add note to mqtt docs to use ID rather than friendly_name (#24441)

Default was changed in b733355

Makefile

@@ -1,7 +1,7 @@
 default_target: local
 
 COMMIT_HASH := $(shell git log -1 --pretty=format:"%h"|tail -1)
-VERSION = 0.18.0
+VERSION = 0.18.1
 IMAGE_REPO ?= ghcr.io/blakeblackshear/frigate
 GITHUB_REF_NAME ?= $(shell git rev-parse --abbrev-ref HEAD)
 BOARDS= #Initialized empty

audio-labelmap.txt

@@ -24,7 +24,7 @@ yell
 sigh
 singing
 choir
-sodeling
+yodeling
 chant
 mantra
 child_singing

docker/main/rootfs/usr/local/nginx/conf/nginx.conf

@@ -150,7 +150,9 @@ http {
             include auth_request.conf;
             types {
                 video/mp4 mp4;
-                image/jpeg jpg;
+                image/jpeg jpg jpeg;
+                image/png png;
+                image/webp webp;
             }
 
             expires 7d;

docs/data/object_detectors_models.yaml

@@ -1100,7 +1100,7 @@ synaptics:
     - key: ssd
       label: SSD MobileNet
       recommended: true
-      download: A synap model is provided in the container at `/mobilenet.synap` and is used by this detector type by default. The model comes from the [Synap-release Github](https://github.com/synaptics-astra/synap-release/tree/v1.5.0/models/dolphin/object_detection/coco/model/mobilenet224_full80).
+      download: A synap model is provided in the container at `/synaptics/mobilenet.synap` and is used by this detector type by default. The model comes from the [Synap-release Github](https://github.com/synaptics-astra/synap-release/tree/v1.5.0/models/dolphin/object_detection/coco/model/mobilenet224_full80).
       ui: |-
         Navigate to **Settings > System > Detectors and model** and select **Synaptics** from the detector type dropdown and click **Add**. Then on the same page, in the **Custom Model** tab, configure:
 

docs/docs/configuration/advanced/reference.md

@@ -286,7 +286,7 @@ ffmpeg:
     # Optional: output args for detect streams (default: shown below)
     detect: -threads 2 -f rawvideo -pix_fmt yuv420p
     # Optional: output args for record streams (default: shown below)
-    record: preset-record-generic
+    record: preset-record-generic-audio-aac
   # Optional: Time in seconds to wait before ffmpeg retries connecting to the camera. (default: shown below)
   # If set too low, frigate will retry a connection to the camera's stream too frequently, using up the limited streams some cameras can allow at once
   # If set too high, then if a ffmpeg crash or camera stream timeout occurs, you could potentially lose up to a maximum of retry_interval second(s) of footage

docs/docs/configuration/cameras.md

@@ -50,6 +50,31 @@ Connect each stream to get a live preview, an estimated bandwidth figure, and a
 
 Other features, including [hardware acceleration](hardware_acceleration_video.md), [two way talk](/configuration/live#two-way-talk), and audio transcoding, is configured after the camera has been added. For camera model specific quirks, see the [camera specific](camera_specific.md) docs.
 
+## Deleting a camera
+
+Click **Delete Camera** in <NavPath path="Settings > Global configuration > Camera management" />, choose the camera, and confirm. Deleting a camera requires the `admin` role and cannot be undone.
+
+:::warning
+
+Deleting a camera permanently removes its recordings, tracked objects, and configuration. If you only want to stop processing a camera, set its state to **Off** or **Disabled** in <NavPath path="Settings > Global configuration > Camera management" /> instead. See [camera state](/configuration/live#camera-state).
+
+:::
+
+Deleting a camera removes:
+
+- The camera's section of your config file, along with its entries in any [role](authentication.md#user-roles) camera list. A custom role left with no cameras is removed as well.
+- Every database record for the camera: tracked objects, review items, recordings, previews, timeline entries, the saved region grid, and [triggers](semantic_search.md#triggers).
+- Every media file for the camera: recordings, snapshots, thumbnails, and preview clips.
+
+[Exports](/usage/exports) are kept by default, so saved footage survives the deletion of the camera it came from. Turn on **Also delete exports for this camera** in the confirmation step to remove those too.
+
+The camera's processes are stopped and the change takes effect immediately, so no restart is required. If the resulting config cannot be parsed, Frigate restores the previous config and reports an error instead of leaving Frigate in a broken state.
+
+Two things are not cleaned up for you:
+
+- **go2rtc streams.** Frigate makes a best effort to stop a running [go2rtc](go2rtc.md) stream named after the camera, but stream entries in your config file remain and are recreated on the next restart. Remove them in <NavPath path="Settings > System > go2rtc streams" /> or in your config file.
+- **Camera groups.** A deleted camera stays listed in any [camera group](#setting-up-camera-groups) that referenced it. The group skips the missing camera, so this is harmless, but you can edit the group to drop the stale entry.
+
 ## Setting Up Camera Inputs
 
 Several inputs can be configured for each camera and the role of each input can be mixed and matched based on your needs. This allows you to use a lower resolution stream for object detection, but create recordings from a higher resolution stream, or vice versa.

docs/docs/configuration/genai/config.md

@@ -59,13 +59,17 @@ Running Generative AI models on CPU is not recommended, as high inference times
 
 ### Recommended Local Models
 
+#### Vision models
+
 You must use a vision-capable model with Frigate. The following models are recommended for local deployment of the `descriptions` and `chat` roles:
 
-| Model      | Notes                                                                                                                                                                |
-| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `qwen3-vl` | Strong visual and situational understanding, enhanced ability to identify smaller objects and interactions with object.                                              |
-| `qwen3.6`  | Strong situational understanding, but missing DeepStack from qwen3-vl leading to worse performance for identifying objects in people's hand and other small details. |
-| `gemma4`   | Strong situational understanding, sometimes resorts to more vague terms like 'interacts' instead of assigning a specific action.                                     |
+| Model               | Notes                                                                                                                                                                |
+| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `qwen3-vl`          | Strong visual and situational understanding, enhanced ability to identify smaller objects and interactions with object.                                              |
+| `qwen3.6`/`qwen3.8` | Strong situational understanding, but missing DeepStack from qwen3-vl leading to worse performance for identifying objects in people's hand and other small details. |
+| `gemma4`            | Strong situational understanding, sometimes resorts to more vague terms like 'interacts' instead of assigning a specific action.                                     |
+
+#### Embedding models
 
 The `embeddings` role needs a different kind of model. Text queries are matched against the stored image embeddings, so the model must be trained to place images and text into the same vector space. A chat or description model will still return vectors when asked, but those vectors are not trained for retrieval and text searches will return poor matches with no error to indicate why.
 

docs/docs/configuration/hardware_acceleration_video.md

@@ -498,7 +498,7 @@ cameras:
 
 ## Synaptics
 
-Hardware accelerated video de-/encoding is supported on Synpatics SL-series SoC.
+Hardware accelerated video de-/encoding is supported on Synaptics SL-series SoC.
 
 ### Prerequisites
 

docs/docs/configuration/license_plate_recognition.md

@@ -8,7 +8,7 @@ import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
 import FaqItem from "@site/src/components/FaqItem";
 
-Frigate can recognize license plates on vehicles and automatically add the detected characters to the `recognized_license_plate` field or a [known](#matching) name as a `sub_label` to tracked objects of type `car` or `motorcycle`. A common use case may be to read the license plates of cars pulling into a driveway or cars passing by on a street.
+Frigate can recognize license plates on vehicles and automatically add the detected characters to the `recognized_license_plate` field or a [known](#matching) name as a `sub_label` to tracked objects of type `car`, `motorcycle`, `bus`, `truck`, `school_bus`, or `garbage_truck`, depending on which of those labels your model detects. A common use case may be to read the license plates of cars pulling into a driveway or cars passing by on a street.
 
 LPR works best when the license plate is clearly visible to the camera. For moving vehicles, Frigate continuously refines the recognition process, keeping the most confident result. When a vehicle becomes stationary, LPR continues to run for a short time after to attempt recognition.
 
@@ -24,7 +24,7 @@ When a plate is recognized, the details are:
 - Viewable in the Details pane in Review/History.
 - Viewable in the Tracked Object Details pane in Explore (sub labels and recognized license plates).
 - Filterable through the More Filters menu in Explore.
-- Published via the `frigate/events` MQTT topic as a `sub_label` ([known](#matching)) or `recognized_license_plate` (unknown) for the `car` or `motorcycle` tracked object.
+- Published via the `frigate/events` MQTT topic as a `sub_label` ([known](#matching)) or `recognized_license_plate` (unknown) for the vehicle tracked object.
 - Published via the `frigate/tracked_object_update` MQTT topic with `name` (if [known](#matching)) and `plate`.
 
 ## Model Requirements
@@ -35,7 +35,7 @@ Users without a model that detects license plates can still run LPR. Frigate use
 
 :::note
 
-In the default mode, Frigate's LPR needs to first detect a `car` or `motorcycle` before it can recognize a license plate. If you're using a dedicated LPR camera and have a zoomed-in view where a `car` or `motorcycle` will not be detected, you can still run LPR, but the configuration parameters will differ from the default mode. See the [Dedicated LPR Cameras](#dedicated-lpr-cameras) section below.
+In the default mode, Frigate's LPR needs to first detect a vehicle before it can recognize a license plate. If you're using a dedicated LPR camera and have a zoomed-in view where a vehicle will not be detected, you can still run LPR, but the configuration parameters will differ from the default mode. See the [Dedicated LPR Cameras](#dedicated-lpr-cameras) section below.
 
 :::
 
@@ -86,7 +86,7 @@ cameras:
 </TabItem>
 </ConfigTabs>
 
-For non-dedicated LPR cameras, ensure that your camera is configured to detect objects of type `car` or `motorcycle`, and that a car or motorcycle is actually being detected by Frigate. Otherwise, LPR will not run.
+For non-dedicated LPR cameras, ensure that your camera is configured to detect vehicle objects, and that a vehicle is actually being detected by Frigate. Otherwise, LPR will not run. The object types that can carry a plate are defined by your model's `attributes_map`, so if your model detects other vehicle labels, you can add them there.
 
 Like the other real-time processors in Frigate, license plate recognition runs on the camera stream defined by the `detect` role in your config. To ensure optimal performance, select a suitable resolution for this stream in your camera's firmware that fits your specific scene and requirements.
 
@@ -158,7 +158,7 @@ lpr:
 
 Navigate to <NavPath path="Settings > Enrichments > License plate recognition" />.
 
-- **Known plates**: Assign custom `sub_label` values to `car` and `motorcycle` objects when a recognized plate matches a known value. These labels appear in the UI, filters, and notifications. Unknown plates are still saved but are added to the `recognized_license_plate` field rather than the `sub_label`.
+- **Known plates**: Assign custom `sub_label` values to vehicle objects when a recognized plate matches a known value. These labels appear in the UI, filters, and notifications. Unknown plates are still saved but are added to the `recognized_license_plate` field rather than the `sub_label`.
 - **Match distance**: Allows for minor variations (missing/incorrect characters) when matching a detected plate to a known plate. For example, setting to `1` allows a plate `ABCDE` to match `ABCBE` or `ABCD`. This parameter will _not_ operate on known plates that are defined as regular expressions.
 
 </TabItem>
@@ -316,7 +316,7 @@ lpr:
 
 :::note
 
-If a camera is configured to detect `car` or `motorcycle` but you don't want Frigate to run LPR for that camera, disable LPR at the camera level:
+If a camera is configured to detect vehicles but you don't want Frigate to run LPR for that camera, disable LPR at the camera level:
 
 <ConfigTabs>
 <TabItem value="ui">
@@ -378,10 +378,10 @@ Navigate to <NavPath path="Settings > Camera configuration > Object detection" /
 
 Navigate to <NavPath path="Settings > Camera configuration > Objects" />.
 
-| Field                                          | Description         |
-| ---------------------------------------------- | ------------------- |
-| **Objects to track**                           | Add `license_plate` |
-| **Object filters > License Plate > Threshold** | Set to `0.7`        |
+| Field                                                     | Description         |
+| --------------------------------------------------------- | ------------------- |
+| **Objects to track**                                      | Add `license_plate` |
+| **Object filters > License Plate > Confidence threshold** | Set to `0.7`        |
 
 Navigate to <NavPath path="Settings > Camera configuration > Motion detection" />.
 
@@ -456,7 +456,7 @@ With this setup:
 - Snapshots will have license plate bounding boxes on them.
 - The `frigate/events` MQTT topic will publish tracked object updates.
 - Debug view will display `license_plate` bounding boxes.
-- If you are using a Frigate+ model and want to submit images from your dedicated LPR camera for model training and fine-tuning, annotate both the `car` / `motorcycle` and the `license_plate` in the snapshots on the Frigate+ website, even if the car is barely visible.
+- If you are using a Frigate+ model and want to submit images from your dedicated LPR camera for model training and fine-tuning, annotate both the vehicle and the `license_plate` in the snapshots on the Frigate+ website, even if the vehicle is barely visible.
 
 ### Using the Secondary LPR Pipeline (Without Frigate+)
 
@@ -611,9 +611,9 @@ If you are still having issues detecting plates, start with a basic configuratio
 
 </FaqItem>
 
-<FaqItem id="can-i-run-lpr-without-detecting-car-or-motorcycle-objects" question={<>Can I run LPR without detecting <code>car</code> or <code>motorcycle</code> objects?</>}>
+<FaqItem id="can-i-run-lpr-without-detecting-car-or-motorcycle-objects" question={<>Can I run LPR without detecting vehicle objects?</>}>
 
-In normal LPR mode, Frigate requires a `car` or `motorcycle` to be detected first before recognizing a license plate. If you have a dedicated LPR camera, you can change the camera `type` to `"lpr"` to use the Dedicated LPR Camera algorithm. This comes with important caveats, though. See the [Dedicated LPR Cameras](#dedicated-lpr-cameras) section above.
+In normal LPR mode, Frigate requires a vehicle to be detected first before recognizing a license plate. If you have a dedicated LPR camera, you can change the camera `type` to `"lpr"` to use the Dedicated LPR Camera algorithm. This comes with important caveats, though. See the [Dedicated LPR Cameras](#dedicated-lpr-cameras) section above.
 
 </FaqItem>
 
@@ -699,7 +699,7 @@ lpr:
 4. Ensure the characters on detected plates are being _recognized_.
    - Check the **Plate recognition** inference time in Enrichment metrics (<NavPath path="System metrics > Enrichments" />). High inference times (> 100ms) could lead to poor recognition results, especially for dedicated LPR cameras where the plate crosses the frame quickly.
    - Enable `debug_save_plates` to save images of detected text on plates to the clips directory (`/media/frigate/clips/lpr`). Ensure these images are readable and the text is clear.
-   - Watch the debug view to see plates recognized in real-time. For non-dedicated LPR cameras, the `car` or `motorcycle` label will change to the recognized plate when LPR is enabled and working.
+   - Watch the debug view to see plates recognized in real-time. For non-dedicated LPR cameras, the vehicle's label will change to the recognized plate when LPR is enabled and working.
    - Adjust `recognition_threshold` settings per the suggestions [above](#advanced-configuration).
 
 </FaqItem>
@@ -714,13 +714,13 @@ LPR's performance impact depends on your hardware. Ensure you have at least 4GB
 
 The YOLOv9 license plate detector model will run (and the metric will appear) if you've enabled LPR but haven't defined `license_plate` as an object to track, either at the global or camera level.
 
-If you are detecting `car` or `motorcycle` on cameras where you don't want to run LPR, make sure you disable LPR it at the camera level. And if you do want to run LPR on those cameras, make sure you define `license_plate` as an object to track.
+If you are detecting vehicles on cameras where you don't want to run LPR, make sure you disable LPR it at the camera level. And if you do want to run LPR on those cameras, make sure you define `license_plate` as an object to track.
 
 </FaqItem>
 
 <FaqItem id="it-looks-like-frigate-picked-up-my-cameras-timestamp-or-overlay-text-as-the-license-plate-how-can-i-prevent-this" question="It looks like Frigate picked up my camera's timestamp or overlay text as the license plate. How can I prevent this?">
 
-This could happen if cars or motorcycles travel close to your camera's timestamp or overlay text. You could either move the text through your camera's firmware, or apply a mask to it in Frigate.
+This could happen if vehicles travel close to your camera's timestamp or overlay text. You could either move the text through your camera's firmware, or apply a mask to it in Frigate.
 
 If you are using a model that natively detects `license_plate`, add an _object mask_ of type `license_plate` and a _motion mask_ over your text.
 

docs/docs/configuration/notifications.md

@@ -6,6 +6,7 @@ title: Notifications
 import ConfigTabs from "@site/src/components/ConfigTabs";
 import TabItem from "@theme/TabItem";
 import NavPath from "@site/src/components/NavPath";
+import FaqItem from "@site/src/components/FaqItem";
 
 # Notifications
 
@@ -21,7 +22,7 @@ Push notifications require internet access from the Frigate server to the browse
 
 In order to use notifications the following requirements must be met:
 
-- Frigate must be accessed via a secure `https` connection ([see the authorization docs](/configuration/authentication)).
+- Frigate must be accessed via a secure `https` connection while signed in as a Frigate user ([see the authorization docs](/configuration/authentication)).
 - A supported browser must be used. Currently Chrome, Firefox, and Safari are known to be supported.
 - In order for notifications to be usable externally, Frigate must be accessible externally.
 - For iOS devices, some users have also indicated that the Notifications switch needs to be enabled in iOS Settings --> Apps --> Safari --> Advanced --> Features.
@@ -85,7 +86,13 @@ cameras:
 
 ### Registration
 
-Once notifications are enabled, press the `Register for Notifications` button on all devices that you would like to receive notifications on. This will register the background worker. After this Frigate must be restarted and then notifications will begin to be sent.
+Once notifications are enabled, press the `Register This Device` button on all devices that you would like to receive notifications on. This will register the background worker. After this Frigate must be restarted and then notifications will begin to be sent.
+
+:::warning
+
+Each registration is attached to the Frigate user account you are signed in as, so you must register over a secure connection to the authenticated port (`8971`). Reverse proxies and tunnels should point at port `8971`.
+
+:::
 
 ## Supported Notifications
 
@@ -104,3 +111,62 @@ Different platforms handle notifications differently, some settings changes may
 ### Android
 
 Most Android phones have battery optimization settings. To get reliable Notification delivery the browser (Chrome, Firefox) should have battery optimizations disabled. If Frigate is running as a PWA then the Frigate app should have battery optimizations disabled as well.
+
+## Notifications FAQ
+
+<FaqItem id="how-do-i-debug-notifications-issues" question="How do I debug notifications issues?">
+
+Push notifications involve Frigate, your browser, and your browser vendor's push service, so it helps to work from the server outward.
+
+1. Enable debug logs for the push client by adding `frigate.comms.webpush: debug` to your `logger` configuration. Restart Frigate after this change.
+
+   ```yaml
+   logger:
+     default: info
+     logs:
+       # highlight-next-line
+       frigate.comms.webpush: debug
+   ```
+
+   These logs show exactly where a notification stopped, including:
+   - `Email must be provided for push notifications to be sent` means the global `email` field is empty and nothing will ever be sent.
+   - `Sending test notification` and `Sending push notification for <camera>, review ID <id>` mean Frigate handed the message off to the push service.
+   - `Skipping notification for <camera> - in global cooldown period` (or `camera-specific cooldown period`) means your [cooldown](#configuration) values suppressed it.
+   - `Notifications for <camera> are currently suspended` means notifications were suspended from <NavPath path="Settings > Notifications" /> or MQTT.
+   - `Notification endpoint expired for <user>, received 410` means that device's subscription is no longer valid and it must be re-registered.
+   - `Failed to send notification to <user> :: <status>` means the push service rejected the message. A `401` or `403` usually points at a VAPID or `email` problem, and a `5xx` is a problem on the push service's end.
+   - If you see no messages at all when an alert occurs, the notification was never queued. Confirm an actual **alert** was created (notifications are not sent for detections), and that notifications are enabled both globally and for that camera.
+
+2. Verify the basics that most reports come down to:
+   - Frigate must be reached over `https` with a certificate your device trusts. Browsers silently refuse to register a service worker otherwise, and a self-signed certificate that is not installed as trusted on the device will fail.
+   - On iOS, notifications only work when Frigate has been installed to the Home Screen via **Share > Add to Home Screen** and opened from that icon. Safari and Chrome tabs cannot receive web push on iOS.
+   - Each device must be registered individually, and Frigate must be restarted after registering before anything can be sent, including test notifications.
+   - The Frigate server needs outbound internet access to the browser vendor's push service. See [Network Requirements](/frigate/network_requirements#push-notifications).
+
+3. Test from the UI. Use the `Send a test notification` button in <NavPath path="Settings > Notifications" />. If the log shows `Sending test notification` but nothing arrives on the device, the problem is between the push service and your device rather than in Frigate.
+
+4. Check the browser side on the device that is not receiving notifications:
+   - Confirm the site's notification permission is set to **Allow** in your browser or OS settings, and that a focus/do not disturb mode is not hiding them.
+   - In desktop browsers, open Developer Tools > Application > Service Workers and confirm `notifications-worker.js` is registered and activated. Unregistering it and registering the device again will rebuild a broken subscription.
+   - Check the browser console and your reverse proxy logs for failures loading `/notifications-worker.js` or errors on `/api/notifications/register`.
+
+</FaqItem>
+
+<FaqItem id="why-did-notifications-stop-arriving-after-working-for-a-while" question="Why did notifications stop arriving after working for a while?">
+
+Push subscriptions are issued by the browser vendor and can be revoked, most often after a browser update, after clearing site data, or when a device has been offline for an extended period. When this happens the device still appears registered in Frigate, but the push service rejects the message. The debug logs will show `Notification endpoint expired` with a `404` or `410` status.
+
+Unregister and re-register the affected device from <NavPath path="Settings > Notifications" />, then restart Frigate.
+
+</FaqItem>
+
+<FaqItem id="why-am-i-not-getting-notifications-for-one-specific-camera" question="Why am I not getting notifications for one specific camera?">
+
+Work through these in order:
+
+- Notifications are only sent for **alerts**. If the camera is producing detections instead, adjust the camera's `review > alerts > labels` so the objects you care about are classified as alerts.
+- Confirm notifications are enabled for that camera in <NavPath path="Settings > Camera configuration > Notifications" />.
+- Check the camera's `cooldown` value, and remember that the global cooldown applies across all cameras. A busy camera can consume the global cooldown and suppress a quieter one.
+- If [authentication](/configuration/authentication) is enabled with roles, users only receive notifications for the cameras their role grants access to.
+
+</FaqItem>

docs/docs/configuration/object_filters.md

@@ -45,10 +45,10 @@ Any detection below `min_score` will be immediately thrown out and never tracked
 
 Navigate to <NavPath path="Settings > Global configuration > Objects" /> to set score filters globally.
 
-| Field                                   | Description                                                      |
-| --------------------------------------- | ---------------------------------------------------------------- |
-| **Object filters > Person > Min Score** | Minimum score for a single detection to initiate tracking        |
-| **Object filters > Person > Threshold** | Minimum computed (median) score to be considered a true positive |
+| Field                                              | Description                                                      |
+| -------------------------------------------------- | ---------------------------------------------------------------- |
+| **Object filters > Person > Minimum confidence**   | Minimum score for a single detection to initiate tracking        |
+| **Object filters > Person > Confidence threshold** | Minimum computed (median) score to be considered a true positive |
 
 To override score filters for a specific camera, navigate to <NavPath path="Settings > Camera configuration > Objects" /> and select the camera.
 
@@ -103,12 +103,12 @@ Conceptually, a ratio of 1 is a square, 0.5 is a "tall skinny" box, and 2 is a "
 
 Navigate to <NavPath path="Settings > Global configuration > Objects" /> to set shape filters globally.
 
-| Field                                   | Description                                                              |
-| --------------------------------------- | ------------------------------------------------------------------------ |
-| **Object filters > Person > Min Area**  | Minimum bounding box area in pixels (or decimal for percentage of frame) |
-| **Object filters > Person > Max Area**  | Maximum bounding box area in pixels (or decimal for percentage of frame) |
-| **Object filters > Person > Min Ratio** | Minimum width/height ratio of the bounding box                           |
-| **Object filters > Person > Max Ratio** | Maximum width/height ratio of the bounding box                           |
+| Field                                              | Description                                                              |
+| -------------------------------------------------- | ------------------------------------------------------------------------ |
+| **Object filters > Person > Minimum object area**  | Minimum bounding box area in pixels (or decimal for percentage of frame) |
+| **Object filters > Person > Maximum object area**  | Maximum bounding box area in pixels (or decimal for percentage of frame) |
+| **Object filters > Person > Minimum aspect ratio** | Minimum width/height ratio of the bounding box                           |
+| **Object filters > Person > Maximum aspect ratio** | Maximum width/height ratio of the bounding box                           |
 
 To override shape filters for a specific camera, navigate to <NavPath path="Settings > Camera configuration > Objects" /> and select the camera.
 

docs/docs/configuration/objects.md

@@ -70,14 +70,14 @@ Object filters help reduce false positives by constraining the size, shape, and
 
 Navigate to <NavPath path="Settings > Global configuration > Objects" />.
 
-| Field                                   | Description                                                              |
-| --------------------------------------- | ------------------------------------------------------------------------ |
-| **Object filters > Person > Min Area**  | Minimum bounding box area in pixels (or decimal for percentage of frame) |
-| **Object filters > Person > Max Area**  | Maximum bounding box area in pixels (or decimal for percentage of frame) |
-| **Object filters > Person > Min Ratio** | Minimum width/height ratio of the bounding box                           |
-| **Object filters > Person > Max Ratio** | Maximum width/height ratio of the bounding box                           |
-| **Object filters > Person > Min Score** | Minimum score for the object to initiate tracking                        |
-| **Object filters > Person > Threshold** | Minimum computed score to be considered a true positive                  |
+| Field                                              | Description                                                              |
+| -------------------------------------------------- | ------------------------------------------------------------------------ |
+| **Object filters > Person > Minimum object area**  | Minimum bounding box area in pixels (or decimal for percentage of frame) |
+| **Object filters > Person > Maximum object area**  | Maximum bounding box area in pixels (or decimal for percentage of frame) |
+| **Object filters > Person > Minimum aspect ratio** | Minimum width/height ratio of the bounding box                           |
+| **Object filters > Person > Maximum aspect ratio** | Maximum width/height ratio of the bounding box                           |
+| **Object filters > Person > Minimum confidence**   | Minimum score for the object to initiate tracking                        |
+| **Object filters > Person > Confidence threshold** | Minimum computed score to be considered a true positive                  |
 
 To override filters for a specific camera, navigate to <NavPath path="Settings > Camera configuration > Objects" />.
 

docs/docs/configuration/profiles.md

@@ -191,14 +191,12 @@ cameras:
     detect:
       enabled: false
     record:
-      enabled: false
+      enabled: true
     profiles:
       away:
         enabled: true
         detect:
           enabled: true
-        record:
-          enabled: true
       home:
         enabled: false
 ```
@@ -251,6 +249,12 @@ Leaving the `objects` section empty (or omitting `track`) does not clear the lis
 
 Fields that require a Frigate restart to take effect cannot be overridden by profiles, since profiles are applied at runtime without restarting. Those fields are hidden when editing a profile override and can only be changed on the base configuration.
 
+### Why can't a profile enable recording when it's disabled in the base config?
+
+Frigate only sets up a camera's recording stream at startup when recording is enabled in the base config, so enabling it later from a profile has no effect. The same applies to turning recording on from the UI or MQTT.
+
+To keep recording off by default, leave `record.enabled: true` in the base config and create a profile that sets `record.enabled: false`. Activate that profile and it will be restored automatically when Frigate starts.
+
 ### Can I schedule profiles to be enabled or disabled at certain times?
 
 Not within Frigate itself. Frigate is an NVR, not an automation platform, so it intentionally does not include a scheduler for activating profiles. Instead, activate profiles from an automation platform that already handles time- and event-based triggers well, such as [Home Assistant](https://www.home-assistant.io/) or [Node-RED](https://nodered.org/). These integrate with Frigate and give you far more robust and flexible scheduling than a built-in scheduler could.

docs/docs/configuration/record.md

@@ -9,7 +9,7 @@ import NavPath from "@site/src/components/NavPath";
 
 Recordings can be enabled and are stored at `/media/frigate/recordings`. The folder structure for the recordings is `YYYY-MM-DD/HH/<camera_name>/MM.SS.mp4` in **UTC time**. These recordings are written directly from your camera stream without re-encoding. Each camera supports a configurable retention policy. Frigate chooses the largest matching retention value between the recording retention and the tracked object retention when determining if a recording should be removed.
 
-New recording segments are written from the camera stream to cache, they are only moved to disk if they match the setup recording retention policy.
+New recording segments are written from the camera stream to cache, they are only moved to disk if they pass a validation check and match the setup recording retention policy.
 
 :::tip
 
@@ -291,7 +291,7 @@ For advanced use cases, the [custom export HTTP API](../integrations/api/export-
 POST /export/custom/{camera_name}/start/{start_time}/end/{end_time}
 ```
 
-The request body accepts `ffmpeg_input_args` and `ffmpeg_output_args` to control encoding, frame rate, filters, and other FFmpeg options. If neither is provided, Frigate defaults to time-lapse output settings (25x speed, 30 FPS).
+The request body accepts `ffmpeg_input_args` and `ffmpeg_output_args` to control encoding, frame rate, filters, and other FFmpeg options. If neither is provided, Frigate defaults to time-lapse output settings (25x speed, 30 FPS) with audio removed (`-an`). When providing your own `ffmpeg_input_args`, include `-an` if you want audio stripped from the export.
 
 The following example exports a time-lapse at 60x speed with 25 FPS:
 

docs/docs/configuration/restream.md

@@ -197,7 +197,7 @@ For cameras that support two-way talk, go2rtc will automatically establish an au
 To prevent this, you must configure two separate stream instances:
 
 1. One stream instance with `#backchannel=0` for Frigate's viewing, recording, and detection (prevents go2rtc from establishing the blocking backchannel)
-2. A second stream instance without `#backchannel=0` for two-way talk functionality (can be used by Frigate's WebRTC viewer or other applications)
+2. A second stream instance with no `#` parameters at all for two-way talk functionality (can be used by Frigate's WebRTC viewer or other applications)
 
 Configuration example:
 
@@ -215,6 +215,8 @@ In this configuration:
 - `front_door` stream is used by Frigate for viewing, recording, and detection. The `#backchannel=0` parameter prevents go2rtc from establishing the audio output backchannel, so it won't block two-way talk access.
 - `front_door_twoway` stream is used for two-way talk functionality. This stream can be used by Frigate's WebRTC viewer when two-way talk is enabled, or by other applications (like Home Assistant Advanced Camera Card) that need access to the camera's audio output channel.
 
+Any `#` parameter on a bare `rtsp://` source disables the backchannel unless the URL explicitly contains `#backchannel=1`. A two-way talk stream with something like `#video=h264` on it silently loses two-way audio, and Frigate will report that two-way talk is unavailable for that stream.
+
 ## Security: Restricted Stream Sources
 
 For security reasons, the `echo:`, `expr:`, and `exec:` stream sources are disabled by default in go2rtc. These sources allow arbitrary command execution and can pose security risks if misconfigured.

docs/docs/configuration/review.md

@@ -121,6 +121,31 @@ cameras:
 </TabItem>
 </ConfigTabs>
 
+## Categorizing manual events
+
+Events created with the [create manual event API](../integrations/api/create-event-events-camera-name-label-create-post.api.mdx) are categorized with the same label lists, using the label from the request path:
+
+1. If alerts are enabled and the label is listed in `review -> alerts -> labels`, the review item is an alert.
+2. Otherwise, if detections are enabled and the label is listed in `review -> detections -> labels`, the review item is a detection.
+3. If the label is in neither list, the review item is an alert, or no review item is created if alerts are disabled.
+
+This means manual events are alerts unless you explicitly list their label as a detection label. For example, to have PIR sensors create detections instead of alerts, post to `/api/events/front_door/pir_sensor/create` with the following config:
+
+```yaml {5-7}
+cameras:
+  front_door:
+    review:
+      detections:
+        labels:
+          - pir_sensor
+```
+
+:::note
+
+Required zones do not apply to manual events, since they are created through the API rather than by the object tracker. Setting `review -> alerts -> labels` to an empty list also does not stop manual events from becoming alerts, as a label in neither list still falls back to an alert.
+
+:::
+
 ## Restricting review items to specific zones
 
 By default a review item will be created if any `review -> alerts -> labels` and `review -> detections -> labels` are detected anywhere in the camera frame. You will likely want to configure review items to only be created when the object enters an area of interest, [see the zone docs for more information](./zones.md#restricting-alerts-and-detections-to-specific-zones)

docs/docs/configuration/semantic_search.md

@@ -245,8 +245,8 @@ Triggers are best configured through the Frigate UI.
 1. Navigate to <NavPath path="Settings > Enrichments > Triggers" /> and select a camera from the dropdown menu.
 2. Click **Add Trigger** to create a new trigger or use the pencil icon to edit an existing one.
 3. In the **Create Trigger** wizard:
-   - Enter a **Name** for the trigger (e.g., "Red Car Alert").
-   - Enter a descriptive **Friendly Name** for the trigger (e.g., "Red car on the driveway camera").
+   - Enter a **Name** for the trigger (e.g., "Red Car Alert"). Frigate derives the trigger's
+     internal **ID** from this name, which can be revealed and edited with the show/hide toggle.
    - Select the **Type** (`Thumbnail` or `Description`).
    - For `Thumbnail`, select an image to trigger this action when a similar thumbnail image is detected, based on the threshold.
    - For `Description`, enter text to trigger this action when a similar tracked object description is detected.

docs/docs/configuration/zones.md

@@ -28,7 +28,7 @@ During testing, enable the Zones option for the [Debug view](/usage/live#the-sin
 1. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> and select the desired camera.
 2. Under the **Zones** section, click the plus icon to add a new zone.
 3. Click on the camera's latest image to create the points for the zone boundary. Click the first point again to close the polygon.
-4. Configure zone options such as **Friendly name**, **Objects**, **Loitering time**, and **Inertia** in the zone editor.
+4. Configure zone options such as **Name**, **Objects**, **Loitering Time**, and **Inertia** in the zone editor.
 5. Press **Save** when finished.
 
 </TabItem>
@@ -200,7 +200,7 @@ When using loitering zones, a review item will behave in the following way:
 
 1. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> and select the desired camera.
 2. Edit or create the zone (e.g., `sidewalk`).
-   - Set **Loitering time** to the desired number of seconds (e.g., `4`)
+   - Set **Loitering Time** to the desired number of seconds (e.g., `4`)
    - Under **Objects**, add the relevant object types (e.g., `person`)
 
 </TabItem>
@@ -291,7 +291,7 @@ Accurate real-world distance measurements are required to estimate speeds. These
 
 1. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> and select the desired camera.
 2. Create or edit a zone with exactly 4 points aligned to the ground plane.
-3. In the zone editor, enter the real-world **Distances** between each pair of consecutive points.
+3. In the zone editor, enable **Speed Estimation** and enter the real-world **Line A distance**, **Line B distance**, **Line C distance**, and **Line D distance** between each pair of consecutive points.
    - For example, if the distance between the first and second points is 10 meters, between the second and third is 12 meters, etc.
 4. Distances are measured in meters (metric) or feet (imperial), depending on the **Unit system** setting.
 
@@ -358,7 +358,7 @@ Zones can be configured with a minimum speed requirement, meaning an object must
 
 1. Navigate to <NavPath path="Settings > Camera configuration > Masks / Zones" /> and select the desired camera.
 2. Edit or create the zone with distances configured.
-   - Set **Speed threshold** to the desired minimum speed (e.g., `20`)
+   - Set **Speed Threshold** to the desired minimum speed (e.g., `20`)
    - The unit is kph or mph, depending on the **Unit system** setting
 
 </TabItem>

docs/docs/frigate/glossary.md

@@ -54,7 +54,7 @@ An object filter mask drops any [bounding box](#bounding-box) whose bottom cente
 
 ## Min Score
 
-The lowest score a detected object can have to be kept during tracking. Anything scoring below the minimum is assumed to be a [false positive](#false-positive) and discarded.
+The lowest score a detected object can have to be kept during tracking. Anything scoring below the minimum is assumed to be a [false positive](#false-positive) and discarded. Set with `min_score` in the config, shown as **Minimum confidence** in the settings UI.
 
 ## Model
 
@@ -86,7 +86,7 @@ A more specific identity assigned to a [tracked object](#tracked-object-event-in
 
 ## Threshold
 
-The median score an object must reach to be considered a true positive.
+The median score an object must reach to be considered a true positive. Set with `threshold` in the config, shown as **Confidence threshold** in the settings UI.
 
 ## Top Score
 

docs/docs/integrations/mqtt.md

@@ -11,6 +11,12 @@ MQTT requires a network connection to your broker. This is typically local, but
 
 :::
 
+:::note
+
+Wherever a topic below includes a camera, mask, or zone name, use its `ID` from the config, not its `friendly_name`. For example, a camera with `friendly_name: "Back Yard"` and ID `back_yard` publishes to `frigate/back_yard/...`, not `frigate/Back Yard/...`.
+
+:::
+
 ## General Frigate Topics
 
 ### `frigate/available`
@@ -292,7 +298,9 @@ Topic with the currently active profile name. Published value is the profile nam
 
 ### `frigate/notifications/set`
 
-Topic to turn notifications on and off. Expected values are `ON` and `OFF`.
+Topic to turn notifications on and off for all cameras. Expected values are `ON` and `OFF`.
+
+Only available when notifications are enabled in the config. Not persisted across Frigate restarts.
 
 ### `frigate/notifications/state`
 
@@ -308,6 +316,8 @@ Publishes the current health status of each role that is enabled (`audio`, `dete
 - `offline`: Stream is offline and is being restarted
 - `disabled`: Camera is currently turned off (either at runtime via the `enabled/set` topic, or persistently via the configuration file). See [Camera state](/configuration/live#camera-state) for the distinction.
 
+These reflect the state of Frigate's process for that role, not the camera's reachability, so an unreachable camera alternates between `offline` and `online` as the watchdog restarts ffmpeg. Wait for the status to hold steady (for example with Home Assistant's `for:`) rather than acting on a single message.
+
 ### `frigate/<camera_name>/<object_name>`
 
 Publishes the count of objects for the camera for use as a sensor in Home Assistant.
@@ -568,16 +578,20 @@ Topic with current state of the Birdseye mode for a camera. Published values are
 
 ### `frigate/<camera_name>/notifications/set`
 
-Topic to turn notifications on and off. Expected values are `ON` and `OFF`.
+Topic to turn notifications for a camera on and off. Expected values are `ON` and `OFF`.
+
+`ON` is ignored unless notifications are enabled in the config for the camera. This is not persisted across Frigate restarts. It is the same control the UI labels **Suspend until restart**.
 
 ### `frigate/<camera_name>/notifications/state`
 
-Topic with current state of notifications. Published values are `ON` and `OFF`.
+Topic with current state of notifications. Published values are `ON` and `OFF`. This is the authoritative topic for whether a camera will notify.
 
 ### `frigate/<camera_name>/notifications/suspend`
 
-Topic to suspend notifications for a certain number of minutes. Expected value is an integer.
+Topic to suspend notifications for a certain number of minutes. Expected value is an integer. Separate from `notifications/set`: it does not change `notifications/state`, and is ignored while notifications are off.
 
 ### `frigate/<camera_name>/notifications/suspended`
 
-Topic with timestamp that notifications are suspended until. Published value is a UNIX timestamp, or 0 if notifications are not suspended.
+Topic with timestamp that notifications are suspended until. Published value is a UNIX timestamp, or 0 if there is no timed suspension.
+
+`0` does not mean notifications are enabled: `notifications/set` `OFF` clears the timed suspension, so this publishes `0` while `notifications/state` is `OFF`.

docs/docs/plus/faq.md

@@ -21,7 +21,13 @@ Yes. Models and metadata are stored in the `model_cache` directory within the co
 
 ### Can I keep using my Frigate+ models even if I do not renew my subscription?
 
-Yes. Subscriptions to Frigate+ provide access to the infrastructure used to train the models. Models trained with your subscription are yours to keep and use forever. However, do note that the terms and conditions prohibit you from sharing, reselling, or creating derivative products from the models.
+Yes. Subscriptions to Frigate+ provide access to the infrastructure used to train the models. Models you train during an active subscription remain licensed for your continued use even after your subscription ends — models already in your model cache will keep working indefinitely. An active subscription is required to train new models and download new versions.
+
+### Can I use Frigate+ models commercially?
+
+A standard subscription covers use on camera systems you own or operate, including for your business. A shop, restaurant, warehouse, or office running Frigate+ at its own locations (including multiple locations) is exactly the kind of use the subscription is for.
+What the standard subscription does not cover is using Frigate+ models to provide a product or service to others. If you're deploying models at your customers' sites, bundling them with hardware you sell, or running them as part of a hosted or managed service, even if your customers never receive the model files themselves, you'll need a commercial license.
+Note that professional installers are fine under standard subscriptions when each customer holds their own Frigate+ subscription. The commercial license is for cases where your license powers your customers' sites.
 
 ### Why can't I submit images to Frigate+?
 

docs/docs/plus/first_model.md

@@ -64,20 +64,20 @@ Frigate+ models generally have much higher scores than the default model provide
 <ConfigTabs>
 <TabItem value="ui">
 
-Navigate to <NavPath path="Settings > Global configuration > Objects" />. Under **Object filters**, set **Min Score** and **Threshold** for each object type, then click **Save**.
+Navigate to <NavPath path="Settings > Global configuration > Objects" />. Under **Object filters**, set **Minimum confidence** and **Confidence threshold** for each object type, then click **Save**.
 
-| Object            | Min Score | Threshold |
-| ----------------- | --------- | --------- |
-| **dog**           | .7        | .9        |
-| **cat**           | .65       | .8        |
-| **face**          | .7        |           |
-| **package**       | .65       | .9        |
-| **license_plate** | .6        |           |
-| **amazon**        | .75       |           |
-| **ups**           | .75       |           |
-| **fedex**         | .75       |           |
-| **person**        | .65       | .85       |
-| **car**           | .65       | .85       |
+| Object            | Minimum confidence | Confidence threshold |
+| ----------------- | ------------------ | -------------------- |
+| **dog**           | .7                 | .9                   |
+| **cat**           | .65                | .8                   |
+| **face**          | .7                 |                      |
+| **package**       | .65                | .9                   |
+| **license_plate** | .6                 |                      |
+| **amazon**        | .75                |                      |
+| **ups**           | .75                |                      |
+| **fedex**         | .75                |                      |
+| **person**        | .65                | .85                  |
+| **car**           | .65                | .85                  |
 
 </TabItem>
 <TabItem value="yaml">

docs/docs/plus/index.md

@@ -65,11 +65,11 @@ Some users may find that Frigate+ models result in more false positives initiall
 
 Frigate+ models support a more relevant set of objects for security cameras. The labels for annotation in Frigate+ are configurable by editing the camera in the Cameras section of Frigate+. Currently, the following objects are supported:
 
-- **People**: `person`, `face`
-- **Vehicles**: `car`, `motorcycle`, `bicycle`, `boat`, `school_bus`, `license_plate`
+- **People**: `person`, `face`, `baby`
+- **Vehicles**: `car`, `motorcycle`, `bicycle`, `boat`, `school_bus`, `garbage truck`, `license_plate`
 - **Delivery Logos**: `amazon`, `usps`, `ups`, `fedex`, `dhl`, `an_post`, `purolator`, `postnl`, `nzpost`, `postnord`, `gls`, `dpd`, `canada_post`, `royal_mail`
-- **Animals**: `dog`, `cat`, `deer`, `horse`, `bird`, `raccoon`, `fox`, `bear`, `cow`, `squirrel`, `goat`, `rabbit`, `skunk`, `kangaroo`
-- **Other**: `package`, `waste_bin`, `bbq_grill`, `robot_lawnmower`, `umbrella`
+- **Animals**: `dog`, `cat`, `deer`, `horse`, `bird`, `raccoon`, `fox`, `bear`, `cow`, `squirrel`, `goat`, `rabbit`, `skunk`, `kangaroo`, `possum`, `rodent`
+- **Other**: `package`, `waste_bin`, `bbq_grill`, `robot_lawnmower`, `umbrella`, `baby_stroller`
 
 Other object types available in the default Frigate model are not available. Additional object types will be added in future releases.
 
@@ -77,9 +77,12 @@ Other object types available in the default Frigate model are not available. Add
 
 Candidate labels are also available for annotation. These labels don't have enough data to be included in the model yet, but using them will help add support sooner. You can enable these labels by editing the camera settings.
 
-Where possible, these labels are mapped to existing labels during training. For example, any `baby` labels are mapped to `person` until support for new labels is added.
+Where possible, these labels are mapped to existing labels during training. For example, any `duck` labels are mapped to `bird` until support for new labels is added.
 
-The candidate labels are: `baby`, `bpost`, `badger`, `possum`, `rodent`, `chicken`, `groundhog`, `boar`, `hedgehog`, `tractor`, `golf cart`, `garbage truck`, `bus`, `sports ball`, `la_poste`, `lawnmower`, `heron`, `rickshaw`, `wombat`, `auspost`, `aramex`, `bobcat`, `mustelid`, `transoflex`, `airplane`, `drone`, `mountain_lion`, `crocodile`, `turkey`, `baby_stroller`, `monkey`, `coyote`, `porcupine`, `parcelforce`, `sheep`, `snake`, `helicopter`, `lizard`, `duck`, `hermes`, `cargus`, `fan_courier`, `sameday`
+- **Vehicles**: `tractor`, `golf_cart`, `bus`, `airplane`, `helicopter`, `rickshaw`, `scooter`
+- **Delivery Logos**: `bpost`, `auspost`, `aramex`, `transoflex`, `parcelforce`, `hermes`, `cargus`, `fan_courier`, `sameday`, `la_poste`
+- **Animals**: `badger`, `chicken`, `duck`, `turkey`, `groundhog`, `boar`, `hedgehog`, `wombat`, `bobcat`, `mustelid`, `mountain_lion`, `crocodile`, `monkey`, `coyote`, `porcupine`, `sheep`, `snake`, `lizard`, `heron`, `elk`, `moose`, `pig`, `donkey`, `civet`
+- **Other**: `sports_ball`, `drone`, `lawnmower`
 
 Candidate labels are not available for automatic suggestions.
 

docs/docs/troubleshooting/common_errors.md

@@ -66,17 +66,19 @@ An FFmpeg message meaning it probed the stream but never saw enough decodable vi
 
 ## Recording
 
-<FaqItem id="no-new-recording-segments" question="No new recording segments were created for <camera> in the last 120s">
+<FaqItem id="no-new-recording-segments" question="No new recording segments were created (or: No new valid recording segments were created / No valid segments created since last invalid segment) for <camera> in the last 120s">
 
-Frigate's record watchdog is restarting the record FFmpeg process because no valid segment has reached the cache. This means the record stream is not connecting or the segments are being rejected (see the audio-codec entry below).
+Frigate's record watchdog is restarting the record FFmpeg process because the camera stopped producing usable recordings. The wording distinguishes the cases: `No new recording segments` means no new segment file reached the cache, so ffmpeg isn't getting video out of the record stream; the two `valid` variants mean recordings are arriving but keep failing validation. Either way the fault is on the camera or network side, and the restart is Frigate trying to recover.
 
-See [Recordings: the record stream isn't connecting](/troubleshooting/recordings#the-record-stream-isnt-connecting).
+See [Recordings: no new recording segments were created](/troubleshooting/recordings#no-new-recording-segments-were-created).
 
 </FaqItem>
 
-<FaqItem id="invalid-or-missing-video-stream-in-segment" question="Invalid or missing video stream in segment. Discarding.">
+<FaqItem id="invalid-or-missing-video-stream-in-segment" question="Invalid or missing video stream in segment. Discarding. / Discarding a corrupt recording segment / Failed to probe corrupt segment / Invalid recording segment detected">
 
-A cached recording segment failed validation (no readable video stream) and was deleted. The most common cause is a segment that was truncated because the record FFmpeg process was killed mid-write, so this often appears alongside, and as a consequence of, the record-stream restarts above. A segment containing only audio triggers it too.
+A cached recording segment failed validation and was deleted, either because it had no readable video stream or because its length was impossible. This nearly always means the camera stopped sending usable video partway through the segment: a camera that rebooted, dropped the connection, or ran out of simultaneous connections, or an unreliable link such as WiFi or a failing switch port. Broken camera timestamps (a "Smart Codec" / H.264+ mode) cause the corrupt-segment variants. The same stream failure trips the record watchdog, so the restarts above usually appear alongside these messages.
+
+See [Recordings: invalid or missing video stream in segment](/troubleshooting/recordings#invalid-or-missing-video-stream-in-segment).
 
 </FaqItem>
 

docs/docs/troubleshooting/cpu.md

@@ -3,7 +3,31 @@ id: cpu
 title: High CPU Usage
 ---
 
-High CPU usage can impact Frigate's performance and responsiveness. This guide outlines the most effective configuration changes to help reduce CPU consumption and optimize resource usage.
+High CPU usage can impact Frigate's performance and responsiveness. This guide explains how to interpret the CPU values Frigate reports and outlines the most effective configuration changes to help reduce CPU consumption and optimize resource usage.
+
+## Understanding Frigate's Reported CPU Usage
+
+Frigate's CPU percentages often look much higher than what the host reports. Usually both numbers are correct and are simply measured against different denominators, so confirm you actually have a problem before tuning anything.
+
+### Per-process values are relative to a single core
+
+The values Frigate reports for FFmpeg, capture, detect, detector, and other processes follow the same convention as `top`: 100% means one CPU core is fully saturated, not that the whole system is saturated. A multithreaded process such as FFmpeg can legitimately report well over 100%.
+
+Host and hypervisor tools instead report a percentage of the machine's total capacity across all cores. This includes `docker stats`, the `htop` summary, the Proxmox summary graph, the Unraid dashboard, Synology Resource Monitor, and Home Assistant's system monitor sensors. To reconcile the two:
+
+```
+host percentage ≈ (sum of Frigate's process percentages) / (number of cores)
+```
+
+On a 4 core system, an FFmpeg process reporting 100% is consuming one quarter of the machine, so the host will show roughly 25 to 30% once the remaining Frigate processes are included. That same 100% on a 16 core system is about 6%. Frigate's own warning thresholds use the per-core convention as well, so an FFmpeg process is flagged at 20% of a single core, not 20% of the system.
+
+### Instantaneous samples and averages measure different things
+
+Frigate collects stats every 15 seconds, and the `cpu` value covers only the interval since the previous collection. The `cpu_average` value in the stats API and MQTT payload is the average across the entire life of the process, and it is what the high CPU usage warnings are based on. Host dashboards generally plot data averaged over a longer window, so a single Frigate sample can show a peak that a host graph never displays. A process that has just started, such as FFmpeg after a camera reconnect, reports 0 until it has been sampled twice.
+
+### The system-wide value depends on what the container can see
+
+The system CPU value is read from `/proc/stat`. Under Docker that file belongs to the host, so the value covers the entire machine including workloads unrelated to Frigate, and it will not match `docker stats` for the Frigate container. Under an LXC container, lxcfs virtualizes `/proc/stat` and the value reflects only the cores assigned to the container. In a virtual machine, the guest sees only its assigned vCPUs while the hypervisor divides by every physical thread on the node, so guest and host percentages will not agree even when both are accurate.
 
 ## 1. Hardware Acceleration for Video Decoding
 
@@ -72,3 +96,19 @@ The model you use significantly impacts detector performance. Frigate provides d
 - Larger models (640x640): Slower inference, can sometimes have higher accuracy on very large objects that take up a majority of the frame.
 
 For more detail on picking the right size, see [Choosing a model size](../configuration/object_detectors.md#choosing-a-model-size).
+
+## 3. Reducing Detector CPU Usage
+
+**Priority: High**
+
+The **Detector CPU Usage** metric measures the CPU spent converting frames into the tensor format the model expects and post-processing the model's output. It does not include inference, so this value can be high even when you've configured a GPU, NPU, or Coral for object detection.
+
+This metric scales with how many detections per second Frigate runs and how expensive each one is to prepare. Tuning [motion detection](../configuration/motion_detection) is usually the first recommendation to reduce the number of detections. Additionally, you can:
+
+- **Lower `detect -> fps`.** 5 is the recommended value for nearly all cameras. Running at 10 doubles the frames eligible for detection and is one of the largest contributors to this metric.
+- **Use a 320x320 model.** A 640x640 model has 4 times as many pixels to transpose, convert, and copy on every inference.
+- **Prefer a model that takes integer input.** Models configured with `input_dtype: float` require each frame to be converted to float32 and normalized on the CPU first. Models taking `int` input, such as the tflite models used by the Edge TPU, skip that step.
+- **Do not match the detect resolution to the model resolution.** The detect stream should match your camera's aspect ratio, for example `1280x720`, not the model's input size. Frigate crops and scales regions of motion itself, so an oversized detect stream only adds work.
+- **Tune stationary object behavior.** Objects that never settle into a stationary state are re-detected continuously. Raising `detect -> stationary -> interval` reduces how often detection runs on objects that are already parked. See [stationary objects](../configuration/stationary_objects).
+
+Adding [more detector instances](#multiple-detector-instances) spreads this work across more CPU cores, but does not reduce the total CPU used.

docs/docs/troubleshooting/faqs.md

@@ -39,6 +39,20 @@ To do this efficiently the following setup is required:
 
 When this is done correctly, the GPU will do the decoding and scaling which will result in a small increase in CPU usage but with better results.
 
+### How can I rotate my camera's video feed?
+
+Rotation is best done in the camera's firmware settings (usually called rotate, flip, or corridor mode) so the video arrives already rotated and no extra processing is needed. Check there first.
+
+If your camera does not support rotation, go2rtc's ffmpeg module can rotate the stream with the `#rotate` parameter (`90`, `180`, `270`, or `-90`), but this is not recommended: rotation requires transcoding (re-encoding) the video, which significantly increases CPU usage, especially for high resolution streams.
+
+```yaml
+go2rtc:
+  streams:
+    my_camera: "ffmpeg:rtsp://user:password@192.168.1.10:554/stream#video=h264#hardware#rotate=90"
+```
+
+Point the camera's inputs at the restream as described in the [restream docs](/configuration/restream.md), and swap `detect -> width` and `detect -> height` to match the rotated resolution.
+
 ### My mjpeg stream or snapshots look green and crazy
 
 This almost always means that the width/height defined for your camera are not correct. Double check the resolution with VLC or another player. Also make sure you don't have the width and height values backwards.
@@ -65,9 +79,17 @@ This is because Frigate does not run in host mode so localhost points to the Fri
 
 ### How do I know if my camera is offline
 
-A camera being offline can be detected via MQTT or /api/stats, the camera_fps for any offline camera will be 0.
+Frigate publishes a per-role health status to [`frigate/<camera_name>/status/<role>`](/integrations/mqtt#frigatecamera_namestatusrole), where `<role>` is each enabled role on the camera (`detect`, `record`, and `audio`). The published value is one of:
 
-Also, Home Assistant will mark any offline camera as being unavailable when the camera is offline.
+- `online`: Frigate's process for that role is running normally
+- `offline`: the process is down and Frigate is restarting it
+- `disabled`: the camera is turned off, either at runtime or in the configuration file
+
+These reflect the state of Frigate's process for that role, not the camera's reachability, so an unreachable camera alternates between `offline` and `online` as the watchdog restarts ffmpeg. Wait for the status to hold steady (for example with Home Assistant's `for:`) rather than acting on a single message.
+
+Because the status is per role, a camera whose substream is fine but whose recording stream has dropped will report `online` for `detect` and `offline` for `record`. The status is republished whenever it changes.
+
+You can also detect an offline camera through `/api/stats`, where `camera_fps` will be 0.
 
 ### How can I view the Frigate log files without using the Web UI?
 
@@ -125,6 +147,12 @@ cameras:
       height: 720
 ```
 
+### What is the `version` key in my config file?
+
+`version` records the config format that your config was last migrated to. On startup Frigate compares it against the format the running version expects, and if it is older it copies your config to `/config/backup_config.yaml`, rewrites it to the new format, and updates `version` as the final step. A config with no `version` key is assumed to predate 0.14 and is migrated from there.
+
+Frigate manages this key for you, so do not set or edit it. Raising it makes Frigate skip migrations your config still needs, and lowering it re-runs migrations against config that has already been converted. Either can leave you with a config that no longer validates.
+
 ### Why does Frigate keep creating new tracked objects for my parked car?
 
 Stationary tracking is designed to _prevent_ this: a parked car should remain a single tracked object rather than generating new ones. If you're repeatedly getting new tracked objects for the same car, it's likely that Frigate is losing the object and re-detecting it as a new one.

docs/docs/troubleshooting/go2rtc.md

@@ -78,7 +78,9 @@ go2rtc:
 
 :::warning
 
-The `#`-modifiers (`#video=`, `#audio=`, `#hardware`, `#backchannel=0`, …) **only take effect on a source that is prefixed with `ffmpeg:`**. Adding them to a bare `rtsp://…#audio=opus` source does nothing: go2rtc ignores them. Likewise, when a source references another stream by name (e.g. `ffmpeg:back#audio=aac`), the name must match the stream key **exactly** (it is case sensitive), or the transcode is silently never produced. This is the single most common configuration mistake. In the Frigate UI, the **Use compatibility mode (ffmpeg)** toggle adds the `ffmpeg:` prefix for you.
+The transcoding modifiers (`#video=`, `#audio=`, `#hardware`, …) **only take effect on a source that is prefixed with `ffmpeg:`**. Adding them to a bare `rtsp://…#audio=opus` source does nothing: go2rtc ignores them. Likewise, when a source references another stream by name (e.g. `ffmpeg:back#audio=aac`), the name must match the stream key **exactly** (it is case sensitive), or the transcode is silently never produced. This is the single most common configuration mistake. In the Frigate UI, the **Use compatibility mode (ffmpeg)** toggle adds the `ffmpeg:` prefix for you.
+
+A bare `rtsp://` source reads a different set of modifiers: `#backchannel=`, `#media=`, `#timeout=`, and `#transport=`. These do nothing on an `ffmpeg:` source. Adding **any** modifier to a bare `rtsp://` source also disables the camera's backchannel unless the URL explicitly contains `#backchannel=1`, so a stream dedicated to two-way talk should carry no modifiers at all.
 
 :::
 
@@ -153,7 +155,7 @@ WebRTC is only attempted when MSE fails or when using a camera's two-way talk fe
 
 - **Codec mismatch**: WebRTC cannot carry H.265 or AAC. The stream backing the WebRTC view must provide Opus (or PCMA/PCMU) audio and H.264 video. Add an `ffmpeg:back#audio=opus` source as shown above.
 - **Port `8555` not reachable, or no candidates set**: WebRTC needs port `8555` (both TCP and UDP) open and a reachable candidate advertised. On Docker installs running on a custom/overlay network, go2rtc may advertise unreachable container IPs as ICE candidates; setting `webrtc.filters.candidates: []` and supplying only your host's LAN IP resolves this. See [WebRTC extra configuration](/configuration/live#webrtc-extra-configuration).
-- **Two-way talk** additionally requires a secure context (HTTPS or the authenticated port `8971`, because browsers block microphone access on plain HTTP). The camera's RTSP backchannel must also be handled correctly: go2rtc seizes the backchannel by default, which blocks two-way audio for other consumers and can inject static. Disable it on the primary stream with `#backchannel=0` and use a separate dedicated stream for talk, as documented in [preventing go2rtc from blocking two-way audio](/configuration/restream#two-way-talk-restream).
+- **Two-way talk** additionally requires a secure context (HTTPS or the authenticated port `8971`, because browsers block microphone access on plain HTTP). The camera's RTSP backchannel must also be handled correctly: go2rtc seizes the backchannel by default, which blocks two-way audio for other consumers and can inject static. Disable it on the primary stream with `#backchannel=0` and use a separate dedicated stream for talk, carrying no `#` modifiers of any kind, as documented in [preventing go2rtc from blocking two-way audio](/configuration/restream#two-way-talk-restream).
 
 ## High CPU usage
 

docs/docs/troubleshooting/recordings.md

@@ -209,6 +209,50 @@ If the record stream uses a "Smart Codec"/H.264+ mode or changes encoding parame
 
 </FaqItem>
 
+<FaqItem id="invalid-or-missing-video-stream-in-segment" question="I see the message: WARNING : Invalid or missing video stream in segment ... Discarding.">
+
+Every recording segment is validated before it leaves the cache. Frigate probes each finished `.mp4` in `/tmp/cache` and requires a readable video stream and a valid duration before moving to storage. A segment that fails is deleted, so those ~10 seconds of footage are lost. Three messages come from this check:
+
+- `Invalid or missing video stream in segment <path>. Discarding.` The segment holds no video, or could not be read at all.
+- `Failed to probe corrupt segment <path>` followed by `Discarding a corrupt recording segment: <path>`. The segment was read, but its length could not be determined.
+- `Discarding a corrupt recording segment: <path>` on its own. The segment's length is impossible (empty, or longer than ten minutes), which points at broken timestamps coming from the camera.
+
+For each one, the camera watchdog also logs `Invalid recording segment detected for <camera> at <timestamp>`.
+
+:::warning
+
+This is almost always a **camera or network problem**, not a Frigate one. A segment is only complete once ffmpeg has finished writing it, so anything that interrupts the stream partway through leaves behind a file that cannot be saved. Frigate is reporting the interruption, not causing it.
+
+:::
+
+#### Start with the camera and the network
+
+- **The camera dropped the connection.** Cameras reboot, reinitialize their stream when switching to night mode, and cut clients off when they are overloaded or out of simultaneous connections. Count everything pulling from the camera at once: Frigate's detect and record streams, go2rtc, a phone app, and any other NVR each use one. Routing all roles through a single [RTSP restream](/configuration/restream#reduce-connections-to-camera) so the camera only ever sees one connection often resolves this by itself.
+- **The link to the camera is unreliable.** WiFi cameras, powerline adapters, a saturated uplink, a failing switch port, or a marginal cable all produce this pattern, and usually only on one camera at a time. WiFi cameras are [not recommended](https://ipcamtalk.com/threads/multiple-cameras-high-bandwidth.77100/#post-861110).
+- **The camera cannot reliably send what it is being asked for.** A high bitrate 4K stream can be more than the camera's own hardware can encode and push out under load. Lower the bitrate, or record a lower-resolution profile.
+- **The camera is using a "Smart Codec", H.264+, or H.265+ mode.** These change encoding parameters mid-stream and produce the broken timestamps behind the corrupt-segment variant. Turn the mode off and set the camera's keyframe interval equal to its frame rate. See [Segments are only ~1 second long](#segments-are-only-1-second-long).
+
+Read the rest of the Frigate and/or go2rtc log around the **first** occurrence. When the camera or the network is at fault, other messages show up with it, such as `No frames received from <camera> in 20 seconds`, `Non-monotonic DTS`, `RTP: PT=xx: bad cseq`, `error while decoding MB`, or a connection timeout. Each of those is explained in [Common error messages](/troubleshooting/common_errors). To confirm the camera is the source, open its stream in the [go2rtc web interface](/troubleshooting/go2rtc) on port `1984` or play the same URL in VLC, and leave it running long enough for the failures to happen again.
+
+#### If the camera and network check out
+
+- **Audio the recording cannot store.** Some cameras send G.711 audio, which cannot be saved in an MP4 and stops segments from finalizing. See [Incompatible audio codec](#incompatible-audio-codec-recordings-silently-fail-to-save).
+- **Frigate itself was stopped or restarted.** A single warning per camera around a restart is expected and needs no action.
+- **The system ran out of room or memory.** A full `/tmp/cache`, or the host killing Frigate for using too much memory, cuts off the segment being written. Both leave other errors in the log alongside this one. See [No space left on device](#errno-28-no-space-left-on-device).
+
+</FaqItem>
+
+<FaqItem id="no-new-recording-segments-were-created" question="I see the message: ERROR : No new recording segments were created for <camera> in the last 120s. Restarting the ffmpeg record process...">
+
+When a camera stops producing usable recordings for two minutes, Frigate restarts that camera's record process to try to recover. The wording tells you how far the recordings got:
+
+- **`No new recording segments were created`**: no new segment file showed up in the cache at all, so ffmpeg isn't getting video out of the record stream. The camera is unreachable or refusing the connection, the stream URL, path, or credentials are wrong, or the camera accepted the connection and then sent nothing. See [The record stream isn't connecting](#the-record-stream-isnt-connecting).
+- **`No new valid recording segments were created`** and **`No valid segments created since last invalid segment`**: recordings are arriving, but they keep failing validation, so the camera is sending video that cannot be saved. See [Invalid or missing video stream in segment](#invalid-or-missing-video-stream-in-segment) above.
+
+The restart is Frigate recovering from a problem, not causing one. One of these after a camera reboot or a brief network drop is normal. Seeing them repeat every couple of minutes means the camera or the network is still failing, and the restarts can extend the damage, because each one cuts off the segment that was being written. Work from the earliest failure in that camera's log rather than from the restarts.
+
+</FaqItem>
+
 <FaqItem id="i-see-the-message-warning--unable-to-keep-up-with-recording-segments-in-cache-for-camera-keeping-the-5-most-recent-segments-out-of-6-and-discarding-the-rest" question="I see the message: WARNING : Unable to keep up with recording segments in cache for camera. Keeping the 5 most recent segments out of 6 and discarding the rest...">
 
 This warning means the recording maintainer cannot move recording segments from the RAM cache to disk fast enough. When the cache fills up, Frigate discards the oldest segments to avoid running out of memory and crashing, so you lose recorded footage. This is almost always a storage throughput or system resource problem. Work through the steps below to identify which.
@@ -353,19 +397,11 @@ dmesg | grep -i -E "gpu|drm|reset|hang"
 
 Messages like `trying reset from guc_exec_queue_timedout_job` or similar GPU reset/hang messages indicate a driver or hardware issue. Ensure your kernel and GPU drivers (especially Intel) are up to date.
 
-#### Step 6: Verify hardware acceleration configuration
-
-An incorrect `hwaccel_args` preset can cause ffmpeg to fail silently or consume excessive CPU, starving the detector of resources.
-
-- After upgrading Frigate, verify your preset matches your hardware (e.g., `preset-intel-qsv-h264` instead of the deprecated `preset-vaapi`).
-- For h265 cameras, use the corresponding h265 preset (e.g., `preset-intel-qsv-h265`).
-- Note that `hwaccel_args` are only relevant for the detect stream. Frigate does not decode the record stream.
-
-#### Step 7: Verify go2rtc stream configuration
+#### Step 6: Verify go2rtc stream configuration
 
 Ensure that the ffmpeg source names in your go2rtc configuration match the correct camera stream. A misconfigured stream name (e.g., copying a config from one camera to another without updating the stream reference) will cause the wrong stream to be used or the stream to fail entirely.
 
-#### Step 8: Check system resources
+#### Step 7: Check system resources
 
 If none of the above apply, the issue may be a general resource constraint. Monitor the following on your host:
 

docs/docusaurus.config.ts

@@ -3,6 +3,9 @@ import * as path from "node:path";
 import type { Config, PluginConfig } from "@docusaurus/types";
 import type * as OpenApiPlugin from "docusaurus-plugin-openapi-docs";
 
+// Bump when a new stable release ships
+const STABLE_VERSION = "0.18";
+
 const config: Config = {
   title: "Frigate",
   tagline: "NVR With Realtime Object Detection for IP Cameras",
@@ -23,17 +26,17 @@ const config: Config = {
     mermaid: true,
   },
   i18n: {
-    defaultLocale: 'en',
-    locales: ['en'],
+    defaultLocale: "en",
+    locales: ["en"],
     localeConfigs: {
       en: {
-        label: 'English',
-      }
+        label: "English",
+      },
     },
   },
   themeConfig: {
     announcementBar: {
-      id: 'frigate_plus',
+      id: "frigate_plus",
       content: `
         <span style="margin-right: 8px; display: inline-block; animation: pulse 2s infinite;">🚀</span>
         Get more relevant and accurate detections with Frigate+ models.
@@ -45,8 +48,8 @@ const config: Config = {
             50%       { transform: scale(1.1); }
           }
         </style>`,
-      backgroundColor: '#005f73',
-      textColor: '#e0fbfc',
+      backgroundColor: "#005f73",
+      textColor: "#e0fbfc",
       isCloseable: false,
     },
     docs: {
@@ -83,15 +86,15 @@ const config: Config = {
       },
     },
     prism: {
-      magicComments:[
+      magicComments: [
         {
-          className: 'theme-code-block-highlighted-line',
-          line: 'highlight-next-line',
-          block: {start: 'highlight-start', end: 'highlight-end'},
+          className: "theme-code-block-highlighted-line",
+          line: "highlight-next-line",
+          block: { start: "highlight-start", end: "highlight-end" },
         },
         {
-          className: 'code-block-error-line',
-          line: 'highlight-error-line',
+          className: "code-block-error-line",
+          line: "highlight-error-line",
         },
       ],
       additionalLanguages: ["bash", "json"],
@@ -131,6 +134,11 @@ const config: Config = {
         srcDark: "img/branding/logo-dark.svg",
       },
       items: [
+        {
+          href: "https://github.com/blakeblackshear/frigate/releases",
+          label: `${STABLE_VERSION}`,
+          position: "left",
+        },
         {
           to: "/",
           activeBasePath: "docs",
@@ -148,19 +156,19 @@ const config: Config = {
           position: "right",
         },
         {
-          type: 'localeDropdown',
-          position: 'right',
+          type: "localeDropdown",
+          position: "right",
           dropdownItemsAfter: [
             {
-              label: '简体中文（社区翻译）',
-              href: 'https://docs.frigate-cn.video',
-            }
-          ]
+              label: "简体中文（社区翻译）",
+              href: "https://docs.frigate-cn.video",
+            },
+          ],
         },
         {
-          href: 'https://github.com/blakeblackshear/frigate',
-          label: 'GitHub',
-          position: 'right',
+          href: "https://github.com/blakeblackshear/frigate",
+          label: "GitHub",
+          position: "right",
         },
       ],
     },

docs/static/frigate-api.yaml

@@ -1476,7 +1476,7 @@ paths:
         - Classification
       summary: Get custom classification attributes
       description: |-
-        **Access:** Admin role required.
+        **Access:** Authenticated user with access to all cameras.
 
         Returns custom classification attributes for a given object type.
             Only includes models with classification_type set to 'attribute'.
@@ -1510,8 +1510,8 @@ paths:
               schema:
                 $ref: '#/components/schemas/HTTPValidationError'
       security:
-        - frigateAdminAuth: []
-      x-required-role: admin
+        - frigateUserAuth: []
+      x-required-role: all_cameras
   /classification/{name}/train:
     get:
       tags:
@@ -2308,15 +2308,15 @@ paths:
                 $ref: '#/components/schemas/HTTPValidationError'
       security:
         - frigateUserAuth: []
-      x-required-role: any
-      description: '**Access:** Any authenticated user.'
+      x-required-role: camera
+      description: '**Access:** Authenticated user with access to the referenced camera.'
   /review/summarize/start/{start_ts}/end/{end_ts}:
     post:
       tags:
         - Review
       summary: Generate Review Summary
       description: |-
-        **Access:** Admin role required.
+        **Access:** Authenticated user with access to all cameras.
 
         Use GenAI to summarize review items over a period of time.
       operationId: 
@@ -2347,8 +2347,8 @@ paths:
               schema:
                 $ref: '#/components/schemas/HTTPValidationError'
       security:
-        - frigateAdminAuth: []
-      x-required-role: admin
+        - frigateUserAuth: []
+      x-required-role: all_cameras
   /:
     get:
       tags:
@@ -4073,6 +4073,16 @@ paths:
               - type: 'null'
             default: 100
             title: Limit
+        - name: offset
+          in: query
+          required: false
+          schema:
+            anyOf:
+              - type: integer
+                minimum: 0
+              - type: 'null'
+            default: 0
+            title: Offset
         - name: after
           in: query
           required: false
@@ -4378,6 +4388,16 @@ paths:
               - type: 'null'
             default: 50
             title: Limit
+        - name: offset
+          in: query
+          required: false
+          schema:
+            anyOf:
+              - type: integer
+                minimum: 0
+              - type: 'null'
+            default: 0
+            title: Offset
         - name: cameras
           in: query
           required: false
@@ -5093,6 +5113,7 @@ paths:
             NOTES:
             - Creating a manual event does not trigger an update to /events MQTT topic.
             - If a duration is set to null, the event will need to be ended manually by calling /events/{event_id}/end.
+            - The review item is an alert unless the label is listed in the camera's review -> detections -> labels config.
       operationId: create_event_events__camera_name___label__create_post
       parameters:
         - name: camera_name
@@ -7108,7 +7129,9 @@ paths:
               schema:
                 $ref: '#/components/schemas/DebugReplayStartResponse'
         '400':
-          description: Invalid camera, time range, or no recordings
+          description: Invalid camera or time range
+        '404':
+          description: No recordings in the requested time range
         '409':
           description: A replay session is already active
         '422':

frigate/api/auth.py

@@ -85,6 +85,7 @@ def require_admin_by_default():
         "/sub_labels",
         "/plus/models",
         "/recognized_license_plates",
+        "/classification/attributes",
         "/timeline",
         "/timeline/hourly",
         "/recordings/storage",
@@ -971,6 +972,7 @@ def delete_user(request: Request, username: str):
     summary="Update user password",
     description="Updates a user's password. Users can only change their own password unless they have admin role. Requires the current password to verify identity for non-admin users. Password must be at least 12 characters long. If user changes their own password, a new JWT cookie is automatically issued.",
 )
+@limiter.limit(limit_value=rateLimiter.get_limit)
 async def update_password(
     request: Request,
     username: str,
@@ -984,10 +986,11 @@ async def update_password(
     current_username = current_user.get("username")
     current_role = current_user.get("role")
 
-    # viewers can only change their own password
-    if current_role == "viewer" and current_username != username:
+    # Only admins may target another account. This has to cover every non-admin
+    # role rather than just viewer, since custom roles are arbitrary names
+    if current_role != "admin" and current_username != username:
         raise HTTPException(
-            status_code=403, detail="Viewers can only update their own password"
+            status_code=403, detail="Users can only update their own password"
         )
 
     HASH_ITERATIONS = request.app.frigate_config.auth.hash_iterations
@@ -1251,3 +1254,23 @@ async def get_allowed_cameras_for_filter(request: Request):
     all_camera_names = set(request.app.frigate_config.cameras.keys())
     roles_dict = request.app.frigate_config.auth.roles
     return User.get_allowed_cameras(role, roles_dict, all_camera_names)
+
+
+async def require_full_camera_access(
+    request: Request,
+    allowed_cameras: list[str] = Depends(get_allowed_cameras_for_filter),
+):
+    """Dependency for endpoints returning data that spans every camera.
+
+    Some responses cannot be meaningfully scoped to a subset of cameras, so
+    rather than filter them the endpoint is limited to callers who can already
+    see every camera. Admin and viewer always qualify; a custom role qualifies
+    only when its camera list covers all configured cameras.
+    """
+    all_camera_names = set(request.app.frigate_config.cameras.keys())
+
+    if not all_camera_names.issubset(allowed_cameras):
+        raise HTTPException(
+            status_code=403,
+            detail="Access to all cameras is required for this endpoint",
+        )

frigate/api/classification.py

@@ -11,11 +11,10 @@ from typing import Any
 import cv2
 from fastapi import APIRouter, Depends, Request, UploadFile
 from fastapi.responses import JSONResponse
-from pathvalidate import sanitize_filename
 from peewee import DoesNotExist
 from playhouse.shortcuts import model_to_dict
 
-from frigate.api.auth import require_role
+from frigate.api.auth import require_full_camera_access, require_role
 from frigate.api.defs.request.classification_body import (
     AudioTranscriptionBody,
     DeleteFaceImagesBody,
@@ -43,12 +42,21 @@ from frigate.util.classification import (
     write_training_metadata,
 )
 from frigate.util.file import get_event_snapshot
+from frigate.util.path import safe_join, sanitize_path_component
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(tags=[Tags.classification])
 
 
+def invalid_name_response(value: str) -> JSONResponse:
+    """Response for a name that cannot be used as a path component."""
+    return JSONResponse(
+        content={"success": False, "message": f"Invalid name: {value}"},
+        status_code=400,
+    )
+
+
 @router.get(
     "/faces",
     response_model=FacesResponse,
@@ -98,9 +106,7 @@ def reclassify_face(request: Request, body: dict = None):
         )
 
     json: dict[str, Any] = body or {}
-    training_file = os.path.join(
-        FACE_DIR, f"train/{sanitize_filename(json.get('training_file', ''))}"
-    )
+    training_file = safe_join(FACE_DIR, "train", json.get("training_file", ""))
 
     if not training_file or not os.path.isfile(training_file):
         return JSONResponse(
@@ -150,8 +156,10 @@ def train_face(request: Request, name: str, body: dict = None):
         )
 
     json: dict[str, Any] = body or {}
-    training_file_name = sanitize_filename(json.get("training_file", ""))
-    training_file = os.path.join(FACE_DIR, f"train/{training_file_name}")
+    training_file_name = json.get("training_file", "")
+    training_file = (
+        safe_join(FACE_DIR, "train", training_file_name) if training_file_name else None
+    )
     event_id = json.get("event_id")
 
     if not training_file_name and not event_id:
@@ -165,7 +173,9 @@ def train_face(request: Request, name: str, body: dict = None):
             status_code=400,
         )
 
-    if training_file_name and not os.path.isfile(training_file):
+    if training_file_name and (
+        training_file is None or not os.path.isfile(training_file)
+    ):
         return JSONResponse(
             content=(
                 {
@@ -176,9 +186,13 @@ def train_face(request: Request, name: str, body: dict = None):
             status_code=404,
         )
 
-    sanitized_name = sanitize_filename(name)
+    sanitized_name = sanitize_path_component(name)
+    new_file_folder = safe_join(FACE_DIR, name)
+
+    if sanitized_name is None or new_file_folder is None:
+        return invalid_name_response(name)
+
     new_name = f"{sanitized_name}-{datetime.datetime.now().timestamp()}.webp"
-    new_file_folder = os.path.join(FACE_DIR, f"{sanitized_name}")
 
     os.makedirs(new_file_folder, exist_ok=True)
 
@@ -261,9 +275,12 @@ async def create_face(request: Request, name: str):
             content={"message": "Face recognition is not enabled.", "success": False},
         )
 
-    os.makedirs(
-        os.path.join(FACE_DIR, sanitize_filename(name.replace(" ", "_"))), exist_ok=True
-    )
+    face_folder = safe_join(FACE_DIR, name.replace(" ", "_"))
+
+    if face_folder is None:
+        return invalid_name_response(name)
+
+    os.makedirs(face_folder, exist_ok=True)
     return JSONResponse(
         status_code=200,
         content={"success": False, "message": "Successfully created face folder."},
@@ -287,6 +304,9 @@ def register_face(request: Request, name: str, file: UploadFile):
             content={"message": "Face recognition is not enabled.", "success": False},
         )
 
+    if sanitize_path_component(name) is None:
+        return invalid_name_response(name)
+
     context: EmbeddingsContext = request.app.embeddings
     result = None if context is None else context.register_face(name, file.file.read())
 
@@ -356,8 +376,8 @@ def reclassify_face_image(request: Request, name: str, body: dict = None):
         )
 
     json: dict[str, Any] = body or {}
-    image_id = sanitize_filename(json.get("id", ""))
-    new_name = sanitize_filename(json.get("new_name", ""))
+    image_id = sanitize_path_component(json.get("id", ""))
+    new_name = sanitize_path_component(json.get("new_name", ""))
 
     if not image_id or not new_name:
         return JSONResponse(
@@ -381,7 +401,12 @@ def reclassify_face_image(request: Request, name: str, body: dict = None):
             status_code=400,
         )
 
-    source_folder = os.path.join(FACE_DIR, sanitize_filename(name))
+    source_folder = safe_join(FACE_DIR, name)
+    target_folder = safe_join(FACE_DIR, new_name)
+
+    if source_folder is None or target_folder is None:
+        return invalid_name_response(name)
+
     source_file = os.path.join(source_folder, image_id)
 
     if not os.path.isfile(source_file):
@@ -396,7 +421,6 @@ def reclassify_face_image(request: Request, name: str, body: dict = None):
         )
 
     target_filename = f"{new_name}-{datetime.datetime.now().timestamp()}.webp"
-    target_folder = os.path.join(FACE_DIR, new_name)
 
     os.makedirs(target_folder, exist_ok=True)
     shutil.move(source_file, os.path.join(target_folder, target_filename))
@@ -430,8 +454,19 @@ def deregister_faces(request: Request, name: str, body: DeleteFaceImagesBody):
             content={"message": "Face recognition is not enabled.", "success": False},
         )
 
+    sanitized_name = sanitize_path_component(name)
+
+    if sanitized_name is None:
+        return invalid_name_response(name)
+
+    sanitized_ids = [
+        component
+        for component in map(sanitize_path_component, body.ids)
+        if component is not None
+    ]
+
     context: EmbeddingsContext = request.app.embeddings
-    context.delete_face_ids(name, map(lambda file: sanitize_filename(file), body.ids))
+    context.delete_face_ids(sanitized_name, sanitized_ids)
     return JSONResponse(
         content=({"success": True, "message": "Successfully deleted faces."}),
         status_code=200,
@@ -642,7 +677,11 @@ def transcribe_audio(request: Request, body: AudioTranscriptionBody):
 def get_classification_dataset(name: str):
     dataset_dict: dict[str, list[str]] = {}
 
-    dataset_dir = os.path.join(CLIPS_DIR, sanitize_filename(name), "dataset")
+    sanitized_name = sanitize_path_component(name)
+    dataset_dir = safe_join(CLIPS_DIR, name, "dataset")
+
+    if sanitized_name is None or dataset_dir is None:
+        return invalid_name_response(name)
 
     if not os.path.exists(dataset_dir):
         return JSONResponse(
@@ -664,8 +703,8 @@ def get_classification_dataset(name: str):
             dataset_dict[category_name].append(file)
 
     # Get training metadata
-    metadata = read_training_metadata(sanitize_filename(name))
-    current_image_count = get_dataset_image_count(sanitize_filename(name))
+    metadata = read_training_metadata(sanitized_name)
+    current_image_count = get_dataset_image_count(sanitized_name)
 
     if metadata is None:
         training_metadata = {
@@ -702,6 +741,7 @@ def get_classification_dataset(name: str):
 
 @router.get(
     "/classification/attributes",
+    dependencies=[Depends(require_full_camera_access)],
     summary="Get custom classification attributes",
     description="""Returns custom classification attributes for a given object type.
     Only includes models with classification_type set to 'attribute'.
@@ -729,8 +769,8 @@ def get_custom_attributes(
         if object_type is not None and object_type not in model_objects:
             continue
 
-        dataset_dir = os.path.join(CLIPS_DIR, sanitize_filename(model_key), "dataset")
-        if not os.path.exists(dataset_dir):
+        dataset_dir = safe_join(CLIPS_DIR, model_key, "dataset")
+        if dataset_dir is None or not os.path.exists(dataset_dir):
             continue
 
         attributes = []
@@ -760,7 +800,10 @@ def get_custom_attributes(
     The name must exist in the classification models. Returns a success message or an error if the name is invalid.""",
 )
 def get_classification_images(name: str):
-    train_dir = os.path.join(CLIPS_DIR, sanitize_filename(name), "train")
+    train_dir = safe_join(CLIPS_DIR, name, "train")
+
+    if train_dir is None:
+        return invalid_name_response(name)
 
     if not os.path.exists(train_dir):
         return JSONResponse(status_code=200, content=[])
@@ -831,15 +874,17 @@ def delete_classification_dataset_images(
 
     json: dict[str, Any] = body or {}
     list_of_ids = json.get("ids", "")
-    folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", sanitize_filename(category)
-    )
+    sanitized_name = sanitize_path_component(name)
+    folder = safe_join(CLIPS_DIR, name, "dataset", category)
+
+    if sanitized_name is None or folder is None:
+        return invalid_name_response(name)
 
     deleted_count = 0
     for id in list_of_ids:
-        file_path = os.path.join(folder, sanitize_filename(id))
+        file_path = safe_join(folder, id)
 
-        if os.path.isfile(file_path):
+        if file_path and os.path.isfile(file_path):
             os.unlink(file_path)
             deleted_count += 1
 
@@ -850,7 +895,6 @@ def delete_classification_dataset_images(
     # This ensures the dataset is marked as changed after deletion
     # (even if the total count happens to be the same after adding and deleting)
     if deleted_count > 0:
-        sanitized_name = sanitize_filename(name)
         metadata = read_training_metadata(sanitized_name)
         if metadata:
             last_count = metadata.get("last_training_image_count", 0)
@@ -888,8 +932,8 @@ def reclassify_classification_image(
         )
 
     json: dict[str, Any] = body or {}
-    image_id = sanitize_filename(json.get("id", ""))
-    new_category = sanitize_filename(json.get("new_category", ""))
+    image_id = sanitize_path_component(json.get("id", ""))
+    new_category = sanitize_path_component(json.get("new_category", ""))
 
     if not image_id or not new_category:
         return JSONResponse(
@@ -913,10 +957,13 @@ def reclassify_classification_image(
             status_code=400,
         )
 
-    sanitized_name = sanitize_filename(name)
-    source_folder = os.path.join(
-        CLIPS_DIR, sanitized_name, "dataset", sanitize_filename(category)
-    )
+    sanitized_name = sanitize_path_component(name)
+    source_folder = safe_join(CLIPS_DIR, name, "dataset", category)
+    target_folder = safe_join(CLIPS_DIR, name, "dataset", new_category)
+
+    if sanitized_name is None or source_folder is None or target_folder is None:
+        return invalid_name_response(name)
+
     source_file = os.path.join(source_folder, image_id)
 
     if not os.path.isfile(source_file):
@@ -933,7 +980,6 @@ def reclassify_classification_image(
     random_id = "".join(random.choices(string.ascii_lowercase + string.digits, k=6))
     timestamp = datetime.datetime.now().timestamp()
     new_name = f"{new_category}-{timestamp}-{random_id}.png"
-    target_folder = os.path.join(CLIPS_DIR, sanitized_name, "dataset", new_category)
 
     os.makedirs(target_folder, exist_ok=True)
 
@@ -983,7 +1029,7 @@ def rename_classification_category(
         )
 
     json: dict[str, Any] = body or {}
-    new_category = sanitize_filename(json.get("new_category", ""))
+    new_category = sanitize_path_component(json.get("new_category", ""))
 
     if not new_category:
         return JSONResponse(
@@ -996,12 +1042,12 @@ def rename_classification_category(
             status_code=400,
         )
 
-    old_folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", sanitize_filename(old_category)
-    )
-    new_folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", new_category
-    )
+    sanitized_name = sanitize_path_component(name)
+    old_folder = safe_join(CLIPS_DIR, name, "dataset", old_category)
+    new_folder = safe_join(CLIPS_DIR, name, "dataset", new_category)
+
+    if sanitized_name is None or old_folder is None or new_folder is None:
+        return invalid_name_response(name)
 
     if not os.path.exists(old_folder):
         return JSONResponse(
@@ -1030,7 +1076,6 @@ def rename_classification_category(
 
         # Mark dataset as ready to train by resetting training metadata
         # This ensures the dataset is marked as changed after renaming
-        sanitized_name = sanitize_filename(name)
         write_training_metadata(sanitized_name, 0)
 
         return JSONResponse(
@@ -1078,13 +1123,20 @@ def categorize_classification_image(request: Request, name: str, body: dict = No
         )
 
     json: dict[str, Any] = body or {}
-    category = sanitize_filename(json.get("category", ""))
-    training_file_name = sanitize_filename(json.get("training_file", ""))
-    training_file = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "train", training_file_name
+    category = sanitize_path_component(json.get("category", ""))
+    training_file_name = json.get("training_file", "")
+    training_file = (
+        safe_join(CLIPS_DIR, name, "train", training_file_name)
+        if training_file_name
+        else None
     )
 
-    if training_file_name and not os.path.isfile(training_file):
+    if category is None:
+        return invalid_name_response(json.get("category", ""))
+
+    if training_file_name and (
+        training_file is None or not os.path.isfile(training_file)
+    ):
         return JSONResponse(
             content=(
                 {
@@ -1098,9 +1150,10 @@ def categorize_classification_image(request: Request, name: str, body: dict = No
     random_id = "".join(random.choices(string.ascii_lowercase + string.digits, k=6))
     timestamp = datetime.datetime.now().timestamp()
     new_name = f"{category}-{timestamp}-{random_id}.png"
-    new_file_folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", category
-    )
+    new_file_folder = safe_join(CLIPS_DIR, name, "dataset", category)
+
+    if new_file_folder is None:
+        return invalid_name_response(name)
 
     os.makedirs(new_file_folder, exist_ok=True)
 
@@ -1138,9 +1191,10 @@ def create_classification_category(request: Request, name: str, category: str):
             status_code=404,
         )
 
-    category_folder = os.path.join(
-        CLIPS_DIR, sanitize_filename(name), "dataset", sanitize_filename(category)
-    )
+    category_folder = safe_join(CLIPS_DIR, name, "dataset", category)
+
+    if category_folder is None:
+        return invalid_name_response(category)
 
     os.makedirs(category_folder, exist_ok=True)
 
@@ -1179,12 +1233,15 @@ def delete_classification_train_images(request: Request, name: str, body: dict =
 
     json: dict[str, Any] = body or {}
     list_of_ids = json.get("ids", "")
-    folder = os.path.join(CLIPS_DIR, sanitize_filename(name), "train")
+    folder = safe_join(CLIPS_DIR, name, "train")
+
+    if folder is None:
+        return invalid_name_response(name)
 
     for id in list_of_ids:
-        file_path = os.path.join(folder, sanitize_filename(id))
+        file_path = safe_join(folder, id)
 
-        if os.path.isfile(file_path):
+        if file_path and os.path.isfile(file_path):
             os.unlink(file_path)
 
     return JSONResponse(
@@ -1201,7 +1258,11 @@ def delete_classification_train_images(request: Request, name: str, body: dict =
 )
 async def generate_state_examples(request: Request, body: GenerateStateExamplesBody):
     """Generate examples for state classification."""
-    model_name = sanitize_filename(body.model_name)
+    model_name = sanitize_path_component(body.model_name)
+
+    if model_name is None:
+        return invalid_name_response(body.model_name)
+
     cameras_normalized = {
         camera_name: tuple(crop)
         for camera_name, crop in body.cameras.items()
@@ -1224,7 +1285,11 @@ async def generate_state_examples(request: Request, body: GenerateStateExamplesB
 )
 async def generate_object_examples(request: Request, body: GenerateObjectExamplesBody):
     """Generate examples for object classification."""
-    model_name = sanitize_filename(body.model_name)
+    model_name = sanitize_path_component(body.model_name)
+
+    if model_name is None:
+        return invalid_name_response(body.model_name)
+
     collect_object_classification_examples(model_name, body.label)
 
     return JSONResponse(
@@ -1243,10 +1308,16 @@ async def generate_object_examples(request: Request, body: GenerateObjectExample
     Returns a success message.""",
 )
 def delete_classification_model(request: Request, name: str):
-    sanitized_name = sanitize_filename(name)
+    # This endpoint intentionally accepts models that are not in the config, so
+    # there is no allow list to fall back on. Both paths below are recursive
+    # deletes, so an unusable name has to be rejected outright.
+    data_dir = safe_join(CLIPS_DIR, name)
+    model_dir = safe_join(MODEL_CACHE_DIR, name)
+
+    if data_dir is None or model_dir is None:
+        return invalid_name_response(name)
 
     # Delete the classification model's data directory in clips
-    data_dir = os.path.join(CLIPS_DIR, sanitized_name)
     if os.path.exists(data_dir):
         try:
             shutil.rmtree(data_dir)
@@ -1255,7 +1326,6 @@ def delete_classification_model(request: Request, name: str):
             logger.debug(f"Failed to delete data directory for {name}: {e}")
 
     # Delete the classification model's files in model_cache
-    model_dir = os.path.join(MODEL_CACHE_DIR, sanitized_name)
     if os.path.exists(model_dir):
         try:
             shutil.rmtree(model_dir)

frigate/api/debug_replay.py

@@ -13,6 +13,7 @@ from frigate.api.auth import require_role
 from frigate.api.defs.tags import Tags
 from frigate.jobs.debug_replay import (
     ExportDebugReplaySource,
+    NoRecordingsError,
     RecordingDebugReplaySource,
     start_debug_replay_job,
 )
@@ -74,7 +75,8 @@ class DebugReplayStopResponse(BaseModel):
     response_model=DebugReplayStartResponse,
     status_code=202,
     responses={
-        400: {"description": "Invalid camera, time range, or no recordings"},
+        400: {"description": "Invalid camera or time range"},
+        404: {"description": "No recordings in the requested time range"},
         409: {"description": "A replay session is already active"},
     },
     dependencies=[Depends(require_role(["admin"]))],
@@ -113,6 +115,14 @@ async def start_debug_replay(request: Request, body: DebugReplayStartBody):
             },
             status_code=409,
         )
+    except NoRecordingsError:
+        return JSONResponse(
+            content={
+                "success": False,
+                "message": "No recordings found in the selected time range",
+            },
+            status_code=404,
+        )
     except ValueError:
         logger.exception("Rejected debug replay start request")
         return JSONResponse(

frigate/api/defs/query/events_query_parameters.py

@@ -14,6 +14,7 @@ class EventsQueryParams(BaseModel):
     zone: str | None = "all"
     zones: str | None = "all"
     limit: int | None = 100
+    offset: int | None = Field(0, ge=0)
     after: float | None = None
     before: float | None = None
     time_range: str | None = DEFAULT_TIME_RANGE
@@ -55,6 +56,7 @@ class EventsSearchQueryParams(BaseModel):
         deprecated=True,
     )
     limit: int | None = 50
+    offset: int | None = Field(0, ge=0)
     cameras: str | None = "all"
     labels: str | None = "all"
     sub_labels: str | None = "all"

frigate/api/event.py

@@ -16,7 +16,6 @@ import numpy as np
 from fastapi import APIRouter, Request
 from fastapi.params import Depends
 from fastapi.responses import JSONResponse
-from pathvalidate import sanitize_filename
 from peewee import JOIN, DoesNotExist, fn, operator
 from playhouse.shortcuts import model_to_dict
 
@@ -56,11 +55,12 @@ from frigate.api.defs.response.generic_response import GenericResponse
 from frigate.api.defs.tags import Tags
 from frigate.comms.event_metadata_updater import EventMetadataTypeEnum
 from frigate.config.classification import ObjectClassificationType
-from frigate.const import CLIPS_DIR, TRIGGER_DIR
+from frigate.const import CLIPS_DIR
 from frigate.embeddings import EmbeddingsContext
 from frigate.models import Event, ReviewSegment, Timeline, Trigger
 from frigate.track.object_processing import TrackedObject
 from frigate.util.file import get_event_thumbnail_bytes, load_event_snapshot_image
+from frigate.util.path import get_trigger_thumbnail_path, safe_join
 from frigate.util.time import get_dst_transitions, get_tz_modifiers
 
 logger = logging.getLogger(__name__)
@@ -129,6 +129,7 @@ def events(
         zones = zone
 
     limit = params.limit
+    offset = params.offset
     after = params.after
     before = params.before
     time_range = params.time_range
@@ -361,11 +362,15 @@ def events(
     else:
         order_by = Event.start_time.desc()
 
+    # offset paging needs a stable order when scores or speeds tie
+    tiebreaker = [Event.id] if sort and sort.startswith(("score", "speed")) else []
+
     events = (
         Event.select(*selected_columns)
         .where(reduce(operator.and_, clauses))
-        .order_by(order_by)
+        .order_by(order_by, *tiebreaker)
         .limit(limit)
+        .offset(offset)
         .dicts()
         .iterator()
     )
@@ -518,6 +523,7 @@ def events_search(
     search_type = params.search_type
     include_thumbnails = params.include_thumbnails
     limit = params.limit
+    offset = params.offset
     sort = params.sort
 
     # Filters
@@ -824,6 +830,9 @@ def events_search(
     if search_results:
         events_query = events_query.where(Event.id << list(search_results.keys()))
 
+    # sorts below are stable, so this orders ties for offset paging
+    events_query = events_query.order_by(Event.id)
+
     # Fetch events and process them in a single pass
     processed_events = []
     for event in events_query.dicts():
@@ -881,7 +890,7 @@ def events_search(
         processed_events.sort(key=lambda x: x["start_time"], reverse=True)
 
     # Limit the number of events returned
-    processed_events = processed_events[:limit]
+    processed_events = processed_events[offset:][:limit]
 
     return JSONResponse(content=processed_events)
 
@@ -1452,10 +1461,10 @@ async def set_attributes(
             continue
 
         # Get available labels from dataset directory
-        dataset_dir = os.path.join(CLIPS_DIR, sanitize_filename(model_key), "dataset")
+        dataset_dir = safe_join(CLIPS_DIR, model_key, "dataset")
         available_labels = set()
 
-        if os.path.exists(dataset_dir):
+        if dataset_dir and os.path.exists(dataset_dir):
             for category_name in os.listdir(dataset_dir):
                 category_dir = os.path.join(dataset_dir, category_name)
                 if os.path.isdir(category_dir):
@@ -1748,6 +1757,7 @@ async def delete_events(request: Request, body: EventsDeleteBody):
     NOTES:
     - Creating a manual event does not trigger an update to /events MQTT topic.
     - If a duration is set to null, the event will need to be ended manually by calling /events/{event_id}/end.
+    - The review item is an alert unless the label is listed in the camera's review -> detections -> labels config.
     """,
 )
 def create_event(
@@ -1958,18 +1968,13 @@ def create_trigger_embedding(
         if body.type == "thumbnail":
             # Save image to the triggers directory
             try:
-                os.makedirs(
-                    os.path.join(TRIGGER_DIR, sanitize_filename(camera_name)),
-                    exist_ok=True,
-                )
-                with open(
-                    os.path.join(
-                        TRIGGER_DIR,
-                        sanitize_filename(camera_name),
-                        f"{sanitize_filename(body.data)}.webp",
-                    ),
-                    "wb",
-                ) as f:
+                webp_path = get_trigger_thumbnail_path(camera_name, body.data)
+
+                if webp_path is None:
+                    raise ValueError(f"Invalid trigger thumbnail path for {body.data}")
+
+                os.makedirs(os.path.dirname(webp_path), exist_ok=True)
+                with open(webp_path, "wb") as f:
                     f.write(thumbnail)
                 logger.debug(
                     f"Writing thumbnail for trigger with data {body.data} in {camera_name}."
@@ -2041,10 +2046,16 @@ def update_trigger_embedding(
         if body.type == "description":
             embedding = context.generate_description_embedding(body.data)
         elif body.type == "thumbnail":
-            webp_file = sanitize_filename(body.data) + ".webp"
-            webp_path = os.path.join(
-                TRIGGER_DIR, sanitize_filename(camera_name), webp_file
-            )
+            webp_path = get_trigger_thumbnail_path(camera_name, body.data)
+
+            if webp_path is None:
+                return JSONResponse(
+                    content={
+                        "success": False,
+                        "message": f"Invalid data for {body.type} trigger",
+                    },
+                    status_code=400,
+                )
 
             try:
                 event: Event = Event.get(Event.id == body.data)
@@ -2101,13 +2112,14 @@ def update_trigger_embedding(
             # Update existing trigger
             if trigger.data != body.data:  # Delete old thumbnail only if data changes
                 try:
-                    os.remove(
-                        os.path.join(
-                            TRIGGER_DIR,
-                            sanitize_filename(camera_name),
-                            f"{trigger.data}.webp",
+                    old_path = get_trigger_thumbnail_path(camera_name, trigger.data)
+
+                    if old_path is None:
+                        raise ValueError(
+                            f"Invalid trigger thumbnail path for {trigger.data}"
                         )
-                    )
+
+                    os.remove(old_path)
                     logger.debug(
                         f"Deleted thumbnail for trigger with data {trigger.data} in {camera_name}."
                     )
@@ -2141,12 +2153,13 @@ def update_trigger_embedding(
         if body.type == "thumbnail":
             # Save image to the triggers directory
             try:
-                camera_path = os.path.join(TRIGGER_DIR, sanitize_filename(camera_name))
-                os.makedirs(camera_path, exist_ok=True)
-                with open(
-                    os.path.join(camera_path, f"{sanitize_filename(body.data)}.webp"),
-                    "wb",
-                ) as f:
+                thumbnail_path = get_trigger_thumbnail_path(camera_name, body.data)
+
+                if thumbnail_path is None:
+                    raise ValueError(f"Invalid trigger thumbnail path for {body.data}")
+
+                os.makedirs(os.path.dirname(thumbnail_path), exist_ok=True)
+                with open(thumbnail_path, "wb") as f:
                     f.write(thumbnail)
                 logger.debug(
                     f"Writing thumbnail for trigger with data {body.data} in {camera_name}."
@@ -2217,11 +2230,12 @@ def delete_trigger_embedding(
             )
 
         try:
-            os.remove(
-                os.path.join(
-                    TRIGGER_DIR, sanitize_filename(camera_name), f"{trigger.data}.webp"
-                )
-            )
+            thumbnail_path = get_trigger_thumbnail_path(camera_name, trigger.data)
+
+            if thumbnail_path is None:
+                raise ValueError(f"Invalid trigger thumbnail path for {trigger.data}")
+
+            os.remove(thumbnail_path)
             logger.debug(
                 f"Deleted thumbnail for trigger with data {trigger.data} in {camera_name}."
             )

frigate/api/export.py

@@ -9,11 +9,12 @@ import zipfile
 from collections import deque
 from collections.abc import Iterator
 from pathlib import Path
+from urllib.parse import quote
 
 import psutil
 from fastapi import APIRouter, Depends, Query, Request
 from fastapi.responses import JSONResponse, StreamingResponse
-from pathvalidate import sanitize_filename, sanitize_filepath
+from pathvalidate import sanitize_filename
 from peewee import DoesNotExist
 from playhouse.shortcuts import model_to_dict
 
@@ -68,10 +69,12 @@ from frigate.jobs.export import (
 from frigate.models import Export, ExportCase, Previews, Recordings
 from frigate.record.export import (
     DEFAULT_TIME_LAPSE_FFMPEG_ARGS,
+    DEFAULT_TIME_LAPSE_FFMPEG_INPUT_ARGS,
     ChaptersEnum,
     PlaybackSourceEnum,
     validate_ffmpeg_args,
 )
+from frigate.util.path import sanitize_contained_path
 from frigate.util.time import is_current_hour
 
 logger = logging.getLogger(__name__)
@@ -129,18 +132,12 @@ def _validate_export_case(export_case_id: str | None) -> JSONResponse | None:
 def _sanitize_existing_image(
     image_path: str | None,
 ) -> tuple[str | None, JSONResponse | None]:
-    # sanitize_filepath normalizes "\" to "/" but leaves ".." intact, so a path
-    # like "clips\..\..\etc/passwd" passes the CLIPS_DIR prefix check yet still
-    # escapes the directory once resolved. A valid snapshot path never uses "..".
-    if image_path and ".." in image_path:
-        return None, JSONResponse(
-            content={"success": False, "message": "Invalid image path"},
-            status_code=400,
-        )
+    if not image_path:
+        return None, None
 
-    existing_image = sanitize_filepath(image_path) if image_path else None
+    existing_image = sanitize_contained_path(image_path, CLIPS_DIR)
 
-    if existing_image and not existing_image.startswith(CLIPS_DIR):
+    if existing_image is None:
         return None, JSONResponse(
             content={"success": False, "message": "Invalid image path"},
             status_code=400,
@@ -458,6 +455,22 @@ def _stream_case_archive(exports: list[Export]) -> Iterator[bytes]:
     yield from buffer.drain()
 
 
+def _content_disposition(filename: str, ascii_fallback: str) -> str:
+    """Build an attachment Content-Disposition that survives non-ASCII names.
+
+    Header values are encoded as latin-1, so a name outside that range cannot
+    go in filename at all. RFC 6266 handles this with a pair: a plain ASCII
+    filename for old clients, plus a percent-encoded UTF-8 filename* that
+    every current browser prefers.
+    """
+    ascii_name = filename if filename.isascii() else ascii_fallback
+
+    return (
+        f'attachment; filename="{ascii_name}"; '
+        f"filename*=UTF-8''{quote(filename, safe='')}"
+    )
+
+
 @router.get(
     "/cases/{case_id}/download",
     dependencies=[Depends(allow_any_authenticated())],
@@ -500,7 +513,9 @@ def download_export_case(
         _stream_case_archive(exports),
         media_type="application/zip",
         headers={
-            "Content-Disposition": f'attachment; filename="{archive_base}.zip"',
+            "Content-Disposition": _content_disposition(
+                f"{archive_base}.zip", f"{case_id}.zip"
+            ),
         },
     )
 
@@ -998,7 +1013,7 @@ def export_recording_custom(
 
     # Set default values if not provided (timelapse defaults)
     if ffmpeg_input_args is None:
-        ffmpeg_input_args = ""
+        ffmpeg_input_args = DEFAULT_TIME_LAPSE_FFMPEG_INPUT_ARGS
 
     if ffmpeg_output_args is None:
         ffmpeg_output_args = DEFAULT_TIME_LAPSE_FFMPEG_ARGS

frigate/api/notification.py

@@ -1,8 +1,10 @@
 """Notification apis."""
 
+import ipaddress
 import logging
 import os
 from typing import Any
+from urllib.parse import urlparse
 
 from cryptography.hazmat.primitives import serialization
 from fastapi import APIRouter, Depends, Request
@@ -19,6 +21,95 @@ logger = logging.getLogger(__name__)
 
 router = APIRouter(tags=[Tags.notifications])
 
+# Push endpoints are opaque URLs but stay well under this in practice
+MAX_ENDPOINT_LENGTH = 2048
+
+# Suffixes that only ever resolve on the local network
+INTERNAL_HOST_SUFFIXES = (".local", ".localdomain", ".internal", ".home.arpa")
+
+
+def _validate_push_endpoint(endpoint: Any) -> str | None:
+    """Return a reason the endpoint is unusable, or None when it is valid.
+
+    Subscriptions are issued by the browser vendor's push service, so a valid
+    endpoint is always a public https URL. Anything else is either a broken
+    registration or an attempt to aim the notification sender somewhere it
+    should not reach.
+    """
+    if not isinstance(endpoint, str) or not endpoint:
+        return "endpoint must be a url"
+
+    if len(endpoint) > MAX_ENDPOINT_LENGTH:
+        return "endpoint is too long"
+
+    try:
+        parsed = urlparse(endpoint)
+        port = parsed.port
+    except ValueError:
+        return "endpoint is not a valid url"
+
+    if parsed.scheme != "https":
+        return "endpoint must use https"
+
+    if parsed.username or parsed.password:
+        return "endpoint must not include credentials"
+
+    if port is not None and port != 443:
+        return "endpoint must use the default https port"
+
+    hostname = parsed.hostname
+
+    if not hostname:
+        return "endpoint must include a hostname"
+
+    try:
+        address = ipaddress.ip_address(hostname)
+    except ValueError:
+        address = None
+
+    if address is not None:
+        # A push service is never reachable at an address only this network can
+        # route, so anything non-global is a misconfiguration at best
+        if not address.is_global:
+            return "endpoint must not use a private address"
+    elif hostname == "localhost" or "." not in hostname:
+        return "endpoint must use a fully qualified hostname"
+    elif hostname.endswith(INTERNAL_HOST_SUFFIXES):
+        return "endpoint must not use an internal hostname"
+
+    # The subscription token lives in the path, and webpush.py assumes there is
+    # a separator after the host when it builds the VAPID audience
+    if len(parsed.path) <= 1:
+        return "endpoint must include a subscription path"
+
+    return None
+
+
+def _validate_subscription(sub: Any) -> str | None:
+    """Return a reason the subscription is unusable, or None when it is valid."""
+    if not isinstance(sub, dict):
+        return "subscription must be an object"
+
+    reason = _validate_push_endpoint(sub.get("endpoint"))
+
+    if reason:
+        return reason
+
+    keys = sub.get("keys")
+
+    if not isinstance(keys, dict):
+        return "subscription must include keys"
+
+    # WebPusher raises on a missing key, which would break every send for the
+    # user rather than just this registration
+    for name in ("p256dh", "auth"):
+        value = keys.get(name)
+
+        if not isinstance(value, str) or not value:
+            return f"subscription keys must include {name}"
+
+    return None
+
 
 @router.get(
     "/notifications/pubkey",
@@ -71,6 +162,17 @@ def register_notifications(request: Request, body: dict = None):
             status_code=400,
         )
 
+    reason = _validate_subscription(sub)
+
+    if reason:
+        logger.warning(
+            "Rejected notification registration for %s: %s", username, reason
+        )
+        return JSONResponse(
+            content={"success": False, "message": f"Invalid subscription: {reason}"},
+            status_code=400,
+        )
+
     try:
         User.update(notification_tokens=User.notification_tokens.append(sub)).where(
             User.username == username

frigate/api/review.py

@@ -17,6 +17,7 @@ from frigate.api.auth import (
     get_allowed_cameras_for_filter,
     get_current_user,
     require_camera_access,
+    require_full_camera_access,
     require_role,
 )
 from frigate.api.defs.query.review_query_parameters import (
@@ -42,6 +43,22 @@ logger = logging.getLogger(__name__)
 router = APIRouter(tags=[Tags.review])
 
 
+def get_label_clause(label: str, include_audio: bool = True):
+    """Build a clause matching a label within a review segment's data.
+
+    Verified objects are stored with a `-verified` suffix (eg. `person-verified`)
+    so that variant is matched as well.
+    """
+    clause = (ReviewSegment.data["objects"].cast("text") % f'*"{label}"*') | (
+        ReviewSegment.data["objects"].cast("text") % f'*"{label}-verified"*'
+    )
+
+    if include_audio:
+        clause |= ReviewSegment.data["audio"].cast("text") % f'*"{label}"*'
+
+    return clause
+
+
 @router.get(
     "/review",
     response_model=list[ReviewSegmentResponse],
@@ -91,10 +108,7 @@ async def review(
         filtered_labels = labels.split(",")
 
         for label in filtered_labels:
-            label_clauses.append(
-                (ReviewSegment.data["objects"].cast("text") % f'*"{label}"*')
-                | (ReviewSegment.data["audio"].cast("text") % f'*"{label}"*')
-            )
+            label_clauses.append(get_label_clause(label))
         clauses.append(reduce(operator.or_, label_clauses))
 
     if zones != "all":
@@ -235,10 +249,7 @@ async def review_summary(
         filtered_labels = labels.split(",")
 
         for label in filtered_labels:
-            label_clauses.append(
-                (ReviewSegment.data["objects"].cast("text") % f'*"{label}"*')
-                | (ReviewSegment.data["audio"].cast("text") % f'*"{label}"*')
-            )
+            label_clauses.append(get_label_clause(label))
         clauses.append(reduce(operator.or_, label_clauses))
     if zones != "all":
         # use matching so segments with multiple zones
@@ -336,9 +347,8 @@ async def review_summary(
         filtered_labels = labels.split(",")
 
         for label in filtered_labels:
-            label_clauses.append(
-                ReviewSegment.data["objects"].cast("text") % f'*"{label}"*'
-            )
+            label_clauses.append(get_label_clause(label, include_audio=False))
+
         clauses.append(reduce(operator.or_, label_clauses))
 
     # Find the time range of available data
@@ -709,6 +719,7 @@ async def get_review(request: Request, review_id: str):
     dependencies=[Depends(allow_any_authenticated())],
 )
 async def set_not_reviewed(
+    request: Request,
     review_id: str,
     current_user: dict = Depends(get_current_user),
 ):
@@ -727,6 +738,8 @@ async def set_not_reviewed(
             status_code=404,
         )
 
+    await require_camera_access(review.camera, request=request)
+
     try:
         user_review = UserReviewStatus.get(
             UserReviewStatus.user_id == user_id,
@@ -743,9 +756,12 @@ async def set_not_reviewed(
     )
 
 
+# Intentionally not camera scoped, as the summary correlates each flagged event
+# with overlapping activity on other cameras. Restricted to callers who can
+# already see every camera, so the unscoped query discloses nothing.
 @router.post(
     "/review/summarize/start/{start_ts}/end/{end_ts}",
-    dependencies=[Depends(require_role(["admin"]))],
+    dependencies=[Depends(require_full_camera_access)],
     description="Use GenAI to summarize review items over a period of time.",
 )
 def generate_review_summary(request: Request, start_ts: float, end_ts: float):

frigate/app.py

@@ -103,21 +103,9 @@ class FrigateApp:
         self.detection_shms: list[mp.shared_memory.SharedMemory] = []
         self.log_queue: Queue = mp.Queue()
         self.camera_metrics: DictProxy = self.metrics_manager.dict()
-        self.embeddings_metrics: DataProcessorMetrics | None = (
-            DataProcessorMetrics(
-                self.metrics_manager, list(config.classification.custom.keys())
-            )
-            if (
-                config.semantic_search.enabled
-                or any(
-                    c.objects.genai.enabled or c.review.genai.enabled
-                    for c in config.cameras.values()
-                )
-                or config.lpr.enabled
-                or config.face_recognition.enabled
-                or len(config.classification.custom) > 0
-            )
-            else None
+
+        self.embeddings_metrics = DataProcessorMetrics(
+            self.metrics_manager, list(config.classification.custom.keys())
         )
         self.ptz_metrics: dict[str, PTZMetrics] = {}
         self.processes: dict[str, int] = {}

frigate/camera/activity_manager.py

@@ -103,12 +103,13 @@ class CameraActivityManager:
         all_objects: list[dict[str, Any]] = []
 
         for camera in new_activity.keys():
-            if camera not in self.config.cameras:
+            camera_config = self.config.cameras.get(camera)
+            if camera_config is None:
                 continue
 
             # handle cameras that were added dynamically
             if camera not in self.camera_all_object_counts:
-                self.__init_camera(self.config.cameras[camera])
+                self.__init_camera(camera_config)
 
             new_objects = new_activity[camera].get("objects", [])
             all_objects.extend(new_objects)
@@ -233,12 +234,13 @@ class AudioActivityManager:
         now = datetime.datetime.now().timestamp()
 
         for camera in new_activity.keys():
-            if camera not in self.config.cameras:
+            camera_config = self.config.cameras.get(camera)
+            if camera_config is None:
                 continue
 
             # handle cameras that were added dynamically
             if camera not in self.current_audio_detections:
-                self.__init_camera(self.config.cameras[camera])
+                self.__init_camera(camera_config)
 
             new_detections = new_activity[camera].get("detections", [])
             if self.compare_audio_activity(camera, new_detections, now):

frigate/camera/state.py

@@ -60,6 +60,11 @@ class CameraState:
         # face/LPR pipelines when using a model without built-in detection.
         self.face_recognition_min_obj_area: int = 0
         self.lpr_min_obj_area: int = 0
+        self.lp_objects = {
+            label
+            for label, attributes in config.model.attributes_map.items()
+            if "license_plate" in attributes
+        }
 
         if (
             self.camera_config.face_recognition.enabled
@@ -452,7 +457,7 @@ class CameraState:
                 and obj_area >= self.face_recognition_min_obj_area
                 and updated_obj.obj_data.get("sub_label") is None
             ) or (
-                obj_label in ("car", "motorcycle")
+                obj_label in self.lp_objects
                 and self.lpr_min_obj_area > 0
                 and obj_area >= self.lpr_min_obj_area
                 and updated_obj.obj_data.get("sub_label") is None
@@ -548,7 +553,7 @@ class CameraState:
                     current_best.thumbnail_data is not None
                     and obj.thumbnail_data is not None
                     and is_better_thumbnail(
-                        object_type,
+                        obj.thumbnail_attributes,
                         current_best.thumbnail_data,
                         obj.thumbnail_data,
                         self.camera_config.frame_shape,

frigate/comms/webpush.py

@@ -89,7 +89,9 @@ class WebPushClient(Communicator):
         # notification and auth config updater
         self.global_config_subscriber = ConfigSubscriber("config/")
         self.config_subscriber = CameraConfigUpdateSubscriber(
-            self.config, self.config.cameras, [CameraConfigUpdateEnum.notifications]
+            self.config,
+            self.config.cameras,
+            [CameraConfigUpdateEnum.add, CameraConfigUpdateEnum.notifications],
         )
         self._refresh_user_cameras()
 
@@ -213,6 +215,8 @@ class WebPushClient(Communicator):
                 self.suspended_cameras[camera] = 0
                 self.last_camera_notification_time[camera] = 0
 
+            self._refresh_user_cameras()
+
         if topic == "reviews":
             decoded = json.loads(payload)
             camera = decoded["before"]["camera"]
@@ -417,6 +421,7 @@ class WebPushClient(Communicator):
         # Don't notify if message is an update and important fields don't have an update
         if (
             state == "update"
+            and payload["before"]["severity"] == payload["after"]["severity"]
             and len(payload["before"]["data"]["objects"])
             == len(payload["after"]["data"]["objects"])
             and len(payload["before"]["data"]["zones"])

frigate/const.py

@@ -44,7 +44,11 @@ DEFAULT_ATTRIBUTE_LABEL_MAP = {
         "ups",
         "usps",
     ],
+    "truck": ["license_plate"],
+    "garbage_truck": ["license_plate"],
     "motorcycle": ["license_plate"],
+    "bus": ["license_plate"],
+    "school_bus": ["license_plate"],
 }
 ATTRIBUTE_LABEL_DISPLAY_MAP = {
     "amazon": "Amazon",

frigate/data_processing/common/license_plate/mixin.py

@@ -1172,6 +1172,28 @@ class LicensePlateProcessingMixin:
 
         return rep["plate"], rep["conf"], rep["char_confidences"], rep["area"]
 
+    def _passes_plate_filters(self, camera: str, plate: str) -> bool:
+        """Check a plate against the configured length and format filters."""
+        if len(plate) < self.lpr_config.min_plate_length:
+            logger.debug(
+                f"{camera}: Filtered out plate '{plate}' due to length ({len(plate)} < {self.lpr_config.min_plate_length})"
+            )
+            return False
+
+        if self.lpr_config.format:
+            try:
+                if not re.fullmatch(self.lpr_config.format, plate):
+                    logger.debug(
+                        f"{camera}: Filtered out plate '{plate}' due to format mismatch"
+                    )
+                    return False
+            except re.error:
+                logger.error(
+                    f"{camera}: Invalid regex in LPR format configuration: {self.lpr_config.format}"
+                )
+
+        return True
+
     def _generate_plate_event(self, camera: str, plate: str, plate_score: float) -> str:
         """Generate a unique ID for a plate event based on camera and text."""
         now = datetime.datetime.now().timestamp()
@@ -1268,7 +1290,7 @@ class LicensePlateProcessingMixin:
                 and obj_data.get("label") != "license_plate"
             ):
                 logger.debug(
-                    f"{camera}: Not a processing license plate for non car/motorcycle object."
+                    f"{camera}: Not a processing license plate for {obj_data.get('label', 'unknown')}."
                 )
                 return
 
@@ -1345,7 +1367,7 @@ class LicensePlateProcessingMixin:
 
                 if not license_plate:
                     logger.debug(
-                        f"{camera}: Detected no license plates for car/motorcycle object."
+                        f"{camera}: Detected no license plates for {obj_data.get('label', 'unknown')} object."
                     )
                     return
 
@@ -1511,10 +1533,14 @@ class LicensePlateProcessingMixin:
             plate_id = None
 
             for existing_id, data in self.detected_license_plates.items():
+                # entries from the object pipeline on this camera have no
+                # last_seen until they pass the filters below
+                last_seen = data.get("last_seen")
+
                 if (
                     data["camera"] == camera
-                    and data["last_seen"] is not None
-                    and current_time - data["last_seen"]
+                    and last_seen is not None
+                    and current_time - last_seen
                     <= self.config.cameras[camera].lpr.expire_time
                 ):
                     similarity = JaroWinkler.similarity(data["plate"], top_plate)
@@ -1525,6 +1551,11 @@ class LicensePlateProcessingMixin:
                         )
                         break
             if plate_id is None:
+                # the event id doubles as the cluster key, so a plate rejected
+                # after this point would leave an entry that never expires
+                if not self._passes_plate_filters(camera, top_plate):
+                    return
+
                 plate_id = self._generate_plate_event(camera, top_plate, avg_confidence)
                 logger.debug(
                     f"{camera}: New plate event for dedicated LPR camera {plate_id}: {top_plate}"
@@ -1569,27 +1600,12 @@ class LicensePlateProcessingMixin:
                 f"{camera}: Clustering changed top plate '{top_plate}' (conf: {avg_confidence:.3f}) to rep '{rep_plate}' (conf: {rep_conf:.3f})"
             )
 
-        # Apply length and format filters to the clustered representative
-        # rather than individual OCR readings, so noisy variants still
-        # contribute to clustering even when they don't pass on their own.
-        if len(rep_plate) < self.lpr_config.min_plate_length:
-            logger.debug(
-                f"{camera}: Filtered out clustered plate '{rep_plate}' due to length ({len(rep_plate)} < {self.lpr_config.min_plate_length})"
-            )
+        # filter the clustered representative rather than individual OCR
+        # readings, so noisy variants still contribute to clustering even
+        # when they don't pass on their own
+        if not self._passes_plate_filters(camera, rep_plate):
             return
 
-        if self.lpr_config.format:
-            try:
-                if not re.fullmatch(self.lpr_config.format, rep_plate):
-                    logger.debug(
-                        f"{camera}: Filtered out clustered plate '{rep_plate}' due to format mismatch"
-                    )
-                    return
-            except re.error:
-                logger.error(
-                    f"{camera}: Invalid regex in LPR format configuration: {self.lpr_config.format}"
-                )
-
         # Update stored rep
         self.detected_license_plates[id].update(
             {

frigate/data_processing/post/object_descriptions.py

@@ -63,8 +63,10 @@ class ObjectDescriptionProcessor(PostProcessorApi):
         """Handle an update to a frame for an object."""
         camera_config = self.config.cameras[camera]
 
-        # no need to save our own thumbnails if genai is not enabled
-        # or if the object has become stationary
+        if not camera_config.objects.genai.enabled:
+            return
+
+        # no need to save our own thumbnails if the object has become stationary
         if not data["stationary"]:
             if data["id"] not in self.tracked_events:
                 self.tracked_events[data["id"]] = []

frigate/data_processing/real_time/face.py

@@ -28,6 +28,7 @@ from frigate.data_processing.common.face.model import (
 from frigate.types import TrackedObjectUpdateTypesEnum
 from frigate.util.builtin import EventsPerSecond, InferenceSpeed
 from frigate.util.image import area
+from frigate.util.path import safe_join, sanitize_path_component
 
 from ..types import DataProcessorMetrics
 from .api import RealTimeProcessorApi
@@ -409,9 +410,17 @@ class FaceRealTimeProcessor(RealTimeProcessorApi):
                 )
 
             # write face to library
-            folder = os.path.join(FACE_DIR, label)
+            sanitized_label = sanitize_path_component(label)
+            folder = safe_join(FACE_DIR, label)
+
+            if sanitized_label is None or folder is None:
+                return {
+                    "message": f"Invalid face name: {label}",
+                    "success": False,
+                }
+
             file = os.path.join(
-                folder, f"{label}_{datetime.datetime.now().timestamp()}.webp"
+                folder, f"{sanitized_label}_{datetime.datetime.now().timestamp()}.webp"
             )
             os.makedirs(folder, exist_ok=True)
 

frigate/db/sqlitevecq.py

@@ -1,8 +1,10 @@
 import logging
 import sqlite3
+import threading
 from typing import Any
 
 import regex
+from peewee import DatabaseError
 from playhouse.sqliteq import SqliteQueueDatabase
 
 logger = logging.getLogger(__name__)
@@ -17,6 +19,7 @@ class SqliteVecQueueDatabase(SqliteQueueDatabase):
         self.load_vec_extension: bool = load_vec_extension
         # no extension necessary, sqlite will load correctly for each platform
         self.sqlite_vec_path = "/usr/local/lib/vec0"
+        self.upsert_lock = threading.Lock()
         super().__init__(*args, **kwargs)
 
     def _connect(self, *args: Any, **kwargs: Any) -> sqlite3.Connection:
@@ -53,6 +56,22 @@ class SqliteVecQueueDatabase(SqliteQueueDatabase):
 
         conn.create_function("REGEXP", 2, regexp)
 
+    def execute_write(self, sql: str, params: Any = None) -> None:
+        """Run a write and wait for it, so that failures are raised here.
+
+        SqliteQueueDatabase hands non-SELECT statements to a writer thread and
+        stores any exception on the cursor it returns, so callers that ignore
+        that cursor never learn the write failed.
+        """
+        self.execute_sql(sql, params).fetchall()
+
+    def _table_exists(self, table: str) -> bool:
+        cursor = self.execute_sql(
+            "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?",
+            (table,),
+        )
+        return cursor.fetchone() is not None
+
     def _delete_embeddings(self, table: str, event_ids: list[str]) -> None:
         """Delete embeddings for the given events, if the table exists.
 
@@ -63,17 +82,17 @@ class SqliteVecQueueDatabase(SqliteQueueDatabase):
             return
 
         # the embeddings tables are only created once semantic search has run
-        cursor = self.execute_sql(
-            "SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?",
-            (table,),
-        )
-
-        if cursor.fetchone() is None:
+        if not self._table_exists(table):
             logger.debug("Skipping %s cleanup, table does not exist", table)
             return
 
         ids = ",".join(["?" for _ in event_ids])
-        self.execute_sql(f"DELETE FROM {table} WHERE id IN ({ids})", event_ids)
+
+        # callers treat cleanup as best effort, so log rather than propagate
+        try:
+            self.execute_write(f"DELETE FROM {table} WHERE id IN ({ids})", event_ids)
+        except DatabaseError:
+            logger.exception("Failed to delete embeddings from %s", table)
 
     def delete_embeddings_thumbnail(self, event_ids: list[str]) -> None:
         self._delete_embeddings("vec_thumbnails", event_ids)
@@ -81,25 +100,67 @@ class SqliteVecQueueDatabase(SqliteQueueDatabase):
     def delete_embeddings_description(self, event_ids: list[str]) -> None:
         self._delete_embeddings("vec_descriptions", event_ids)
 
+    def _restore_vec_info_table(self, table: str) -> None:
+        """Recreate the _info shadow table a legacy vec0 table is missing.
+
+        sqlite-vec added _info in 0.1.6 and drops it unconditionally when a
+        table is destroyed, so tables written by Frigate 0.17 and earlier fail
+        to drop. An empty stub is enough, and leaving it unseeded keeps the
+        table reading as pre-0.1.10 if the drop does not follow.
+        """
+        if not self._table_exists(table) or self._table_exists(f"{table}_info"):
+            return
+
+        logger.debug("Restoring the %s_info shadow table before dropping", table)
+        self.execute_write(
+            f'CREATE TABLE "{table}_info" (key TEXT PRIMARY KEY, value ANY)'
+        )
+
     def drop_embeddings_tables(self) -> None:
-        self.execute_sql("""
-            DROP TABLE vec_descriptions;
-        """)
-        self.execute_sql("""
-            DROP TABLE vec_thumbnails;
-        """)
+        for table in ("vec_descriptions", "vec_thumbnails"):
+            self._restore_vec_info_table(table)
+            self.execute_write(f"DROP TABLE IF EXISTS {table}")
 
     def create_embeddings_tables(self) -> None:
         """Create vec0 virtual table for embeddings"""
-        self.execute_sql("""
+        self.execute_write("""
             CREATE VIRTUAL TABLE IF NOT EXISTS vec_thumbnails USING vec0(
                 id TEXT PRIMARY KEY,
                 thumbnail_embedding FLOAT[768] distance_metric=cosine
             );
         """)
-        self.execute_sql("""
+        self.execute_write("""
             CREATE VIRTUAL TABLE IF NOT EXISTS vec_descriptions USING vec0(
                 id TEXT PRIMARY KEY,
                 description_embedding FLOAT[768] distance_metric=cosine
             );
         """)
+
+    def upsert_embeddings(
+        self, table: str, column: str, embeddings: dict[str, bytes]
+    ) -> None:
+        """Write embeddings for the given event ids, replacing any that exist.
+
+        vec0 implements neither REPLACE nor UPSERT, so rows that are already
+        there have to be deleted first.
+        """
+        if not embeddings:
+            return
+
+        event_ids = list(embeddings.keys())
+        ids = ",".join(["?" for _ in event_ids])
+        params: list[Any] = []
+
+        for event_id in event_ids:
+            params.extend((event_id, embeddings[event_id]))
+
+        values = ", ".join(["(?, ?)"] * len(event_ids))
+
+        # reindexing and live embedding run on separate threads, and each write
+        # is queued separately, so the delete and the insert have to be held
+        # together or an interleaved pair fails on the vec0 primary key
+        with self.upsert_lock:
+            self.execute_write(f"DELETE FROM {table} WHERE id IN ({ids})", event_ids)
+            self.execute_write(
+                f"INSERT INTO {table}(id, {column}) VALUES {values}", params
+            )

frigate/detectors/detection_runners.py

@@ -25,25 +25,31 @@ def is_arm64_platform() -> bool:
     return machine in ("aarch64", "arm64", "armv8", "armv7l")
 
 
-def get_ort_session_options(
-    is_complex_model: bool = False,
-) -> ort.SessionOptions | None:
+def get_ort_session_options(model_type: str | None = None) -> ort.SessionOptions | None:
     """Get ONNX Runtime session options with appropriate settings.
 
     Args:
-        is_complex_model: Whether the model needs basic optimization to avoid graph fusion issues.
+        model_type: Model being loaded, used to pin its graph optimization level.
 
     Returns:
-        SessionOptions with appropriate optimization level, or None for default settings.
+        SessionOptions with a pinned optimization level, or None for default settings.
     """
-    if is_complex_model:
-        sess_options = ort.SessionOptions()
-        sess_options.graph_optimization_level = (
-            ort.GraphOptimizationLevel.ORT_ENABLE_BASIC
-        )
-        return sess_options
+    # Import here to avoid circular imports
+    from frigate.embeddings.types import EnrichmentModelTypeEnum
 
-    return None
+    if model_type == EnrichmentModelTypeEnum.jina_v2.value:
+        # below EXTENDED the CUDA EP returns an identical vector for every image,
+        # and ORT_ENABLE_ALL fails to build on CPU with a SimplifiedLayerNormFusion error
+        level = ort.GraphOptimizationLevel.ORT_ENABLE_EXTENDED
+    elif model_type == EnrichmentModelTypeEnum.jina_v1.value:
+        # aggressive optimizations create or expect nodes that don't exist
+        level = ort.GraphOptimizationLevel.ORT_ENABLE_BASIC
+    else:
+        return None
+
+    sess_options = ort.SessionOptions()
+    sess_options.graph_optimization_level = level
+    return sess_options
 
 
 # Import OpenVINO only when needed to avoid circular dependencies
@@ -115,21 +121,6 @@ class BaseModelRunner(ABC):
 class ONNXModelRunner(BaseModelRunner):
     """Run ONNX models using ONNX Runtime."""
 
-    @staticmethod
-    def is_cpu_complex_model(model_type: str) -> bool:
-        """Check if model needs basic optimization level to avoid graph fusion issues.
-
-        Some models (like Jina-CLIP) have issues with aggressive optimizations like
-        SimplifiedLayerNormFusion that create or expect nodes that don't exist.
-        """
-        # Import here to avoid circular imports
-        from frigate.embeddings.types import EnrichmentModelTypeEnum
-
-        return model_type in [
-            EnrichmentModelTypeEnum.jina_v1.value,
-            EnrichmentModelTypeEnum.jina_v2.value,
-        ]
-
     @staticmethod
     def is_migraphx_complex_model(model_type: str) -> bool:
         # Import here to avoid circular imports
@@ -208,15 +199,20 @@ class CudaGraphRunner(BaseModelRunner):
             EnrichmentModelTypeEnum.yolov9_license_plate.value,
         ]
 
+    # ORT performs two regular runs before it starts capturing, but on some
+    # driver / cuDNN combinations the arena still has to extend on the run that
+    # captures, and cudaMalloc is not allowed during capture. Running with
+    # capture disabled first keeps those allocations outside of the capture.
+    GRAPH_FREE_WARMUP_RUNS = 2
+
     def __init__(self, session: ort.InferenceSession, cuda_device_id: int):
         self._session = session
         self._cuda_device_id = cuda_device_id
-        self._captured = False
+        self._prepared = False
         self._io_binding: ort.IOBinding | None = None
         self._input_name: str | None = None
         self._output_names: list[str] | None = None
         self._input_ortvalue: ort.OrtValue | None = None
-        self._output_ortvalues: ort.OrtValue | None = None
 
     def get_input_names(self) -> list[str]:
         """Get input names for the model."""
@@ -226,35 +222,41 @@ class CudaGraphRunner(BaseModelRunner):
         """Get the input width of the model."""
         return self._session.get_inputs()[0].shape[3]
 
+    def _prepare(self, input_name: str, tensor_input: np.ndarray) -> None:
+        """Bind CUDA buffers and warm the session up with capture disabled."""
+        self._io_binding = self._session.io_binding()
+        self._input_name = input_name
+        self._output_names = [o.name for o in self._session.get_outputs()]
+
+        self._input_ortvalue = ort.OrtValue.ortvalue_from_numpy(
+            tensor_input, "cuda", self._cuda_device_id
+        )
+        self._io_binding.bind_ortvalue_input(self._input_name, self._input_ortvalue)
+
+        for name in self._output_names:
+            # Bind outputs to CUDA and allow ORT to allocate appropriately
+            self._io_binding.bind_output(name, "cuda", self._cuda_device_id)
+
+        # gpu_graph_id -1 disables capture and replay for the run
+        warmup_options = ort.RunOptions()
+        warmup_options.add_run_config_entry("gpu_graph_id", "-1")
+
+        for _ in range(self.GRAPH_FREE_WARMUP_RUNS):
+            self._session.run_with_iobinding(self._io_binding, warmup_options)
+
+        self._prepared = True
+
     def run(self, input: dict[str, Any]):
         # Extract the single tensor input (assuming one input)
         input_name = list(input.keys())[0]
-        tensor_input = input[input_name]
-        tensor_input = np.ascontiguousarray(tensor_input)
+        tensor_input = np.ascontiguousarray(input[input_name])
 
-        if not self._captured:
-            # Prepare IOBinding with CUDA buffers and let ORT allocate outputs on device
-            self._io_binding = self._session.io_binding()
-            self._input_name = input_name
-            self._output_names = [o.name for o in self._session.get_outputs()]
+        if not self._prepared:
+            self._prepare(input_name, tensor_input)
+        else:
+            # Replay using updated input
+            self._input_ortvalue.update_inplace(tensor_input)
 
-            self._input_ortvalue = ort.OrtValue.ortvalue_from_numpy(
-                tensor_input, "cuda", self._cuda_device_id
-            )
-            self._io_binding.bind_ortvalue_input(self._input_name, self._input_ortvalue)
-
-            for name in self._output_names:
-                # Bind outputs to CUDA and allow ORT to allocate appropriately
-                self._io_binding.bind_output(name, "cuda", self._cuda_device_id)
-
-            # First IOBinding run to allocate, execute, and capture CUDA Graph
-            ro = ort.RunOptions()
-            self._session.run_with_iobinding(self._io_binding, ro)
-            self._captured = True
-            return self._io_binding.copy_outputs_to_cpu()
-
-        # Replay using updated input, copy results to CPU
-        self._input_ortvalue.update_inplace(tensor_input)
         ro = ort.RunOptions()
         self._session.run_with_iobinding(self._io_binding, ro)
         return self._io_binding.copy_outputs_to_cpu()
@@ -323,6 +325,12 @@ class OpenVINOModelRunner(BaseModelRunner):
         if device in ["GPU", "AUTO", "NPU"]:
             self.ov_core.set_property(device, {"PERFORMANCE_HINT": "LATENCY"})
 
+        if device in ["GPU", "AUTO"]:
+            try:
+                self.ov_core.set_property("GPU", {"GPU_QUEUE_THROTTLE": "LOW"})
+            except Exception as e:
+                logger.debug(f"GPU_QUEUE_THROTTLE not supported: {e}")
+
         if device == "NPU" and OpenVINOModelRunner.is_detection_model(model_type):
             try:
                 self.ov_core.set_property(device, {"NPU_TURBO": "YES"})
@@ -626,9 +634,7 @@ def get_optimized_runner(
     return ONNXModelRunner(
         ort.InferenceSession(
             model_path,
-            sess_options=get_ort_session_options(
-                ONNXModelRunner.is_cpu_complex_model(model_type)
-            ),
+            sess_options=get_ort_session_options(model_type),
             providers=providers,
             provider_options=options,
         ),

frigate/embeddings/__init__.py

@@ -21,6 +21,7 @@ from frigate.db.sqlitevecq import SqliteVecQueueDatabase
 from frigate.models import Event
 from frigate.util.builtin import serialize
 from frigate.util.classification import kickoff_model_training
+from frigate.util.path import safe_join
 from frigate.util.process import FrigateProcess
 
 from .maintainer import EmbeddingMaintainer
@@ -33,7 +34,7 @@ class EmbeddingProcess(FrigateProcess):
     def __init__(
         self,
         config: FrigateConfig,
-        metrics: DataProcessorMetrics | None,
+        metrics: DataProcessorMetrics,
         stop_event: MpEvent,
     ) -> None:
         super().__init__(
@@ -234,11 +235,16 @@ class EmbeddingsContext:
         )
 
     def delete_face_ids(self, face: str, ids: list[str]) -> None:
-        folder = os.path.join(FACE_DIR, face)
-        for id in ids:
-            file_path = os.path.join(folder, id)
+        folder = safe_join(FACE_DIR, face)
 
-            if os.path.isfile(file_path):
+        if folder is None:
+            logger.warning("Not deleting faces for invalid name %s", face)
+            return
+
+        for id in ids:
+            file_path = safe_join(folder, id)
+
+            if file_path and os.path.isfile(file_path):
                 os.unlink(file_path)
 
         if face != "train" and len(os.listdir(folder)) == 0:

frigate/embeddings/embeddings.py

@@ -6,9 +6,10 @@ import logging
 import os
 import threading
 import time
+from typing import Any
 
 import numpy as np
-from peewee import DoesNotExist, IntegrityError
+from peewee import DatabaseError, DoesNotExist, IntegrityError
 from PIL import Image
 from playhouse.shortcuts import model_to_dict
 
@@ -207,12 +208,10 @@ class Embeddings:
         embedding = self.vision_embedding([thumbnail])[0]
 
         if upsert:
-            self.db.execute_sql(
-                """
-                INSERT OR REPLACE INTO vec_thumbnails(id, thumbnail_embedding)
-                VALUES(?, ?)
-                """,
-                (event_id, serialize(embedding)),
+            self.db.upsert_embeddings(
+                "vec_thumbnails",
+                "thumbnail_embedding",
+                {event_id: serialize(embedding)},
             )
 
         self.image_inference_speed.update(datetime.datetime.now().timestamp() - start)
@@ -251,19 +250,12 @@ class Embeddings:
         embeddings = self.vision_embedding(valid_thumbs)
 
         if upsert:
-            items = []
+            items = {}
             for i in range(len(valid_ids)):
-                items.append(valid_ids[i])
-                items.append(serialize(embeddings[i]))
+                items[valid_ids[i]] = serialize(embeddings[i])
                 self.image_eps.update()
 
-            self.db.execute_sql(
-                """
-                INSERT OR REPLACE INTO vec_thumbnails(id, thumbnail_embedding)
-                VALUES {}
-                """.format(", ".join(["(?, ?)"] * len(valid_ids))),
-                items,
-            )
+            self.db.upsert_embeddings("vec_thumbnails", "thumbnail_embedding", items)
 
         duration = datetime.datetime.now().timestamp() - start
         self.image_inference_speed.update(duration / len(valid_ids))
@@ -277,12 +269,10 @@ class Embeddings:
         embedding = self.text_embedding([description])[0]
 
         if upsert:
-            self.db.execute_sql(
-                """
-                INSERT OR REPLACE INTO vec_descriptions(id, description_embedding)
-                VALUES(?, ?)
-                """,
-                (event_id, serialize(embedding)),
+            self.db.upsert_embeddings(
+                "vec_descriptions",
+                "description_embedding",
+                {event_id: serialize(embedding)},
             )
 
         self.text_inference_speed.update(datetime.datetime.now().timestamp() - start)
@@ -302,19 +292,14 @@ class Embeddings:
 
         if upsert:
             ids = list(event_descriptions.keys())
-            items = []
+            items = {}
 
             for i in range(len(ids)):
-                items.append(ids[i])
-                items.append(serialize(embeddings[i]))
+                items[ids[i]] = serialize(embeddings[i])
                 self.text_eps.update()
 
-            self.db.execute_sql(
-                """
-                INSERT OR REPLACE INTO vec_descriptions(id, description_embedding)
-                VALUES {}
-                """.format(", ".join(["(?, ?)"] * len(ids))),
-                items,
+            self.db.upsert_embeddings(
+                "vec_descriptions", "description_embedding", items
             )
 
         self.text_inference_speed.update(datetime.datetime.now().timestamp() - start)
@@ -322,6 +307,17 @@ class Embeddings:
         return embeddings
 
     def reindex(self) -> None:
+        """Rebuild every tracked object embedding from scratch."""
+        totals: dict[str, Any] = {"status": "indexing"}
+
+        try:
+            self._reindex(totals)
+        except DatabaseError:
+            logger.exception("Unable to reindex tracked object embeddings")
+            totals["status"] = "failed"
+            self.requestor.send_data(UPDATE_EMBEDDINGS_REINDEX_PROGRESS, totals)
+
+    def _reindex(self, totals: dict[str, Any]) -> None:
         logger.info("Indexing tracked object embeddings...")
 
         self.db.drop_embeddings_tables()
@@ -346,14 +342,18 @@ class Embeddings:
             batch_size = 32
         current_page = 1
 
-        totals = {
-            "thumbnails": 0,
-            "descriptions": 0,
-            "processed_objects": total_events - 1 if total_events < batch_size else 0,
-            "total_objects": total_events,
-            "time_remaining": 0 if total_events < batch_size else -1,
-            "status": "indexing",
-        }
+        totals.update(
+            {
+                "thumbnails": 0,
+                "descriptions": 0,
+                "processed_objects": total_events - 1
+                if total_events < batch_size
+                else 0,
+                "total_objects": total_events,
+                "time_remaining": 0 if total_events < batch_size else -1,
+                "status": "indexing",
+            }
+        )
 
         self.requestor.send_data(UPDATE_EMBEDDINGS_REINDEX_PROGRESS, totals)
 

frigate/embeddings/maintainer.py

@@ -78,6 +78,16 @@ logger = logging.getLogger(__name__)
 
 MAX_THUMBNAILS = 10
 
+GENAI_UPDATE_TOPICS = frozenset(
+    {
+        CameraConfigUpdateEnum.add.name,
+        CameraConfigUpdateEnum.objects.name,
+        CameraConfigUpdateEnum.object_genai.name,
+        CameraConfigUpdateEnum.review.name,
+        CameraConfigUpdateEnum.review_genai.name,
+    }
+)
+
 
 class EmbeddingMaintainer(threading.Thread):
     """Handle embedding queue and post event updates."""
@@ -85,7 +95,7 @@ class EmbeddingMaintainer(threading.Thread):
     def __init__(
         self,
         config: FrigateConfig,
-        metrics: DataProcessorMetrics | None,
+        metrics: DataProcessorMetrics,
         stop_event: MpEvent,
     ) -> None:
         super().__init__(name="embeddings_maintainer")
@@ -220,16 +230,6 @@ class EmbeddingMaintainer(threading.Thread):
         # post processors
         self.post_processors: list[PostProcessorApi] = []
 
-        if any(c.review.genai.enabled_in_config for c in self.config.cameras.values()):
-            self.post_processors.append(
-                ReviewDescriptionProcessor(
-                    self.config,
-                    self.requestor,
-                    self.metrics,
-                    self.genai_manager,
-                )
-            )
-
         if self.config.lpr.enabled:
             self.post_processors.append(
                 LicensePlatePostProcessor(
@@ -252,9 +252,9 @@ class EmbeddingMaintainer(threading.Thread):
                 )
             )
 
-        semantic_trigger_processor: SemanticTriggerProcessor | None = None
+        self.semantic_trigger_processor: SemanticTriggerProcessor | None = None
         if self.config.semantic_search.enabled:
-            semantic_trigger_processor = SemanticTriggerProcessor(
+            self.semantic_trigger_processor = SemanticTriggerProcessor(
                 db,
                 self.config,
                 self.requestor,
@@ -262,9 +262,49 @@ class EmbeddingMaintainer(threading.Thread):
                 metrics,
                 self.embeddings,
             )
-            self.post_processors.append(semantic_trigger_processor)
+            self.post_processors.append(self.semantic_trigger_processor)
 
-        if any(c.objects.genai.enabled_in_config for c in self.config.cameras.values()):
+        self._sync_genai_processors()
+
+        self.stop_event = stop_event
+
+        # recordings data
+        self.recordings_available_through: dict[str, float] = {}
+
+    def _sync_genai_processors(self) -> None:
+        """Create GenAI post processors for cameras that have GenAI enabled.
+
+        Called at startup and again after camera config updates so enabling
+        GenAI on the first camera does not require a restart. Processors are
+        never removed once created.
+
+        A profile can turn GenAI on without setting enabled_in_config, so both
+        flags are checked.
+        """
+        cameras = self.config.cameras.values()
+
+        if any(
+            c.review.genai.enabled or c.review.genai.enabled_in_config for c in cameras
+        ) and not any(
+            isinstance(p, ReviewDescriptionProcessor) for p in self.post_processors
+        ):
+            logger.debug("Initializing review description processor")
+            self.post_processors.append(
+                ReviewDescriptionProcessor(
+                    self.config,
+                    self.requestor,
+                    self.metrics,
+                    self.genai_manager,
+                )
+            )
+
+        if any(
+            c.objects.genai.enabled or c.objects.genai.enabled_in_config
+            for c in cameras
+        ) and not any(
+            isinstance(p, ObjectDescriptionProcessor) for p in self.post_processors
+        ):
+            logger.debug("Initializing object description processor")
             self.post_processors.append(
                 ObjectDescriptionProcessor(
                     self.config,
@@ -272,19 +312,21 @@ class EmbeddingMaintainer(threading.Thread):
                     self.requestor,
                     self.metrics,
                     self.genai_manager,
-                    semantic_trigger_processor,
+                    self.semantic_trigger_processor,
                 )
             )
 
-        self.stop_event = stop_event
+    def _check_camera_config_updates(self) -> None:
+        """Apply camera config updates and register newly enabled processors."""
+        updated_topics = self.config_updater.check_for_updates()
 
-        # recordings data
-        self.recordings_available_through: dict[str, float] = {}
+        if updated_topics.keys() & GENAI_UPDATE_TOPICS:
+            self._sync_genai_processors()
 
     def run(self) -> None:
         """Maintain a SQLite-vec database for semantic search."""
         while not self.stop_event.is_set():
-            self.config_updater.check_for_updates()
+            self._check_camera_config_updates()
             self._check_enrichment_config_updates()
             self._process_requests()
             self._process_updates()

frigate/ffmpeg_presets.py

@@ -121,8 +121,8 @@ PRESETS_HW_ACCEL_SCALE = {
     "preset-rpi-64-h264": "-r {0} -vf fps={0},scale={1}:{2}",
     "preset-rpi-64-h265": "-r {0} -vf fps={0},scale={1}:{2}",
     FFMPEG_HWACCEL_VAAPI: "-r {0} -vf fps={0},scale_vaapi=w={1}:h={2},hwdownload,format=nv12",
-    "preset-intel-qsv-h264": "-r {0} -vf vpp_qsv=w={1}:h={2}:format=nv12,hwdownload,format=nv12,fps={0},format=yuv420p",
-    "preset-intel-qsv-h265": "-r {0} -vf vpp_qsv=w={1}:h={2}:format=nv12,hwdownload,format=nv12,fps={0},format=yuv420p",
+    "preset-intel-qsv-h264": "-r {0} -vf fps={0},vpp_qsv=w={1}:h={2}:format=nv12,hwdownload,format=nv12,format=yuv420p",
+    "preset-intel-qsv-h265": "-r {0} -vf fps={0},vpp_qsv=w={1}:h={2}:format=nv12,hwdownload,format=nv12,format=yuv420p",
     FFMPEG_HWACCEL_NVIDIA: "-r {0} -vf fps={0},scale_cuda=w={1}:h={2},hwdownload,format=nv12",
     "preset-jetson-h264": "-r {0}",  # scaled in decoder
     "preset-jetson-h265": "-r {0}",  # scaled in decoder

frigate/genai/plugins/gemini.py

@@ -245,7 +245,7 @@ class GeminiClient(GenAIClient):
                     )
                     gemini_messages.append(
                         types.Content(
-                            role="function",
+                            role="user",
                             parts=[
                                 types.Part.from_function_response(
                                     name=msg.get("name")
@@ -501,7 +501,7 @@ class GeminiClient(GenAIClient):
                     )
                     gemini_messages.append(
                         types.Content(
-                            role="function",
+                            role="user",
                             parts=[
                                 types.Part.from_function_response(
                                     name=msg.get("name")

frigate/jobs/debug_replay.py

@@ -115,6 +115,10 @@ def query_recordings(source_camera: str, start_ts: float, end_ts: float) -> Mode
     return cast(ModelSelect, query)
 
 
+class NoRecordingsError(ValueError):
+    """Raised when no recordings exist in the requested time range."""
+
+
 class DebugReplaySource(ABC):
     """Abstract source for a debug replay session.
 
@@ -187,7 +191,7 @@ class RecordingDebugReplaySource(DebugReplaySource):
             raise ValueError("End time must be after start time")
 
         if not query_recordings(self._camera, self._start_ts, self._end_ts).count():
-            raise ValueError(
+            raise NoRecordingsError(
                 f"No recordings found for camera '{self._camera}' in the specified time range"
             )
 

frigate/record/export.py

@@ -36,8 +36,9 @@ from frigate.util.time import is_current_hour
 logger = logging.getLogger(__name__)
 
 
+DEFAULT_TIME_LAPSE_FFMPEG_INPUT_ARGS = "-an"
 DEFAULT_TIME_LAPSE_FFMPEG_ARGS = "-vf setpts=0.04*PTS -r 30"
-TIMELAPSE_DATA_INPUT_ARGS = "-an -skip_frame nokey"
+TIMELAPSE_DATA_INPUT_ARGS = "-skip_frame nokey"
 
 # Matches the setpts factor used in timelapse exports (e.g. setpts=0.04*PTS).
 # Captures the floating-point factor so we can scale expected duration.
@@ -737,7 +738,7 @@ class RecordingExporter(threading.Thread):
                 parse_preset_hardware_acceleration_encode(
                     self.config.ffmpeg.ffmpeg_path,
                     hwaccel_args,
-                    f"{self.ffmpeg_input_args} -an {ffmpeg_input}".strip(),
+                    f"{self.ffmpeg_input_args} {ffmpeg_input}".strip(),
                     f"{self.ffmpeg_output_args} -movflags +faststart".strip(),
                     EncodeTypeEnum.timelapse,
                 )

frigate/review/maintainer.py

@@ -392,6 +392,32 @@ class ReviewSegmentMaintainer(threading.Thread):
             return self._publish_segment_end(segment, prev_data)
         return None
 
+    def get_manual_event_severity(self, camera: str, label: str) -> SeverityEnum | None:
+        """Determine the review severity for a manual event label.
+
+        Alert labels take precedence over detection labels, matching how
+        tracked objects are categorized. Labels in neither list default to
+        alerts so manual events keep their historical severity.
+        """
+        review_config = self.config.cameras[camera].review
+        # label contains 'label: sub_label', only the label is categorized
+        label = label.split(": ")[0]
+
+        if review_config.alerts.enabled and label in review_config.alerts.labels:
+            return SeverityEnum.alert
+
+        if (
+            review_config.detections.enabled
+            and review_config.detections.labels is not None
+            and label in review_config.detections.labels
+        ):
+            return SeverityEnum.detection
+
+        if review_config.alerts.enabled:
+            return SeverityEnum.alert
+
+        return None
+
     def update_existing_segment(
         self,
         segment: PendingReviewSegment,
@@ -734,24 +760,19 @@ class ReviewSegmentMaintainer(threading.Thread):
                             manual_info["label"]
                         )
                         if topic == DetectionTypeEnum.api:
-                            # manual_info["label"] contains 'label: sub_label'
-                            # so split out the label without modifying manual_info
-                            det_labels = self.config.cameras[
-                                camera
-                            ].review.detections.labels
-                            if (
-                                self.config.cameras[camera].review.detections.enabled
-                                and det_labels is not None
-                                and manual_info["label"].split(": ")[0] in det_labels
-                            ):
-                                current_segment.last_detection_time = manual_info[
-                                    "end_time"
-                                ]
-                            elif self.config.cameras[camera].review.alerts.enabled:
+                            severity = self.get_manual_event_severity(
+                                camera, manual_info["label"]
+                            )
+
+                            if severity == SeverityEnum.alert:
                                 current_segment.severity = SeverityEnum.alert
                                 current_segment.last_alert_time = manual_info[
                                     "end_time"
                                 ]
+                            elif severity == SeverityEnum.detection:
+                                current_segment.last_detection_time = manual_info[
+                                    "end_time"
+                                ]
                         elif (
                             topic == DetectionTypeEnum.lpr
                             and self.config.cameras[camera].review.detections.enabled
@@ -765,21 +786,12 @@ class ReviewSegmentMaintainer(threading.Thread):
                         current_segment.detections[manual_info["event_id"]] = (
                             manual_info["label"]
                         )
-                        if (
-                            topic == DetectionTypeEnum.api
-                            and self.config.cameras[camera].review.alerts.enabled
-                        ):
-                            # manual_info["label"] contains 'label: sub_label'
-                            # so split out the label without modifying manual_info
-                            det_labels = self.config.cameras[
-                                camera
-                            ].review.detections.labels
+                        if topic == DetectionTypeEnum.api:
                             if (
-                                not self.config.cameras[
-                                    camera
-                                ].review.detections.enabled
-                                or det_labels is None
-                                or manual_info["label"].split(": ")[0] not in det_labels
+                                self.get_manual_event_severity(
+                                    camera, manual_info["label"]
+                                )
+                                == SeverityEnum.alert
                             ):
                                 current_segment.severity = SeverityEnum.alert
                         elif (
@@ -853,18 +865,9 @@ class ReviewSegmentMaintainer(threading.Thread):
                             detections,
                         )
                 elif topic == DetectionTypeEnum.api:
-                    severity = None
-                    # manual_info["label"] contains 'label: sub_label'
-                    # so split out the label without modifying manual_info
-                    det_labels = self.config.cameras[camera].review.detections.labels
-                    if (
-                        self.config.cameras[camera].review.detections.enabled
-                        and det_labels is not None
-                        and manual_info["label"].split(": ")[0] in det_labels
-                    ):
-                        severity = SeverityEnum.detection
-                    elif self.config.cameras[camera].review.alerts.enabled:
-                        severity = SeverityEnum.alert
+                    severity = self.get_manual_event_severity(
+                        camera, manual_info["label"]
+                    )
 
                     if severity:
                         api_segment = PendingReviewSegment(

frigate/stats/util.py

@@ -62,7 +62,7 @@ def get_latest_version(config: FrigateConfig) -> str:
 def stats_init(
     config: FrigateConfig,
     camera_metrics: DictProxy,
-    embeddings_metrics: DataProcessorMetrics | None,
+    embeddings_metrics: DataProcessorMetrics,
     detectors: dict[str, ObjectDetectProcess],
     processes: dict[str, int],
 ) -> StatsTrackingTypes:
@@ -352,8 +352,9 @@ def stats_snapshot(
     total_camera_fps = total_process_fps = total_skipped_fps = total_detection_fps = 0
 
     stats["cameras"] = {}
-    for name, camera_stats in camera_metrics.items():
-        if name not in config.cameras:
+    for name, camera_stats in list(camera_metrics.items()):
+        camera_config = config.cameras.get(name)
+        if camera_config is None:
             continue
 
         total_camera_fps += camera_stats.camera_fps.value
@@ -370,7 +371,7 @@ def stats_snapshot(
         # Calculate connection quality based on current state
         # This is computed at stats-collection time so offline cameras
         # correctly show as unusable rather than excellent
-        expected_fps = config.cameras[name].detect.fps
+        expected_fps = camera_config.detect.fps
         current_fps = camera_stats.camera_fps.value
         reconnects = camera_stats.reconnects_last_hour.value
         stalls = camera_stats.stalls_last_hour.value
@@ -398,7 +399,7 @@ def stats_snapshot(
             "process_fps": round(camera_stats.process_fps.value, 2),
             "skipped_fps": round(camera_stats.skipped_fps.value, 2),
             "detection_fps": round(camera_stats.detection_fps.value, 2),
-            "detection_enabled": config.cameras[name].detect.enabled,
+            "detection_enabled": camera_config.detect.enabled,
             "pid": pid,
             "capture_pid": capture_pid,
             "ffmpeg_pid": ffmpeg_pid,

frigate/test/http_api/test_debug_replay_api.py

@@ -2,6 +2,7 @@
 
 from unittest.mock import patch
 
+from frigate.jobs.debug_replay import NoRecordingsError
 from frigate.models import Event, Recordings, ReviewSegment
 from frigate.test.http_api.base_http_test import AuthTestClient, BaseTestHttp
 
@@ -66,6 +67,32 @@ class TestDebugReplayAPI(BaseTestHttp):
         # (CodeQL: information exposure through an exception).
         self.assertEqual(body["message"], "Invalid debug replay parameters")
 
+    def test_start_returns_404_when_no_recordings(self):
+        with patch(
+            "frigate.api.debug_replay.start_debug_replay_job",
+            side_effect=NoRecordingsError(
+                "No recordings found for camera 'front' in the specified time range"
+            ),
+        ):
+            with AuthTestClient(self.app) as client:
+                resp = client.post(
+                    "/debug_replay/start",
+                    json={
+                        "camera": "front",
+                        "start_time": 100,
+                        "end_time": 200,
+                    },
+                )
+
+        self.assertEqual(resp.status_code, 404)
+        body = resp.json()
+        self.assertFalse(body["success"])
+        # Message is hard-coded so we don't echo exception text back to clients
+        # (CodeQL: information exposure through an exception).
+        self.assertEqual(
+            body["message"], "No recordings found in the selected time range"
+        )
+
     def test_start_returns_409_when_session_already_active(self):
         with patch(
             "frigate.api.debug_replay.start_debug_replay_job",

frigate/test/http_api/test_http_camera_access.py

@@ -440,3 +440,68 @@ class TestGo2rtcStreamAccess(BaseTestHttp):
             f"limited_user should be denied on alias back_door_main; "
             f"got {resp.status_code}"
         )
+
+
+class TestReviewSummaryAccess(BaseTestHttp):
+    """Tests for POST /review/summarize/start/{start_ts}/end/{end_ts}.
+
+    The summary correlates each flagged event with overlapping activity on
+    other cameras, so it is gated on full camera access rather than scoped to
+    the caller's cameras. These tests pin that decision so the dependency is
+    not loosened without first scoping the query.
+
+    GenAI is not configured in unit tests, so an authorized request returns 400
+    while an unauthorized one is rejected with 403 before the handler runs.
+    """
+
+    def setUp(self):
+        super().setUp([Event, ReviewSegment, Recordings])
+        self.minimal_config = _MULTI_CAMERA_CONFIG
+        self.app = super().create_app()
+
+    def tearDown(self):
+        self.app.dependency_overrides.clear()
+        super().tearDown()
+
+    def _summarize(self, allowed_cameras: list[str]):
+        async def mock_cameras(request: Request):
+            return allowed_cameras
+
+        self.app.dependency_overrides[get_allowed_cameras_for_filter] = mock_cameras
+        with AuthTestClient(self.app) as client:
+            return client.post("/review/summarize/start/0/end/9999999999")
+
+    def _assert_allowed(self, resp):
+        assert resp.status_code not in (401, 403), (
+            f"Caller should not be blocked; got {resp.status_code}"
+        )
+
+    def test_partial_camera_access_blocked(self):
+        assert self._summarize(["front_door"]).status_code == 403
+
+    def test_no_camera_access_blocked(self):
+        assert self._summarize([]).status_code == 403
+
+    def test_full_camera_access_allowed(self):
+        # Covers admin and viewer, which always resolve to every camera, and a
+        # custom role whose list happens to name them all.
+        self._assert_allowed(self._summarize(["front_door", "back_door"]))
+
+    def _summarize_as_role(self, role: str):
+        """Summarize using the real role to allowed-cameras resolution."""
+        self.app.dependency_overrides.pop(get_allowed_cameras_for_filter, None)
+        with AuthTestClient(self.app) as client:
+            return client.post(
+                "/review/summarize/start/0/end/9999999999",
+                headers={"remote-user": "test", "remote-role": role},
+            )
+
+    def test_viewer_role_allowed(self):
+        # viewer is never camera restricted, so it resolves to every camera.
+        self._assert_allowed(self._summarize_as_role("viewer"))
+
+    def test_admin_role_allowed(self):
+        self._assert_allowed(self._summarize_as_role("admin"))
+
+    def test_restricted_role_blocked(self):
+        assert self._summarize_as_role("limited_user").status_code == 403

frigate/test/http_api/test_http_classification_traversal.py

@@ -0,0 +1,73 @@
+"""End to end checks that classification endpoints cannot escape their base dir."""
+
+import os
+import shutil
+import tempfile
+from unittest.mock import patch
+
+from frigate.models import Event
+from frigate.test.http_api.base_http_test import AuthTestClient, BaseTestHttp
+
+# Percent encodings that survive nginx normalization. nginx collapses a bare
+# ".." segment, but "..:" and friends are not relative segments to nginx while
+# pathvalidate still reduces them to exactly "..".
+TRAVERSAL_NAMES = ["..%3A", "..%2A", "..%3C", "..%7C", "..%20", ".."]
+
+
+class TestHttpClassificationTraversal(BaseTestHttp):
+    def setUp(self):
+        super().setUp([Event])
+        self.app = super().create_app()
+
+        self.root = tempfile.mkdtemp()
+        self.clips = os.path.join(self.root, "clips")
+        self.model_cache = os.path.join(self.root, "model_cache")
+        os.makedirs(os.path.join(self.clips, "model1"))
+        os.makedirs(os.path.join(self.model_cache, "model1"))
+        os.makedirs(os.path.join(self.root, "recordings"))
+
+        # Sibling data that a "/.." escape from clips would reach.
+        self.canary = os.path.join(self.root, "recordings", "seg.mp4")
+
+        with open(self.canary, "w") as f:
+            f.write("recording")
+
+        clips_patch = patch("frigate.api.classification.CLIPS_DIR", self.clips)
+        cache_patch = patch(
+            "frigate.api.classification.MODEL_CACHE_DIR", self.model_cache
+        )
+        clips_patch.start()
+        cache_patch.start()
+        self.addCleanup(clips_patch.stop)
+        self.addCleanup(cache_patch.stop)
+
+    def tearDown(self):
+        shutil.rmtree(self.root, ignore_errors=True)
+        self.app.dependency_overrides.clear()
+        super().tearDown()
+
+    def test_delete_model_rejects_traversal_names(self):
+        client = AuthTestClient(self.app)
+
+        for name in TRAVERSAL_NAMES:
+            with self.subTest(name=name):
+                response = client.delete(f"/classification/{name}")
+
+                # Either the router never matches it or the handler rejects it,
+                # but the sibling directory must survive either way.
+                self.assertNotEqual(response.status_code, 200)
+                self.assertTrue(
+                    os.path.exists(self.canary),
+                    f"{name} deleted data outside the clips directory",
+                )
+                self.assertTrue(os.path.exists(os.path.join(self.root, "recordings")))
+
+    def test_delete_model_still_removes_its_own_directories(self):
+        client = AuthTestClient(self.app)
+
+        response = client.delete("/classification/model1")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertFalse(os.path.exists(os.path.join(self.clips, "model1")))
+        self.assertFalse(os.path.exists(os.path.join(self.model_cache, "model1")))
+        self.assertTrue(os.path.exists(self.canary))

frigate/test/http_api/test_http_event.py

@@ -168,6 +168,29 @@ class TestHttpApp(BaseTestHttp):
             assert events[0]["id"] == id
             assert events[1]["id"] == id2
 
+    def test_get_event_list_offset_pages_score_sort(self):
+        now = datetime.now().timestamp()
+        scores = [0.6, 0.9, 0.7, 0.95, 0.8]
+
+        with AuthTestClient(self.app) as client:
+            for i, score in enumerate(scores):
+                super().insert_mock_event(
+                    f"event-{i}", start_time=now + i, data={"score": score}
+                )
+
+            params = {"sort": "score_desc"}
+            full = [e["id"] for e in client.get("/events", params=params).json()]
+            paged = [
+                e["id"]
+                for offset in (0, 2, 4)
+                for e in client.get(
+                    "/events", params={**params, "limit": 2, "offset": offset}
+                ).json()
+            ]
+
+            assert full == ["event-3", "event-1", "event-4", "event-2", "event-0"]
+            assert paged == full
+
     def test_get_event_list_match_multilingual_attribute(self):
         event_id = "123456.zh"
         attribute = "中文标签"
@@ -219,6 +242,85 @@ class TestHttpApp(BaseTestHttp):
             assert len(events) == 1
             assert events[0]["id"] == event_id
 
+    def test_events_search_offset_pages_score_sort(self):
+        now = datetime.now().timestamp()
+        scores = [0.6, 0.9, 0.7, 0.95, 0.8]
+        ids = [f"event-{i}" for i in range(len(scores))]
+        mock_embeddings = Mock()
+        mock_embeddings.search_thumbnail.return_value = [
+            (event_id, 0.1 * i) for i, event_id in enumerate(ids)
+        ]
+
+        self.app.frigate_config.semantic_search.enabled = True
+        self.app.embeddings = mock_embeddings
+
+        with AuthTestClient(self.app) as client:
+            for i, score in enumerate(scores):
+                super().insert_mock_event(
+                    ids[i], start_time=now + i, data={"score": score}
+                )
+
+            params = {
+                "search_type": "similarity",
+                "event_id": ids[0],
+                "sort": "score_desc",
+            }
+            paged = [
+                e["id"]
+                for offset in (0, 2, 4)
+                for e in client.get(
+                    "/events/search",
+                    params={**params, "limit": 2, "offset": offset},
+                ).json()
+            ]
+
+            assert paged == ["event-3", "event-1", "event-4", "event-2", "event-0"]
+
+    def test_events_search_offset_pages_orders_ties_by_id(self):
+        now = datetime.now().timestamp()
+        ids = ["event-c", "event-a", "event-b"]
+        mock_embeddings = Mock()
+        mock_embeddings.search_thumbnail.return_value = [
+            (event_id, 0.1) for event_id in ids
+        ]
+
+        self.app.frigate_config.semantic_search.enabled = True
+        self.app.embeddings = mock_embeddings
+
+        with AuthTestClient(self.app) as client:
+            for i, event_id in enumerate(ids):
+                super().insert_mock_event(
+                    event_id, start_time=now + i, data={"score": 0.8}
+                )
+
+            for sort in ("score_desc", "relevance"):
+                params = {
+                    "search_type": "similarity",
+                    "event_id": ids[0],
+                    "sort": sort,
+                }
+                paged = [
+                    e["id"]
+                    for offset in (0, 1, 2)
+                    for e in client.get(
+                        "/events/search",
+                        params={**params, "limit": 1, "offset": offset},
+                    ).json()
+                ]
+
+                assert paged == ["event-a", "event-b", "event-c"]
+
+    def test_event_list_rejects_negative_offset(self):
+        with AuthTestClient(self.app) as client:
+            response = client.get("/events", params={"offset": -5})
+            assert response.status_code == 422
+
+            response = client.get(
+                "/events/search",
+                params={"query": "car", "offset": -5},
+            )
+            assert response.status_code == 422
+
     def test_similarity_search_hides_unauthorized_anchor_event(self):
         mock_embeddings = Mock()
         self.app.frigate_config.semantic_search.enabled = True

frigate/test/http_api/test_http_export.py

@@ -1,5 +1,7 @@
+import io
 import os
 import tempfile
+import zipfile
 from unittest.mock import patch
 
 from frigate.jobs.export import (
@@ -1431,3 +1433,79 @@ class TestHttpExport(BaseTestHttp):
             )
 
         assert response.status_code == 403
+
+    def test_download_export_case_with_multibyte_name(self):
+        """A case name outside latin-1 must not break the response headers."""
+        case = ExportCase.create(
+            id="case_multibyte",
+            name="テスト事案",
+            description="",
+            created_at=10,
+            updated_at=10,
+        )
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            video_path = os.path.join(tmpdir, "multibyte_export.mp4")
+            with open(video_path, "wb") as handle:
+                handle.write(b"video")
+
+            Export.create(
+                id="export_multibyte",
+                camera="front_door",
+                name="現場カメラ",
+                date=100,
+                video_path=video_path,
+                thumb_path=os.path.join(tmpdir, "multibyte_export.webp"),
+                in_progress=False,
+                export_case=case,
+            )
+
+            with AuthTestClient(self.app) as client:
+                response = client.get(f"/cases/{case.id}/download")
+
+        assert response.status_code == 200
+        # RFC 5987/6266: the UTF-8 name rides in filename*, and a latin-1 safe
+        # fallback stays in filename for old clients.
+        assert response.headers["content-disposition"] == (
+            'attachment; filename="case_multibyte.zip"; '
+            "filename*=UTF-8''%E3%83%86%E3%82%B9%E3%83%88%E4%BA%8B%E6%A1%88.zip"
+        )
+
+        archive = zipfile.ZipFile(io.BytesIO(response.content))
+        assert archive.namelist() == ["現場カメラ.mp4"]
+
+    def test_download_export_case_with_ascii_name(self):
+        """An ASCII case name still gets a plain, readable filename."""
+        case = ExportCase.create(
+            id="case_ascii",
+            name="Burglary 2026-08",
+            description="",
+            created_at=10,
+            updated_at=10,
+        )
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            video_path = os.path.join(tmpdir, "ascii_export.mp4")
+            with open(video_path, "wb") as handle:
+                handle.write(b"video")
+
+            Export.create(
+                id="export_ascii",
+                camera="front_door",
+                name="Front door",
+                date=100,
+                video_path=video_path,
+                thumb_path=os.path.join(tmpdir, "ascii_export.webp"),
+                in_progress=False,
+                export_case=case,
+            )
+
+            with AuthTestClient(self.app) as client:
+                response = client.get(f"/cases/{case.id}/download")
+
+        assert response.status_code == 200
+        assert (
+            response.headers["content-disposition"]
+            == 'attachment; filename="Burglary 2026-08.zip"; '
+            "filename*=UTF-8''Burglary%202026-08.zip"
+        )

frigate/test/http_api/test_http_password.py

@@ -0,0 +1,113 @@
+"""Tests for password change authorization."""
+
+from fastapi import Request
+
+from frigate.api.auth import get_current_user, hash_password, verify_password
+from frigate.models import Event, Recordings, ReviewSegment, User
+from frigate.test.http_api.base_http_test import AuthTestClient, BaseTestHttp
+
+# Config carrying a custom role, which is the class of user the literal
+# "viewer" check used to let through.
+_CUSTOM_ROLE_CONFIG = {
+    "mqtt": {"host": "mqtt"},
+    "auth": {"roles": {"neighbor": ["front_door"]}, "hash_iterations": 10},
+    "cameras": {
+        "front_door": {
+            "ffmpeg": {
+                "inputs": [{"path": "rtsp://10.0.0.1:554/video", "roles": ["detect"]}]
+            },
+            "detect": {"height": 1080, "width": 1920, "fps": 5},
+        },
+    },
+}
+
+ADMIN_PASSWORD = "admin-real-password"
+NEW_PASSWORD = "AttackerChosenPassword123!"
+
+
+class TestUpdatePasswordAccess(BaseTestHttp):
+    def setUp(self):
+        super().setUp([Event, ReviewSegment, Recordings, User])
+        self.minimal_config = _CUSTOM_ROLE_CONFIG
+        self.app = super().create_app()
+        User.insert(
+            username="admin",
+            password_hash=hash_password(ADMIN_PASSWORD, iterations=10),
+            role="admin",
+            notification_tokens=[],
+        ).execute()
+
+        async def mock_get_current_user(request: Request):
+            return {
+                "username": request.headers.get("remote-user"),
+                "role": request.headers.get("remote-role"),
+            }
+
+        self.app.dependency_overrides[get_current_user] = mock_get_current_user
+
+    def tearDown(self):
+        self.app.dependency_overrides.clear()
+        super().tearDown()
+
+    def _change_password(self, actor: str, role: str, target: str, old_password: str):
+        with AuthTestClient(self.app) as client:
+            return client.put(
+                f"/users/{target}/password",
+                json={"password": NEW_PASSWORD, "old_password": old_password},
+                headers={"remote-user": actor, "remote-role": role},
+            )
+
+    def _admin_password_unchanged(self) -> bool:
+        return verify_password(ADMIN_PASSWORD, User.get_by_id("admin").password_hash)
+
+    def test_custom_role_cannot_target_another_account(self):
+        resp = self._change_password("neighbor", "neighbor", "admin", "wrong-guess")
+        assert resp.status_code == 403
+        assert self._admin_password_unchanged()
+
+    def test_custom_role_cannot_target_another_account_with_correct_password(self):
+        # The 403 must land before old_password is checked, so knowing the
+        # target's password is not a way through
+        resp = self._change_password("neighbor", "neighbor", "admin", ADMIN_PASSWORD)
+        assert resp.status_code == 403
+        assert self._admin_password_unchanged()
+
+    def test_viewer_cannot_target_another_account(self):
+        resp = self._change_password("viewer_user", "viewer", "admin", ADMIN_PASSWORD)
+        assert resp.status_code == 403
+        assert self._admin_password_unchanged()
+
+    def test_admin_can_target_another_account(self):
+        User.insert(
+            username="neighbor",
+            password_hash=hash_password("neighbor-password", iterations=10),
+            role="neighbor",
+            notification_tokens=[],
+        ).execute()
+
+        resp = self._change_password("admin", "admin", "neighbor", "")
+        assert resp.status_code == 200
+
+    def test_non_admin_can_change_own_password(self):
+        User.insert(
+            username="neighbor",
+            password_hash=hash_password("neighbor-password", iterations=10),
+            role="neighbor",
+            notification_tokens=[],
+        ).execute()
+
+        resp = self._change_password(
+            "neighbor", "neighbor", "neighbor", "neighbor-password"
+        )
+        assert resp.status_code == 200
+
+    def test_non_admin_own_password_still_requires_old_password(self):
+        User.insert(
+            username="neighbor",
+            password_hash=hash_password("neighbor-password", iterations=10),
+            role="neighbor",
+            notification_tokens=[],
+        ).execute()
+
+        resp = self._change_password("neighbor", "neighbor", "neighbor", "wrong-guess")
+        assert resp.status_code == 401

frigate/test/http_api/test_http_review.py

@@ -240,9 +240,101 @@ class TestHttpReview(BaseTestHttp):
             assert len(response_json) == 1
             assert response_json[0]["id"] == id_reviewed
 
+    def test_get_review_with_label_filter_matches_verified(self):
+        """Test that a label filter also matches the `-verified` variant."""
+        now = datetime.now().timestamp()
+
+        with AuthTestClient(self.app) as client:
+            super().insert_mock_review_segment(
+                "123456.person", now, now + 2, data={"objects": ["person"]}
+            )
+            super().insert_mock_review_segment(
+                "123456.verified", now, now + 2, data={"objects": ["person-verified"]}
+            )
+            super().insert_mock_review_segment(
+                "123456.car", now, now + 2, data={"objects": ["car"]}
+            )
+
+            params = {
+                "labels": "person",
+                "after": now - 1,
+                "before": now + 3,
+            }
+            response = client.get("/review", params=params)
+            assert response.status_code == 200
+            response_json = response.json()
+            assert {r["id"] for r in response_json} == {
+                "123456.person",
+                "123456.verified",
+            }
+
+    def test_get_review_with_label_filter_does_not_match_prefix(self):
+        """Test that a label filter does not match labels that only share a prefix."""
+        now = datetime.now().timestamp()
+
+        with AuthTestClient(self.app) as client:
+            super().insert_mock_review_segment(
+                "123456.carrot", now, now + 2, data={"objects": ["carrot"]}
+            )
+
+            params = {
+                "labels": "car",
+                "after": now - 1,
+                "before": now + 3,
+            }
+            response = client.get("/review", params=params)
+            assert response.status_code == 200
+            assert len(response.json()) == 0
+
+    def test_get_review_with_audio_label_filter(self):
+        """Test that a label filter still matches audio labels."""
+        now = datetime.now().timestamp()
+
+        with AuthTestClient(self.app) as client:
+            super().insert_mock_review_segment(
+                "123456.audio", now, now + 2, data={"audio": ["speech"]}
+            )
+
+            params = {
+                "labels": "speech",
+                "after": now - 1,
+                "before": now + 3,
+            }
+            response = client.get("/review", params=params)
+            assert response.status_code == 200
+            response_json = response.json()
+            assert len(response_json) == 1
+            assert response_json[0]["id"] == "123456.audio"
+
     ####################################################################################################################
     ###################################  GET /review/summary Endpoint   #################################################
     ####################################################################################################################
+    def test_get_review_summary_label_filter_matches_verified(self):
+        """Test that the summary label filter also matches the `-verified` variant."""
+        with AuthTestClient(self.app) as client:
+            super().insert_mock_review_segment(
+                "123456.verified", data={"objects": ["person-verified"]}
+            )
+            super().insert_mock_review_segment(
+                "123456.car", data={"objects": ["car"]}, severity=SeverityEnum.detection
+            )
+
+            params = {
+                "cameras": "front_door",
+                "labels": "person",
+                "zones": "all",
+                "timezone": "utc",
+            }
+            response = client.get("/review/summary", params=params)
+            assert response.status_code == 200
+            response_json = response.json()
+            assert response_json["last24Hours"]["total_alert"] == 1
+            assert response_json["last24Hours"]["total_detection"] == 0
+
+            today_formatted = datetime.today().strftime("%Y-%m-%d")
+            assert response_json[today_formatted]["total_alert"] == 1
+            assert response_json[today_formatted]["total_detection"] == 0
+
     def test_get_review_summary_all_filters(self):
         with AuthTestClient(self.app) as client:
             super().insert_mock_review_segment("123456.random")

frigate/test/test_debug_replay_job.py

@@ -9,6 +9,7 @@ from unittest.mock import MagicMock, patch
 from frigate.debug_replay import DebugReplayManager
 from frigate.jobs.debug_replay import (
     DebugReplayJob,
+    NoRecordingsError,
     RecordingDebugReplaySource,
     cancel_debug_replay_job,
     get_active_runner,
@@ -129,7 +130,7 @@ class TestStartDebugReplayJob(unittest.TestCase):
         empty_qs = MagicMock()
         empty_qs.count.return_value = 0
         with patch("frigate.jobs.debug_replay.query_recordings", return_value=empty_qs):
-            with self.assertRaises(ValueError):
+            with self.assertRaises(NoRecordingsError):
                 start_debug_replay_job(
                     source=RecordingDebugReplaySource(
                         source_camera="front",

frigate/test/test_detection_runners.py

@@ -0,0 +1,88 @@
+"""Tests for ONNX Runtime session option selection."""
+
+import unittest
+from unittest.mock import MagicMock, patch
+
+import numpy as np
+import onnxruntime as ort
+
+from frigate.detectors.detection_runners import (
+    CudaGraphRunner,
+    get_ort_session_options,
+)
+from frigate.detectors.detector_config import ModelTypeEnum
+from frigate.embeddings.types import EnrichmentModelTypeEnum
+
+
+class TestGetOrtSessionOptions(unittest.TestCase):
+    def test_jina_v2_uses_extended(self):
+        """jina-clip-v2 returns an identical vector for every image on the CUDA
+        execution provider at anything below EXTENDED."""
+        options = get_ort_session_options(EnrichmentModelTypeEnum.jina_v2.value)
+
+        self.assertIsNotNone(options)
+        self.assertEqual(
+            options.graph_optimization_level,
+            ort.GraphOptimizationLevel.ORT_ENABLE_EXTENDED,
+        )
+
+    def test_jina_v1_uses_basic(self):
+        options = get_ort_session_options(EnrichmentModelTypeEnum.jina_v1.value)
+
+        self.assertIsNotNone(options)
+        self.assertEqual(
+            options.graph_optimization_level,
+            ort.GraphOptimizationLevel.ORT_ENABLE_BASIC,
+        )
+
+    def test_other_models_use_defaults(self):
+        for model_type in [
+            None,
+            EnrichmentModelTypeEnum.paddleocr.value,
+            EnrichmentModelTypeEnum.arcface.value,
+            ModelTypeEnum.rfdetr.value,
+        ]:
+            with self.subTest(model_type=model_type):
+                self.assertIsNone(get_ort_session_options(model_type))
+
+
+class TestCudaGraphRunner(unittest.TestCase):
+    """CUDA graph capture fails if the arena has to allocate during capture, so
+    the session is warmed up with capture disabled before the first real run."""
+
+    def setUp(self):
+        self.session = MagicMock()
+        self.session.get_outputs.return_value = [MagicMock(name="output")]
+        self.io_binding = self.session.io_binding.return_value
+        self.input = {"images": np.zeros((1, 3, 320, 320), np.float32)}
+
+    def _annotations(self) -> list[str | None]:
+        """Graph annotation id passed with each run, None when unset."""
+        annotations = []
+
+        for call in self.session.run_with_iobinding.call_args_list:
+            try:
+                annotations.append(call.args[1].get_run_config_entry("gpu_graph_id"))
+            except RuntimeError:
+                annotations.append(None)
+
+        return annotations
+
+    def test_first_run_warms_up_with_capture_disabled(self):
+        with patch.object(ort.OrtValue, "ortvalue_from_numpy"):
+            CudaGraphRunner(self.session, 0).run(self.input)
+
+        self.assertEqual(
+            self._annotations(),
+            ["-1"] * CudaGraphRunner.GRAPH_FREE_WARMUP_RUNS + [None],
+        )
+
+    def test_later_runs_allow_capture(self):
+        with patch.object(ort.OrtValue, "ortvalue_from_numpy"):
+            runner = CudaGraphRunner(self.session, 0)
+            runner.run(self.input)
+            self.session.run_with_iobinding.reset_mock()
+            runner.run(self.input)
+
+        self.assertEqual(self._annotations(), [None])
+        runner._input_ortvalue.update_inplace.assert_called_once()

frigate/test/test_genai_processor_sync.py

@@ -0,0 +1,213 @@
+"""Tests for GenAI enablement gating in the embeddings maintainer.
+
+Covers creating post processors when GenAI is enabled at runtime, and the
+per-camera gating those processors apply once they exist.
+"""
+
+import sys
+import unittest
+from unittest.mock import MagicMock, patch
+
+# Mock TFLite before importing the maintainer
+_MOCK_MODULES = [
+    "tflite_runtime",
+    "tflite_runtime.interpreter",
+    "ai_edge_litert",
+    "ai_edge_litert.interpreter",
+]
+for mod in _MOCK_MODULES:
+    if mod not in sys.modules:
+        sys.modules[mod] = MagicMock()
+
+# imported from the maintainer to avoid tripping the circular import between
+# the maintainer and the processor modules
+from frigate.embeddings.maintainer import (  # noqa: E402
+    EmbeddingMaintainer,
+    ObjectDescriptionProcessor,
+    PostProcessDataEnum,
+    ReviewDescriptionProcessor,
+)
+
+
+class TestGenAIProcessorSync(unittest.TestCase):
+    """Enabling GenAI on the first camera must not require a restart."""
+
+    def _make_maintainer(
+        self,
+        review: bool = False,
+        objects: bool = False,
+        review_in_config: bool | None = None,
+        objects_in_config: bool | None = None,
+    ) -> EmbeddingMaintainer:
+        # Bypass the heavy __init__; only the attributes touched by
+        # _sync_genai_processors are needed for these tests.
+        maintainer = EmbeddingMaintainer.__new__(EmbeddingMaintainer)
+        maintainer.post_processors = []
+        maintainer.config = MagicMock()
+        maintainer.config.cameras = {
+            "front": self._make_camera(
+                review,
+                objects,
+                review if review_in_config is None else review_in_config,
+                objects if objects_in_config is None else objects_in_config,
+            )
+        }
+        maintainer.config_updater = MagicMock()
+        maintainer.embeddings = None
+        maintainer.requestor = MagicMock()
+        maintainer.metrics = MagicMock()
+        maintainer.genai_manager = MagicMock()
+        maintainer.semantic_trigger_processor = None
+        return maintainer
+
+    def _make_camera(
+        self,
+        review: bool,
+        objects: bool,
+        review_in_config: bool,
+        objects_in_config: bool,
+    ) -> MagicMock:
+        camera = MagicMock()
+        camera.review.genai.enabled = review
+        camera.review.genai.enabled_in_config = review_in_config
+        camera.objects.genai.enabled = objects
+        camera.objects.genai.enabled_in_config = objects_in_config
+        return camera
+
+    def _processor_types(self, maintainer: EmbeddingMaintainer) -> list[type]:
+        return [type(p) for p in maintainer.post_processors]
+
+    def test_no_processors_when_genai_disabled(self):
+        """A config with no GenAI cameras registers neither processor."""
+        maintainer = self._make_maintainer()
+
+        maintainer._sync_genai_processors()
+
+        self.assertEqual(maintainer.post_processors, [])
+
+    def test_review_processor_added_when_enabled_after_startup(self):
+        """Enabling review GenAI on the first camera registers the processor."""
+        maintainer = self._make_maintainer()
+        maintainer._sync_genai_processors()
+
+        camera = maintainer.config.cameras["front"]
+        camera.review.genai.enabled = True
+        camera.review.genai.enabled_in_config = True
+        maintainer._sync_genai_processors()
+
+        self.assertEqual(
+            self._processor_types(maintainer), [ReviewDescriptionProcessor]
+        )
+
+    def test_object_processor_added_when_enabled_after_startup(self):
+        """Enabling object GenAI on the first camera registers the processor."""
+        maintainer = self._make_maintainer()
+        maintainer._sync_genai_processors()
+
+        camera = maintainer.config.cameras["front"]
+        camera.objects.genai.enabled = True
+        camera.objects.genai.enabled_in_config = True
+        maintainer._sync_genai_processors()
+
+        self.assertEqual(
+            self._processor_types(maintainer), [ObjectDescriptionProcessor]
+        )
+
+    def test_processor_added_when_only_enabled_by_profile(self):
+        """A profile enables GenAI without setting enabled_in_config."""
+        maintainer = self._make_maintainer(
+            review=True, objects=True, review_in_config=False, objects_in_config=False
+        )
+
+        maintainer._sync_genai_processors()
+
+        self.assertEqual(
+            self._processor_types(maintainer),
+            [ReviewDescriptionProcessor, ObjectDescriptionProcessor],
+        )
+
+    def test_processors_are_not_duplicated(self):
+        """Repeated config updates must not register a second processor."""
+        maintainer = self._make_maintainer(review=True, objects=True)
+
+        maintainer._sync_genai_processors()
+        maintainer._sync_genai_processors()
+
+        self.assertEqual(
+            self._processor_types(maintainer),
+            [ReviewDescriptionProcessor, ObjectDescriptionProcessor],
+        )
+
+    def test_genai_topic_triggers_sync(self):
+        """A camera config update on a GenAI topic registers the processor."""
+        maintainer = self._make_maintainer(review=True)
+        maintainer.config_updater.check_for_updates.return_value = {"review": ["front"]}
+
+        maintainer._check_camera_config_updates()
+
+        self.assertEqual(
+            self._processor_types(maintainer), [ReviewDescriptionProcessor]
+        )
+
+    def test_unrelated_topic_does_not_sync(self):
+        """An unrelated camera config update must not register processors."""
+        maintainer = self._make_maintainer(review=True)
+        maintainer.config_updater.check_for_updates.return_value = {"motion": ["front"]}
+
+        maintainer._check_camera_config_updates()
+
+        self.assertEqual(maintainer.post_processors, [])
+
+
+class TestObjectDescriptionCameraGating(unittest.TestCase):
+    """One camera enabling object descriptions must not enlist the others."""
+
+    def _make_processor(self, enabled: bool) -> ObjectDescriptionProcessor:
+        config = MagicMock()
+        camera = MagicMock()
+        camera.objects.genai.enabled = enabled
+        camera.objects.genai.send_triggers.after_significant_updates = None
+        config.cameras = {"front": camera}
+
+        genai_manager = MagicMock()
+        genai_manager.description_client = MagicMock()
+
+        return ObjectDescriptionProcessor(
+            config, None, MagicMock(), MagicMock(), genai_manager, None
+        )
+
+    def _update(self, processor: ObjectDescriptionProcessor) -> None:
+        processor.process_data(
+            {
+                "camera": "front",
+                "data": {
+                    "id": "1234.5-abcdef",
+                    "box": (0, 0, 10, 10),
+                    "stationary": False,
+                },
+                "state": "update",
+                "yuv_frame": MagicMock(),
+            },
+            PostProcessDataEnum.tracked_object,
+        )
+
+    @patch("frigate.data_processing.post.object_descriptions.create_thumbnail")
+    def test_disabled_camera_collects_no_thumbnails(self, mock_create_thumbnail):
+        """A camera with object descriptions off does no thumbnail work."""
+        processor = self._make_processor(enabled=False)
+
+        self._update(processor)
+
+        mock_create_thumbnail.assert_not_called()
+        self.assertEqual(processor.tracked_events, {})
+
+    @patch("frigate.data_processing.post.object_descriptions.create_thumbnail")
+    def test_enabled_camera_collects_thumbnails(self, mock_create_thumbnail):
+        """A camera with object descriptions on still collects thumbnails."""
+        mock_create_thumbnail.return_value = b"jpg"
+        processor = self._make_processor(enabled=True)
+
+        self._update(processor)
+
+        mock_create_thumbnail.assert_called_once()
+        self.assertEqual(len(processor.tracked_events["1234.5-abcdef"]), 1)

frigate/test/test_review_manual_event_severity.py

@@ -0,0 +1,154 @@
+"""Tests for manual event severity categorization.
+
+Regression coverage for manual events created via the events API being
+categorized as detections when their label appears in both the alerts and
+detections label lists. Alert labels must win, matching how tracked objects
+are categorized, and labels in neither list must default to alerts so the
+historical behavior of the API is preserved.
+"""
+
+import unittest
+
+from frigate.config import FrigateConfig
+from frigate.review.maintainer import ReviewSegmentMaintainer
+from frigate.review.types import SeverityEnum
+
+BASE_CONFIG = """
+mqtt:
+  enabled: False
+cameras:
+  front_door:
+    ffmpeg:
+      inputs:
+        - path: rtsp://10.0.0.1:554/video
+          roles:
+            - detect
+    detect:
+      width: 1920
+      height: 1080
+      fps: 5
+%s
+"""
+
+
+class TestManualEventSeverity(unittest.TestCase):
+    def _make_maintainer(self, review_config: str = "") -> ReviewSegmentMaintainer:
+        """Build a maintainer without invoking __init__ (avoids needing ZMQ
+        sockets, shared memory, and clip dirs). Only the config is read when
+        categorizing a manual event label."""
+        maintainer = ReviewSegmentMaintainer.__new__(ReviewSegmentMaintainer)
+        maintainer.config = FrigateConfig.parse_yaml(BASE_CONFIG % review_config)
+        return maintainer
+
+    def test_defaults_to_alert(self) -> None:
+        maintainer = self._make_maintainer()
+
+        self.assertEqual(
+            maintainer.get_manual_event_severity("front_door", "person"),
+            SeverityEnum.alert,
+        )
+
+    def test_unlisted_label_defaults_to_alert(self) -> None:
+        maintainer = self._make_maintainer(
+            """
+    review:
+      detections:
+        labels:
+          - dog
+"""
+        )
+
+        self.assertEqual(
+            maintainer.get_manual_event_severity("front_door", "pir_sensor"),
+            SeverityEnum.alert,
+        )
+
+    def test_detection_label_is_detection(self) -> None:
+        maintainer = self._make_maintainer(
+            """
+    review:
+      alerts:
+        labels:
+          - person
+      detections:
+        labels:
+          - pir_sensor
+"""
+        )
+
+        self.assertEqual(
+            maintainer.get_manual_event_severity("front_door", "pir_sensor"),
+            SeverityEnum.detection,
+        )
+
+    def test_alert_label_wins_over_detection_label(self) -> None:
+        maintainer = self._make_maintainer(
+            """
+    review:
+      alerts:
+        labels:
+          - person
+      detections:
+        labels:
+          - person
+          - dog
+"""
+        )
+
+        self.assertEqual(
+            maintainer.get_manual_event_severity("front_door", "person"),
+            SeverityEnum.alert,
+        )
+
+    def test_sub_label_is_stripped_before_categorizing(self) -> None:
+        maintainer = self._make_maintainer(
+            """
+    review:
+      alerts:
+        labels:
+          - person
+      detections:
+        labels:
+          - person
+"""
+        )
+
+        self.assertEqual(
+            maintainer.get_manual_event_severity("front_door", "person: Bob"),
+            SeverityEnum.alert,
+        )
+
+    def test_alert_label_is_detection_when_alerts_disabled(self) -> None:
+        maintainer = self._make_maintainer(
+            """
+    review:
+      alerts:
+        enabled: False
+        labels:
+          - person
+      detections:
+        labels:
+          - person
+"""
+        )
+
+        self.assertEqual(
+            maintainer.get_manual_event_severity("front_door", "person"),
+            SeverityEnum.detection,
+        )
+
+    def test_no_severity_when_alerts_disabled_and_label_not_a_detection(self) -> None:
+        maintainer = self._make_maintainer(
+            """
+    review:
+      alerts:
+        enabled: False
+      detections:
+        labels:
+          - dog
+"""
+        )
+
+        self.assertIsNone(
+            maintainer.get_manual_event_severity("front_door", "pir_sensor")
+        )

frigate/test/test_sqlitevecq_embeddings.py

@@ -1,16 +1,24 @@
-"""Tests for embedding cleanup on the main Frigate database.
+"""Tests for embedding storage and cleanup on the main Frigate database.
 
 Embeddings are deleted whether or not semantic search is currently enabled, so
 the delete path has to tolerate databases where the vec0 tables were never
 created and installs where the sqlite-vec extension is unavailable.
+
+The write paths need the real extension, since the behavior under test belongs
+to vec0 itself, so those tests are skipped when it is not installed.
 """
 
 import os
+import struct
 import tempfile
 import unittest
 
+from peewee import OperationalError
+
 from frigate.db.sqlitevecq import SqliteVecQueueDatabase
 
+VEC_EXTENSION_PATH = "/usr/local/lib/vec0.so"
+
 
 class TestDeleteEmbeddings(unittest.TestCase):
     def setUp(self) -> None:
@@ -52,6 +60,21 @@ class TestDeleteEmbeddings(unittest.TestCase):
 
         self.assertEqual(self._thumbnail_ids(), ["b"])
 
+    def test_delete_failure_is_logged_not_raised(self) -> None:
+        self._create_thumbnails_table()
+        self.db.execute_sql(
+            """
+            CREATE TRIGGER vec_thumbnails_no_delete BEFORE DELETE ON vec_thumbnails
+            BEGIN SELECT RAISE(ABORT, 'delete blocked'); END
+            """
+        ).fetchall()
+
+        with self.assertLogs("frigate.db.sqlitevecq", level="ERROR") as logs:
+            self.db.delete_embeddings_thumbnail(event_ids=["a"])
+
+        self.assertIn("Failed to delete embeddings", logs.output[0])
+        self.assertEqual(self._thumbnail_ids(), ["a", "b"])
+
     def test_delete_skipped_without_extension(self) -> None:
         self._create_thumbnails_table()
         self.db.load_vec_extension = False
@@ -61,3 +84,104 @@ class TestDeleteEmbeddings(unittest.TestCase):
 
         # the vec0 tables cannot be written without the extension
         self.assertEqual(self._thumbnail_ids(), ["a", "b"])
+
+
+def _vector(value: float) -> bytes:
+    return struct.pack("768f", *([value] * 768))
+
+
+@unittest.skipUnless(
+    os.path.exists(VEC_EXTENSION_PATH), "sqlite-vec extension is not installed"
+)
+class TestEmbeddingsTableWrites(unittest.TestCase):
+    """Covers the vec0 writes behind semantic search reindexing."""
+
+    def setUp(self) -> None:
+        self.tmp_dir = tempfile.TemporaryDirectory()
+        self.db = SqliteVecQueueDatabase(
+            os.path.join(self.tmp_dir.name, "test.db"), load_vec_extension=True
+        )
+        self.db.start()
+        self.db.create_embeddings_tables()
+
+    def tearDown(self) -> None:
+        self.db.stop()
+        self.db.close()
+        self.tmp_dir.cleanup()
+
+    def _vec_tables(self) -> list[str]:
+        return [
+            row[0]
+            for row in self.db.execute_sql(
+                "SELECT name FROM sqlite_master WHERE name LIKE 'vec_%' ORDER BY name"
+            )
+        ]
+
+    def _make_legacy(self, table: str) -> None:
+        # sqlite-vec added the _info shadow table in 0.1.6, so tables written by
+        # Frigate 0.17 and earlier do not have one
+        self.db.execute_sql(f"DROP TABLE {table}_info").fetchall()
+
+    def _stored(self, table: str, column: str, event_id: str) -> str | None:
+        row = self.db.execute_sql(
+            f"SELECT vec_to_json({column}) FROM {table} WHERE id = ?", (event_id,)
+        ).fetchone()
+        return row[0] if row else None
+
+    def test_write_error_is_raised(self) -> None:
+        # queued writes hide their exception in the returned cursor
+        with self.assertRaises(OperationalError):
+            self.db.execute_write("INSERT INTO vec_missing(id) VALUES ('a')")
+
+    def test_drop_tables_removes_legacy_tables(self) -> None:
+        self._make_legacy("vec_thumbnails")
+        self._make_legacy("vec_descriptions")
+
+        self.db.drop_embeddings_tables()
+
+        self.assertEqual(self._vec_tables(), [])
+
+    def test_drop_tables_without_any_tables_does_not_raise(self) -> None:
+        self.db.drop_embeddings_tables()
+
+        self.db.drop_embeddings_tables()
+
+    def test_upsert_replaces_existing_embedding(self) -> None:
+        self.db.upsert_embeddings(
+            "vec_thumbnails", "thumbnail_embedding", {"evt1": _vector(0.01)}
+        )
+
+        self.db.upsert_embeddings(
+            "vec_thumbnails", "thumbnail_embedding", {"evt1": _vector(0.99)}
+        )
+
+        stored = self._stored("vec_thumbnails", "thumbnail_embedding", "evt1")
+        self.assertTrue(stored.startswith("[0.990000"), stored)
+
+    def test_upsert_keeps_one_row_per_event(self) -> None:
+        for _ in range(3):
+            self.db.upsert_embeddings(
+                "vec_descriptions", "description_embedding", {"evt1": _vector(0.5)}
+            )
+
+        count = self.db.execute_sql(
+            "SELECT count(*) FROM vec_descriptions WHERE id = 'evt1'"
+        ).fetchone()[0]
+        self.assertEqual(count, 1)
+
+    def test_reindex_cycle_rewrites_legacy_tables(self) -> None:
+        """The 0.18 upgrade path: old vectors in, new vectors out."""
+        self.db.upsert_embeddings(
+            "vec_thumbnails", "thumbnail_embedding", {"evt1": _vector(0.01)}
+        )
+        self._make_legacy("vec_thumbnails")
+        self._make_legacy("vec_descriptions")
+
+        self.db.drop_embeddings_tables()
+        self.db.create_embeddings_tables()
+        self.db.upsert_embeddings(
+            "vec_thumbnails", "thumbnail_embedding", {"evt1": _vector(0.99)}
+        )
+
+        stored = self._stored("vec_thumbnails", "thumbnail_embedding", "evt1")
+        self.assertTrue(stored.startswith("[0.990000"), stored)

frigate/test/test_util_path.py

@@ -0,0 +1,197 @@
+"""Tests for safe filesystem path construction."""
+
+import os
+import shutil
+import tempfile
+import unittest
+
+from frigate.const import TRIGGER_DIR
+from frigate.util.path import (
+    get_trigger_thumbnail_path,
+    is_contained_in,
+    safe_join,
+    sanitize_contained_path,
+    sanitize_path_component,
+)
+
+# Values that pathvalidate's sanitize_filename reduces to exactly "..", because
+# it strips reserved characters but leaves relative markers intact. nginx only
+# normalizes a bare ".." segment, so the decorated variants reach the app.
+DOT_DOT_VARIANTS = ["..", "..:", "..*", "..?", '.."', "..<", "..>", "..|", ".. ", " .."]
+
+
+class TestSanitizePathComponent(unittest.TestCase):
+    def test_rejects_dot_dot_variants(self):
+        for value in DOT_DOT_VARIANTS:
+            with self.subTest(value=value):
+                self.assertIsNone(sanitize_path_component(value))
+
+    def test_rejects_relative_markers_and_empty(self):
+        for value in [".", "", None, "   ", "/", "//", "\\"]:
+            with self.subTest(value=value):
+                self.assertIsNone(sanitize_path_component(value))
+
+    def test_strips_separators(self):
+        component = sanitize_path_component("a/b/c")
+        self.assertIsNotNone(component)
+        self.assertNotIn("/", component)
+
+    def test_allows_ordinary_names(self):
+        for value in ["model1", "front-door", "My Model", "café", "a.b_c-1"]:
+            with self.subTest(value=value):
+                self.assertEqual(sanitize_path_component(value), value)
+
+
+class TestSafeJoin(unittest.TestCase):
+    base = "/media/frigate/clips"
+
+    def test_rejects_dot_dot_variants(self):
+        for value in DOT_DOT_VARIANTS:
+            with self.subTest(value=value):
+                self.assertIsNone(safe_join(self.base, value))
+
+    def test_rejects_dot_dot_in_any_segment(self):
+        self.assertIsNone(safe_join(self.base, "model", "dataset", ".."))
+        self.assertIsNone(safe_join(self.base, "..", "dataset", ".."))
+
+    def test_result_stays_inside_base(self):
+        for value in ["model1", "a/../..", "....//", "..\\..", "%2e%2e"]:
+            with self.subTest(value=value):
+                joined = safe_join(self.base, value)
+
+                if joined is not None:
+                    self.assertTrue(is_contained_in(joined, self.base))
+
+    def test_joins_multiple_segments(self):
+        self.assertEqual(
+            safe_join(self.base, "model1", "dataset", "none"),
+            "/media/frigate/clips/model1/dataset/none",
+        )
+
+    def test_rejects_empty_segment(self):
+        self.assertIsNone(safe_join(self.base, "model1", "", "none"))
+
+
+class TestIsContainedIn(unittest.TestCase):
+    def test_rejects_sibling_sharing_a_name_prefix(self):
+        self.assertFalse(
+            is_contained_in("/media/frigate/clips_evil/x.webp", "/media/frigate/clips")
+        )
+
+    def test_accepts_base_itself_and_children(self):
+        self.assertTrue(is_contained_in("/media/frigate/clips", "/media/frigate/clips"))
+        self.assertTrue(
+            is_contained_in("/media/frigate/clips/a/b.webp", "/media/frigate/clips")
+        )
+
+    def test_rejects_parent(self):
+        self.assertFalse(is_contained_in("/media/frigate", "/media/frigate/clips"))
+
+    def test_handles_a_root_base(self):
+        # A prefix test would compare against "//" here and wrongly report that
+        # the root directory contains nothing.
+        self.assertTrue(is_contained_in("/child", "/"))
+        self.assertEqual(safe_join("/", "child"), "/child")
+
+    def test_rejects_uncomparable_paths(self):
+        self.assertFalse(is_contained_in("relative/x", "/media/frigate/clips"))
+
+
+class TestSanitizeContainedPath(unittest.TestCase):
+    base = "/media/frigate/clips"
+
+    def test_rejects_dot_dot_anywhere(self):
+        for value in [
+            "/media/frigate/clips/../../etc/passwd",
+            "clips\\..\\..\\etc/passwd",
+            "/media/frigate/clips/a/../../../x",
+        ]:
+            with self.subTest(value=value):
+                self.assertIsNone(sanitize_contained_path(value, self.base))
+
+    def test_rejects_sibling_sharing_a_name_prefix(self):
+        self.assertIsNone(
+            sanitize_contained_path("/media/frigate/clips_evil/x.webp", self.base)
+        )
+
+    def test_rejects_outside_base(self):
+        self.assertIsNone(sanitize_contained_path("/etc/passwd", self.base))
+
+    def test_rejects_empty(self):
+        self.assertIsNone(sanitize_contained_path("", self.base))
+        self.assertIsNone(sanitize_contained_path(None, self.base))
+
+    def test_keeps_a_valid_nested_path(self):
+        self.assertEqual(
+            sanitize_contained_path("/media/frigate/clips/a/b.webp", self.base),
+            "/media/frigate/clips/a/b.webp",
+        )
+
+
+class TestTriggerThumbnailPath(unittest.TestCase):
+    def test_stays_inside_the_trigger_dir(self):
+        for camera, data in [
+            ("cam", "../../../../etc/passwd"),
+            ("cam", "../../../../config/config.yml"),
+            ("cam", "normal-event-id"),
+        ]:
+            with self.subTest(camera=camera, data=data):
+                path = get_trigger_thumbnail_path(camera, data)
+
+                self.assertIsNotNone(path)
+                self.assertTrue(is_contained_in(path, TRIGGER_DIR))
+
+    def test_rejects_traversal_camera_names(self):
+        for camera in DOT_DOT_VARIANTS:
+            with self.subTest(camera=camera):
+                self.assertIsNone(get_trigger_thumbnail_path(camera, "data"))
+
+    def test_builds_the_expected_path(self):
+        self.assertEqual(
+            get_trigger_thumbnail_path("front_door", "abc"),
+            os.path.join(TRIGGER_DIR, "front_door", "abc.webp"),
+        )
+
+
+class TestRmtreeContainment(unittest.TestCase):
+    """A recursive delete built through safe_join must not reach a parent.
+
+    shutil.rmtree on a path ending in ".." deletes the parent's contents before
+    failing on the final rmdir, so the guard has to run before the call.
+    """
+
+    def setUp(self):
+        self.root = tempfile.mkdtemp()
+        self.clips = os.path.join(self.root, "clips")
+        os.makedirs(os.path.join(self.clips, "model1"))
+        os.makedirs(os.path.join(self.root, "recordings"))
+
+        with open(os.path.join(self.root, "recordings", "seg.mp4"), "w") as f:
+            f.write("recording")
+
+    def tearDown(self):
+        shutil.rmtree(self.root, ignore_errors=True)
+
+    def test_traversal_name_never_yields_a_path_to_delete(self):
+        for value in DOT_DOT_VARIANTS:
+            with self.subTest(value=value):
+                self.assertIsNone(safe_join(self.clips, value))
+
+        self.assertTrue(
+            os.path.exists(os.path.join(self.root, "recordings", "seg.mp4"))
+        )
+
+    def test_ordinary_name_still_deletes_its_own_directory(self):
+        target = safe_join(self.clips, "model1")
+        self.assertIsNotNone(target)
+
+        shutil.rmtree(target)
+
+        self.assertFalse(os.path.exists(os.path.join(self.clips, "model1")))
+        self.assertTrue(
+            os.path.exists(os.path.join(self.root, "recordings", "seg.mp4"))
+        )
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)

frigate/test/test_webpush_registration.py

@@ -0,0 +1,150 @@
+"""Tests for push notification subscription validation."""
+
+import unittest
+
+from frigate.api.notification import _validate_push_endpoint, _validate_subscription
+
+VALID_ENDPOINTS = [
+    "https://fcm.googleapis.com/fcm/send/dGhpcy1pcy1hLXRva2Vu",
+    "https://updates.push.services.mozilla.com/wpush/v2/dGhpcy1pcy1hLXRva2Vu",
+    "https://web.push.apple.com/dGhpcy1pcy1hLXRva2Vu",
+    "https://wns2-by3p.notify.windows.com/w/?token=dGhpcy1pcy1hLXRva2Vu",
+    "https://fcm.googleapis.com:443/fcm/send/dGhpcy1pcy1hLXRva2Vu",
+]
+
+
+def _subscription(endpoint: str) -> dict:
+    return {
+        "endpoint": endpoint,
+        "keys": {"p256dh": "cHVibGljLWtleQ", "auth": "YXV0aC1zZWNyZXQ"},
+    }
+
+
+class TestValidatePushEndpoint(unittest.TestCase):
+    def test_accepts_real_push_service_endpoints(self):
+        for endpoint in VALID_ENDPOINTS:
+            with self.subTest(endpoint=endpoint):
+                self.assertIsNone(_validate_push_endpoint(endpoint))
+
+    def test_rejects_http(self):
+        self.assertIsNotNone(
+            _validate_push_endpoint("http://fcm.googleapis.com/fcm/send/token")
+        )
+
+    def test_rejects_non_http_schemes(self):
+        for endpoint in (
+            "file:///etc/passwd",
+            "ftp://example.com/token",
+            "//example.com/token",
+        ):
+            with self.subTest(endpoint=endpoint):
+                self.assertIsNotNone(_validate_push_endpoint(endpoint))
+
+    def test_rejects_localhost(self):
+        for endpoint in (
+            "https://localhost/token",
+            "https://localhost:443/token",
+            "https://127.0.0.1/token",
+            "https://[::1]/token",
+        ):
+            with self.subTest(endpoint=endpoint):
+                self.assertIsNotNone(_validate_push_endpoint(endpoint))
+
+    def test_rejects_private_addresses(self):
+        for endpoint in (
+            "https://192.168.1.10/token",
+            "https://10.0.0.5/token",
+            "https://172.16.0.1/token",
+            "https://169.254.169.254/token",
+            "https://0.0.0.0/token",
+        ):
+            with self.subTest(endpoint=endpoint):
+                self.assertIsNotNone(_validate_push_endpoint(endpoint))
+
+    def test_rejects_internal_hostnames(self):
+        for endpoint in (
+            "https://frigate/token",
+            "https://nas.local/token",
+            "https://push.internal/token",
+            "https://host.home.arpa/token",
+        ):
+            with self.subTest(endpoint=endpoint):
+                self.assertIsNotNone(_validate_push_endpoint(endpoint))
+
+    def test_rejects_non_default_port(self):
+        self.assertIsNotNone(
+            _validate_push_endpoint("https://fcm.googleapis.com:8080/fcm/send/token")
+        )
+
+    def test_rejects_embedded_credentials(self):
+        self.assertIsNotNone(
+            _validate_push_endpoint(
+                "https://user:pass@fcm.googleapis.com/fcm/send/token"
+            )
+        )
+
+    def test_rejects_endpoint_without_path(self):
+        for endpoint in ("https://fcm.googleapis.com", "https://fcm.googleapis.com/"):
+            with self.subTest(endpoint=endpoint):
+                self.assertIsNotNone(_validate_push_endpoint(endpoint))
+
+    def test_rejects_endpoint_that_breaks_audience_parsing(self):
+        # webpush.py locates the host by searching for a separator after index
+        # 10, which raises ValueError when the url has no path at all
+        endpoint = "https://fcm.googleapis.com"
+
+        with self.assertRaises(ValueError):
+            endpoint.index("/", 10)
+
+        self.assertIsNotNone(_validate_push_endpoint(endpoint))
+
+    def test_rejects_missing_or_non_string_endpoint(self):
+        for endpoint in (None, "", 5, {"url": "https://example.com/token"}):
+            with self.subTest(endpoint=endpoint):
+                self.assertIsNotNone(_validate_push_endpoint(endpoint))
+
+    def test_rejects_overlong_endpoint(self):
+        self.assertIsNotNone(
+            _validate_push_endpoint(f"https://fcm.googleapis.com/{'a' * 4096}")
+        )
+
+
+class TestValidateSubscription(unittest.TestCase):
+    def test_accepts_valid_subscription(self):
+        self.assertIsNone(_validate_subscription(_subscription(VALID_ENDPOINTS[0])))
+
+    def test_accepts_extra_fields_sent_by_the_browser(self):
+        sub = _subscription(VALID_ENDPOINTS[0])
+        sub["expirationTime"] = None
+        self.assertIsNone(_validate_subscription(sub))
+
+    def test_rejects_non_object(self):
+        for sub in ("https://fcm.googleapis.com/fcm/send/token", ["endpoint"], 5):
+            with self.subTest(sub=sub):
+                self.assertIsNotNone(_validate_subscription(sub))
+
+    def test_rejects_bad_endpoint(self):
+        self.assertIsNotNone(
+            _validate_subscription(_subscription("https://localhost/t"))
+        )
+
+    def test_rejects_missing_keys(self):
+        sub = _subscription(VALID_ENDPOINTS[0])
+        del sub["keys"]
+        self.assertIsNotNone(_validate_subscription(sub))
+
+    def test_rejects_incomplete_keys(self):
+        for keys in (
+            {"p256dh": "cHVibGljLWtleQ"},
+            {"auth": "YXV0aC1zZWNyZXQ"},
+            {"p256dh": "cHVibGljLWtleQ", "auth": ""},
+            {"p256dh": None, "auth": "YXV0aC1zZWNyZXQ"},
+        ):
+            with self.subTest(keys=keys):
+                sub = _subscription(VALID_ENDPOINTS[0])
+                sub["keys"] = keys
+                self.assertIsNotNone(_validate_subscription(sub))
+
+
+if __name__ == "__main__":
+    unittest.main()

frigate/track/object_processing.py

@@ -24,6 +24,7 @@ from frigate.comms.event_metadata_updater import (
 from frigate.comms.events_updater import EventEndSubscriber, EventUpdatePublisher
 from frigate.comms.inter_process import InterProcessRequestor
 from frigate.config import (
+    CameraConfig,
     CameraMqttConfig,
     FrigateConfig,
     RecordConfig,
@@ -128,8 +129,10 @@ class TrackedObjectProcessor(threading.Thread):
             )
 
         def update(camera: str, obj: TrackedObject, frame_name: str) -> None:
-            obj.has_snapshot = self.should_save_snapshot(camera, obj)
-            obj.has_clip = self.should_retain_recording(camera, obj)
+            obj.has_snapshot = self.should_save_snapshot(
+                camera_state.camera_config, obj
+            )
+            obj.has_clip = self.should_retain_recording(camera_state.camera_config, obj)
             after = obj.to_dict()
             message = {
                 "before": obj.previous,
@@ -153,8 +156,10 @@ class TrackedObjectProcessor(threading.Thread):
 
         def end(camera: str, obj: TrackedObject, frame_name: str) -> None:
             # populate has_snapshot
-            obj.has_snapshot = self.should_save_snapshot(camera, obj)
-            obj.has_clip = self.should_retain_recording(camera, obj)
+            obj.has_snapshot = self.should_save_snapshot(
+                camera_state.camera_config, obj
+            )
+            obj.has_clip = self.should_retain_recording(camera_state.camera_config, obj)
 
             # write thumbnail to disk if it will be saved as an event
             if obj.has_snapshot or obj.has_clip:
@@ -184,8 +189,8 @@ class TrackedObjectProcessor(threading.Thread):
             )
 
         def snapshot(camera: str, obj: TrackedObject) -> bool:
-            mqtt_config: CameraMqttConfig = self.config.cameras[camera].mqtt
-            if mqtt_config.enabled and self.should_mqtt_snapshot(camera, obj):
+            mqtt_config: CameraMqttConfig = camera_state.camera_config.mqtt
+            if mqtt_config.enabled and self.should_mqtt_snapshot(mqtt_config, obj):
                 jpg_bytes, _ = obj.get_img_bytes(
                     ext="jpg",
                     timestamp=mqtt_config.timestamp,
@@ -238,11 +243,13 @@ class TrackedObjectProcessor(threading.Thread):
         camera_state.on("camera_activity", camera_activity)
         self.camera_states[camera] = camera_state
 
-    def should_save_snapshot(self, camera: str, obj: TrackedObject) -> bool:
+    def should_save_snapshot(
+        self, camera_config: CameraConfig, obj: TrackedObject
+    ) -> bool:
         if obj.false_positive:
             return False
 
-        snapshot_config: SnapshotsConfig = self.config.cameras[camera].snapshots
+        snapshot_config: SnapshotsConfig = camera_config.snapshots
 
         if not snapshot_config.enabled:
             return False
@@ -261,11 +268,13 @@ class TrackedObjectProcessor(threading.Thread):
 
         return True
 
-    def should_retain_recording(self, camera: str, obj: TrackedObject) -> bool:
+    def should_retain_recording(
+        self, camera_config: CameraConfig, obj: TrackedObject
+    ) -> bool:
         if obj.false_positive:
             return False
 
-        record_config: RecordConfig = self.config.cameras[camera].record
+        record_config: RecordConfig = camera_config.record
 
         # Recording is disabled
         if not record_config.enabled:
@@ -281,13 +290,15 @@ class TrackedObjectProcessor(threading.Thread):
 
         return True
 
-    def should_mqtt_snapshot(self, camera: str, obj: TrackedObject) -> bool:
+    def should_mqtt_snapshot(
+        self, mqtt_config: CameraMqttConfig, obj: TrackedObject
+    ) -> bool:
         # object never changed position
         if obj.is_stationary():
             return False
 
         # if there are required zones and there is no overlap
-        required_zones = self.config.cameras[camera].mqtt.required_zones
+        required_zones = mqtt_config.required_zones
         if len(required_zones) > 0 and not set(obj.entered_zones) & set(required_zones):
             logger.debug(
                 f"Not sending mqtt for {obj.obj_data['id']} because it did not enter required zones"
@@ -297,7 +308,11 @@ class TrackedObjectProcessor(threading.Thread):
         return True
 
     def update_mqtt_motion(
-        self, camera: str, frame_time: float, motion_boxes: list
+        self,
+        camera: str,
+        camera_config: CameraConfig,
+        frame_time: float,
+        motion_boxes: list,
     ) -> None:
         # publish if motion is currently being detected
         if motion_boxes:
@@ -312,7 +327,7 @@ class TrackedObjectProcessor(threading.Thread):
             # always updated latest motion
             self.last_motion_detected[camera] = frame_time
         elif self.last_motion_detected.get(camera, 0) > 0:
-            mqtt_delay = self.config.cameras[camera].motion.mqtt_off_delay
+            mqtt_delay = camera_config.motion.mqtt_off_delay
 
             # If no motion, make sure the off_delay has passed
             if frame_time - self.last_motion_detected.get(camera, 0) >= mqtt_delay:
@@ -783,7 +798,7 @@ class TrackedObjectProcessor(threading.Thread):
                 frame_name, frame_time, current_tracked_objects, motion_boxes, regions
             )
 
-            self.update_mqtt_motion(camera, frame_time, motion_boxes)
+            self.update_mqtt_motion(camera, camera_config, frame_time, motion_boxes)
 
             tracked_objects = [
                 o.to_dict() for o in camera_state.tracked_objects.values()

frigate/track/tracked_object.py

@@ -54,6 +54,11 @@ class TrackedObject:
         self.obj_data = obj_data
         self.colormap = model_config.colormap
         self.logos = model_config.all_attribute_logos
+        self.thumbnail_attributes = [
+            attr
+            for attr in model_config.attributes_map.get(obj_data["label"], [])
+            if attr in model_config.non_logo_attributes
+        ]
         self.camera_config = camera_config
         self.ui_config = ui_config
         self.frame_cache = frame_cache
@@ -149,7 +154,7 @@ class TrackedObject:
         if not self.false_positive and has_valid_frame:
             # determine if this frame is a better thumbnail
             if self.thumbnail_data is None or is_better_thumbnail(
-                self.obj_data["label"],
+                self.thumbnail_attributes,
                 self.thumbnail_data,
                 obj_data,
                 self.camera_config.frame_shape,

frigate/types.py

@@ -8,7 +8,7 @@ from frigate.object_detection.base import ObjectDetectProcess
 
 class StatsTrackingTypes(TypedDict):
     camera_metrics: dict[str, CameraMetrics]
-    embeddings_metrics: DataProcessorMetrics | None
+    embeddings_metrics: DataProcessorMetrics
     detectors: dict[str, ObjectDetectProcess]
     started: int
     latest_frigate_version: str

frigate/util/config.py

@@ -533,7 +533,7 @@ def migrate_018_0(config: dict[str, dict[str, Any]]) -> dict[str, dict[str, Any]
     genai = new_config.get("genai")
 
     if genai and genai.get("provider"):
-        genai["roles"] = ["embeddings", "descriptions", "chat"]
+        genai["roles"] = ["descriptions", "chat"]
         new_config["genai"] = {"default": genai}
 
     # Remove deprecated sync_recordings from global record config

frigate/util/image.py

@@ -67,7 +67,7 @@ def has_better_attr(current_thumb, new_obj, attr_label) -> bool:
 
 
 def is_better_thumbnail(
-    label: str,
+    label_attributes: list[str],
     current_thumb: dict[str, Any],
     new_obj: dict[str, Any],
     frame_shape: tuple[int, int],
@@ -76,20 +76,12 @@ def is_better_thumbnail(
     # cutoff images are less ideal, but they should also be smaller?
     # better scores are obviously better too
 
-    # check face on person
-    if label == "person":
-        if has_better_attr(current_thumb, new_obj, "face"):
+    for attr_label in label_attributes:
+        if has_better_attr(current_thumb, new_obj, attr_label):
             return True
-        # if the current thumb has a face attr, dont update unless it gets better
-        if any([a["label"] == "face" for a in current_thumb["attributes"]]):
-            return False
 
-    # check license_plate on car
-    if label in ["car", "motorcycle"]:
-        if has_better_attr(current_thumb, new_obj, "license_plate"):
-            return True
-        # if the current thumb has a license_plate attr, dont update unless it gets better
-        if any([a["label"] == "license_plate" for a in current_thumb["attributes"]]):
+        # if the current thumb has the attr, dont update unless it gets better
+        if any([a["label"] == attr_label for a in current_thumb["attributes"]]):
             return False
 
     # if the new_thumb is on an edge, and the current thumb is not

frigate/util/path.py

@@ -0,0 +1,134 @@
+"""Helpers for building filesystem paths out of user supplied values."""
+
+import os
+
+from pathvalidate import ValidationError, sanitize_filename, sanitize_filepath
+
+from frigate.const import TRIGGER_DIR
+
+# Components that name a directory relative to its parent instead of a child.
+# pathvalidate strips separators and reserved characters but leaves these
+# intact, and it collapses values like "..:" down to "..", so they have to be
+# rejected after sanitizing rather than before.
+RELATIVE_COMPONENTS = {"", ".", ".."}
+
+
+def sanitize_path_component(value: str | None) -> str | None:
+    """Reduce a user supplied value to a single path component.
+
+    Args:
+        value: The untrusted value, such as a path parameter or body field
+
+    Returns:
+        A component that is safe to join onto a base directory, or None when
+        nothing usable remains so the caller can reject the request.
+    """
+    if not value:
+        return None
+
+    try:
+        component = sanitize_filename(value)
+    except (ValidationError, ValueError):
+        return None
+
+    if component.strip() in RELATIVE_COMPONENTS:
+        return None
+
+    if os.sep in component or (os.altsep and os.altsep in component):
+        return None
+
+    return component
+
+
+def is_contained_in(path: str, base: str) -> bool:
+    """Check that a path sits inside a base directory.
+
+    Compares whole path components, so a sibling directory that merely shares a
+    name prefix with base is not treated as contained.
+    """
+    resolved = os.path.normpath(path)
+    root = os.path.normpath(base)
+
+    try:
+        # commonpath compares components, and unlike a prefix test it stays
+        # correct for a base that already ends in a separator such as "/".
+        return os.path.commonpath([resolved, root]) == root
+    except ValueError:
+        # Raised when the paths cannot be compared, such as one relative and
+        # one absolute, or two different Windows drives.
+        return False
+
+
+def safe_join(base: str, *parts: str | None) -> str | None:
+    """Join user supplied parts beneath a trusted base directory.
+
+    Args:
+        base: Trusted base directory the result must stay inside of
+        parts: Untrusted values, each becoming one path component
+
+    Returns:
+        The joined path, or None if any part is unusable or the result would
+        land outside base.
+    """
+    components: list[str] = []
+
+    for part in parts:
+        component = sanitize_path_component(part)
+
+        if component is None:
+            return None
+
+        components.append(component)
+
+    resolved = os.path.normpath(os.path.join(base, *components))
+
+    # normpath rather than realpath so symlinked media roots keep working; the
+    # per component checks above are what actually prevent traversal.
+    if not is_contained_in(resolved, base):
+        return None
+
+    return resolved
+
+
+def sanitize_contained_path(path: str | None, base: str) -> str | None:
+    """Validate a whole user supplied path that must already sit under base.
+
+    Unlike safe_join this keeps the directory structure the caller sent, so it
+    suits values that name an existing file rather than one component.
+
+    Args:
+        path: The untrusted path
+        base: Directory the path has to stay inside of
+
+    Returns:
+        The sanitized path, or None if it is unusable or escapes base.
+    """
+    if not path:
+        return None
+
+    # sanitize_filepath normalizes "\" to "/" but leaves ".." intact, so a path
+    # like "clips\..\..\etc/passwd" would pass the containment check yet still
+    # escape once resolved. A valid path here never uses "..".
+    if ".." in path:
+        return None
+
+    sanitized = sanitize_filepath(path)
+
+    if not is_contained_in(sanitized, base):
+        return None
+
+    return sanitized
+
+
+def get_trigger_thumbnail_path(camera_name: str, data: str) -> str | None:
+    """Path of the thumbnail stored for a semantic search trigger.
+
+    Args:
+        camera_name: Camera the trigger belongs to
+        data: The trigger's data value, which is free-form text supplied by the
+            client and persisted verbatim
+
+    Returns:
+        The thumbnail path, or None if it cannot be built safely.
+    """
+    return safe_join(TRIGGER_DIR, camera_name, f"{data}.webp")

frigate/video/detect.py

@@ -216,20 +216,10 @@ def process_frames(
 
     # remove license_plate from attributes if this camera is a dedicated LPR cam
     if camera_config.type == CameraTypeEnum.lpr:
-        modified_attributes_map = model_config.attributes_map.copy()
-
-        if (
-            "car" in modified_attributes_map
-            and "license_plate" in modified_attributes_map["car"]
-        ):
-            modified_attributes_map["car"] = [
-                attr
-                for attr in modified_attributes_map["car"]
-                if attr != "license_plate"
-            ]
-
-            attributes_map = modified_attributes_map
-
+        attributes_map = {
+            label: [attr for attr in attributes if attr != "license_plate"]
+            for label, attributes in model_config.attributes_map.items()
+        }
         all_attributes = [
             attr for attr in model_config.all_attributes if attr != "license_plate"
         ]

frigate/video/ffmpeg.py

@@ -34,6 +34,8 @@ from frigate.util.process import FrigateProcess
 
 logger = logging.getLogger(__name__)
 
+RECORD_GRACE_SECONDS = 90
+
 
 def capture_frames(
     ffmpeg_process: sp.Popen[Any],
@@ -164,6 +166,7 @@ class CameraWatchdog(threading.Thread):
         self.latest_invalid_segment_time: float = 0
         self.latest_cache_segment_time: float = 0
         self.record_enable_time: datetime | None = None
+        self.record_grace_until: datetime | None = None
 
         # `valid` segments are published with the segment's start time, so the
         # gap between consecutive publishes can reach 2 * segment_time. Pad the
@@ -280,6 +283,7 @@ class CameraWatchdog(threading.Thread):
                 self.latest_valid_segment_time = 0
                 self.latest_invalid_segment_time = 0
                 self.latest_cache_segment_time = 0
+                self.record_grace_until = None
                 self.record_enable_time = datetime.now().astimezone(UTC)
                 last_restart_time = datetime.now().timestamp()
                 continue
@@ -294,6 +298,7 @@ class CameraWatchdog(threading.Thread):
                     self.latest_valid_segment_time = 0
                     self.latest_invalid_segment_time = 0
                     self.latest_cache_segment_time = 0
+                    self.record_grace_until = None
                     self.record_enable_time = datetime.now().astimezone(UTC)
                 else:
                     self.logger.debug(f"Disabling camera {self.config.name}")
@@ -318,6 +323,7 @@ class CameraWatchdog(threading.Thread):
                     self.latest_valid_segment_time = 0
                     self.latest_invalid_segment_time = 0
                     self.latest_cache_segment_time = 0
+                    self.record_grace_until = None
                     self.record_enable_time = datetime.now().astimezone(UTC)
                     last_restart_time = datetime.now().timestamp()
                 self.was_record_enabled_in_config = record_enabled_in_config
@@ -404,11 +410,16 @@ class CameraWatchdog(threading.Thread):
                 if self.config.record.enabled and "record" in p["roles"]:
                     now_utc = datetime.now().astimezone(UTC)
 
-                    # Check if we're within the grace period after enabling recording
-                    # Grace period: 90 seconds allows time for ffmpeg to start and create first segment
-                    in_grace_period = self.record_enable_time is not None and (
-                        now_utc - self.record_enable_time
-                    ) < timedelta(seconds=90)
+                    # ffmpeg needs time to create a first segment after
+                    # recording is enabled and after a restart
+                    in_grace_period = (
+                        self.record_enable_time is not None
+                        and (now_utc - self.record_enable_time)
+                        < timedelta(seconds=RECORD_GRACE_SECONDS)
+                    ) or (
+                        self.record_grace_until is not None
+                        and now_utc < self.record_grace_until
+                    )
 
                     latest_cache_dt = (
                         datetime.fromtimestamp(self.latest_cache_segment_time, tz=UTC)
@@ -445,8 +456,9 @@ class CameraWatchdog(threading.Thread):
                         <= self.latest_invalid_segment_time
                     )
                     invalid_stale = invalid_stale_condition
+                    stale = cache_stale or valid_stale or invalid_stale
 
-                    if cache_stale or valid_stale or invalid_stale:
+                    if stale and can_restart:
                         if cache_stale:
                             reason = "No new recording segments were created"
                         elif valid_stale:
@@ -471,8 +483,13 @@ class CameraWatchdog(threading.Thread):
                                 f"{self.config.name}/status/{role.value}", "offline"
                             )
 
+                        self.record_grace_until = now_utc + timedelta(
+                            seconds=RECORD_GRACE_SECONDS
+                        )
+                        last_restart_time = now
+
                         continue
-                    else:
+                    elif not stale:
                         self._send_record_status("online", now)
                         p["latest_segment_time"] = self.latest_cache_segment_time
 

generate_api_auth_spec.py

@@ -94,6 +94,7 @@ SPEC_SERVERS = [
 PUBLIC = "public"
 AUTHENTICATED = "any"
 CAMERA = "camera"
+ALL_CAMERAS = "all_cameras"
 ADMIN = "admin"
 
 ADMIN_SCHEME = "frigateAdminAuth"
@@ -128,6 +129,7 @@ ACCESS_NOTES = {
     PUBLIC: "**Access:** Public — no authentication required.",
     AUTHENTICATED: "**Access:** Any authenticated user.",
     CAMERA: "**Access:** Authenticated user with access to the referenced camera.",
+    ALL_CAMERAS: "**Access:** Authenticated user with access to all cameras.",
     ADMIN: "**Access:** Admin role required.",
 }
 
@@ -197,6 +199,8 @@ def _route_markers(route: APIRoute) -> tuple[set[str], list[str] | None]:
                 pass
         elif name in ("require_camera_access", "require_go2rtc_stream_access"):
             markers.add(CAMERA)
+        elif name == "require_full_camera_access":
+            markers.add(ALL_CAMERAS)
         elif "auth_checker" in qualname:
             markers.add(AUTHENTICATED)
         elif "public_checker" in qualname:
@@ -254,6 +258,8 @@ def _classify_base(
     # Explicit route-level markers win, in order of specificity.
     if ADMIN in markers:
         return ADMIN, admin_roles or ["admin"], None
+    if ALL_CAMERAS in markers:
+        return ALL_CAMERAS, None, None
     if CAMERA in markers:
         return CAMERA, None, None
     if AUTHENTICATED in markers:
@@ -337,8 +343,8 @@ def security_for(level: str) -> list:
         return []
     if level == ADMIN:
         return [{ADMIN_SCHEME: []}]
-    # AUTHENTICATED and CAMERA both require any authenticated session; the
-    # camera-specific scoping is conveyed in the note and x-required-role.
+    # AUTHENTICATED, CAMERA and ALL_CAMERAS all require any authenticated
+    # session; the camera scoping is conveyed in the note and x-required-role.
     return [{USER_SCHEME: []}]
 
 

web/e2e/fixtures/frigate-test.ts

@@ -54,8 +54,11 @@ export class FrigateApp {
     });
 
     await this.ws.install(this.page);
-    await this.media.install();
     await this.api.install(overrides);
+    // media goes last so its per-event routes win over the broader
+    // `**/api/events**` list route, which otherwise answers thumbnail and
+    // snapshot requests with the events JSON
+    await this.media.install();
   }
 
   /** Navigate to a page. Always call installDefaults() first. */

web/e2e/fixtures/mock-data/config.ts

@@ -52,6 +52,9 @@ function deepMerge<T extends Record<string, unknown>>(
 export const BASE_CONFIG = {
   ...configSnapshot,
   version: "0.15.0-test",
+  // injected by the /config endpoint rather than the Pydantic model, so it
+  // is absent from the snapshot
+  plus: { enabled: false },
   cameras: {
     ...configSnapshot.cameras,
     front_door: {

web/e2e/helpers/api-mocker.ts

@@ -249,8 +249,9 @@ export class MediaMocker {
       }),
     );
 
-    // Event thumbnails
-    await this.page.route("**/api/events/*/thumbnail.jpg**", (route) =>
+    // Event thumbnails. The explore grid and detail dialog request .webp,
+    // everything else requests .jpg.
+    await this.page.route("**/api/events/*/thumbnail.{jpg,webp}**", (route) =>
       route.fulfill({
         contentType: "image/png",
         body: PLACEHOLDER_PNG,

web/e2e/specs/explore.spec.ts

@@ -263,3 +263,71 @@ test.describe("Explore — mobile @high @mobile", () => {
     await expect(searchInput).toBeFocused();
   });
 });
+
+// ---------------------------------------------------------------------------
+// Frigate+ submission — desktop only
+// The detail dialog's previous/next arrows only render on desktop.
+// ---------------------------------------------------------------------------
+
+test.describe("Explore — Frigate+ submission (desktop) @high", () => {
+  test.skip(
+    ({ frigateApp }) => frigateApp.isMobile,
+    "Detail dialog navigation arrows are desktop-only",
+  );
+
+  test("in-flight submission does not mark the next tracked object as submitted", async ({
+    frigateApp,
+  }) => {
+    await frigateApp.installDefaults({ config: { plus: { enabled: true } } });
+    const page = frigateApp.page;
+
+    // Hold the submission open so it is still in flight while the user moves
+    // on to the next tracked object.
+    let releaseSubmission: () => void = () => {};
+    const submissionHeld = new Promise<void>((resolve) => {
+      releaseSubmission = resolve;
+    });
+    let submissions = 0;
+    await page.route("**/api/events/*/plus", async (route) => {
+      submissions += 1;
+      await submissionHeld;
+      await route.fulfill({ json: { success: true } });
+    });
+
+    await frigateApp.goto("/explore?labels=person");
+
+    const firstResult = page.locator("[data-start]").first();
+    await expect(firstResult).toBeVisible({ timeout: 10_000 });
+    await firstResult.click();
+
+    // The label being confirmed is rendered in a <code> tag inside the
+    // "Is this object a <label>?" question.
+    const dialog = page.getByRole("dialog");
+    await expect(dialog.locator("code")).toHaveText("person");
+
+    await dialog.getByRole("button", { name: "Yes", exact: true }).click();
+    await expect.poll(() => submissions, { timeout: 5_000 }).toBe(1);
+
+    await page.getByRole("button", { name: "Next tracked object" }).click();
+    await expect(dialog.locator("code")).toHaveText("car");
+
+    const submissionLanded = page.waitForResponse(/\/api\/events\/.*\/plus/);
+    releaseSubmission();
+    await submissionLanded;
+    // two frames is enough for React to flush the response handler's state
+    // updates, so the assertions below can't pass by racing ahead of them
+    await page.evaluate(
+      () =>
+        new Promise((resolve) =>
+          requestAnimationFrame(() => requestAnimationFrame(resolve)),
+        ),
+    );
+
+    // The car was never submitted, so its question must be untouched.
+    expect(submissions).toBe(1);
+    await expect(dialog.getByText("Submitted")).toHaveCount(0);
+    await expect(
+      dialog.getByRole("button", { name: "Yes", exact: true }),
+    ).toBeVisible();
+  });
+});

web/e2e/specs/export.spec.ts

@@ -1,4 +1,4 @@
-import { test, expect } from "../fixtures/frigate-test";
+import { test, expect, type FrigateApp } from "../fixtures/frigate-test";
 import {
   expectBodyInteractive,
   waitForBodyInteractive,
@@ -575,7 +575,7 @@ test.describe("Multi-Review Export @high", () => {
     await expect(dialog.getByText(/None/)).toBeVisible();
   });
 
-  test("starting an export posts the expected payload and navigates to the case", async ({
+  test("starting an export posts the expected payload and stays on the review page", async ({
     frigateApp,
   }) => {
     test.skip(frigateApp.isMobile, "Desktop multi-select flow");
@@ -673,9 +673,15 @@ test.describe("Multi-Review Export @high", () => {
       "mex-review-002",
     ]);
 
-    await expect(frigateApp.page).toHaveURL(/caseId=new-case-xyz/, {
-      timeout: 5_000,
-    });
+    // Creating a case must not pull the user off the review they were
+    // working through — the case is offered as a link on the toast instead.
+    const viewCase = frigateApp.page.getByRole("link", { name: /view/i });
+    await expect(viewCase).toBeVisible({ timeout: 5_000 });
+    await expect(viewCase).toHaveAttribute(
+      "href",
+      /export\?caseId=new-case-xyz$/,
+    );
+    await expect(frigateApp.page).toHaveURL(/\/review(\?|$)/);
   });
 
   test("mobile opens a drawer (not a dialog) for the multi-review export flow", async ({
@@ -834,12 +840,128 @@ test.describe("Multi-Review Export @high", () => {
     expect(payload.new_case_description).toBeUndefined();
     expect(payload.items).toHaveLength(2);
 
-    // Navigate should hit /export. useSearchEffect consumes the caseId
-    // query param and strips it once the case is found in the cases list,
-    // so we assert on the path, not the query string.
-    await expect(frigateApp.page).toHaveURL(/\/export(\?|$)/, {
-      timeout: 5_000,
-    });
+    // Attaching to a case leaves the user on the review page; the case is
+    // reachable from the toast action.
+    const viewCase = frigateApp.page.getByRole("link", { name: /view/i });
+    await expect(viewCase).toBeVisible({ timeout: 5_000 });
+    await expect(viewCase).toHaveAttribute(
+      "href",
+      /export\?caseId=existing-case-abc$/,
+    );
+    await expect(frigateApp.page).toHaveURL(/\/review(\?|$)/);
+  });
+});
+
+test.describe("Multi-Camera Export from History @high", () => {
+  // The recording view seeds the multi-camera range around the playback
+  // position, so the deep link has to land close to the live edge for the
+  // seeded end to run past the end of the timeline.
+  const playbackTime = Math.floor(Date.now() / 1000) - 300;
+
+  async function openRecordingView(frigateApp: FrigateApp) {
+    // The recording view pulls these while the timeline renders; the preview
+    // server 500s on them, which the error collector would flag.
+    await frigateApp.page.route("**/api/*/recordings**", (route) =>
+      route.fulfill({ json: [] }),
+    );
+    await frigateApp.page.route("**/api/recordings/unavailable**", (route) =>
+      route.fulfill({ json: [] }),
+    );
+
+    await frigateApp.goto(`/review?timestamp=front_door_${playbackTime}`);
+  }
+
+  // Desktop opens the export form in a dialog from the Actions menu; mobile
+  // opens the same form inside the settings drawer.
+  async function openMultiCameraTab(frigateApp: FrigateApp) {
+    await openRecordingView(frigateApp);
+
+    if (frigateApp.isMobile) {
+      await frigateApp.page
+        .getByRole("button", { name: /filters/i })
+        .first()
+        .click({ timeout: 15_000 });
+      await frigateApp.page.getByRole("button", { name: /^export$/i }).click();
+    } else {
+      await frigateApp.page
+        .getByRole("button", { name: /actions/i })
+        .click({ timeout: 15_000 });
+      await frigateApp.page.getByRole("menuitem", { name: /export/i }).click();
+    }
+
+    const form = frigateApp.page.getByRole("dialog");
+    await expect(form).toBeVisible({ timeout: 5_000 });
+    await form.getByRole("tab", { name: /multi-camera/i }).click();
+
+    return form;
+  }
+
+  test("timeline selection renders both export handles on the timeline", async ({
+    frigateApp,
+  }) => {
+    await frigateApp.installDefaults();
+    const form = await openMultiCameraTab(frigateApp);
+
+    await form
+      .getByRole("button", { name: "Select from Timeline" })
+      .click({ timeout: 5_000 });
+    await expect(form).toBeHidden({ timeout: 5_000 });
+
+    // A range seeded past the end of the timeline has no segment to anchor
+    // to, which leaves the handle unpositioned at the top of the timeline
+    // with an empty label until it is dragged.
+    for (const handle of [".export-start", ".export-end"]) {
+      const locator = frigateApp.page.locator(handle);
+      await expect(locator).toHaveText(/\d{1,2}:\d{2}/, { timeout: 5_000 });
+      await expect(locator).not.toHaveAttribute("style", /top:\s*0px/);
+    }
+  });
+
+  test("the time range picker opens without a configured timezone", async ({
+    frigateApp,
+  }) => {
+    await frigateApp.installDefaults();
+    const form = await openMultiCameraTab(frigateApp);
+
+    // ui.timezone is null until the user sets one, which used to take the
+    // whole page down when the calendar worked out its disabled days
+    await form
+      .getByRole("button", { name: /^start time$/i })
+      .click({ timeout: 5_000 });
+
+    await expect(
+      frigateApp.page.getByRole("button", { name: /previous month/i }),
+    ).toBeVisible({ timeout: 5_000 });
+  });
+
+  test("canceling timeline selection reopens the form with the case intact", async ({
+    frigateApp,
+  }) => {
+    await frigateApp.installDefaults();
+    const form = await openMultiCameraTab(frigateApp);
+
+    await form
+      .getByPlaceholder(/new case name/i)
+      .fill("Incident 7", { timeout: 5_000 });
+    await form
+      .getByPlaceholder(/case description/i)
+      .fill("Front gate follow-up");
+
+    await form.getByRole("button", { name: "Select from Timeline" }).click();
+    await expect(form).toBeHidden({ timeout: 5_000 });
+
+    await frigateApp.page.getByRole("button", { name: /cancel/i }).click();
+
+    await expect(form).toBeVisible({ timeout: 5_000 });
+    await expect(
+      form.getByRole("tab", { name: /multi-camera/i }),
+    ).toHaveAttribute("aria-selected", "true");
+    await expect(form.getByPlaceholder(/new case name/i)).toHaveValue(
+      "Incident 7",
+    );
+    await expect(form.getByPlaceholder(/case description/i)).toHaveValue(
+      "Front gate follow-up",
+    );
   });
 });
 

web/e2e/specs/history-debug-replay.spec.ts

@@ -0,0 +1,207 @@
+/**
+ * Debug Replay range selection from History -- HIGH tier.
+ *
+ * Covers the "Select from Timeline" flow that Debug Replay shares with
+ * Export. The other half of the same report, a loading spinner latched
+ * after Cancel, needs real media: the vod mock serves an empty playlist.
+ */
+
+import { test, expect, type FrigateApp } from "../fixtures/frigate-test";
+
+// the selection is seeded around the playback position, so land near the
+// live edge
+const playbackTime = Math.floor(Date.now() / 1000) - 300;
+
+async function openRecordingView(frigateApp: FrigateApp) {
+  // The recording view pulls these while the timeline renders; the preview
+  // server 500s on them, which the error collector would flag.
+  await frigateApp.page.route("**/api/*/recordings**", (route) =>
+    route.fulfill({ json: [] }),
+  );
+  await frigateApp.page.route("**/api/recordings/unavailable**", (route) =>
+    route.fulfill({ json: [] }),
+  );
+  // inert here; the 0.19 recording view fetches coverage and needs an
+  // object, so this has to follow the broad recordings route to win
+  await frigateApp.page.route("**/api/*/recordings/coverage**", (route) =>
+    route.fulfill({
+      json: {
+        spans: [
+          {
+            start_time: playbackTime - 3600,
+            end_time: playbackTime + 600,
+            streams: ["main"],
+          },
+        ],
+        codecs_compatible: true,
+        streams: {
+          main: {
+            video_codec: "h264",
+            audio_rate: null,
+            audio_codec: null,
+            has_audio: false,
+            bitrate: 2_000_000,
+          },
+        },
+      },
+    }),
+  );
+
+  await frigateApp.goto(`/review?timestamp=front_door_${playbackTime}`);
+}
+
+// desktop reaches Debug Replay through the Actions menu, mobile through
+// the settings drawer; both render the same form
+async function openDebugReplayForm(frigateApp: FrigateApp) {
+  if (frigateApp.isMobile) {
+    await frigateApp.page
+      .getByRole("button", { name: /filters/i })
+      .first()
+      .click({ timeout: 15_000 });
+    await frigateApp.page
+      .getByRole("button", { name: /^debug replay$/i })
+      .click();
+  } else {
+    await frigateApp.page
+      .getByRole("button", { name: /actions/i })
+      .click({ timeout: 15_000 });
+    await frigateApp.page
+      .getByRole("menuitem", { name: /debug replay/i })
+      .click();
+  }
+
+  const form = frigateApp.page.getByRole("dialog");
+  await expect(form).toBeVisible({ timeout: 5_000 });
+  return form;
+}
+
+async function selectRangeFromTimeline(frigateApp: FrigateApp) {
+  const form = await openDebugReplayForm(frigateApp);
+  await form.getByText("From Timeline").click();
+  await form.getByRole("button", { name: "Select", exact: true }).click();
+  await expect(form).toBeHidden({ timeout: 5_000 });
+
+  await expect(frigateApp.page.locator(".export-start")).toHaveText(
+    /\d{1,2}:\d{2}/,
+    { timeout: 5_000 },
+  );
+}
+
+// moving the playhead between the two selections is what makes the second
+// range differ from the first
+async function reselectRange(frigateApp: FrigateApp) {
+  await selectRangeFromTimeline(frigateApp);
+
+  await frigateApp.page
+    .getByRole("button", { name: /^cancel$/i })
+    .click({ timeout: 5_000 });
+  await expect(frigateApp.page.locator(".export-start")).toHaveCount(0);
+
+  const segments = frigateApp.page.locator(".segment[data-segment-id]");
+  const count = await segments.count();
+  await segments.nth(Math.min(20, count - 1)).click({ force: true });
+
+  await selectRangeFromTimeline(frigateApp);
+}
+
+// the loop flipped this label between the two ranges ~25 times a second
+async function countHandleLabelChanges(frigateApp: FrigateApp) {
+  return frigateApp.page.evaluate(async () => {
+    const handle = document.querySelector(".export-start");
+    if (!handle) {
+      return -1;
+    }
+
+    let changes = 0;
+    let last = handle.textContent;
+    const observer = new MutationObserver(() => {
+      if (handle.textContent !== last) {
+        changes += 1;
+        last = handle.textContent;
+      }
+    });
+    observer.observe(handle, {
+      subtree: true,
+      childList: true,
+      characterData: true,
+    });
+    await new Promise((resolve) => setTimeout(resolve, 1500));
+    observer.disconnect();
+    return changes;
+  });
+}
+
+test.describe("Debug Replay from History @high", () => {
+  test("a reselected range lands once and stays put", async ({
+    frigateApp,
+  }) => {
+    if (frigateApp.isMobile) {
+      test.skip();
+      return;
+    }
+
+    const pageErrors: string[] = [];
+    frigateApp.page.on("pageerror", (err) => pageErrors.push(err.message));
+
+    await frigateApp.installDefaults();
+    await openRecordingView(frigateApp);
+    await reselectRange(frigateApp);
+
+    expect(await countHandleLabelChanges(frigateApp)).toBe(0);
+    expect(
+      pageErrors.filter((message) => /Maximum update depth/i.test(message)),
+    ).toHaveLength(0);
+  });
+
+  test("dragging a handle after a reselect moves it", async ({
+    frigateApp,
+  }) => {
+    if (frigateApp.isMobile) {
+      test.skip();
+      return;
+    }
+
+    await frigateApp.installDefaults();
+    await openRecordingView(frigateApp);
+    await reselectRange(frigateApp);
+
+    const start = frigateApp.page.locator(".export-start");
+    const before = (await start.textContent()) ?? "";
+    const box = await start.boundingBox();
+    if (!box) {
+      throw new Error("export start handle has no bounding box");
+    }
+
+    const x = box.x + box.width / 2;
+    const y = box.y + box.height / 2;
+    await frigateApp.page.mouse.move(x, y);
+    await frigateApp.page.mouse.down();
+    await frigateApp.page.mouse.move(x, y - 90, { steps: 12 });
+    await frigateApp.page.mouse.up();
+
+    await expect(start).not.toHaveText(before, { timeout: 5_000 });
+  });
+});
+
+test.describe("Debug Replay from History — mobile @high @mobile", () => {
+  test("a reselected range lands once and stays put", async ({
+    frigateApp,
+  }) => {
+    if (!frigateApp.isMobile) {
+      test.skip();
+      return;
+    }
+
+    const pageErrors: string[] = [];
+    frigateApp.page.on("pageerror", (err) => pageErrors.push(err.message));
+
+    await frigateApp.installDefaults();
+    await openRecordingView(frigateApp);
+    await reselectRange(frigateApp);
+
+    expect(await countHandleLabelChanges(frigateApp)).toBe(0);
+    expect(
+      pageErrors.filter((message) => /Maximum update depth/i.test(message)),
+    ).toHaveLength(0);
+  });
+});

web/index.html

@@ -27,6 +27,7 @@
     <link rel="mask-icon" href="/images/branding/favicon.svg" color="#3b82f7" />
     <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
     <meta name="theme-color" content="#000000" media="(prefers-color-scheme: dark)" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="default" />
   </head>
   <body>
     <div id="root"></div>

web/login.html

@@ -27,6 +27,7 @@
     <link rel="mask-icon" href="/images/branding/favicon.svg" color="#3b82f7" />
     <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
     <meta name="theme-color" content="#000000" media="(prefers-color-scheme: dark)" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="default" />
   </head>
   <body>
     <div id="root"></div>

web/public/locales/ar/audio.json

@@ -38,7 +38,7 @@
   "cough": "سُعَال",
   "throat_clearing": "تَنْحِيم",
   "sneeze": "عُطَاس",
-  "sniff": "شَمَّ",
+  "sniff": "كشف",
   "run": "رَكْض",
   "shuffle": "خَلْط",
   "footsteps": "خُطُوَات",
@@ -161,5 +161,43 @@
   "rumble": "الحلبة",
   "skateboard": "لوح تزلج",
   "echo": "صدى الصوت",
-  "noise": "ازعاج"
+  "noise": "ازعاج",
+  "duck": "بطة",
+  "quack": "صوت البطة",
+  "goose": "وزة",
+  "honk": "نعيق الأوز",
+  "wild_animals": "حيوانات برية",
+  "roar": "زئير",
+  "chirp": "زقزقة",
+  "pigeon": "حمامة",
+  "crow": "غراب",
+  "roaring_cats": "قطط هائجة",
+  "squawk": "نعيق",
+  "coo": "هديل الحمام",
+  "mallet_percussion": "مطرقة إيقاعية",
+  "marimba": "ماريمبا",
+  "glockenspiel": "معزف الأجراس",
+  "vibraphone": "فيبرافون",
+  "steelpan": "طبل نحاسي",
+  "orchestra": "أوركسترا",
+  "brass_instrument": "آلة نحاسية",
+  "french_horn": "بوق فرنسي",
+  "trumpet": "بوق",
+  "trombone": "ترومبون",
+  "bowed_string_instrument": "آلة وترية مقوسة",
+  "string_section": "آلات وترية",
+  "violin": "كمان",
+  "pizzicato": "تقنية العزف بيزيكاتو",
+  "cello": "تشيلو",
+  "double_bass": "كمان كبير",
+  "wind_instrument": "آلة نفخية",
+  "flute": "فلوت",
+  "saxophone": "ساكسفون",
+  "clarinet": "كلارينيت",
+  "harp": "قيثارة",
+  "bell": "جرس",
+  "church_bell": "جرس الكنيسة",
+  "jingle_bell": "جرس جلجل",
+  "bicycle_bell": "جرس الدراجة",
+  "tuning_fork": "شوكة رنانة"
 }

web/public/locales/az/audio.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/common.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/components/auth.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/components/camera.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/components/dialog.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/components/filter.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/components/icons.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/components/input.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/components/player.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/config/cameras.json

@@ -0,0 +1 @@
+{}

web/public/locales/az/config/global.json

@@ -0,0 +1 @@
+{}