aae8c38a20
Phase 6 / Gate 3 — Security-Review auf den fertigen Code, 4 thematische Pakete: - P1 Secrets+Injection (client/phraser/diagnostics): validate haertet URL/Entity/ Unicode-Umgehungen (// , &entity; , Cc/Cf/Zl/Zp); kein Key-Leak. - P2 XSS+externe (card/ha_entity/frontend): kein XSS; DoS-Caps (Forecast 400, Karte 60). - P3 Mutator+Startup (coordinator/__init__/const): nicht-blockierender Startup via Background-Task, LLM-/Store-Ops defensiv, weather_entity_id-Guard, build_items NaN/inf+Caps, Warn-Log ohne Secret. - P4 Flows (config_flow): test_entity exception-frei, _clean_item defensiv, finite Bandgrenzen + sanitized_options-Normalisierung, echte bool-Coercion, Typ-Log. - 24 Findings, 14 uebernommen (mit Regressionstests), 10 verworfen mit Evidenz. Suite gruen 188/188. Gate 3 BESTANDEN. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .claude/skills | ||
| .github/workflows | ||
| _bmad | ||
| _bmad-output/planning-artifacts | ||
| blueprints/automation/what_to_wear | ||
| brands-assets/custom_integrations/what_to_wear | ||
| custom_components/what_to_wear | ||
| docs | ||
| tests | ||
| .gitignore | ||
| CHANGELOG.md | ||
| hacs.json | ||
| LEDGER.md | ||
| LICENSE | ||
| NOTICE | ||
| pyproject.toml | ||
| README.md | ||
| requirements-test.txt | ||
What to Wear (WTW)
A Home Assistant integration that tells you — the evening before — which clothes from your own wardrobe to lay out for tomorrow. It derives a complete outfit deterministically from your weather entity's forecast, explains every piece, names what you're missing, and delivers it where you already live: dashboard card, phone push, and voice announcement.
- Deterministic core, no cloud, no telemetry. The optional LLM tone is strictly opt-in (bring your own key) and only rephrases — it never changes the selection.
- Your real wardrobe as native Home Assistant sub-entries.
- de + en, minimum Home Assistant 2025.3.
Install (HACS)
Until the integration is in the HACS default store, add it as a custom repository:
- HACS → three-dot menu → Custom repositories → add
https://github.com/kenearos/what_to_wear, category Integration. - Install What to Wear, then restart Home Assistant.
- Settings → Devices & Services → Add integration → What to Wear.
In the setup dialog, pick your weather.* entity (it is verified immediately),
set your cold-sensitivity, and optionally create the example wardrobe (12
items) so you get a full recommendation right away. Replace the example items
with your own at your own pace.
The dashboard card
The integration ships a read-only Lovelace card and registers it automatically
in storage mode. Just add a What to Wear card (or a manual card of type
custom:what-to-wear-card) to a dashboard.
YAML-mode dashboards: automatic registration is skipped. Add the resource manually under Settings → Dashboards → Resources:
url: /what_to_wear/what-to-wear-card.js
type: module
Notifications & announcements (blueprints)
Two automation blueprints call what_to_wear.recommend for a fresh result and
use its response. Import them:
- Push notification —
- TTS announcement —
The push blueprint can be set to send only when the recommendation changed or when there is a gap or an alert.
The service
what_to_wear.recommend forces a fresh computation and (optionally) returns the
full recommendation, and always fires the what_to_wear_recommendation event.
Removing the integration
⚠️ Removing the integration deletes your wardrobe (the item sub-entries). Home Assistant backups include it, so back up before removing if you want to keep your items.
Privacy
By default, What to Wear makes no external network calls and sends no telemetry. All computation is local.
Optional LLM tone (opt-in only). If you enable the LLM tone with your own API key, then on each recommendation the following is sent to the provider you chose (OpenAI or Anthropic — a third country is possible), under that provider's terms: your item names, the weather values, and the target language. Never sent: photos, coordinates, entity ids, or any other household data. Item names are treated as untrusted input; the model is instructed to ignore any instructions embedded in them, and the output is validated (plain text only, no links/markup, every item and gap named) — otherwise the deterministic rule text is used. A residual risk remains that a crafted item name influences the wording; the model can never change the selection.
Key storage. The API key is stored in Home Assistant's config storage — the Home Assistant standard — which is unencrypted on disk and included in backups. Disabling the LLM tone removes the stored key.
Datenschutz (Deutsch)
Standardmäßig macht What to Wear keine externen Netzaufrufe und sendet keine Telemetrie. Die gesamte Berechnung läuft lokal.
Optionaler LLM-Ton (nur Opt-in). Aktivierst du den LLM-Ton mit deinem eigenen API-Key, werden bei jeder Empfehlung an den gewählten Anbieter (OpenAI oder Anthropic — Drittland möglich) unter dessen Bedingungen übertragen: deine Stücknamen, die Wetterkennwerte und die Zielsprache. Nie übertragen: Fotos, Koordinaten, Entity-IDs oder andere Haushaltsdaten. Stücknamen gelten als nicht vertrauenswürdige Eingabe; das Modell wird angewiesen, darin enthaltene Anweisungen zu ignorieren, und die Ausgabe wird validiert (nur Fließtext, keine Links/Markup, jedes Stück und jede Lücke genannt) — sonst wird der deterministische Regeltext verwendet. Ein Restrisiko bleibt, dass ein präparierter Stückname die Formulierung beeinflusst; die Auswahl kann das Modell nie ändern.
Key-Speicherung. Der API-Key liegt im Home-Assistant-Config-Storage (der HA-Standard) — unverschlüsselt auf der Platte und in Backups enthalten. Beim Deaktivieren des LLM-Tons wird der gespeicherte Key entfernt.
Development
uv venv --python 3.13 .venv
.venv/bin/pip install -r requirements-test.txt
.venv/bin/pytest -q