lasselian/prism-desktop 1.6

Prism Desktop v1.6

on GitHub

⚠️ Security - please rotate your Home Assistant token

This release fixes a vulnerability in 1.5.5 and earlier that could leak your
Home Assistant long-lived access token to third-party servers.

Album art and Assist voice replies were fetched using the same authenticated
session as the API, which sends Authorization: Bearer <your token> on every
request. When Home Assistant handed back an absolute third-party URL - which it
does routinely for Chromecast, Music Assistant, HEOS, WiiM, Xbox, PlayStation
Network, Yoto and universal media players - that token was sent to whatever
server hosted the artwork, where it could end up in request logs.

This needed no attacker. If you used a media tile backed by any of those
integrations, it very likely happened to you on every artwork change.

What you should do: rotate your Home Assistant token. In Home Assistant, go
to your profile → Security → Long-Lived Access Tokens, delete the token Prism
is using, create a new one, and enter it in Prism under Settings → Home
Assistant.

I'm sorry. This was my mistake, it went unnoticed for too long, and a token
leaving your network is exactly what this app should never have done. Thank you
to @valoche-68 for finding it, reporting it privately, and contributing the
first fix.

Technical detail: media URLs now go through an origin check. Anything on your
Home Assistant origin uses the authenticated session with redirects refused, so
the token cannot be bounced off-origin. Anything else is fetched with no
credentials and no cookie jar - the same way Home Assistant's own frontend
loads them. External artwork keeps working; only the credential stops
travelling. Responses are size-capped, and error logs no longer include the
URL, which can carry signed query secrets.

🍎 macOS support - thanks to @HomeRiz

Prism Desktop now runs natively on macOS, with builds for both Apple Silicon
and Intel. Download the .dmg to install, or the .zip if you prefer.

This was contributed in full by @HomeRiz (#64) - the app bundle, DMG
packaging, the CI workflow that builds both architectures, and a long tail of
platform fixes:

• Tray behaviour adapted for macOS: left-click toggles the dashboard, right-click
  opens the menu, and the tray defaults to the top of the screen.
• Accessibility permission is re-requested once per app version instead of every launch.
• The updater downloads the architecture-specific asset, and a failed update now
  rolls back the .app replace instead of destroying the install.
• Releases publish a SHA256SUMS file, which the in-app updater verifies.

Note on token storage: these builds are ad-hoc signed (no paid Apple Developer
certificate), so the macOS Keychain isn't used - the code signature changes with
every update, which would otherwise trigger a password prompt each time. Your
token is stored in an encrypted file keyed to your Mac's hardware UUID instead.
This protects it at rest, but is weaker than the Keychain: other software
running under your user account could potentially recover it. See the README
for details.

🗣️ Assist (beta)

Talk or type to Home Assistant's Assist pipeline straight from the dashboard -
push-to-talk voice with spoken replies, or plain text chat. Pick your microphone
and speaker, bind a global shortcut to open it, and optionally have the mic start
listening the moment the shortcut fires.

Assist is off by default and marked beta. Turn it on under
Settings → Assist (Beta). While it's off, the footer button is hidden, its
shortcut is inert, and the microphone is never opened. Expect rough edges, and
please report anything that misbehaves.

On KDE Wayland the shortcut is managed by KDE itself, and on other Wayland
desktops you can bind prism-desktop --assist as a custom keybind - the
settings panel explains both.

🚨 Alarm control panel support

Alarm panels are now a tile type, with arm modes for Home, Away, Night, Vacation
and Bypass, code entry for both arming and disarming, and live state through
arming / pending / disarming / triggered.

🔔 Actionable notifications (Windows + Linux)

Notifications from Home Assistant can now carry buttons that call straight back
into HA, firing a mobile_app_notification_action event with the action id and
your device identity. Linux gets a native D-Bus notifier for this.

✨ Other additions

• 3D printer tiles now support image.* camera streams alongside cameras.
• Russian translation - thanks @kfattum (#63).
• Nix flake updated for the previous release - thanks @niklasthorild (#58).

🐛 Fixes

• Certificate handling - Windows and macOS now fall back to the bundled
  certifi CA bundle. Python sources trust from the Windows CryptoAPI store,
  which is populated lazily and can be stale or incomplete, breaking TLS
  connections on some machines (#61).
• Windows auto-update - the silent installer never relaunched the app after
  updating (#60).
• Assist UI improvements (#61).
• Config file is backed up rather than lost if it can't be parsed.
• The button edit menu is more compact, with margin and layout tidying.
• Dead code, duplicate definitions and unused imports removed.

Thanks

@HomeRiz for native macOS support · @valoche-68 for responsibly
reporting the token leak and the first fix · @kfattum for the Russian
translation · @niklasthorild for the flake update.

Install

Checksums for the macOS builds are in SHA256SUMS.