E2E: filter by name, or run only desktop/mobile
+npx playwright test --config e2e/playwright.config.ts --grep="severity tab"
+npx playwright test --config e2e/playwright.config.ts --project=desktop
+
+# E2E: regenerate mock data after backend model changes (from repo root)
+PYTHONPATH=. python3 web/e2e/fixtures/mock-data/generate-mock-data.py
+
+# Regenerate config translations from Pydantic models — outputs to
+# web/public/locales/en/config/{global,cameras}.json. NEVER edit those
+# JSON files by hand; change the Pydantic field title/description and
+# re-run this script. (from repo root)
+python3 generate_config_translations.py
+
+# Extract i18n keys from source into the locale files after adding
+# new t() calls. Use the :ci variant to verify the locale files are
+# in sync with source (fails if extraction would change anything).
+npm run i18n:extract
+npm run i18n:extract:ci
+```
+
+### Docker Development
+
+AI agents should never run these commands directly unless instructed.
+
+```bash
+# Build local image
+make local
+
+# Build debug image
+make debug
+```
+
+## Common Patterns
+
+### API Endpoint Pattern
+
+```python
+from fastapi import APIRouter, Request
+from frigate.api.defs.tags import Tags
+
+router = APIRouter(tags=[Tags.Events])
+
+@router.get("/events")
+async def get_events(request: Request, limit: int = 100):
+    """Retrieve events from the database."""
+    # Implementation
+```
+
+### Configuration Access
+
+```python
+# Access Frigate configuration
+config: FrigateConfig = request.app.frigate_config
+camera_config = config.cameras["front_door"]
+```
+
+### Database Queries
+
+```python
+from frigate.models import Event
+
+# Use Peewee ORM for database access
+events = (
+    Event.select()
+    .where(Event.camera == camera_name)
+    .order_by(Event.start_time.desc())
+    .limit(limit)
+)
+```
+
+## Common Anti-Patterns to Avoid
+
+### ❌ Avoid These
+
+```python
+# Blocking operations in async functions
+data = requests.get(url)  # ❌ Use async HTTP client
+time.sleep(5)  # ❌ Use asyncio.sleep()
+
+# Hardcoded strings in React components
+<div>Camera not found</div>  # ❌ Use t("camera_not_found")
+
+# Missing error handling
+data = await api.get_data()  # ❌ No exception handling
+
+# Bare exceptions in regular code
+try:
+    value = await sensor.read()
+except Exception:  # ❌ Too broad
+    logger.error("Failed")
+
+# Returning exceptions in JSON responses
+except ValueError as e:
+    return JSONResponse(
+        content={"success": False, "message": str(e)},
+    )
+```
+
+### ✅ Use These Instead
+
+```python
+# Async operations
+import aiohttp
+async with aiohttp.ClientSession() as session:
+    async with session.get(url) as response:
+        data = await response.json()
+
+await asyncio.sleep(5)  # ✅ Non-blocking
+
+# Translatable strings in React
+const { t } = useTranslation();
+<div>{t("camera_not_found")}</div>  # ✅ Translatable
+
+# Proper error handling
+try:
+    data = await api.get_data()
+except ApiException as err:
+    logger.error("API error: %s", err)
+    raise
+
+# Specific exceptions
+try:
+    value = await sensor.read()
+except SensorException as err:  # ✅ Specific
+    logger.exception("Failed to read sensor")
+
+# Safe error responses
+except ValueError:
+    logger.exception("Invalid parameters for API request")
+    return JSONResponse(
+        content={
+            "success": False,
+            "message": "Invalid request parameters",
+        },
+    )
+```
+
+## WebSocket Broadcasts
+
+Outbound WebSocket broadcasts go through a per-recipient classifier in `frigate/comms/ws.py` that enforces camera-level access. **The classifier is fail-closed: any topic it doesn't recognize is dropped for every client.** New outbound topics must be classified there or they'll silently disappear.
+
+## Project-Specific Conventions
+
+### Configuration Files
+
+- Main config: `config/config.yml`
+
+### Directory Structure
+
+- Backend code: `frigate/`
+- Frontend code: `web/`
+- Docker files: `docker/`
+- Documentation: `docs/`
+- Database migrations: `migrations/`
+
+### Code Style Conformance
+
+Always conform new and refactored code to the existing coding style in the project:
+
+- Follow established patterns in similar files
+- Match indentation and formatting of surrounding code
+- Use consistent naming conventions (snake_case for Python, camelCase for TypeScript)
+- Maintain the same level of verbosity in comments and docstrings
+
+## Additional Resources
+
+- Documentation: https://docs.frigate.video
+- Main Repository: https://github.com/blakeblackshear/frigate
+- Home Assistant Integration: https://github.com/blakeblackshear/frigate-hass-integration

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

docker/main/rootfs/usr/local/go2rtc/create_config.py

@@ -3,7 +3,6 @@
 import json
 import os
 import sys
-from pathlib import Path
 from typing import Any
 
 from ruamel.yaml import YAML
@@ -18,37 +17,12 @@ from frigate.const import (
 )
 from frigate.ffmpeg_presets import parse_preset_hardware_acceleration_encode
 from frigate.util.config import find_config_file
+from frigate.util.services import is_restricted_go2rtc_source
 
 sys.path.remove("/opt/frigate")
 
 yaml = YAML()
 
-# Check if arbitrary exec sources are allowed (defaults to False for security)
-allow_arbitrary_exec = None
-if "GO2RTC_ALLOW_ARBITRARY_EXEC" in os.environ:
-    allow_arbitrary_exec = os.environ.get("GO2RTC_ALLOW_ARBITRARY_EXEC")
-elif (
-    os.path.isdir("/run/secrets")
-    and os.access("/run/secrets", os.R_OK)
-    and "GO2RTC_ALLOW_ARBITRARY_EXEC" in os.listdir("/run/secrets")
-):
-    allow_arbitrary_exec = (
-        Path(os.path.join("/run/secrets", "GO2RTC_ALLOW_ARBITRARY_EXEC"))
-        .read_text()
-        .strip()
-    )
-# check for the add-on options file
-elif os.path.isfile("/data/options.json"):
-    with open("/data/options.json") as f:
-        raw_options = f.read()
-    options = json.loads(raw_options)
-    allow_arbitrary_exec = options.get("go2rtc_allow_arbitrary_exec")
-
-ALLOW_ARBITRARY_EXEC = allow_arbitrary_exec is not None and str(
-    allow_arbitrary_exec
-).lower() in ("true", "1", "yes")
-
-
 config_file = find_config_file()
 
 try:
@@ -128,18 +102,13 @@ if LIBAVFORMAT_VERSION_MAJOR < 59:
         go2rtc_config["ffmpeg"]["rtsp"] = rtsp_args
 
 
-def is_restricted_source(stream_source: str) -> bool:
-    """Check if a stream source is restricted (echo, expr, or exec)."""
-    return stream_source.strip().startswith(("echo:", "expr:", "exec:"))
-
-
 for name in list(go2rtc_config.get("streams", {})):
     stream = go2rtc_config["streams"][name]
 
     if isinstance(stream, str):
         try:
             formatted_stream = substitute_frigate_vars(stream)
-            if not ALLOW_ARBITRARY_EXEC and is_restricted_source(formatted_stream):
+            if is_restricted_go2rtc_source(formatted_stream):
                 print(
                     f"[ERROR] Stream '{name}' uses a restricted source (echo/expr/exec) which is disabled by default for security. "
                     f"Set GO2RTC_ALLOW_ARBITRARY_EXEC=true to enable arbitrary exec sources."
@@ -158,7 +127,7 @@ for name in list(go2rtc_config.get("streams", {})):
         for i, stream_item in enumerate(stream):
             try:
                 formatted_stream = substitute_frigate_vars(stream_item)
-                if not ALLOW_ARBITRARY_EXEC and is_restricted_source(formatted_stream):
+                if is_restricted_go2rtc_source(formatted_stream):
                     print(
                         f"[ERROR] Stream '{name}' item {i + 1} uses a restricted source (echo/expr/exec) which is disabled by default for security. "
                         f"Set GO2RTC_ALLOW_ARBITRARY_EXEC=true to enable arbitrary exec sources."

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -252,6 +252,7 @@ http {
             include proxy.conf;
 
             proxy_cache api_cache;
+            proxy_cache_key "$scheme$proxy_host$request_uri|$role|$groups|$user";
             proxy_cache_lock on;
             proxy_cache_use_stale updating;
             proxy_cache_valid 200 5s;

docs/docs/configuration/advanced.md

@@ -172,7 +172,7 @@ Custom models may also require different input tensor formats. The colorspace co
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detection model" /> to configure the model path, dimensions, and input format.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and open the **Custom Model** tab to configure the model path, dimensions, and input format.
 
 | Field                                         | Description                          |
 | --------------------------------------------- | ------------------------------------ |

docs/docs/configuration/cameras.md

@@ -67,7 +67,7 @@ Additional cameras are simply added under the camera configuration section.
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > Camera configuration > Management" /> and use the add camera button to configure each additional camera.
+Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and use the add camera button to configure each additional camera.
 
 </TabItem>
 <TabItem value="yaml">
@@ -143,6 +143,11 @@ If your ONVIF camera does not require authentication credentials, you may still
 
 :::
 
+If a camera connects but fails to authenticate, two optional fields can help:
+
+- `tls_insecure`: Skips TLS certificate verification and sends the ONVIF password as plaintext (`PasswordText`) instead of a hashed digest (`PasswordDigest`). Some cameras reject the digest token and only accept plaintext. This weakens connection security, so only enable it on a trusted local network.
+- `ignore_time_mismatch`: ONVIF authentication tokens include a timestamp, and a camera will reject the token if its clock differs too much from Frigate's. Enabling this makes Frigate compensate for the time offset so authentication can still succeed. Running NTP on both the camera and the Frigate host is the recommended fix; only use this in a "safe" environment, as it slightly weakens token validation.
+
 If your camera has multiple ONVIF profiles, you can specify which one to use for PTZ control with the `profile` option, matched by token or name. When not set, Frigate selects the first profile with a valid PTZ configuration. Check the Frigate debug logs (`frigate.ptz.onvif: debug`) to see available profile names and tokens for your camera.
 
 An ONVIF-capable camera that supports relative movement within the field of view (FOV) can also be configured to automatically track moving objects and keep them in the center of the frame. For autotracking setup, see the [autotracking](autotracking.md) docs.

docs/docs/configuration/custom_classification/object_classification.md

@@ -149,9 +149,16 @@ For more detail, see [Frigate Tip: Best Practices for Training Face and Custom C
 - **The wizard is just the starting point**: You don't need to find and label every class upfront. Missing classes will naturally appear in Recent Classifications, and those images tend to be more valuable because they represent new conditions and edge cases.
 - **Problem framing**: Keep classes visually distinct and relevant to the chosen object types.
 - **Preprocessing**: Ensure examples reflect object crops similar to Frigate's boxes; keep the subject centered.
-- **Labels**: Keep label names short and consistent; include a `none` class if you plan to ignore uncertain predictions for sub labels.
+- **Crop size**: Aim for crops of at least 100×100 pixels (a 10,000 pixel area). Crops smaller than ~80×80 get stretched 3-7× by the model's 224×224 input resize and tend to collapse into a generic "blob" region of feature space where identity becomes unreliable. If most of your detections are small because the camera is far from the subject, consider repositioning the camera for closer crops.
+- **Class balance**: Aim to keep your largest class within ~3× the count of your smallest. Beyond that, the model becomes biased toward the dominant class and tends to default borderline predictions to it (the "everything looks like Buddy" failure mode).
 - **Threshold**: Tune `threshold` per model to reduce false assignments. Start at `0.8` and adjust based on validation.
 
+:::tip `none` works differently from named classes
+
+Named classes work best with visually uniform examples — every Buddy photo should look like Buddy. The `none` class needs the opposite: visual diversity across sizes, framings, and qualities, because at inference it has to absorb everything that isn't one of your named classes. Don't apply the same "only keep large, well-framed images" rule to `none` that you would to a named class. Mix in small crops, partial views, and false positives deliberately - otherwise the model has no signal for "small/ambiguous thing = not one of my known classes" and will force those crops into a named class by default.
+
+:::
+
 ## Debugging Classification Models
 
 To troubleshoot issues with object classification models, enable debug logging to see detailed information about classification attempts, scores, and consensus calculations.

docs/docs/configuration/genai/config.md

@@ -49,15 +49,14 @@ You should have at least 8 GB of RAM available (or VRAM if running on GPU) to ru
 
 ### Model Types: Instruct vs Thinking
 
-Most vision-language models are available as **instruct** models, which are fine-tuned to follow instructions and respond concisely to prompts. However, some models (such as certain Qwen-VL or minigpt variants) offer both **instruct** and **thinking** versions.
+Vision-language models come in **instruct** variants (fine-tuned to follow instructions and respond concisely), **thinking** variants (fine-tuned for free-form, speculative reasoning), and **hybrid** variants that support both modes per request. Most modern vision-language models are hybrid.
 
-- **Instruct models** are always recommended for use with Frigate. These models generate direct, relevant, actionable descriptions that best fit Frigate's object and event summary use case.
-- **Reasoning / Thinking models** are fine-tuned for more free-form, open-ended, and speculative outputs, which are typically not concise and may not provide the practical summaries Frigate expects. For this reason, Frigate does **not** recommend or support using thinking models.
+Frigate manages reasoning per task automatically:
 
-Some models are labeled as **hybrid** (capable of both thinking and instruct tasks). In these cases, it is recommended to disable reasoning / thinking, which is generally model specific (see your models documentation).
+- **Description tasks** (object descriptions, review descriptions, review summaries) are synthesis-only and benefit from concise, direct output, so Frigate disables thinking for these calls when the model exposes a per-request toggle.
+- **Chat** lets you toggle thinking on or off from the composer when the configured model supports it.
 
-**Recommendation:**
-Always select the `-instruct` or documented instruct/tagged variant of any model you use in your Frigate configuration. If in doubt, refer to your model provider's documentation or model library for guidance on the correct model variant to use.
+You can use a pure instruct, hybrid, or thinking-capable model with Frigate — no extra configuration is required to disable thinking for descriptions.
 
 ### llama.cpp
 

docs/docs/configuration/index.md

@@ -110,10 +110,10 @@ Here are some common starter configuration examples. These can be configured thr
 
 1. Navigate to <NavPath path="Settings > System > MQTT" /> and configure the MQTT connection to your Home Assistant Mosquitto broker
 2. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to `Raspberry Pi (H.264)`
-3. Navigate to <NavPath path="Settings > System > Detector hardware" /> and add a detector with **Type** `EdgeTPU` and **Device** `usb`
+3. Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `EdgeTPU` and **Device** `usb`
 4. Navigate to <NavPath path="Settings > Global configuration > Recording" /> and set **Enable recording** to on, **Motion retention > Retention days** to `7`, **Alert retention > Event retention > Retention days** to `30`, **Alert retention > Event retention > Retention mode** to `motion`, **Detection retention > Event retention > Retention days** to `30`, **Detection retention > Event retention > Retention mode** to `motion`
 5. Navigate to <NavPath path="Settings > Global configuration > Snapshots" /> and set **Enable snapshots** to on, **Snapshot retention > Default retention** to `30`
-6. Navigate to <NavPath path="Settings > Camera configuration > Management" /> and add your camera with the appropriate RTSP stream URL
+6. Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and add your camera with the appropriate RTSP stream URL
 7. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> to add a motion mask for the camera timestamp
 
 </TabItem>
@@ -189,10 +189,10 @@ cameras:
 
 1. Navigate to <NavPath path="Settings > System > MQTT" /> and set **Enable MQTT** to off
 2. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to `VAAPI (Intel/AMD GPU)`
-3. Navigate to <NavPath path="Settings > System > Detector hardware" /> and add a detector with **Type** `EdgeTPU` and **Device** `usb`
+3. Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `EdgeTPU` and **Device** `usb`
 4. Navigate to <NavPath path="Settings > Global configuration > Recording" /> and set **Enable recording** to on, **Motion retention > Retention days** to `7`, **Alert retention > Event retention > Retention days** to `30`, **Alert retention > Event retention > Retention mode** to `motion`, **Detection retention > Event retention > Retention days** to `30`, **Detection retention > Event retention > Retention mode** to `motion`
 5. Navigate to <NavPath path="Settings > Global configuration > Snapshots" /> and set **Enable snapshots** to on, **Snapshot retention > Default retention** to `30`
-6. Navigate to <NavPath path="Settings > Camera configuration > Management" /> and add your camera with the appropriate RTSP stream URL
+6. Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and add your camera with the appropriate RTSP stream URL
 7. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> to add a motion mask for the camera timestamp
 
 </TabItem>
@@ -266,11 +266,11 @@ cameras:
 
 1. Navigate to <NavPath path="Settings > System > MQTT" /> and configure the connection to your MQTT broker
 2. Navigate to <NavPath path="Settings > Global configuration > FFmpeg" /> and set **Hardware acceleration arguments** to `VAAPI (Intel/AMD GPU)`
-3. Navigate to <NavPath path="Settings > System > Detector hardware" /> and add a detector with **Type** `openvino` and **Device** `AUTO`
-4. Navigate to <NavPath path="Settings > System > Detection model" /> and configure the OpenVINO model path and settings
+3. Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `openvino` and **Device** `AUTO`
+4. On the same page, in the **Custom Model** tab, configure the OpenVINO model path and settings
 5. Navigate to <NavPath path="Settings > Global configuration > Recording" /> and set **Enable recording** to on, **Motion retention > Retention days** to `7`, **Alert retention > Event retention > Retention days** to `30`, **Alert retention > Event retention > Retention mode** to `motion`, **Detection retention > Event retention > Retention days** to `30`, **Detection retention > Event retention > Retention mode** to `motion`
 6. Navigate to <NavPath path="Settings > Global configuration > Snapshots" /> and set **Enable snapshots** to on, **Snapshot retention > Default retention** to `30`
-7. Navigate to <NavPath path="Settings > Camera configuration > Management" /> and add your camera with the appropriate RTSP stream URL
+7. Navigate to <NavPath path="Settings > Global configuration > Camera management" /> and add your camera with the appropriate RTSP stream URL
 8. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> to add a motion mask for the camera timestamp
 
 </TabItem>

docs/docs/configuration/live.md

@@ -88,8 +88,18 @@ Configure a "friendly name" for your stream followed by the go2rtc stream name.
 <ConfigTabs>
 <TabItem value="ui">
 
-1. Navigate to <NavPath path="Settings > Camera configuration > Live playback" />, then select your camera.
-   - Under **Live stream names**, add entries mapping a friendly name to each go2rtc stream name (e.g., `Main Stream` mapped to `test_cam`, `Sub Stream` mapped to `test_cam_sub`).
+1. Navigate to <NavPath path="Settings > Camera configuration > Live playback" /> and select your camera.
+2. Under **Live stream names**, click **Add stream** to add a new entry.
+3. In the **Stream name** field, enter a friendly name that will appear in the Live UI's stream dropdown (e.g., `Main Stream`).
+4. In the **go2rtc stream** field, open the dropdown and select the go2rtc stream this name should map to (e.g., `test_cam`). The dropdown lists every stream configured under `go2rtc.streams`. If the go2rtc stream hasn't been created yet, you can type the name and choose **Use "..."** to save a custom value.
+5. Repeat for each additional stream you want to expose (e.g., `Sub Stream` → `test_cam_sub`).
+6. Use the trash icon on a row to remove a stream, then **Save** the section.
+
+:::tip
+
+Configure your go2rtc streams first under <NavPath path="Settings > System > go2rtc streams" /> so the dropdown is populated with valid options.
+
+:::
 
 </TabItem>
 <TabItem value="yaml">
@@ -257,19 +267,47 @@ cameras:
 </TabItem>
 </ConfigTabs>
 
-### Disabling cameras
+### Camera state
 
-Cameras can be temporarily disabled through the Frigate UI and through [MQTT](/integrations/mqtt#frigatecamera_nameenabledset) to conserve system resources. When disabled, Frigate's ffmpeg processes are terminated — recording stops, object detection is paused, and the Live dashboard displays a blank image with a disabled message. Review items, tracked objects, and historical footage for disabled cameras can still be accessed via the UI.
+Each camera has three possible states, surfaced as a status selector in **Settings → Global configuration → Camera management**:
 
-:::note
+- **On** — streams are processed normally. Object detection, recording, and Live view are active.
+- **Off** — Frigate's ffmpeg processes are paused. Recording stops, object detection is paused, and the Live dashboard displays a blank image with a "Camera is off" message. The camera is still visible in the Live dashboard and its past review items, tracked objects, and historical footage remain accessible via the UI. The Off state persists across Frigate restarts via a `.runtime_state.json` file alongside `config.yml` (see [Runtime toggle persistence](#runtime-toggle-persistence)).
+- **Disabled** — the change is saved to your configuration file (`enabled: False`). The camera stops immediately, Frigate stops ffmpeg processes, and all live and historical UI elements for the camera are no longer visible but remains retained on disk. The camera is still listed in **Settings → Global configuration → Camera management** so it can be re-enabled. **A restart of Frigate is required to bring a disabled camera back to On.**
 
-Disabling a camera via the Frigate UI or MQTT is temporary and does not persist through restarts of Frigate.
+#### Turning a camera on or off
 
-:::
+Turning a camera off is temporary and does not require a restart. The available controls are:
 
-For restreamed cameras, go2rtc remains active but does not use system resources for decoding or processing unless there are active external consumers (such as the Advanced Camera Card in Home Assistant using a go2rtc source).
+- The power button in the single-camera Live view header
+- The right-click context menu on a camera tile on the Live dashboard
+- The Camera management settings pane (status set to **Off**)
+- The mobile settings drawer on the single-camera Live view (admin users only)
+- The [MQTT topic](/integrations/mqtt#frigatecamera_nameenabledset) `frigate/<camera_name>/enabled/set` with payload `ON` or `OFF`
+- The Home Assistant integration via the [`camera.turn_on` / `camera.turn_off` actions](/integrations/home-assistant#camera-api)
 
-Note that disabling a camera through the config file (`enabled: False`) removes all related UI elements, including historical footage access. To retain access while disabling the camera, keep it enabled in the config and use the UI or MQTT to disable it temporarily.
+#### Disabling a camera
+
+Disabling a camera saves the change to your configuration file. Navigate to **Settings → Global configuration → Camera management** and set the camera's status to **Disabled**. Runtime processing stops immediately; the change persists across restarts.
+
+Re-enabling a disabled camera requires a restart of Frigate so that the ffmpeg processes and other camera-scoped resources can be initialized. The UI will prompt you to restart when you switch a disabled camera back to On.
+
+#### Restream behavior
+
+For both Off and Disabled cameras, go2rtc remains active but does not use system resources for decoding or processing unless there are active external consumers (such as the Advanced Camera Card in Home Assistant using a go2rtc source).
+
+#### Choosing Off versus Disabled
+
+If you want a camera's historical data (review items, tracked objects, footage) to stay accessible in the UI while you stop processing, set the camera to **Off**. If you want the camera fully removed from the Live dashboard, review filters, and other UI surfaces, set it to **Disabled**. The Disabled state still keeps the camera in Camera management so it can be re-enabled later; if you want to remove all traces of a camera including its configuration, delete it via Camera management instead.
+
+#### Runtime toggle persistence
+
+The Live view toggles for **camera on/off**, **detect**, **recordings**, **snapshots**, and **audio detection** — along with the equivalent MQTT `/set` topics — write the new state to `.runtime_state.json` next to your `config.yml`. The file is replayed on Frigate startup so your last-known toggle states survive a restart. Two interactions worth knowing:
+
+- **Settings UI saves win.** When you save a field through **Settings → Global configuration**, the matching entry is cleared from `.runtime_state.json` so the new value in your config file is the durable source.
+- **Switching profiles clears all runtime overrides.** Activating or deactivating a [profile](/configuration/profiles) is treated as a deliberate state change, so the file is wiped to avoid stale overrides replaying on top of the new profile.
+
+If you hand-edit `config.yml` while runtime overrides exist, the overrides will still replay on restart. Delete `.runtime_state.json` to reset to the YAML-defined defaults.
 
 ### Live player error messages
 

docs/docs/configuration/motion_detection.md

@@ -197,3 +197,7 @@ This option is handy when you want to prevent large transient changes from trigg
 When the skip threshold is exceeded, **no motion is reported** for that frame, meaning **nothing is recorded** for that frame. That means you can miss something important, like a PTZ camera auto-tracking an object or activity while the camera is moving. If you prefer to guarantee that every frame is saved, leave this unset and accept occasional recordings containing scene noise — they typically only take up a few megabytes and are quick to scan in the timeline UI.
 
 :::
+
+## Reviewing Detected Motion
+
+To review what the detector picked up — or to search past recordings for motion in a specific region — see [Reviewing Motion](review.md#reviewing-motion) on the Review page.

docs/docs/configuration/object_detectors.md

@@ -72,7 +72,7 @@ This does not affect using hardware for accelerating other tasks such as [semant
 
 # Officially Supported Detectors
 
-Frigate provides a number of builtin detector types. By default, Frigate will use a single OpenVINO detector running on the CPU. Other detectors may require additional configuration as described below. When using multiple detectors they will run in dedicated processes, but pull from a common queue of detection requests from across all cameras.
+Frigate provides a number of builtin detector types. By default, Frigate will use a single CPU detector. Other detectors may require additional configuration as described below. When using multiple detectors they will run in dedicated processes, but pull from a common queue of detection requests from across all cameras.
 
 ## Edge TPU Detector
 
@@ -91,7 +91,7 @@ See [common Edge TPU troubleshooting steps](/troubleshooting/edgetpu) if the Edg
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then set device to `usb`.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then set device to `usb`.
 
 </TabItem>
 <TabItem value="yaml">
@@ -111,7 +111,7 @@ detectors:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **EdgeTPU** from the detector type dropdown and click **Add** to add multiple detectors, specifying `usb:0` and `usb:1` as the device for each.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add** to add multiple detectors, specifying `usb:0` and `usb:1` as the device for each.
 
 </TabItem>
 <TabItem value="yaml">
@@ -136,7 +136,7 @@ _warning: may have [compatibility issues](https://github.com/blakeblackshear/fri
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then leave the device field empty.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then leave the device field empty.
 
 </TabItem>
 <TabItem value="yaml">
@@ -156,7 +156,7 @@ detectors:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then set device to `pci`.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then set device to `pci`.
 
 </TabItem>
 <TabItem value="yaml">
@@ -176,7 +176,7 @@ detectors:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **EdgeTPU** from the detector type dropdown and click **Add** to add multiple detectors, specifying `pci:0` and `pci:1` as the device for each.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add** to add multiple detectors, specifying `pci:0` and `pci:1` as the device for each.
 
 </TabItem>
 <TabItem value="yaml">
@@ -199,7 +199,7 @@ detectors:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **EdgeTPU** from the detector type dropdown and click **Add** to add multiple detectors with different device types (e.g., `usb` and `pci`).
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add** to add multiple detectors with different device types (e.g., `usb` and `pci`).
 
 </TabItem>
 <TabItem value="yaml">
@@ -246,7 +246,7 @@ After placing the downloaded files for the tflite model and labels in your confi
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then set device to `usb`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure the model settings:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **EdgeTPU** from the detector type dropdown and click **Add**, then set device to `usb`. Then on the same page, in the **Custom Model** tab, configure the model settings:
 
 | Field                                    | Value                                                             |
 | ---------------------------------------- | ----------------------------------------------------------------- |
@@ -309,7 +309,7 @@ Use this configuration for YOLO-based models. When no custom model path or URL i
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **Hailo-8/Hailo-8L** from the detector type dropdown and click **Add**, then set device to `PCIe`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure the model settings:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **Hailo-8/Hailo-8L** from the detector type dropdown and click **Add**, then set device to `PCIe`. Then on the same page, in the **Custom Model** tab, configure the model settings:
 
 | Field                                    | Value                   |
 | ---------------------------------------- | ----------------------- |
@@ -365,7 +365,7 @@ For SSD-based models, provide either a model path or URL to your compiled SSD mo
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **Hailo-8/Hailo-8L** from the detector type dropdown and click **Add**, then set device to `PCIe`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure the model settings:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **Hailo-8/Hailo-8L** from the detector type dropdown and click **Add**, then set device to `PCIe`. Then on the same page, in the **Custom Model** tab, configure the model settings:
 
 | Field                                   | Value  |
 | --------------------------------------- | ------ |
@@ -410,7 +410,7 @@ The Hailo detector supports all YOLO models compiled for Hailo hardware that inc
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **Hailo-8/Hailo-8L** from the detector type dropdown and click **Add**, then set device to `PCIe`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure the model settings to match your custom model dimensions and format.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **Hailo-8/Hailo-8L** from the detector type dropdown and click **Add**, then set device to `PCIe`. Then on the same page, in the **Custom Model** tab, configure the model settings to match your custom model dimensions and format.
 
 </TabItem>
 <TabItem value="yaml">
@@ -465,7 +465,7 @@ When using many cameras one detector may not be enough to keep up. Multiple dete
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **OpenVINO** from the detector type dropdown and click **Add** to add multiple detectors, each targeting `GPU` or `NPU`.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **OpenVINO** from the detector type dropdown and click **Add** to add multiple detectors, each targeting `GPU` or `NPU`.
 
 </TabItem>
 <TabItem value="yaml">
@@ -508,7 +508,7 @@ Use the model configuration shown below when using the OpenVINO detector with th
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `GPU` (or `NPU`). Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `GPU` (or `NPU`). Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                      |
 | ---------------------------------------- | ------------------------------------------ |
@@ -558,7 +558,7 @@ After placing the downloaded onnx model in your config folder, use the following
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `GPU`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `GPU`. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                             |
 | ---------------------------------------- | ------------------------------------------------- |
@@ -620,7 +620,7 @@ After placing the downloaded onnx model in your config folder, use the following
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `GPU` (or `NPU`). Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `GPU` (or `NPU`). Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                                    |
 | ---------------------------------------- | -------------------------------------------------------- |
@@ -676,7 +676,7 @@ After placing the downloaded onnx model in your `config/model_cache` folder, use
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `GPU`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `GPU`. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                   | Value                             |
 | --------------------------------------- | --------------------------------- |
@@ -728,7 +728,7 @@ After placing the downloaded onnx model in your config/model_cache folder, use t
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `CPU`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **OpenVINO** from the detector type dropdown and click **Add**, then set device to `CPU`. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                              |
 | ---------------------------------------- | ---------------------------------- |
@@ -807,7 +807,7 @@ Using the detector config below will connect to the client:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **ZMQ IPC** from the detector type dropdown and click **Add**, then set the endpoint to `tcp://host.docker.internal:5555`.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **ZMQ IPC** from the detector type dropdown and click **Add**, then set the endpoint to `tcp://host.docker.internal:5555`.
 
 </TabItem>
 <TabItem value="yaml">
@@ -841,7 +841,7 @@ When Frigate is started with the following config it will connect to the detecto
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **ZMQ IPC** from the detector type dropdown and click **Add**, then set the endpoint to `tcp://host.docker.internal:5555`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **ZMQ IPC** from the detector type dropdown and click **Add**, then set the endpoint to `tcp://host.docker.internal:5555`. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                                    |
 | ---------------------------------------- | -------------------------------------------------------- |
@@ -1002,7 +1002,7 @@ When using many cameras one detector may not be enough to keep up. Multiple dete
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **ONNX** from the detector type dropdown and click **Add** to add multiple detectors.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **ONNX** from the detector type dropdown and click **Add** to add multiple detectors.
 
 </TabItem>
 <TabItem value="yaml">
@@ -1050,7 +1050,7 @@ After placing the downloaded onnx model in your config folder, use the following
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **ONNX** from the detector type dropdown and click **Add**. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **ONNX** from the detector type dropdown and click **Add**. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                             |
 | ---------------------------------------- | ------------------------------------------------- |
@@ -1109,7 +1109,7 @@ After placing the downloaded onnx model in your config folder, use the following
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **ONNX** from the detector type dropdown and click **Add**. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **ONNX** from the detector type dropdown and click **Add**. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                                    |
 | ---------------------------------------- | -------------------------------------------------------- |
@@ -1158,7 +1158,7 @@ After placing the downloaded onnx model in your config folder, use the following
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **ONNX** from the detector type dropdown and click **Add**. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **ONNX** from the detector type dropdown and click **Add**. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                                    |
 | ---------------------------------------- | -------------------------------------------------------- |
@@ -1207,7 +1207,7 @@ After placing the downloaded onnx model in your `config/model_cache` folder, use
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **ONNX** from the detector type dropdown and click **Add**. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **ONNX** from the detector type dropdown and click **Add**. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                   | Value                             |
 | --------------------------------------- | --------------------------------- |
@@ -1252,7 +1252,7 @@ After placing the downloaded onnx model in your `config/model_cache` folder, use
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **ONNX** from the detector type dropdown and click **Add**. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **ONNX** from the detector type dropdown and click **Add**. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                       |
 | ---------------------------------------- | ------------------------------------------- |
@@ -1328,7 +1328,7 @@ A TensorFlow Lite model is provided in the container at `/cpu_model.tflite` and
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **CPU** from the detector type dropdown and click **Add**. Configure the number of threads and click **Add** again to add additional CPU detectors as needed (one per camera is recommended).
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **CPU** from the detector type dropdown and click **Add**. Configure the number of threads and click **Add** again to add additional CPU detectors as needed (one per camera is recommended).
 
 </TabItem>
 <TabItem value="yaml">
@@ -1364,7 +1364,7 @@ To integrate CodeProject.AI into Frigate, configure the detector as follows:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **DeepStack** from the detector type dropdown and click **Add**. Set the API URL to point to your CodeProject.AI server (e.g., `http://<your_codeproject_ai_server_ip>:<port>/v1/vision/detection`).
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **DeepStack** from the detector type dropdown and click **Add**. Set the API URL to point to your CodeProject.AI server (e.g., `http://<your_codeproject_ai_server_ip>:<port>/v1/vision/detection`).
 
 </TabItem>
 <TabItem value="yaml">
@@ -1403,7 +1403,7 @@ To configure the MemryX detector, use the following example configuration:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`.
 
 </TabItem>
 <TabItem value="yaml">
@@ -1423,7 +1423,7 @@ detectors:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **MemryX** from the detector type dropdown and click **Add** to add multiple detectors, specifying `PCIe:0`, `PCIe:1`, `PCIe:2`, etc. as the device for each.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **MemryX** from the detector type dropdown and click **Add** to add multiple detectors, specifying `PCIe:0`, `PCIe:1`, `PCIe:2`, etc. as the device for each.
 
 </TabItem>
 <TabItem value="yaml">
@@ -1467,7 +1467,7 @@ Below is the recommended configuration for using the **YOLO-NAS** (small) model
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                             |
 | ---------------------------------------- | ------------------------------------------------- |
@@ -1515,7 +1515,7 @@ Below is the recommended configuration for using the **YOLOv9** (small) model wi
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                             |
 | ---------------------------------------- | ------------------------------------------------- |
@@ -1562,7 +1562,7 @@ Below is the recommended configuration for using the **YOLOX** (small) model wit
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                   |
 | ---------------------------------------- | ----------------------- |
@@ -1609,7 +1609,7 @@ Below is the recommended configuration for using the **SSDLite MobileNet v2** mo
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **MemryX** from the detector type dropdown and click **Add**, then set device to `PCIe:0`. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                   |
 | ---------------------------------------- | ----------------------- |
@@ -1768,7 +1768,7 @@ Use the config below to work with generated TRT models:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **TensorRT** from the detector type dropdown and click **Add**, then set the device to `0` (the default GPU index). Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **TensorRT** from the detector type dropdown and click **Add**, then set the device to `0` (the default GPU index). Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                                        |
 | ---------------------------------------- | ------------------------------------------------------------ |
@@ -1825,7 +1825,7 @@ Use the model configuration shown below when using the synaptics detector with t
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **Synaptics** from the detector type dropdown and click **Add**. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **Synaptics** from the detector type dropdown and click **Add**. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                        |
 | ---------------------------------------- | ---------------------------- |
@@ -1879,7 +1879,7 @@ When using many cameras one detector may not be enough to keep up. Multiple dete
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **RKNN** from the detector type dropdown and click **Add** to add multiple detectors, each with `num_cores` set to `0` for automatic selection.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **RKNN** from the detector type dropdown and click **Add** to add multiple detectors, each with `num_cores` set to `0` for automatic selection.
 
 </TabItem>
 <TabItem value="yaml">
@@ -1921,7 +1921,7 @@ This `config.yml` shows all relevant options to configure the detector and expla
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **RKNN** from the detector type dropdown and click **Add**. Set `num_cores` to `0` for automatic selection (increase for better performance on multicore NPUs, e.g., set to `3` on rk3588).
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **RKNN** from the detector type dropdown and click **Add**. Set `num_cores` to `0` for automatic selection (increase for better performance on multicore NPUs, e.g., set to `3` on rk3588).
 
 </TabItem>
 <TabItem value="yaml">
@@ -1958,7 +1958,7 @@ The inference time was determined on a rk3588 with 3 NPU cores.
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                                                   |
 | ---------------------------------------- | ----------------------------------------------------------------------- |
@@ -2004,7 +2004,7 @@ The pre-trained YOLO-NAS weights from DeciAI are subject to their license and ca
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                              |
 | ---------------------------------------- | -------------------------------------------------- |
@@ -2044,7 +2044,7 @@ model: # required
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                                          |
 | ---------------------------------------- | ---------------------------------------------- |
@@ -2138,7 +2138,7 @@ Once completed, configure the detector as follows:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **DeGirum** from the detector type dropdown and click **Add**. Set the location to your AI server (e.g., service name, container name, or `host:port`), the zoo to `degirum/public`, and provide your authentication token if needed.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **DeGirum** from the detector type dropdown and click **Add**. Set the location to your AI server (e.g., service name, container name, or `host:port`), the zoo to `degirum/public`, and provide your authentication token if needed.
 
 </TabItem>
 <TabItem value="yaml">
@@ -2181,7 +2181,7 @@ It is also possible to eliminate the need for an AI server and run the hardware
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **DeGirum** from the detector type dropdown and click **Add**. Set the location to `@local`, the zoo to `degirum/public`, and provide your authentication token.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **DeGirum** from the detector type dropdown and click **Add**. Set the location to `@local`, the zoo to `degirum/public`, and provide your authentication token.
 
 </TabItem>
 <TabItem value="yaml">
@@ -2218,7 +2218,7 @@ If you do not possess whatever hardware you want to run, there's also the option
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **DeGirum** from the detector type dropdown and click **Add**. Set the location to `@cloud`, the zoo to `degirum/public`, and provide your authentication token.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **DeGirum** from the detector type dropdown and click **Add**. Set the location to `@cloud`, the zoo to `degirum/public`, and provide your authentication token.
 
 </TabItem>
 <TabItem value="yaml">
@@ -2274,7 +2274,7 @@ Use the model configuration shown below when using the axengine detector with th
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and select **AXEngine NPU** from the detector type dropdown and click **Add**. Then navigate to <NavPath path="Settings > System > Detection model" /> and configure:
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and select **AXEngine NPU** from the detector type dropdown and click **Add**. Then on the same page, in the **Custom Model** tab, configure:
 
 | Field                                    | Value                   |
 | ---------------------------------------- | ----------------------- |

docs/docs/configuration/profiles.md

@@ -33,10 +33,10 @@ The easiest way to define profiles is to use the Frigate UI. Profiles can also b
 <ConfigTabs>
 <TabItem value="ui">
 
-1. **Create a profile** — Navigate to <NavPath path="Settings > Camera configuration > Profiles" />. Click the **Add Profile** button, enter a name (and optionally a profile ID).
+1. **Create a profile** — Navigate to <NavPath path="Settings > Global configuration > Profiles" />. Click the **Add Profile** button, enter a name (and optionally a profile ID).
 2. **Configure overrides** — Navigate to a camera configuration section (e.g. Motion detection, Record, Notifications). In the top right, two buttons will appear - choose a camera and a profile from the profile selector to edit overrides for that camera and section. Only the fields you change will be stored as overrides — fields that require a restart are hidden since profiles are applied at runtime. You can click the **Remove Profile Override** button to clear overrides.
-3. **Activate a profile** — Use the **Profiles** option in Frigate's main menu to choose a profile. Alternatively, in Settings, navigate to <NavPath path="Settings > Camera configuration > Profiles" />, then choose a profile in the Active Profile dropdown to activate it. The active profile is also shown in the status bar at the bottom of the screen on desktop browsers.
-4. **Delete a profile** — Navigate to <NavPath path="Settings > Camera configuration > Profiles" />, then click the trash icon for a profile. This removes the profile definition and all camera overrides associated with it.
+3. **Activate a profile** — Use the **Profiles** option in Frigate's main menu to choose a profile. Alternatively, in Settings, navigate to <NavPath path="Settings > Global configuration > Profiles" />, then choose a profile in the Active Profile dropdown to activate it. The active profile is also shown in the status bar at the bottom of the screen on desktop browsers.
+4. **Delete a profile** — Navigate to <NavPath path="Settings > Global configuration > Profiles" />, then click the trash icon for a profile. This removes the profile definition and all camera overrides associated with it.
 
 </TabItem>
 <TabItem value="yaml">
@@ -126,7 +126,11 @@ Only the fields you explicitly set in a profile override are applied. All other
 
 ## Activating Profiles
 
-Profiles can be activated and deactivated from the Frigate UI. Open the Settings cog and select **Profiles** from the submenu to see all defined profiles. From there you can activate any profile or deactivate the current one. The active profile is indicated in the UI so you always know which profile is in effect.
+Profiles can be activated and deactivated via the Frigate UI, [MQTT](/integrations/mqtt#frigateprofileset), or the Home Assistant integration.
+
+In the Frigate UI, open the Settings cog and select **Profiles** from the submenu to see all defined profiles. From there you can activate any profile or deactivate the current one. The active profile is indicated in the UI so you always know which profile is in effect.
+
+Activating or deactivating a profile clears any [runtime toggle overrides](/configuration/live#runtime-toggle-persistence) so the profile's settings aren't silently undone by a stale toggle from before the switch.
 
 ## Example: Home / Away Setup
 
@@ -135,10 +139,10 @@ A common use case is having different detection and notification settings based
 <ConfigTabs>
 <TabItem value="ui">
 
-1. Navigate to <NavPath path="Settings > Camera configuration > Profiles" /> and create two profiles: **Home** and **Away**.
+1. Navigate to <NavPath path="Settings > Global configuration > Profiles" /> and create two profiles: **Home** and **Away**.
 2. From to the Camera configuration section in Settings, choose the **front_door** camera, and select the **Away** profile from the profile dropdown. Then, enable notifications from the Notifications pane, and set alert labels to `person` and `car` from the Review pane. Then, from the profile dropdown choose **Home** profile, then navigate to Notifications to disable notifications.
 3. For the **indoor_cam** camera, perform similar steps - configure the **Away** profile to enable the camera, detection, and recording. Configure the **Home** profile to disable the camera entirely for privacy.
-4. Activate the desired profile from <NavPath path="Settings > Camera configuration > Profiles" /> or from the **Profiles** option in Frigate's main menu.
+4. Activate the desired profile from <NavPath path="Settings > Global configuration > Profiles" /> or from the **Profiles** option in Frigate's main menu.
 
 </TabItem>
 <TabItem value="yaml">
@@ -207,3 +211,27 @@ In this example:
 - **Away profile**: The front door camera enables notifications and tracks specific alert labels. The indoor camera is fully enabled with detection and recording.
 - **Home profile**: The front door camera disables notifications. The indoor camera is completely disabled for privacy.
 - **No profile active**: All cameras use their base configuration values.
+
+## FAQ
+
+### Can I define a zone or mask in a profile but not have it in the base config?
+
+No. Profiles are pure overrides. Every zone and mask defined under a profile must reference an entry that already exists on the base camera config. Configurations that introduce profile-only zones or masks are rejected at startup.
+
+If you want a zone or mask to be active only under a specific profile, define it on the base config with `enabled: false`, then enable it in that profile's overrides.
+
+### How do I revert a profile zone or mask override back to the base configuration?
+
+Delete the override. In the Frigate UI, edit the profile and use the "Revert override" action (the trash can icon) on the zone or mask. The base entry is left untouched, and once the override is removed the profile inherits the base values for that zone or mask.
+
+### Can multiple profiles be active at the same time?
+
+No. Only one profile can be active at a time. Activating a new profile automatically deactivates the current one.
+
+### What happens to my profile overrides if I delete a zone or mask from the base?
+
+When you delete a base zone or mask in the Frigate UI, any profile overrides for that entry are deleted automatically as part of the same operation. If you remove a base entry by editing your config file directly and leave a profile override behind, the config will fail validation at startup until the orphaned override is removed as well.
+
+### Why are some settings missing when I configure a profile override?
+
+Fields that require a Frigate restart to take effect cannot be overridden by profiles, since profiles are applied at runtime without restarting. Those fields are hidden when editing a profile override and can only be changed on the base configuration.

docs/docs/configuration/reference.md

@@ -840,8 +840,8 @@ cameras:
   # Required: name of the camera
   back:
     # Optional: Enable/Disable the camera (default: shown below).
-    # If disabled: config is used but no live stream and no capture etc.
-    # Events/Recordings are still viewable.
+    # When False, ffmpeg is not started and the camera is hidden from the UI
+    # (except Camera Management). Re-enabling requires a Frigate restart.
     enabled: True
     # Optional: camera type used for some Frigate features (default: shown below)
     # Options are "generic" and "lpr"

docs/docs/configuration/review.md

@@ -23,7 +23,7 @@ In 0.14 and later, all of that is bundled into a single review item which starts
 
 ## Alerts and Detections
 
-Not every segment of video captured by Frigate may be of the same level of interest to you. Video of people who enter your property may be a different priority than those walking by on the sidewalk. For this reason, Frigate 0.14 categorizes review items as _alerts_ and _detections_. By default, all person and car objects are considered alerts. You can refine categorization of your review items by configuring required zones for them.
+Not every segment of video captured by Frigate may be of the same level of interest to you. Video of people who enter your property may be a different priority than those walking by on the sidewalk. For this reason, Frigate categorizes review items as _alerts_ and _detections_. By default, all person and car objects are considered alerts. You can refine categorization of your review items by configuring required zones for them.
 
 :::note
 
@@ -130,3 +130,61 @@ By default a review item will be created if any `review -> alerts -> labels` and
 Because zones don't apply to audio, audio labels will always be marked as a detection by default.
 
 :::
+
+## Reviewing Motion
+
+The Review page also can show periods of motion that didn't produce a tracked object, and provides a way to search past recordings for motion in a specific region. These tools complement the alerts and detections workflow above — see [Tuning Motion Detection](motion_detection.md) for how the underlying motion detector is configured.
+
+### Motion Previews
+
+The Motion Previews pane shows preview clips for periods of significant motion that did not produce a tracked object. It is useful for spotting things that motion detection picked up but object detection did not, which can help validate tuning or catch missed objects.
+
+On the <NavPath path="Review > Motion" /> page, click the kebab menu on a camera and choose **Motion Previews**. Each card represents a continuous range of motion-only activity and plays back the recorded preview for that range. A heatmap overlay dims areas of the frame with no motion so the moving regions stand out.
+
+The pane provides a few controls:
+
+- **Speed** — speeds up or slows down all of the preview clips at once.
+- **Dim** — controls how strongly non-motion areas are darkened by the heatmap overlay. Higher values increase motion area visibility.
+- **Filter** — opens a 16×16 grid overlaid on a snapshot of the camera. Select one or more cells to only show clips with motion in those regions. This is helpful for filtering out motion in areas like a busy street while keeping motion in your driveway.
+
+Clicking a preview clip seeks the recording player to that timestamp so you can review the full footage.
+
+### Motion Search
+
+Motion Search lets you scan recorded footage for changes inside a region of interest you draw on the camera. Unlike Motion Previews, which surfaces what Frigate's motion detector flagged in real time, Motion Search re-analyzes the saved recordings, so it can find changes that were missed (for example, an object that appeared while motion detection was paused by `lightning_threshold`, or in a region that is normally motion-masked).
+
+To start a search, open the Actions menu in History or click the kebab menu on a camera in the <NavPath path="Review > Motion" /> page and choose **Motion Search**. In the dialog:
+
+1. Pick the camera and time range to scan.
+2. Draw a polygon on the camera frame to define the region of interest.
+3. Adjust the search parameters if needed:
+
+| Field                     | Description                                                                                                                                                                                                                                                                                                    |
+| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Sensitivity Threshold** | Per-pixel luminance change required to count as motion inside the ROI. Behaves like Frigate's motion detection `threshold` setting.                                                                                                                                                                            |
+| **Minimum Change Area**   | Minimum percentage of the region of interest that must change for a frame to be considered significant. Raise it to ignore small movements (leaves, distant motion); lower it when the object you care about only covers a small slice of the ROI.                                                             |
+| **Frame Skip**            | Number of frames to skip between samples — at a camera recording 20 fps, a skip value of 20 takes motion samples roughly once per second. Higher values scan much faster and are usually the right choice; lower it only when you need to catch the exact appearance or disappearance of a fast-moving object. |
+| **Maximum Results**       | Maximum number of matching timestamps to return.                                                                                                                                                                                                                                                               |
+| **Parallel mode**         | Process multiple recording segments in parallel. Speeds up large time ranges at the cost of higher CPU usage.                                                                                                                                                                                                  |
+
+Once running, Frigate scans the recording segments that overlap the time range and reports timestamps where changes were detected inside the polygon, along with the percentage of the ROI that changed. Clicking a result seeks the player to that moment so you can review what happened.
+
+The status panel shows live progress and metrics such as how many segments were scanned, how many were skipped because no motion was recorded for that segment (using the stored motion heatmap), how many frames were decoded, and the total wall-clock time. Segments with no recorded motion in the selected ROI are skipped automatically, which is what makes searching long time ranges practical.
+
+#### Common use cases
+
+Frigate's main use case is to record and surface tracked objects, so Motion Search is most useful for the cases where object detection produced nothing — there is no object to find in Explore, but you suspect something happened.
+
+- **Locating an unattributed change.** You know something appeared, disappeared, or moved in a window of footage — a package now gone, a gate left open — but no detection points to it. A search returns the candidate timestamps instead of scrubbing the timeline by hand.
+- **An object that was never detected.** Something Frigate doesn't have a model label for, an object too small or distant to be detected, or movement in a region where detection isn't running. The activity left no tracked object but did change the pixels, so a search can still find it.
+- **Activity while detection was effectively paused.** Changes that occurred while object detection was disabled, motion was suppressed by `skip_motion_threshold`, or inside an area covered by a motion mask, won't appear as review items or tracked objects but can be recovered by searching the recordings directly.
+
+#### Expected performance
+
+Motion Search analyzes the saved recordings on demand rather than reading a pre-built index, so a search over a long range takes longer than browsing Motion Previews. Cost scales mainly with how much footage has to be examined: segments with no recorded motion in your ROI are skipped using the stored motion heatmap (shown as "segments skipped" in the status panel), so a quiet range finishes quickly while a busy one takes longer.
+
+To increase the speed of searches:
+
+- Draw a tight ROI. Because **Minimum Change Area** is measured as a percentage of the region you draw, a tight ROI around where you expect the change makes the object fill a larger share of the area, so it clears the threshold more easily. A loose ROI makes the same object a small fraction of the region, so it can fall below the threshold and be missed — forcing you to lower Minimum Change Area, which lets in more noise.
+- Keep Frame Skip high. A higher value samples fewer frames and speeds up the search considerably, while still landing within a few seconds of when the motion or object appeared — close enough to seek to in the recording. Only lower it when you need to pinpoint the exact frame something appears or disappears.
+- Use Parallel mode to shorten wall-clock time on multi-core systems, at the cost of higher CPU usage while it runs.

docs/docs/guides/getting_started.md

@@ -144,7 +144,7 @@ At this point you should be able to start Frigate and a basic config will be cre
 
 ### Step 2: Add a camera
 
-Click the **Add Camera** button in <NavPath path="Settings > Camera configuration > Management" /> to use the camera setup wizard to get your first camera added into Frigate.
+Click the **Add Camera** button in <NavPath path="Settings > Global configuration > Camera management" /> to use the camera setup wizard to get your first camera added into Frigate.
 
 ### Step 3: Configure hardware acceleration (recommended)
 
@@ -204,8 +204,8 @@ You need to refer to **Configure hardware acceleration** above to enable the con
 <ConfigTabs>
 <TabItem value="ui">
 
-1. Navigate to <NavPath path="Settings > System > Detector hardware" /> and add a detector with **Type** `OpenVINO` and **Device** `GPU`
-2. Navigate to <NavPath path="Settings > System > Detection model" /> and configure the model settings for OpenVINO:
+1. Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `OpenVINO` and **Device** `GPU`
+2. On the same page, in the **Custom Model** tab, configure the model settings for OpenVINO:
 
 | Field                                    | Value                                      |
 | ---------------------------------------- | ------------------------------------------ |
@@ -273,7 +273,7 @@ services:
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > System > Detector hardware" /> and add a detector with **Type** `EdgeTPU` and **Device** `usb`.
+Navigate to <NavPath path="Settings > System > Detectors and model" /> and add a detector with **Type** `EdgeTPU` and **Device** `usb`.
 
 </TabItem>
 <TabItem value="yaml">

docs/docs/integrations/home-assistant.md

@@ -195,7 +195,7 @@ For clips to be castable to media devices, audio is required and may need to be
 
 ## Camera API
 
-To disable a camera dynamically
+To turn a camera off (pauses Frigate's processing of the stream; does not persist across Frigate restarts; see [Camera state](/configuration/live#camera-state)):
 
 ```
 action: camera.turn_off
@@ -204,7 +204,7 @@ target:
   entity_id: camera.back_deck_cam  # your Frigate camera entity ID
 ```
 
-To enable a camera that has been disabled dynamically
+To turn a camera back on:
 
 ```
 action: camera.turn_on
@@ -213,6 +213,12 @@ target:
   entity_id: camera.back_deck_cam  # your Frigate camera entity ID
 ```
 
+:::note
+
+These actions toggle Frigate's runtime On/Off state. To permanently disable a camera, set its status to **Disabled** in **Settings → Camera Management** in the Frigate UI.
+
+:::
+
 ## Notification API
 
 Many people do not want to expose Frigate to the web, so the integration creates some public API endpoints that can be used for notifications.

docs/docs/integrations/mqtt.md

@@ -306,7 +306,7 @@ Publishes the current health status of each role that is enabled (`audio`, `dete
 
 - `online`: Stream is running and being processed
 - `offline`: Stream is offline and is being restarted
-- `disabled`: Camera is currently disabled
+- `disabled`: Camera is currently turned off (either at runtime via the `enabled/set` topic, or persistently via the configuration file). See [Camera state](/configuration/live#camera-state) for the distinction.
 
 ### `frigate/<camera_name>/<object_name>`
 
@@ -368,15 +368,15 @@ The published value is the detected state class name (e.g., `open`, `closed`, `o
 
 ### `frigate/<camera_name>/enabled/set`
 
-Topic to turn Frigate's processing of a camera on and off. Expected values are `ON` and `OFF`.
+Topic to turn Frigate's processing of a camera on or off at runtime. Expected values are `ON` and `OFF`. The change is persisted across Frigate restarts (see [Runtime toggle persistence](/configuration/live#runtime-toggle-persistence)). To permanently change the configured value, use **Settings → Global configuration → Camera management** in the Frigate UI. See [Camera state](/configuration/live#camera-state) for the difference between turning a camera off and disabling it.
 
 ### `frigate/<camera_name>/enabled/state`
 
-Topic with current state of processing for a camera. Published values are `ON` and `OFF`.
+Topic with current runtime state of processing for a camera. Published values are `ON` and `OFF`.
 
 ### `frigate/<camera_name>/detect/set`
 
-Topic to turn object detection for a camera on and off. Expected values are `ON` and `OFF`.
+Topic to turn object detection for a camera on and off. Expected values are `ON` and `OFF`. The change is persisted across Frigate restarts (see [Runtime toggle persistence](/configuration/live#runtime-toggle-persistence)).
 
 ### `frigate/<camera_name>/detect/state`
 
@@ -384,7 +384,7 @@ Topic with current state of object detection for a camera. Published values are
 
 ### `frigate/<camera_name>/audio/set`
 
-Topic to turn audio detection for a camera on and off. Expected values are `ON` and `OFF`.
+Topic to turn audio detection for a camera on and off. Expected values are `ON` and `OFF`. The change is persisted across Frigate restarts (see [Runtime toggle persistence](/configuration/live#runtime-toggle-persistence)).
 
 ### `frigate/<camera_name>/audio/state`
 
@@ -392,7 +392,7 @@ Topic with current state of audio detection for a camera. Published values are `
 
 ### `frigate/<camera_name>/recordings/set`
 
-Topic to turn recordings for a camera on and off. Expected values are `ON` and `OFF`.
+Topic to turn recordings for a camera on and off. Expected values are `ON` and `OFF`. The change is persisted across Frigate restarts (see [Runtime toggle persistence](/configuration/live#runtime-toggle-persistence)).
 
 ### `frigate/<camera_name>/recordings/state`
 
@@ -400,7 +400,7 @@ Topic with current state of recordings for a camera. Published values are `ON` a
 
 ### `frigate/<camera_name>/snapshots/set`
 
-Topic to turn snapshots for a camera on and off. Expected values are `ON` and `OFF`.
+Topic to turn snapshots for a camera on and off. Expected values are `ON` and `OFF`. The change is persisted across Frigate restarts (see [Runtime toggle persistence](/configuration/live#runtime-toggle-persistence)).
 
 ### `frigate/<camera_name>/snapshots/state`
 

docs/docs/integrations/plus.md

@@ -3,6 +3,8 @@ id: plus
 title: Frigate+
 ---
 
+import NavPath from "@site/src/components/NavPath";
+
 For more information about how to use Frigate+ to improve your model, see the [Frigate+ docs](/plus/).
 
 :::info
@@ -57,7 +59,7 @@ You can view all of your submitted images at [https://plus.frigate.video](https:
 
 Once you have [requested your first model](../plus/first_model.md) and gotten your own model ID, it can be used with a special model path. No other information needs to be configured for Frigate+ models because it fetches the remaining config from Frigate+ automatically.
 
-You can either choose the new model from the Frigate+ pane in the Settings page of the Frigate UI, or manually set the model at the root level in your config:
+You can either choose the new model from the <NavPath path="Settings > System > Detectors and model" /> pane in the Frigate UI (the **Frigate+ Model** tab), or manually set the model at the root level in your config:
 
 ```yaml
 detectors: ...

docs/docs/troubleshooting/dummy-camera.md

@@ -3,6 +3,8 @@ id: dummy-camera
 title: Analyzing Object Detection
 ---
 
+import NavPath from "@site/src/components/NavPath";
+
 Frigate provides several tools for investigating object detection and tracking behavior: reviewing recorded detections through the UI, using the built-in Debug Replay feature, and manually setting up a dummy camera for advanced scenarios.
 
 ## Reviewing Detections in the UI
@@ -37,6 +39,8 @@ The per-clip variation is typically quite low and is mostly an artifact of keyfr
 
 Debug Replay lets you re-run Frigate's detection pipeline against a section of recorded video without manually configuring a dummy camera. It automatically extracts the recording, creates a temporary camera with the same detection settings as the original, and loops the clip through the pipeline so you can observe detections in real time.
 
+Debug Replay isn't intended to be a one-stop pane for all Frigate diagnostics or a comprehensive debugging environment for every Frigate feature. It merely makes it easier to spin up a "dummy camera" and perform some common adjustments in real-time. You'll still need to use the normal tools (logs, an MQTT client, etc) to debug your feature.
+
 ### When to use
 
 - Reproducing a detection or tracking issue from a specific time range
@@ -49,11 +53,25 @@ Only one replay session can be active at a time. If a session is already running
 
 :::
 
+### Starting Debug Replay
+
+Debug Replay can be started from several places in the UI. The starting point determines the time range that gets replayed.
+
+- **History — Actions menu.** Navigate to <NavPath path="History > {camera}" />, open the **Actions** menu in the toolbar, and choose **Debug Replay**. From here you can pick a preset (**Last 1 Minute**, **Last 5 Minutes**), select a range directly on the timeline with **From Timeline**, or enter exact start and end times with **Custom**. This is the most flexible option and the best choice when you want to add padding around a detection. On mobile, the same options appear in the Actions drawer.
+- **History — Detail Stream event menu.** While viewing a review item in the Detail Stream, open the menu on a tracked object's event card and choose **Debug Replay**. The replay range is set automatically to that object's start and end times.
+- **Explore — search result menu.** From an Explore card, open the kebab menu and choose **Debug Replay**. The range is taken from the tracked object's lifecycle.
+- **Explore — Tracking Details Actions menu.** Open a tracked object's **Tracking Details** dialog, then choose **Debug Replay** from the Actions menu. Same automatic range as the search result menu.
+- **Exports — export card menu.** From <NavPath path="Exports" />, open the menu on an export and choose **Debug Replay** to loop the exported clip through the detection pipeline for the camera it was exported from.
+
+The Detail Stream, Explore, and Exports entry points use the underlying recording or export's bounds with a small amount of padding. This can be convenient for quick checks, but if a detection is short or you want extra "settle" time for motion and the detector, start the replay from the History Actions menu instead and widen the range manually.
+
 ### Variables to consider
 
 - The replay will not always produce identical results to the original run. Different frames may be selected on replay, which can change detections and tracking.
 - Motion detection depends on the exact frames used; small frame shifts can change motion regions and therefore what gets passed to the detector.
 - Object detection is not fully deterministic: models and post-processing can yield slightly different results across runs.
+- In cases where a detection is short and a replay may only be a small number of frames, it is recommended to manually add some padding before and after the detection so that the motion and object detectors have time to settle into the scene. Rather than starting Debug Replay from Explore, navigate to History for your camera, choose Debug Replay from the Actions menu, and click the "From Timeline" or "Custom" option.
+- The replay camera inherits the source camera's zones. Any automations that trigger on those zone names will fire for the replay camera as well. This can be helpful when debugging zone behavior, but may be unexpected. You can add a condition on the source camera's name in your automation if you want to exclude replay triggers.
 
 Treat the replay as a close approximation rather than an exact reproduction. Run multiple loops and examine the debug overlays and logs to understand the behavior.
 

docs/scripts/lib/nav_map.py

@@ -63,8 +63,8 @@ SYSTEM_NAV: dict[str, tuple[str, str]] = {
     "environment_vars": ("System", "Environment variables"),
     "telemetry": ("System", "Telemetry"),
     "birdseye": ("System", "Birdseye"),
-    "detectors": ("System", "Detector hardware"),
-    "model": ("System", "Detection model"),
+    "detectors": ("System", "Detectors and model"),
+    "model": ("System", "Detectors and model"),
 }
 
 # All known top-level config section keys

docs/static/frigate-api.yaml

@@ -2058,6 +2058,47 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/HTTPValidationError"
+  /genai/models:
+    get:
+      tags:
+        - App
+      summary: List available GenAI models
+      description: Returns available models for each configured GenAI provider.
+      operationId: genai_models_genai_models_get
+      responses:
+        "200":
+          description: Successful Response
+          content:
+            application/json:
+              schema: {}
+  /genai/probe:
+    post:
+      tags:
+        - App
+      summary: Probe a GenAI provider without saving config
+      description: >-
+        Builds a transient client from the request body and returns its
+        available models. Used to validate provider credentials in the UI
+        before saving the configuration. Requires admin role.
+      operationId: genai_probe_genai_probe_post
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/GenAIProbeBody"
+      responses:
+        "200":
+          description: Successful Response
+          content:
+            application/json:
+              schema: {}
+        "422":
+          description: Validation Error
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/HTTPValidationError"
   /vainfo:
     get:
       tags:
@@ -7031,6 +7072,39 @@ components:
                 "john_doe": ["face1.webp", "face2.jpg"],
                 "jane_smith": ["face3.png"]
             }
+    GenAIProbeBody:
+      properties:
+        provider:
+          type: string
+          enum:
+            - openai
+            - azure_openai
+            - gemini
+            - ollama
+            - llamacpp
+          title: Provider
+          description: GenAI provider to probe
+        api_key:
+          anyOf:
+            - type: string
+            - type: "null"
+          title: API Key
+          description: API key for the provider (when applicable)
+        base_url:
+          anyOf:
+            - type: string
+            - type: "null"
+          title: Base URL
+          description: Base URL for self-hosted or compatible providers
+        provider_options:
+          type: object
+          title: Provider Options
+          description: Additional provider-specific options
+          default: {}
+      type: object
+      required:
+        - provider
+      title: GenAIProbeBody
     GenerateObjectExamplesBody:
       properties:
         model_name:

frigate/api/app.py

@@ -34,15 +34,18 @@ from frigate.api.auth import (
 from frigate.api.defs.query.app_query_parameters import AppTimelineHourlyQueryParameters
 from frigate.api.defs.request.app_body import (
     AppConfigSetBody,
+    GenAIProbeBody,
     MediaSyncBody,
 )
 from frigate.api.defs.tags import Tags
-from frigate.config import FrigateConfig
+from frigate.config import FrigateConfig, GenAIConfig, GenAIProviderEnum
 from frigate.config.camera.updater import (
     CameraConfigUpdateEnum,
     CameraConfigUpdateTopic,
 )
+from frigate.const import REDACTED_CREDENTIAL_SENTINEL
 from frigate.ffmpeg_presets import FFMPEG_HWACCEL_VAAPI, _gpu_selector
+from frigate.genai import PROVIDERS, load_providers
 from frigate.jobs.media_sync import (
     get_current_media_sync_job,
     get_media_sync_job_by_id,
@@ -59,7 +62,11 @@ from frigate.util.builtin import (
     process_config_query_string,
     update_yaml_file_bulk,
 )
-from frigate.util.config import apply_section_update, find_config_file
+from frigate.util.config import (
+    apply_section_update,
+    find_config_file,
+    redact_credential,
+)
 from frigate.util.schema import get_config_schema
 from frigate.util.services import (
     get_nvidia_driver_info,
@@ -75,6 +82,14 @@ logger = logging.getLogger(__name__)
 
 router = APIRouter(tags=[Tags.app])
 
+# Short timeout for the /genai/probe path. The probe is interactive — fail
+# fast on hung providers rather than holding an API worker thread.
+_PROBE_TIMEOUT_SECONDS = 10
+# Outer cap that returns control to the caller even if the underlying sync
+# HTTP call ignores its timeout. The sync work continues in the background
+# thread; only the response is bounded.
+_PROBE_OUTER_TIMEOUT_SECONDS = 15
+
 
 @router.get(
     "/", response_class=PlainTextResponse, dependencies=[Depends(allow_public())]
@@ -96,11 +111,46 @@ def version():
 
 
 @router.get("/stats", dependencies=[Depends(allow_any_authenticated())])
-def stats(request: Request):
-    return JSONResponse(content=request.app.stats_emitter.get_latest_stats())
+def stats(
+    request: Request,
+    allowed_cameras: List[str] = Depends(get_allowed_cameras_for_filter),
+):
+    stats_data = request.app.stats_emitter.get_latest_stats()
+
+    # Admins see the full snapshot
+    if request.headers.get("remote-role") == "admin":
+        return JSONResponse(content=stats_data)
+
+    allowed_set = set(allowed_cameras)
+
+    # Shallow-copy so we don't mutate the cached stats history entry.
+    filtered = {**stats_data}
+
+    cameras = stats_data.get("cameras")
+    if cameras is not None:
+        filtered["cameras"] = {
+            name: data for name, data in cameras.items() if name in allowed_set
+        }
+
+    bandwidth = stats_data.get("bandwidth_usages")
+    if bandwidth is not None:
+        filtered["bandwidth_usages"] = {
+            name: data for name, data in bandwidth.items() if name in allowed_set
+        }
+
+    # cmdline can leak camera URLs/paths; strip but keep cpu/mem so
+    # client-side problem heuristics still work.
+    cpu_usages = stats_data.get("cpu_usages")
+    if cpu_usages is not None:
+        filtered["cpu_usages"] = {
+            pid: {k: v for k, v in usage.items() if k != "cmdline"}
+            for pid, usage in cpu_usages.items()
+        }
+
+    return JSONResponse(content=filtered)
 
 
-@router.get("/stats/history", dependencies=[Depends(allow_any_authenticated())])
+@router.get("/stats/history", dependencies=[Depends(require_role(["admin"]))])
 def stats_history(request: Request, keys: str = None):
     if keys:
         keys = keys.split(",")
@@ -135,6 +185,95 @@ def genai_models(request: Request):
     return JSONResponse(content=request.app.genai_manager.list_models())
 
 
+@router.post(
+    "/genai/probe",
+    dependencies=[Depends(require_role(["admin"]))],
+    summary="Probe a GenAI provider without saving config",
+    description=(
+        "Builds a transient client from the request body and returns its "
+        "available models. Used to validate provider credentials in the UI "
+        "before saving the configuration."
+    ),
+)
+async def genai_probe(body: GenAIProbeBody):
+    load_providers()
+
+    provider_cls = PROVIDERS.get(body.provider)
+    if not provider_cls:
+        return JSONResponse(
+            status_code=400,
+            content={"success": False, "message": "Unknown provider"},
+        )
+
+    # The OpenAI-compatible SDKs accept "timeout" as a constructor kwarg via
+    # provider_options; other plugins use GenAIClient.timeout passed below.
+    # Don't inject timeout for Gemini — its HttpOptions interprets the value
+    # in milliseconds and would clash with the plugin's own default.
+    probe_provider_options: dict[str, Any] = dict(body.provider_options or {})
+    if body.provider in (GenAIProviderEnum.openai, GenAIProviderEnum.azure_openai):
+        probe_provider_options.setdefault("timeout", _PROBE_TIMEOUT_SECONDS)
+
+    try:
+        transient_cfg = GenAIConfig(
+            provider=body.provider,
+            api_key=body.api_key,
+            base_url=body.base_url,
+            provider_options=probe_provider_options,
+            # model is required by the schema but irrelevant for listing.
+            model="probe",
+            roles=[],
+        )
+    except ValidationError:
+        logger.exception("GenAI probe: invalid configuration")
+        return JSONResponse(
+            status_code=400,
+            content={"success": False, "message": "Invalid provider configuration"},
+        )
+
+    try:
+        client = provider_cls(
+            transient_cfg,
+            timeout=_PROBE_TIMEOUT_SECONDS,
+            validate_model=False,
+        )
+    except Exception:
+        logger.exception("GenAI probe: failed to construct client")
+        return JSONResponse(
+            content={
+                "success": False,
+                "message": "Failed to connect to provider",
+            },
+        )
+
+    try:
+        models = await asyncio.wait_for(
+            asyncio.to_thread(client.list_models),
+            timeout=_PROBE_OUTER_TIMEOUT_SECONDS,
+        )
+    except asyncio.TimeoutError:
+        return JSONResponse(
+            content={"success": False, "message": "Probe timed out"},
+        )
+    except Exception:
+        logger.exception("GenAI probe: list_models failed")
+        return JSONResponse(
+            content={"success": False, "message": "Provider returned no models"},
+        )
+
+    if not models:
+        return JSONResponse(
+            content={
+                "success": False,
+                "message": (
+                    "No models returned. Check the API key, base URL, and "
+                    "that the provider is reachable."
+                ),
+            },
+        )
+
+    return JSONResponse(content={"success": True, "models": models})
+
+
 @router.get("/config", dependencies=[Depends(allow_any_authenticated())])
 def config(request: Request):
     config_obj: FrigateConfig = request.app.frigate_config
@@ -150,26 +289,24 @@ def config(request: Request):
     if request.headers.get("remote-role") != "admin":
         config.pop("environment_vars", None)
 
-    # remove mqtt credentials
-    config["mqtt"].pop("password", None)
-    config["mqtt"].pop("user", None)
+    # redact mqtt credentials
+    redact_credential(config["mqtt"], "password")
 
-    # remove the proxy secret
-    config["proxy"].pop("auth_secret", None)
+    # redact proxy secret
+    redact_credential(config["proxy"], "auth_secret")
 
-    # remove genai api keys
-    for genai_name, genai_cfg in config.get("genai", {}).items():
+    # redact genai api keys
+    for _genai_name, genai_cfg in config.get("genai", {}).items():
         if isinstance(genai_cfg, dict):
-            genai_cfg.pop("api_key", None)
+            redact_credential(genai_cfg, "api_key")
 
     for camera_name, camera in request.app.frigate_config.cameras.items():
         camera_dict = config["cameras"][camera_name]
 
-        # remove onvif credentials
+        # redact onvif credentials
         onvif_dict = camera_dict.get("onvif", {})
         if onvif_dict:
-            onvif_dict.pop("user", None)
-            onvif_dict.pop("password", None)
+            redact_credential(onvif_dict, "password")
 
         # clean paths
         for input in camera_dict.get("ffmpeg", {}).get("inputs", []):
@@ -546,6 +683,10 @@ def _config_set_in_memory(request: Request, body: AppConfigSetBody) -> JSONRespo
             _restore_masked_camera_paths(body.config_data, request.app.frigate_config)
             updates = flatten_config_data(body.config_data)
             updates = {k: ("" if v is None else v) for k, v in updates.items()}
+            # Drop any field whose value is still the redaction sentinel
+            updates = {
+                k: v for k, v in updates.items() if v != REDACTED_CREDENTIAL_SENTINEL
+            }
 
         if not updates:
             return JSONResponse(
@@ -609,6 +750,40 @@ def _config_set_in_memory(request: Request, body: AppConfigSetBody) -> JSONRespo
                     settings,
                 )
 
+                # detect resize also republishes motion + objects so other
+                # processes pick up the rebuilt masks, and fires refresh so
+                # the camera maintainer recycles the camera process to pick
+                # up the new ffmpeg cmd / SHM sizing
+                if field == "detect":
+                    cam_cfg = config.cameras.get(camera)
+                    if cam_cfg is not None:
+                        if cam_cfg.motion is not None:
+                            request.app.config_publisher.publish_update(
+                                CameraConfigUpdateTopic(
+                                    CameraConfigUpdateEnum.motion, camera
+                                ),
+                                cam_cfg.motion,
+                            )
+                        request.app.config_publisher.publish_update(
+                            CameraConfigUpdateTopic(
+                                CameraConfigUpdateEnum.objects, camera
+                            ),
+                            cam_cfg.objects,
+                        )
+                        if cam_cfg.zones:
+                            request.app.config_publisher.publish_update(
+                                CameraConfigUpdateTopic(
+                                    CameraConfigUpdateEnum.zones, camera
+                                ),
+                                cam_cfg.zones,
+                            )
+                        request.app.config_publisher.publish_update(
+                            CameraConfigUpdateTopic(
+                                CameraConfigUpdateEnum.refresh, camera
+                            ),
+                            cam_cfg,
+                        )
+
         return JSONResponse(
             content={"success": True, "message": "Config applied in-memory"},
             status_code=200,
@@ -656,6 +831,13 @@ def config_set(request: Request, body: AppConfigSetBody):
                     updates = flatten_config_data(body.config_data)
                     # Convert None values to empty strings for deletion (e.g., when deleting masks)
                     updates = {k: ("" if v is None else v) for k, v in updates.items()}
+                    # Drop sentinel-valued fields so untouched credential
+                    # placeholders don't clobber the saved YAML value.
+                    updates = {
+                        k: v
+                        for k, v in updates.items()
+                        if v != REDACTED_CREDENTIAL_SENTINEL
+                    }
 
                 if not updates:
                     return JSONResponse(
@@ -726,6 +908,11 @@ def config_set(request: Request, body: AppConfigSetBody):
                     status_code=500,
                 )
 
+            # drop runtime overrides for any fields the user just rewrote in
+            # yaml so a stale override doesn't silently win after restart
+            if request.app.dispatcher is not None:
+                request.app.dispatcher.clear_runtime_state_for_yaml_keys(updates.keys())
+
             if body.requires_restart == 0 or body.update_topic:
                 old_config: FrigateConfig = request.app.frigate_config
                 request.app.frigate_config = config
@@ -739,6 +926,8 @@ def config_set(request: Request, body: AppConfigSetBody):
 
                 if request.app.dispatcher is not None:
                     request.app.dispatcher.config = config
+                    for comm in request.app.dispatcher.comms:
+                        comm.config = config
 
                 if body.update_topic:
                     if body.update_topic.startswith("config/cameras/"):
@@ -835,7 +1024,7 @@ def nvinfo():
 @router.get(
     "/logs/{service}",
     tags=[Tags.logs],
-    dependencies=[Depends(allow_any_authenticated())],
+    dependencies=[Depends(require_role(["admin"]))],
 )
 async def logs(
     service: str = Path(enum=["frigate", "nginx", "go2rtc"]),
@@ -1040,12 +1229,27 @@ def get_media_sync_status(job_id: str):
 
 
 @router.get("/labels", dependencies=[Depends(allow_any_authenticated())])
-def get_labels(camera: str = ""):
+def get_labels(
+    camera: str = "",
+    allowed_cameras: List[str] = Depends(get_allowed_cameras_for_filter),
+):
     try:
         if camera:
+            if camera not in allowed_cameras:
+                return JSONResponse(
+                    content={
+                        "success": False,
+                        "message": f"Access denied to camera '{camera}'",
+                    },
+                    status_code=403,
+                )
             events = Event.select(Event.label).where(Event.camera == camera).distinct()
         else:
-            events = Event.select(Event.label).distinct()
+            events = (
+                Event.select(Event.label)
+                .where(Event.camera << allowed_cameras)
+                .distinct()
+            )
     except Exception as e:
         logger.error(e)
         return JSONResponse(
@@ -1058,9 +1262,16 @@ def get_labels(camera: str = ""):
 
 
 @router.get("/sub_labels", dependencies=[Depends(allow_any_authenticated())])
-def get_sub_labels(split_joined: Optional[int] = None):
+def get_sub_labels(
+    split_joined: Optional[int] = None,
+    allowed_cameras: List[str] = Depends(get_allowed_cameras_for_filter),
+):
     try:
-        events = Event.select(Event.sub_label).distinct()
+        events = (
+            Event.select(Event.sub_label)
+            .where(Event.camera << allowed_cameras)
+            .distinct()
+        )
     except Exception:
         return JSONResponse(
             content=({"success": False, "message": "Failed to get sub_labels"}),

frigate/api/camera.py

@@ -19,7 +19,9 @@ from zeep.exceptions import Fault, TransportError
 from zeep.transports import AsyncTransport
 
 from frigate.api.auth import (
+    _get_stream_owner_cameras,
     allow_any_authenticated,
+    get_current_user,
     require_go2rtc_stream_access,
     require_role,
 )
@@ -31,11 +33,12 @@ from frigate.config.camera.updater import (
     CameraConfigUpdateTopic,
 )
 from frigate.config.env import substitute_frigate_vars
+from frigate.models import User
 from frigate.util.builtin import clean_camera_user_pass
 from frigate.util.camera_cleanup import cleanup_camera_db, cleanup_camera_files
 from frigate.util.config import find_config_file
 from frigate.util.image import run_ffmpeg_snapshot
-from frigate.util.services import ffprobe_stream
+from frigate.util.services import ffprobe_stream, is_restricted_go2rtc_source
 
 logger = logging.getLogger(__name__)
 
@@ -66,7 +69,7 @@ def _is_valid_host(host: str) -> bool:
 
 
 @router.get("/go2rtc/streams", dependencies=[Depends(allow_any_authenticated())])
-def go2rtc_streams():
+async def go2rtc_streams(request: Request):
     r = requests.get("http://127.0.0.1:1984/api/streams")
     if not r.ok:
         logger.error("Failed to fetch streams from go2rtc")
@@ -75,6 +78,24 @@ def go2rtc_streams():
             status_code=500,
         )
     stream_data = r.json()
+
+    # Roles with an explicit camera list see only streams owned by an allowed
+    # camera. Admin and full-access roles (no list / empty list) see all streams.
+    current_user = await get_current_user(request)
+    if not isinstance(current_user, JSONResponse):
+        role = current_user["role"]
+        roles_dict = request.app.frigate_config.auth.roles
+        if role != "admin" and roles_dict.get(role):
+            all_camera_names = set(request.app.frigate_config.cameras.keys())
+            allowed_cameras = set(
+                User.get_allowed_cameras(role, roles_dict, all_camera_names)
+            )
+            stream_data = {
+                name: data
+                for name, data in stream_data.items()
+                if _get_stream_owner_cameras(request, name) & allowed_cameras
+            }
+
     for data in stream_data.values():
         for producer in data.get("producers") or []:
             producer["url"] = clean_camera_user_pass(producer.get("url", ""))
@@ -126,9 +147,24 @@ def go2rtc_add_stream(request: Request, stream_name: str, src: str = ""):
         params = {"name": stream_name}
         if src:
             try:
-                params["src"] = substitute_frigate_vars(src)
+                resolved_src = substitute_frigate_vars(src)
             except KeyError:
-                params["src"] = src
+                resolved_src = src
+
+            if is_restricted_go2rtc_source(resolved_src):
+                logger.warning(
+                    "Rejected go2rtc stream '%s' with restricted source type (echo/expr/exec)",
+                    stream_name,
+                )
+                return JSONResponse(
+                    content={
+                        "success": False,
+                        "message": "Restricted stream source type",
+                    },
+                    status_code=400,
+                )
+
+            params["src"] = resolved_src
 
         r = requests.put(
             "http://127.0.0.1:1984/api/streams",
@@ -493,6 +529,68 @@ def _extract_fps(r_frame_rate: str) -> float | None:
         return None
 
 
+def _build_digest_transport(username: str, password: str) -> AsyncTransport:
+    """Build a zeep transport backed by an httpx client using HTTP digest auth."""
+    auth = httpx.DigestAuth(username, password)
+    client = httpx.AsyncClient(auth=auth, timeout=10.0)
+    return AsyncTransport(client=client)
+
+
+async def _connect_onvif_camera(
+    host: str,
+    port: int,
+    username: str,
+    password: str,
+    wsdl_base: str | None,
+    auth_type: str,
+) -> ONVIFCamera:
+    """Connect to an ONVIF device, trying both WS-Security password encodings.
+
+    Cameras disagree on whether the WS-Security UsernameToken should carry a
+    hashed PasswordDigest or a plaintext PasswordText. The wizard can't know
+    which a given camera expects, so we try PasswordDigest first (the common
+    case) and fall back to PasswordText when the device rejects the token. This
+    is independent of auth_type, which controls HTTP transport-level auth.
+    """
+    first_error: Fault | None = None
+
+    # encrypt=True -> PasswordDigest, encrypt=False -> PasswordText
+    for encrypt in (True, False):
+        onvif_camera = ONVIFCamera(
+            host,
+            port,
+            username or "",
+            password or "",
+            wsdl_dir=wsdl_base,
+            encrypt=encrypt,
+        )
+
+        try:
+            await onvif_camera.update_xaddrs()
+        except Fault as e:
+            # A SOAP fault here is how a camera signals the wrong password
+            # encoding, so retry with the other encoding before giving up.
+            logger.debug(
+                "ONVIF connect with %s rejected, trying alternate encoding",
+                "PasswordDigest" if encrypt else "PasswordText",
+            )
+            if first_error is None:
+                first_error = e
+            continue
+
+        if auth_type == "digest" and username and password:
+            transport = _build_digest_transport(username, password)
+            for service in ("devicemgmt", "media", "ptz"):
+                if hasattr(onvif_camera, service):
+                    getattr(onvif_camera, service).zeep_client.transport = transport
+            logger.debug("Configured digest authentication")
+
+        return onvif_camera
+
+    # Both encodings failed authentication; surface the original fault.
+    raise first_error
+
+
 @router.get(
     "/onvif/probe",
     dependencies=[Depends(require_role(["admin"]))],
@@ -569,34 +667,10 @@ async def onvif_probe(
         except Exception:
             wsdl_base = None
 
-        onvif_camera = ONVIFCamera(
-            host, port, username or "", password or "", wsdl_dir=wsdl_base
+        onvif_camera = await _connect_onvif_camera(
+            host, port, username, password, wsdl_base, auth_type
         )
 
-        # Configure digest authentication if requested
-        if auth_type == "digest" and username and password:
-            # Create httpx client with digest auth
-            auth = httpx.DigestAuth(username, password)
-            client = httpx.AsyncClient(auth=auth, timeout=10.0)
-
-            # Replace the transport in the zeep client
-            transport = AsyncTransport(client=client)
-
-            # Update the xaddr before setting transport
-            await onvif_camera.update_xaddrs()
-
-            # Replace transport in all services
-            if hasattr(onvif_camera, "devicemgmt"):
-                onvif_camera.devicemgmt.zeep_client.transport = transport
-            if hasattr(onvif_camera, "media"):
-                onvif_camera.media.zeep_client.transport = transport
-            if hasattr(onvif_camera, "ptz"):
-                onvif_camera.ptz.zeep_client.transport = transport
-
-            logger.debug("Configured digest authentication")
-        else:
-            await onvif_camera.update_xaddrs()
-
         # Get device information
         device_info = {
             "manufacturer": "Unknown",
@@ -608,10 +682,9 @@ async def onvif_probe(
 
             # Update transport for device service if digest auth
             if auth_type == "digest" and username and password:
-                auth = httpx.DigestAuth(username, password)
-                client = httpx.AsyncClient(auth=auth, timeout=10.0)
-                transport = AsyncTransport(client=client)
-                device_service.zeep_client.transport = transport
+                device_service.zeep_client.transport = _build_digest_transport(
+                    username, password
+                )
 
             device_info_resp = await device_service.GetDeviceInformation()
             manufacturer = getattr(device_info_resp, "Manufacturer", None) or (
@@ -649,10 +722,9 @@ async def onvif_probe(
 
             # Update transport for media service if digest auth
             if auth_type == "digest" and username and password:
-                auth = httpx.DigestAuth(username, password)
-                client = httpx.AsyncClient(auth=auth, timeout=10.0)
-                transport = AsyncTransport(client=client)
-                media_service.zeep_client.transport = transport
+                media_service.zeep_client.transport = _build_digest_transport(
+                    username, password
+                )
 
             profiles = await media_service.GetProfiles()
             profiles_count = len(profiles) if profiles else 0
@@ -684,10 +756,9 @@ async def onvif_probe(
 
             # Update transport for PTZ service if digest auth
             if auth_type == "digest" and username and password:
-                auth = httpx.DigestAuth(username, password)
-                client = httpx.AsyncClient(auth=auth, timeout=10.0)
-                transport = AsyncTransport(client=client)
-                ptz_service.zeep_client.transport = transport
+                ptz_service.zeep_client.transport = _build_digest_transport(
+                    username, password
+                )
 
             # Check if PTZ service is available
             try:
@@ -840,10 +911,9 @@ async def onvif_probe(
 
             # Update transport for media service if digest auth
             if auth_type == "digest" and username and password:
-                auth = httpx.DigestAuth(username, password)
-                client = httpx.AsyncClient(auth=auth, timeout=10.0)
-                transport = AsyncTransport(client=client)
-                media_service.zeep_client.transport = transport
+                media_service.zeep_client.transport = _build_digest_transport(
+                    username, password
+                )
 
             if profiles_count and media_service:
                 for p in profiles or []:
@@ -966,7 +1036,6 @@ async def onvif_probe(
                         probe = ffprobe_stream(
                             request.app.frigate_config.ffmpeg, test_uri, detailed=False
                         )
-                        print(probe)
                         ok = probe is not None and getattr(probe, "returncode", 1) == 0
                         tested_candidates.append(
                             {

frigate/api/chat.py

@@ -10,7 +10,7 @@ from functools import reduce
 from typing import Any, Dict, List, Optional
 
 import cv2
-from fastapi import APIRouter, Body, Depends, Request
+from fastapi import APIRouter, Body, Depends, HTTPException, Request
 from fastapi.responses import JSONResponse, StreamingResponse
 from pydantic import BaseModel
 
@@ -35,9 +35,13 @@ from frigate.api.defs.response.chat_response import (
     ToolCall,
 )
 from frigate.api.defs.tags import Tags
-from frigate.api.event import events
+from frigate.api.event import _build_attribute_filter_clause, events
 from frigate.config import FrigateConfig
-from frigate.config.ui import UnitSystemEnum
+from frigate.genai.prompts import (
+    build_chat_system_prompt,
+    get_attribute_classifications,
+    get_tool_definitions,
+)
 from frigate.genai.utils import build_assistant_message_for_conversation
 from frigate.jobs.vlm_watch import (
     get_vlm_watch_job,
@@ -68,338 +72,21 @@ class VLMMonitorRequest(BaseModel):
     zones: List[str] = []
 
 
-def get_tool_definitions() -> List[Dict[str, Any]]:
-    """
-    Get OpenAI-compatible tool definitions for Frigate.
-
-    Returns a list of tool definitions that can be used with OpenAI-compatible
-    function calling APIs.
-    """
-    return [
-        {
-            "type": "function",
-            "function": {
-                "name": "search_objects",
-                "description": (
-                    "Search the historical record of detected objects in Frigate. "
-                    "Use this ONLY for questions about the PAST — e.g. 'did anyone come by today?', "
-                    "'when was the last car?', 'show me detections from yesterday'. "
-                    "Do NOT use this for monitoring or alerting requests about future events — "
-                    "use start_camera_watch instead for those. "
-                    "An 'object' in Frigate represents a tracked detection (e.g., a person, package, car). "
-                    "When the user asks about a specific name (person, delivery company, animal, etc.), "
-                    "filter by sub_label only and do not set label."
-                ),
-                "parameters": {
-                    "type": "object",
-                    "properties": {
-                        "camera": {
-                            "type": "string",
-                            "description": "Camera name to filter by (optional).",
-                        },
-                        "label": {
-                            "type": "string",
-                            "description": "Object label to filter by (e.g., 'person', 'package', 'car').",
-                        },
-                        "sub_label": {
-                            "type": "string",
-                            "description": "Name of a person, delivery company, animal, etc. When filtering by a specific name, use only sub_label; do not set label.",
-                        },
-                        "after": {
-                            "type": "string",
-                            "description": "Start time in ISO 8601 format (e.g., '2024-01-01T00:00:00Z').",
-                        },
-                        "before": {
-                            "type": "string",
-                            "description": "End time in ISO 8601 format (e.g., '2024-01-01T23:59:59Z').",
-                        },
-                        "zones": {
-                            "type": "array",
-                            "items": {"type": "string"},
-                            "description": "List of zone names to filter by.",
-                        },
-                        "limit": {
-                            "type": "integer",
-                            "description": "Maximum number of objects to return (default: 25).",
-                            "default": 25,
-                        },
-                    },
-                },
-                "required": [],
-            },
-        },
-        {
-            "type": "function",
-            "function": {
-                "name": "find_similar_objects",
-                "description": (
-                    "Find tracked objects that are visually and semantically similar "
-                    "to a specific past event. Use this when the user references a "
-                    "particular object they have seen and wants to find other "
-                    "sightings of the same or similar one ('that green car', 'the "
-                    "person in the red jacket', 'the package that was delivered'). "
-                    "Prefer this over search_objects whenever the user's intent is "
-                    "'find more like this specific one.' Use search_objects first "
-                    "only if you need to locate the anchor event. Requires semantic "
-                    "search to be enabled."
-                ),
-                "parameters": {
-                    "type": "object",
-                    "properties": {
-                        "event_id": {
-                            "type": "string",
-                            "description": "The id of the anchor event to find similar objects to.",
-                        },
-                        "after": {
-                            "type": "string",
-                            "description": "Start time in ISO 8601 format (e.g., '2024-01-01T00:00:00Z').",
-                        },
-                        "before": {
-                            "type": "string",
-                            "description": "End time in ISO 8601 format (e.g., '2024-01-01T23:59:59Z').",
-                        },
-                        "cameras": {
-                            "type": "array",
-                            "items": {"type": "string"},
-                            "description": "Optional list of cameras to restrict to. Defaults to all.",
-                        },
-                        "labels": {
-                            "type": "array",
-                            "items": {"type": "string"},
-                            "description": "Optional list of labels to restrict to. Defaults to the anchor event's label.",
-                        },
-                        "sub_labels": {
-                            "type": "array",
-                            "items": {"type": "string"},
-                            "description": "Optional list of sub_labels (names) to restrict to.",
-                        },
-                        "zones": {
-                            "type": "array",
-                            "items": {"type": "string"},
-                            "description": "Optional list of zones. An event matches if any of its zones overlap.",
-                        },
-                        "similarity_mode": {
-                            "type": "string",
-                            "enum": ["visual", "semantic", "fused"],
-                            "description": "Which similarity signal(s) to use. 'fused' (default) combines visual and semantic.",
-                            "default": "fused",
-                        },
-                        "min_score": {
-                            "type": "number",
-                            "description": "Drop matches with a similarity score below this threshold (0.0-1.0).",
-                        },
-                        "limit": {
-                            "type": "integer",
-                            "description": "Maximum number of matches to return (default: 10).",
-                            "default": 10,
-                        },
-                    },
-                    "required": ["event_id"],
-                },
-            },
-        },
-        {
-            "type": "function",
-            "function": {
-                "name": "set_camera_state",
-                "description": (
-                    "Change a camera's feature state (e.g., turn detection on/off, enable/disable recordings). "
-                    "Use camera='*' to apply to all cameras at once. "
-                    "Only call this tool when the user explicitly asks to change a camera setting. "
-                    "Requires admin privileges."
-                ),
-                "parameters": {
-                    "type": "object",
-                    "properties": {
-                        "camera": {
-                            "type": "string",
-                            "description": "Camera name to target, or '*' to target all cameras.",
-                        },
-                        "feature": {
-                            "type": "string",
-                            "enum": [
-                                "detect",
-                                "record",
-                                "snapshots",
-                                "audio",
-                                "motion",
-                                "enabled",
-                                "birdseye",
-                                "birdseye_mode",
-                                "improve_contrast",
-                                "ptz_autotracker",
-                                "motion_contour_area",
-                                "motion_threshold",
-                                "notifications",
-                                "audio_transcription",
-                                "review_alerts",
-                                "review_detections",
-                                "object_descriptions",
-                                "review_descriptions",
-                                "profile",
-                            ],
-                            "description": (
-                                "The feature to change. Most features accept ON or OFF. "
-                                "birdseye_mode accepts CONTINUOUS, MOTION, or OBJECTS. "
-                                "motion_contour_area and motion_threshold accept a number. "
-                                "profile accepts a profile name or 'none' to deactivate (requires camera='*')."
-                            ),
-                        },
-                        "value": {
-                            "type": "string",
-                            "description": "The value to set. ON or OFF for toggles, a number for thresholds, a profile name or 'none' for profile.",
-                        },
-                    },
-                    "required": ["camera", "feature", "value"],
-                },
-            },
-        },
-        {
-            "type": "function",
-            "function": {
-                "name": "get_live_context",
-                "description": (
-                    "Get the current live image and detection information for a camera: objects being tracked, "
-                    "zones, timestamps. Use this to understand what is visible in the live view. "
-                    "Call this when answering questions about what is happening right now on a specific camera."
-                ),
-                "parameters": {
-                    "type": "object",
-                    "properties": {
-                        "camera": {
-                            "type": "string",
-                            "description": "Camera name to get live context for.",
-                        },
-                    },
-                    "required": ["camera"],
-                },
-            },
-        },
-        {
-            "type": "function",
-            "function": {
-                "name": "start_camera_watch",
-                "description": (
-                    "Start a continuous VLM watch job that monitors a camera and sends a notification "
-                    "when a specified condition is met. Use this when the user wants to be alerted about "
-                    "a future event, e.g. 'tell me when guests arrive' or 'notify me when the package is picked up'. "
-                    "Only one watch job can run at a time. Returns a job ID."
-                ),
-                "parameters": {
-                    "type": "object",
-                    "properties": {
-                        "camera": {
-                            "type": "string",
-                            "description": "Camera ID to monitor.",
-                        },
-                        "condition": {
-                            "type": "string",
-                            "description": (
-                                "Natural-language description of the condition to watch for, "
-                                "e.g. 'a person arrives at the front door'."
-                            ),
-                        },
-                        "max_duration_minutes": {
-                            "type": "integer",
-                            "description": "Maximum time to watch before giving up (minutes, default 60).",
-                            "default": 60,
-                        },
-                        "labels": {
-                            "type": "array",
-                            "items": {"type": "string"},
-                            "description": "Object labels that should trigger a VLM check (e.g. ['person', 'car']). If omitted, any detection on the camera triggers a check.",
-                        },
-                        "zones": {
-                            "type": "array",
-                            "items": {"type": "string"},
-                            "description": "Zone names to filter by. If specified, only detections in these zones trigger a VLM check.",
-                        },
-                    },
-                    "required": ["camera", "condition"],
-                },
-            },
-        },
-        {
-            "type": "function",
-            "function": {
-                "name": "stop_camera_watch",
-                "description": (
-                    "Cancel the currently running VLM watch job. Use this when the user wants to "
-                    "stop a previously started watch, e.g. 'stop watching the front door'."
-                ),
-                "parameters": {
-                    "type": "object",
-                    "properties": {},
-                    "required": [],
-                },
-            },
-        },
-        {
-            "type": "function",
-            "function": {
-                "name": "get_profile_status",
-                "description": (
-                    "Get the current profile status including the active profile and "
-                    "timestamps of when each profile was last activated. Use this to "
-                    "determine time periods for recap requests — e.g. when the user asks "
-                    "'what happened while I was away?', call this first to find the relevant "
-                    "time window based on profile activation history."
-                ),
-                "parameters": {
-                    "type": "object",
-                    "properties": {},
-                    "required": [],
-                },
-            },
-        },
-        {
-            "type": "function",
-            "function": {
-                "name": "get_recap",
-                "description": (
-                    "Get a recap of all activity (alerts and detections) for a given time period. "
-                    "Use this after calling get_profile_status to retrieve what happened during "
-                    "a specific window — e.g. 'what happened while I was away?'. Returns a "
-                    "chronological list of activity with camera, objects, zones, and GenAI-generated "
-                    "descriptions when available. Summarize the results for the user."
-                ),
-                "parameters": {
-                    "type": "object",
-                    "properties": {
-                        "after": {
-                            "type": "string",
-                            "description": "Start of the time period in ISO 8601 format (e.g. '2025-03-15T08:00:00').",
-                        },
-                        "before": {
-                            "type": "string",
-                            "description": "End of the time period in ISO 8601 format (e.g. '2025-03-15T17:00:00').",
-                        },
-                        "cameras": {
-                            "type": "string",
-                            "description": "Comma-separated camera IDs to include, or 'all' for all cameras. Default is 'all'.",
-                        },
-                        "severity": {
-                            "type": "string",
-                            "enum": ["alert", "detection"],
-                            "description": "Filter by severity level. Omit to include both alerts and detections.",
-                        },
-                    },
-                    "required": ["after", "before"],
-                },
-            },
-        },
-    ]
-
-
 @router.get(
     "/chat/tools",
     dependencies=[Depends(allow_any_authenticated())],
     summary="Get available tools",
     description="Returns OpenAI-compatible tool definitions for function calling.",
 )
-def get_tools() -> JSONResponse:
+def get_tools(request: Request) -> JSONResponse:
     """Get list of available tools for LLM function calling."""
-    tools = get_tool_definitions()
+    config = request.app.frigate_config
+    semantic_search_enabled = bool(getattr(config.semantic_search, "enabled", False))
+    attribute_classifications = get_attribute_classifications(config)
+    tools = get_tool_definitions(
+        semantic_search_enabled=semantic_search_enabled,
+        attribute_classifications=attribute_classifications,
+    )
     return JSONResponse(content={"tools": tools})
 
 
@@ -432,16 +119,29 @@ def _resolve_zones(
 
 
 async def _execute_search_objects(
+    request: Request,
     arguments: Dict[str, Any],
     allowed_cameras: List[str],
-    config: FrigateConfig,
 ) -> JSONResponse:
     """
     Execute the search_objects tool.
 
-    This searches for detected objects (events) in Frigate using the same
-    logic as the events API endpoint.
+    Routes to the semantic path when the LLM supplied a `semantic_query`
+    and semantic search is enabled; otherwise delegates to the standard
+    events API logic.
     """
+    config = request.app.frigate_config
+    semantic_query = arguments.get("semantic_query")
+    if isinstance(semantic_query, str):
+        semantic_query = semantic_query.strip() or None
+    else:
+        semantic_query = None
+
+    if semantic_query and getattr(config.semantic_search, "enabled", False):
+        return await _execute_search_objects_semantic(
+            request, arguments, allowed_cameras, semantic_query
+        )
+
     # Parse after/before as server local time; convert to Unix timestamp
     after = arguments.get("after")
     before = arguments.get("before")
@@ -477,11 +177,14 @@ async def _execute_search_objects(
     elif zones is None:
         zones = "all"
 
+    attribute = arguments.get("attribute")
+
     # Build query parameters compatible with EventsQueryParams
     query_params = EventsQueryParams(
         cameras=arguments.get("camera", "all"),
         labels=arguments.get("label", "all"),
         sub_labels=arguments.get("sub_label", "all"),  # case-insensitive on the backend
+        attributes=attribute if attribute else "all",
         zones=zones,
         zone=zones,
         after=after,
@@ -508,6 +211,124 @@ async def _execute_search_objects(
         )
 
 
+async def _execute_search_objects_semantic(
+    request: Request,
+    arguments: Dict[str, Any],
+    allowed_cameras: List[str],
+    semantic_query: str,
+) -> JSONResponse:
+    """Search objects via fused thumbnail + description embeddings.
+
+    Runs both visual and description vec searches against `semantic_query`,
+    intersects the candidates with the structured filters (camera, label,
+    sub_label, zones, time window) the LLM supplied, and ranks the survivors
+    by fused similarity. Mirrors the candidate-then-filter pattern used by
+    find_similar_objects since sqlite-vec's IN filter is unreliable.
+    """
+    from peewee import fn
+
+    config = request.app.frigate_config
+    context = request.app.embeddings
+    if context is None:
+        logger.warning(
+            "semantic_query supplied but embeddings context is unavailable; "
+            "returning empty results."
+        )
+        return JSONResponse(content=[])
+
+    after = parse_iso_to_timestamp(arguments.get("after"))
+    before = parse_iso_to_timestamp(arguments.get("before"))
+
+    camera_arg = arguments.get("camera")
+    if camera_arg and camera_arg != "all":
+        if camera_arg not in allowed_cameras:
+            return JSONResponse(content=[])
+        cameras = [camera_arg]
+    else:
+        cameras = list(allowed_cameras) if allowed_cameras else []
+
+    if not cameras:
+        return JSONResponse(content=[])
+
+    label = arguments.get("label")
+    sub_label = arguments.get("sub_label")
+    attribute = arguments.get("attribute")
+
+    zones = arguments.get("zones")
+    if isinstance(zones, list) and zones:
+        zones = _resolve_zones(zones, config, cameras)
+    else:
+        zones = None
+
+    limit = int(arguments.get("limit", 25))
+    limit = max(1, min(limit, 100))
+
+    visual_distances: Dict[str, float] = {}
+    description_distances: Dict[str, float] = {}
+    try:
+        rows = context.search_thumbnail(semantic_query)
+        visual_distances = {row[0]: row[1] for row in rows}
+    except Exception:
+        logger.exception(
+            "search_thumbnail failed for semantic_query: %s", semantic_query
+        )
+
+    try:
+        rows = context.search_description(semantic_query)
+        description_distances = {row[0]: row[1] for row in rows}
+    except Exception:
+        logger.exception(
+            "search_description failed for semantic_query: %s", semantic_query
+        )
+
+    vec_ids = set(visual_distances) | set(description_distances)
+    if not vec_ids:
+        return JSONResponse(content=[])
+
+    clauses = [Event.id.in_(list(vec_ids)), Event.camera.in_(cameras)]
+    if after is not None:
+        clauses.append(Event.start_time >= after)
+    if before is not None:
+        clauses.append(Event.start_time <= before)
+    if label:
+        clauses.append(Event.label == label)
+    if sub_label:
+        # case-insensitive match to mirror events() behavior
+        clauses.append(fn.LOWER(Event.sub_label.cast("text")) == sub_label.lower())
+    if attribute:
+        attribute_clause = _build_attribute_filter_clause(attribute)
+        if attribute_clause is not None:
+            clauses.append(attribute_clause)
+    if zones:
+        zone_clauses = [Event.zones.cast("text") % f'*"{zone}"*' for zone in zones]
+        clauses.append(reduce(operator.or_, zone_clauses))
+
+    eligible = {e.id: e for e in Event.select().where(reduce(operator.and_, clauses))}
+
+    scored: List[tuple[str, float]] = []
+    for eid in eligible:
+        v_score = (
+            distance_to_score(visual_distances[eid], context.thumb_stats)
+            if eid in visual_distances
+            else None
+        )
+        d_score = (
+            distance_to_score(description_distances[eid], context.desc_stats)
+            if eid in description_distances
+            else None
+        )
+        fused = fuse_scores(v_score, d_score)
+        if fused is None:
+            continue
+        scored.append((eid, fused))
+
+    scored.sort(key=lambda pair: pair[1], reverse=True)
+    scored = scored[:limit]
+
+    results = [hydrate_event(eligible[eid], score=score) for eid, score in scored]
+    return JSONResponse(content=results)
+
+
 async def _execute_find_similar_objects(
     request: Request,
     arguments: Dict[str, Any],
@@ -696,9 +517,7 @@ async def execute_tool(
     logger.debug(f"Executing tool: {tool_name} with arguments: {arguments}")
 
     if tool_name == "search_objects":
-        return await _execute_search_objects(
-            arguments, allowed_cameras, request.app.frigate_config
-        )
+        return await _execute_search_objects(request, arguments, allowed_cameras)
 
     if tool_name == "find_similar_objects":
         result = await _execute_find_similar_objects(
@@ -728,9 +547,21 @@ async def _execute_get_live_context(
     camera: str,
     allowed_cameras: List[str],
 ) -> Dict[str, Any]:
+    # Reject wildcards explicitly so models retry with a real camera name
+    # instead of silently fanning out across every camera.
+    if camera in ("*", "all"):
+        return {
+            "error": (
+                "get_live_context requires a single camera name; wildcards "
+                "are not supported. Call this tool once per camera."
+            ),
+            "available_cameras": allowed_cameras,
+        }
+
     if camera not in allowed_cameras:
         return {
             "error": f"Camera '{camera}' not found or access denied",
+            "available_cameras": allowed_cameras,
         }
 
     if camera not in request.app.frigate_config.cameras:
@@ -878,9 +709,7 @@ async def _execute_tool_internal(
     This is used by the chat completion endpoint to execute tools.
     """
     if tool_name == "search_objects":
-        response = await _execute_search_objects(
-            arguments, allowed_cameras, request.app.frigate_config
-        )
+        response = await _execute_search_objects(request, arguments, allowed_cameras)
         try:
             if hasattr(response, "body"):
                 body_str = response.body.decode("utf-8")
@@ -904,7 +733,14 @@ async def _execute_tool_internal(
                 "Arguments: %s",
                 json.dumps(arguments),
             )
-            return {"error": "Camera parameter is required"}
+            return {
+                "error": (
+                    "get_live_context requires a single camera name; "
+                    "wildcards and empty values are not supported. "
+                    "Call this tool once per camera."
+                ),
+                "available_cameras": allowed_cameras,
+            }
         return await _execute_get_live_context(request, camera, allowed_cameras)
     elif tool_name == "start_camera_watch":
         return await _execute_start_camera_watch(request, arguments)
@@ -1293,64 +1129,21 @@ async def chat_completion(
             status_code=400,
         )
 
-    tools = get_tool_definitions()
+    config = request.app.frigate_config
+    semantic_search_enabled = bool(getattr(config.semantic_search, "enabled", False))
+    attribute_classifications = get_attribute_classifications(config)
+    tools = get_tool_definitions(
+        semantic_search_enabled=semantic_search_enabled,
+        attribute_classifications=attribute_classifications,
+    )
     conversation = []
 
-    current_datetime = datetime.now()
-    current_date_str = current_datetime.strftime("%Y-%m-%d")
-    current_time_str = current_datetime.strftime("%I:%M:%S %p")
-
-    cameras_info = []
-    config = request.app.frigate_config
-    has_speed_zone = False
-    for camera_id in allowed_cameras:
-        if camera_id not in config.cameras:
-            continue
-        camera_config = config.cameras[camera_id]
-        friendly_name = (
-            camera_config.friendly_name
-            if camera_config.friendly_name
-            else camera_id.replace("_", " ").title()
-        )
-        zone_names = list(camera_config.zones.keys())
-        if not has_speed_zone:
-            has_speed_zone = any(
-                zone.distances for zone in camera_config.zones.values()
-            )
-        if zone_names:
-            cameras_info.append(
-                f"  - {friendly_name} (ID: {camera_id}, zones: {', '.join(zone_names)})"
-            )
-        else:
-            cameras_info.append(f"  - {friendly_name} (ID: {camera_id})")
-
-    cameras_section = ""
-    if cameras_info:
-        cameras_section = (
-            "\n\nAvailable cameras:\n"
-            + "\n".join(cameras_info)
-            + "\n\nWhen users refer to cameras by their friendly name (e.g., 'Back Deck Camera'), use the corresponding camera ID (e.g., 'back_deck_cam') in tool calls."
-        )
-
-    speed_units_section = ""
-    if has_speed_zone:
-        speed_unit = (
-            "mph" if config.ui.unit_system == UnitSystemEnum.imperial else "km/h"
-        )
-        speed_units_section = f"\n\nReport object speeds to the user in {speed_unit}."
-
-    system_prompt = f"""You are a helpful assistant for Frigate, a security camera NVR system. You help users answer questions about their cameras, detected objects, and events.
-
-Current server local date and time: {current_date_str} at {current_time_str}
-
-Do not start your response with phrases like "I will check...", "Let me see...", or "Let me look...". Answer directly.
-
-Always present times to the user in the server's local timezone. When tool results include start_time_local and end_time_local, use those exact strings when listing or describing detection times—do not convert or invent timestamps. Do not use UTC or ISO format with Z for the user-facing answer unless the tool result only provides Unix timestamps without local time fields.
-When users ask about "today", "yesterday", "this week", etc., use the current date above as reference.
-When searching for objects or events, use ISO 8601 format for dates (e.g., {current_date_str}T00:00:00Z for the start of today).
-Always be accurate with time calculations based on the current date provided.
-
-When a user refers to a specific object they have seen or describe with identifying details ("that green car", "the person in the red jacket", "a package left today"), prefer the find_similar_objects tool over search_objects. Use search_objects first only to locate the anchor event, then pass its id to find_similar_objects. For generic queries like "show me all cars today", keep using search_objects. If a user message begins with [attached_event:<id>], treat that event id as the anchor for any similarity or "tell me more" request in the same message and call find_similar_objects with that id.{cameras_section}{speed_units_section}"""
+    system_prompt = build_chat_system_prompt(
+        config=config,
+        allowed_cameras=allowed_cameras,
+        semantic_search_enabled=semantic_search_enabled,
+        attribute_classifications=attribute_classifications,
+    )
 
     conversation.append(
         {
@@ -1399,6 +1192,7 @@ When a user refers to a specific object they have seen or describe with identify
                     messages=conversation,
                     tools=tools if tools else None,
                     tool_choice="auto",
+                    enable_thinking=body.enable_thinking,
                 ):
                     if await request.is_disconnected():
                         logger.debug("Client disconnected, stopping chat stream")
@@ -1411,6 +1205,18 @@ When a user refers to a specific object they have seen or describe with identify
                             )
                             + b"\n"
                         )
+                    elif kind == "reasoning_delta":
+                        yield (
+                            json.dumps({"type": "reasoning", "delta": value}).encode(
+                                "utf-8"
+                            )
+                            + b"\n"
+                        )
+                    elif kind == "stats":
+                        yield (
+                            json.dumps({"type": "stats", **value}).encode("utf-8")
+                            + b"\n"
+                        )
                     elif kind == "message":
                         msg = value
                         if msg.get("finish_reason") == "error":
@@ -1481,6 +1287,7 @@ When a user refers to a specific object they have seen or describe with identify
                 messages=conversation,
                 tools=tools if tools else None,
                 tool_choice="auto",
+                enable_thinking=body.enable_thinking,
             )
 
             if response.get("finish_reason") == "error":
@@ -1506,6 +1313,7 @@ When a user refers to a specific object they have seen or describe with identify
                 final_content = response.get("content") or ""
 
                 if body.stream:
+                    final_reasoning = response.get("reasoning")
 
                     async def stream_body() -> Any:
                         if tool_calls:
@@ -1520,6 +1328,15 @@ When a user refers to a specific object they have seen or describe with identify
                                 ).encode("utf-8")
                                 + b"\n"
                             )
+                        # Emit the full reasoning trace up front when the
+                        # underlying client did not stream it
+                        if final_reasoning:
+                            yield (
+                                json.dumps(
+                                    {"type": "reasoning", "delta": final_reasoning}
+                                ).encode("utf-8")
+                                + b"\n"
+                            )
                         # Stream content in word-sized chunks for smooth UX
                         for part in chunk_content(final_content):
                             yield (
@@ -1540,6 +1357,7 @@ When a user refers to a specific object they have seen or describe with identify
                         message=ChatMessageResponse(
                             role="assistant",
                             content=final_content,
+                            reasoning=response.get("reasoning"),
                             tool_calls=None,
                         ),
                         finish_reason=response.get("finish_reason", "stop"),
@@ -1641,6 +1459,7 @@ async def start_vlm_monitor(
             dispatcher=request.app.dispatcher,
             labels=body.labels,
             zones=body.zones,
+            username=request.headers.get("remote-user", ""),
         )
     except RuntimeError as e:
         logger.error("Failed to start VLM watch job: %s", e, exc_info=True)
@@ -1661,10 +1480,22 @@ async def start_vlm_monitor(
     summary="Get current VLM watch job",
     description="Returns the current (or most recently completed) VLM watch job.",
 )
-async def get_vlm_monitor() -> JSONResponse:
+async def get_vlm_monitor(request: Request) -> JSONResponse:
     job = get_vlm_watch_job()
     if job is None:
         return JSONResponse(content={"active": False}, status_code=200)
+
+    role = request.headers.get("remote-role", "viewer")
+    username = request.headers.get("remote-user", "")
+
+    # Admin and the job's creator always see the job. Other users only see it
+    # if they have access to the camera being watched; otherwise hide it.
+    if role != "admin" and username != job.username:
+        try:
+            await require_camera_access(job.camera, request=request)
+        except HTTPException:
+            return JSONResponse(content={"active": False}, status_code=200)
+
     return JSONResponse(content={"active": True, **job.to_dict()}, status_code=200)
 
 
@@ -1674,7 +1505,27 @@ async def get_vlm_monitor() -> JSONResponse:
     summary="Cancel the current VLM watch job",
     description="Cancels the running watch job if one exists.",
 )
-async def cancel_vlm_monitor() -> JSONResponse:
+async def cancel_vlm_monitor(request: Request) -> JSONResponse:
+    job = get_vlm_watch_job()
+    if job is None:
+        return JSONResponse(
+            content={"success": False, "message": "No active watch job to cancel."},
+            status_code=404,
+        )
+
+    role = request.headers.get("remote-role", "viewer")
+    username = request.headers.get("remote-user", "")
+
+    # Admin can cancel any job; other users can only cancel jobs they started.
+    if role != "admin" and username != job.username:
+        return JSONResponse(
+            content={
+                "success": False,
+                "message": "Not authorized to cancel this watch job.",
+            },
+            status_code=403,
+        )
+
     cancelled = stop_vlm_watch_job()
     if not cancelled:
         return JSONResponse(

frigate/api/classification.py

@@ -280,7 +280,7 @@ async def create_face(request: Request, name: str):
     success response with details about the registration, or an error if face recognition
     is not enabled or the image cannot be processed.""",
 )
-async def register_face(request: Request, name: str, file: UploadFile):
+def register_face(request: Request, name: str, file: UploadFile):
     if not request.app.frigate_config.face_recognition.enabled:
         return JSONResponse(
             status_code=400,
@@ -288,7 +288,7 @@ async def register_face(request: Request, name: str, file: UploadFile):
         )
 
     context: EmbeddingsContext = request.app.embeddings
-    result = None if context is None else context.register_face(name, await file.read())
+    result = None if context is None else context.register_face(name, file.file.read())
 
     if not isinstance(result, dict):
         return JSONResponse(
@@ -313,7 +313,7 @@ async def register_face(request: Request, name: str, file: UploadFile):
     registered faces in the system. Returns the recognized face name and confidence score,
     or an error if face recognition is not enabled or the image cannot be processed.""",
 )
-async def recognize_face(request: Request, file: UploadFile):
+def recognize_face(request: Request, file: UploadFile):
     if not request.app.frigate_config.face_recognition.enabled:
         return JSONResponse(
             status_code=400,
@@ -321,7 +321,7 @@ async def recognize_face(request: Request, file: UploadFile):
         )
 
     context: EmbeddingsContext = request.app.embeddings
-    result = context.recognize_face(await file.read())
+    result = context.recognize_face(file.file.read())
 
     if not isinstance(result, dict):
         return JSONResponse(

frigate/api/debug_replay.py

@@ -6,11 +6,18 @@ from datetime import datetime
 
 from fastapi import APIRouter, Depends, Request
 from fastapi.responses import JSONResponse
+from peewee import DoesNotExist
 from pydantic import BaseModel, Field
 
 from frigate.api.auth import require_role
 from frigate.api.defs.tags import Tags
-from frigate.jobs.debug_replay import start_debug_replay_job
+from frigate.jobs.debug_replay import (
+    ExportDebugReplaySource,
+    RecordingDebugReplaySource,
+    start_debug_replay_job,
+)
+from frigate.models import Export
+from frigate.util.services import get_video_properties
 
 logger = logging.getLogger(__name__)
 
@@ -25,6 +32,12 @@ class DebugReplayStartBody(BaseModel):
     end_time: float = Field(title="End timestamp")
 
 
+class DebugReplayStartFromExportBody(BaseModel):
+    """Request body for starting a debug replay session from an export."""
+
+    export_id: str = Field(title="Export id")
+
+
 class DebugReplayStartResponse(BaseModel):
     """Response for starting a debug replay session."""
 
@@ -73,13 +86,100 @@ class DebugReplayStopResponse(BaseModel):
 async def start_debug_replay(request: Request, body: DebugReplayStartBody):
     """Start a debug replay session asynchronously."""
     replay_manager = request.app.replay_manager
+    internal_port = request.app.frigate_config.networking.listen.internal
+    if type(internal_port) is str:
+        internal_port = int(internal_port.split(":")[-1])
+
+    source = RecordingDebugReplaySource(
+        source_camera=body.camera,
+        start_ts=body.start_time,
+        end_ts=body.end_time,
+        internal_port=internal_port,
+    )
 
     try:
         job_id = await asyncio.to_thread(
             start_debug_replay_job,
-            source_camera=body.camera,
-            start_ts=body.start_time,
-            end_ts=body.end_time,
+            source=source,
+            frigate_config=request.app.frigate_config,
+            config_publisher=request.app.config_publisher,
+            replay_manager=replay_manager,
+        )
+    except RuntimeError:
+        return JSONResponse(
+            content={
+                "success": False,
+                "message": "A replay session is already active",
+            },
+            status_code=409,
+        )
+    except ValueError:
+        logger.exception("Rejected debug replay start request")
+        return JSONResponse(
+            content={
+                "success": False,
+                "message": "Invalid debug replay parameters",
+            },
+            status_code=400,
+        )
+
+    return JSONResponse(
+        content={
+            "success": True,
+            "replay_camera": replay_manager.replay_camera_name,
+            "job_id": job_id,
+        },
+        status_code=202,
+    )
+
+
+@router.post(
+    "/debug_replay/start_from_export",
+    response_model=DebugReplayStartResponse,
+    status_code=202,
+    responses={
+        400: {"description": "Invalid export, time range, or no recordings"},
+        404: {"description": "Export not found"},
+        409: {"description": "A replay session is already active"},
+    },
+    dependencies=[Depends(require_role(["admin"]))],
+    summary="Start debug replay from an export",
+    description="Start a debug replay session covering an existing export's "
+    "time range. The end time is derived from the export's video duration.",
+)
+async def start_debug_replay_from_export(
+    request: Request, body: DebugReplayStartFromExportBody
+):
+    """Start a debug replay session from an existing export."""
+    try:
+        export: Export = Export.get(Export.id == body.export_id)
+    except DoesNotExist:
+        return JSONResponse(
+            content={"success": False, "message": "Export not found"},
+            status_code=404,
+        )
+
+    properties = await get_video_properties(
+        request.app.frigate_config.ffmpeg, export.video_path, get_duration=True
+    )
+    duration = properties.get("duration", -1)
+
+    if duration is None or duration <= 0:
+        return JSONResponse(
+            content={
+                "success": False,
+                "message": "Could not determine export duration",
+            },
+            status_code=400,
+        )
+
+    replay_manager = request.app.replay_manager
+    source = ExportDebugReplaySource(export=export, duration=float(duration))
+
+    try:
+        job_id = await asyncio.to_thread(
+            start_debug_replay_job,
+            source=source,
             frigate_config=request.app.frigate_config,
             config_publisher=request.app.config_publisher,
             replay_manager=replay_manager,

frigate/api/defs/request/app_body.py

@@ -2,6 +2,8 @@ from typing import Any, Dict, List, Optional
 
 from pydantic import BaseModel, Field
 
+from frigate.config import GenAIProviderEnum
+
 
 class AppConfigSetBody(BaseModel):
     requires_restart: int = 1
@@ -10,6 +12,13 @@ class AppConfigSetBody(BaseModel):
     skip_save: bool = False
 
 
+class GenAIProbeBody(BaseModel):
+    provider: GenAIProviderEnum
+    api_key: Optional[str] = None
+    base_url: Optional[str] = None
+    provider_options: Dict[str, Any] = Field(default_factory=dict)
+
+
 class AppPutPasswordBody(BaseModel):
     password: str
     old_password: Optional[str] = None

frigate/api/defs/request/chat_body.py

@@ -36,3 +36,10 @@ class ChatCompletionRequest(BaseModel):
         default=False,
         description="If true, stream the final assistant response in the body as newline-delimited JSON.",
     )
+    enable_thinking: Optional[bool] = Field(
+        default=None,
+        description=(
+            "Per-request thinking toggle. None means use the provider default. "
+            "Ignored by providers that do not expose a per-request thinking switch."
+        ),
+    )

frigate/api/defs/response/chat_response.py

@@ -20,6 +20,10 @@ class ChatMessageResponse(BaseModel):
     content: Optional[str] = Field(
         default=None, description="Message content (None if tool calls present)"
     )
+    reasoning: Optional[str] = Field(
+        default=None,
+        description="Separated reasoning/thinking trace if the model emitted one",
+    )
     tool_calls: Optional[list[ToolCallInvocation]] = Field(
         default=None, description="Tool calls if LLM wants to call tools"
     )

frigate/api/export.py

@@ -398,7 +398,7 @@ class _StreamingZipBuffer:
 def _unique_archive_name(export: Export, used: set[str]) -> str:
     base = sanitize_filename(export.name) if export.name else None
     if not base:
-        base = f"{export.camera}_{int(datetime.datetime.timestamp(export.date))}"
+        base = f"{export.camera}_{int(export.date)}"
 
     candidate = f"{base}.mp4"
     counter = 1

frigate/api/fastapi_app.py

@@ -1,3 +1,4 @@
+import asyncio
 import logging
 import re
 from typing import Optional
@@ -36,7 +37,7 @@ from frigate.comms.event_metadata_updater import (
 from frigate.config import FrigateConfig
 from frigate.config.camera.updater import CameraConfigUpdatePublisher
 from frigate.config.profile_manager import ProfileManager
-from frigate.debug_replay import DebugReplayManager
+from frigate.debug_replay import DebugReplayManager, debug_replay_auto_stop_watchdog
 from frigate.embeddings import EmbeddingsContext
 from frigate.genai import GenAIClientManager
 from frigate.ptz.onvif import OnvifController
@@ -116,6 +117,11 @@ def create_fastapi_app(
     @app.on_event("startup")
     async def startup():
         logger.info("FastAPI started")
+        asyncio.create_task(
+            debug_replay_auto_stop_watchdog(
+                replay_manager, frigate_config, config_publisher
+            )
+        )
 
     # Rate limiter (used for login endpoint)
     if frigate_config.auth.failed_login_rate_limit is None:

frigate/api/motion_search.py

@@ -42,9 +42,9 @@ class MotionSearchRequest(BaseModel):
         description="Minimum change area as a percentage of the ROI",
     )
     frame_skip: int = Field(
-        default=5,
+        default=30,
         ge=1,
-        le=30,
+        le=120,
         description="Process every Nth frame (1=all frames, 5=every 5th frame)",
     )
     parallel: bool = Field(

frigate/app.py

@@ -144,7 +144,7 @@ class FrigateApp:
         for d in dirs:
             if not os.path.exists(d) and not os.path.islink(d):
                 logger.info(f"Creating directory: {d}")
-                os.makedirs(d)
+                os.makedirs(d, exist_ok=True)
             else:
                 logger.debug(f"Skipping directory: {d}")
 
@@ -343,12 +343,24 @@ class FrigateApp:
         )
         self.dispatcher.profile_manager = self.profile_manager
 
+    def restore_active_profile(self) -> None:
+        """Re-activate the persisted profile after subscribers are connected.
+
+        ZMQ PUB/SUB drops messages with no subscribers, so activation must
+        run after every config_updater subscriber is up.
+        """
+        if self.profile_manager is None:
+            return
+
         persisted = ProfileManager.load_persisted_profile()
         if persisted and any(
             persisted in cam.profiles for cam in self.config.cameras.values()
         ):
             logger.info("Restoring persisted profile '%s'", persisted)
-            self.profile_manager.activate_profile(persisted)
+            # runtime overrides are layered on top via restore_runtime_state()
+            self.profile_manager.activate_profile(
+                persisted, clear_runtime_overrides=False
+            )
 
     def start_detectors(self) -> None:
         for name in self.config.cameras.keys():
@@ -428,18 +440,11 @@ class FrigateApp:
         self.camera_maintainer.start()
 
     def start_audio_processor(self) -> None:
-        audio_cameras = [
-            c
-            for c in self.config.cameras.values()
-            if c.enabled and c.audio.enabled_in_config
-        ]
-
-        if audio_cameras:
-            self.audio_process = AudioProcessor(
-                self.config, audio_cameras, self.camera_metrics, self.stop_event
-            )
-            self.audio_process.start()
-            self.processes["audio_detector"] = self.audio_process.pid or 0
+        self.audio_process = AudioProcessor(
+            self.config, self.camera_metrics, self.stop_event
+        )
+        self.audio_process.start()
+        self.processes["audio_detector"] = self.audio_process.pid or 0
 
     def start_timeline_processor(self) -> None:
         self.timeline_processor = TimelineProcessor(
@@ -619,6 +624,10 @@ class FrigateApp:
         self.start_record_cleanup()
         self.start_watchdog()
 
+        # restore persisted runtime overrides on top of config
+        self.restore_active_profile()
+        self.dispatcher.restore_runtime_state()
+
         self.init_auth()
 
         try:

frigate/camera/maintainer.py

@@ -14,6 +14,7 @@ from frigate.config.camera.updater import (
     CameraConfigUpdateEnum,
     CameraConfigUpdateSubscriber,
 )
+from frigate.const import REPLAY_CAMERA_PREFIX
 from frigate.models import Regions
 from frigate.util.builtin import empty_and_close_queue
 from frigate.util.image import SharedMemoryFrameManager, UntrackedSharedMemory
@@ -50,6 +51,7 @@ class CameraMaintainer(threading.Thread):
             [
                 CameraConfigUpdateEnum.add,
                 CameraConfigUpdateEnum.remove,
+                CameraConfigUpdateEnum.refresh,
             ],
         )
         self.shm_count = self.__calculate_shm_frame_count()
@@ -202,6 +204,25 @@ class CameraMaintainer(threading.Thread):
                 capture_process.terminate()
                 capture_process.join()
 
+    def __unlink_camera_frame_slots(self, camera: str) -> None:
+        """Drop the camera's per-frame YUV SHM segments from this
+        process's frame_manager and unlink them at the OS level.
+
+        Safe to call after the camera's capture/processor subprocesses
+        have been joined — they no longer hold mappings, so unlink frees
+        the segments immediately. Other long-lived processes that opened
+        these slots will continue using their existing mappings until
+        they call frame_manager.get with a shape that no longer fits
+        (the get path drops and reopens stale refs).
+        """
+        prefix = f"{camera}_frame"
+        names = [n for n in list(self.frame_manager.shm_store) if n.startswith(prefix)]
+        for name in names:
+            try:
+                self.frame_manager.delete(name)
+            except Exception as exc:
+                logger.debug("Could not unlink SHM %s: %s", name, exc)
+
     def __stop_camera_process(self, camera: str) -> None:
         camera_process = self.camera_processes.get(camera)
         if camera_process is not None:
@@ -253,12 +274,45 @@ class CameraMaintainer(threading.Thread):
                     for camera in updated_cameras:
                         self.__stop_camera_capture_process(camera)
                         self.__stop_camera_process(camera)
+                        self.__unlink_camera_frame_slots(camera)
                         self.capture_processes.pop(camera, None)
                         self.camera_processes.pop(camera, None)
                         self.camera_stop_events.pop(camera, None)
                         self.region_grids.pop(camera, None)
                         self.camera_metrics.pop(camera, None)
                         self.ptz_metrics.pop(camera, None)
+                elif update_type == CameraConfigUpdateEnum.refresh.name:
+                    # Recycle replay cameras so detect width/height/fps
+                    # propagate through ffmpeg args, SHM sizing, and the
+                    # region grid. Regular cameras detect change still
+                    # requires a full restart.
+                    for camera in updated_cameras:
+                        if not camera.startswith(REPLAY_CAMERA_PREFIX):
+                            continue
+
+                        new_config = self.update_subscriber.camera_configs.get(camera)
+                        if new_config is None:
+                            # remove arrived in the same batch
+                            continue
+
+                        if (
+                            camera not in self.camera_processes
+                            and camera not in self.capture_processes
+                        ):
+                            continue
+
+                        # rebuild ffmpeg cmds on the shared config so the
+                        # new subprocesses spawn with current args
+                        new_config.recreate_ffmpeg_cmds()
+
+                        self.__stop_camera_capture_process(camera)
+                        self.__stop_camera_process(camera)
+                        self.__unlink_camera_frame_slots(camera)
+                        self.capture_processes.pop(camera, None)
+                        self.camera_processes.pop(camera, None)
+
+                        self.__start_camera_processor(camera, new_config, runtime=True)
+                        self.__start_camera_capture(camera, new_config, runtime=True)
 
         # ensure the capture processes are done
         for camera in self.capture_processes.keys():

frigate/camera/state.py

@@ -45,6 +45,7 @@ class CameraState:
         self.frame_cache: dict[float, dict[str, Any]] = {}
         self.zone_objects: defaultdict[str, list[Any]] = defaultdict(list)
         self._current_frame = np.zeros(self.camera_config.frame_shape_yuv, np.uint8)
+        self._last_frame_shape: tuple[int, int] = self.camera_config.frame_shape_yuv
         self.current_frame_lock = threading.Lock()
         self.current_frame_time = 0.0
         self.motion_boxes: list[tuple[int, int, int, int]] = []
@@ -303,6 +304,42 @@ class CameraState:
     def on(self, event_type: str, callback: Callable[..., Any]) -> None:
         self.callbacks[event_type].append(callback)
 
+    def _discard_stale_resolution_state(
+        self, current_detections: dict[str, dict[str, Any]]
+    ) -> bool:
+        """Drop tracked state when the camera's detect resolution has
+        changed, and signal the caller to skip this batch if it contains
+        out-of-bounds boxes from the pre-recycle detect process.
+
+        Returns True when the batch should be skipped entirely.
+        """
+        # detect resolution changed — drop tracked state so old-grid
+        # boxes don't leak through end-callbacks
+        current_shape = self.camera_config.frame_shape_yuv
+        if current_shape != self._last_frame_shape:
+            logger.debug(
+                f"{self.name}: detect resolution changed {self._last_frame_shape} -> {current_shape}, dropping tracked state"
+            )
+            with self.current_frame_lock:
+                self.tracked_objects.clear()
+                self.motion_boxes = []
+                self.regions = []
+            self._last_frame_shape = current_shape
+
+        # drop in-flight batches from the pre-recycle detect process
+        # whose boxes exceed the current detect resolution
+        detect = self.camera_config.detect
+        if detect.width is not None and detect.height is not None:
+            for obj in current_detections.values():
+                box = obj.get("box")
+                if box and (box[2] > detect.width or box[3] > detect.height):
+                    logger.debug(
+                        f"{self.name}: dropping stale-resolution detection batch (box {box} exceeds {detect.width}x{detect.height})"
+                    )
+                    return True
+
+        return False
+
     def update(
         self,
         frame_name: str,
@@ -311,6 +348,9 @@ class CameraState:
         motion_boxes: list[tuple[int, int, int, int]],
         regions: list[tuple[int, int, int, int]],
     ) -> None:
+        if self._discard_stale_resolution_state(current_detections):
+            return
+
         current_frame = self.frame_manager.get(
             frame_name, self.camera_config.frame_shape_yuv
         )
@@ -332,14 +372,18 @@ class CameraState:
                 current_detections[id],
             )
 
-            # add initial frame to frame cache
-            logger.debug(
-                f"{self.name}: New object, adding {frame_time} to frame cache for {id}"
-            )
-            self.frame_cache[frame_time] = {
-                "frame": np.copy(current_frame),  # type: ignore[arg-type]
-                "object_id": id,
-            }
+            # Skip caching when the frame buffer isn't readable — e.g.
+            # frame_manager.get returned None because the SHM segment was
+            # unlinked or hasn't been recreated yet during a camera
+            # add/remove cycle.
+            if current_frame is not None:
+                logger.debug(
+                    f"{self.name}: New object, adding {frame_time} to frame cache for {id}"
+                )
+                self.frame_cache[frame_time] = {
+                    "frame": np.copy(current_frame),
+                    "object_id": id,
+                }
 
             # save initial thumbnail data and best object
             thumbnail_data = {

frigate/comms/dispatcher.py

@@ -3,11 +3,13 @@
 import datetime
 import json
 import logging
+from collections.abc import Iterable
 from typing import Any, Callable, Optional, cast
 
 from frigate.camera import PTZMetrics
 from frigate.camera.activity_manager import AudioActivityManager, CameraActivityManager
 from frigate.comms.base_communicator import Communicator
+from frigate.comms.runtime_state import RuntimeStatePersistence
 from frigate.comms.webpush import WebPushClient
 from frigate.config import BirdseyeModeEnum, FrigateConfig
 from frigate.config.camera.updater import (
@@ -67,6 +69,7 @@ class Dispatcher:
         self.embeddings_reindex: dict[str, Any] = {}
         self.birdseye_layout: dict[str, Any] = {}
         self.audio_transcription_state: str = "idle"
+        self._runtime_state = RuntimeStatePersistence()
         self._camera_settings_handlers: dict[str, Callable] = {
             "audio": self._on_audio_command,
             "audio_transcription": self._on_audio_transcription_command,
@@ -397,6 +400,60 @@ class Dispatcher:
         for comm in self.comms:
             comm.stop()
 
+    def restore_runtime_state(self) -> None:
+        """Replay persisted runtime overrides through the camera settings handlers.
+
+        Called once after Frigate startup completes so processing threads can
+        receive the resulting ``config_updater`` broadcasts. Unknown cameras
+        and topics are skipped; handler exceptions are logged and replay
+        continues for remaining entries.
+        """
+        state = self._runtime_state.load()
+        for camera_name, features in state.items():
+            if camera_name not in self.config.cameras:
+                continue
+            for topic, value in features.items():
+                handler = self._camera_settings_handlers.get(topic)
+                if handler is None:
+                    continue
+                payload = "ON" if value else "OFF"
+                try:
+                    handler(camera_name, payload)
+                except Exception:
+                    logger.exception(
+                        "Failed to restore runtime state %s.%s=%s",
+                        camera_name,
+                        topic,
+                        payload,
+                    )
+                    continue
+                logger.info(
+                    "Restored runtime state: %s.%s=%s",
+                    camera_name,
+                    topic,
+                    payload,
+                )
+
+    def clear_runtime_state_for_yaml_keys(self, dotted_keys: Iterable[str]) -> None:
+        """Clear stored runtime overrides for YAML keys that were just rewritten.
+
+        Called by ``/api/config/set`` after a successful YAML save so an
+        explicit settings-UI save isn't silently overridden by an older
+        runtime toggle on the next restart.
+        """
+        self._runtime_state.clear_for_yaml_keys(dotted_keys)
+
+    def clear_runtime_state(self) -> None:
+        """Wipe every stored runtime override.
+
+        Called when a profile is activated or deactivated. A profile switch
+        changes the layer below the runtime overrides, so the stored
+        "steady state" is no longer valid and must be reset; otherwise a
+        subsequent restart would replay stale overrides on top of the new
+        profile-derived in-memory state.
+        """
+        self._runtime_state.clear_all()
+
     def _on_detect_command(self, camera_name: str, payload: str) -> None:
         """Callback for detect topic."""
         detect_settings = self.config.cameras[camera_name].detect
@@ -428,6 +485,7 @@ class Dispatcher:
             CameraConfigUpdateTopic(CameraConfigUpdateEnum.detect, camera_name),
             detect_settings,
         )
+        self._runtime_state.set(camera_name, "detect", detect_settings.enabled)
         self.publish(f"{camera_name}/detect/state", payload, retain=True)
 
     def _on_enabled_command(self, camera_name: str, payload: str) -> None:
@@ -452,6 +510,7 @@ class Dispatcher:
             CameraConfigUpdateTopic(CameraConfigUpdateEnum.enabled, camera_name),
             camera_settings.enabled,
         )
+        self._runtime_state.set(camera_name, "enabled", camera_settings.enabled)
         self.publish(f"{camera_name}/enabled/state", payload, retain=True)
 
     def _on_motion_command(self, camera_name: str, payload: str) -> None:
@@ -614,6 +673,7 @@ class Dispatcher:
             CameraConfigUpdateTopic(CameraConfigUpdateEnum.audio, camera_name),
             audio_settings,
         )
+        self._runtime_state.set(camera_name, "audio", audio_settings.enabled)
         self.publish(f"{camera_name}/audio/state", payload, retain=True)
 
     def _on_audio_transcription_command(self, camera_name: str, payload: str) -> None:
@@ -670,6 +730,7 @@ class Dispatcher:
             CameraConfigUpdateTopic(CameraConfigUpdateEnum.record, camera_name),
             record_settings,
         )
+        self._runtime_state.set(camera_name, "recordings", record_settings.enabled)
         self.publish(f"{camera_name}/recordings/state", payload, retain=True)
 
     def _on_snapshots_command(self, camera_name: str, payload: str) -> None:
@@ -689,6 +750,7 @@ class Dispatcher:
             CameraConfigUpdateTopic(CameraConfigUpdateEnum.snapshots, camera_name),
             snapshots_settings,
         )
+        self._runtime_state.set(camera_name, "snapshots", snapshots_settings.enabled)
         self.publish(f"{camera_name}/snapshots/state", payload, retain=True)
 
     def _on_ptz_command(self, camera_name: str, payload: str | bytes) -> None:

frigate/comms/runtime_state.py

@@ -0,0 +1,163 @@
+"""Persistence layer for dispatcher runtime state overrides."""
+
+import json
+import logging
+import os
+from collections.abc import Iterable
+from typing import Any
+
+from filelock import FileLock, Timeout
+
+from frigate.util.config import find_config_file
+
+logger = logging.getLogger(__name__)
+
+
+class RuntimeStatePersistence:
+    """Persist last-known runtime states for dispatcher toggles.
+
+    Stores boolean overrides applied to camera-level toggles by the dispatcher.
+    Overrides are replayed at startup on top of the YAML-derived in-memory
+    config, so changes made via MQTT or the live-view UI survive a restart.
+    """
+
+    # Maps dispatcher topic name -> YAML key suffix under cameras.<cam>
+    TRACKED_TOPICS: dict[str, str] = {
+        "enabled": "enabled",
+        "detect": "detect.enabled",
+        "snapshots": "snapshots.enabled",
+        "recordings": "record.enabled",
+        "audio": "audio.enabled",
+    }
+
+    _SUFFIX_TO_TOPIC: dict[str, str] = {v: k for k, v in TRACKED_TOPICS.items()}
+
+    def __init__(self) -> None:
+        self._path = os.path.join(
+            os.path.dirname(find_config_file()), ".runtime_state.json"
+        )
+        self._lock_path = f"{self._path}.lock"
+        self._lock_timeout = 5
+
+    def load(self) -> dict[str, dict[str, bool]]:
+        """Return {camera: {topic: bool}} or {} if missing/corrupt."""
+        try:
+            with FileLock(self._lock_path, timeout=self._lock_timeout):
+                data = self._read_locked()
+        except Timeout:
+            logger.error("Timed out acquiring runtime state lock for load")
+            return {}
+        cameras = data.get("cameras", {})
+        if not isinstance(cameras, dict):
+            return {}
+        # Filter out malformed camera entries so callers can trust the shape.
+        return {
+            name: features
+            for name, features in cameras.items()
+            if isinstance(features, dict)
+        }
+
+    def set(self, camera: str, topic: str, value: bool) -> None:
+        """Persist a single (camera, topic, value). No-op if topic untracked."""
+        if topic not in self.TRACKED_TOPICS:
+            return
+        try:
+            with FileLock(self._lock_path, timeout=self._lock_timeout):
+                data = self._read_locked()
+                cameras = data.setdefault("cameras", {})
+                if not isinstance(cameras, dict):
+                    cameras = {}
+                    data["cameras"] = cameras
+                cam = cameras.setdefault(camera, {})
+                if not isinstance(cam, dict):
+                    cam = {}
+                    cameras[camera] = cam
+                cam[topic] = bool(value)
+                self._write_locked(data)
+        except Timeout:
+            logger.error("Timed out persisting runtime state for %s/%s", camera, topic)
+        except OSError:
+            logger.exception("Failed to persist runtime state for %s/%s", camera, topic)
+
+    def clear_all(self) -> None:
+        """Wipe every stored runtime override.
+
+        Called when the "layer below" changes in a way that invalidates all
+        runtime overrides for the current session (currently: profile
+        activation or deactivation).
+        """
+        try:
+            with FileLock(self._lock_path, timeout=self._lock_timeout):
+                if not os.path.exists(self._path):
+                    return
+                self._write_locked({"cameras": {}})
+        except Timeout:
+            logger.error("Timed out clearing runtime state")
+        except OSError:
+            logger.exception("Failed to clear runtime state")
+
+    def clear_for_yaml_keys(self, dotted_keys: Iterable[str]) -> None:
+        """Remove stored entries whose YAML key was just rewritten.
+
+        Each dotted key must be of the form ``cameras.<camera>.<suffix>``.
+        Keys that don't match a tracked topic are ignored.
+        """
+        to_remove: list[tuple[str, str]] = []
+        for key in dotted_keys:
+            parts = key.split(".")
+            if len(parts) < 3 or parts[0] != "cameras":
+                continue
+            camera = parts[1]
+            suffix = ".".join(parts[2:])
+            topic = self._SUFFIX_TO_TOPIC.get(suffix)
+            if topic is not None:
+                to_remove.append((camera, topic))
+
+        if not to_remove:
+            return
+
+        try:
+            with FileLock(self._lock_path, timeout=self._lock_timeout):
+                data = self._read_locked()
+                cameras = data.get("cameras")
+                if not isinstance(cameras, dict):
+                    return
+                changed = False
+                for camera, topic in to_remove:
+                    cam = cameras.get(camera)
+                    if isinstance(cam, dict) and topic in cam:
+                        del cam[topic]
+                        changed = True
+                        if not cam:
+                            del cameras[camera]
+                if changed:
+                    self._write_locked(data)
+        except Timeout:
+            logger.error("Timed out clearing runtime state for YAML keys")
+        except OSError:
+            logger.exception("Failed to clear runtime state for YAML keys")
+
+    def _read_locked(self) -> dict[str, Any]:
+        """Read the JSON file while the FileLock is held.
+
+        Returns ``{}`` on a missing or corrupt file so the caller can write a
+        fresh structure on the next mutation.
+        """
+        if not os.path.exists(self._path):
+            return {}
+        try:
+            with open(self._path, "r") as f:
+                data = json.load(f)
+        except (OSError, json.JSONDecodeError):
+            logger.exception(
+                "Failed to read runtime state file %s; starting fresh", self._path
+            )
+            return {}
+        return data if isinstance(data, dict) else {}
+
+    def _write_locked(self, data: dict[str, Any]) -> None:
+        """Atomically write the JSON file while the FileLock is held."""
+        tmp_path = f"{self._path}.tmp"
+        with open(tmp_path, "w") as f:
+            json.dump(data, f, indent=2, sort_keys=True)
+        os.replace(tmp_path, self._path)

frigate/comms/ws.py

@@ -34,6 +34,8 @@ from frigate.const import (
     UPDATE_REVIEW_DESCRIPTION,
     UPSERT_REVIEW_SEGMENT,
 )
+from frigate.models import User
+from frigate.output.ws_auth import ws_has_camera_access
 
 logger = logging.getLogger(__name__)
 
@@ -66,6 +68,7 @@ _WS_VIEWER_TOPICS = frozenset(
         "audioTranscriptionState",
         "birdseyeLayout",
         "embeddingsReindexProgress",
+        "jobState",
     }
 )
 
@@ -102,6 +105,321 @@ def _check_ws_authorization(
     return topic in _WS_VIEWER_TOPICS
 
 
+# ---- Outbound filtering ---------------------------------------------------
+#
+# Every WebSocket broadcast is classified into one of a small set of scopes,
+# then materialized per recipient. Connections with restricted roles only see
+# data for cameras they are authorized to access; admin and full-access roles
+# behave as today.
+
+# Topics that are safe to broadcast to every authenticated client.
+_WS_GLOBAL_OUTBOUND_TOPICS = frozenset(
+    {
+        "model_state",
+        "embeddings_reindex_progress",
+        "audio_transcription_state",
+        "profile/state",
+        "notifications/state",
+        "notification_test",
+    }
+)
+
+# Topics that restricted roles must never receive. Birdseye composites span
+# all cameras, so the existing JSMPEG policy already restricts birdseye access
+# to unrestricted roles; the layout broadcast follows the same rule.
+_WS_UNRESTRICTED_ONLY_TOPICS = frozenset(
+    {
+        "birdseye_layout",
+    }
+)
+
+# Topics whose payload (parsed as JSON) names a single owning camera at the
+# given key path. Used to scope events, reviews, triggers, etc.
+_WS_PAYLOAD_CAMERA_TOPICS: dict[str, tuple[str, ...]] = {
+    "events": ("after", "camera"),
+    "reviews": ("after", "camera"),
+    "tracked_object_update": ("camera",),
+    "triggers": ("camera",),
+    "camera_monitoring": ("camera",),
+}
+
+# Topics whose payload is a dict keyed by camera name; filter keys per
+# recipient.
+_WS_RESHAPE_BY_CAMERA_KEY_TOPICS = frozenset(
+    {
+        "camera_activity",
+        "audio_detections",
+    }
+)
+
+# Topics whose payload is a dict keyed by job_type, where each entry may
+# contain a "camera" or "source_camera" field, or a nested ``results.jobs``
+# list of per-camera sub-jobs (export broadcasts).
+_WS_RESHAPE_JOB_STATE_TOPICS = frozenset(
+    {
+        "job_state",
+    }
+)
+
+# Topics whose payload mixes global aggregates with a ``cameras`` sub-dict
+# keyed by camera name. Aggregates and detector data stay; per-camera entries
+# are filtered.
+_WS_RESHAPE_STATS_TOPICS = frozenset(
+    {
+        "stats",
+    }
+)
+
+
+def _collect_zone_names(config: FrigateConfig) -> set[str]:
+    """Return the set of all zone names defined across cameras."""
+    names: set[str] = set()
+    for camera in config.cameras.values():
+        zones = getattr(camera, "zones", None) or {}
+        names.update(zones.keys())
+    return names
+
+
+def _parse_json_payload(payload: Any) -> Any:
+    """Return payload parsed as JSON if it is a string, else as-is."""
+    if isinstance(payload, str):
+        try:
+            return json.loads(payload)
+        except (ValueError, TypeError):
+            return None
+    return payload
+
+
+def _scope_job_entry_to_allowed(entry: Any, allowed: set[str]) -> dict[str, Any] | None:
+    """Filter a single job_state entry to the recipient's allowed cameras.
+
+    Returns the (possibly reshaped) entry, or None to drop it. Four shapes
+    are handled:
+
+    * Top-level ``camera`` or ``source_camera`` (motion_search, vlm_watch,
+      export sub-job dicts): drop the entry if not allowed.
+    * Nested ``results.jobs`` list of per-camera sub-jobs (the aggregated
+      export broadcast): filter the list; drop the entry if nothing remains.
+    * Nested ``results.camera`` or ``results.source_camera`` (debug_replay,
+      which puts replay-specific fields inside ``results``): drop the entry
+      if not allowed.
+    * No camera anywhere (e.g. ``media_sync``): treat as global and keep.
+    """
+    if not isinstance(entry, dict):
+        return None
+
+    cam = entry.get("camera") or entry.get("source_camera")
+
+    if cam is None:
+        results = entry.get("results")
+        if isinstance(results, dict):
+            sub_jobs = results.get("jobs")
+            if isinstance(sub_jobs, list):
+                filtered_jobs = [
+                    j
+                    for j in sub_jobs
+                    if isinstance(j, dict)
+                    and (j.get("camera") or j.get("source_camera")) in allowed
+                ]
+                if not filtered_jobs:
+                    return None
+                reshaped = dict(entry)
+                reshaped["results"] = dict(results)
+                reshaped["results"]["jobs"] = filtered_jobs
+                return reshaped
+
+            cam = results.get("camera") or results.get("source_camera")
+
+    if cam is not None:
+        return entry if cam in allowed else None
+
+    return entry
+
+
+def _extract_payload_camera(payload: Any, path: tuple[str, ...]) -> str | None:
+    """Walk the dotted path through a (possibly JSON-encoded) payload."""
+    cur = _parse_json_payload(payload)
+    for key in path:
+        if not isinstance(cur, dict):
+            return None
+        cur = cur.get(key)
+    return cur if isinstance(cur, str) else None
+
+
+def _classify_outbound(
+    topic: str, all_cameras: set[str], all_zones: set[str]
+) -> tuple[str, Any]:
+    """Classify an outbound topic into (kind, extra).
+
+    kind values:
+      - "global"             : send to every authenticated client
+      - "drop"               : send to nobody (fail-closed for unknowns)
+      - "unrestricted_only"  : send only to admin/full-access roles
+      - "camera"             : extra is the owning camera name
+      - "payload_camera"     : extra is the JSON key path to the camera name
+      - "reshape_by_camera_key"
+      - "reshape_job_state"
+      - "reshape_stats"
+    """
+    if topic in _WS_GLOBAL_OUTBOUND_TOPICS:
+        return ("global", None)
+    if topic in _WS_UNRESTRICTED_ONLY_TOPICS:
+        return ("unrestricted_only", None)
+    if topic in _WS_RESHAPE_BY_CAMERA_KEY_TOPICS:
+        return ("reshape_by_camera_key", None)
+    if topic in _WS_RESHAPE_JOB_STATE_TOPICS:
+        return ("reshape_job_state", None)
+    if topic in _WS_RESHAPE_STATS_TOPICS:
+        return ("reshape_stats", None)
+    if topic in _WS_PAYLOAD_CAMERA_TOPICS:
+        return ("payload_camera", _WS_PAYLOAD_CAMERA_TOPICS[topic])
+
+    # Topic-prefix based: first segment names the owning camera or zone.
+    first = topic.split("/", 1)[0]
+    if first in all_cameras:
+        return ("camera", first)
+    if first in all_zones:
+        # Zone aggregates span cameras; restricted users see nothing here.
+        return ("unrestricted_only", None)
+
+    return ("drop", None)
+
+
+def _ws_role_header(ws: Any) -> str | None:
+    """Return the HTTP_REMOTE_ROLE header value, if any."""
+    environ = getattr(ws, "environ", None)
+    if not environ:
+        return None
+    value = environ.get("HTTP_REMOTE_ROLE")
+    return value if isinstance(value, str) else None
+
+
+def _ws_valid_roles(ws: Any, config: FrigateConfig) -> list[str]:
+    """Return the list of recognized roles for this connection."""
+    header = _ws_role_header(ws)
+    if not header:
+        return []
+    roles = [r.strip() for r in header.split(config.proxy.separator) if r.strip()]
+    return [r for r in roles if r in config.auth.roles]
+
+
+def _ws_is_unrestricted(ws: Any, config: FrigateConfig) -> bool:
+    """True when the connection has unrestricted camera access.
+
+    Mirrors the policy in ``frigate.output.ws_auth``: admin or any role with
+    an empty allow-list grants full access.
+    """
+    roles = _ws_valid_roles(ws, config)
+    if not roles:
+        return False
+    roles_dict = config.auth.roles
+    return any(r == "admin" or not roles_dict.get(r) for r in roles)
+
+
+def _ws_allowed_cameras(ws: Any, config: FrigateConfig) -> set[str]:
+    """Return the union of cameras this connection may access across its roles."""
+    roles = _ws_valid_roles(ws, config)
+    if not roles:
+        return set()
+    all_cameras = set(config.cameras.keys())
+    allowed: set[str] = set()
+    for role in roles:
+        if role == "admin" or not config.auth.roles.get(role):
+            return all_cameras
+        allowed.update(User.get_allowed_cameras(role, config.auth.roles, all_cameras))
+    return allowed
+
+
+def _wrap_envelope(topic: str, inner_payload: Any) -> str:
+    """Re-serialize a (topic, payload) message after payload reshaping.
+
+    Frigate's wire format keeps payloads as JSON-encoded strings inside the
+    outer envelope, mirroring what producers send today.
+    """
+    return json.dumps({"topic": topic, "payload": json.dumps(inner_payload)})
+
+
+def _materialize_for_ws(
+    ws: Any,
+    topic: str,
+    full_message: str,
+    scope: tuple[str, Any],
+    parsed_payload: Any,
+    config: FrigateConfig,
+) -> str | None:
+    """Return the JSON string to deliver to ``ws``, or None to skip it."""
+    kind, extra = scope
+    has_role = _ws_role_header(ws) is not None
+
+    if kind == "drop":
+        return None
+
+    if kind == "global":
+        # Globals still require an authenticated connection. Missing role
+        # falls back to viewer semantics (matching the inbound rule).
+        return full_message
+
+    # Beyond globals, an authenticated role header is required (fail-closed).
+    if not has_role:
+        return None
+
+    if kind == "unrestricted_only":
+        return full_message if _ws_is_unrestricted(ws, config) else None
+
+    if kind == "camera":
+        return full_message if ws_has_camera_access(ws, extra, config) else None
+
+    if kind == "payload_camera":
+        camera = _extract_payload_camera(parsed_payload, extra)
+        if camera is None:
+            return None
+        return full_message if ws_has_camera_access(ws, camera, config) else None
+
+    if kind == "reshape_by_camera_key":
+        if _ws_is_unrestricted(ws, config):
+            return full_message
+        if not isinstance(parsed_payload, dict):
+            return None
+        allowed = _ws_allowed_cameras(ws, config)
+        filtered = {cam: data for cam, data in parsed_payload.items() if cam in allowed}
+        if not filtered:
+            return None
+        return _wrap_envelope(topic, filtered)
+
+    if kind == "reshape_job_state":
+        if _ws_is_unrestricted(ws, config):
+            return full_message
+        if not isinstance(parsed_payload, dict):
+            return None
+        allowed = _ws_allowed_cameras(ws, config)
+        filtered_jobs: dict[str, Any] = {}
+        for job_type, job_payload in parsed_payload.items():
+            scoped = _scope_job_entry_to_allowed(job_payload, allowed)
+            if scoped is not None:
+                filtered_jobs[job_type] = scoped
+        if not filtered_jobs:
+            return None
+        return _wrap_envelope(topic, filtered_jobs)
+
+    if kind == "reshape_stats":
+        if _ws_is_unrestricted(ws, config):
+            return full_message
+        if not isinstance(parsed_payload, dict):
+            return None
+        allowed = _ws_allowed_cameras(ws, config)
+        cameras_block = parsed_payload.get("cameras")
+        if isinstance(cameras_block, dict):
+            filtered_cameras = {
+                name: data for name, data in cameras_block.items() if name in allowed
+            }
+            reshaped = dict(parsed_payload)
+            reshaped["cameras"] = filtered_cameras
+            return _wrap_envelope(topic, reshaped)
+        return full_message
+
+    return None
+
+
 class WebSocket(WebSocket_):  # type: ignore[misc]
     def unhandled_error(self, error: Any) -> None:
         """
@@ -183,6 +501,10 @@ class WebSocketClient(Communicator):
         self.websocket_thread.start()
 
     def publish(self, topic: str, payload: Any, _: bool = False) -> None:
+        if self.websocket_server is None:
+            logger.debug("Skipping message, websocket not connected yet")
+            return
+
         try:
             ws_message = json.dumps(
                 {
@@ -195,14 +517,42 @@ class WebSocketClient(Communicator):
             logger.debug(f"payload for {topic} wasn't text. Skipping...")
             return
 
-        if self.websocket_server is None:
-            logger.debug("Skipping message, websocket not connected yet")
+        all_cameras = set(self.config.cameras.keys())
+        all_zones = _collect_zone_names(self.config)
+        scope = _classify_outbound(topic, all_cameras, all_zones)
+
+        if scope[0] == "drop":
             return
 
-        try:
-            self.websocket_server.manager.broadcast(ws_message)
-        except ConnectionResetError:
-            pass
+        # Pre-parse payload once for topics that need to read its contents.
+        parsed_payload: Any = None
+        if scope[0] in (
+            "payload_camera",
+            "reshape_by_camera_key",
+            "reshape_job_state",
+            "reshape_stats",
+        ):
+            parsed_payload = _parse_json_payload(payload)
+            if parsed_payload is None:
+                # malformed payload — fail closed
+                return
+
+        manager = self.websocket_server.manager
+        with manager.lock:
+            websockets = list(manager.websockets.values())
+
+        for ws in websockets:
+            if getattr(ws, "terminated", False):
+                continue
+            message = _materialize_for_ws(
+                ws, topic, ws_message, scope, parsed_payload, self.config
+            )
+            if message is None:
+                continue
+            try:
+                ws.send(message)
+            except (ConnectionResetError, BrokenPipeError, ValueError):
+                pass
 
     def stop(self) -> None:
         if self.websocket_server is not None:

frigate/config/camera/genai.py

@@ -37,7 +37,7 @@ class GenAIConfig(FrigateBaseModel):
         description="Base URL for self-hosted or compatible providers (for example an Ollama instance).",
     )
     model: str = Field(
-        default="gpt-4o",
+        default="",
         title="Model",
         description="The model to use from the provider for generating descriptions or summaries.",
     )

frigate/config/camera/updater.py

@@ -26,6 +26,7 @@ class CameraConfigUpdateEnum(str, Enum):
     object_genai = "object_genai"
     onvif = "onvif"
     record = "record"
+    refresh = "refresh"  # signals the camera maintainer to recycle the camera process
     remove = "remove"  # for removing a camera
     review = "review"
     review_genai = "review_genai"
@@ -84,8 +85,8 @@ class CameraConfigUpdateSubscriber:
         self, camera: str, update_type: CameraConfigUpdateEnum, updated_config: Any
     ) -> None:
         if update_type == CameraConfigUpdateEnum.add:
-            self.config.cameras[camera] = updated_config
-            self.camera_configs[camera] = updated_config
+            shared = self.config.cameras.setdefault(camera, updated_config)
+            self.camera_configs[camera] = shared
             return
         elif update_type == CameraConfigUpdateEnum.remove:
             self.config.cameras.pop(camera, None)

frigate/config/config.py

@@ -26,7 +26,6 @@ from frigate.plus import PlusApi
 from frigate.util.builtin import (
     deep_merge,
     get_ffmpeg_arg_list,
-    load_labels,
 )
 from frigate.util.config import (
     CURRENT_CONFIG_VERSION,
@@ -81,12 +80,12 @@ logger = logging.getLogger(__name__)
 
 yaml = YAML()
 
-DEFAULT_DETECTORS = {
-    "ov": {
-        "type": "openvino",
-        "device": "CPU",
-    }
-}
+# Pydantic field default applied when an existing config omits `detectors:`.
+# Kept as cpu tflite for backwards compatibility with 0.17 configs.
+DEFAULT_DETECTORS = {"cpu": {"type": "cpu"}}
+
+# Used by the openvino branch below and rendered into the new-config YAML
+# template so first-time setups default to openvino on CPU.
 DEFAULT_MODEL = {
     "width": 300,
     "height": 300,
@@ -95,6 +94,7 @@ DEFAULT_MODEL = {
     "path": "/openvino-model/ssdlite_mobilenet_v2.xml",
     "labelmap_path": "/openvino-model/coco_91cl_bkgr.txt",
 }
+NEW_CONFIG_DETECTORS = {"ov": {"type": "openvino", "device": "CPU"}}
 DEFAULT_DETECT_DIMENSIONS = {"width": 1280, "height": 720}
 
 
@@ -110,7 +110,7 @@ DEFAULT_CONFIG = f"""
 mqtt:
   enabled: False
 
-{_render_default_yaml({"detectors": DEFAULT_DETECTORS, "model": DEFAULT_MODEL})}
+{_render_default_yaml({"detectors": NEW_CONFIG_DETECTORS, "model": DEFAULT_MODEL})}
 cameras: {{}}  # No cameras defined, UI wizard should be used
 version: {CURRENT_CONFIG_VERSION}
 """
@@ -326,6 +326,47 @@ def verify_required_zones_exist(camera_config: CameraConfig) -> None:
             )
 
 
+def verify_profile_overrides_match_base(camera_config: CameraConfig) -> None:
+    """Verify that profile zone and mask IDs reference entries defined on the base camera."""
+    for profile_name, profile in camera_config.profiles.items():
+        if profile.zones:
+            for zone_name in profile.zones:
+                if zone_name not in camera_config.zones:
+                    raise ValueError(
+                        f"Camera '{camera_config.name}' profile '{profile_name}' defines "
+                        f"zone '{zone_name}' that does not exist on the base config"
+                    )
+
+        if profile.motion and profile.motion.mask:
+            for mask_name in profile.motion.mask:
+                if mask_name not in camera_config.motion.mask:
+                    raise ValueError(
+                        f"Camera '{camera_config.name}' profile '{profile_name}' defines "
+                        f"motion mask '{mask_name}' that does not exist on the base config"
+                    )
+
+        if profile.objects:
+            for mask_name in profile.objects.mask or {}:
+                if mask_name not in (camera_config.objects.mask or {}):
+                    raise ValueError(
+                        f"Camera '{camera_config.name}' profile '{profile_name}' defines "
+                        f"object mask '{mask_name}' that does not exist on the base config"
+                    )
+            for label, filter_config in (profile.objects.filters or {}).items():
+                base_filter = (camera_config.objects.filters or {}).get(label)
+                profile_filter_masks = (
+                    filter_config.mask if filter_config else None
+                ) or {}
+                base_filter_masks = (base_filter.mask if base_filter else None) or {}
+                for mask_name in profile_filter_masks:
+                    if mask_name not in base_filter_masks:
+                        raise ValueError(
+                            f"Camera '{camera_config.name}' profile '{profile_name}' defines "
+                            f"object mask '{mask_name}' for '{label}' that does not exist "
+                            f"on the base config"
+                        )
+
+
 def verify_autotrack_zones(camera_config: CameraConfig) -> ValueError | None:
     """Verify that required_zones are specified when autotracking is enabled."""
     if (
@@ -629,26 +670,29 @@ class FrigateConfig(FrigateBaseModel):
 
         # set default min_score for object attributes
         for attribute in self.model.all_attributes:
-            if not self.objects.filters.get(attribute):
+            existing = self.objects.filters.get(attribute)
+            if existing is None:
                 self.objects.filters[attribute] = FilterConfig(min_score=0.7)
-            elif self.objects.filters[attribute].min_score == 0.5:
-                self.objects.filters[attribute].min_score = 0.7
+            elif "min_score" not in existing.model_fields_set:
+                existing.min_score = 0.7
 
         # auto detect hwaccel args
         if self.ffmpeg.hwaccel_args == "auto":
             self.ffmpeg.hwaccel_args = auto_detect_hwaccel()
 
-        # Populate global audio filters for all audio labels
-        all_audio_labels = {
-            label
-            for label in load_labels("/audio-labelmap.txt", prefill=521).values()
-            if label
-        }
+        # Resolve global export hwaccel_args so it matches the per-camera
+        # resolution below. Without this, every camera reads as overriding
+        # record.export.hwaccel_args because the global stays "auto" while
+        # the camera value gets resolved to the actual args list.
+        if self.record.export.hwaccel_args == "auto":
+            self.record.export.hwaccel_args = self.ffmpeg.hwaccel_args
 
+        # Populate global audio filters from listen. Existing user-defined
+        # entries for labels not in listen are preserved but unused at runtime.
         if self.audio.filters is None:
             self.audio.filters = {}
 
-        for key in sorted(all_audio_labels - self.audio.filters.keys()):
+        for key in sorted(set(self.audio.listen) - self.audio.filters.keys()):
             self.audio.filters[key] = AudioFilterConfig()
 
         self.audio.filters = dict(sorted(self.audio.filters.items()))
@@ -840,7 +884,9 @@ class FrigateConfig(FrigateBaseModel):
             if camera_config.audio.filters is None:
                 camera_config.audio.filters = {}
 
-            for key in sorted(all_audio_labels - camera_config.audio.filters.keys()):
+            for key in sorted(
+                set(camera_config.audio.listen) - camera_config.audio.filters.keys()
+            ):
                 camera_config.audio.filters[key] = AudioFilterConfig()
 
             camera_config.audio.filters = dict(
@@ -954,6 +1000,7 @@ class FrigateConfig(FrigateBaseModel):
             verify_recording_segments_setup_with_reasonable_time(camera_config)
             verify_zone_objects_are_tracked(camera_config)
             verify_required_zones_exist(camera_config)
+            verify_profile_overrides_match_base(camera_config)
             verify_autotrack_zones(camera_config)
             verify_motion_and_detect(camera_config)
             verify_objects_track(camera_config, labelmap_objects)

frigate/config/profile_manager.py

@@ -124,11 +124,24 @@ class ProfileManager:
                 self.config.active_profile = None
                 self._persist_active_profile(None)
 
-    def activate_profile(self, profile_name: Optional[str]) -> Optional[str]:
+            # drop all runtime overrides so they don't replay stale values on restart
+            if self.dispatcher is not None:
+                self.dispatcher.clear_runtime_state()
+
+    def activate_profile(
+        self,
+        profile_name: Optional[str],
+        clear_runtime_overrides: bool = True,
+    ) -> Optional[str]:
         """Activate a profile by name, or deactivate if None.
 
         Args:
             profile_name: Profile name to activate, or None to deactivate.
+            clear_runtime_overrides: When True (the default, for user-initiated
+                activations) drop the dispatcher's runtime override file because
+                the layer below changed. Startup callers that are replaying a
+                persisted profile pass False so the runtime state stays
+                available for the subsequent replay step.
 
         Returns:
             None on success, or an error message string on failure.
@@ -156,6 +169,11 @@ class ProfileManager:
 
         self.config.active_profile = profile_name
         self._persist_active_profile(profile_name)
+
+        # a profile switch invalidates the steady-state runtime overrides
+        if clear_runtime_overrides and self.dispatcher is not None:
+            self.dispatcher.clear_runtime_state()
+
         logger.info(
             "Profile %s",
             f"'{profile_name}' activated" if profile_name else "deactivated",

frigate/const.py

@@ -21,6 +21,8 @@ PLUS_API_HOST = "https://api.frigate.video"
 
 SHM_FRAMES_VAR = "SHM_MAX_FRAMES"
 
+REDACTED_CREDENTIAL_SENTINEL = "__FRIGATE_SAVED_CREDENTIAL__"
+
 # Attribute & Object constants
 
 DEFAULT_ATTRIBUTE_LABEL_MAP = {

frigate/data_processing/post/object_descriptions.py

@@ -269,7 +269,9 @@ class ObjectDescriptionProcessor(PostProcessorApi):
 
         if event.has_snapshot and camera_config.objects.genai.use_snapshot:
             snapshot_image = self._read_and_crop_snapshot(event)
+
             if not snapshot_image:
+                self.cleanup_event(event_id)
                 return
 
         num_thumbnails = len(self.tracked_events.get(event_id, []))

frigate/debug_replay.py

@@ -5,10 +5,12 @@ frigate.jobs.debug_replay. This module owns only session presence
 (active), session metadata, and post-session cleanup.
 """
 
+import asyncio
 import logging
 import os
 import shutil
 import threading
+import time
 
 from ruamel.yaml import YAML
 
@@ -25,12 +27,23 @@ from frigate.const import (
     REPLAY_DIR,
     THUMB_DIR,
 )
-from frigate.jobs.debug_replay import cancel_debug_replay_job, wait_for_runner
+from frigate.jobs.debug_replay import (
+    JOB_TYPE as DEBUG_REPLAY_JOB_TYPE,
+)
+from frigate.jobs.debug_replay import (
+    cancel_debug_replay_job,
+    wait_for_runner,
+)
+from frigate.jobs.export import JobStatePublisher
+from frigate.types import JobStatusTypesEnum
 from frigate.util.camera_cleanup import cleanup_camera_db, cleanup_camera_files
 from frigate.util.config import find_config_file
 
 logger = logging.getLogger(__name__)
 
+MAX_SESSION_DURATION_SECONDS = 12 * 60 * 60
+AUTO_STOP_CHECK_INTERVAL_SECONDS = 60
+
 
 class DebugReplayManager:
     """Owns the lifecycle pointers for a single debug replay session.
@@ -49,6 +62,8 @@ class DebugReplayManager:
         self.clip_path: str | None = None
         self.start_ts: float | None = None
         self.end_ts: float | None = None
+        self.session_started_at: float | None = None
+        self._job_state_publisher = JobStatePublisher()
 
     @property
     def active(self) -> bool:
@@ -73,6 +88,7 @@ class DebugReplayManager:
             self.start_ts = start_ts
             self.end_ts = end_ts
             self.clip_path = None
+            self.session_started_at = time.time()
 
     def mark_session_ready(self, clip_path: str) -> None:
         """Record the on-disk clip path after the camera has been published."""
@@ -94,6 +110,7 @@ class DebugReplayManager:
         self.clip_path = None
         self.start_ts = None
         self.end_ts = None
+        self.session_started_at = None
 
     def publish_camera(
         self,
@@ -150,6 +167,7 @@ class DebugReplayManager:
                 return
 
             replay_name = self.replay_camera_name
+            source_camera = self.source_camera
 
             # Only publish remove if the camera was actually added to the live
             # config (i.e. the runner reached the starting_camera phase).
@@ -158,11 +176,27 @@ class DebugReplayManager:
                     CameraConfigUpdateTopic(CameraConfigUpdateEnum.remove, replay_name),
                     frigate_config.cameras[replay_name],
                 )
+                frigate_config.cameras.pop(replay_name, None)
 
             if replay_name is not None:
                 self._cleanup_db(replay_name)
                 self._cleanup_files(replay_name)
 
+            self._job_state_publisher.publish(
+                {
+                    "id": "stopped",
+                    "job_type": DEBUG_REPLAY_JOB_TYPE,
+                    "status": JobStatusTypesEnum.cancelled,
+                    "start_time": None,
+                    "end_time": time.time(),
+                    "error_message": None,
+                    "results": {
+                        "source_camera": source_camera,
+                        "replay_camera_name": replay_name,
+                    },
+                }
+            )
+
             self._clear_locked()
 
             logger.info("Debug replay stopped and cleaned up: %s", replay_name)
@@ -211,6 +245,10 @@ class DebugReplayManager:
             zone_dump.setdefault("coordinates", zone_config.coordinates)
             zones_dict[zone_name] = zone_dump
 
+        # Extract LPR and face recognition configs
+        lpr_dict = source_config.lpr.model_dump()
+        face_recognition_dict = source_config.face_recognition.model_dump()
+
         # Extract motion config (exclude runtime fields)
         motion_dict = {}
         if source_config.motion is not None:
@@ -219,11 +257,23 @@ class DebugReplayManager:
                     "frame_shape",
                     "raw_mask",
                     "mask",
-                    "improved_contrast_enabled",
+                    "enabled_in_config",
                     "rasterized_mask",
                 }
             )
 
+            if source_config.motion.mask:
+                motion_dict["mask"] = {
+                    mask_id: (
+                        mask_cfg.model_dump(
+                            exclude={"raw_coordinates", "enabled_in_config"}
+                        )
+                        if mask_cfg is not None
+                        else None
+                    )
+                    for mask_id, mask_cfg in source_config.motion.mask.items()
+                }
+
         return {
             "enabled": True,
             "ffmpeg": {
@@ -248,8 +298,8 @@ class DebugReplayManager:
             },
             "birdseye": {"enabled": False},
             "audio": {"enabled": False},
-            "lpr": {"enabled": False},
-            "face_recognition": {"enabled": False},
+            "lpr": lpr_dict,
+            "face_recognition": face_recognition_dict,
         }
 
     def _cleanup_db(self, camera_name: str) -> None:
@@ -308,3 +358,41 @@ def cleanup_replay_cameras() -> None:
             shutil.rmtree(REPLAY_DIR)
         except Exception as e:
             logger.error("Failed to remove replay cache directory: %s", e)
+
+
+async def debug_replay_auto_stop_watchdog(
+    manager: DebugReplayManager,
+    frigate_config: FrigateConfig,
+    config_publisher: CameraConfigUpdatePublisher,
+) -> None:
+    """Auto-stop debug replay sessions that exceed MAX_SESSION_DURATION_SECONDS.
+
+    Backstop against a session left running for days. The cap is intentionally
+    generous so realistic tuning and overnight soak workflows aren't disrupted.
+    """
+    while True:
+        try:
+            await asyncio.sleep(AUTO_STOP_CHECK_INTERVAL_SECONDS)
+
+            started_at = manager.session_started_at
+            if not manager.active or started_at is None:
+                continue
+
+            if time.time() - started_at < MAX_SESSION_DURATION_SECONDS:
+                continue
+
+            replay_name = manager.replay_camera_name
+            await asyncio.to_thread(
+                manager.stop,
+                frigate_config=frigate_config,
+                config_publisher=config_publisher,
+            )
+            logger.info(
+                "Debug replay auto-stopped after exceeding max session duration of %d hours: %s",
+                MAX_SESSION_DURATION_SECONDS // 3600,
+                replay_name,
+            )
+        except asyncio.CancelledError:
+            raise
+        except Exception:
+            logger.exception("Error in debug replay auto-stop watchdog")

frigate/detectors/detection_runners.py

@@ -79,7 +79,11 @@ def is_openvino_gpu_npu_available() -> bool:
     available_devices = get_openvino_available_devices()
     # Check for GPU, NPU, or other acceleration devices (excluding CPU)
     acceleration_devices = ["GPU", "MYRIAD", "NPU", "GNA", "HDDL"]
-    return any(device in available_devices for device in acceleration_devices)
+    return any(
+        avail_dev == accel_dev or avail_dev.startswith(accel_dev + ".")
+        for avail_dev in available_devices
+        for accel_dev in acceleration_devices
+    )
 
 
 class BaseModelRunner(ABC):
@@ -278,6 +282,13 @@ class OpenVINOModelRunner(BaseModelRunner):
             EnrichmentModelTypeEnum.arcface.value,
         ]
 
+    @staticmethod
+    def is_detection_model(model_type: str) -> bool:
+        # Import here to avoid circular imports
+        from frigate.detectors.detector_config import ModelTypeEnum
+
+        return model_type in [m.value for m in ModelTypeEnum]
+
     def __init__(self, model_path: str, device: str, model_type: str, **kwargs):
         self.model_path = model_path
         self.device = device
@@ -306,9 +317,15 @@ class OpenVINOModelRunner(BaseModelRunner):
         # Apply performance optimization
         self.ov_core.set_property(device, {"PERF_COUNT": "NO"})
 
-        if device in ["GPU", "AUTO"]:
+        if device in ["GPU", "AUTO", "NPU"]:
             self.ov_core.set_property(device, {"PERFORMANCE_HINT": "LATENCY"})
 
+        if device == "NPU" and OpenVINOModelRunner.is_detection_model(model_type):
+            try:
+                self.ov_core.set_property(device, {"NPU_TURBO": "YES"})
+            except Exception as e:
+                logger.debug(f"NPU_TURBO not supported by driver: {e}")
+
         # Compile model
         self.compiled_model = self.ov_core.compile_model(
             model=model_path, device_name=device

frigate/embeddings/maintainer.py

@@ -60,7 +60,11 @@ from frigate.data_processing.real_time.license_plate import (
 )
 from frigate.data_processing.types import DataProcessorMetrics, PostProcessDataEnum
 from frigate.db.sqlitevecq import SqliteVecQueueDatabase
-from frigate.events.types import EventTypeEnum, RegenerateDescriptionEnum
+from frigate.events.types import (
+    EventStateEnum,
+    EventTypeEnum,
+    RegenerateDescriptionEnum,
+)
 from frigate.genai import GenAIClientManager
 from frigate.models import Event, Recordings, ReviewSegment, Trigger
 from frigate.types import TrackedObjectUpdateTypesEnum
@@ -94,10 +98,17 @@ class EmbeddingMaintainer(threading.Thread):
             [
                 CameraConfigUpdateEnum.add,
                 CameraConfigUpdateEnum.remove,
+                CameraConfigUpdateEnum.detect,
+                CameraConfigUpdateEnum.face_recognition,
+                CameraConfigUpdateEnum.ffmpeg,
+                CameraConfigUpdateEnum.lpr,
+                CameraConfigUpdateEnum.motion,
+                CameraConfigUpdateEnum.objects,
                 CameraConfigUpdateEnum.object_genai,
                 CameraConfigUpdateEnum.review,
                 CameraConfigUpdateEnum.review_genai,
                 CameraConfigUpdateEnum.semantic_search,
+                CameraConfigUpdateEnum.zones,
             ],
         )
         self.enrichment_config_subscriber = ConfigSubscriber("config/")
@@ -228,7 +239,7 @@ class EmbeddingMaintainer(threading.Thread):
                 )
             )
 
-        if self.config.audio_transcription.enabled and any(
+        if any(
             c.enabled_in_config and c.audio_transcription.enabled
             for c in self.config.cameras.values()
         ):
@@ -435,7 +446,7 @@ class EmbeddingMaintainer(threading.Thread):
         if update is None:
             return
 
-        source_type, _, camera, frame_name, data = update
+        source_type, event_type, camera, frame_name, data = update
 
         logger.debug(
             f"Received update - source_type: {source_type}, camera: {camera}, data label: {data.get('label') if data else 'None'}"
@@ -485,6 +496,12 @@ class EmbeddingMaintainer(threading.Thread):
 
         for processor in self.post_processors:
             if isinstance(processor, ObjectDescriptionProcessor):
+                # skip end events — _process_finalized handles them via event_end_subscriber.
+                # processing them here can re-create tracked_events entries after cleanup
+                # when the event_subscriber queue is backlogged behind event_end_subscriber.
+                if event_type == EventStateEnum.end:
+                    continue
+
                 processor.process_data(
                     {
                         "camera": camera,

frigate/events/audio.py

@@ -84,7 +84,6 @@ class AudioProcessor(FrigateProcess):
     def __init__(
         self,
         config: FrigateConfig,
-        cameras: list[CameraConfig],
         camera_metrics: DictProxy,
         stop_event: MpEvent,
     ):
@@ -93,16 +92,30 @@ class AudioProcessor(FrigateProcess):
         )
 
         self.camera_metrics = camera_metrics
-        self.cameras = cameras
         self.config = config
 
+    def __stop_audio_thread(self, camera: str) -> None:
+        thread = self.audio_threads.pop(camera, None)
+        if thread is None:
+            return
+
+        thread.stop()
+        thread.join(10)
+        if thread.is_alive():
+            self.logger.warning(f"Audio maintainer thread for {camera} is still alive")
+        else:
+            self.logger.info(f"Audio maintainer stopped for {camera}")
+
     def run(self) -> None:
         self.pre_run_setup(self.config.logger)
-        audio_threads: list[AudioEventMaintainer] = []
+        self.audio_threads: dict[str, AudioEventMaintainer] = {}
 
         threading.current_thread().name = "process:audio_manager"
 
-        if self.config.audio_transcription.enabled:
+        if any(
+            c.enabled_in_config and c.audio_transcription.enabled
+            for c in self.config.cameras.values()
+        ):
             self.transcription_model_runner: AudioTranscriptionModelRunner | None = (
                 AudioTranscriptionModelRunner(
                     self.config.audio_transcription.device or "AUTO",
@@ -112,32 +125,67 @@ class AudioProcessor(FrigateProcess):
         else:
             self.transcription_model_runner = None
 
-        if len(self.cameras) == 0:
-            return
+        config_subscriber = CameraConfigUpdateSubscriber(
+            self.config,
+            self.config.cameras,
+            [
+                CameraConfigUpdateEnum.add,
+                CameraConfigUpdateEnum.audio,
+                CameraConfigUpdateEnum.ffmpeg,
+                CameraConfigUpdateEnum.remove,
+            ],
+        )
 
-        for camera in self.cameras:
-            audio_thread = AudioEventMaintainer(
+        def spawn_if_needed(camera: CameraConfig) -> None:
+            name = camera.name
+            if name is None or name in self.audio_threads:
+                return
+            if not camera.enabled or not camera.audio.enabled:
+                return
+            # ffmpeg update may not have arrived yet; wait for next poll
+            if not any("audio" in i.roles for i in camera.ffmpeg.inputs):
+                return
+            thread = AudioEventMaintainer(
                 camera,
                 self.config,
                 self.camera_metrics,
                 self.transcription_model_runner,
                 self.stop_event,  # type: ignore[arg-type]
             )
-            audio_threads.append(audio_thread)
-            audio_thread.start()
+            self.audio_threads[name] = thread
+            thread.start()
+            self.logger.info(f"Audio maintainer started for {name}")
+
+        for camera in self.config.cameras.values():
+            spawn_if_needed(camera)
 
         self.logger.info(f"Audio processor started (pid: {self.pid})")
 
-        while not self.stop_event.wait():
-            pass
+        # poll for newly added/removed cameras or cameras flipped to
+        # audio.enabled at runtime
+        while not self.stop_event.wait(timeout=1.0):
+            updated_topics = config_subscriber.check_for_updates()
 
-        for thread in audio_threads:
+            # stop maintainers for removed cameras so their ffmpeg process is
+            # torn down and they stop touching camera_metrics (which the camera
+            # maintainer has already popped for the removed camera)
+            for removed_camera in updated_topics.get(
+                CameraConfigUpdateEnum.remove.name, []
+            ):
+                self.__stop_audio_thread(removed_camera)
+
+            for camera in self.config.cameras.values():
+                spawn_if_needed(camera)
+
+        config_subscriber.stop()
+
+        for thread in self.audio_threads.values():
             thread.join(1)
             if thread.is_alive():
                 self.logger.info(f"Waiting for thread {thread.name:s} to exit")
                 thread.join(10)
 
-        for thread in audio_threads:
+        for thread in self.audio_threads.values():
             if thread.is_alive():
                 self.logger.warning(f"Thread {thread.name} is still alive")
 
@@ -159,6 +207,9 @@ class AudioEventMaintainer(threading.Thread):
         self.camera_config = camera
         self.camera_metrics = camera_metrics
         self.stop_event = stop_event
+        # per-camera stop signal so a single maintainer can be torn down at
+        # runtime (e.g. on camera removal) without stopping the whole process
+        self.camera_stop_event = threading.Event()
         self.detector = AudioTfl(stop_event, self.camera_config.audio.num_threads)
         self.shape = (int(round(AUDIO_DURATION * AUDIO_SAMPLE_RATE)),)
         self.chunk_size = int(round(AUDIO_DURATION * AUDIO_SAMPLE_RATE * 2))
@@ -184,7 +235,7 @@ class AudioEventMaintainer(threading.Thread):
         self.detection_publisher = DetectionPublisher(DetectionTypeEnum.audio.value)
 
         if (
-            self.config.audio_transcription.enabled
+            self.camera_config.audio_transcription.enabled
             and self.audio_transcription_model_runner is not None
         ):
             # init the transcription processor for this camera
@@ -208,7 +259,11 @@ class AudioEventMaintainer(threading.Thread):
         self.was_audio_enabled = camera.audio.enabled
 
     def detect_audio(self, audio: np.ndarray) -> None:
-        if not self.camera_config.audio.enabled or self.stop_event.is_set():
+        if (
+            not self.camera_config.audio.enabled
+            or self.stop_event.is_set()
+            or self.camera_stop_event.is_set()
+        ):
             return
 
         audio_as_float: np.ndarray = audio.astype(np.float32)
@@ -327,11 +382,15 @@ class AudioEventMaintainer(threading.Thread):
             self.logger.error(f"Error reading audio data from ffmpeg process: {e}")
             log_and_restart()
 
+    def stop(self) -> None:
+        """Signal this maintainer to exit its run loop and clean up."""
+        self.camera_stop_event.set()
+
     def run(self) -> None:
         if self.camera_config.enabled:
             self.start_or_restart_ffmpeg()
 
-        while not self.stop_event.is_set():
+        while not self.stop_event.is_set() and not self.camera_stop_event.is_set():
             # check if there is an updated config
             self.config_subscriber.check_for_updates()
 

frigate/genai/__init__.py

@@ -1,21 +1,25 @@
 """Generative AI module for Frigate."""
 
-import datetime
 import importlib
 import json
 import logging
 import os
 import re
-from typing import Any, Callable, Optional
+from typing import Any, AsyncGenerator, Callable, Optional
 
 import numpy as np
-from playhouse.shortcuts import model_to_dict
 from pydantic import ValidationError
 
 from frigate.config import CameraConfig, GenAIConfig, GenAIProviderEnum
 from frigate.const import CLIPS_DIR
 from frigate.data_processing.post.types import ReviewMetadata
 from frigate.genai.manager import GenAIClientManager
+from frigate.genai.prompts import (
+    build_object_description_prompt,
+    build_review_description_prompt,
+    build_review_description_response_format,
+    build_review_summary_prompt,
+)
 from frigate.models import Event
 
 logger = logging.getLogger(__name__)
@@ -46,9 +50,15 @@ def register_genai_provider(key: GenAIProviderEnum) -> Callable:
 class GenAIClient:
     """Generative AI client for Frigate."""
 
-    def __init__(self, genai_config: GenAIConfig, timeout: int = 120) -> None:
+    def __init__(
+        self,
+        genai_config: GenAIConfig,
+        timeout: int = 120,
+        validate_model: bool = True,
+    ) -> None:
         self.genai_config: GenAIConfig = genai_config
         self.timeout = timeout
+        self.validate_model = validate_model
         self.provider = self._init_provider()
 
     def generate_review_description(
@@ -61,75 +71,14 @@ class GenAIClient:
         activity_context_prompt: str,
     ) -> ReviewMetadata | None:
         """Generate a description for the review item activity."""
+        context_prompt = build_review_description_prompt(
+            review_data,
+            thumbnails,
+            concerns,
+            preferred_language,
+            activity_context_prompt,
+        )
 
-        def get_concern_prompt() -> str:
-            if concerns:
-                concern_list = "\n    - ".join(concerns)
-                return f"""- `other_concerns` (list of strings): Include a list of any of the following concerns that are occurring:
-    - {concern_list}"""
-            else:
-                return ""
-
-        def get_language_prompt() -> str:
-            if preferred_language:
-                return f"Provide your answer in {preferred_language}"
-            else:
-                return ""
-
-        def get_objects_list() -> str:
-            if review_data["unified_objects"]:
-                return "\n- " + "\n- ".join(review_data["unified_objects"])
-            else:
-                return "\n- (No objects detected)"
-
-        context_prompt = f"""
-Your task is to analyze a sequence of images taken in chronological order from a security camera.
-
-## Normal Activity Patterns for This Property
-
-{activity_context_prompt}
-
-## Task Instructions
-
-Describe the scene based on observable actions and movements, evaluate the activity against the Activity Indicators above, and assign a potential_threat_level (0, 1, or 2) by applying the threat level indicators consistently.
-
-## Analysis Guidelines
-
-When forming your description:
-- **CRITICAL: Only describe objects explicitly listed in "Objects in Scene" below.** Do not infer or mention additional people, vehicles, or objects not present in this list, even if visual patterns suggest them. If only a car is listed, do not describe a person interacting with it unless "person" is also in the objects list.
-- **Only describe actions actually visible in the frames.** Do not assume or infer actions that you don't observe happening. If someone walks toward furniture but you never see them sit, do not say they sat. Stick to what you can see across the sequence.
-- Describe what you observe: actions, movements, interactions with objects and the environment. Include any observable environmental changes (e.g., lighting changes triggered by activity).
-- Note visible details such as clothing, items being carried or placed, tools or equipment present, and how they interact with the property or objects.
-- Consider the full sequence chronologically: what happens from start to finish, how duration and actions relate to the location and objects involved.
-- **Use the actual timestamp provided in "Activity started at"** below for time of day context—do not infer time from image brightness or darkness. Unusual hours (late night/early morning) should increase suspicion when the observable behavior itself appears questionable. However, recognize that some legitimate activities can occur at any hour.
-- **Consider duration as a primary factor**: Apply the duration thresholds defined in the activity patterns above. Brief sequences during normal hours with apparent purpose typically indicate normal activity unless explicit suspicious actions are visible.
-- **Weigh all evidence holistically**: Match the activity against the normal and suspicious patterns defined above, then evaluate based on the complete context (zone, objects, time, actions, duration). Apply the threat level indicators consistently. Use your judgment for edge cases.
-
-## Response Field Guidelines
-
-Respond with a JSON object matching the provided schema. Field-specific guidance:
-- `observations`: Include the very start of the activity — for example, a vehicle entering the frame or pulling into the driveway — even if it lasts only a few frames and the rest of the clip is dominated by a longer activity. Include each arrival, departure, object handled, and notable change in position or state. Each item is a single concrete fact written as a complete sentence.
-- `scene`: Describe how the sequence begins, then the progression of events — all significant movements and actions in order. For example, if a vehicle arrives and then a person exits, describe both sequentially. For named subjects (those with a `←` separator in "Objects in Scene"), always use their name — do not replace them with generic terms. For unnamed objects (e.g., "person", "car"), refer to them naturally with articles (e.g., "a person", "the car"). Your description should align with and support the threat level you assign.
-- `title`: Name the primary activity across the observations, together with the location. An activity is what is being done with objects, tools, or surfaces; locomotion through the scene qualifies as the activity only when no other interaction is observed. For named subjects, always use their name. For unnamed objects, refer to them naturally with articles.
-- `shortSummary`: Briefly summarize the primary activity across the observations.
-- `potential_threat_level`: Must be consistent with your scene description and the activity patterns above.
-
-## Sequence Details
-
-- Camera: {review_data["camera"]}
-- Total frames: {len(thumbnails)} (Frame 1 = earliest, Frame {len(thumbnails)} = latest)
-- Activity started at {review_data["start"]} and lasted {review_data["duration"]} seconds
-- Zones involved: {", ".join(review_data["zones"]) if review_data["zones"] else "None"}
-
-## Objects in Scene
-
-Each line represents a detection state, not necessarily unique individuals. The `←` symbol separates a recognized subject's name from their object type — use only the name (before the `←`) in your response, not the type after it. The same subject may appear across multiple lines if detected multiple times.
-
-**Note: Unidentified objects (without names) are NOT indicators of suspicious activity—they simply mean the system hasn't identified that object.**
-{get_objects_list()}
-
-{get_language_prompt()}
-"""
         logger.debug(
             f"Sending {len(thumbnails)} images to create review description on {review_data['camera']}"
         )
@@ -143,25 +92,7 @@ Each line represents a detection state, not necessarily unique individuals. The
             ) as f:
                 f.write(context_prompt)
 
-        # Build JSON schema for structured output from ReviewMetadata model
-        schema = ReviewMetadata.model_json_schema()
-        schema.get("properties", {}).pop("time", None)
-
-        if "time" in schema.get("required", []):
-            schema["required"].remove("time")
-        if not concerns:
-            schema.get("properties", {}).pop("other_concerns", None)
-            if "other_concerns" in schema.get("required", []):
-                schema["required"].remove("other_concerns")
-
-        response_format = {
-            "type": "json_schema",
-            "json_schema": {
-                "name": "review_metadata",
-                "strict": True,
-                "schema": schema,
-            },
-        }
+        response_format = build_review_description_response_format(concerns)
 
         response = self._send(context_prompt, thumbnails, response_format)
 
@@ -240,61 +171,9 @@ Each line represents a detection state, not necessarily unique individuals. The
         debug_save: bool,
     ) -> str | None:
         """Generate a summary of review item descriptions over a period of time."""
-        time_range = f"{datetime.datetime.fromtimestamp(start_ts).strftime('%B %d, %Y at %I:%M %p')} to {datetime.datetime.fromtimestamp(end_ts).strftime('%B %d, %Y at %I:%M %p')}"
-        timeline_summary_prompt = f"""
-You are a security officer writing a concise security report.
-
-Time range: {time_range}
-
-Input format: Each event is a JSON object with:
-- "title", "scene", "confidence", "potential_threat_level" (0-2), "other_concerns", "camera", "time", "start_time", "end_time"
-- "context": array of related events from other cameras that occurred during overlapping time periods
-
-**Note: Use the "scene" field for event descriptions in the report. Ignore any "shortSummary" field if present.**
-
-Report Structure - Use this EXACT format:
-
-# Security Summary - {time_range}
-
-## Overview
-[Write 1-2 sentences summarizing the overall activity pattern during this period.]
-
----
-
-## Timeline
-
-[Group events by time periods (e.g., "Morning (6:00 AM - 12:00 PM)", "Afternoon (12:00 PM - 5:00 PM)", "Evening (5:00 PM - 9:00 PM)", "Night (9:00 PM - 6:00 AM)"). Use appropriate time blocks based on when events occurred.]
-
-### [Time Block Name]
-
-**HH:MM AM/PM** | [Camera Name] | [Threat Level Indicator]
-- [Event title]: [Clear description incorporating contextual information from the "context" array]
-- Context: [If context array has items, mention them here, e.g., "Delivery truck present on Front Driveway Cam (HH:MM AM/PM)"]
-- Assessment: [Brief assessment incorporating context - if context explains the event, note it here]
-
-[Repeat for each event in chronological order within the time block]
-
----
-
-## Summary
-[One sentence summarizing the period. If all events are normal/explained: "Routine activity observed." If review needed: "Some activity requires review but no security concerns." If security concerns: "Security concerns requiring immediate attention."]
-
-Guidelines:
-- List ALL events in chronological order, grouped by time blocks
-- Threat level indicators: ✓ Normal, ⚠️ Needs review, 🔴 Security concern
-- Integrate contextual information naturally - use the "context" array to enrich each event's description
-- If context explains the event (e.g., delivery truck explains person at door), describe it accordingly (e.g., "delivery person" not "unidentified person")
-- Be concise but informative - focus on what happened and what it means
-- If contextual information makes an event clearly normal, reflect that in your assessment
-- Only create time blocks that have events - don't create empty sections
-"""
-
-        timeline_summary_prompt += "\n\nEvents:\n"
-        for event in events:
-            timeline_summary_prompt += f"\n{event}\n"
-
-        if preferred_language:
-            timeline_summary_prompt += f"\nProvide your answer in {preferred_language}"
+        timeline_summary_prompt = build_review_summary_prompt(
+            start_ts, end_ts, events, preferred_language
+        )
 
         if debug_save:
             with open(
@@ -326,10 +205,7 @@ Guidelines:
     ) -> Optional[str]:
         """Generate a description for the frame."""
         try:
-            prompt = camera_config.objects.genai.object_prompts.get(
-                str(event.label),
-                camera_config.objects.genai.prompt,
-            ).format(**model_to_dict(event))
+            prompt = build_object_description_prompt(camera_config, event)
         except KeyError as e:
             logger.error(f"Invalid key in GenAI prompt: {e}")
             return None
@@ -346,8 +222,15 @@ Guidelines:
         prompt: str,
         images: list[bytes],
         response_format: Optional[dict] = None,
+        enable_thinking: bool = False,
     ) -> Optional[str]:
-        """Submit a request to the provider."""
+        """Submit a request to the provider.
+
+        ``enable_thinking`` is honored only by providers that report
+        ``supports_toggleable_thinking``. Description-style callers leave it
+        at the default (off) since synthesis tasks don't benefit from
+        reasoning traces.
+        """
         return None
 
     @property
@@ -359,6 +242,11 @@ Guidelines:
         """
         return True
 
+    @property
+    def supports_toggleable_thinking(self) -> bool:
+        """Whether the configured model exposes a per-request thinking toggle."""
+        return False
+
     def list_models(self) -> list[str]:
         """Return the list of model names available from this provider.
 
@@ -402,6 +290,7 @@ Guidelines:
         messages: list[dict[str, Any]],
         tools: Optional[list[dict[str, Any]]] = None,
         tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
     ) -> dict[str, Any]:
         """
         Send chat messages to LLM with optional tool definitions.
@@ -425,11 +314,17 @@ Guidelines:
                 - 'none': Model must not call tools
                 - 'required': Model must call at least one tool
                 - Or a dict specifying a specific tool to call
-            **kwargs: Additional provider-specific parameters.
+            enable_thinking: Per-request thinking toggle. None means use the
+                provider default. Ignored by providers without a per-request
+                toggle (see `supports_toggleable_thinking`).
 
         Returns:
             Dictionary with:
             - 'content': Optional[str] - The text response from the LLM, None if tool calls
+            - 'reasoning': Optional[str] - The separated reasoning/thinking trace
+              if the model emitted one (e.g. via OpenAI-compatible
+              `reasoning_content`). None when the model does not surface a
+              trace or the provider does not parse it.
             - 'tool_calls': Optional[List[Dict]] - List of tool calls if LLM wants to call tools.
               Each tool call dict has:
                 - 'id': str - Unique identifier for this tool call
@@ -441,6 +336,14 @@ Guidelines:
                 - 'length': Hit token limit
                 - 'error': An error occurred
 
+        Streaming counterpart `chat_with_tools_stream` yields
+        ``(kind, value)`` tuples where ``kind`` is one of:
+            - 'content_delta': value is a string fragment of the answer
+            - 'reasoning_delta': value is a string fragment of the reasoning
+              trace (emitted before content for thinking models)
+            - 'stats': value is a usage stats dict
+            - 'message': value is the final dict shape described above
+
         Raises:
             NotImplementedError: If the provider doesn't implement this method.
         """
@@ -451,14 +354,50 @@ Guidelines:
         )
         return {
             "content": None,
+            "reasoning": None,
             "tool_calls": None,
             "finish_reason": "error",
         }
 
+    async def chat_with_tools_stream(
+        self,
+        messages: list[dict[str, Any]],
+        tools: Optional[list[dict[str, Any]]] = None,
+        tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
+    ) -> AsyncGenerator[tuple[str, Any], None]:
+        """Streaming counterpart to `chat_with_tools`.
+
+        Yields ``(kind, value)`` tuples where ``kind`` is one of:
+            - 'content_delta': value is a string fragment of the answer
+            - 'reasoning_delta': value is a string fragment of the reasoning
+              trace (emitted before content for thinking models)
+            - 'stats': value is a usage stats dict
+            - 'message': value is the final dict shape described in
+              `chat_with_tools`
+
+        Argument semantics — including ``enable_thinking`` — match
+        `chat_with_tools`. Providers that don't support streaming should
+        override this and yield an error 'message' event.
+        """
+        logger.warning(
+            f"{self.__class__.__name__} does not support chat_with_tools_stream. "
+            "This method should be overridden by the provider implementation."
+        )
+        yield (
+            "message",
+            {
+                "content": None,
+                "reasoning": None,
+                "tool_calls": None,
+                "finish_reason": "error",
+            },
+        )
+
 
 def load_providers() -> None:
-    package_dir = os.path.dirname(__file__)
-    for filename in os.listdir(package_dir):
+    plugins_dir = os.path.join(os.path.dirname(__file__), "plugins")
+    for filename in os.listdir(plugins_dir):
         if filename.endswith(".py") and filename != "__init__.py":
-            module_name = f"frigate.genai.{filename[:-3]}"
+            module_name = f"frigate.genai.plugins.{filename[:-3]}"
             importlib.import_module(module_name)

frigate/genai/azure-openai.py

@@ -1,305 +0,0 @@
-"""Azure OpenAI Provider for Frigate AI."""
-
-import base64
-import json
-import logging
-from typing import Any, AsyncGenerator, Optional
-from urllib.parse import parse_qs, urlparse
-
-from openai import AzureOpenAI
-
-from frigate.config import GenAIProviderEnum
-from frigate.genai import GenAIClient, register_genai_provider
-
-logger = logging.getLogger(__name__)
-
-
-@register_genai_provider(GenAIProviderEnum.azure_openai)
-class OpenAIClient(GenAIClient):
-    """Generative AI client for Frigate using Azure OpenAI."""
-
-    provider: AzureOpenAI
-
-    def _init_provider(self) -> AzureOpenAI | None:
-        """Initialize the client."""
-        try:
-            parsed_url = urlparse(self.genai_config.base_url or "")
-            query_params = parse_qs(parsed_url.query)
-            api_version = query_params.get("api-version", [None])[0]
-            azure_endpoint = f"{parsed_url.scheme}://{parsed_url.netloc}/"
-
-            if not api_version:
-                logger.warning("Azure OpenAI url is missing API version.")
-                return None
-
-        except Exception as e:
-            logger.warning("Error parsing Azure OpenAI url: %s", str(e))
-            return None
-
-        return AzureOpenAI(
-            api_key=self.genai_config.api_key,
-            api_version=api_version,
-            azure_endpoint=azure_endpoint,
-        )
-
-    def _send(
-        self,
-        prompt: str,
-        images: list[bytes],
-        response_format: Optional[dict] = None,
-    ) -> Optional[str]:
-        """Submit a request to Azure OpenAI."""
-        encoded_images = [base64.b64encode(image).decode("utf-8") for image in images]
-        try:
-            request_params = {
-                "model": self.genai_config.model,
-                "messages": [
-                    {
-                        "role": "user",
-                        "content": [{"type": "text", "text": prompt}]
-                        + [
-                            {
-                                "type": "image_url",
-                                "image_url": {
-                                    "url": f"data:image/jpeg;base64,{image}",
-                                    "detail": "low",
-                                },
-                            }
-                            for image in encoded_images
-                        ],
-                    },
-                ],
-                "timeout": self.timeout,
-                **self.genai_config.runtime_options,
-            }
-            if response_format:
-                request_params["response_format"] = response_format
-            result = self.provider.chat.completions.create(**request_params)
-        except Exception as e:
-            logger.warning("Azure OpenAI returned an error: %s", str(e))
-            return None
-        if len(result.choices) > 0:
-            return str(result.choices[0].message.content.strip())
-        return None
-
-    def list_models(self) -> list[str]:
-        """Return available model IDs from Azure OpenAI."""
-        try:
-            return sorted(m.id for m in self.provider.models.list().data)
-        except Exception as e:
-            logger.warning("Failed to list Azure OpenAI models: %s", e)
-            return []
-
-    def get_context_size(self) -> int:
-        """Get the context window size for Azure OpenAI."""
-        return 128000
-
-    def chat_with_tools(
-        self,
-        messages: list[dict[str, Any]],
-        tools: Optional[list[dict[str, Any]]] = None,
-        tool_choice: Optional[str] = "auto",
-    ) -> dict[str, Any]:
-        try:
-            openai_tool_choice = None
-            if tool_choice:
-                if tool_choice == "none":
-                    openai_tool_choice = "none"
-                elif tool_choice == "auto":
-                    openai_tool_choice = "auto"
-                elif tool_choice == "required":
-                    openai_tool_choice = "required"
-
-            request_params = {
-                "model": self.genai_config.model,
-                "messages": messages,
-                "timeout": self.timeout,
-            }
-
-            if tools:
-                request_params["tools"] = tools
-                if openai_tool_choice is not None:
-                    request_params["tool_choice"] = openai_tool_choice
-
-            result = self.provider.chat.completions.create(**request_params)  # type: ignore[call-overload]
-
-            if (
-                result is None
-                or not hasattr(result, "choices")
-                or len(result.choices) == 0
-            ):
-                return {
-                    "content": None,
-                    "tool_calls": None,
-                    "finish_reason": "error",
-                }
-
-            choice = result.choices[0]
-            message = choice.message
-
-            content = message.content.strip() if message.content else None
-
-            tool_calls = None
-            if message.tool_calls:
-                tool_calls = []
-                for tool_call in message.tool_calls:
-                    try:
-                        arguments = json.loads(tool_call.function.arguments)
-                    except (json.JSONDecodeError, AttributeError) as e:
-                        logger.warning(
-                            f"Failed to parse tool call arguments: {e}, "
-                            f"tool: {tool_call.function.name if hasattr(tool_call.function, 'name') else 'unknown'}"
-                        )
-                        arguments = {}
-
-                    tool_calls.append(
-                        {
-                            "id": tool_call.id if hasattr(tool_call, "id") else "",
-                            "name": tool_call.function.name
-                            if hasattr(tool_call.function, "name")
-                            else "",
-                            "arguments": arguments,
-                        }
-                    )
-
-            finish_reason = "error"
-            if hasattr(choice, "finish_reason") and choice.finish_reason:
-                finish_reason = choice.finish_reason
-            elif tool_calls:
-                finish_reason = "tool_calls"
-            elif content:
-                finish_reason = "stop"
-
-            return {
-                "content": content,
-                "tool_calls": tool_calls,
-                "finish_reason": finish_reason,
-            }
-
-        except Exception as e:
-            logger.warning("Azure OpenAI returned an error: %s", str(e))
-            return {
-                "content": None,
-                "tool_calls": None,
-                "finish_reason": "error",
-            }
-
-    async def chat_with_tools_stream(
-        self,
-        messages: list[dict[str, Any]],
-        tools: Optional[list[dict[str, Any]]] = None,
-        tool_choice: Optional[str] = "auto",
-    ) -> AsyncGenerator[tuple[str, Any], None]:
-        """
-        Stream chat with tools; yields content deltas then final message.
-
-        Implements streaming function calling/tool usage for Azure OpenAI models.
-        """
-        try:
-            openai_tool_choice = None
-            if tool_choice:
-                if tool_choice == "none":
-                    openai_tool_choice = "none"
-                elif tool_choice == "auto":
-                    openai_tool_choice = "auto"
-                elif tool_choice == "required":
-                    openai_tool_choice = "required"
-
-            request_params = {
-                "model": self.genai_config.model,
-                "messages": messages,
-                "timeout": self.timeout,
-                "stream": True,
-            }
-
-            if tools:
-                request_params["tools"] = tools
-                if openai_tool_choice is not None:
-                    request_params["tool_choice"] = openai_tool_choice
-
-            # Use streaming API
-            content_parts: list[str] = []
-            tool_calls_by_index: dict[int, dict[str, Any]] = {}
-            finish_reason = "stop"
-
-            stream = self.provider.chat.completions.create(**request_params)  # type: ignore[call-overload]
-
-            for chunk in stream:
-                if not chunk or not chunk.choices:
-                    continue
-
-                choice = chunk.choices[0]
-                delta = choice.delta
-
-                # Check for finish reason
-                if choice.finish_reason:
-                    finish_reason = choice.finish_reason
-
-                # Extract content deltas
-                if delta.content:
-                    content_parts.append(delta.content)
-                    yield ("content_delta", delta.content)
-
-                # Extract tool calls
-                if delta.tool_calls:
-                    for tc in delta.tool_calls:
-                        idx = tc.index
-                        fn = tc.function
-
-                        if idx not in tool_calls_by_index:
-                            tool_calls_by_index[idx] = {
-                                "id": tc.id or "",
-                                "name": fn.name if fn and fn.name else "",
-                                "arguments": "",
-                            }
-
-                        t = tool_calls_by_index[idx]
-                        if tc.id:
-                            t["id"] = tc.id
-                        if fn and fn.name:
-                            t["name"] = fn.name
-                        if fn and fn.arguments:
-                            t["arguments"] += fn.arguments
-
-            # Build final message
-            full_content = "".join(content_parts).strip() or None
-
-            # Convert tool calls to list format
-            tool_calls_list = None
-            if tool_calls_by_index:
-                tool_calls_list = []
-                for tc in tool_calls_by_index.values():
-                    try:
-                        # Parse accumulated arguments as JSON
-                        parsed_args = json.loads(tc["arguments"])
-                    except (json.JSONDecodeError, Exception):
-                        parsed_args = tc["arguments"]
-
-                    tool_calls_list.append(
-                        {
-                            "id": tc["id"],
-                            "name": tc["name"],
-                            "arguments": parsed_args,
-                        }
-                    )
-                finish_reason = "tool_calls"
-
-            yield (
-                "message",
-                {
-                    "content": full_content,
-                    "tool_calls": tool_calls_list,
-                    "finish_reason": finish_reason,
-                },
-            )
-
-        except Exception as e:
-            logger.warning("Azure OpenAI streaming returned an error: %s", str(e))
-            yield (
-                "message",
-                {
-                    "content": None,
-                    "tool_calls": None,
-                    "finish_reason": "error",
-                },
-            )

frigate/genai/manager.py

@@ -6,7 +6,7 @@ no chat feature is active) are never initialized.
 """
 
 import logging
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING, Any, Optional
 
 from frigate.config import FrigateConfig
 from frigate.config.camera.genai import GenAIConfig, GenAIRoleEnum
@@ -108,11 +108,16 @@ class GenAIClientManager:
         name = self._role_map.get(GenAIRoleEnum.embeddings)
         return self._get_client(name) if name else None
 
-    def list_models(self) -> dict[str, list[str]]:
-        """Return available models keyed by config entry name."""
-        result: dict[str, list[str]] = {}
-        for name in self._configs:
+    def list_models(self) -> dict[str, dict[str, Any]]:
+        """Return per-entry model lists and capabilities, keyed by config entry name."""
+        result: dict[str, dict[str, Any]] = {}
+        for name, genai_cfg in self._configs.items():
             client = self._get_client(name)
-            if client:
-                result[name] = client.list_models()
+            if not client:
+                continue
+            result[name] = {
+                "models": client.list_models(),
+                "roles": [r.value for r in genai_cfg.roles],
+                "supports_toggleable_thinking": client.supports_toggleable_thinking,
+            }
         return result

frigate/genai/plugins/__init__.py

@@ -0,0 +1 @@
+"""GenAI provider plugins."""

frigate/genai/plugins/azure-openai.py

@@ -0,0 +1,53 @@
+"""Azure OpenAI Provider for Frigate AI.
+
+Azure OpenAI exposes the same chat completions API as OpenAI once the
+client is constructed, so this provider inherits all transport, streaming,
+reasoning, and tool-calling logic from :class:`OpenAIClient` and only
+overrides what is genuinely Azure-specific:
+
+- Client construction: parses ``api-version`` out of the configured
+  ``base_url`` query string and instantiates :class:`openai.AzureOpenAI`
+  with ``azure_endpoint`` instead of ``base_url``. Raises if the URL is
+  malformed; :class:`GenAIClientManager` catches the exception and
+  disables the provider.
+- Context size: Azure does not expose a per-model ``max_model_len`` field
+  reliably, so we keep the historical 128K default rather than the
+  model-name heuristic used by OpenAI.
+"""
+
+import logging
+from urllib.parse import parse_qs, urlparse
+
+from openai import AzureOpenAI
+
+from frigate.config import GenAIProviderEnum
+from frigate.genai import register_genai_provider
+from frigate.genai.plugins.openai import OpenAIClient
+
+logger = logging.getLogger(__name__)
+
+
+@register_genai_provider(GenAIProviderEnum.azure_openai)
+class AzureOpenAIClient(OpenAIClient):
+    """Generative AI client for Frigate using Azure OpenAI."""
+
+    def _init_provider(self) -> AzureOpenAI:
+        """Initialize the AzureOpenAI client from the configured base_url."""
+        parsed_url = urlparse(self.genai_config.base_url or "")
+        query_params = parse_qs(parsed_url.query)
+        api_version = query_params.get("api-version", [None])[0]
+
+        if not api_version:
+            raise ValueError("Azure OpenAI base_url is missing api-version.")
+
+        azure_endpoint = f"{parsed_url.scheme}://{parsed_url.netloc}/"
+
+        return AzureOpenAI(
+            api_key=self.genai_config.api_key,
+            api_version=api_version,
+            azure_endpoint=azure_endpoint,
+        )
+
+    def get_context_size(self) -> int:
+        """Azure does not reliably surface per-model context size; use 128K."""
+        return 128000

frigate/genai/plugins/gemini.py

@@ -1,5 +1,7 @@
 """Gemini Provider for Frigate AI."""
 
+import base64
+import binascii
 import json
 import logging
 from typing import Any, AsyncGenerator, Optional
@@ -14,6 +16,41 @@ from frigate.genai import GenAIClient, register_genai_provider
 logger = logging.getLogger(__name__)
 
 
+def _decode_thought_signature(value: Any) -> Optional[bytes]:
+    """Decode a base64-encoded thought_signature carried across conversation turns."""
+    if not value:
+        return None
+    if isinstance(value, bytes):
+        return value
+    if isinstance(value, str):
+        try:
+            return base64.b64decode(value)
+        except (binascii.Error, ValueError):
+            return None
+    return None
+
+
+def _encode_thought_signature(signature: Optional[bytes]) -> Optional[str]:
+    """Encode bytes thought_signature as base64 so it survives JSON-friendly transport."""
+    if not signature:
+        return None
+    return base64.b64encode(signature).decode("ascii")
+
+
+def _stats_from_gemini_usage(usage: Any) -> Optional[dict[str, Any]]:
+    """Build a stats dict from a Gemini usage_metadata object."""
+    prompt_tokens = getattr(usage, "prompt_token_count", None)
+    completion_tokens = getattr(usage, "candidates_token_count", None)
+    if prompt_tokens is None and completion_tokens is None:
+        return None
+    stats: dict[str, Any] = {}
+    if isinstance(prompt_tokens, int):
+        stats["prompt_tokens"] = prompt_tokens
+    if isinstance(completion_tokens, int):
+        stats["completion_tokens"] = completion_tokens
+    return stats or None
+
+
 @register_genai_provider(GenAIProviderEnum.gemini)
 class GeminiClient(GenAIClient):
     """Generative AI client for Frigate using Gemini."""
@@ -48,6 +85,7 @@ class GeminiClient(GenAIClient):
         prompt: str,
         images: list[bytes],
         response_format: Optional[dict] = None,
+        enable_thinking: bool = False,
     ) -> Optional[str]:
         """Submit a request to Gemini."""
         contents = [prompt] + [
@@ -105,11 +143,14 @@ class GeminiClient(GenAIClient):
         messages: list[dict[str, Any]],
         tools: Optional[list[dict[str, Any]]] = None,
         tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
     ) -> dict[str, Any]:
         """
         Send chat messages to Gemini with optional tool definitions.
 
-        Implements function calling/tool usage for Gemini models.
+        Implements function calling/tool usage for Gemini models. Thinking is
+        configured at the model level for Gemini, so ``enable_thinking`` is
+        accepted for interface parity and ignored.
         """
         try:
             # Convert messages to Gemini format
@@ -151,11 +192,17 @@ class GeminiClient(GenAIClient):
                         if not isinstance(tc_args, dict):
                             tc_args = {}
                         if tc_name:
-                            parts.append(
-                                types.Part.from_function_call(
-                                    name=tc_name, args=tc_args
-                                )
+                            fc_part = types.Part.from_function_call(
+                                name=tc_name, args=tc_args
                             )
+                            # Thinking-capable Gemini models require the original
+                            # thought_signature to be echoed back on functionCall
+                            # parts after a tool response, or the next request
+                            # fails with INVALID_ARGUMENT.
+                            sig = _decode_thought_signature(tc.get("thought_signature"))
+                            if sig:
+                                fc_part.thought_signature = sig
+                            parts.append(fc_part)
                     if not parts:
                         parts.append(types.Part.from_text(text=" "))
                     gemini_messages.append(types.Content(role="model", parts=parts))
@@ -234,6 +281,13 @@ class GeminiClient(GenAIClient):
             if tool_config:
                 config_params["tool_config"] = tool_config
 
+            # Ask thinking-capable models (Gemini 2.5+) to include their
+            # reasoning trace as separate `thought` parts so we can surface
+            # it on the reasoning channel. Older models ignore this field.
+            config_params["thinking_config"] = types.ThinkingConfig(
+                include_thoughts=True
+            )
+
             # Merge runtime_options
             if isinstance(self.genai_config.runtime_options, dict):
                 config_params.update(self.genai_config.runtime_options)
@@ -248,19 +302,24 @@ class GeminiClient(GenAIClient):
             if not response or not response.candidates:
                 return {
                     "content": None,
+                    "reasoning": None,
                     "tool_calls": None,
                     "finish_reason": "error",
                 }
 
             candidate = response.candidates[0]
             content = None
+            reasoning_parts: list[str] = []
             tool_calls = None
 
-            # Extract content and tool calls from response
+            # Extract content, reasoning, and tool calls from response
             if candidate.content and candidate.content.parts:
                 for part in candidate.content.parts:
                     if part.text:
-                        content = part.text.strip()
+                        if getattr(part, "thought", False):
+                            reasoning_parts.append(part.text)
+                        else:
+                            content = part.text.strip()
                     elif part.function_call:
                         # Handle function call
                         if tool_calls is None:
@@ -280,9 +339,14 @@ class GeminiClient(GenAIClient):
                                 "id": part.function_call.name or "",
                                 "name": part.function_call.name or "",
                                 "arguments": arguments,
+                                "thought_signature": _encode_thought_signature(
+                                    getattr(part, "thought_signature", None)
+                                ),
                             }
                         )
 
+            reasoning = "".join(reasoning_parts).strip() or None
+
             # Determine finish reason
             finish_reason = "error"
             if hasattr(candidate, "finish_reason") and candidate.finish_reason:
@@ -308,6 +372,7 @@ class GeminiClient(GenAIClient):
 
             return {
                 "content": content,
+                "reasoning": reasoning,
                 "tool_calls": tool_calls,
                 "finish_reason": finish_reason,
             }
@@ -316,6 +381,7 @@ class GeminiClient(GenAIClient):
             logger.warning("Gemini API error during chat_with_tools: %s", str(e))
             return {
                 "content": None,
+                "reasoning": None,
                 "tool_calls": None,
                 "finish_reason": "error",
             }
@@ -325,6 +391,7 @@ class GeminiClient(GenAIClient):
             )
             return {
                 "content": None,
+                "reasoning": None,
                 "tool_calls": None,
                 "finish_reason": "error",
             }
@@ -334,11 +401,14 @@ class GeminiClient(GenAIClient):
         messages: list[dict[str, Any]],
         tools: Optional[list[dict[str, Any]]] = None,
         tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
     ) -> AsyncGenerator[tuple[str, Any], None]:
         """
         Stream chat with tools; yields content deltas then final message.
 
         Implements streaming function calling/tool usage for Gemini models.
+        ``enable_thinking`` is accepted for interface parity; Gemini configures
+        thinking at the model level, so it is ignored here.
         """
         try:
             # Convert messages to Gemini format
@@ -380,11 +450,17 @@ class GeminiClient(GenAIClient):
                         if not isinstance(tc_args, dict):
                             tc_args = {}
                         if tc_name:
-                            parts.append(
-                                types.Part.from_function_call(
-                                    name=tc_name, args=tc_args
-                                )
+                            fc_part = types.Part.from_function_call(
+                                name=tc_name, args=tc_args
                             )
+                            # Thinking-capable Gemini models require the original
+                            # thought_signature to be echoed back on functionCall
+                            # parts after a tool response, or the next request
+                            # fails with INVALID_ARGUMENT.
+                            sig = _decode_thought_signature(tc.get("thought_signature"))
+                            if sig:
+                                fc_part.thought_signature = sig
+                            parts.append(fc_part)
                     if not parts:
                         parts.append(types.Part.from_text(text=" "))
                     gemini_messages.append(types.Content(role="model", parts=parts))
@@ -463,14 +539,22 @@ class GeminiClient(GenAIClient):
             if tool_config:
                 config_params["tool_config"] = tool_config
 
+            # Ask thinking-capable models to include their reasoning trace
+            # as separate `thought` parts (Gemini 2.5+; ignored elsewhere).
+            config_params["thinking_config"] = types.ThinkingConfig(
+                include_thoughts=True
+            )
+
             # Merge runtime_options
             if isinstance(self.genai_config.runtime_options, dict):
                 config_params.update(self.genai_config.runtime_options)
 
             # Use streaming API
             content_parts: list[str] = []
+            reasoning_parts: list[str] = []
             tool_calls_by_index: dict[int, dict[str, Any]] = {}
             finish_reason = "stop"
+            usage_stats: Optional[dict[str, Any]] = None
 
             stream = await self.provider.aio.models.generate_content_stream(
                 model=self.genai_config.model,
@@ -479,6 +563,12 @@ class GeminiClient(GenAIClient):
             )
 
             async for chunk in stream:
+                chunk_usage = getattr(chunk, "usage_metadata", None)
+                if chunk_usage is not None:
+                    maybe_stats = _stats_from_gemini_usage(chunk_usage)
+                    if maybe_stats is not None:
+                        usage_stats = maybe_stats
+
                 if not chunk or not chunk.candidates:
                     continue
 
@@ -498,12 +588,16 @@ class GeminiClient(GenAIClient):
                     ]:
                         finish_reason = "error"
 
-                # Extract content and tool calls from chunk
+                # Extract content, reasoning, and tool calls from chunk
                 if candidate.content and candidate.content.parts:
                     for part in candidate.content.parts:
                         if part.text:
-                            content_parts.append(part.text)
-                            yield ("content_delta", part.text)
+                            if getattr(part, "thought", False):
+                                reasoning_parts.append(part.text)
+                                yield ("reasoning_delta", part.text)
+                            else:
+                                content_parts.append(part.text)
+                                yield ("content_delta", part.text)
                         elif part.function_call:
                             # Handle function call
                             try:
@@ -532,6 +626,7 @@ class GeminiClient(GenAIClient):
                                     "id": tool_call_id,
                                     "name": tool_call_name,
                                     "arguments": "",
+                                    "thought_signature": None,
                                 }
 
                             # Accumulate arguments
@@ -542,8 +637,16 @@ class GeminiClient(GenAIClient):
                                     else str(arguments)
                                 )
 
+                            # Capture latest thought_signature for this call
+                            chunk_sig = getattr(part, "thought_signature", None)
+                            if chunk_sig:
+                                tool_calls_by_index[found_index][
+                                    "thought_signature"
+                                ] = chunk_sig
+
             # Build final message
             full_content = "".join(content_parts).strip() or None
+            full_reasoning = "".join(reasoning_parts).strip() or None
 
             # Convert tool calls to list format
             tool_calls_list = None
@@ -561,14 +664,21 @@ class GeminiClient(GenAIClient):
                             "id": tc["id"],
                             "name": tc["name"],
                             "arguments": parsed_args,
+                            "thought_signature": _encode_thought_signature(
+                                tc.get("thought_signature")
+                            ),
                         }
                     )
                 finish_reason = "tool_calls"
 
+            if usage_stats is not None:
+                yield ("stats", usage_stats)
+
             yield (
                 "message",
                 {
                     "content": full_content,
+                    "reasoning": full_reasoning,
                     "tool_calls": tool_calls_list,
                     "finish_reason": finish_reason,
                 },
@@ -580,6 +690,7 @@ class GeminiClient(GenAIClient):
                 "message",
                 {
                     "content": None,
+                    "reasoning": None,
                     "tool_calls": None,
                     "finish_reason": "error",
                 },
@@ -592,6 +703,7 @@ class GeminiClient(GenAIClient):
                 "message",
                 {
                     "content": None,
+                    "reasoning": None,
                     "tool_calls": None,
                     "finish_reason": "error",
                 },

frigate/genai/plugins/llama_cpp.py

@@ -4,7 +4,7 @@ import base64
 import io
 import json
 import logging
-from typing import Any, AsyncGenerator, Optional
+from typing import Any, AsyncGenerator, Optional, cast
 
 import httpx
 import numpy as np
@@ -18,6 +18,86 @@ from frigate.genai.utils import parse_tool_calls_from_message
 logger = logging.getLogger(__name__)
 
 
+def _stats_from_llama_cpp_chunk(data: dict[str, Any]) -> Optional[dict[str, Any]]:
+    """Build a stats dict from a llama.cpp streaming chunk.
+
+    Final-chunk `usage` carries authoritative token counts. Per-chunk
+    `timings` (enabled via timings_per_token) carries the running token
+    counts (prompt_n, predicted_n) and generation rate, so live updates
+    work mid-stream.
+    """
+    usage = data.get("usage") or {}
+    timings = data.get("timings") or {}
+    prompt_tokens = usage.get("prompt_tokens")
+    completion_tokens = usage.get("completion_tokens")
+    predicted_ms = timings.get("predicted_ms")
+    tps = timings.get("predicted_per_second")
+    stats: dict[str, Any] = {}
+
+    if not isinstance(prompt_tokens, int):
+        prompt_n = timings.get("prompt_n")
+
+        if isinstance(prompt_n, int):
+            prompt_tokens = prompt_n
+
+    if not isinstance(completion_tokens, int):
+        predicted_n = timings.get("predicted_n")
+
+        if isinstance(predicted_n, int):
+            completion_tokens = predicted_n
+
+    if not isinstance(prompt_tokens, int) and not isinstance(completion_tokens, int):
+        return None
+
+    if isinstance(prompt_tokens, int):
+        stats["prompt_tokens"] = prompt_tokens
+
+    if isinstance(completion_tokens, int):
+        stats["completion_tokens"] = completion_tokens
+
+    if isinstance(predicted_ms, (int, float)) and predicted_ms > 0:
+        stats["completion_duration_ms"] = float(predicted_ms)
+
+    if isinstance(tps, (int, float)) and tps > 0:
+        stats["tokens_per_second"] = float(tps)
+
+    return stats or None
+
+
+def _parse_launch_arg(args: list[str], flag: str) -> str | None:
+    """Return the value following `flag` in a positional argv list, or None."""
+    try:
+        idx = args.index(flag)
+    except ValueError:
+        return None
+    if idx + 1 >= len(args):
+        return None
+    return args[idx + 1]
+
+
+def _fetch_llama_props(base_url: str, model: str) -> dict[str, Any]:
+    """Fetch /props from a llama.cpp server, with llama-swap fallback.
+
+    Raises the underlying RequestException if both endpoints fail; callers
+    decide how to surface the failure.
+    """
+    try:
+        response = requests.get(
+            f"{base_url}/props",
+            params={"model": model},
+            timeout=10,
+        )
+        response.raise_for_status()
+        return cast(dict[str, Any], response.json())
+    except Exception:
+        response = requests.get(
+            f"{base_url}/upstream/{model}/props",
+            timeout=10,
+        )
+        response.raise_for_status()
+        return cast(dict[str, Any], response.json())
+
+
 def _to_jpeg(img_bytes: bytes) -> bytes | None:
     """Convert image bytes to JPEG. llama.cpp/STB does not support WebP."""
     try:
@@ -42,6 +122,7 @@ class LlamaCppClient(GenAIClient):
     _supports_vision: bool
     _supports_audio: bool
     _supports_tools: bool
+    _supports_reasoning: bool
     _image_token_cache: dict[tuple[int, int], int]
     _text_baseline_tokens: int | None
     _media_marker: str
@@ -55,6 +136,7 @@ class LlamaCppClient(GenAIClient):
         self._supports_vision = False
         self._supports_audio = False
         self._supports_tools = False
+        self._supports_reasoning = False
         self._image_token_cache = {}
         self._text_baseline_tokens = None
         self._media_marker = "<__media__>"
@@ -70,27 +152,77 @@ class LlamaCppClient(GenAIClient):
         else:
             base_url = base_url.replace("/v1", "")  # Strip /v1 if included in base_url
 
-        configured_model = self.genai_config.model
+        if not self.validate_model:
+            # Probe path
+            return base_url
 
-        # Query /v1/models to validate the configured model exists
+        configured_model = self.genai_config.model
+        info = self._get_model_info(base_url, configured_model)
+
+        if info is None:
+            return None
+
+        self._context_size = info["context_size"]
+        self._supports_vision = info["supports_vision"]
+        self._supports_audio = info["supports_audio"]
+        self._supports_tools = info["supports_tools"]
+        self._supports_reasoning = info["supports_reasoning"]
+        self._media_marker = info["media_marker"]
+
+        logger.info(
+            "llama.cpp model '%s' initialized — context: %s, vision: %s, audio: %s, tools: %s, reasoning: %s",
+            configured_model,
+            self._context_size or "unknown",
+            self._supports_vision,
+            self._supports_audio,
+            self._supports_tools,
+            self._supports_reasoning,
+        )
+
+        return base_url
+
+    def _get_model_info(
+        self, base_url: str, configured_model: str
+    ) -> dict[str, Any] | None:
+        """Resolve model metadata from /v1/models with /props fallback.
+
+        Returns a dict of capability fields, or None if the server's model
+        registry was reachable and reported the configured model as missing.
+        A reachable-but-unparseable /v1/models is treated as soft-pass and
+        falls through to /props, matching prior behavior.
+
+        After ggml-org/llama.cpp#22952, /v1/models exposes per-model
+        `architecture.input_modalities` (text/image/audio) — the primary
+        source. When proxied through llama-swap, the same entry carries
+        `status.args` (server launch argv) and, for the loaded model,
+        `meta.n_ctx`. /props remains the only source for `media_marker`,
+        which the server randomizes per startup unless LLAMA_MEDIA_MARKER
+        is set.
+        """
+        info: dict[str, Any] = {
+            "context_size": None,
+            "supports_vision": False,
+            "supports_audio": False,
+            "supports_tools": False,
+            "supports_reasoning": False,
+            "media_marker": "<__media__>",
+        }
+
+        model_entry: dict[str, Any] | None = None
         try:
-            response = requests.get(
-                f"{base_url}/v1/models",
-                timeout=10,
-            )
+            response = requests.get(f"{base_url}/v1/models", timeout=10)
             response.raise_for_status()
             models_data = response.json()
 
-            model_found = False
             for model in models_data.get("data", []):
                 model_ids = {model.get("id")}
                 for alias in model.get("aliases", []):
                     model_ids.add(alias)
                 if configured_model in model_ids:
-                    model_found = True
+                    model_entry = model
                     break
 
-            if not model_found:
+            if model_entry is None:
                 available = []
                 for m in models_data.get("data", []):
                     available.append(m.get("id", "unknown"))
@@ -109,71 +241,78 @@ class LlamaCppClient(GenAIClient):
                 e,
             )
 
-        # Query /props for context size, modalities, and tool support.
-        # The standard /props?model=<name> endpoint works with llama-server.
-        # If it fails, try the llama-swap per-model passthrough endpoint which
-        # returns props for a specific model without requiring it to be loaded.
-        try:
-            try:
-                response = requests.get(
-                    f"{base_url}/props",
-                    params={"model": configured_model},
-                    timeout=10,
-                )
-                response.raise_for_status()
-                props = response.json()
-            except Exception:
-                response = requests.get(
-                    f"{base_url}/upstream/{configured_model}/props",
-                    timeout=10,
-                )
-                response.raise_for_status()
-                props = response.json()
+        if model_entry is not None:
+            architecture = model_entry.get("architecture") or {}
+            input_modalities = architecture.get("input_modalities") or []
+
+            if isinstance(input_modalities, list):
+                info["supports_vision"] = "image" in input_modalities
+                info["supports_audio"] = "audio" in input_modalities
+
+            status = model_entry.get("status") or {}
+            launch_args = status.get("args") if isinstance(status, dict) else None
+            if not isinstance(launch_args, list):
+                launch_args = []
+
+            meta = model_entry.get("meta") if isinstance(model_entry, dict) else None
+            n_ctx = meta.get("n_ctx") if isinstance(meta, dict) else None
+
+            if not n_ctx:
+                n_ctx = _parse_launch_arg(launch_args, "--ctx-size")
 
-            # Context size from server runtime config
-            default_settings = props.get("default_generation_settings", {})
-            n_ctx = default_settings.get("n_ctx")
             if n_ctx:
-                self._context_size = int(n_ctx)
+                try:
+                    info["context_size"] = int(n_ctx)
+                except (TypeError, ValueError):
+                    pass
 
-            # Modalities (vision, audio)
-            modalities = props.get("modalities", {})
-            self._supports_vision = modalities.get("vision", False)
-            self._supports_audio = modalities.get("audio", False)
+            # Tool calling on llama-server requires --jinja.
+            if "--jinja" in launch_args:
+                info["supports_tools"] = True
 
-            # Tool support from chat template capabilities
-            chat_caps = props.get("chat_template_caps", {})
-            self._supports_tools = chat_caps.get("supports_tools", False)
+        try:
+            props = _fetch_llama_props(base_url, configured_model)
+
+            if info["context_size"] is None:
+                default_settings = props.get("default_generation_settings", {})
+                n_ctx = default_settings.get("n_ctx")
+                if n_ctx:
+                    info["context_size"] = int(n_ctx)
+
+            if not (info["supports_vision"] or info["supports_audio"]):
+                modalities = props.get("modalities", {})
+                info["supports_vision"] = bool(modalities.get("vision", False))
+                info["supports_audio"] = bool(modalities.get("audio", False))
+
+            chat_caps = props.get("chat_template_caps") or {}
+
+            if not info["supports_tools"]:
+                info["supports_tools"] = bool(chat_caps.get("supports_tools", False))
+
+            # llama.cpp does not advertise per-template reasoning support, so
+            # detect it by looking for the `enable_thinking` toggle variable
+            # in the Jinja chat template itself.
+            chat_template = props.get("chat_template") or ""
+            info["supports_reasoning"] = "enable_thinking" in chat_template
 
-            # Media marker for multimodal embeddings; the server randomizes this
-            # per startup unless LLAMA_MEDIA_MARKER is set, so we must read it
-            # from /props rather than hardcoding "<__media__>".
             media_marker = props.get("media_marker")
             if isinstance(media_marker, str) and media_marker:
-                self._media_marker = media_marker
-
-            logger.info(
-                "llama.cpp model '%s' initialized — context: %s, vision: %s, audio: %s, tools: %s",
-                configured_model,
-                self._context_size or "unknown",
-                self._supports_vision,
-                self._supports_audio,
-                self._supports_tools,
-            )
+                info["media_marker"] = media_marker
         except Exception as e:
             logger.warning(
                 "Failed to query llama.cpp /props endpoint: %s. "
-                "Using defaults for context size and capabilities.",
+                "Image embeddings may fail if the server randomized its media marker.",
                 e,
             )
 
-        return base_url
+        return info
 
     def _send(
         self,
         prompt: str,
         images: list[bytes],
         response_format: Optional[dict] = None,
+        enable_thinking: bool = False,
     ) -> Optional[str]:
         """Submit a request to llama.cpp server."""
         if self.provider is None:
@@ -201,7 +340,7 @@ class LlamaCppClient(GenAIClient):
                 )
 
             # Build request payload with llama.cpp native options
-            payload = {
+            payload: dict[str, Any] = {
                 "model": self.genai_config.model,
                 "messages": [
                     {
@@ -215,6 +354,9 @@ class LlamaCppClient(GenAIClient):
             if response_format:
                 payload["response_format"] = response_format
 
+            if self.supports_toggleable_thinking:
+                payload["chat_template_kwargs"] = {"enable_thinking": enable_thinking}
+
             response = requests.post(
                 f"{self.provider}/v1/chat/completions",
                 json=payload,
@@ -251,6 +393,10 @@ class LlamaCppClient(GenAIClient):
         """Whether the loaded model supports tool/function calling."""
         return self._supports_tools
 
+    @property
+    def supports_toggleable_thinking(self) -> bool:
+        return self._supports_reasoning
+
     def list_models(self) -> list[str]:
         """Return available model IDs from the llama.cpp server."""
         base_url = self.provider or (
@@ -378,6 +524,7 @@ class LlamaCppClient(GenAIClient):
         tools: Optional[list[dict[str, Any]]],
         tool_choice: Optional[str],
         stream: bool = False,
+        enable_thinking: Optional[bool] = None,
     ) -> dict[str, Any]:
         """Build request payload for chat completions (sync or stream)."""
         openai_tool_choice = None
@@ -393,29 +540,47 @@ class LlamaCppClient(GenAIClient):
             "messages": messages,
             "model": self.genai_config.model,
         }
+
         if stream:
             payload["stream"] = True
+            payload["stream_options"] = {"include_usage": True}
+            payload["timings_per_token"] = True
+
         if tools:
             payload["tools"] = tools
+
             if openai_tool_choice is not None:
                 payload["tool_choice"] = openai_tool_choice
+
+        if enable_thinking is not None and self._supports_reasoning:
+            payload["chat_template_kwargs"] = {"enable_thinking": enable_thinking}
+
         provider_opts = {
             k: v for k, v in self.provider_options.items() if k != "context_size"
         }
         payload.update(provider_opts)
+        payload.update(self.genai_config.runtime_options)
         return payload
 
     def _message_from_choice(self, choice: dict[str, Any]) -> dict[str, Any]:
-        """Parse OpenAI-style choice into {content, tool_calls, finish_reason}."""
+        """Parse OpenAI-style choice into {content, reasoning, tool_calls, finish_reason}.
+
+        llama.cpp's `--reasoning-format` puts the trace in
+        `message.reasoning_content` (preferred) or `message.thinking`; both
+        keys are accepted so different builds work without configuration.
+        """
         message = choice.get("message", {})
         content = message.get("content")
         content = content.strip() if content else None
+        reasoning = message.get("reasoning_content") or message.get("thinking")
+        reasoning = reasoning.strip() if reasoning else None
         tool_calls = parse_tool_calls_from_message(message)
         finish_reason = choice.get("finish_reason") or (
             "tool_calls" if tool_calls else "stop" if content else "error"
         )
         return {
             "content": content,
+            "reasoning": reasoning,
             "tool_calls": tool_calls,
             "finish_reason": finish_reason,
         }
@@ -444,6 +609,31 @@ class LlamaCppClient(GenAIClient):
             )
         return result if result else None
 
+    def _refresh_media_marker(self) -> bool:
+        """Re-fetch /props and update the cached media marker if it changed.
+
+        The server randomizes the marker per startup (unless LLAMA_MEDIA_MARKER
+        is set), so a stale marker indicates a restart. Returns True iff the
+        marker was updated to a new value — used to gate a one-shot retry of
+        a failed embeddings request.
+        """
+        if self.provider is None:
+            return False
+        try:
+            props = _fetch_llama_props(self.provider, self.genai_config.model)
+        except Exception as e:
+            logger.warning("Failed to refresh llama.cpp media marker: %s", e)
+            return False
+
+        marker = props.get("media_marker")
+
+        if not isinstance(marker, str) or not marker or marker == self._media_marker:
+            return False
+
+        logger.info("llama.cpp media marker changed (server restart); refreshed")
+        self._media_marker = marker
+        return True
+
     def embed(
         self,
         texts: list[str] | None = None,
@@ -468,30 +658,46 @@ class LlamaCppClient(GenAIClient):
 
         EMBEDDING_DIM = 768
 
-        content = []
-        for text in texts:
-            content.append({"prompt_string": text})
+        encoded_images: list[str] = []
         for img in images:
             # llama.cpp uses STB which does not support WebP; convert to JPEG
             jpeg_bytes = _to_jpeg(img)
             to_encode = jpeg_bytes if jpeg_bytes is not None else img
-            encoded = base64.b64encode(to_encode).decode("utf-8")
-            # prompt_string must contain the server's media marker placeholder.
-            # The marker is randomized per server startup (read from /props).
-            content.append(
-                {
-                    "prompt_string": f"{self._media_marker}\n",
-                    "multimodal_data": [encoded],  # type: ignore[dict-item]
-                }
+            encoded_images.append(base64.b64encode(to_encode).decode("utf-8"))
+
+        def build_content() -> list[dict[str, Any]]:
+            # prompt_string must contain the server's media marker placeholder
+            # for each image. The marker is randomized per server startup.
+            content: list[dict[str, Any]] = []
+            for text in texts:
+                content.append({"prompt_string": text})
+            for encoded in encoded_images:
+                content.append(
+                    {
+                        "prompt_string": f"{self._media_marker}\n",
+                        "multimodal_data": [encoded],
+                    }
+                )
+            return content
+
+        def post_embeddings() -> requests.Response:
+            return requests.post(
+                f"{self.provider}/embeddings",
+                json={"model": self.genai_config.model, "content": build_content()},
+                timeout=self.timeout,
             )
 
         try:
-            response = requests.post(
-                f"{self.provider}/embeddings",
-                json={"model": self.genai_config.model, "content": content},
-                timeout=self.timeout,
-            )
-            response.raise_for_status()
+            try:
+                response = post_embeddings()
+                response.raise_for_status()
+            except requests.exceptions.RequestException:
+                # The server may have restarted with a new media marker.
+                # Refresh from /props; only retry if the marker actually changed.
+                if not encoded_images or not self._refresh_media_marker():
+                    raise
+                response = post_embeddings()
+                response.raise_for_status()
             result = response.json()
 
             items = result.get("data", result) if isinstance(result, dict) else result
@@ -554,6 +760,7 @@ class LlamaCppClient(GenAIClient):
         messages: list[dict[str, Any]],
         tools: Optional[list[dict[str, Any]]] = None,
         tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
     ) -> dict[str, Any]:
         """
         Send chat messages to llama.cpp server with optional tool definitions.
@@ -571,7 +778,13 @@ class LlamaCppClient(GenAIClient):
                 "finish_reason": "error",
             }
         try:
-            payload = self._build_payload(messages, tools, tool_choice, stream=False)
+            payload = self._build_payload(
+                messages,
+                tools,
+                tool_choice,
+                stream=False,
+                enable_thinking=enable_thinking,
+            )
             response = requests.post(
                 f"{self.provider}/v1/chat/completions",
                 json=payload,
@@ -619,6 +832,7 @@ class LlamaCppClient(GenAIClient):
         messages: list[dict[str, Any]],
         tools: Optional[list[dict[str, Any]]] = None,
         tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
     ) -> AsyncGenerator[tuple[str, Any], None]:
         """Stream chat with tools via OpenAI-compatible streaming API."""
         if self.provider is None:
@@ -635,8 +849,15 @@ class LlamaCppClient(GenAIClient):
             )
             return
         try:
-            payload = self._build_payload(messages, tools, tool_choice, stream=True)
+            payload = self._build_payload(
+                messages,
+                tools,
+                tool_choice,
+                stream=True,
+                enable_thinking=enable_thinking,
+            )
             content_parts: list[str] = []
+            reasoning_parts: list[str] = []
             tool_calls_by_index: dict[int, dict[str, Any]] = {}
             finish_reason = "stop"
 
@@ -657,12 +878,24 @@ class LlamaCppClient(GenAIClient):
                             data = json.loads(data_str)
                         except json.JSONDecodeError:
                             continue
+                        maybe_stats = _stats_from_llama_cpp_chunk(data)
+                        if maybe_stats is not None:
+                            yield ("stats", maybe_stats)
                         choices = data.get("choices") or []
                         if not choices:
                             continue
                         delta = choices[0].get("delta", {})
                         if choices[0].get("finish_reason"):
                             finish_reason = choices[0]["finish_reason"]
+                        # llama.cpp emits separated thinking under
+                        # reasoning_content (preferred) or thinking before any
+                        # content tokens arrive
+                        reasoning_delta = delta.get("reasoning_content") or delta.get(
+                            "thinking"
+                        )
+                        if reasoning_delta:
+                            reasoning_parts.append(reasoning_delta)
+                            yield ("reasoning_delta", reasoning_delta)
                         if delta.get("content"):
                             content_parts.append(delta["content"])
                             yield ("content_delta", delta["content"])
@@ -688,6 +921,7 @@ class LlamaCppClient(GenAIClient):
                                 )
 
             full_content = "".join(content_parts).strip() or None
+            full_reasoning = "".join(reasoning_parts).strip() or None
             tool_calls_list = self._streamed_tool_calls_to_list(tool_calls_by_index)
             if tool_calls_list:
                 finish_reason = "tool_calls"
@@ -695,6 +929,7 @@ class LlamaCppClient(GenAIClient):
                 "message",
                 {
                     "content": full_content,
+                    "reasoning": full_reasoning,
                     "tool_calls": tool_calls_list,
                     "finish_reason": finish_reason,
                 },

frigate/genai/plugins/ollama.py

@@ -18,6 +18,37 @@ from frigate.genai.utils import parse_tool_calls_from_message
 logger = logging.getLogger(__name__)
 
 
+def _extract_ollama_stats(response: Any) -> Optional[dict[str, Any]]:
+    """Build a stats dict from Ollama's response metadata.
+
+    Ollama reports eval_count/eval_duration (generation) and
+    prompt_eval_count (context size). Durations are nanoseconds.
+    """
+    if not response:
+        return None
+    if hasattr(response, "get"):
+        getter = response.get
+    else:
+        getter = lambda key: getattr(response, key, None)  # noqa: E731
+
+    eval_count = getter("eval_count")
+    eval_duration_ns = getter("eval_duration")
+    prompt_eval_count = getter("prompt_eval_count")
+    if eval_count is None and prompt_eval_count is None:
+        return None
+
+    stats: dict[str, Any] = {}
+    if isinstance(prompt_eval_count, int):
+        stats["prompt_tokens"] = prompt_eval_count
+    if isinstance(eval_count, int):
+        stats["completion_tokens"] = eval_count
+    if isinstance(eval_duration_ns, int) and eval_duration_ns > 0:
+        stats["completion_duration_ms"] = eval_duration_ns / 1_000_000
+        if isinstance(eval_count, int) and eval_count > 0:
+            stats["tokens_per_second"] = eval_count / (eval_duration_ns / 1_000_000_000)
+    return stats or None
+
+
 def _normalize_multimodal_content(
     content: Any,
 ) -> tuple[Optional[str], Optional[list[bytes]]]:
@@ -67,6 +98,22 @@ class OllamaClient(GenAIClient):
 
     provider: ApiClient | None
     provider_options: dict[str, Any]
+    _supports_thinking_cache: Optional[bool] = None
+
+    @property
+    def supports_toggleable_thinking(self) -> bool:
+        if self._supports_thinking_cache is not None:
+            return self._supports_thinking_cache
+        if self.provider is None:
+            return False
+        try:
+            response = self.provider.show(self.genai_config.model)
+            capabilities = response.get("capabilities") or []
+            self._supports_thinking_cache = "thinking" in capabilities
+        except Exception as e:
+            logger.debug("Failed to query Ollama model capabilities: %s", e)
+            self._supports_thinking_cache = False
+        return self._supports_thinking_cache
 
     def _auth_headers(self) -> dict | None:
         if self.genai_config.api_key:
@@ -87,6 +134,9 @@ class OllamaClient(GenAIClient):
                 timeout=self.timeout,
                 headers=self._auth_headers(),
             )
+            if not self.validate_model:
+                # Probe path
+                return client
             # ensure the model is available locally
             response = client.show(self.genai_config.model)
             if response.get("error"):
@@ -144,6 +194,7 @@ class OllamaClient(GenAIClient):
         prompt: str,
         images: list[bytes],
         response_format: Optional[dict] = None,
+        enable_thinking: bool = False,
     ) -> Optional[str]:
         """Submit a request to Ollama"""
         if self.provider is None:
@@ -160,6 +211,8 @@ class OllamaClient(GenAIClient):
                 schema = response_format.get("json_schema", {}).get("schema")
                 if schema:
                     ollama_options["format"] = self._clean_schema_for_ollama(schema)
+            if self.supports_toggleable_thinking:
+                ollama_options["think"] = enable_thinking
             logger.debug(
                 "Ollama generate request: model=%s, prompt_len=%s, image_count=%s, "
                 "has_format=%s, options=%s",
@@ -240,6 +293,7 @@ class OllamaClient(GenAIClient):
         tools: Optional[list[dict[str, Any]]],
         tool_choice: Optional[str],
         stream: bool = False,
+        enable_thinking: Optional[bool] = None,
     ) -> dict[str, Any]:
         """Build request_messages and params for chat (sync or stream)."""
         request_messages = []
@@ -278,11 +332,14 @@ class OllamaClient(GenAIClient):
             "model": self.genai_config.model,
             "messages": request_messages,
             **self.provider_options,
+            **self.genai_config.runtime_options,
         }
         if stream:
             request_params["stream"] = True
         if tools:
             request_params["tools"] = tools
+        if enable_thinking is not None and self.supports_toggleable_thinking:
+            request_params["think"] = enable_thinking
         return request_params
 
     def _message_from_response(self, response: dict[str, Any]) -> dict[str, Any]:
@@ -305,6 +362,9 @@ class OllamaClient(GenAIClient):
             response.get("done"),
         )
         content = message.get("content", "").strip() if message.get("content") else None
+        reasoning = (
+            message.get("thinking", "").strip() if message.get("thinking") else None
+        )
         tool_calls = parse_tool_calls_from_message(message)
         finish_reason = "error"
         if response.get("done"):
@@ -317,6 +377,7 @@ class OllamaClient(GenAIClient):
             finish_reason = "stop"
         return {
             "content": content,
+            "reasoning": reasoning,
             "tool_calls": tool_calls,
             "finish_reason": finish_reason,
         }
@@ -326,6 +387,7 @@ class OllamaClient(GenAIClient):
         messages: list[dict[str, Any]],
         tools: Optional[list[dict[str, Any]]] = None,
         tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
     ) -> dict[str, Any]:
         if self.provider is None:
             logger.warning(
@@ -338,7 +400,11 @@ class OllamaClient(GenAIClient):
             }
         try:
             request_params = self._build_request_params(
-                messages, tools, tool_choice, stream=False
+                messages,
+                tools,
+                tool_choice,
+                stream=False,
+                enable_thinking=enable_thinking,
             )
             response = self.provider.chat(**request_params)
             return self._message_from_response(response)
@@ -362,6 +428,7 @@ class OllamaClient(GenAIClient):
         messages: list[dict[str, Any]],
         tools: Optional[list[dict[str, Any]]] = None,
         tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
     ) -> AsyncGenerator[tuple[str, Any], None]:
         """Stream chat with tools; yields content deltas then final message.
 
@@ -391,7 +458,11 @@ class OllamaClient(GenAIClient):
                     "Ollama: tools provided, using non-streaming call for tool support"
                 )
                 request_params = self._build_request_params(
-                    messages, tools, tool_choice, stream=False
+                    messages,
+                    tools,
+                    tool_choice,
+                    stream=False,
+                    enable_thinking=enable_thinking,
                 )
                 async_client = OllamaAsyncClient(
                     host=self.genai_config.base_url,
@@ -400,14 +471,24 @@ class OllamaClient(GenAIClient):
                 )
                 response = await async_client.chat(**request_params)
                 result = self._message_from_response(response)
+                reasoning = result.get("reasoning")
+                if reasoning:
+                    yield ("reasoning_delta", reasoning)
                 content = result.get("content")
                 if content:
                     yield ("content_delta", content)
+                stats = _extract_ollama_stats(response)
+                if stats is not None:
+                    yield ("stats", stats)
                 yield ("message", result)
                 return
 
             request_params = self._build_request_params(
-                messages, tools, tool_choice, stream=True
+                messages,
+                tools,
+                tool_choice,
+                stream=True,
+                enable_thinking=enable_thinking,
             )
             async_client = OllamaAsyncClient(
                 host=self.genai_config.base_url,
@@ -415,25 +496,38 @@ class OllamaClient(GenAIClient):
                 headers=self._auth_headers(),
             )
             content_parts: list[str] = []
+            reasoning_parts: list[str] = []
             final_message: dict[str, Any] | None = None
+            final_chunk: Any = None
             stream = await async_client.chat(**request_params)
             async for chunk in stream:
                 if not chunk or "message" not in chunk:
                     continue
                 msg = chunk.get("message", {})
+                reasoning_delta = msg.get("thinking") or ""
+                if reasoning_delta:
+                    reasoning_parts.append(reasoning_delta)
+                    yield ("reasoning_delta", reasoning_delta)
                 delta = msg.get("content") or ""
                 if delta:
                     content_parts.append(delta)
                     yield ("content_delta", delta)
                 if chunk.get("done"):
+                    final_chunk = chunk
                     full_content = "".join(content_parts).strip() or None
+                    full_reasoning = "".join(reasoning_parts).strip() or None
                     final_message = {
                         "content": full_content,
+                        "reasoning": full_reasoning,
                         "tool_calls": None,
                         "finish_reason": "stop",
                     }
                     break
 
+            stats = _extract_ollama_stats(final_chunk)
+            if stats is not None:
+                yield ("stats", stats)
+
             if final_message is not None:
                 yield ("message", final_message)
             else:
@@ -441,6 +535,7 @@ class OllamaClient(GenAIClient):
                     "message",
                     {
                         "content": "".join(content_parts).strip() or None,
+                        "reasoning": "".join(reasoning_parts).strip() or None,
                         "tool_calls": None,
                         "finish_reason": "stop",
                     },

frigate/genai/plugins/openai.py

@@ -14,6 +14,22 @@ from frigate.genai import GenAIClient, register_genai_provider
 logger = logging.getLogger(__name__)
 
 
+def _stats_from_openai_usage(usage: Any) -> Optional[dict[str, Any]]:
+    """Build a stats dict from an OpenAI-compatible usage object."""
+    if usage is None:
+        return None
+    prompt_tokens = getattr(usage, "prompt_tokens", None)
+    completion_tokens = getattr(usage, "completion_tokens", None)
+    if prompt_tokens is None and completion_tokens is None:
+        return None
+    stats: dict[str, Any] = {}
+    if isinstance(prompt_tokens, int):
+        stats["prompt_tokens"] = prompt_tokens
+    if isinstance(completion_tokens, int):
+        stats["completion_tokens"] = completion_tokens
+    return stats or None
+
+
 @register_genai_provider(GenAIProviderEnum.openai)
 class OpenAIClient(GenAIClient):
     """Generative AI client for Frigate using OpenAI."""
@@ -22,7 +38,11 @@ class OpenAIClient(GenAIClient):
     context_size: Optional[int] = None
 
     def _init_provider(self) -> OpenAI:
-        """Initialize the client."""
+        """Initialize the client.
+
+        Subclasses (e.g. Azure) should raise on configuration errors; the
+        manager catches construction failures and disables the provider.
+        """
         # Extract context_size from provider_options as it's not a valid OpenAI client parameter
         # It will be used in get_context_size() instead
         provider_opts = {
@@ -41,6 +61,7 @@ class OpenAIClient(GenAIClient):
         prompt: str,
         images: list[bytes],
         response_format: Optional[dict] = None,
+        enable_thinking: bool = False,
     ) -> Optional[str]:
         """Submit a request to OpenAI."""
         encoded_images = [base64.b64encode(image).decode("utf-8") for image in images]
@@ -167,11 +188,14 @@ class OpenAIClient(GenAIClient):
         messages: list[dict[str, Any]],
         tools: Optional[list[dict[str, Any]]] = None,
         tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
     ) -> dict[str, Any]:
         """
         Send chat messages to OpenAI with optional tool definitions.
 
-        Implements function calling/tool usage for OpenAI models.
+        Implements function calling/tool usage for OpenAI models. The OpenAI
+        chat completions API does not expose a per-request thinking toggle,
+        so ``enable_thinking`` is accepted for interface parity and ignored.
         """
         try:
             openai_tool_choice = None
@@ -187,6 +211,7 @@ class OpenAIClient(GenAIClient):
                 "model": self.genai_config.model,
                 "messages": messages,
                 "timeout": self.timeout,
+                **self.genai_config.runtime_options,
             }
 
             if tools:
@@ -203,7 +228,7 @@ class OpenAIClient(GenAIClient):
                 }
                 request_params.update(provider_opts)
 
-            result = self.provider.chat.completions.create(**request_params)  # type: ignore[call-overload]
+            result = self.provider.chat.completions.create(**request_params)
 
             if (
                 result is None
@@ -219,6 +244,10 @@ class OpenAIClient(GenAIClient):
             choice = result.choices[0]
             message = choice.message
             content = message.content.strip() if message.content else None
+            raw_reasoning = getattr(message, "reasoning_content", None) or getattr(
+                message, "reasoning", None
+            )
+            reasoning = raw_reasoning.strip() if raw_reasoning else None
 
             tool_calls = None
             if message.tool_calls:
@@ -253,6 +282,7 @@ class OpenAIClient(GenAIClient):
 
             return {
                 "content": content,
+                "reasoning": reasoning,
                 "tool_calls": tool_calls,
                 "finish_reason": finish_reason,
             }
@@ -261,6 +291,7 @@ class OpenAIClient(GenAIClient):
             logger.warning("OpenAI request timed out: %s", str(e))
             return {
                 "content": None,
+                "reasoning": None,
                 "tool_calls": None,
                 "finish_reason": "error",
             }
@@ -268,6 +299,7 @@ class OpenAIClient(GenAIClient):
             logger.warning("OpenAI returned an error: %s", str(e))
             return {
                 "content": None,
+                "reasoning": None,
                 "tool_calls": None,
                 "finish_reason": "error",
             }
@@ -277,11 +309,15 @@ class OpenAIClient(GenAIClient):
         messages: list[dict[str, Any]],
         tools: Optional[list[dict[str, Any]]] = None,
         tool_choice: Optional[str] = "auto",
+        enable_thinking: Optional[bool] = None,
     ) -> AsyncGenerator[tuple[str, Any], None]:
         """
         Stream chat with tools; yields content deltas then final message.
 
         Implements streaming function calling/tool usage for OpenAI models.
+        The OpenAI chat completions API does not expose a per-request thinking
+        toggle, so ``enable_thinking`` is accepted for interface parity and
+        ignored.
         """
         try:
             openai_tool_choice = None
@@ -298,6 +334,8 @@ class OpenAIClient(GenAIClient):
                 "messages": messages,
                 "timeout": self.timeout,
                 "stream": True,
+                "stream_options": {"include_usage": True},
+                **self.genai_config.runtime_options,
             }
 
             if tools:
@@ -316,12 +354,18 @@ class OpenAIClient(GenAIClient):
 
             # Use streaming API
             content_parts: list[str] = []
+            reasoning_parts: list[str] = []
             tool_calls_by_index: dict[int, dict[str, Any]] = {}
             finish_reason = "stop"
+            usage_stats: Optional[dict[str, Any]] = None
 
-            stream = self.provider.chat.completions.create(**request_params)  # type: ignore[call-overload]
+            stream = self.provider.chat.completions.create(**request_params)
 
             for chunk in stream:
+                chunk_usage = getattr(chunk, "usage", None)
+                if chunk_usage is not None:
+                    usage_stats = _stats_from_openai_usage(chunk_usage)
+
                 if not chunk or not chunk.choices:
                     continue
 
@@ -332,6 +376,15 @@ class OpenAIClient(GenAIClient):
                 if choice.finish_reason:
                     finish_reason = choice.finish_reason
 
+                # Extract reasoning deltas (reasoning_content or reasoning,
+                # depending on the server)
+                reasoning_delta = getattr(delta, "reasoning_content", None) or getattr(
+                    delta, "reasoning", None
+                )
+                if reasoning_delta:
+                    reasoning_parts.append(reasoning_delta)
+                    yield ("reasoning_delta", reasoning_delta)
+
                 # Extract content deltas
                 if delta.content:
                     content_parts.append(delta.content)
@@ -360,6 +413,7 @@ class OpenAIClient(GenAIClient):
 
             # Build final message
             full_content = "".join(content_parts).strip() or None
+            full_reasoning = "".join(reasoning_parts).strip() or None
 
             # Convert tool calls to list format
             tool_calls_list = None
@@ -381,10 +435,14 @@ class OpenAIClient(GenAIClient):
                     )
                 finish_reason = "tool_calls"
 
+            if usage_stats is not None:
+                yield ("stats", usage_stats)
+
             yield (
                 "message",
                 {
                     "content": full_content,
+                    "reasoning": full_reasoning,
                     "tool_calls": tool_calls_list,
                     "finish_reason": finish_reason,
                 },
@@ -396,6 +454,7 @@ class OpenAIClient(GenAIClient):
                 "message",
                 {
                     "content": None,
+                    "reasoning": None,
                     "tool_calls": None,
                     "finish_reason": "error",
                 },
@@ -406,6 +465,7 @@ class OpenAIClient(GenAIClient):
                 "message",
                 {
                     "content": None,
+                    "reasoning": None,
                     "tool_calls": None,
                     "finish_reason": "error",
                 },

frigate/genai/prompts.py

@@ -0,0 +1,744 @@
+"""Prompt and response-format builders for GenAI features.
+
+Centralizes the per-feature prompt framing and structured-output schema
+shaping so provider clients in :mod:`frigate.genai.plugins` only handle
+transport.
+"""
+
+import datetime
+from typing import Any, Dict, List, Optional
+
+from playhouse.shortcuts import model_to_dict
+
+from frigate.config import CameraConfig, FrigateConfig
+from frigate.config.classification import ObjectClassificationType
+from frigate.config.ui import UnitSystemEnum
+from frigate.data_processing.post.types import ReviewMetadata
+from frigate.models import Event
+
+
+def build_review_description_prompt(
+    review_data: dict[str, Any],
+    thumbnails: list[bytes],
+    concerns: list[str],
+    preferred_language: str | None,
+    activity_context_prompt: str,
+) -> str:
+    """Build the prompt for review activity description generation."""
+
+    def get_concern_prompt() -> str:
+        if concerns:
+            concern_list = "\n    - ".join(concerns)
+            return (
+                "\n- `other_concerns` (list of strings): Include a list of any of "
+                "the following concerns that are occurring:\n"
+                f"    - {concern_list}"
+            )
+        else:
+            return ""
+
+    def get_language_prompt() -> str:
+        if preferred_language:
+            return f"Provide your answer in {preferred_language}"
+        else:
+            return ""
+
+    def get_objects_list() -> str:
+        if review_data["unified_objects"]:
+            return "\n- " + "\n- ".join(review_data["unified_objects"])
+        else:
+            return "\n- (No objects detected)"
+
+    return f"""
+Your task is to analyze a sequence of images taken in chronological order from a security camera.
+
+## Normal Activity Patterns for This Property
+
+{activity_context_prompt}
+
+## Task Instructions
+
+Describe the scene based on observable actions and movements, evaluate the activity against the Activity Indicators above, and assign a potential_threat_level (0, 1, or 2) by applying the threat level indicators consistently.
+
+## Analysis Guidelines
+
+When forming your description:
+- **Treat "Objects in Scene" as the list of tracked subjects to describe.** Do not introduce additional people or vehicles that are not present in this list. You may freely reference other items, surfaces, and environmental details visible in the frames when describing what the listed subjects are doing.
+- **Describe the most likely activity from visible cues across the sequence** — the subject's path, what they are carrying, and what they interact with. Avoid asserting completed outcomes you do not observe; describe in-progress actions rather than results.
+- Describe what you observe: actions, movements, interactions with objects and the environment. Include any observable environmental changes (e.g., lighting changes triggered by activity).
+- Note visible details such as clothing, items being carried or placed, tools or equipment present, and how they interact with the property or objects.
+- Consider the full sequence chronologically: what happens from start to finish, how duration and actions relate to the location and objects involved.
+- **Use the actual timestamp provided in "Activity started at"** below for time of day context—do not infer time from image brightness or darkness. Unusual hours (late night/early morning) should increase suspicion when the observable behavior itself appears questionable. However, recognize that some legitimate activities can occur at any hour.
+- **Consider duration as a primary factor**: Apply the duration thresholds defined in the activity patterns above. Brief sequences during normal hours with apparent purpose typically indicate normal activity unless explicit suspicious actions are visible.
+- **Weigh all evidence holistically**: Match the activity against the normal and suspicious patterns defined above, then evaluate based on the complete context (zone, objects, time, actions, duration). Apply the threat level indicators consistently. Use your judgment for edge cases.
+
+## Response Field Guidelines
+
+Respond with a JSON object matching the provided schema. Field-specific guidance:
+- `observations`: Include the very start of the activity — for example, a vehicle entering the frame or pulling into the driveway — even if it lasts only a few frames and the rest of the clip is dominated by a longer activity. Include each arrival, departure, object handled, and notable change in position or state. Each item is a single concrete fact written as a complete sentence.
+- `scene`: Describe how the sequence begins, then the progression of events — all significant movements and actions in order. For example, if a vehicle arrives and then a person exits, describe both sequentially. For named subjects (those with a `←` separator in "Objects in Scene"), always use their name — do not replace them with generic terms. For unnamed objects (e.g., "person", "car"), refer to them naturally with articles (e.g., "a person", "the car"). Your description should align with and support the threat level you assign.
+- `title`: Name the primary activity across the observations, together with the location. An activity is what is being done with objects, tools, or surfaces; locomotion through the scene qualifies as the activity only when no other interaction is observed. For named subjects, always use their name. For unnamed objects, refer to them naturally with articles.
+- `shortSummary`: Briefly summarize the primary activity across the observations.
+- `potential_threat_level`: Must be consistent with your scene description and the activity patterns above.
+{get_concern_prompt()}
+
+## Sequence Details
+
+- Camera: {review_data["camera"]}
+- Total frames: {len(thumbnails)} (Frame 1 = earliest, Frame {len(thumbnails)} = latest)
+- Activity started at {review_data["start"]} and lasted {review_data["duration"]} seconds
+- Zones involved: {", ".join(review_data["zones"]) if review_data["zones"] else "None"}
+
+## Objects in Scene
+
+Each line represents a detection state, not necessarily unique individuals. The `←` symbol separates a recognized subject's name from their object type — use only the name (before the `←`) in your response, not the type after it. The same subject may appear across multiple lines if detected multiple times.
+
+**Note: Unidentified objects (without names) are NOT indicators of suspicious activity—they simply mean the system hasn't identified that object.**
+{get_objects_list()}
+
+{get_language_prompt()}
+"""
+
+
+def build_review_description_response_format(concerns: list[str]) -> dict[str, Any]:
+    """Build the structured-output JSON schema for review descriptions.
+
+    Strips the `time` field (populated server-side) and drops
+    `other_concerns` when no concerns are configured.
+    """
+    schema = ReviewMetadata.model_json_schema()
+    schema.get("properties", {}).pop("time", None)
+
+    if "time" in schema.get("required", []):
+        schema["required"].remove("time")
+    if not concerns:
+        schema.get("properties", {}).pop("other_concerns", None)
+        if "other_concerns" in schema.get("required", []):
+            schema["required"].remove("other_concerns")
+
+    return {
+        "type": "json_schema",
+        "json_schema": {
+            "name": "review_metadata",
+            "strict": True,
+            "schema": schema,
+        },
+    }
+
+
+def build_review_summary_prompt(
+    start_ts: float,
+    end_ts: float,
+    events: list[dict[str, Any]],
+    preferred_language: str | None,
+) -> str:
+    """Build the prompt for a multi-event review summary."""
+    time_range = (
+        f"{datetime.datetime.fromtimestamp(start_ts).strftime('%B %d, %Y at %I:%M %p')}"
+        f" to "
+        f"{datetime.datetime.fromtimestamp(end_ts).strftime('%B %d, %Y at %I:%M %p')}"
+    )
+    prompt = f"""
+You are a security officer writing a concise security report.
+
+Time range: {time_range}
+
+Input format: Each event is a JSON object with:
+- "title", "scene", "confidence", "potential_threat_level" (0-2), "other_concerns", "camera", "time", "start_time", "end_time"
+- "context": array of related events from other cameras that occurred during overlapping time periods
+
+**Note: Use the "scene" field for event descriptions in the report. Ignore any "shortSummary" field if present.**
+
+Report Structure - Use this EXACT format:
+
+# Security Summary - {time_range}
+
+## Overview
+[Write 1-2 sentences summarizing the overall activity pattern during this period.]
+
+---
+
+## Timeline
+
+[Group events by time periods (e.g., "Morning (6:00 AM - 12:00 PM)", "Afternoon (12:00 PM - 5:00 PM)", "Evening (5:00 PM - 9:00 PM)", "Night (9:00 PM - 6:00 AM)"). Use appropriate time blocks based on when events occurred.]
+
+### [Time Block Name]
+
+**HH:MM AM/PM** | [Camera Name] | [Threat Level Indicator]
+- [Event title]: [Clear description incorporating contextual information from the "context" array]
+- Context: [If context array has items, mention them here, e.g., "Delivery truck present on Front Driveway Cam (HH:MM AM/PM)"]
+- Assessment: [Brief assessment incorporating context - if context explains the event, note it here]
+
+[Repeat for each event in chronological order within the time block]
+
+---
+
+## Summary
+[One sentence summarizing the period. If all events are normal/explained: "Routine activity observed." If review needed: "Some activity requires review but no security concerns." If security concerns: "Security concerns requiring immediate attention."]
+
+Guidelines:
+- List ALL events in chronological order, grouped by time blocks
+- Threat level indicators: ✓ Normal, ⚠️ Needs review, 🔴 Security concern
+- Integrate contextual information naturally - use the "context" array to enrich each event's description
+- If context explains the event (e.g., delivery truck explains person at door), describe it accordingly (e.g., "delivery person" not "unidentified person")
+- Be concise but informative - focus on what happened and what it means
+- If contextual information makes an event clearly normal, reflect that in your assessment
+- Only create time blocks that have events - don't create empty sections
+"""
+
+    prompt += "\n\nEvents:\n"
+    for event in events:
+        prompt += f"\n{event}\n"
+
+    if preferred_language:
+        prompt += f"\nProvide your answer in {preferred_language}"
+
+    return prompt
+
+
+def build_object_description_prompt(
+    camera_config: CameraConfig,
+    event: Event,
+) -> str:
+    """Build the prompt for a per-object description.
+
+    Pulls the per-label override from `objects.genai.object_prompts`, falling
+    back to the camera default, and interpolates event fields.
+
+    Raises:
+        KeyError: if the user-defined prompt template references an unknown
+            event field.
+    """
+    template = camera_config.objects.genai.object_prompts.get(
+        str(event.label),
+        camera_config.objects.genai.prompt,
+    )
+    return template.format(**model_to_dict(event))
+
+
+def get_attribute_classifications(config: FrigateConfig) -> List[Dict[str, Any]]:
+    """Return enabled custom classification models of `attribute` type.
+
+    Each entry: {"name": <model name>, "objects": [<object label>, ...]}.
+    These models attach attribute metadata to events on the listed object
+    types, which can later be filtered via the search_objects `attribute`
+    field.
+    """
+    result: List[Dict[str, Any]] = []
+
+    for model_key, model_config in config.classification.custom.items():
+        if not model_config.enabled or model_config.object_config is None:
+            continue
+
+        if (
+            model_config.object_config.classification_type
+            != ObjectClassificationType.attribute
+        ):
+            continue
+
+        result.append(
+            {
+                "name": model_config.name or model_key,
+                "objects": list(model_config.object_config.objects or []),
+            }
+        )
+
+    return result
+
+
+def get_tool_definitions(
+    semantic_search_enabled: bool = False,
+    attribute_classifications: Optional[List[Dict[str, Any]]] = None,
+) -> List[Dict[str, Any]]:
+    """
+    Get OpenAI-compatible tool definitions for Frigate.
+
+    Returns a list of tool definitions that can be used with OpenAI-compatible
+    function calling APIs. When semantic search is enabled, the search_objects
+    tool exposes an additional `semantic_query` parameter for descriptive
+    queries (e.g. "person riding a lawn mower") and find_similar_objects is
+    included. When attribute classification models are configured, an
+    `attribute` parameter is exposed for filtering by their labels.
+    """
+    search_objects_properties: Dict[str, Any] = {
+        "camera": {
+            "type": "string",
+            "description": "Camera name to filter by (optional).",
+        },
+        "label": {
+            "type": "string",
+            "description": (
+                "Generic object class to filter by — one of the tracked detector "
+                "labels such as 'person', 'package', 'car', 'dog', 'bird'. Use "
+                "this for broad queries like 'show me all cars today'. Combine "
+                "with semantic_query when the user also describes appearance or "
+                "behavior (e.g. label='person', semantic_query='riding a lawn "
+                "mower')."
+            ),
+        },
+        "sub_label": {
+            "type": "string",
+            "description": (
+                "Filter by a DISCRETE NAMED entity recognized in the detection. "
+                "Use this for: a known person's name ('John'), a delivery "
+                "company ('Amazon', 'UPS'), a recognized animal species or "
+                "breed ('blue jay', 'cardinal', 'golden retriever'), or a "
+                "license plate string. When filtering by a specific name, set "
+                "only sub_label and leave label unset. Do NOT use sub_label "
+                "for descriptions of appearance, clothing, or actions — those "
+                "belong in semantic_query."
+            ),
+        },
+        "after": {
+            "type": "string",
+            "description": "Start time in ISO 8601 format (e.g., '2024-01-01T00:00:00Z').",
+        },
+        "before": {
+            "type": "string",
+            "description": "End time in ISO 8601 format (e.g., '2024-01-01T23:59:59Z').",
+        },
+        "zones": {
+            "type": "array",
+            "items": {"type": "string"},
+            "description": "List of zone names to filter by.",
+        },
+        "limit": {
+            "type": "integer",
+            "description": "Maximum number of objects to return (default: 25).",
+            "default": 25,
+        },
+    }
+
+    if attribute_classifications:
+        model_outline = "; ".join(
+            f"{m['name']} (applies to {', '.join(m['objects']) or 'any object'})"
+            for m in attribute_classifications
+        )
+        search_objects_properties["attribute"] = {
+            "type": "string",
+            "description": (
+                "Filter by a classification attribute label produced by a "
+                "configured attribute classification model. Use this INSTEAD "
+                "of semantic_query when the user's request matches one of "
+                "these classifications. Configured models: "
+                f"{model_outline}. "
+                "Set the value to the attribute label that matches the user's "
+                "phrasing (case-sensitive)."
+            ),
+        }
+
+    if semantic_search_enabled:
+        search_objects_properties["semantic_query"] = {
+            "type": "string",
+            "description": (
+                "Optional natural-language description of a PHYSICAL "
+                "CHARACTERISTIC, APPEARANCE, or ACTIVITY the user mentioned, "
+                "used to semantically narrow results. Only set this when the "
+                "user describes something beyond what label and sub_label can "
+                "express on their own.\n"
+                "USE for descriptive phrases like: 'riding a lawn mower', "
+                "'wearing a red jacket', 'carrying a package', 'walking a "
+                "dog', 'on a bicycle', 'holding an umbrella'.\n"
+                "DO NOT USE for:\n"
+                "- specific named people, pets, or delivery companies → use sub_label\n"
+                "- animal species or breed names like 'blue jay', 'cardinal', "
+                "'golden retriever' → use sub_label\n"
+                "- license plate strings → use sub_label\n"
+                "- generic object queries like 'all cars today' or 'every "
+                "person' → use label alone with no semantic_query\n"
+                "When set, combine with label/time/camera/zone filters as "
+                "usual (e.g. label='person', semantic_query='riding a lawn "
+                "mower', after='2024-05-01T00:00:00Z')."
+            ),
+        }
+
+    search_objects_description = (
+        "Search the historical record of detected objects in Frigate. "
+        "Use this ONLY for questions about the PAST — e.g. 'did anyone come by today?', "
+        "'when was the last car?', 'show me detections from yesterday'. "
+        "Do NOT use this for monitoring or alerting requests about future events — "
+        "use start_camera_watch instead for those. "
+        "An 'object' in Frigate represents a tracked detection (e.g., a person, package, car).\n\n"
+        "Choose filters based on what the user is asking for:\n"
+        "- Generic class query ('show me all cars today'): set `label` only.\n"
+        "- Specific NAMED entity (known person, delivery company, animal "
+        "species/breed like 'blue jay' or 'golden retriever', license "
+        "plate): set `sub_label` only and leave `label` unset.\n"
+    )
+    if semantic_search_enabled:
+        search_objects_description += (
+            "- Physical CHARACTERISTIC, APPEARANCE, or ACTIVITY that is not a "
+            "discrete name ('person riding a lawn mower', 'someone in a red "
+            "jacket', 'person carrying a package'): set `semantic_query` with "
+            "the descriptive phrase, optionally alongside `label` for the "
+            "object class. Do NOT put descriptive phrases in sub_label."
+        )
+
+    return [
+        {
+            "type": "function",
+            "function": {
+                "name": "search_objects",
+                "description": search_objects_description,
+                "parameters": {
+                    "type": "object",
+                    "properties": search_objects_properties,
+                },
+                "required": [],
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "find_similar_objects",
+                "description": (
+                    "Find tracked objects that are visually and semantically similar "
+                    "to a specific past event. Use this when the user references a "
+                    "particular object they have seen and wants to find other "
+                    "sightings of the same or similar one ('that green car', 'the "
+                    "person in the red jacket', 'the package that was delivered'). "
+                    "Prefer this over search_objects whenever the user's intent is "
+                    "'find more like this specific one.' Use search_objects first "
+                    "only if you need to locate the anchor event. Requires semantic "
+                    "search to be enabled."
+                ),
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "event_id": {
+                            "type": "string",
+                            "description": "The id of the anchor event to find similar objects to.",
+                        },
+                        "after": {
+                            "type": "string",
+                            "description": "Start time in ISO 8601 format (e.g., '2024-01-01T00:00:00Z').",
+                        },
+                        "before": {
+                            "type": "string",
+                            "description": "End time in ISO 8601 format (e.g., '2024-01-01T23:59:59Z').",
+                        },
+                        "cameras": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "description": "Optional list of cameras to restrict to. Defaults to all.",
+                        },
+                        "labels": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "description": "Optional list of labels to restrict to. Defaults to the anchor event's label.",
+                        },
+                        "sub_labels": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "description": "Optional list of sub_labels (names) to restrict to.",
+                        },
+                        "zones": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "description": "Optional list of zones. An event matches if any of its zones overlap.",
+                        },
+                        "similarity_mode": {
+                            "type": "string",
+                            "enum": ["visual", "semantic", "fused"],
+                            "description": "Which similarity signal(s) to use. 'fused' (default) combines visual and semantic.",
+                            "default": "fused",
+                        },
+                        "min_score": {
+                            "type": "number",
+                            "description": "Drop matches with a similarity score below this threshold (0.0-1.0).",
+                        },
+                        "limit": {
+                            "type": "integer",
+                            "description": "Maximum number of matches to return (default: 10).",
+                            "default": 10,
+                        },
+                    },
+                    "required": ["event_id"],
+                },
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "set_camera_state",
+                "description": (
+                    "Change a camera's feature state (e.g., turn detection on/off, enable/disable recordings). "
+                    "Use camera='*' to apply to all cameras at once. "
+                    "Only call this tool when the user explicitly asks to change a camera setting. "
+                    "Requires admin privileges."
+                ),
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "camera": {
+                            "type": "string",
+                            "description": "Camera name to target, or '*' to target all cameras.",
+                        },
+                        "feature": {
+                            "type": "string",
+                            "enum": [
+                                "detect",
+                                "record",
+                                "snapshots",
+                                "audio",
+                                "motion",
+                                "enabled",
+                                "birdseye",
+                                "birdseye_mode",
+                                "improve_contrast",
+                                "ptz_autotracker",
+                                "motion_contour_area",
+                                "motion_threshold",
+                                "notifications",
+                                "audio_transcription",
+                                "review_alerts",
+                                "review_detections",
+                                "object_descriptions",
+                                "review_descriptions",
+                                "profile",
+                            ],
+                            "description": (
+                                "The feature to change. Most features accept ON or OFF. "
+                                "birdseye_mode accepts CONTINUOUS, MOTION, or OBJECTS. "
+                                "motion_contour_area and motion_threshold accept a number. "
+                                "profile accepts a profile name or 'none' to deactivate (requires camera='*')."
+                            ),
+                        },
+                        "value": {
+                            "type": "string",
+                            "description": "The value to set. ON or OFF for toggles, a number for thresholds, a profile name or 'none' for profile.",
+                        },
+                    },
+                    "required": ["camera", "feature", "value"],
+                },
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "get_live_context",
+                "description": (
+                    "Get the current live image and detection information for a single camera: objects being tracked, "
+                    "zones, timestamps. Use this to understand what is visible in the live view. "
+                    "Call this when answering questions about what is happening right now on a specific camera. "
+                    "Operates on one camera at a time; call the tool again for each additional camera. "
+                    "Wildcards and empty values are not accepted."
+                ),
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "camera": {
+                            "type": "string",
+                            "description": (
+                                "Exact name of a single camera to get live context for. "
+                                "Wildcards (e.g. '*', 'all') and empty strings are not accepted."
+                            ),
+                        },
+                    },
+                    "required": ["camera"],
+                },
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "start_camera_watch",
+                "description": (
+                    "Start a continuous VLM watch job that monitors a camera and sends a notification "
+                    "when a specified condition is met. Use this when the user wants to be alerted about "
+                    "a future event, e.g. 'tell me when guests arrive' or 'notify me when the package is picked up'. "
+                    "Only one watch job can run at a time. Returns a job ID."
+                ),
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "camera": {
+                            "type": "string",
+                            "description": "Camera ID to monitor.",
+                        },
+                        "condition": {
+                            "type": "string",
+                            "description": (
+                                "Natural-language description of the condition to watch for, "
+                                "e.g. 'a person arrives at the front door'."
+                            ),
+                        },
+                        "max_duration_minutes": {
+                            "type": "integer",
+                            "description": "Maximum time to watch before giving up (minutes, default 60).",
+                            "default": 60,
+                        },
+                        "labels": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "description": "Object labels that should trigger a VLM check (e.g. ['person', 'car']). If omitted, any detection on the camera triggers a check.",
+                        },
+                        "zones": {
+                            "type": "array",
+                            "items": {"type": "string"},
+                            "description": "Zone names to filter by. If specified, only detections in these zones trigger a VLM check.",
+                        },
+                    },
+                    "required": ["camera", "condition"],
+                },
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "stop_camera_watch",
+                "description": (
+                    "Cancel the currently running VLM watch job. Use this when the user wants to "
+                    "stop a previously started watch, e.g. 'stop watching the front door'."
+                ),
+                "parameters": {
+                    "type": "object",
+                    "properties": {},
+                    "required": [],
+                },
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "get_profile_status",
+                "description": (
+                    "Get the current profile status including the active profile and "
+                    "timestamps of when each profile was last activated. Use this to "
+                    "determine time periods for recap requests — e.g. when the user asks "
+                    "'what happened while I was away?', call this first to find the relevant "
+                    "time window based on profile activation history."
+                ),
+                "parameters": {
+                    "type": "object",
+                    "properties": {},
+                    "required": [],
+                },
+            },
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "get_recap",
+                "description": (
+                    "Get a recap of all activity (alerts and detections) for a given time period. "
+                    "Use this after calling get_profile_status to retrieve what happened during "
+                    "a specific window — e.g. 'what happened while I was away?'. Returns a "
+                    "chronological list of activity with camera, objects, zones, and GenAI-generated "
+                    "descriptions when available. Summarize the results for the user."
+                ),
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "after": {
+                            "type": "string",
+                            "description": "Start of the time period in ISO 8601 format (e.g. '2025-03-15T08:00:00').",
+                        },
+                        "before": {
+                            "type": "string",
+                            "description": "End of the time period in ISO 8601 format (e.g. '2025-03-15T17:00:00').",
+                        },
+                        "cameras": {
+                            "type": "string",
+                            "description": "Comma-separated camera IDs to include, or 'all' for all cameras. Default is 'all'.",
+                        },
+                        "severity": {
+                            "type": "string",
+                            "enum": ["alert", "detection"],
+                            "description": "Filter by severity level. Omit to include both alerts and detections.",
+                        },
+                    },
+                    "required": ["after", "before"],
+                },
+            },
+        },
+    ]
+
+
+def build_chat_system_prompt(
+    config: FrigateConfig,
+    allowed_cameras: List[str],
+    semantic_search_enabled: bool,
+    attribute_classifications: List[Dict[str, Any]],
+) -> str:
+    """Build the system prompt for the chat completion endpoint.
+
+    Composes the static framing with conditional sections describing the
+    available cameras, speed units, semantic-search routing guidance, and
+    configured attribute classifications.
+    """
+    current_datetime = datetime.datetime.now()
+    current_date_str = current_datetime.strftime("%Y-%m-%d")
+    current_time_str = current_datetime.strftime("%I:%M:%S %p")
+
+    cameras_info: List[str] = []
+    has_speed_zone = False
+    for camera_id in allowed_cameras:
+        if camera_id not in config.cameras:
+            continue
+        camera_config = config.cameras[camera_id]
+        friendly_name = (
+            camera_config.friendly_name
+            if camera_config.friendly_name
+            else camera_id.replace("_", " ").title()
+        )
+        zone_names = list(camera_config.zones.keys())
+        if not has_speed_zone:
+            has_speed_zone = any(
+                zone.distances for zone in camera_config.zones.values()
+            )
+        if zone_names:
+            cameras_info.append(
+                f"  - {friendly_name} (ID: {camera_id}, zones: {', '.join(zone_names)})"
+            )
+        else:
+            cameras_info.append(f"  - {friendly_name} (ID: {camera_id})")
+
+    cameras_section = ""
+    if cameras_info:
+        cameras_section = (
+            "\n\nAvailable cameras:\n"
+            + "\n".join(cameras_info)
+            + "\n\nWhen users refer to cameras by their friendly name (e.g., 'Back Deck Camera'), use the corresponding camera ID (e.g., 'back_deck_cam') in tool calls."
+        )
+
+    speed_units_section = ""
+    if has_speed_zone:
+        speed_unit = (
+            "mph" if config.ui.unit_system == UnitSystemEnum.imperial else "km/h"
+        )
+        speed_units_section = f"\n\nReport object speeds to the user in {speed_unit}."
+
+    semantic_search_section = ""
+    if semantic_search_enabled:
+        semantic_search_section = (
+            "\n\nWhen routing a search_objects call, pick filters by the shape of the user's request:\n"
+            "- Generic class ('show me all cars today'): set `label` only.\n"
+            "- Specific named entity — a known person ('John'), delivery company ('Amazon'), animal species/breed ('blue jay', 'cardinal', 'golden retriever'), or license plate: set `sub_label` only and leave `label` unset.\n"
+            "- Physical characteristic, appearance, or activity that is NOT a discrete name ('find me people riding a lawn mower', 'someone in a red jacket', 'a person carrying a package'): set `semantic_query` with the descriptive phrase, optionally combined with `label` for the object class. Never put descriptive phrases in `sub_label`."
+        )
+
+    attribute_classification_section = ""
+    if attribute_classifications:
+        model_lines = "\n".join(
+            f"- {m['name']}: applies to {', '.join(m['objects']) or 'any object'}"
+            for m in attribute_classifications
+        )
+        attribute_classification_section = (
+            "\n\nAttribute classification models are configured for the following object types:\n"
+            f"{model_lines}\n"
+            "When the user's request matches one of these classifications, set the search_objects `attribute` field to the matching label rather than using `semantic_query`. Reserve `semantic_query` for descriptive phrases that fall outside the configured attribute labels."
+        )
+
+    return f"""You are a helpful assistant for Frigate, a security camera NVR system. You help users answer questions about their cameras, detected objects, and events.
+
+Current server local date and time: {current_date_str} at {current_time_str}
+
+Do not start your response with phrases like "I will check...", "Let me see...", or "Let me look...". Answer directly.
+
+Always present times to the user in the server's local timezone. When tool results include start_time_local and end_time_local, use those exact strings when listing or describing detection times—do not convert or invent timestamps. Do not use UTC or ISO format with Z for the user-facing answer unless the tool result only provides Unix timestamps without local time fields.
+When users ask about "today", "yesterday", "this week", etc., use the current date above as reference.
+When searching for objects or events, use ISO 8601 format for dates (e.g., {current_date_str}T00:00:00Z for the start of today).
+Always be accurate with time calculations based on the current date provided.
+
+When a user refers to a specific object they have seen or describe with identifying details ("that green car", "the person in the red jacket", "a package left today"), prefer the find_similar_objects tool over search_objects. Use search_objects first only to locate the anchor event, then pass its id to find_similar_objects. For generic queries like "show me all cars today", keep using search_objects. If a user message begins with [attached_event:<id>], treat that event id as the anchor for any similarity or "tell me more" request in the same message and call find_similar_objects with that id.{semantic_search_section}{attribute_classification_section}{cameras_section}{speed_units_section}"""

frigate/genai/utils.py

@@ -69,6 +69,14 @@ def build_assistant_message_for_conversation(
                     "name": tc["name"],
                     "arguments": json.dumps(tc.get("arguments") or {}),
                 },
+                # Gemini-only: opaque signature that must be echoed back on
+                # the same functionCall part in the next turn. Other providers
+                # do not set or read this.
+                **(
+                    {"thought_signature": tc["thought_signature"]}
+                    if tc.get("thought_signature")
+                    else {}
+                ),
             }
             for tc in tool_calls_raw
         ]

frigate/jobs/debug_replay.py

@@ -1,4 +1,4 @@
-"""Debug replay startup job: ffmpeg concat + camera config publish.
+"""Debug replay startup job: ffmpeg remux + camera config publish.
 
 The runner orchestrates the async portion of starting a debug replay
 session. The DebugReplayManager (in frigate.debug_replay) owns session
@@ -12,6 +12,7 @@ import os
 import subprocess as sp
 import threading
 import time
+from abc import ABC, abstractmethod
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any, Optional, cast
 
@@ -23,7 +24,7 @@ from frigate.const import REPLAY_CAMERA_PREFIX, REPLAY_DIR
 from frigate.jobs.export import JobStatePublisher
 from frigate.jobs.job import Job
 from frigate.jobs.manager import job_is_running, set_current_job
-from frigate.models import Recordings
+from frigate.models import Export, Recordings
 from frigate.types import JobStatusTypesEnum
 from frigate.util.ffmpeg import run_ffmpeg_with_progress
 
@@ -114,6 +115,130 @@ def query_recordings(source_camera: str, start_ts: float, end_ts: float) -> Mode
     return cast(ModelSelect, query)
 
 
+class DebugReplaySource(ABC):
+    """Abstract source for a debug replay session.
+
+    Provides the camera identity and time range the replay represents,
+    validates that usable content exists, and supplies the ffmpeg input
+    args used to build the replay clip.
+    """
+
+    @property
+    @abstractmethod
+    def source_camera(self) -> str:
+        """Camera name the replay is derived from."""
+
+    @property
+    @abstractmethod
+    def start_ts(self) -> float:
+        """Unix timestamp marking the start of the replay range."""
+
+    @property
+    @abstractmethod
+    def end_ts(self) -> float:
+        """Unix timestamp marking the end of the replay range."""
+
+    @abstractmethod
+    def validate(self) -> None:
+        """Raise ValueError if the source has no usable content."""
+
+    @abstractmethod
+    def ffmpeg_input_args(self, working_dir: str) -> list[str]:
+        """Return ffmpeg input args (including -i). May write temp files in working_dir."""
+
+    def cleanup(self, working_dir: str) -> None:
+        """Remove any temp files the source created in working_dir. Default no-op."""
+
+
+class RecordingDebugReplaySource(DebugReplaySource):
+    """Replay source backed by the Recordings table.
+
+    Feeds ffmpeg the internal VOD endpoint so segments with mismatched
+    SPS/PPS (e.g. across day/night transitions) stitch cleanly via HLS
+    discontinuities.
+    """
+
+    def __init__(
+        self,
+        source_camera: str,
+        start_ts: float,
+        end_ts: float,
+        internal_port: int,
+    ) -> None:
+        self._camera = source_camera
+        self._start_ts = start_ts
+        self._end_ts = end_ts
+        self._internal_port = internal_port
+
+    @property
+    def source_camera(self) -> str:
+        return self._camera
+
+    @property
+    def start_ts(self) -> float:
+        return self._start_ts
+
+    @property
+    def end_ts(self) -> float:
+        return self._end_ts
+
+    def validate(self) -> None:
+        if self._end_ts <= self._start_ts:
+            raise ValueError("End time must be after start time")
+
+        if not query_recordings(self._camera, self._start_ts, self._end_ts).count():
+            raise ValueError(
+                f"No recordings found for camera '{self._camera}' in the specified time range"
+            )
+
+    def ffmpeg_input_args(self, working_dir: str) -> list[str]:
+        playlist_url = (
+            f"http://127.0.0.1:{self._internal_port}/vod/{self._camera}"
+            f"/start/{self._start_ts}/end/{self._end_ts}/index.m3u8"
+        )
+        return [
+            "-protocol_whitelist",
+            "pipe,file,http,tcp",
+            "-i",
+            playlist_url,
+        ]
+
+
+class ExportDebugReplaySource(DebugReplaySource):
+    """Replay source backed by an existing Export.
+
+    Uses the export's video file directly as the ffmpeg input — does not
+    require recordings to still exist for the time range.
+    """
+
+    def __init__(self, export: Export, duration: float) -> None:
+        self._camera = cast(str, export.camera)
+        # Export.date is declared DateTimeField but Frigate writes raw unix
+        # timestamps to the column.
+        self._start_ts = float(cast(Any, export.date))
+        self._video_path = cast(str, export.video_path)
+        self._duration = duration
+
+    @property
+    def source_camera(self) -> str:
+        return self._camera
+
+    @property
+    def start_ts(self) -> float:
+        return self._start_ts
+
+    @property
+    def end_ts(self) -> float:
+        return self._start_ts + self._duration
+
+    def validate(self) -> None:
+        if not os.path.exists(self._video_path):
+            raise ValueError(f"Export video file not found: {self._video_path}")
+
+    def ffmpeg_input_args(self, working_dir: str) -> list[str]:
+        return ["-i", self._video_path]
+
+
 class DebugReplayJobRunner(threading.Thread):
     """Worker thread that drives the startup job to completion.
 
@@ -126,6 +251,7 @@ class DebugReplayJobRunner(threading.Thread):
     def __init__(
         self,
         job: DebugReplayJob,
+        source: DebugReplaySource,
         frigate_config: FrigateConfig,
         config_publisher: CameraConfigUpdatePublisher,
         replay_manager: "DebugReplayManager",
@@ -133,6 +259,7 @@ class DebugReplayJobRunner(threading.Thread):
     ) -> None:
         super().__init__(daemon=True, name=f"debug_replay_{job.id}")
         self.job = job
+        self.source = source
         self.frigate_config = frigate_config
         self.config_publisher = config_publisher
         self.replay_manager = replay_manager
@@ -183,7 +310,6 @@ class DebugReplayJobRunner(threading.Thread):
     def run(self) -> None:
         replay_name = self.job.replay_camera_name
         os.makedirs(REPLAY_DIR, exist_ok=True)
-        concat_file = os.path.join(REPLAY_DIR, f"{replay_name}_concat.txt")
         clip_path = os.path.join(REPLAY_DIR, f"{replay_name}.mp4")
 
         self.job.status = JobStatusTypesEnum.running
@@ -192,23 +318,13 @@ class DebugReplayJobRunner(threading.Thread):
         self._broadcast(force=True)
 
         try:
-            recordings = query_recordings(
-                self.job.source_camera, self.job.start_ts, self.job.end_ts
-            )
-            with open(concat_file, "w") as f:
-                for recording in recordings:
-                    f.write(f"file '{recording.path}'\n")
+            input_args = self.source.ffmpeg_input_args(REPLAY_DIR)
 
             ffmpeg_cmd = [
                 self.frigate_config.ffmpeg.ffmpeg_path,
                 "-hide_banner",
                 "-y",
-                "-f",
-                "concat",
-                "-safe",
-                "0",
-                "-i",
-                concat_file,
+                *input_args,
                 "-c",
                 "copy",
                 "-movflags",
@@ -285,7 +401,7 @@ class DebugReplayJobRunner(threading.Thread):
             self.replay_manager.clear_session()
             _remove_silent(clip_path)
         finally:
-            _remove_silent(concat_file)
+            self.source.cleanup(REPLAY_DIR)
             _set_active_runner(None)
 
     def _finalize_cancelled(self, clip_path: str) -> None:
@@ -309,52 +425,43 @@ def _remove_silent(path: str) -> None:
 
 def start_debug_replay_job(
     *,
-    source_camera: str,
-    start_ts: float,
-    end_ts: float,
+    source: DebugReplaySource,
     frigate_config: FrigateConfig,
     config_publisher: CameraConfigUpdatePublisher,
     replay_manager: "DebugReplayManager",
 ) -> str:
     """Validate, create job, start runner. Returns the job id.
 
-    Raises ValueError for bad params (camera missing, time range
-    invalid, no recordings) and RuntimeError if a session is already
-    active.
+    Raises ValueError for an invalid source (camera missing, source has
+    no usable content) and RuntimeError if a session is already active.
     """
     if job_is_running(JOB_TYPE) or replay_manager.active:
         raise RuntimeError("A replay session is already active")
 
-    if source_camera not in frigate_config.cameras:
-        raise ValueError(f"Camera '{source_camera}' not found")
+    if source.source_camera not in frigate_config.cameras:
+        raise ValueError(f"Camera '{source.source_camera}' not found")
 
-    if end_ts <= start_ts:
-        raise ValueError("End time must be after start time")
+    source.validate()
 
-    recordings = query_recordings(source_camera, start_ts, end_ts)
-    if not recordings.count():
-        raise ValueError(
-            f"No recordings found for camera '{source_camera}' in the specified time range"
-        )
-
-    replay_name = f"{REPLAY_CAMERA_PREFIX}{source_camera}"
+    replay_name = f"{REPLAY_CAMERA_PREFIX}{source.source_camera}"
     replay_manager.mark_starting(
-        source_camera=source_camera,
+        source_camera=source.source_camera,
         replay_camera_name=replay_name,
-        start_ts=start_ts,
-        end_ts=end_ts,
+        start_ts=source.start_ts,
+        end_ts=source.end_ts,
     )
 
     job = DebugReplayJob(
-        source_camera=source_camera,
+        source_camera=source.source_camera,
         replay_camera_name=replay_name,
-        start_ts=start_ts,
-        end_ts=end_ts,
+        start_ts=source.start_ts,
+        end_ts=source.end_ts,
     )
     set_current_job(job)
 
     runner = DebugReplayJobRunner(
         job=job,
+        source=source,
         frigate_config=frigate_config,
         config_publisher=config_publisher,
         replay_manager=replay_manager,

frigate/jobs/vlm_watch.py

@@ -45,6 +45,7 @@ class VLMWatchJob(Job):
     last_reasoning: str = ""
     notification_message: str = ""
     iteration_count: int = 0
+    username: str = ""
 
     def to_dict(self) -> dict[str, Any]:
         return asdict(self)
@@ -374,6 +375,7 @@ def start_vlm_watch_job(
     dispatcher: Any,
     labels: list[str] | None = None,
     zones: list[str] | None = None,
+    username: str = "",
 ) -> str:
     """Start a new VLM watch job. Returns the job ID.
 
@@ -397,6 +399,7 @@ def start_vlm_watch_job(
             max_duration_minutes=max_duration_minutes,
             labels=labels or [],
             zones=zones or [],
+            username=username,
         )
         cancel_ev = threading.Event()
         _current_job = job

frigate/object_detection/base.py

@@ -167,8 +167,9 @@ class DetectorRunner(FrigateProcess):
 
             # detect and send the output
             self.start_time.value = datetime.datetime.now().timestamp()
+            mono_start = time.monotonic()
             detections = object_detector.detect_raw(input_frame)
-            duration = datetime.datetime.now().timestamp() - self.start_time.value
+            duration = time.monotonic() - mono_start
             frame_manager.close(connection_id)
 
             if connection_id not in self.outputs:

frigate/output/birdseye.py

@@ -62,8 +62,10 @@ def get_canvas_shape(width: int, height: int) -> tuple[int, int]:
     if round(a_w / a_h, 2) != round(width / height, 2):
         canvas_width = int(width // 4 * 4)
         canvas_height = int((canvas_width / a_w * a_h) // 4 * 4)
-        logger.warning(
-            f"The birdseye resolution is a non-standard aspect ratio, forcing birdseye resolution to {canvas_width} x {canvas_height}"
+        logger.error(
+            f"Birdseye resolution {width}x{height} is not a supported aspect ratio "
+            f"and may cause visual distortion; falling back to {canvas_width}x{canvas_height}. "
+            f"Set width and height to a supported aspect ratio (16:9, 20:10, 16:6, 32:9, 12:9, 22:15, 9:16, 9:12, 16:3, or 1:1)"
         )
 
     return (canvas_width, canvas_height)
@@ -796,15 +798,18 @@ class Birdseye:
         websocket_server: Any,
     ) -> None:
         self.config = config
+        canvas_width, canvas_height = get_canvas_shape(
+            config.birdseye.width, config.birdseye.height
+        )
         self.input: queue.Queue[bytes] = queue.Queue(maxsize=10)
         self.converter = FFMpegConverter(
             config.ffmpeg,
             self.input,
             stop_event,
-            config.birdseye.width,
-            config.birdseye.height,
-            config.birdseye.width,
-            config.birdseye.height,
+            canvas_width,
+            canvas_height,
+            canvas_width,
+            canvas_height,
             config.birdseye.quality,
             config.birdseye.restream,
         )

frigate/output/output.py

@@ -342,20 +342,30 @@ def move_preview_frames(loc: str) -> None:
     preview_holdover = os.path.join(CLIPS_DIR, "preview_restart_cache")
     preview_cache = os.path.join(CACHE_DIR, "preview_frames")
 
+    if loc == "clips":
+        src = preview_cache
+        dst = preview_holdover
+    elif loc == "cache":
+        src = preview_holdover
+        dst = preview_cache
+    else:
+        return
+
     try:
-        if loc == "clips":
-            shutil.move(preview_cache, preview_holdover)
-        elif loc == "cache":
-            if not os.path.exists(preview_holdover):
-                return
+        if not os.path.exists(src):
+            return
 
-            if not os.access(preview_holdover, os.R_OK | os.W_OK):
-                logger.error(
-                    "Insufficient permissions on preview restart cache at %s",
-                    preview_holdover,
-                )
-                return
+        shutil.move(src, dst)
 
-            shutil.move(preview_holdover, preview_cache)
+    except PermissionError:
+        logger.error(
+            "Insufficient permissions while moving preview restart cache from %s to %s",
+            src,
+            dst,
+        )
     except shutil.Error:
-        logger.error("Failed to restore preview cache.")
+        logger.error(
+            "Failed to move preview restart cache from %s to %s",
+            src,
+            dst,
+        )

frigate/ptz/autotrack.py

@@ -1331,6 +1331,8 @@ class PtzAutoTracker:
         return self.tracked_object[camera]["region"]
 
     def autotrack_object(self, camera: str, obj: TrackedObject):
+        if camera not in self.config.cameras:
+            return
         camera_config = self.config.cameras[camera]
 
         if camera_config.onvif.autotracking.enabled:

frigate/record/export.py

@@ -579,7 +579,9 @@ class RecordingExporter(threading.Thread):
         else:
             chapters_path = self._build_chapter_metadata_file(recordings)
             chapter_args = (
-                f" -i {chapters_path} -map 0 -map_metadata 1" if chapters_path else ""
+                f" -i {chapters_path} -map 0 -dn -map_metadata 1"
+                if chapters_path
+                else ""
             )
             ffmpeg_cmd = (
                 f"{self.config.ffmpeg.ffmpeg_path} -hide_banner {ffmpeg_input}{chapter_args} -c copy -movflags +faststart"

frigate/record/maintainer.py

@@ -610,8 +610,7 @@ class RecordingMaintainer(threading.Thread):
             camera,
         )
 
-        if not os.path.exists(directory):
-            os.makedirs(directory)
+        os.makedirs(directory, exist_ok=True)
 
         # file will be in utc due to start_time being in utc
         file_name = f"{start_time.strftime('%M.%S.mp4')}"

frigate/stats/emitter.py

@@ -32,7 +32,7 @@ class StatsEmitter(threading.Thread):
         self.config = config
         self.stats_tracking = stats_tracking
         self.stop_event = stop_event
-        self.hwaccel_errors: list[str] = []
+        self.hwaccel_errors: dict[str, float] = {}
         self.stats_history: list[dict[str, Any]] = []
 
         # create communication for stats

frigate/stats/intel_gpu_info.py

@@ -0,0 +1,109 @@
+"""Resolve human-readable names for Intel GPUs via OpenVINO."""
+
+import logging
+import re
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+
+class IntelGpuNameResolver:
+    """Build a pdev -> normalized device name map by enumerating OpenVINO GPUs.
+
+    The lookup is performed once on first access and cached for the process
+    lifetime. OpenVINO exposes DEVICE_PCI_INFO (domain/bus/device/function) and
+    FULL_DEVICE_NAME for each GPU it can see, which is enough to associate the
+    name with the pdev string used by DRM fdinfo.
+    """
+
+    _names: Optional[dict[str, str]] = None
+
+    def get_names(self) -> dict[str, str]:
+        if self._names is not None:
+            return self._names
+
+        names: dict[str, str] = {}
+
+        try:
+            from openvino import Core
+        except ImportError:
+            logger.debug("OpenVINO unavailable; cannot resolve Intel GPU names")
+            self._names = names
+            return names
+
+        try:
+            core = Core()
+            devices = core.available_devices
+        except Exception as exc:
+            logger.debug(f"OpenVINO Core initialization failed: {exc}")
+            self._names = names
+            return names
+
+        cpu_name: Optional[str] = None
+        if "CPU" in devices:
+            try:
+                cpu_name = self._strip_trademarks(
+                    core.get_property("CPU", "FULL_DEVICE_NAME")
+                )
+            except Exception as exc:
+                logger.debug(f"Failed to read CPU FULL_DEVICE_NAME: {exc}")
+
+        for device in devices:
+            if not device.startswith("GPU"):
+                continue
+
+            try:
+                pci = core.get_property(device, "DEVICE_PCI_INFO")
+                raw_name = core.get_property(device, "FULL_DEVICE_NAME")
+                device_type = core.get_property(device, "DEVICE_TYPE")
+            except Exception as exc:
+                logger.debug(f"Failed to read properties for {device}: {exc}")
+                continue
+
+            pdev = self._format_pdev(pci)
+            if not pdev:
+                continue
+
+            names[pdev] = self._resolve_name(raw_name, device_type, cpu_name)
+
+        self._names = names
+        return names
+
+    @staticmethod
+    def _format_pdev(pci) -> Optional[str]:
+        try:
+            return f"{pci.domain:04x}:{pci.bus:02x}:{pci.device:02x}.{pci.function:x}"
+        except AttributeError:
+            return None
+
+    @classmethod
+    def _resolve_name(cls, raw_name: str, device_type, cpu_name: Optional[str]) -> str:
+        """Build a display name for a GPU.
+
+        Modern integrated Intel GPUs are reported by OpenVINO with a generic
+        FULL_DEVICE_NAME like "Intel(R) Graphics (iGPU)" that gives no model
+        information. Since the iGPU is part of the CPU on these platforms, fall
+        back to the CPU name (which OpenVINO does report specifically) and
+        suffix it with "iGPU" so it's clear what the entry is.
+        """
+        is_integrated = "INTEGRATED" in str(device_type).upper()
+
+        if is_integrated and cpu_name:
+            short_cpu = re.sub(r"^Intel\s+", "", cpu_name)
+            return f"{short_cpu} iGPU"
+
+        return cls._normalize_name(raw_name)
+
+    @classmethod
+    def _normalize_name(cls, name: str) -> str:
+        cleaned = cls._strip_trademarks(name)
+        cleaned = re.sub(r"\s*\((?:i|d)GPU\)\s*$", "", cleaned, flags=re.IGNORECASE)
+        return " ".join(cleaned.split())
+
+    @staticmethod
+    def _strip_trademarks(name: str) -> str:
+        cleaned = re.sub(r"\(R\)|\(TM\)", "", name)
+        return " ".join(cleaned.split())
+
+
+intel_gpu_name_resolver = IntelGpuNameResolver()

frigate/stats/util.py

@@ -1,6 +1,7 @@
 """Utilities for stats."""
 
 import asyncio
+import logging
 import os
 import shutil
 import time
@@ -34,6 +35,10 @@ from frigate.util.services import (
 )
 from frigate.version import VERSION
 
+logger = logging.getLogger(__name__)
+
+HWACCEL_ERROR_COOLDOWN_SECONDS = 3600
+
 
 def get_latest_version(config: FrigateConfig) -> str:
     if not config.telemetry.version_check:
@@ -167,7 +172,9 @@ def get_detector_stats(
 
 
 def get_processing_stats(
-    config: FrigateConfig, stats: dict[str, str], hwaccel_errors: list[str]
+    config: FrigateConfig,
+    stats: dict[str, str],
+    hwaccel_errors: dict[str, float],
 ) -> None:
     """Get stats for cpu / gpu."""
 
@@ -206,7 +213,9 @@ async def set_bandwidth_stats(config: FrigateConfig, all_stats: dict[str, Any])
 
 
 async def set_gpu_stats(
-    config: FrigateConfig, all_stats: dict[str, Any], hwaccel_errors: list[str]
+    config: FrigateConfig,
+    all_stats: dict[str, Any],
+    hwaccel_errors: dict[str, float],
 ) -> None:
     """Parse GPUs from hwaccel args and use for stats."""
     hwaccel_args = []
@@ -230,18 +239,24 @@ async def set_gpu_stats(
                 hwaccel_args.append(args)
 
     stats: dict[str, dict] = {}
+    intel_gpu_collected = False
+    now = time.monotonic()
 
     for args in hwaccel_args:
-        if args in hwaccel_errors:
-            # known erroring args should automatically return as error
-            stats["error-gpu"] = {"gpu": "", "mem": ""}
-        elif "cuvid" in args or "nvidia" in args:
+        last_error = hwaccel_errors.get(args)
+        if last_error is not None:
+            if now - last_error < HWACCEL_ERROR_COOLDOWN_SECONDS:
+                continue
+            hwaccel_errors.pop(args, None)
+
+        if "cuvid" in args or "nvidia" in args:
             # nvidia GPU
             nvidia_usage = get_nvidia_gpu_stats()
 
             if nvidia_usage:
                 for i in range(len(nvidia_usage)):
                     stats[nvidia_usage[i]["name"]] = {
+                        "vendor": "nvidia",
                         "gpu": str(round(float(nvidia_usage[i]["gpu"]), 2)) + "%",
                         "mem": str(round(float(nvidia_usage[i]["mem"]), 2)) + "%",
                         "enc": str(round(float(nvidia_usage[i]["enc"]), 2)) + "%",
@@ -250,32 +265,35 @@ async def set_gpu_stats(
                     }
 
             else:
-                stats["nvidia-gpu"] = {"gpu": "", "mem": ""}
-                hwaccel_errors.append(args)
+                stats["nvidia-gpu"] = {"vendor": "nvidia", "gpu": "", "mem": ""}
+                hwaccel_errors[args] = time.monotonic()
         elif "nvmpi" in args or "jetson" in args:
             # nvidia Jetson
             jetson_usage = get_jetson_stats()
 
             if jetson_usage:
-                stats["jetson-gpu"] = jetson_usage
+                stats["jetson-gpu"] = {"vendor": "nvidia", **jetson_usage}
             else:
-                stats["jetson-gpu"] = {"gpu": "", "mem": ""}
-                hwaccel_errors.append(args)
+                stats["jetson-gpu"] = {"vendor": "nvidia", "gpu": "", "mem": ""}
+                hwaccel_errors[args] = time.monotonic()
         elif "qsv" in args or ("vaapi" in args and not is_vaapi_amd_driver()):
             if not config.telemetry.stats.intel_gpu_stats:
                 continue
 
-            if "intel-gpu" not in stats:
+            if not intel_gpu_collected:
                 # intel GPU (QSV or VAAPI both use the same physical GPU)
+                intel_gpu_collected = True
                 intel_usage = get_intel_gpu_stats(
                     config.telemetry.stats.intel_gpu_device
                 )
 
-                if intel_usage is not None:
-                    stats["intel-gpu"] = intel_usage or {"gpu": "", "mem": ""}
+                if intel_usage:
+                    for entry in intel_usage.values():
+                        name = entry.pop("name")
+                        stats[name] = entry
                 else:
-                    stats["intel-gpu"] = {"gpu": "", "mem": ""}
-                    hwaccel_errors.append(args)
+                    stats["intel-gpu"] = {"vendor": "intel", "gpu": "", "mem": ""}
+                    hwaccel_errors[args] = time.monotonic()
         elif "vaapi" in args:
             if not config.telemetry.stats.amd_gpu_stats:
                 continue
@@ -284,18 +302,18 @@ async def set_gpu_stats(
             amd_usage = get_amd_gpu_stats()
 
             if amd_usage:
-                stats["amd-vaapi"] = amd_usage
+                stats["amd-vaapi"] = {"vendor": "amd", **amd_usage}
             else:
-                stats["amd-vaapi"] = {"gpu": "", "mem": ""}
-                hwaccel_errors.append(args)
+                stats["amd-vaapi"] = {"vendor": "amd", "gpu": "", "mem": ""}
+                hwaccel_errors[args] = time.monotonic()
         elif "preset-rk" in args:
             rga_usage = get_rockchip_gpu_stats()
 
             if rga_usage:
-                stats["rockchip"] = rga_usage
+                stats["rockchip"] = {"vendor": "rockchip", **rga_usage}
         elif "v4l2m2m" in args or "rpi" in args:
             # RPi v4l2m2m is currently not able to get usage stats
-            stats["rpi-v4l2m2m"] = {"gpu": "", "mem": ""}
+            stats["rpi-v4l2m2m"] = {"vendor": "rpi", "gpu": "", "mem": ""}
 
     if stats:
         all_stats["gpu_usages"] = stats
@@ -323,7 +341,9 @@ async def set_npu_usages(config: FrigateConfig, all_stats: dict[str, Any]) -> No
 
 
 def stats_snapshot(
-    config: FrigateConfig, stats_tracking: StatsTrackingTypes, hwaccel_errors: list[str]
+    config: FrigateConfig,
+    stats_tracking: StatsTrackingTypes,
+    hwaccel_errors: dict[str, float],
 ) -> dict[str, Any]:
     """Get a snapshot of the current stats that are being tracked."""
     camera_metrics = stats_tracking["camera_metrics"]

frigate/test/http_api/test_debug_replay_api.py

@@ -15,11 +15,12 @@ class TestDebugReplayAPI(BaseTestHttp):
         # Stub the factory to skip validation/threading and just record the
         # name on the manager the way the real factory's mark_starting would.
         def fake_start(**kwargs):
+            source = kwargs["source"]
             kwargs["replay_manager"].mark_starting(
-                source_camera=kwargs["source_camera"],
+                source_camera=source.source_camera,
                 replay_camera_name="_replay_front",
-                start_ts=kwargs["start_ts"],
-                end_ts=kwargs["end_ts"],
+                start_ts=source.start_ts,
+                end_ts=source.end_ts,
             )
             return "job-1234"
 

frigate/test/http_api/test_http_app.py

@@ -1,5 +1,9 @@
-from unittest.mock import Mock
+from unittest.mock import Mock, patch
 
+import frigate.genai
+from frigate.config import GenAIProviderEnum
+from frigate.const import REDACTED_CREDENTIAL_SENTINEL
+from frigate.genai import GenAIClient
 from frigate.models import Event, Recordings, ReviewSegment
 from frigate.stats.emitter import StatsEmitter
 from frigate.test.http_api.base_http_test import AuthTestClient, BaseTestHttp
@@ -71,3 +75,108 @@ class TestHttpApp(BaseTestHttp):
 
             assert response.status_code == 200
             assert app.frigate_config.cameras["front_door"].objects.track == ["person"]
+
+    ####################################################################################################################
+    ###################################  Credential redaction sentinel  ################################################
+    ####################################################################################################################
+    def test_config_response_redacts_mqtt_password_with_sentinel(self):
+        self.minimal_config["mqtt"]["user"] = "mqttuser"
+        self.minimal_config["mqtt"]["password"] = "supersecret"
+        app = super().create_app()
+
+        with AuthTestClient(app) as client:
+            response = client.get("/config")
+            assert response.status_code == 200
+            mqtt = response.json()["mqtt"]
+            assert mqtt["password"] == REDACTED_CREDENTIAL_SENTINEL
+
+    ####################################################################################################################
+    ###################################  POST /genai/probe Endpoint   ##################################################
+    ####################################################################################################################
+    def test_genai_probe_requires_admin(self):
+        app = super().create_app()
+
+        with AuthTestClient(app) as client:
+            response = client.post(
+                "/genai/probe",
+                json={"provider": "openai"},
+                headers={"remote-user": "viewer", "remote-role": "viewer"},
+            )
+            assert response.status_code == 403
+
+    def test_genai_probe_returns_models_from_transient_client(self):
+        class FakeClient(GenAIClient):
+            def list_models(self):
+                return ["fake-model-a", "fake-model-b"]
+
+        app = super().create_app()
+
+        with (
+            AuthTestClient(app) as client,
+            patch.dict(
+                frigate.genai.PROVIDERS,
+                {GenAIProviderEnum.openai: FakeClient},
+            ),
+        ):
+            response = client.post(
+                "/genai/probe",
+                json={
+                    "provider": "openai",
+                    "api_key": "sk-test",
+                    "base_url": "https://example.invalid",
+                },
+            )
+            assert response.status_code == 200
+            assert response.json() == {
+                "success": True,
+                "models": ["fake-model-a", "fake-model-b"],
+            }
+
+    def test_genai_probe_empty_list_is_treated_as_failure(self):
+        # The plugin's list_models() returns [] on connection failure rather
+        # than raising. The endpoint should surface that as success=false so
+        # the UI can show a meaningful error.
+        class EmptyClient(GenAIClient):
+            def list_models(self):
+                return []
+
+        app = super().create_app()
+
+        with (
+            AuthTestClient(app) as client,
+            patch.dict(
+                frigate.genai.PROVIDERS,
+                {GenAIProviderEnum.openai: EmptyClient},
+            ),
+        ):
+            response = client.post(
+                "/genai/probe",
+                json={"provider": "openai"},
+            )
+            assert response.status_code == 200
+            payload = response.json()
+            assert payload["success"] is False
+            assert "message" in payload
+
+    def test_genai_probe_handles_provider_failure(self):
+        class FailingClient(GenAIClient):
+            def list_models(self):
+                raise RuntimeError("provider unreachable")
+
+        app = super().create_app()
+
+        with (
+            AuthTestClient(app) as client,
+            patch.dict(
+                frigate.genai.PROVIDERS,
+                {GenAIProviderEnum.openai: FailingClient},
+            ),
+        ):
+            response = client.post(
+                "/genai/probe",
+                json={"provider": "openai"},
+            )
+            assert response.status_code == 200
+            payload = response.json()
+            assert payload["success"] is False
+            assert "message" in payload

frigate/test/http_api/test_http_camera_access.py

@@ -1,3 +1,4 @@
+import os
 from unittest.mock import patch
 
 from fastapi import HTTPException, Request
@@ -357,6 +358,51 @@ class TestGo2rtcStreamAccess(BaseTestHttp):
             f"got {resp.status_code}"
         )
 
+    def test_add_stream_rejects_restricted_source(self):
+        """PUT /go2rtc/streams must reject exec:/echo:/expr: sources even for
+        admins"""
+        app = self._make_app(_MULTI_CAMERA_CONFIG)
+        with AuthTestClient(app) as client:
+            for src in (
+                "exec:/tmp/rev.sh",
+                "echo:foo",
+                "expr:bar",
+                "  exec:/tmp/rev.sh",
+            ):
+                resp = client.put(f"/go2rtc/streams/revshell?src={src}")
+                assert resp.status_code == 400, (
+                    f"Expected 400 for restricted src {src!r}; got {resp.status_code}"
+                )
+                assert resp.json().get("success") is False
+
+    def test_add_stream_allows_non_restricted_source(self):
+        """A normal stream URL should pass the restricted-source check and reach
+        the (unavailable in tests) go2rtc proxy — so we expect 500, not 400."""
+        app = self._make_app(_MULTI_CAMERA_CONFIG)
+        with AuthTestClient(app) as client:
+            resp = client.put("/go2rtc/streams/legit?src=rtsp://10.0.0.1:554/video")
+            assert resp.status_code != 400, (
+                f"Non-restricted source should not be rejected with 400; got {resp.status_code}"
+            )
+
+    def test_add_stream_allows_restricted_source_when_override_set(self):
+        """When GO2RTC_ALLOW_ARBITRARY_EXEC is set, the API must defer to operator
+        intent and forward the request to go2rtc instead of short-circuiting with 400."""
+        app = self._make_app(_MULTI_CAMERA_CONFIG)
+        mock_response = type("R", (), {"ok": True, "status_code": 200, "text": "ok"})()
+        with patch.dict(os.environ, {"GO2RTC_ALLOW_ARBITRARY_EXEC": "true"}):
+            with patch(
+                "frigate.api.camera.requests.put", return_value=mock_response
+            ) as mock_put:
+                with AuthTestClient(app) as client:
+                    resp = client.put("/go2rtc/streams/legit?src=exec:/tmp/something")
+                assert resp.status_code == 200, (
+                    f"Restricted src should be forwarded when override set; got {resp.status_code}"
+                )
+                mock_put.assert_called_once()
+                forwarded_src = mock_put.call_args.kwargs["params"]["src"]
+                assert forwarded_src == "exec:/tmp/something"
+
     def test_stream_alias_blocked_when_owning_camera_disallowed(self):
         """limited_user cannot access a stream alias that belongs to a camera they
         are not allowed to see."""

frigate/test/test_camera_maintainer.py

@@ -0,0 +1,79 @@
+"""Tests for CameraMaintainer SHM cleanup on camera remove.
+
+Regression coverage for the case where a camera is removed and then a
+new camera is added with the same name. Without unlinking the per-frame
+YUV SHM slots, the maintainer's frame_manager.create call hits
+FileExistsError and falls back to reopening the existing segment at the
+*old* size, which the new ffmpeg process then writes mismatched-size
+frames into.
+"""
+
+import unittest
+from unittest.mock import MagicMock, patch
+
+from frigate.camera.maintainer import CameraMaintainer
+
+
+class TestMaintainerUnlinkFrameSlotsOnRemove(unittest.TestCase):
+    def _make_maintainer(self) -> CameraMaintainer:
+        """Build a maintainer without invoking __init__ (avoids needing real
+        FrigateConfig, queues, multiprocessing manager, etc.). We're only
+        exercising the SHM-cleanup helper, so the surrounding init is
+        irrelevant."""
+        maintainer = CameraMaintainer.__new__(CameraMaintainer)
+        maintainer.frame_manager = MagicMock()
+        return maintainer
+
+    def test_unlinks_only_segments_with_matching_prefix(self) -> None:
+        maintainer = self._make_maintainer()
+        maintainer.frame_manager.shm_store = {
+            "front_frame0": object(),
+            "front_frame1": object(),
+            "front_frame2": object(),
+            # Different camera; must not be touched.
+            "side_frame0": object(),
+            # Detector input/output buffers are sized by the model and
+            # cached by the long-lived DetectorRunner — must not be
+            # touched even when their owning camera is removed.
+            "front": object(),
+            "out-front": object(),
+        }
+
+        # __name-mangled access from outside the class.
+        maintainer._CameraMaintainer__unlink_camera_frame_slots("front")
+
+        deleted = [c.args[0] for c in maintainer.frame_manager.delete.call_args_list]
+        self.assertEqual(
+            sorted(deleted),
+            ["front_frame0", "front_frame1", "front_frame2"],
+        )
+
+    def test_handles_camera_with_no_slots(self) -> None:
+        """Cameras that were removed before any frame slot was ever
+        created (e.g. cancelled during preparing_clip) should be a no-op."""
+        maintainer = self._make_maintainer()
+        maintainer.frame_manager.shm_store = {"other_frame0": object()}
+
+        maintainer._CameraMaintainer__unlink_camera_frame_slots("front")
+
+        maintainer.frame_manager.delete.assert_not_called()
+
+    def test_swallows_delete_errors(self) -> None:
+        """Unlink failures shouldn't abort the remove loop — best-effort."""
+        maintainer = self._make_maintainer()
+        maintainer.frame_manager.shm_store = {
+            "front_frame0": object(),
+            "front_frame1": object(),
+        }
+        maintainer.frame_manager.delete.side_effect = OSError("simulated")
+
+        # Both slots are attempted; the OSError on the first doesn't
+        # prevent the second from being tried.
+        with patch("frigate.camera.maintainer.logger"):
+            maintainer._CameraMaintainer__unlink_camera_frame_slots("front")
+
+        self.assertEqual(maintainer.frame_manager.delete.call_count, 2)
+
+
+if __name__ == "__main__":
+    unittest.main()

frigate/test/test_config.py

@@ -10,7 +10,7 @@ from ruamel.yaml.constructor import DuplicateKeyError
 from frigate.config import BirdseyeModeEnum, FrigateConfig
 from frigate.const import MODEL_CACHE_DIR
 from frigate.detectors import DetectorTypeEnum
-from frigate.util.builtin import deep_merge, load_labels
+from frigate.util.builtin import deep_merge
 
 
 class TestConfig(unittest.TestCase):
@@ -64,9 +64,9 @@ class TestConfig(unittest.TestCase):
 
     def test_config_class(self):
         frigate_config = FrigateConfig(**self.minimal)
-        assert "ov" in frigate_config.detectors.keys()
-        assert frigate_config.detectors["ov"].type == DetectorTypeEnum.openvino
-        assert frigate_config.detectors["ov"].model.width == 300
+        assert "cpu" in frigate_config.detectors.keys()
+        assert frigate_config.detectors["cpu"].type == DetectorTypeEnum.cpu
+        assert frigate_config.detectors["cpu"].model.width == 320
 
     @patch("frigate.detectors.detector_config.load_labels")
     def test_detector_custom_model_path(self, mock_labels):
@@ -309,16 +309,11 @@ class TestConfig(unittest.TestCase):
         }
 
         frigate_config = FrigateConfig(**config)
-        all_audio_labels = {
-            label
-            for label in load_labels("/audio-labelmap.txt", prefill=521).values()
-            if label
+        assert set(frigate_config.cameras["back"].audio.filters.keys()) == {
+            "speech",
+            "yell",
         }
 
-        assert all_audio_labels.issubset(
-            set(frigate_config.cameras["back"].audio.filters.keys())
-        )
-
     def test_override_audio_filters(self):
         config = {
             "mqtt": {"host": "mqtt"},
@@ -345,7 +340,8 @@ class TestConfig(unittest.TestCase):
         frigate_config = FrigateConfig(**config)
         assert "speech" in frigate_config.cameras["back"].audio.filters
         assert frigate_config.cameras["back"].audio.filters["speech"].threshold == 0.9
-        assert "babbling" in frigate_config.cameras["back"].audio.filters
+        assert "yell" in frigate_config.cameras["back"].audio.filters
+        assert "babbling" not in frigate_config.cameras["back"].audio.filters
 
     def test_inherit_object_filters(self):
         config = {
@@ -1677,5 +1673,60 @@ class TestConfig(unittest.TestCase):
         self.assertRaises(ValueError, lambda: FrigateConfig(**config))
 
 
+class TestAttributeFilterDefaults(unittest.TestCase):
+    """Verify attribute filter min_score handling at config load."""
+
+    def setUp(self):
+        self.minimal = {
+            "mqtt": {"host": "mqtt"},
+            "cameras": {
+                "back": {
+                    "ffmpeg": {
+                        "inputs": [
+                            {"path": "rtsp://10.0.0.1:554/video", "roles": ["detect"]}
+                        ]
+                    },
+                    "detect": {
+                        "height": 1080,
+                        "width": 1920,
+                        "fps": 5,
+                    },
+                }
+            },
+        }
+
+    def _build_config(self, object_filters: dict | None = None) -> FrigateConfig:
+        config = deep_merge({}, self.minimal)
+        if object_filters is not None:
+            config.setdefault("objects", {})["filters"] = object_filters
+        return FrigateConfig(**config)
+
+    def test_attribute_with_no_filter_gets_default_min_score(self):
+        """Attribute with no user-provided filter gets created with min_score=0.7."""
+        config = self._build_config()
+        face_filter = config.objects.filters.get("face")
+        self.assertIsNotNone(face_filter)
+        self.assertEqual(face_filter.min_score, 0.7)
+
+    def test_attribute_filter_without_min_score_gets_bumped(self):
+        """If user sets some FilterConfig field but not min_score, min_score is bumped to 0.7."""
+        config = self._build_config({"face": {"min_area": 500}})
+        face_filter = config.objects.filters["face"]
+        self.assertEqual(face_filter.min_area, 500)
+        self.assertEqual(face_filter.min_score, 0.7)
+
+    def test_attribute_filter_explicit_min_score_half_is_preserved(self):
+        """User-provided min_score=0.5 must NOT be silently rewritten to 0.7."""
+        config = self._build_config({"face": {"min_score": 0.5}})
+        face_filter = config.objects.filters["face"]
+        self.assertEqual(face_filter.min_score, 0.5)
+
+    def test_attribute_filter_explicit_min_score_other_value_is_preserved(self):
+        """Sanity: explicit non-0.5 values pass through unchanged."""
+        config = self._build_config({"face": {"min_score": 0.3}})
+        face_filter = config.objects.filters["face"]
+        self.assertEqual(face_filter.min_score, 0.3)
+
+
 if __name__ == "__main__":
     unittest.main(verbosity=2)

frigate/test/test_debug_replay.py

@@ -71,6 +71,14 @@ class TestDebugReplayManagerSession(unittest.TestCase):
 
 
 class TestDebugReplayManagerStop(unittest.TestCase):
+    def setUp(self) -> None:
+        # stop() publishes a terminal job_state via a real JobStatePublisher,
+        # which opens a ZMQ REQ socket and blocks on REP. No dispatcher runs
+        # in unit tests, so substitute a no-op publisher.
+        patcher = patch("frigate.debug_replay.JobStatePublisher")
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
     def test_stop_when_inactive_is_a_noop(self) -> None:
         from frigate.debug_replay import DebugReplayManager
 

frigate/test/test_debug_replay_job.py

@@ -9,6 +9,7 @@ from unittest.mock import MagicMock, patch
 from frigate.debug_replay import DebugReplayManager
 from frigate.jobs.debug_replay import (
     DebugReplayJob,
+    RecordingDebugReplaySource,
     cancel_debug_replay_job,
     get_active_runner,
     start_debug_replay_job,
@@ -99,9 +100,12 @@ class TestStartDebugReplayJob(unittest.TestCase):
     def test_rejects_unknown_camera(self) -> None:
         with self.assertRaises(ValueError):
             start_debug_replay_job(
-                source_camera="missing",
-                start_ts=100.0,
-                end_ts=200.0,
+                source=RecordingDebugReplaySource(
+                    source_camera="missing",
+                    start_ts=100.0,
+                    end_ts=200.0,
+                    internal_port=5000,
+                ),
                 frigate_config=self.frigate_config,
                 config_publisher=self.publisher,
                 replay_manager=self.manager,
@@ -110,9 +114,12 @@ class TestStartDebugReplayJob(unittest.TestCase):
     def test_rejects_invalid_time_range(self) -> None:
         with self.assertRaises(ValueError):
             start_debug_replay_job(
-                source_camera="front",
-                start_ts=200.0,
-                end_ts=100.0,
+                source=RecordingDebugReplaySource(
+                    source_camera="front",
+                    start_ts=200.0,
+                    end_ts=100.0,
+                    internal_port=5000,
+                ),
                 frigate_config=self.frigate_config,
                 config_publisher=self.publisher,
                 replay_manager=self.manager,
@@ -124,9 +131,12 @@ class TestStartDebugReplayJob(unittest.TestCase):
         with patch("frigate.jobs.debug_replay.query_recordings", return_value=empty_qs):
             with self.assertRaises(ValueError):
                 start_debug_replay_job(
-                    source_camera="front",
-                    start_ts=100.0,
-                    end_ts=200.0,
+                    source=RecordingDebugReplaySource(
+                        source_camera="front",
+                        start_ts=100.0,
+                        end_ts=200.0,
+                        internal_port=5000,
+                    ),
                     frigate_config=self.frigate_config,
                     config_publisher=self.publisher,
                     replay_manager=self.manager,
@@ -154,9 +164,12 @@ class TestStartDebugReplayJob(unittest.TestCase):
             patch("builtins.open", unittest.mock.mock_open()),
         ):
             job_id = start_debug_replay_job(
-                source_camera="front",
-                start_ts=100.0,
-                end_ts=200.0,
+                source=RecordingDebugReplaySource(
+                    source_camera="front",
+                    start_ts=100.0,
+                    end_ts=200.0,
+                    internal_port=5000,
+                ),
                 frigate_config=self.frigate_config,
                 config_publisher=self.publisher,
                 replay_manager=self.manager,
@@ -191,9 +204,12 @@ class TestStartDebugReplayJob(unittest.TestCase):
             patch("builtins.open", unittest.mock.mock_open()),
         ):
             start_debug_replay_job(
-                source_camera="front",
-                start_ts=100.0,
-                end_ts=200.0,
+                source=RecordingDebugReplaySource(
+                    source_camera="front",
+                    start_ts=100.0,
+                    end_ts=200.0,
+                    internal_port=5000,
+                ),
                 frigate_config=self.frigate_config,
                 config_publisher=self.publisher,
                 replay_manager=self.manager,
@@ -201,9 +217,12 @@ class TestStartDebugReplayJob(unittest.TestCase):
 
             with self.assertRaises(RuntimeError):
                 start_debug_replay_job(
-                    source_camera="front",
-                    start_ts=100.0,
-                    end_ts=200.0,
+                    source=RecordingDebugReplaySource(
+                        source_camera="front",
+                        start_ts=100.0,
+                        end_ts=200.0,
+                        internal_port=5000,
+                    ),
                     frigate_config=self.frigate_config,
                     config_publisher=self.publisher,
                     replay_manager=self.manager,
@@ -269,9 +288,12 @@ class TestRunnerHappyPath(unittest.TestCase):
             patch("builtins.open", unittest.mock.mock_open()),
         ):
             start_debug_replay_job(
-                source_camera="front",
-                start_ts=100.0,
-                end_ts=200.0,
+                source=RecordingDebugReplaySource(
+                    source_camera="front",
+                    start_ts=100.0,
+                    end_ts=200.0,
+                    internal_port=5000,
+                ),
                 frigate_config=self.frigate_config,
                 config_publisher=self.publisher,
                 replay_manager=self.manager,
@@ -340,9 +362,12 @@ class TestRunnerFailurePath(unittest.TestCase):
             patch("builtins.open", unittest.mock.mock_open()),
         ):
             start_debug_replay_job(
-                source_camera="front",
-                start_ts=100.0,
-                end_ts=200.0,
+                source=RecordingDebugReplaySource(
+                    source_camera="front",
+                    start_ts=100.0,
+                    end_ts=200.0,
+                    internal_port=5000,
+                ),
                 frigate_config=self.frigate_config,
                 config_publisher=self.publisher,
                 replay_manager=self.manager,
@@ -418,9 +443,12 @@ class TestRunnerCancellation(unittest.TestCase):
             patch("builtins.open", unittest.mock.mock_open()),
         ):
             start_debug_replay_job(
-                source_camera="front",
-                start_ts=100.0,
-                end_ts=200.0,
+                source=RecordingDebugReplaySource(
+                    source_camera="front",
+                    start_ts=100.0,
+                    end_ts=200.0,
+                    internal_port=5000,
+                ),
                 frigate_config=self.frigate_config,
                 config_publisher=self.publisher,
                 replay_manager=self.manager,

frigate/test/test_dispatcher_runtime_state.py

@@ -0,0 +1,217 @@
+"""Tests for Dispatcher runtime state persistence wiring."""
+
+import os
+import tempfile
+import unittest
+from unittest.mock import MagicMock, patch
+
+from frigate.comms.dispatcher import Dispatcher
+from frigate.comms.runtime_state import RuntimeStatePersistence
+
+
+def _make_camera_mock(
+    *,
+    enabled: bool = True,
+    enabled_in_config: bool = True,
+    detect_enabled: bool = True,
+    record_enabled: bool = True,
+    record_enabled_in_config: bool = True,
+    snapshots_enabled: bool = True,
+    audio_enabled: bool = True,
+    audio_enabled_in_config: bool = True,
+) -> MagicMock:
+    """Build a camera config mock with the fields the in-scope handlers read."""
+    camera = MagicMock()
+    camera.enabled = enabled
+    camera.enabled_in_config = enabled_in_config
+    camera.detect.enabled = detect_enabled
+    camera.motion.enabled = True  # avoid the detect→motion side-effect path
+    camera.record.enabled = record_enabled
+    camera.record.enabled_in_config = record_enabled_in_config
+    camera.snapshots.enabled = snapshots_enabled
+    camera.audio.enabled = audio_enabled
+    camera.audio.enabled_in_config = audio_enabled_in_config
+    return camera
+
+
+def _build_dispatcher(cameras: dict[str, MagicMock]) -> Dispatcher:
+    """Construct a Dispatcher with the bare-minimum mocks the tests need."""
+    config = MagicMock()
+    config.cameras = cameras
+    config_updater = MagicMock()
+    onvif = MagicMock()
+    ptz_metrics: dict = {}
+    communicators: list = []
+
+    with (
+        patch("frigate.comms.dispatcher.CameraActivityManager"),
+        patch("frigate.comms.dispatcher.AudioActivityManager"),
+    ):
+        return Dispatcher(config, config_updater, onvif, ptz_metrics, communicators)
+
+
+class TestRestoreRuntimeState(unittest.TestCase):
+    """Verify replay routes through handlers and tolerates missing entries."""
+
+    def setUp(self) -> None:
+        self.dispatcher = _build_dispatcher(
+            {
+                "front_door": _make_camera_mock(),
+                "back_yard": _make_camera_mock(),
+            }
+        )
+        # Swap each in-scope handler for a MagicMock so we can assert calls
+        # without exercising the handler's own logic.
+        self.handler_mocks: dict[str, MagicMock] = {}
+        for topic in ("enabled", "detect", "snapshots", "recordings", "audio"):
+            mock = MagicMock()
+            self.dispatcher._camera_settings_handlers[topic] = mock
+            self.handler_mocks[topic] = mock
+
+    def test_replays_each_stored_entry_through_its_handler(self) -> None:
+        self.dispatcher._runtime_state = MagicMock(
+            spec=RuntimeStatePersistence,
+            load=MagicMock(
+                return_value={
+                    "front_door": {"detect": False, "recordings": False},
+                    "back_yard": {"audio": False},
+                }
+            ),
+        )
+        self.dispatcher.restore_runtime_state()
+
+        self.handler_mocks["detect"].assert_called_once_with("front_door", "OFF")
+        self.handler_mocks["recordings"].assert_called_once_with("front_door", "OFF")
+        self.handler_mocks["audio"].assert_called_once_with("back_yard", "OFF")
+        self.handler_mocks["enabled"].assert_not_called()
+        self.handler_mocks["snapshots"].assert_not_called()
+
+    def test_skips_unknown_cameras(self) -> None:
+        self.dispatcher._runtime_state = MagicMock(
+            spec=RuntimeStatePersistence,
+            load=MagicMock(return_value={"removed_cam": {"detect": False}}),
+        )
+        self.dispatcher.restore_runtime_state()
+        for mock in self.handler_mocks.values():
+            mock.assert_not_called()
+
+    def test_skips_unknown_topics(self) -> None:
+        self.dispatcher._runtime_state = MagicMock(
+            spec=RuntimeStatePersistence,
+            load=MagicMock(return_value={"front_door": {"some_old_topic": True}}),
+        )
+        self.dispatcher.restore_runtime_state()
+        for mock in self.handler_mocks.values():
+            mock.assert_not_called()
+
+    def test_continues_after_handler_exception(self) -> None:
+        self.handler_mocks["detect"].side_effect = RuntimeError("boom")
+        self.dispatcher._runtime_state = MagicMock(
+            spec=RuntimeStatePersistence,
+            load=MagicMock(
+                return_value={
+                    "front_door": {"detect": False, "recordings": False},
+                }
+            ),
+        )
+        # Must not raise; the recordings handler must still run.
+        self.dispatcher.restore_runtime_state()
+        self.handler_mocks["recordings"].assert_called_once_with("front_door", "OFF")
+
+    def test_true_value_routes_as_on_payload(self) -> None:
+        self.dispatcher._runtime_state = MagicMock(
+            spec=RuntimeStatePersistence,
+            load=MagicMock(return_value={"front_door": {"detect": True}}),
+        )
+        self.dispatcher.restore_runtime_state()
+        self.handler_mocks["detect"].assert_called_once_with("front_door", "ON")
+
+
+class TestHandlersPersistViaSet(unittest.TestCase):
+    """Verify each in-scope handler writes to the runtime state on success."""
+
+    def setUp(self) -> None:
+        self.tmp_dir = tempfile.mkdtemp()
+        self.config_path = os.path.join(self.tmp_dir, "config.yml")
+        with open(self.config_path, "w") as f:
+            f.write("")
+        self._patcher = patch(
+            "frigate.comms.runtime_state.find_config_file",
+            return_value=self.config_path,
+        )
+        self._patcher.start()
+
+        # Start with everything OFF so each ON payload triggers a real change
+        self.cameras = {
+            "front_door": _make_camera_mock(
+                enabled=False,
+                detect_enabled=False,
+                record_enabled=False,
+                snapshots_enabled=False,
+                audio_enabled=False,
+            )
+        }
+        self.dispatcher = _build_dispatcher(self.cameras)
+
+    def tearDown(self) -> None:
+        self._patcher.stop()
+        for name in os.listdir(self.tmp_dir):
+            os.remove(os.path.join(self.tmp_dir, name))
+        os.rmdir(self.tmp_dir)
+
+    def _stored_state(self) -> dict:
+        return RuntimeStatePersistence().load()
+
+    def test_enabled_handler_persists(self) -> None:
+        self.dispatcher._on_enabled_command("front_door", "ON")
+        self.assertEqual(self._stored_state(), {"front_door": {"enabled": True}})
+
+    def test_detect_handler_persists(self) -> None:
+        self.dispatcher._on_detect_command("front_door", "ON")
+        self.assertEqual(self._stored_state(), {"front_door": {"detect": True}})
+
+    def test_recordings_handler_persists(self) -> None:
+        self.dispatcher._on_recordings_command("front_door", "ON")
+        self.assertEqual(self._stored_state(), {"front_door": {"recordings": True}})
+
+    def test_snapshots_handler_persists(self) -> None:
+        self.dispatcher._on_snapshots_command("front_door", "ON")
+        self.assertEqual(self._stored_state(), {"front_door": {"snapshots": True}})
+
+    def test_audio_handler_persists(self) -> None:
+        self.dispatcher._on_audio_command("front_door", "ON")
+        self.assertEqual(self._stored_state(), {"front_door": {"audio": True}})
+
+    def test_enabled_in_config_gate_blocks_persistence(self) -> None:
+        """An ON payload rejected by the gate must not be persisted."""
+        cam = self.cameras["front_door"]
+        cam.enabled_in_config = False
+        cam.record.enabled_in_config = False
+        cam.audio.enabled_in_config = False
+
+        self.dispatcher._on_enabled_command("front_door", "ON")
+        self.dispatcher._on_recordings_command("front_door", "ON")
+        self.dispatcher._on_audio_command("front_door", "ON")
+
+        self.assertEqual(self._stored_state(), {})
+
+
+class TestClearPassthrough(unittest.TestCase):
+    """The dispatcher's public clear methods delegate to the store."""
+
+    def test_clear_runtime_state_for_yaml_keys_passthrough(self) -> None:
+        dispatcher = _build_dispatcher({})
+        dispatcher._runtime_state = MagicMock(spec=RuntimeStatePersistence)
+        keys = ["cameras.front_door.detect.enabled"]
+        dispatcher.clear_runtime_state_for_yaml_keys(keys)
+        dispatcher._runtime_state.clear_for_yaml_keys.assert_called_once_with(keys)
+
+    def test_clear_runtime_state_passthrough(self) -> None:
+        dispatcher = _build_dispatcher({})
+        dispatcher._runtime_state = MagicMock(spec=RuntimeStatePersistence)
+        dispatcher.clear_runtime_state()
+        dispatcher._runtime_state.clear_all.assert_called_once_with()
+
+
+if __name__ == "__main__":
+    unittest.main()

frigate/test/test_gpu_stats.py

@@ -17,12 +17,14 @@ class TestGpuStats(unittest.TestCase):
         amd_stats = get_amd_gpu_stats()
         assert amd_stats == {"gpu": "4.17%", "mem": "60.37%"}
 
+    @patch("frigate.stats.intel_gpu_info.intel_gpu_name_resolver.get_names")
     @patch("frigate.util.services.time.sleep")
     @patch("frigate.util.services.time.monotonic")
     @patch("frigate.util.services._read_intel_drm_fdinfo")
-    def test_intel_gpu_stats_fdinfo(self, read_fdinfo, monotonic, sleep):
+    def test_intel_gpu_stats_fdinfo(self, read_fdinfo, monotonic, sleep, get_names):
         # 1 second of wall clock between snapshots
         monotonic.side_effect = [0.0, 1.0]
+        get_names.return_value = {"0000:00:02.0": "Intel Graphics"}
 
         # Two i915 clients on the same iGPU. Engine values are cumulative ns.
         # Deltas over the 1s window:
@@ -79,11 +81,15 @@ class TestGpuStats(unittest.TestCase):
 
         sleep.assert_called_once()
         assert intel_stats == {
-            "gpu": "90.0%",
-            "mem": "-%",
-            "compute": "30.0%",
-            "dec": "60.0%",
-            "clients": {"100": "80.0%", "200": "10.0%"},
+            "0000:00:02.0": {
+                "name": "Intel Graphics",
+                "vendor": "intel",
+                "gpu": "90.0%",
+                "mem": "-%",
+                "compute": "30.0%",
+                "dec": "60.0%",
+                "clients": {"100": "80.0%", "200": "10.0%"},
+            },
         }
 
     @patch("frigate.util.services._read_intel_drm_fdinfo")

frigate/test/test_media_auth.py

@@ -230,7 +230,7 @@ class TestExportResolution(unittest.TestCase):
             id=export_id,
             camera=camera,
             name=f"export-{export_id}",
-            date=datetime.datetime.now(),
+            date=int(datetime.datetime.now().timestamp()),
             video_path=f"/media/frigate/exports/{filename}",
             thumb_path=f"/media/frigate/exports/{filename}.jpg",
             in_progress=False,

frigate/test/test_onvif_probe.py

@@ -0,0 +1,124 @@
+import unittest
+from unittest.mock import AsyncMock, MagicMock, patch
+
+from zeep.exceptions import Fault, TransportError
+from zeep.transports import AsyncTransport
+
+from frigate.api.camera import _build_digest_transport, _connect_onvif_camera
+
+
+def _make_camera(update_side_effect=None):
+    """Build a mock ONVIFCamera whose update_xaddrs can raise or succeed."""
+    camera = MagicMock()
+    camera.update_xaddrs = AsyncMock(side_effect=update_side_effect)
+    return camera
+
+
+class TestConnectOnvifCamera(unittest.IsolatedAsyncioTestCase):
+    async def test_password_digest_succeeds_first(self):
+        # Cameras that accept PasswordDigest authenticate on the first attempt
+        # and should never trigger the PasswordText fallback.
+        camera = _make_camera()
+
+        with patch("frigate.api.camera.ONVIFCamera", return_value=camera) as mock_cls:
+            result = await _connect_onvif_camera(
+                "cam.local", 80, "user", "pass", None, "basic"
+            )
+
+        self.assertIs(result, camera)
+        mock_cls.assert_called_once()
+        self.assertTrue(mock_cls.call_args.kwargs["encrypt"])
+
+    async def test_falls_back_to_password_text(self):
+        # A PasswordDigest rejection should retry once with PasswordText.
+        camera_digest = _make_camera(update_side_effect=Fault("token rejected"))
+        camera_text = _make_camera()
+
+        with patch(
+            "frigate.api.camera.ONVIFCamera",
+            side_effect=[camera_digest, camera_text],
+        ) as mock_cls:
+            result = await _connect_onvif_camera(
+                "cam.local", 80, "user", "pass", None, "basic"
+            )
+
+        self.assertIs(result, camera_text)
+        self.assertEqual(mock_cls.call_count, 2)
+        self.assertTrue(mock_cls.call_args_list[0].kwargs["encrypt"])
+        self.assertFalse(mock_cls.call_args_list[1].kwargs["encrypt"])
+
+    async def test_both_encodings_fail_raises_first_fault(self):
+        # When both encodings fault, the original (PasswordDigest) fault is
+        # surfaced so the caller's existing Fault handler reports it.
+        first_fault = Fault("digest rejected")
+        camera_digest = _make_camera(update_side_effect=first_fault)
+        camera_text = _make_camera(update_side_effect=Fault("text rejected"))
+
+        with patch(
+            "frigate.api.camera.ONVIFCamera",
+            side_effect=[camera_digest, camera_text],
+        ) as mock_cls:
+            with self.assertRaises(Fault) as ctx:
+                await _connect_onvif_camera(
+                    "cam.local", 80, "user", "pass", None, "basic"
+                )
+
+        self.assertIs(ctx.exception, first_fault)
+        self.assertEqual(mock_cls.call_count, 2)
+
+    async def test_transport_error_is_not_retried(self):
+        # Connection-level errors (timeout, refused, unreachable) should
+        # propagate immediately without doubling latency on a second encoding.
+        camera = _make_camera(update_side_effect=TransportError("unreachable"))
+
+        with patch("frigate.api.camera.ONVIFCamera", side_effect=[camera]) as mock_cls:
+            with self.assertRaises(TransportError):
+                await _connect_onvif_camera(
+                    "cam.local", 80, "user", "pass", None, "basic"
+                )
+
+        mock_cls.assert_called_once()
+
+    async def test_digest_auth_replaces_service_transports(self):
+        # auth_type "digest" wires an HTTP digest transport onto each service,
+        # independently of the WS-Security encoding.
+        camera = _make_camera()
+
+        with (
+            patch("frigate.api.camera.ONVIFCamera", return_value=camera),
+            patch(
+                "frigate.api.camera._build_digest_transport",
+                return_value="TRANSPORT",
+            ) as mock_transport,
+        ):
+            result = await _connect_onvif_camera(
+                "cam.local", 80, "user", "pass", None, "digest"
+            )
+
+        self.assertIs(result, camera)
+        mock_transport.assert_called_once_with("user", "pass")
+        self.assertEqual(camera.devicemgmt.zeep_client.transport, "TRANSPORT")
+        self.assertEqual(camera.media.zeep_client.transport, "TRANSPORT")
+        self.assertEqual(camera.ptz.zeep_client.transport, "TRANSPORT")
+
+    async def test_basic_auth_does_not_replace_transports(self):
+        # Without digest auth, no transport override is built.
+        camera = _make_camera()
+
+        with (
+            patch("frigate.api.camera.ONVIFCamera", return_value=camera),
+            patch("frigate.api.camera._build_digest_transport") as mock_transport,
+        ):
+            await _connect_onvif_camera("cam.local", 80, "user", "pass", None, "basic")
+
+        mock_transport.assert_not_called()
+
+
+class TestBuildDigestTransport(unittest.TestCase):
+    def test_returns_async_transport(self):
+        transport = _build_digest_transport("user", "pass")
+        self.assertIsInstance(transport, AsyncTransport)
+
+
+if __name__ == "__main__":
+    unittest.main()

frigate/test/test_profiles.py

@@ -178,6 +178,141 @@ class TestCameraProfileConfig(unittest.TestCase):
         with self.assertRaises(ValidationError):
             FrigateConfig(**config_data)
 
+    def test_profile_zone_without_base_rejected(self):
+        """Profile defining a zone not present on the base camera is rejected."""
+        from pydantic import ValidationError
+
+        config_data = {
+            "mqtt": {"host": "mqtt"},
+            "profiles": {
+                "armed": {"friendly_name": "Armed"},
+            },
+            "cameras": {
+                "front": {
+                    "ffmpeg": {
+                        "inputs": [
+                            {
+                                "path": "rtsp://10.0.0.1:554/video",
+                                "roles": ["detect"],
+                            }
+                        ]
+                    },
+                    "detect": {"height": 1080, "width": 1920, "fps": 5},
+                    "zones": {
+                        "front_yard": {"coordinates": "0,0,100,0,100,100,0,100"},
+                    },
+                    "profiles": {
+                        "armed": {
+                            "zones": {
+                                "phantom": {
+                                    "coordinates": "0,0,50,0,50,50,0,50",
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        }
+        with self.assertRaises(ValidationError) as ctx:
+            FrigateConfig(**config_data)
+        self.assertIn("phantom", str(ctx.exception))
+
+    def test_profile_motion_mask_without_base_rejected(self):
+        """Profile defining a motion mask not present on the base camera is rejected."""
+        from pydantic import ValidationError
+
+        config_data = {
+            "mqtt": {"host": "mqtt"},
+            "profiles": {
+                "armed": {"friendly_name": "Armed"},
+            },
+            "cameras": {
+                "front": {
+                    "ffmpeg": {
+                        "inputs": [
+                            {
+                                "path": "rtsp://10.0.0.1:554/video",
+                                "roles": ["detect"],
+                            }
+                        ]
+                    },
+                    "detect": {"height": 1080, "width": 1920, "fps": 5},
+                    "motion": {
+                        "mask": {
+                            "base_mask": {
+                                "coordinates": "0,0,100,0,100,100,0,100",
+                            },
+                        },
+                    },
+                    "profiles": {
+                        "armed": {
+                            "motion": {
+                                "mask": {
+                                    "phantom_mask": {
+                                        "coordinates": "0,0,50,0,50,50,0,50",
+                                    },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        }
+        with self.assertRaises(ValidationError) as ctx:
+            FrigateConfig(**config_data)
+        self.assertIn("phantom_mask", str(ctx.exception))
+
+    def test_profile_overrides_matching_base_accepted(self):
+        """Profile overrides that reference existing base zones/masks parse cleanly."""
+        config_data = {
+            "mqtt": {"host": "mqtt"},
+            "profiles": {
+                "armed": {"friendly_name": "Armed"},
+            },
+            "cameras": {
+                "front": {
+                    "ffmpeg": {
+                        "inputs": [
+                            {
+                                "path": "rtsp://10.0.0.1:554/video",
+                                "roles": ["detect"],
+                            }
+                        ]
+                    },
+                    "detect": {"height": 1080, "width": 1920, "fps": 5},
+                    "zones": {
+                        "front_yard": {"coordinates": "0,0,100,0,100,100,0,100"},
+                    },
+                    "motion": {
+                        "mask": {
+                            "tree": {
+                                "coordinates": "0,0,100,0,100,100,0,100",
+                            },
+                        },
+                    },
+                    "profiles": {
+                        "armed": {
+                            "zones": {
+                                "front_yard": {
+                                    "coordinates": "0,0,50,0,50,50,0,50",
+                                    "inertia": 5,
+                                },
+                            },
+                            "motion": {
+                                "mask": {
+                                    "tree": {
+                                        "coordinates": "0,0,75,0,75,75,0,75",
+                                    },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        }
+        config = FrigateConfig(**config_data)
+        assert "armed" in config.cameras["front"].profiles
+
 
 class TestProfileInConfig(unittest.TestCase):
     """Test that profiles parse correctly in FrigateConfig."""
@@ -592,6 +727,55 @@ class TestProfileManager(unittest.TestCase):
         # Should not raise
         json.dumps(api_base)
 
+    @patch.object(ProfileManager, "_persist_active_profile")
+    def test_activate_profile_clears_dispatcher_runtime_state(self, mock_persist):
+        """User-initiated activation drops runtime overrides (steady-state rule)."""
+        dispatcher = MagicMock()
+        manager = ProfileManager(self.config, self.mock_updater, dispatcher)
+        manager.activate_profile("armed")
+        dispatcher.clear_runtime_state.assert_called_once_with()
+
+    @patch.object(ProfileManager, "_persist_active_profile")
+    def test_deactivate_profile_clears_dispatcher_runtime_state(self, mock_persist):
+        """Deactivating a profile also drops runtime overrides."""
+        dispatcher = MagicMock()
+        manager = ProfileManager(self.config, self.mock_updater, dispatcher)
+        manager.activate_profile("armed")
+        dispatcher.clear_runtime_state.reset_mock()
+
+        manager.activate_profile(None)
+        dispatcher.clear_runtime_state.assert_called_once_with()
+
+    @patch.object(ProfileManager, "_persist_active_profile")
+    def test_startup_replay_does_not_clear_runtime_state(self, mock_persist):
+        """Startup callers pass clear_runtime_overrides=False to preserve state."""
+        dispatcher = MagicMock()
+        manager = ProfileManager(self.config, self.mock_updater, dispatcher)
+        manager.activate_profile("armed", clear_runtime_overrides=False)
+        dispatcher.clear_runtime_state.assert_not_called()
+
+    @patch.object(ProfileManager, "_persist_active_profile")
+    def test_update_config_clears_when_active_profile_reapplies(self, mock_persist):
+        """After /api/config/set, an active-profile re-application drops state."""
+        dispatcher = MagicMock()
+        manager = ProfileManager(self.config, self.mock_updater, dispatcher)
+        manager.activate_profile("armed")
+        dispatcher.clear_runtime_state.reset_mock()
+
+        new_config = FrigateConfig(**self.config_data)
+        manager.update_config(new_config)
+        dispatcher.clear_runtime_state.assert_called_once_with()
+
+    @patch.object(ProfileManager, "_persist_active_profile")
+    def test_update_config_does_not_clear_when_no_active_profile(self, mock_persist):
+        """Plain /api/config/set without a profile doesn't trigger the broad clear."""
+        dispatcher = MagicMock()
+        manager = ProfileManager(self.config, self.mock_updater, dispatcher)
+        # No activate_profile call — config.active_profile is None
+        new_config = FrigateConfig(**self.config_data)
+        manager.update_config(new_config)
+        dispatcher.clear_runtime_state.assert_not_called()
+
 
 class TestProfilePersistence(unittest.TestCase):
     """Test profile persistence to disk."""

frigate/test/test_runtime_state.py

@@ -0,0 +1,136 @@
+"""Tests for RuntimeStatePersistence."""
+
+import json
+import os
+import tempfile
+import unittest
+from unittest.mock import patch
+
+from frigate.comms.runtime_state import RuntimeStatePersistence
+
+
+class TestRuntimeStatePersistence(unittest.TestCase):
+    """Unit tests for the JSON-backed runtime state store."""
+
+    def setUp(self) -> None:
+        self.tmp_dir = tempfile.mkdtemp()
+        self.config_path = os.path.join(self.tmp_dir, "config.yml")
+        # Touch a placeholder config.yml so find_config_file returns a real path
+        with open(self.config_path, "w") as f:
+            f.write("")
+        self._patcher = patch(
+            "frigate.comms.runtime_state.find_config_file",
+            return_value=self.config_path,
+        )
+        self._patcher.start()
+        self.store = RuntimeStatePersistence()
+
+    def tearDown(self) -> None:
+        self._patcher.stop()
+        for name in os.listdir(self.tmp_dir):
+            os.remove(os.path.join(self.tmp_dir, name))
+        os.rmdir(self.tmp_dir)
+
+    def test_load_returns_empty_when_file_missing(self) -> None:
+        self.assertEqual(self.store.load(), {})
+
+    def test_set_then_load_round_trip(self) -> None:
+        self.store.set("front_door", "detect", False)
+        self.store.set("front_door", "recordings", True)
+        self.store.set("back_yard", "audio", False)
+
+        result = self.store.load()
+        self.assertEqual(
+            result,
+            {
+                "front_door": {"detect": False, "recordings": True},
+                "back_yard": {"audio": False},
+            },
+        )
+
+    def test_set_with_untracked_topic_is_noop(self) -> None:
+        self.store.set("front_door", "ptz_autotracker", True)
+        self.assertEqual(self.store.load(), {})
+        # File should not even be created if no tracked entries were written
+        runtime_path = os.path.join(self.tmp_dir, ".runtime_state.json")
+        self.assertFalse(os.path.exists(runtime_path))
+
+    def test_set_overwrites_previous_value(self) -> None:
+        self.store.set("front_door", "detect", True)
+        self.store.set("front_door", "detect", False)
+        self.assertEqual(self.store.load(), {"front_door": {"detect": False}})
+
+    def test_load_returns_empty_when_file_corrupt(self) -> None:
+        runtime_path = os.path.join(self.tmp_dir, ".runtime_state.json")
+        with open(runtime_path, "w") as f:
+            f.write("{not valid json")
+        self.assertEqual(self.store.load(), {})
+
+    def test_load_handles_unexpected_top_level_shape(self) -> None:
+        runtime_path = os.path.join(self.tmp_dir, ".runtime_state.json")
+        with open(runtime_path, "w") as f:
+            json.dump(["unexpected", "list"], f)
+        self.assertEqual(self.store.load(), {})
+
+    def test_clear_for_yaml_keys_removes_matching_entries(self) -> None:
+        self.store.set("front_door", "detect", False)
+        self.store.set("front_door", "recordings", False)
+        self.store.set("back_yard", "audio", False)
+
+        self.store.clear_for_yaml_keys(
+            [
+                "cameras.front_door.detect.enabled",
+                "cameras.back_yard.audio.enabled",
+            ]
+        )
+
+        self.assertEqual(
+            self.store.load(),
+            {"front_door": {"recordings": False}},
+        )
+
+    def test_clear_for_yaml_keys_collapses_empty_camera_dict(self) -> None:
+        self.store.set("front_door", "detect", False)
+        self.store.clear_for_yaml_keys(["cameras.front_door.detect.enabled"])
+        self.assertEqual(self.store.load(), {})
+
+    def test_clear_for_yaml_keys_ignores_unrelated_keys(self) -> None:
+        self.store.set("front_door", "detect", False)
+        self.store.clear_for_yaml_keys(
+            [
+                "ui.theme",
+                "go2rtc.streams.x",
+                "cameras.front_door.ffmpeg.inputs",
+                "not_cameras.front_door.detect.enabled",
+            ]
+        )
+        self.assertEqual(self.store.load(), {"front_door": {"detect": False}})
+
+    def test_clear_for_yaml_keys_handles_empty_iterable(self) -> None:
+        self.store.set("front_door", "detect", False)
+        self.store.clear_for_yaml_keys([])
+        self.assertEqual(self.store.load(), {"front_door": {"detect": False}})
+
+    def test_camera_level_enabled_uses_top_level_yaml_key(self) -> None:
+        """`enabled` topic maps to the camera-level `cameras.<cam>.enabled` key."""
+        self.store.set("front_door", "enabled", False)
+        self.store.clear_for_yaml_keys(["cameras.front_door.enabled"])
+        self.assertEqual(self.store.load(), {})
+
+    def test_clear_all_wipes_every_entry(self) -> None:
+        self.store.set("front_door", "detect", False)
+        self.store.set("front_door", "recordings", True)
+        self.store.set("back_yard", "audio", False)
+
+        self.store.clear_all()
+
+        self.assertEqual(self.store.load(), {})
+
+    def test_clear_all_is_safe_when_file_missing(self) -> None:
+        # No prior set() calls — file does not exist
+        self.store.clear_all()
+        self.assertEqual(self.store.load(), {})
+
+
+if __name__ == "__main__":
+    unittest.main()

frigate/test/test_shared_memory_frame_manager.py

@@ -0,0 +1,156 @@
+"""Tests for SharedMemoryFrameManager cache invalidation.
+
+Covers the case where a SHM segment is unlinked and recreated at a
+different size across a camera add/remove cycle while a long-lived
+in-process cache (e.g. TrackedObjectProcessor) still holds a ref to
+the old, smaller segment.
+"""
+
+import unittest
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import numpy as np
+
+from frigate.util.image import SharedMemoryFrameManager
+
+
+def _fake_shm(size: int) -> SimpleNamespace:
+    """A minimal stand-in for UntrackedSharedMemory with .size and .buf."""
+    return SimpleNamespace(size=size, buf=bytearray(size), close=lambda: None)
+
+
+class TestSharedMemoryFrameManagerGet(unittest.TestCase):
+    def test_get_reopens_when_cached_segment_is_smaller_than_shape(self) -> None:
+        """A cached ref to an older smaller segment must be dropped and the
+        current (correctly sized) segment reopened. Without this, np.ndarray
+        would raise "buffer is too small for requested array" when the
+        in-memory cache pointed at an old SHM after a same-name resize."""
+        manager = SharedMemoryFrameManager()
+
+        small = _fake_shm(size=100)
+        current = _fake_shm(size=2_500)
+        manager.shm_store["cam_frame0"] = small
+
+        with patch("frigate.util.image.UntrackedSharedMemory", return_value=current):
+            arr = manager.get("cam_frame0", (50, 50))
+
+        self.assertIsNotNone(arr)
+        self.assertEqual(arr.shape, (50, 50))
+        self.assertIs(manager.shm_store["cam_frame0"], current)
+
+    def test_get_reopens_when_cached_segment_is_larger_than_shape(self) -> None:
+        """Symmetric to the smaller-cache case: when detect resolution drops,
+        the SHM is unlinked and recreated at a smaller size. A cached ref to
+        the old, larger segment still satisfies any size check but points at
+        an orphaned inode whose stale bytes get reinterpreted at the new
+        shape — producing miscolored, distorted YUV frames downstream. Drop
+        the cache so we reopen by name and bind to the current segment."""
+        manager = SharedMemoryFrameManager()
+
+        old_large = _fake_shm(size=10_000)
+        current = _fake_shm(size=2_500)
+        manager.shm_store["cam_frame0"] = old_large
+
+        with patch("frigate.util.image.UntrackedSharedMemory", return_value=current):
+            arr = manager.get("cam_frame0", (50, 50))
+
+        self.assertIsNotNone(arr)
+        self.assertEqual(arr.shape, (50, 50))
+        self.assertIs(manager.shm_store["cam_frame0"], current)
+
+    def test_get_keeps_cached_segment_when_size_matches(self) -> None:
+        """Don't pay the reopen cost when the cached ref is the right size."""
+        manager = SharedMemoryFrameManager()
+
+        cached = _fake_shm(size=2_500)
+        manager.shm_store["cam_frame0"] = cached
+
+        with patch("frigate.util.image.UntrackedSharedMemory") as untracked_shm_cls:
+            arr = manager.get("cam_frame0", (50, 50))
+            untracked_shm_cls.assert_not_called()
+
+        self.assertIsNotNone(arr)
+        self.assertIs(manager.shm_store["cam_frame0"], cached)
+
+    def test_get_opens_fresh_when_no_cache_entry(self) -> None:
+        manager = SharedMemoryFrameManager()
+        fresh = _fake_shm(size=2_500)
+
+        with patch("frigate.util.image.UntrackedSharedMemory", return_value=fresh):
+            arr = manager.get("cam_frame0", (50, 50))
+
+        self.assertIsNotNone(arr)
+        self.assertIs(manager.shm_store["cam_frame0"], fresh)
+
+    def test_get_returns_none_when_segment_missing(self) -> None:
+        manager = SharedMemoryFrameManager()
+
+        with patch(
+            "frigate.util.image.UntrackedSharedMemory",
+            side_effect=FileNotFoundError,
+        ):
+            arr = manager.get("cam_frame0", (50, 50))
+
+        self.assertIsNone(arr)
+
+    def test_get_returns_none_when_reopened_segment_is_still_too_small(self) -> None:
+        """Race during a same-name SHM recreate: cache is stale, we reopen
+        by name, but the maintainer hasn't allocated the new segment yet —
+        the reopened ref is also too small. Skip the frame (return None)
+        rather than crash on np.ndarray."""
+        manager = SharedMemoryFrameManager()
+
+        small_cached = _fake_shm(size=100)
+        still_small_after_reopen = _fake_shm(size=100)
+        manager.shm_store["cam_frame0"] = small_cached
+
+        with patch(
+            "frigate.util.image.UntrackedSharedMemory",
+            return_value=still_small_after_reopen,
+        ):
+            arr = manager.get("cam_frame0", (50, 50))
+
+        self.assertIsNone(arr)
+        # Don't cache the too-small reopened ref — next call will re-open
+        # once the maintainer has finished recreating the segment.
+        self.assertNotIn("cam_frame0", manager.shm_store)
+
+    def test_get_handles_n_dimensional_shape(self) -> None:
+        """np.prod must be used (not raw multiplication) for tuple shapes."""
+        manager = SharedMemoryFrameManager()
+        # YUV-shaped frame: (height * 3/2, width) for 1920x1080 = 3,110,400
+        big_enough = _fake_shm(size=3_110_400)
+        manager.shm_store["cam_frame0"] = big_enough
+
+        with patch("frigate.util.image.UntrackedSharedMemory") as untracked_shm_cls:
+            arr = manager.get("cam_frame0", (1620, 1920))
+            untracked_shm_cls.assert_not_called()
+
+        self.assertIsNotNone(arr)
+        self.assertEqual(arr.shape, (1620, 1920))
+
+
+class TestSharedMemoryFrameManagerGetRecreatesLargerSegment(unittest.TestCase):
+    """End-to-end-style: simulates the full unlink-and-recreate cycle."""
+
+    def test_segment_grows_then_get_succeeds(self) -> None:
+        manager = SharedMemoryFrameManager()
+
+        # Phase 1: existing camera at 320x240 YUV — 320 * 240 * 1.5 = 115_200
+        small = _fake_shm(size=115_200)
+        manager.shm_store["cam_frame0"] = small
+        arr_small = np.ndarray((360, 320), dtype=np.uint8, buffer=small.buf)
+        self.assertEqual(arr_small.shape, (360, 320))
+
+        # Phase 2: restart at 1920x1080 — new SHM segment, larger size.
+        large = _fake_shm(size=3_110_400)
+        with patch("frigate.util.image.UntrackedSharedMemory", return_value=large):
+            arr_large = manager.get("cam_frame0", (1620, 1920))
+
+        self.assertIsNotNone(arr_large)
+        self.assertEqual(arr_large.shape, (1620, 1920))
+
+
+if __name__ == "__main__":
+    unittest.main()

frigate/test/test_ws_outbound_filter.py

@@ -0,0 +1,806 @@
+"""Tests for outbound WebSocket broadcast filtering."""
+
+import json
+import threading
+import unittest
+from types import SimpleNamespace
+from typing import Any
+
+from frigate.comms.ws import (
+    WebSocketClient,
+    _classify_outbound,
+    _collect_zone_names,
+    _extract_payload_camera,
+    _materialize_for_ws,
+    _ws_allowed_cameras,
+    _ws_is_unrestricted,
+)
+from frigate.config import FrigateConfig
+
+
+def _build_config(
+    *,
+    extra_roles: dict[str, list[str]] | None = None,
+    extra_cameras: dict[str, dict[str, Any]] | None = None,
+    extra_zones: dict[str, dict[str, dict[str, Any]]] | None = None,
+) -> FrigateConfig:
+    """Construct a FrigateConfig used by the outbound filter tests.
+
+    The default fixture has three cameras: front_door, back_door, garage.
+    Restricted role "house_only" sees front_door + back_door but not garage.
+    """
+    cameras: dict[str, dict[str, Any]] = {
+        "front_door": {
+            "ffmpeg": {
+                "inputs": [{"path": "rtsp://10.0.0.1:554/v", "roles": ["detect"]}],
+            },
+            "detect": {"height": 1080, "width": 1920, "fps": 5},
+        },
+        "back_door": {
+            "ffmpeg": {
+                "inputs": [{"path": "rtsp://10.0.0.2:554/v", "roles": ["detect"]}],
+            },
+            "detect": {"height": 1080, "width": 1920, "fps": 5},
+        },
+        "garage": {
+            "ffmpeg": {
+                "inputs": [{"path": "rtsp://10.0.0.3:554/v", "roles": ["detect"]}],
+            },
+            "detect": {"height": 1080, "width": 1920, "fps": 5},
+        },
+    }
+    if extra_cameras:
+        cameras.update(extra_cameras)
+    if extra_zones:
+        for cam_name, zones in extra_zones.items():
+            cameras[cam_name]["zones"] = zones
+
+    roles = {"house_only": ["front_door", "back_door"]}
+    if extra_roles:
+        roles.update(extra_roles)
+
+    return FrigateConfig(
+        mqtt={"host": "mqtt"},
+        auth={"roles": roles},
+        cameras=cameras,
+    )
+
+
+def _ws(role: str | None) -> Any:
+    """Build a fake ws4py-style websocket exposing ``environ``."""
+    environ = {} if role is None else {"HTTP_REMOTE_ROLE": role}
+    return SimpleNamespace(environ=environ, terminated=False, sent=[])
+
+
+class TestClassifyOutbound(unittest.TestCase):
+    """The pure classifier — bucket every topic into a scope."""
+
+    def setUp(self):
+        self.config = _build_config(
+            extra_zones={"front_door": {"driveway": {"coordinates": "0,0,1,0,1,1,0,1"}}}
+        )
+        self.all_cameras = set(self.config.cameras.keys())
+        self.all_zones = _collect_zone_names(self.config)
+
+    def _classify(self, topic: str) -> tuple[str, Any]:
+        return _classify_outbound(topic, self.all_cameras, self.all_zones)
+
+    # --- Global allowlist ---
+
+    def test_model_state_is_global(self):
+        self.assertEqual(self._classify("model_state"), ("global", None))
+
+    def test_profile_state_is_global(self):
+        self.assertEqual(self._classify("profile/state"), ("global", None))
+
+    def test_bare_notifications_state_is_global(self):
+        """The 2-segment ``notifications/state`` is global; the 3-segment
+        ``<camera>/notifications/state`` is camera-scoped (see below)."""
+        self.assertEqual(self._classify("notifications/state"), ("global", None))
+
+    def test_notification_test_is_global(self):
+        self.assertEqual(self._classify("notification_test"), ("global", None))
+
+    # --- Unrestricted-only ---
+
+    def test_birdseye_layout_is_unrestricted_only(self):
+        self.assertEqual(self._classify("birdseye_layout"), ("unrestricted_only", None))
+
+    # --- Camera-prefixed ---
+
+    def test_camera_state_topic_resolves_to_camera(self):
+        self.assertEqual(
+            self._classify("front_door/detect/state"), ("camera", "front_door")
+        )
+
+    def test_camera_motion_topic_resolves_to_camera(self):
+        self.assertEqual(self._classify("back_door/motion"), ("camera", "back_door"))
+
+    def test_camera_per_notification_topic_resolves_to_camera(self):
+        self.assertEqual(
+            self._classify("front_door/notifications/state"),
+            ("camera", "front_door"),
+        )
+
+    def test_camera_label_counter_resolves_to_camera(self):
+        self.assertEqual(self._classify("front_door/person"), ("camera", "front_door"))
+
+    def test_camera_object_mask_state_resolves_to_camera(self):
+        self.assertEqual(
+            self._classify("front_door/object_mask/zone_1/state"),
+            ("camera", "front_door"),
+        )
+
+    # --- Zone-prefixed ---
+
+    def test_zone_aggregate_topic_is_unrestricted_only(self):
+        self.assertEqual(self._classify("driveway/person"), ("unrestricted_only", None))
+
+    def test_zone_all_topic_is_unrestricted_only(self):
+        self.assertEqual(self._classify("driveway/all"), ("unrestricted_only", None))
+
+    # --- Payload-camera ---
+
+    def test_events_topic_marks_payload_camera_path(self):
+        self.assertEqual(
+            self._classify("events"), ("payload_camera", ("after", "camera"))
+        )
+
+    def test_reviews_topic_marks_payload_camera_path(self):
+        self.assertEqual(
+            self._classify("reviews"), ("payload_camera", ("after", "camera"))
+        )
+
+    def test_triggers_topic_marks_payload_camera_path(self):
+        self.assertEqual(self._classify("triggers"), ("payload_camera", ("camera",)))
+
+    def test_tracked_object_update_marks_payload_camera_path(self):
+        self.assertEqual(
+            self._classify("tracked_object_update"), ("payload_camera", ("camera",))
+        )
+
+    # --- Reshape ---
+
+    def test_camera_activity_is_reshape_by_camera_key(self):
+        self.assertEqual(
+            self._classify("camera_activity"), ("reshape_by_camera_key", None)
+        )
+
+    def test_audio_detections_is_reshape_by_camera_key(self):
+        self.assertEqual(
+            self._classify("audio_detections"), ("reshape_by_camera_key", None)
+        )
+
+    def test_job_state_is_reshape_job_state(self):
+        self.assertEqual(self._classify("job_state"), ("reshape_job_state", None))
+
+    def test_stats_is_reshape_stats(self):
+        self.assertEqual(self._classify("stats"), ("reshape_stats", None))
+
+    # --- Fail-closed ---
+
+    def test_unknown_topic_is_dropped(self):
+        self.assertEqual(self._classify("some_random_topic"), ("drop", None))
+
+    def test_unknown_camera_prefix_is_dropped(self):
+        self.assertEqual(self._classify("ghost_camera/detect/state"), ("drop", None))
+
+
+class TestCollectZoneNames(unittest.TestCase):
+    def test_zones_from_all_cameras(self):
+        config = _build_config(
+            extra_zones={
+                "front_door": {"driveway": {"coordinates": "0,0,1,0,1,1,0,1"}},
+                "back_door": {"yard": {"coordinates": "0,0,1,0,1,1,0,1"}},
+            }
+        )
+        self.assertEqual(_collect_zone_names(config), {"driveway", "yard"})
+
+    def test_no_zones_returns_empty(self):
+        self.assertEqual(_collect_zone_names(_build_config()), set())
+
+
+class TestExtractPayloadCamera(unittest.TestCase):
+    def test_extract_from_dict_path(self):
+        payload = {"after": {"camera": "front_door"}}
+        self.assertEqual(
+            _extract_payload_camera(payload, ("after", "camera")), "front_door"
+        )
+
+    def test_extract_from_json_string(self):
+        payload = json.dumps({"after": {"camera": "front_door"}})
+        self.assertEqual(
+            _extract_payload_camera(payload, ("after", "camera")), "front_door"
+        )
+
+    def test_extract_single_segment_path(self):
+        self.assertEqual(
+            _extract_payload_camera({"camera": "garage"}, ("camera",)), "garage"
+        )
+
+    def test_missing_key_returns_none(self):
+        self.assertIsNone(_extract_payload_camera({}, ("after", "camera")))
+
+    def test_malformed_json_returns_none(self):
+        self.assertIsNone(_extract_payload_camera("not-json", ("camera",)))
+
+    def test_non_string_camera_returns_none(self):
+        self.assertIsNone(_extract_payload_camera({"camera": 42}, ("camera",)))
+
+
+class TestWsRoleHelpers(unittest.TestCase):
+    def setUp(self):
+        self.config = _build_config()
+
+    def test_admin_is_unrestricted(self):
+        self.assertTrue(_ws_is_unrestricted(_ws("admin"), self.config))
+
+    def test_viewer_is_unrestricted(self):
+        self.assertTrue(_ws_is_unrestricted(_ws("viewer"), self.config))
+
+    def test_restricted_role_is_not_unrestricted(self):
+        self.assertFalse(_ws_is_unrestricted(_ws("house_only"), self.config))
+
+    def test_missing_role_is_not_unrestricted(self):
+        self.assertFalse(_ws_is_unrestricted(_ws(None), self.config))
+
+    def test_unknown_role_is_not_unrestricted(self):
+        self.assertFalse(_ws_is_unrestricted(_ws("ghost"), self.config))
+
+    def test_admin_allowed_cameras_is_all(self):
+        self.assertEqual(
+            _ws_allowed_cameras(_ws("admin"), self.config),
+            {"front_door", "back_door", "garage"},
+        )
+
+    def test_restricted_role_allowed_cameras_is_subset(self):
+        self.assertEqual(
+            _ws_allowed_cameras(_ws("house_only"), self.config),
+            {"front_door", "back_door"},
+        )
+
+    def test_missing_role_allowed_cameras_is_empty(self):
+        self.assertEqual(_ws_allowed_cameras(_ws(None), self.config), set())
+
+    def test_multi_role_union_grants_widest(self):
+        self.assertEqual(
+            _ws_allowed_cameras(_ws("house_only,admin"), self.config),
+            {"front_door", "back_door", "garage"},
+        )
+
+
+class TestMaterializeForWs(unittest.TestCase):
+    def setUp(self):
+        self.config = _build_config(
+            extra_zones={"front_door": {"driveway": {"coordinates": "0,0,1,0,1,1,0,1"}}}
+        )
+        self.all_cameras = set(self.config.cameras.keys())
+        self.all_zones = _collect_zone_names(self.config)
+
+    def _materialize(self, ws: Any, topic: str, payload: Any) -> str | None:
+        scope = _classify_outbound(topic, self.all_cameras, self.all_zones)
+        from frigate.comms.ws import _parse_json_payload
+
+        parsed = (
+            _parse_json_payload(payload)
+            if scope[0]
+            in (
+                "payload_camera",
+                "reshape_by_camera_key",
+                "reshape_job_state",
+                "reshape_stats",
+            )
+            else None
+        )
+        full = json.dumps({"topic": topic, "payload": payload})
+        return _materialize_for_ws(ws, topic, full, scope, parsed, self.config)
+
+    # --- Globals: every authenticated client sees them ---
+
+    def test_globals_reach_admin(self):
+        self.assertIsNotNone(self._materialize(_ws("admin"), "model_state", "{}"))
+
+    def test_globals_reach_restricted(self):
+        self.assertIsNotNone(self._materialize(_ws("house_only"), "model_state", "{}"))
+
+    def test_globals_reach_no_role(self):
+        """A missing role header still gets globals (matches viewer-default
+        for inbound)."""
+        self.assertIsNotNone(self._materialize(_ws(None), "model_state", "{}"))
+
+    # --- Unknown topic dropped for everyone ---
+
+    def test_unknown_topic_dropped_for_admin(self):
+        self.assertIsNone(self._materialize(_ws("admin"), "rogue_topic", "{}"))
+
+    # --- Non-global topics require a role (fail-closed) ---
+
+    def test_no_role_blocked_from_camera_topic(self):
+        self.assertIsNone(self._materialize(_ws(None), "front_door/detect/state", "ON"))
+
+    def test_no_role_blocked_from_events(self):
+        payload = json.dumps({"after": {"camera": "front_door"}})
+        self.assertIsNone(self._materialize(_ws(None), "events", payload))
+
+    # --- Camera-prefixed ---
+
+    def test_restricted_role_sees_allowed_camera(self):
+        self.assertIsNotNone(
+            self._materialize(_ws("house_only"), "front_door/detect/state", "ON")
+        )
+
+    def test_restricted_role_blocked_from_unallowed_camera(self):
+        self.assertIsNone(
+            self._materialize(_ws("house_only"), "garage/detect/state", "ON")
+        )
+
+    def test_admin_sees_all_camera_topics(self):
+        self.assertIsNotNone(
+            self._materialize(_ws("admin"), "garage/detect/state", "ON")
+        )
+
+    # --- Unrestricted-only (zones, birdseye_layout) ---
+
+    def test_zone_aggregate_blocked_for_restricted(self):
+        self.assertIsNone(self._materialize(_ws("house_only"), "driveway/person", 3))
+
+    def test_zone_aggregate_visible_to_admin(self):
+        self.assertIsNotNone(self._materialize(_ws("admin"), "driveway/person", 3))
+
+    def test_birdseye_layout_blocked_for_restricted(self):
+        payload = json.dumps(
+            {"front_door": {"x": 0, "y": 0, "width": 100, "height": 100}}
+        )
+        self.assertIsNone(
+            self._materialize(_ws("house_only"), "birdseye_layout", payload)
+        )
+
+    def test_birdseye_layout_visible_to_admin(self):
+        payload = json.dumps(
+            {"front_door": {"x": 0, "y": 0, "width": 100, "height": 100}}
+        )
+        self.assertIsNotNone(
+            self._materialize(_ws("admin"), "birdseye_layout", payload)
+        )
+
+    # --- Payload-camera ---
+
+    def test_events_filtered_by_payload_camera(self):
+        payload = json.dumps({"after": {"camera": "garage"}})
+        self.assertIsNone(self._materialize(_ws("house_only"), "events", payload))
+
+        payload = json.dumps({"after": {"camera": "front_door"}})
+        self.assertIsNotNone(self._materialize(_ws("house_only"), "events", payload))
+
+    def test_events_with_missing_camera_dropped(self):
+        payload = json.dumps({"after": {}})
+        self.assertIsNone(self._materialize(_ws("house_only"), "events", payload))
+
+    def test_triggers_filtered_by_payload_camera(self):
+        payload = json.dumps({"name": "t1", "camera": "garage"})
+        self.assertIsNone(self._materialize(_ws("house_only"), "triggers", payload))
+
+    # --- Reshape: dict keyed by camera ---
+
+    def test_camera_activity_filtered_to_allowed_keys(self):
+        payload = json.dumps(
+            {
+                "front_door": {"objects": 1},
+                "back_door": {"objects": 0},
+                "garage": {"objects": 2},
+            }
+        )
+        message = self._materialize(_ws("house_only"), "camera_activity", payload)
+        self.assertIsNotNone(message)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        inner = json.loads(envelope["payload"])
+        self.assertEqual(set(inner.keys()), {"front_door", "back_door"})
+        self.assertNotIn("garage", inner)
+
+    def test_camera_activity_unchanged_for_admin(self):
+        payload = json.dumps({"front_door": {}, "back_door": {}, "garage": {}})
+        message = self._materialize(_ws("admin"), "camera_activity", payload)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        self.assertEqual(envelope["payload"], payload)
+
+    def test_camera_activity_with_no_allowed_returns_none(self):
+        payload = json.dumps({"garage": {"objects": 2}})
+        self.assertIsNone(
+            self._materialize(_ws("house_only"), "camera_activity", payload)
+        )
+
+    def test_audio_detections_filtered_to_allowed_keys(self):
+        payload = json.dumps({"front_door": {"bark": {}}, "garage": {"speech": {}}})
+        message = self._materialize(_ws("house_only"), "audio_detections", payload)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        inner = json.loads(envelope["payload"])
+        self.assertEqual(set(inner.keys()), {"front_door"})
+
+    # --- Reshape: job_state ---
+
+    def test_job_state_admin_sees_full_payload(self):
+        payload = json.dumps(
+            {
+                "motion_search": {"job_type": "motion_search", "camera": "garage"},
+                "media_sync": {"job_type": "media_sync"},
+            }
+        )
+        message = self._materialize(_ws("admin"), "job_state", payload)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        self.assertEqual(envelope["payload"], payload)
+
+    def test_job_state_restricted_keeps_allowed_camera_jobs(self):
+        """Top-level camera field on a job entry: drop if not allowed."""
+        payload = json.dumps(
+            {
+                "motion_search": {"job_type": "motion_search", "camera": "front_door"},
+                "vlm_watch": {"job_type": "vlm_watch", "camera": "garage"},
+            }
+        )
+        message = self._materialize(_ws("house_only"), "job_state", payload)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        inner = json.loads(envelope["payload"])
+        self.assertIn("motion_search", inner)
+        self.assertNotIn("vlm_watch", inner)
+
+    def test_job_state_export_results_jobs_filtered_per_recipient(self):
+        """The aggregated export broadcast nests per-camera sub-jobs under
+        ``results.jobs``. Restricted users must only see allowed entries."""
+        payload = json.dumps(
+            {
+                "export": {
+                    "job_type": "export",
+                    "status": "running",
+                    "results": {
+                        "jobs": [
+                            {"job_type": "export", "camera": "front_door", "id": "a"},
+                            {"job_type": "export", "camera": "garage", "id": "b"},
+                            {"job_type": "export", "camera": "back_door", "id": "c"},
+                        ]
+                    },
+                }
+            }
+        )
+        message = self._materialize(_ws("house_only"), "job_state", payload)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        inner = json.loads(envelope["payload"])
+        self.assertIn("export", inner)
+        kept_cameras = [j["camera"] for j in inner["export"]["results"]["jobs"]]
+        self.assertEqual(kept_cameras, ["front_door", "back_door"])
+        # Sibling fields like ``status`` must survive reshaping.
+        self.assertEqual(inner["export"]["status"], "running")
+
+    def test_job_state_export_entry_dropped_when_no_jobs_allowed(self):
+        payload = json.dumps(
+            {
+                "export": {
+                    "job_type": "export",
+                    "status": "running",
+                    "results": {
+                        "jobs": [
+                            {"job_type": "export", "camera": "garage", "id": "b"},
+                        ]
+                    },
+                }
+            }
+        )
+        self.assertIsNone(self._materialize(_ws("house_only"), "job_state", payload))
+
+    # --- Reshape: stats ---
+
+    def _stats_payload(self) -> str:
+        return json.dumps(
+            {
+                "cameras": {
+                    "front_door": {"camera_fps": 5.0, "pid": 1234},
+                    "back_door": {"camera_fps": 5.0, "pid": 1235},
+                    "garage": {"camera_fps": 5.0, "pid": 1236},
+                },
+                "detectors": {"cpu": {"detection_start": 0.0, "inference_speed": 10}},
+                "service": {"uptime": 12345, "version": "0.16.0"},
+                "camera_fps": 15.0,
+                "detection_fps": 6.0,
+            }
+        )
+
+    def test_stats_admin_sees_full_payload(self):
+        message = self._materialize(_ws("admin"), "stats", self._stats_payload())
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        self.assertEqual(envelope["payload"], self._stats_payload())
+
+    def test_stats_restricted_filters_camera_keys_but_keeps_aggregates(self):
+        message = self._materialize(_ws("house_only"), "stats", self._stats_payload())
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        inner = json.loads(envelope["payload"])
+        self.assertEqual(set(inner["cameras"].keys()), {"front_door", "back_door"})
+        self.assertNotIn("garage", inner["cameras"])
+        # Aggregates, detectors, and service block must survive.
+        self.assertEqual(inner["camera_fps"], 15.0)
+        self.assertEqual(inner["detection_fps"], 6.0)
+        self.assertIn("detectors", inner)
+        self.assertIn("service", inner)
+
+    def test_stats_restricted_with_no_allowed_cameras_still_sends_aggregates(self):
+        """A restricted role whose allow-list contains only nonexistent cameras
+        still gets the global aggregates and service block."""
+        config = _build_config(extra_roles={"empty_role": ["nonexistent"]})
+        from frigate.comms.ws import _parse_json_payload
+
+        payload = self._stats_payload()
+        all_cameras = set(config.cameras.keys())
+        scope = _classify_outbound("stats", all_cameras, _collect_zone_names(config))
+        full = json.dumps({"topic": "stats", "payload": payload})
+        message = _materialize_for_ws(
+            _ws("empty_role"),
+            "stats",
+            full,
+            scope,
+            _parse_json_payload(payload),
+            config,
+        )
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        inner = json.loads(envelope["payload"])
+        self.assertEqual(inner["cameras"], {})
+        self.assertEqual(inner["camera_fps"], 15.0)
+        self.assertIn("service", inner)
+
+    def test_stats_without_cameras_key_passes_through(self):
+        """A malformed stats payload missing the cameras sub-dict shouldn't
+        break delivery for restricted users — fall back to the full message."""
+        payload = json.dumps({"detectors": {}, "service": {}, "detection_fps": 0.0})
+        message = self._materialize(_ws("house_only"), "stats", payload)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        self.assertEqual(envelope["payload"], payload)
+
+    def test_job_state_export_entry_unchanged_for_admin(self):
+        payload = json.dumps(
+            {
+                "export": {
+                    "job_type": "export",
+                    "status": "running",
+                    "results": {
+                        "jobs": [
+                            {"job_type": "export", "camera": "garage", "id": "b"},
+                        ]
+                    },
+                }
+            }
+        )
+        message = self._materialize(_ws("admin"), "job_state", payload)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        self.assertEqual(envelope["payload"], payload)
+
+    def test_job_state_restricted_keeps_global_jobs(self):
+        """media_sync has no camera field; restricted users still see it."""
+        payload = json.dumps(
+            {"media_sync": {"job_type": "media_sync", "status": "running"}}
+        )
+        message = self._materialize(_ws("house_only"), "job_state", payload)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        inner = json.loads(envelope["payload"])
+        self.assertIn("media_sync", inner)
+
+    def test_job_state_debug_replay_nested_source_camera_filtered(self):
+        """debug_replay puts ``source_camera`` inside ``results`` (see
+        jobs/debug_replay.py:to_dict). Restricted users must not receive
+        entries whose nested source camera is unauthorized."""
+        payload = json.dumps(
+            {
+                "debug_replay": {
+                    "id": "bd6dc99d-a7d",
+                    "job_type": "debug_replay",
+                    "status": "running",
+                    "start_time": 1.0,
+                    "end_time": None,
+                    "error_message": None,
+                    "results": {
+                        "current_step": "preparing_clip",
+                        "progress_percent": 0.0,
+                        "source_camera": "garage",
+                        "replay_camera_name": "_replay_garage",
+                        "start_ts": 0.0,
+                        "end_ts": 1.0,
+                    },
+                }
+            }
+        )
+        self.assertIsNone(self._materialize(_ws("house_only"), "job_state", payload))
+
+    def test_job_state_debug_replay_nested_source_camera_allowed(self):
+        payload = json.dumps(
+            {
+                "debug_replay": {
+                    "id": "bd6dc99d-a7d",
+                    "job_type": "debug_replay",
+                    "status": "running",
+                    "results": {
+                        "source_camera": "front_door",
+                        "replay_camera_name": "_replay_front_door",
+                    },
+                }
+            }
+        )
+        message = self._materialize(_ws("house_only"), "job_state", payload)
+        envelope = json.loads(message)  # type: ignore[arg-type]
+        inner = json.loads(envelope["payload"])
+        self.assertIn("debug_replay", inner)
+        self.assertEqual(
+            inner["debug_replay"]["results"]["source_camera"], "front_door"
+        )
+
+
+class _FakeManager:
+    """Minimal ws4py manager: holds clients and exposes a lock."""
+
+    def __init__(self, clients: list[Any]) -> None:
+        self.lock = threading.Lock()
+        self.websockets = {id(c): c for c in clients}
+
+
+class _FakeServer:
+    def __init__(self, manager: _FakeManager) -> None:
+        self.manager = manager
+
+
+class _CapturingWs(SimpleNamespace):
+    """Fake ws4py client that records what was sent."""
+
+    def __init__(self, role: str | None) -> None:
+        environ = {} if role is None else {"HTTP_REMOTE_ROLE": role}
+        super().__init__(environ=environ, terminated=False)
+        self.sent: list[str] = []
+
+    def send(self, message: str) -> None:  # noqa: D401 - matches ws4py API
+        self.sent.append(message)
+
+
+class TestPublishEndToEnd(unittest.TestCase):
+    """Drive WebSocketClient.publish() against fake clients with different roles."""
+
+    def setUp(self):
+        self.config = _build_config(
+            extra_zones={"front_door": {"driveway": {"coordinates": "0,0,1,0,1,1,0,1"}}}
+        )
+        self.admin = _CapturingWs("admin")
+        self.restricted = _CapturingWs("house_only")
+        self.anon = _CapturingWs(None)
+        self.client = WebSocketClient(self.config)
+        self.client.websocket_server = _FakeServer(
+            _FakeManager([self.admin, self.restricted, self.anon])
+        )
+
+    def _payloads(self, ws: _CapturingWs) -> list[Any]:
+        return [json.loads(m)["payload"] for m in ws.sent]
+
+    def test_global_topic_reaches_everyone(self):
+        self.client.publish("model_state", "{}")
+        self.assertEqual(len(self.admin.sent), 1)
+        self.assertEqual(len(self.restricted.sent), 1)
+        self.assertEqual(len(self.anon.sent), 1)
+
+    def test_camera_topic_filters_restricted_recipient(self):
+        self.client.publish("garage/detect/state", "ON")
+        self.assertEqual(len(self.admin.sent), 1)
+        self.assertEqual(len(self.restricted.sent), 0)
+        self.assertEqual(len(self.anon.sent), 0)
+
+    def test_camera_topic_allows_restricted_recipient_for_allowed_camera(self):
+        self.client.publish("front_door/detect/state", "ON")
+        self.assertEqual(len(self.admin.sent), 1)
+        self.assertEqual(len(self.restricted.sent), 1)
+        self.assertEqual(len(self.anon.sent), 0)
+
+    def test_events_payload_filtered(self):
+        self.client.publish("events", json.dumps({"after": {"camera": "garage"}}))
+        self.assertEqual(len(self.admin.sent), 1)
+        self.assertEqual(len(self.restricted.sent), 0)
+
+    def test_camera_activity_reshaped_per_recipient(self):
+        self.client.publish(
+            "camera_activity",
+            json.dumps(
+                {
+                    "front_door": {"objects": 1},
+                    "back_door": {"objects": 0},
+                    "garage": {"objects": 2},
+                }
+            ),
+        )
+        self.assertEqual(len(self.admin.sent), 1)
+        admin_inner = json.loads(self._payloads(self.admin)[0])
+        self.assertEqual(set(admin_inner.keys()), {"front_door", "back_door", "garage"})
+
+        self.assertEqual(len(self.restricted.sent), 1)
+        restricted_inner = json.loads(self._payloads(self.restricted)[0])
+        self.assertEqual(set(restricted_inner.keys()), {"front_door", "back_door"})
+
+        self.assertEqual(len(self.anon.sent), 0)
+
+    def test_birdseye_layout_blocked_for_restricted_and_anon(self):
+        self.client.publish(
+            "birdseye_layout",
+            json.dumps({"front_door": {"x": 0, "y": 0, "width": 1, "height": 1}}),
+        )
+        self.assertEqual(len(self.admin.sent), 1)
+        self.assertEqual(len(self.restricted.sent), 0)
+        self.assertEqual(len(self.anon.sent), 0)
+
+    def test_zone_aggregate_blocked_for_restricted(self):
+        self.client.publish("driveway/person", 2)
+        self.assertEqual(len(self.admin.sent), 1)
+        self.assertEqual(len(self.restricted.sent), 0)
+
+    def test_stats_reshaped_per_recipient(self):
+        self.client.publish(
+            "stats",
+            json.dumps(
+                {
+                    "cameras": {
+                        "front_door": {"camera_fps": 5.0},
+                        "garage": {"camera_fps": 5.0},
+                    },
+                    "service": {"uptime": 1},
+                    "camera_fps": 10.0,
+                }
+            ),
+        )
+        self.assertEqual(len(self.admin.sent), 1)
+        admin_inner = json.loads(self._payloads(self.admin)[0])
+        self.assertEqual(set(admin_inner["cameras"].keys()), {"front_door", "garage"})
+
+        self.assertEqual(len(self.restricted.sent), 1)
+        restricted_inner = json.loads(self._payloads(self.restricted)[0])
+        self.assertEqual(set(restricted_inner["cameras"].keys()), {"front_door"})
+        self.assertEqual(restricted_inner["camera_fps"], 10.0)
+        self.assertIn("service", restricted_inner)
+
+        # Stats requires a role; anonymous gets nothing.
+        self.assertEqual(len(self.anon.sent), 0)
+
+    def test_export_job_state_filters_results_jobs_per_recipient(self):
+        self.client.publish(
+            "job_state",
+            json.dumps(
+                {
+                    "export": {
+                        "job_type": "export",
+                        "status": "running",
+                        "results": {
+                            "jobs": [
+                                {"camera": "front_door", "id": "a"},
+                                {"camera": "garage", "id": "b"},
+                            ]
+                        },
+                    }
+                }
+            ),
+        )
+        self.assertEqual(len(self.admin.sent), 1)
+        admin_inner = json.loads(self._payloads(self.admin)[0])
+        self.assertEqual(
+            [j["camera"] for j in admin_inner["export"]["results"]["jobs"]],
+            ["front_door", "garage"],
+        )
+
+        self.assertEqual(len(self.restricted.sent), 1)
+        restricted_inner = json.loads(self._payloads(self.restricted)[0])
+        self.assertEqual(
+            [j["camera"] for j in restricted_inner["export"]["results"]["jobs"]],
+            ["front_door"],
+        )
+
+    def test_unknown_topic_dropped_for_everyone(self):
+        self.client.publish("some_rogue_topic", "data")
+        self.assertEqual(self.admin.sent, [])
+        self.assertEqual(self.restricted.sent, [])
+        self.assertEqual(self.anon.sent, [])
+
+    def test_terminated_client_is_skipped(self):
+        self.restricted.terminated = True
+        self.client.publish("front_door/detect/state", "ON")
+        self.assertEqual(len(self.admin.sent), 1)
+        self.assertEqual(len(self.restricted.sent), 0)
+
+
+if __name__ == "__main__":
+    unittest.main()

frigate/track/object_processing.py

@@ -357,6 +357,9 @@ class TrackedObjectProcessor(threading.Thread):
 
     def get_current_frame_time(self, camera: str) -> float:
         """Returns the latest frame time for a given camera."""
+        if camera not in self.camera_states:
+            return 0.0
+
         return self.camera_states[camera].current_frame_time
 
     def set_sub_label(

frigate/track/tracked_object.py

@@ -531,8 +531,7 @@ class TrackedObject:
 
         directory = os.path.join(THUMB_DIR, self.camera_config.name)
 
-        if not os.path.exists(directory):
-            os.makedirs(directory)
+        os.makedirs(directory, exist_ok=True)
 
         thumb_bytes = self.get_thumbnail("webp")
 

frigate/util/config.py

@@ -8,7 +8,7 @@ from typing import Any, Optional, Union
 
 from ruamel.yaml import YAML
 
-from frigate.const import CONFIG_DIR, EXPORT_DIR
+from frigate.const import CONFIG_DIR, EXPORT_DIR, REDACTED_CREDENTIAL_SENTINEL
 from frigate.util.builtin import deep_merge
 from frigate.util.services import get_video_properties
 
@@ -18,6 +18,21 @@ CURRENT_CONFIG_VERSION = "0.18-0"
 DEFAULT_CONFIG_FILE = os.path.join(CONFIG_DIR, "config.yml")
 
 
+def redact_credential(obj: dict[str, Any], key: str) -> None:
+    """Replace obj[key] with the redaction sentinel if a value is saved, else drop.
+
+    Used when shaping the /config response so saved credentials never leave
+    the server. The frontend recognizes REDACTED_CREDENTIAL_SENTINEL, renders
+    the field as empty with a "saved — leave blank to keep" placeholder, and
+    /config/set strips it from any incoming payload so the YAML value is
+    preserved when the user doesn't touch the field.
+    """
+    if obj.get(key):
+        obj[key] = REDACTED_CREDENTIAL_SENTINEL
+    else:
+        obj.pop(key, None)
+
+
 def find_config_file() -> str:
     config_path = os.environ.get("CONFIG_FILE", DEFAULT_CONFIG_FILE)
 
@@ -492,7 +507,7 @@ def migrate_018_0(config: dict[str, dict[str, Any]]) -> dict[str, dict[str, Any]
     genai = new_config.get("genai")
 
     if genai and genai.get("provider"):
-        genai["roles"] = ["embeddings", "vision", "tools"]
+        genai["roles"] = ["embeddings", "descriptions", "chat"]
         new_config["genai"] = {"default": genai}
 
     # Remove deprecated sync_recordings from global record config
@@ -773,6 +788,45 @@ def apply_section_update(camera_config, section: str, update: dict) -> Optional[
                 )
             camera_config.objects = new_objects
 
+        elif section == "detect":
+            # apply detect first so frame_shape reflects the new resolution
+            # before we rebuild mask-dependent runtime configs below
+            merged = deep_merge(current.model_dump(), update, override=True)
+            camera_config.detect = current.__class__.model_validate(merged)
+
+            new_frame_shape = camera_config.frame_shape
+
+            # rebuild motion's rasterized_mask at the new frame_shape
+            if camera_config.motion is not None:
+                camera_config.motion = RuntimeMotionConfig(
+                    frame_shape=new_frame_shape,
+                    **camera_config.motion.model_dump(exclude_unset=True),
+                )
+
+            # rebuild per-object filter masks at the new frame_shape
+            for obj_name, filt in camera_config.objects.filters.items():
+                merged_mask = dict(filt.mask)
+                if camera_config.objects.mask:
+                    for gid, gmask in camera_config.objects.mask.items():
+                        merged_mask[f"global_{gid}"] = gmask
+
+                camera_config.objects.filters[obj_name] = RuntimeFilterConfig(
+                    frame_shape=new_frame_shape,
+                    mask=merged_mask,
+                    **filt.model_dump(exclude_unset=True, exclude={"mask", "raw_mask"}),
+                )
+
+            # Regenerate zone contours and per-zone filter masks at the new
+            # frame_shape so zone outlines and membership stay relative
+            for zone in camera_config.zones.values():
+                if zone.filters:
+                    for zone_obj_name, zone_filter in zone.filters.items():
+                        zone.filters[zone_obj_name] = RuntimeFilterConfig(
+                            frame_shape=new_frame_shape,
+                            **zone_filter.model_dump(exclude_unset=True),
+                        )
+                zone.generate_contour(new_frame_shape)
+
         else:
             merged = deep_merge(current.model_dump(), update, override=True)
             setattr(camera_config, section, current.__class__.model_validate(merged))

frigate/util/image.py

@@ -1089,10 +1089,25 @@ class SharedMemoryFrameManager(FrameManager):
 
     def get(self, name: str, shape) -> Optional[np.ndarray]:
         try:
-            if name in self.shm_store:
-                shm = self.shm_store[name]
-            else:
+            required = int(np.prod(shape))
+            shm = self.shm_store.get(name)
+            if shm is not None and shm.size != required:
+                # stale cached ref from a same-name recreate — drop and reopen
+                try:
+                    shm.close()
+                except Exception:
+                    pass
+                self.shm_store.pop(name, None)
+                shm = None
+            if shm is None:
                 shm = UntrackedSharedMemory(name=name)
+                if shm.size != required:
+                    # mid-recreate: OS segment doesn't match shape yet; skip
+                    try:
+                        shm.close()
+                    except Exception:
+                        pass
+                    return None
                 self.shm_store[name] = shm
             return np.ndarray(shape, dtype=np.uint8, buffer=shm.buf)
         except FileNotFoundError:

frigate/util/services.py

@@ -393,8 +393,10 @@ def _read_intel_drm_fdinfo(target_pdev: Optional[str]) -> dict:
     return snapshot
 
 
-def get_intel_gpu_stats(intel_gpu_device: Optional[str]) -> Optional[dict[str, Any]]:
-    """Get stats by reading DRM fdinfo files.
+def get_intel_gpu_stats(
+    intel_gpu_device: Optional[str],
+) -> Optional[dict[str, dict[str, Any]]]:
+    """Get stats by reading DRM fdinfo files, bucketed per-pdev.
 
     Each DRM client FD exposes monotonic per-engine busy counters via
     /proc/<pid>/fdinfo/<fd> (i915 since kernel 5.19, Xe since first release).
@@ -402,11 +404,23 @@ def get_intel_gpu_stats(intel_gpu_device: Optional[str]) -> Optional[dict[str, A
     utilization. Render/3D and Compute are pooled into "compute"; Video and
     VideoEnhance into "dec". Overall "gpu" is the sum of those pools (clamped
     to 100%).
+
+    The return value is keyed by the GPU's drm-pdev string so multiple Intel
+    GPUs in the same system are reported separately. Each entry carries a
+    "name" populated from OpenVINO (falling back to the pdev) so callers can
+    surface a real device name in the UI.
     """
+    from frigate.stats.intel_gpu_info import intel_gpu_name_resolver
+
     target_pdev = _resolve_intel_gpu_pdev(intel_gpu_device)
 
     snapshot_a = _read_intel_drm_fdinfo(target_pdev)
     if not snapshot_a:
+        logger.warning(
+            "Unable to collect Intel GPU stats: no DRM fdinfo entries found"
+            "%s. Check that /proc is readable and the i915/xe driver is loaded",
+            f" for pdev {target_pdev}" if target_pdev else "",
+        )
         return None
 
     start = time.monotonic()
@@ -415,21 +429,26 @@ def get_intel_gpu_stats(intel_gpu_device: Optional[str]) -> Optional[dict[str, A
 
     snapshot_b = _read_intel_drm_fdinfo(target_pdev)
     if not snapshot_b or elapsed_ns <= 0:
+        logger.warning(
+            "Unable to collect Intel GPU stats: second DRM fdinfo sample was empty"
+        )
         return None
 
-    engine_pct: dict[str, float] = {
-        "render": 0.0,
-        "video": 0.0,
-        "video-enhance": 0.0,
-        "compute": 0.0,
-    }
-    pid_pct: dict[str, float] = {}
+    def _new_engine_pct() -> dict[str, float]:
+        return {"render": 0.0, "video": 0.0, "video-enhance": 0.0, "compute": 0.0}
+
+    per_pdev_engine_pct: dict[str, dict[str, float]] = {}
+    per_pdev_pid_pct: dict[str, dict[str, float]] = {}
 
     for key, data_b in snapshot_b.items():
         data_a = snapshot_a.get(key)
         if not data_a or data_a["driver"] != data_b["driver"]:
             continue
 
+        pdev = key[0]
+        engine_pct = per_pdev_engine_pct.setdefault(pdev, _new_engine_pct())
+        pid_pct = per_pdev_pid_pct.setdefault(pdev, {})
+
         client_total = 0.0
         for engine, (busy_b, total_b) in data_b["engines"].items():
             if engine not in engine_pct:
@@ -452,25 +471,41 @@ def get_intel_gpu_stats(intel_gpu_device: Optional[str]) -> Optional[dict[str, A
 
         pid_pct[data_b["pid"]] = pid_pct.get(data_b["pid"], 0.0) + client_total
 
-    for engine in engine_pct:
-        engine_pct[engine] = min(100.0, engine_pct[engine])
+    if not per_pdev_engine_pct:
+        logger.warning(
+            "Unable to collect Intel GPU stats: no per-engine counters available "
+            "(i915 requires kernel >= 5.19)"
+        )
+        return None
 
-    compute_pct = min(100.0, engine_pct["render"] + engine_pct["compute"])
-    dec_pct = min(100.0, engine_pct["video"] + engine_pct["video-enhance"])
-    overall_pct = min(100.0, compute_pct + dec_pct)
+    names = intel_gpu_name_resolver.get_names()
+    results: dict[str, dict[str, Any]] = {}
 
-    results: dict[str, Any] = {
-        "gpu": f"{round(overall_pct, 2)}%",
-        "mem": "-%",
-        "compute": f"{round(compute_pct, 2)}%",
-        "dec": f"{round(dec_pct, 2)}%",
-    }
+    for pdev, engine_pct in per_pdev_engine_pct.items():
+        for engine in engine_pct:
+            engine_pct[engine] = min(100.0, engine_pct[engine])
 
-    if pid_pct:
-        results["clients"] = {
-            pid: f"{round(min(100.0, pct), 2)}%" for pid, pct in pid_pct.items()
+        compute_pct = min(100.0, engine_pct["render"] + engine_pct["compute"])
+        dec_pct = min(100.0, engine_pct["video"] + engine_pct["video-enhance"])
+        overall_pct = min(100.0, compute_pct + dec_pct)
+
+        entry: dict[str, Any] = {
+            "name": names.get(pdev) or "Intel iGPU",
+            "vendor": "intel",
+            "gpu": f"{round(overall_pct, 2)}%",
+            "mem": "-%",
+            "compute": f"{round(compute_pct, 2)}%",
+            "dec": f"{round(dec_pct, 2)}%",
         }
 
+        pid_pct = per_pdev_pid_pct.get(pdev)
+        if pid_pct:
+            entry["clients"] = {
+                pid: f"{round(min(100.0, pct), 2)}%" for pid, pct in pid_pct.items()
+            }
+
+        results[pdev] = entry
+
     return results
 
 
@@ -755,6 +790,41 @@ def get_hailo_temps() -> dict[str, float]:
     return temps
 
 
+def _go2rtc_arbitrary_exec_allowed() -> bool:
+    """Read the GO2RTC_ALLOW_ARBITRARY_EXEC override from env, docker
+    secrets, or the Home Assistant add-on options file."""
+    raw: Optional[str] = None
+    if "GO2RTC_ALLOW_ARBITRARY_EXEC" in os.environ:
+        raw = os.environ.get("GO2RTC_ALLOW_ARBITRARY_EXEC")
+    elif (
+        os.path.isdir("/run/secrets")
+        and os.access("/run/secrets", os.R_OK)
+        and "GO2RTC_ALLOW_ARBITRARY_EXEC" in os.listdir("/run/secrets")
+    ):
+        try:
+            with open("/run/secrets/GO2RTC_ALLOW_ARBITRARY_EXEC") as f:
+                raw = f.read().strip()
+        except OSError:
+            raw = None
+    elif os.path.isfile("/data/options.json"):
+        try:
+            with open("/data/options.json") as f:
+                options = json.loads(f.read())
+            raw = options.get("go2rtc_allow_arbitrary_exec")
+        except (OSError, json.JSONDecodeError):
+            raw = None
+
+    return raw is not None and str(raw).lower() in ("true", "1", "yes")
+
+
+def is_restricted_go2rtc_source(stream_source: str) -> bool:
+    """Check if a stream source is a restricted type (echo, expr, or exec)
+    and the GO2RTC_ALLOW_ARBITRARY_EXEC override is not set."""
+    if not stream_source.strip().startswith(("echo:", "expr:", "exec:")):
+        return False
+    return not _go2rtc_arbitrary_exec_allowed()
+
+
 def ffprobe_stream(ffmpeg, path: str, detailed: bool = False) -> sp.CompletedProcess:
     """Run ffprobe on stream."""
     clean_path = escape_special_characters(path)

generate_config_translations.py

@@ -150,29 +150,51 @@ def extract_translations_from_schema(
             # Handle anyOf cases
             elif "anyOf" in field_schema:
                 for item in field_schema["anyOf"]:
+                    nested = None
+                    if item.get("type") == "null":
+                        continue
                     if "properties" in item:
                         nested = extract_translations_from_schema(item, defs=defs)
+                    elif "$ref" in item:
+                        ref_path = item["$ref"]
+                        if ref_path.startswith("#/$defs/"):
+                            ref_name = ref_path.split("/")[-1]
+                            if ref_name in defs:
+                                nested = extract_translations_from_schema(
+                                    defs[ref_name], defs=defs
+                                )
+                    elif (
+                        "additionalProperties" in item
+                        and isinstance(item["additionalProperties"], dict)
+                        and "$ref" in item["additionalProperties"]
+                    ):
+                        ref_path = item["additionalProperties"]["$ref"]
+                        if ref_path.startswith("#/$defs/"):
+                            ref_name = ref_path.split("/")[-1]
+                            if ref_name in defs:
+                                nested = extract_translations_from_schema(
+                                    defs[ref_name], defs=defs
+                                )
+                    elif (
+                        "items" in item
+                        and isinstance(item["items"], dict)
+                        and ("$ref" in item["items"])
+                    ):
+                        ref_path = item["items"]["$ref"]
+                        if ref_path.startswith("#/$defs/"):
+                            ref_name = ref_path.split("/")[-1]
+                            if ref_name in defs:
+                                nested = extract_translations_from_schema(
+                                    defs[ref_name], defs=defs
+                                )
+
+                    if nested:
                         nested_without_root = {
                             k: v
                             for k, v in nested.items()
                             if k not in ("label", "description")
                         }
                         field_translations.update(nested_without_root)
-                    elif "$ref" in item:
-                        ref_path = item["$ref"]
-                        if ref_path.startswith("#/$defs/"):
-                            ref_name = ref_path.split("/")[-1]
-                            if ref_name in defs:
-                                ref_schema = defs[ref_name]
-                                nested = extract_translations_from_schema(
-                                    ref_schema, defs=defs
-                                )
-                                nested_without_root = {
-                                    k: v
-                                    for k, v in nested.items()
-                                    if k not in ("label", "description")
-                                }
-                                field_translations.update(nested_without_root)
 
         if field_translations:
             translations[field_name] = field_translations
@@ -342,6 +364,64 @@ def main():
                     continue
                 section_data.pop(key, None)
 
+        if field_name == "objects":
+            # Produce a parallel `filters_attribute` block alongside `filters`,
+            # with object-wording rewritten for attribute filters (face,
+            # license_plate, courier logos). The frontend's
+            # buildTranslationPath routes `filters.<attr>.<field>` lookups to
+            # `filters_attribute.<field>` when `<attr>` is in
+            # `model.all_attributes`. Keep this rewrite list explicit rather
+            # than running a blanket s/object/attribute/ so unrelated
+            # descriptions (e.g. "JSON object") never accidentally flip.
+            filters_block = section_data.get("filters")
+            if isinstance(filters_block, dict):
+                attribute_rewrites = [
+                    ("Object filters", "Attribute filters"),
+                    ("detected objects", "detected attributes"),
+                    ("object area", "attribute area"),
+                    ("object type", "attribute"),
+                    ("the object", "the attribute"),
+                ]
+
+                # Per-field overrides for cases where the generic rewrite
+                # doesn't capture the attribute-specific semantics. Keys
+                # match the FilterConfig field name; values are partial
+                # overrides applied AFTER the generic rewrites.
+                attribute_field_overrides: Dict[str, Dict[str, str]] = {
+                    "min_score": {
+                        "description": (
+                            "Minimum single-frame detection confidence required "
+                            "to associate this attribute with its parent object."
+                        ),
+                    },
+                }
+
+                def rewrite(text: str) -> str:
+                    for source, replacement in attribute_rewrites:
+                        text = text.replace(source, replacement)
+                    return text
+
+                attribute_variant: Dict[str, Any] = {}
+                for key, value in filters_block.items():
+                    if key in ("label", "description"):
+                        if isinstance(value, str):
+                            attribute_variant[key] = rewrite(value)
+                        continue
+                    if not isinstance(value, dict):
+                        continue
+                    field_trans: Dict[str, str] = {}
+                    if isinstance(value.get("label"), str):
+                        field_trans["label"] = rewrite(value["label"])
+                    if isinstance(value.get("description"), str):
+                        field_trans["description"] = rewrite(value["description"])
+                    overrides = attribute_field_overrides.get(key)
+                    if overrides:
+                        field_trans.update(overrides)
+                    if field_trans:
+                        attribute_variant[key] = field_trans
+                if attribute_variant:
+                    section_data["filters_attribute"] = attribute_variant
+
         if not section_data:
             logger.warning(f"No translations found for section: {field_name}")
             continue

web/e2e/specs/clone-camera.spec.ts

@@ -0,0 +1,181 @@
+/**
+ * Camera clone dialog E2E tests.
+ *
+ * Covers the design invariants that don't depend on per-camera resolution
+ * differences in the mock fixture:
+ *   1. Dialog opens from the "Clone settings" button below Add/Delete.
+ *   2. A source camera must be chosen inside the dialog before cloning.
+ *   3. "Stream URLs and roles" is forced on and disabled for new-camera target.
+ *   4. Cloning to a new camera issues a single add PUT and shows a restart prompt.
+ *   5. The existing-camera target selects multiple destinations via a switch
+ *      popover (with an "All cameras" toggle and source exclusion); the closed
+ *      trigger summarizes the selection by name or as "All cameras".
+ *
+ * The spatial-mismatch warning path is exercised in unit-level review and via
+ * manual QA — the shared mock fixture ships every camera at 1280×720. The
+ * existing-camera PUT fan-out is likewise not asserted here: the mock cameras
+ * are identical apart from stream URLs (which existing-camera clones never
+ * copy) and the schema mock is empty, so a clone onto them produces no diff
+ * and no PUT. That path is covered by unit-level review and manual QA.
+ */
+
+import { test, expect } from "../fixtures/frigate-test";
+
+async function openCloneDialog(frigateApp: {
+  page: import("@playwright/test").Page;
+}) {
+  await frigateApp.page
+    .getByRole("button", { name: /^Clone settings$/i })
+    .click();
+  await expect(frigateApp.page.getByRole("dialog")).toBeVisible();
+}
+
+async function selectSource(
+  frigateApp: { page: import("@playwright/test").Page },
+  source: string,
+) {
+  await frigateApp.page.getByRole("dialog").getByRole("combobox").click();
+  await frigateApp.page
+    .getByRole("option", { name: source, exact: true })
+    .click();
+}
+
+test.describe("Camera clone dialog @medium @mobile", () => {
+  test.beforeEach(async ({ frigateApp }) => {
+    await frigateApp.goto("/settings?page=cameraManagement");
+    await expect(
+      frigateApp.page.getByRole("heading", { name: /Manage Cameras/i }),
+    ).toBeVisible();
+  });
+
+  test("opens the dialog from the Clone settings button", async ({
+    frigateApp,
+  }) => {
+    await openCloneDialog(frigateApp);
+
+    await expect(
+      frigateApp.page.getByRole("dialog").getByText(/Clone camera settings/i),
+    ).toBeVisible();
+
+    // The Clone button is disabled until a source (and target) is chosen.
+    await expect(
+      frigateApp.page.getByRole("button", { name: /^Clone$/i }),
+    ).toBeDisabled();
+  });
+
+  test("forces Stream URLs and roles on for new-camera target", async ({
+    frigateApp,
+  }) => {
+    await openCloneDialog(frigateApp);
+    await selectSource(frigateApp, "Front Door");
+
+    // The "New camera" radio is selected by default; the Streams group renders
+    // the ffmpeg_live checkbox as forced-checked and disabled.
+    const streamsLabel = frigateApp.page
+      .locator("label")
+      .filter({ hasText: /Stream URLs and roles/i });
+    await expect(streamsLabel).toBeVisible();
+
+    const streamsCheckbox = streamsLabel.getByRole("checkbox");
+    await expect(streamsCheckbox).toBeChecked();
+    await expect(streamsCheckbox).toBeDisabled();
+  });
+
+  test("issues a single add PUT and shows restart toast for new-camera target", async ({
+    frigateApp,
+  }) => {
+    const requests: { body: unknown }[] = [];
+
+    await frigateApp.page.route("**/api/config/set", async (route) => {
+      const body = route.request().postDataJSON();
+      requests.push({ body });
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ success: true, require_restart: false }),
+      });
+    });
+
+    await frigateApp.goto("/settings?page=cameraManagement");
+    await expect(
+      frigateApp.page.getByRole("heading", { name: /Manage Cameras/i }),
+    ).toBeVisible();
+
+    await openCloneDialog(frigateApp);
+    await selectSource(frigateApp, "Front Door");
+
+    const nameInput = frigateApp.page.getByPlaceholder(
+      /e\.g\., back_door or Back Door/i,
+    );
+    await nameInput.fill("clone_target_one");
+
+    // With a source picked and a valid name, changeCount > 0 enables Clone.
+    await expect(
+      frigateApp.page.getByRole("button", { name: /^Clone$/i }),
+    ).toBeEnabled({ timeout: 5_000 });
+
+    await frigateApp.page.getByRole("button", { name: /^Clone$/i }).click();
+
+    // New-camera clones bundle into a single atomic add PUT (avoids
+    // per-section validation ordering issues).
+    await expect.poll(() => requests.length, { timeout: 10_000 }).toBe(1);
+
+    const firstBody = requests[0].body as {
+      requires_restart?: number;
+      update_topic?: string;
+    };
+    expect(firstBody.update_topic).toMatch(
+      /config\/cameras\/clone_target_one\/add/,
+    );
+    expect(firstBody.requires_restart).toBe(1);
+
+    // The toast offers a Restart action because new-camera always needs restart.
+    // .first() avoids strict-mode rejection when both the toast action and the
+    // RestartDialog trigger render concurrently.
+    await expect(
+      frigateApp.page.getByRole("button", { name: /Restart/i }).first(),
+    ).toBeVisible({ timeout: 8_000 });
+  });
+
+  test("selects multiple existing destination cameras via a switch popover", async ({
+    frigateApp,
+  }) => {
+    await openCloneDialog(frigateApp);
+    await selectSource(frigateApp, "Front Door");
+
+    await frigateApp.page
+      .getByRole("radio", { name: /Existing cameras/i })
+      .click();
+
+    const dialog = frigateApp.page.getByRole("dialog");
+
+    // The destination trigger starts with the empty-selection placeholder.
+    await dialog
+      .getByRole("button", { name: /Select at least one camera/i })
+      .click();
+
+    // The chosen source is excluded from the destination switch list.
+    await expect(
+      dialog.getByRole("switch", { name: /Backyard/i }),
+    ).toBeVisible();
+    await expect(dialog.getByRole("switch", { name: /Garage/i })).toBeVisible();
+    await expect(
+      dialog.getByRole("switch", { name: /^Front Door$/i }),
+    ).toHaveCount(0);
+
+    // Selecting a single camera summarizes by name once the popover closes.
+    await dialog.getByRole("switch", { name: /Backyard/i }).click();
+    await frigateApp.page.keyboard.press("Escape");
+    await expect(
+      dialog.getByRole("button", { name: /^Backyard$/i }),
+    ).toBeVisible();
+
+    // Reopen and select everything; the trigger collapses to "All cameras".
+    await dialog.getByRole("button", { name: /^Backyard$/i }).click();
+    await dialog.getByRole("switch", { name: /^All cameras$/i }).click();
+    await frigateApp.page.keyboard.press("Escape");
+    await expect(
+      dialog.getByRole("button", { name: /^All cameras$/i }),
+    ).toBeVisible();
+  });
+});

web/e2e/specs/replay.spec.ts

@@ -129,8 +129,14 @@ test.describe("Replay — active session @medium", () => {
     );
     await actionGroup.first().click();
 
-    const dialog = frigateApp.page.getByRole("dialog");
-    await expect(dialog).toBeVisible({ timeout: 5_000 });
+    // On mobile PlatformAwareSheet renders a MobilePage (full-screen panel)
+    // instead of a Radix Dialog, so assert the panel title heading is visible.
+    await expect(
+      frigateApp.page.getByRole("heading", {
+        level: 2,
+        name: /^Configuration$/i,
+      }),
+    ).toBeVisible({ timeout: 5_000 });
   });
 
   test("Objects tab renders with the camera_activity objects list", async ({

web/e2e/specs/settings/detectors-and-model.spec.ts

@@ -0,0 +1,55 @@
+/**
+ * Detectors and model settings page tests -- HIGH tier.
+ *
+ * Tests rendering of the merged page and navigation from the Frigate+ page.
+ */
+
+import { test, expect } from "../../fixtures/frigate-test";
+
+test.describe("Detectors and model Settings @high", () => {
+  test("page renders with detector and model cards", async ({ frigateApp }) => {
+    await frigateApp.goto("/settings?page=systemDetectorsAndModel");
+    await frigateApp.page.waitForTimeout(2000);
+    await expect(frigateApp.page.locator("#pageRoot")).toBeVisible();
+
+    const text = await frigateApp.page.textContent("#pageRoot");
+    expect(text).toContain("Detectors and model");
+    expect(text?.toLowerCase()).toContain("detector hardware");
+    expect(text?.toLowerCase()).toContain("detection model");
+  });
+
+  test("Frigate+ page links to the merged page", async ({ frigateApp }) => {
+    await frigateApp.goto("/settings?page=frigateplus");
+    await frigateApp.page.waitForTimeout(2000);
+
+    const button = frigateApp.page.getByRole("button", {
+      name: /Change in Detectors and model/,
+    });
+
+    // Button only appears when Frigate+ is enabled in the test config; skip
+    // the click assertion if it's not present.
+    if ((await button.count()) > 0) {
+      await button.first().click();
+      await frigateApp.page.waitForURL(/page=systemDetectorsAndModel/);
+      await expect(frigateApp.page.locator("#pageRoot")).toContainText(
+        "Detectors and model",
+      );
+    } else {
+      test.skip(
+        true,
+        "Frigate+ not enabled in this test config; skipping link assertion",
+      );
+    }
+  });
+
+  test("old systemDetectionModel deep-link no longer routes here", async ({
+    frigateApp,
+  }) => {
+    await frigateApp.goto("/settings?page=systemDetectionModel");
+    await frigateApp.page.waitForTimeout(2000);
+    // The old page key is no longer in allSettingsViews; the router
+    // falls back to its default settings page (uiSettings).
+    const text = await frigateApp.page.textContent("#pageRoot");
+    expect(text).not.toContain("Detection model");
+  });
+});

web/e2e/specs/settings/go2rtc-streams.spec.ts

@@ -0,0 +1,235 @@
+/**
+ * go2rtc streams settings page tests -- MEDIUM tier.
+ *
+ * Regression coverage for the compat-mode (ffmpeg:) URL editor: unknown
+ * fragments like #timeout=10 must remain visible and editable when the
+ * stream is using compatibility mode.
+ */
+
+import { test, expect } from "../../fixtures/frigate-test";
+import type { Page } from "@playwright/test";
+
+const STREAM_NAME = "dome_sub";
+const FFMPEG_URL_WITH_TIMEOUT =
+  "ffmpeg:rtsp://user:pass@192.168.0.20:554/Stream1#video=copy#audio=copy#timeout=10";
+
+async function installRawPathsRoute(page: Page, streamUrl: string) {
+  let lastSavedConfig: unknown = null;
+  await page.route("**/api/config/raw_paths", (route) =>
+    route.fulfill({
+      json: {
+        cameras: {},
+        go2rtc: { streams: { [STREAM_NAME]: [streamUrl] } },
+      },
+    }),
+  );
+  await page.route("**/api/config/set", async (route) => {
+    lastSavedConfig = route.request().postDataJSON();
+    await route.fulfill({ json: { success: true, require_restart: false } });
+  });
+  return {
+    capturedConfig: () => lastSavedConfig,
+  };
+}
+
+async function expandStream(page: Page, streamName: string) {
+  // Each StreamCard renders the stream name as an h4 next to a rename
+  // button, with the chevron toggle as the last button in the header row.
+  // Scope to the header row (h4's grandparent) and click that last button.
+  const headerRow = page
+    .locator(`h4:text-is("${streamName}")`)
+    .locator("xpath=../..");
+  await headerRow.getByRole("button").last().click();
+}
+
+test.describe("go2rtc streams settings — ffmpeg compat mode @medium", () => {
+  test("preserves unknown fragments like #timeout= in the URL input", async ({
+    frigateApp,
+  }) => {
+    await installRawPathsRoute(frigateApp.page, FFMPEG_URL_WITH_TIMEOUT);
+    await frigateApp.goto("/settings?page=systemGo2rtcStreams");
+
+    await expect(
+      frigateApp.page.getByRole("heading", { name: STREAM_NAME }),
+    ).toBeVisible();
+
+    await expandStream(frigateApp.page, STREAM_NAME);
+
+    const urlInput = frigateApp.page.getByPlaceholder(
+      "e.g., rtsp://user:pass@192.168.1.100/stream",
+    );
+    await expect(urlInput).toBeVisible();
+
+    // Focus the input so credential masking is bypassed and the raw value
+    // is rendered — this matches how a user would inspect the URL before
+    // editing it.
+    await urlInput.focus();
+    await expect(urlInput).toHaveValue(
+      "rtsp://user:pass@192.168.0.20:554/Stream1#timeout=10",
+    );
+  });
+
+  test("lets the user add an extra fragment in compat mode", async ({
+    frigateApp,
+  }) => {
+    const capture = await installRawPathsRoute(
+      frigateApp.page,
+      FFMPEG_URL_WITH_TIMEOUT,
+    );
+    await frigateApp.goto("/settings?page=systemGo2rtcStreams");
+    await expandStream(frigateApp.page, STREAM_NAME);
+
+    const urlInput = frigateApp.page.getByPlaceholder(
+      "e.g., rtsp://user:pass@192.168.1.100/stream",
+    );
+    await urlInput.focus();
+    await urlInput.fill(
+      "rtsp://user:pass@192.168.0.20:554/Stream1#timeout=10#backchannel=0",
+    );
+    await urlInput.blur();
+
+    // Reopen and re-focus to assert the new value round-tripped through
+    // parseFfmpegBaseAndExtras + buildFfmpegUrl back into the displayed text.
+    await urlInput.focus();
+    await expect(urlInput).toHaveValue(
+      "rtsp://user:pass@192.168.0.20:554/Stream1#timeout=10#backchannel=0",
+    );
+
+    // Save and verify the persisted URL includes both extras after the
+    // recognized video/audio directives.
+    await frigateApp.page.getByRole("button", { name: "Save" }).click();
+    await expect
+      .poll(() => capture.capturedConfig(), { timeout: 5_000 })
+      .toMatchObject({
+        config_data: {
+          go2rtc: {
+            streams: {
+              [STREAM_NAME]: [
+                "ffmpeg:rtsp://user:pass@192.168.0.20:554/Stream1#video=copy#audio=copy#timeout=10#backchannel=0",
+              ],
+            },
+          },
+        },
+      });
+  });
+
+  test("preserves repeatable #audio= fallback chain and lets the user add another codec", async ({
+    frigateApp,
+  }) => {
+    const capture = await installRawPathsRoute(
+      frigateApp.page,
+      // Idiomatic go2rtc fallback: copy if source has the codec, else transcode
+      "ffmpeg:rtsp://user:pass@192.168.0.20:554/Stream1#video=copy#audio=copy#audio=opus",
+    );
+    await frigateApp.goto("/settings?page=systemGo2rtcStreams");
+    await expandStream(frigateApp.page, STREAM_NAME);
+
+    // Two pre-populated audio rows — one per #audio= fragment.
+    const audioLabel = frigateApp.page.locator(`label:text-is("Audio")`);
+    const audioRowsContainer = audioLabel.locator("xpath=../..");
+    await expect(audioRowsContainer.getByRole("combobox")).toHaveCount(2);
+    await expect(audioRowsContainer.getByRole("combobox").first()).toHaveText(
+      "Copy",
+    );
+    await expect(audioRowsContainer.getByRole("combobox").nth(1)).toHaveText(
+      "Transcode to Opus",
+    );
+
+    // Add a third audio codec via the LuPlus next to the "Audio" label.
+    await audioRowsContainer
+      .getByRole("button", { name: "Add audio codec" })
+      .click();
+    await expect(audioRowsContainer.getByRole("combobox")).toHaveCount(3);
+
+    // Change the newly-added entry to AAC.
+    await audioRowsContainer.getByRole("combobox").nth(2).click();
+    await frigateApp.page
+      .getByRole("option", { name: "Transcode to AAC" })
+      .click();
+
+    await frigateApp.page.getByRole("button", { name: "Save" }).click();
+    await expect
+      .poll(() => capture.capturedConfig(), { timeout: 5_000 })
+      .toMatchObject({
+        config_data: {
+          go2rtc: {
+            streams: {
+              [STREAM_NAME]: [
+                "ffmpeg:rtsp://user:pass@192.168.0.20:554/Stream1#video=copy#audio=copy#audio=opus#audio=aac",
+              ],
+            },
+          },
+        },
+      });
+  });
+
+  test("LuX is only shown on fallback rows and removes only that codec", async ({
+    frigateApp,
+  }) => {
+    const capture = await installRawPathsRoute(
+      frigateApp.page,
+      "ffmpeg:rtsp://user:pass@192.168.0.20:554/Stream1#video=copy#audio=copy#audio=opus",
+    );
+    await frigateApp.goto("/settings?page=systemGo2rtcStreams");
+    await expandStream(frigateApp.page, STREAM_NAME);
+
+    const audioLabel = frigateApp.page.locator(`label:text-is("Audio")`);
+    const audioRowsContainer = audioLabel.locator("xpath=../..");
+    const removeButtons = audioRowsContainer.getByRole("button", {
+      name: "Remove codec",
+    });
+    // Primary (audio=copy) row is permanent and has no X; only the audio=opus
+    // fallback exposes a remove button.
+    await expect(removeButtons).toHaveCount(1);
+
+    await removeButtons.first().click();
+    await expect(audioRowsContainer.getByRole("combobox")).toHaveCount(1);
+    await expect(audioRowsContainer.getByRole("combobox")).toHaveText("Copy");
+
+    await frigateApp.page.getByRole("button", { name: "Save" }).click();
+    await expect
+      .poll(() => capture.capturedConfig(), { timeout: 5_000 })
+      .toMatchObject({
+        config_data: {
+          go2rtc: {
+            streams: {
+              [STREAM_NAME]: [
+                "ffmpeg:rtsp://user:pass@192.168.0.20:554/Stream1#video=copy#audio=copy",
+              ],
+            },
+          },
+        },
+      });
+  });
+
+  test("picking Exclude on the primary row drops the #video= fragment entirely", async ({
+    frigateApp,
+  }) => {
+    const capture = await installRawPathsRoute(
+      frigateApp.page,
+      "ffmpeg:rtsp://user:pass@192.168.0.20:554/Stream1#video=copy#audio=copy",
+    );
+    await frigateApp.goto("/settings?page=systemGo2rtcStreams");
+    await expandStream(frigateApp.page, STREAM_NAME);
+
+    const videoLabel = frigateApp.page.locator(`label:text-is("Video")`);
+    const videoRowsContainer = videoLabel.locator("xpath=../..");
+    await videoRowsContainer.getByRole("combobox").first().click();
+    await frigateApp.page.getByRole("option", { name: "Exclude" }).click();
+
+    await frigateApp.page.getByRole("button", { name: "Save" }).click();
+    await expect
+      .poll(() => capture.capturedConfig(), { timeout: 5_000 })
+      .toMatchObject({
+        config_data: {
+          go2rtc: {
+            streams: {
+              [STREAM_NAME]: [
+                "ffmpeg:rtsp://user:pass@192.168.0.20:554/Stream1#audio=copy",
+              ],
+            },
+          },
+        },
+      });
+  });
+});

web/public/locales/ca/audio.json

@@ -138,7 +138,7 @@
   "plucked_string_instrument": "Instrument de corda pinçada",
   "guitar": "Guitarra",
   "electric_guitar": "Guitarra elèctrica",
-  "bass_guitar": "Baix",
+  "bass_guitar": "Guitarra baixa",
   "acoustic_guitar": "Guitarra acústica",
   "steel_guitar": "Guitarra steel",
   "tapping": "Tapping",

web/public/locales/ca/common.json

@@ -49,7 +49,8 @@
       "gl": "Galego (Gallec)",
       "id": "Bahasa Indonesia (Indonesi)",
       "ur": "اردو (Urdú)",
-      "hr": "Hrvatski (croat)"
+      "hr": "Hrvatski (croat)",
+      "bs": "Bosanski (Bosni)"
     },
     "system": "Sistema",
     "systemMetrics": "Mètriques del sistema",