tesla-cli 5.3.0__tar.gz → 5.4.0__tar.gz

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/.github/workflows/ci.yml

@@ -66,6 +66,7 @@ jobs:
         env:
           CYPRESS_INSTALL_BINARY: "0"
       - run: npx tsc --noEmit
+      - run: npm run lint
       - run: npx vitest run
       - run: npx vite build --outDir "$RUNNER_TEMP/ui-dist" --emptyOutDir
 

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/.github/workflows/publish.yml

@@ -68,11 +68,68 @@ jobs:
       - name: Set up Python
         run: uv python install 3.12
 
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: ui/package-lock.json
+
+      - name: Build dashboard into the package
+        working-directory: ui
+        env:
+          CYPRESS_INSTALL_BINARY: "0"
+        run: |
+          npm ci
+          npm run build
+
       - name: Build package
         run: uv build
 
+      - name: Wheel ships the dashboard
+        run: |
+          python3 - <<'PY'
+          import glob, zipfile
+          names = zipfile.ZipFile(glob.glob("dist/*.whl")[0]).namelist()
+          assert "tesla_cli/api/ui_dist/index.html" in names, "dashboard missing from wheel"
+          print(sum(n.startswith("tesla_cli/api/ui_dist/") for n in names), "dashboard files in wheel")
+          PY
+
       - name: Scan distribution archives before publication
         run: scripts/secret-scan.sh --artifacts dist
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+
+  docker:
+    name: Publish multi-arch image to GHCR
+    needs: verify
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/tesla-cli
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/.gitignore

@@ -88,3 +88,6 @@ audit/
 /tesla-config*.bak
 /tesla-config*.backup
 coverage.xml
+
+# Built dashboard (make build / release workflow); shipped via hatch artifacts
+src/tesla_cli/api/ui_dist/

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/.gitleaks.toml

@@ -29,10 +29,14 @@ regex = '''\b[0-9]{7,12}:[A-Za-z0-9_-]{30,50}\b'''
 [[rules]]
 id = "generic-api-key"
 [[rules.allowlists]]
-description = "Audited generated React vnode SHA1 keys, not authentication keys"
+# Ionic/Stencil compiled components carry 40-hex SHA1 vnode keys
+# (`key:"<sha1>"`). The generic rule sometimes captures only a prefix of one
+# (seen: 27 chars), so accept hex-only prefixes of 20-40 chars — still only
+# inside built dashboard bundles, and only in the `key:"<hex>` vnode shape.
+description = "Audited generated React/Stencil vnode SHA1 keys, not authentication keys"
 condition = "AND"
 regexTarget = "match"
-regexes = ['''\bkey\s*:\s*["'][a-f0-9]{30,40}(?:["']|$)''']
+regexes = ['''\bkey\s*:\s*["'][a-f0-9]{20,40}(?:["']|$)''']
 paths = ['''(?:^|/)(?:src/)?tesla_cli/api/ui_dist/assets/[^/]+\.js$''']
 
 [[rules]]

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/CHANGELOG.md

@@ -5,6 +5,99 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.4.0] - 2026-11-04
+
+Stabilization release: works through the remaining findings of the critical
+production-readiness review. No new end-user features.
+
+### Upgrading from 5.3.x
+
+- **`openquery` is now optional** (`tesla-cli[query]`). It was a hard
+  dependency that pulled paddlepaddle, torch and CUDA libraries (gigabytes)
+  into every install and has no Linux arm64 wheels. A base install with the
+  dashboard is now ~84 MB. Colombian registry features (RUNT, SIMIT, …) need
+  `pip install 'tesla-cli[query]'`; the Docker image omits it (build with
+  `--build-arg UV_EXTRAS=...` to include it, amd64 only).
+
+- `POST /api/dossier/refresh` replaces `GET` (state-changing GETs are
+  triggerable cross-site). The bundled dashboard is updated.
+- `/api/auth/browser-login` ignores `email`/`password` (they were never used:
+  login happens in Tesla's own page in a browser window on the server).
+- Order tracking sends `deviceCountry`/`deviceLanguage` from the new
+  `[order] country` / `language` settings (default `US` / `en`; it used to
+  be hardcoded to `CO` / `es`). Colombian users: `tesla config set
+  order.country CO` and `order.language es`.
+- Tesla authentication failures surface as HTTP 424 (not 401, which the
+  dashboard reads as "wrong API key"); Tesla unreachable is 504.
+- Docker images: `ghcr.io/dacrypt/tesla-cli` (amd64 + arm64).
+
+### Reliability
+
+- **Central error mapping** (`api/errors.py`) replaces 19 copy-pasted blocks
+  that guessed the HTTP status by searching for "412"/"429" in error text;
+  typed errors escaping any route are mapped by a global handler.
+- **Network retries** for every backend: connection failures are retried for
+  any method, read timeouts only for GET — a command is never sent twice.
+  New typed `NetworkError`.
+- **Rate limits per Tesla quota class** (data 45/min, commands 25/min, wake
+  3/min) instead of one 5/min bucket shared with the dashboard poller, which
+  could block commands for up to 30 s.
+- Owner API backend moved onto the shared HTTP helper (429/503 backoff,
+  Retry-After, typed errors).
+- 31 silently swallowed exceptions now log with tracebacks; new global
+  `--debug` flag / `TESLA_LOG_LEVEL`; a test blocks new silent swallows.
+
+### Security
+
+- **Root cause of the October 2026 disclosure fixed.** `tesla config backup`
+  wrote `tesla-config-backup.json` into the current directory (the project
+  checkout, where it was committed) and its key-name redaction let Apprise
+  notification URLs (Telegram bot token), VIN and reservation through.
+  Backups, `config export -o` and `config export-env -o` now go through
+  `core/private_files.py`: default location `~/.tesla-cli/backups/`, mode
+  `0600`, and **refuse to write inside any git work tree**. Redaction covers
+  notification/webhook URLs. `config export` no longer claims to be "safe to
+  share" while printing every key: credentials are redacted unless
+  `--include-secrets`. `config restore` never writes `[REDACTED]`
+  placeholders back.
+- Secret-scanner allowlist for compiled dashboard bundles also accepts
+  20–40-char prefixes of Stencil vnode SHA1 keys (gitleaks captured a 27-char
+  prefix of one after the legacy bundle was dropped). Still restricted to
+  `ui_dist/assets/*.js` and the `key:"<hex>` shape.
+- Single-flight guard on endpoints that spawn headless browsers (login,
+  portal scrape, dossier refresh): concurrent calls get 429.
+- Audit log covers every mutating API call with recursive redaction (PINs,
+  URLs, keys).
+- Static file serving uses `Path.is_relative_to` (prefix check matched
+  sibling directories).
+- Dashboard no longer sends the Tesla password to the server.
+
+### Architecture
+
+- `core/` no longer imports the CLI or Rich (interactive login moved to
+  `cli/auth_flow.py`; dossier progress via callback); the API no longer
+  imports private CLI helpers (`core/charging.py`, `core/config_checks.py`);
+  routes no longer call external APIs inline
+  (`core/backends/colombia_open_data.py`). `tests/test_layering.py`
+  enforces it.
+- **Config schema versioning**: `schema_version` + step-by-step migrations;
+  configs from a newer tesla-cli are refused. `tesla config migrate` now
+  actually detects missing keys (it diffed the loaded model before) and its
+  backup is `0600`.
+
+### Dashboard & release
+
+- ESLint errors fixed and lint runs in CI (legacy `any` capped as warnings);
+  one shared HTTP client; TeslaMate/Grafana links use the dashboard host.
+- Dropped `@vitejs/plugin-legacy`: bundle 4.6 MB → 2.3 MB.
+- The compiled dashboard is no longer committed; the release workflow builds
+  it and verifies the wheel ships it.
+- Multi-arch image published to GHCR on each release; new
+  [self-hosting guide](docs/self-hosting.md) (remote access, upgrades,
+  backups).
+- Docs: removed links to unpublished design notes; CLI translations marked
+  experimental (`--lang` does not translate output yet).
+
 ## [5.3.0] - 2026-11-04
 
 First stable 5.x release on PyPI (the previous published version is 4.9.0;
@@ -220,7 +313,7 @@ managed TeslaMate stack — and a verified release pipeline.
 ### CLI — Native EV Route Planner (Phase 1 MVP)
 
 First shippable phase of the native EV planner roadmap
-(`.omc/plans/native-ev-planner.md`). Suggests charging stops along a route
+(the `native-ev-planner` design notes (internal, not published)). Suggests charging stops along a route
 using open-source data — no ABRP Premium contract required.
 
 - **`tesla nav plan <origin> <destination>`** — computes a driving route via
@@ -311,7 +404,7 @@ using open-source data — no ABRP Premium contract required.
 ### Why
 
 Unblocks the phased native EV route planner roadmap
-(`.omc/plans/native-ev-planner.md`): Phase 1 `tesla nav plan <from> <to>`
+(the `native-ev-planner` design notes (internal, not published)): Phase 1 `tesla nav plan <from> <to>`
 will tag generated routes with `source="native-planner"` so that re-running
 a plan cannot clobber a route you created by hand with `tesla nav route
 create`. Ships standalone (no dependency on later phases).
@@ -369,7 +462,7 @@ create`. Ships standalone (no dependency on later phases).
 - `docs/user-guide.md` — new "Favorites Importer" section with command examples
   and dedupe semantics.
 - `docs/roadmap.md` — current state advanced to v4.9.3.
-- `.omc/plans/nav-favorites-importer.md` — ralplan consensus design record.
+- the `nav-favorites-importer` design notes (internal, not published) — ralplan consensus design record.
 
 ## [4.9.2] - 2026-04-20
 

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/CLAUDE.md

@@ -4,7 +4,7 @@
 
 Full-stack Tesla management platform: CLI (Typer) + REST API (FastAPI) + Web Dashboard (React/Ionic). Tracks orders, controls vehicles, aggregates data from 15+ sources, integrates with TeslaMate/MQTT/HA/ABRP.
 
-**Version**: v5.3.0 | **Python**: 3.12+ | **Package manager**: uv | **Tests**: 2100+
+**Version**: v5.4.0 | **Python**: 3.12+ | **Package manager**: uv | **Tests**: 2100+
 
 ## Architecture (quick reference)
 
@@ -42,7 +42,7 @@ Full architecture: [docs/architecture.md](docs/architecture.md)
 ## Development commands
 
 ```bash
-uv sync --extra dev --extra serve --extra teslaMate --extra fleet --extra pdf
+uv sync --extra dev --extra serve --extra teslaMate --extra fleet --extra pdf --extra query
 uv run pytest -m "not integration" -x    # unit tests (fast)
 uv run pytest                            # all tests including integration
 uv run ruff check src/ tests/            # lint
@@ -91,4 +91,5 @@ make api                                 # FastAPI dev server (port 8080)
 | [docs/configuration.md](docs/configuration.md) | Config keys, auth, tokens |
 | [docs/api-reference.md](docs/api-reference.md) | REST endpoints, SSE, Prometheus |
 | [docs/data-sources.md](docs/data-sources.md) | Tesla APIs, 15 registered sources |
+| [docs/self-hosting.md](docs/self-hosting.md) | Production install, remote access, upgrades, backups |
 | [docs/roadmap.md](docs/roadmap.md) | Remaining gaps, priorities |

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/Dockerfile

@@ -1,5 +1,6 @@
-# Stage 1: Build UI
-FROM node:20-alpine AS ui-build
+# Stage 1: Build UI (on the build host's native platform: the bundle is
+# platform-independent, so arm64 images do not pay for emulated npm builds)
+FROM --platform=$BUILDPLATFORM node:20-alpine AS ui-build
 WORKDIR /app/ui
 COPY ui/package*.json ./
 # Cypress (e2e only) is not needed to build the bundle
@@ -22,8 +23,11 @@ WORKDIR /app
 COPY pyproject.toml uv.lock README.md ./
 COPY src/ src/
 
-# Install with serve extra
-RUN uv sync --frozen --extra serve --extra fleet --extra teslaMate --extra pdf --no-dev
+# Extras baked into the image. Colombian registry lookups (RUNT/SIMIT) need
+# `--build-arg UV_EXTRAS="--extra serve --extra fleet --extra teslaMate --extra pdf --extra query"`
+# — amd64 only: openquery pulls paddlepaddle/torch, which ship no arm64 wheels.
+ARG UV_EXTRAS="--extra serve --extra fleet --extra teslaMate --extra pdf"
+RUN uv sync --frozen $UV_EXTRAS --no-dev
 
 # Copy freshly built UI into the location the API serves from
 COPY --from=ui-build /app/src/tesla_cli/api/ui_dist src/tesla_cli/api/ui_dist/

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tesla-cli
-Version: 5.3.0
+Version: 5.4.0
 Summary: CLI tool for Tesla order tracking and vehicle control
 Project-URL: Homepage, https://github.com/dacrypt/tesla
 Project-URL: Repository, https://github.com/dacrypt/tesla
@@ -23,7 +23,6 @@ Requires-Dist: apprise>=1.9
 Requires-Dist: cryptography>=46.0.5
 Requires-Dist: httpx>=0.28
 Requires-Dist: keyring>=25
-Requires-Dist: openquery~=1.4.0
 Requires-Dist: pydantic-settings>=2.7
 Requires-Dist: pydantic>=2.10
 Requires-Dist: pyjwt>=2.10
@@ -39,7 +38,7 @@ Requires-Dist: tesla-fleet-api>=1.0; extra == 'fleet'
 Provides-Extra: pdf
 Requires-Dist: fpdf2>=2.7; extra == 'pdf'
 Provides-Extra: query
-Requires-Dist: openquery; extra == 'query'
+Requires-Dist: openquery~=1.4.0; extra == 'query'
 Provides-Extra: serve
 Requires-Dist: fastapi>=0.110; extra == 'serve'
 Requires-Dist: uvicorn[standard]>=0.29; extra == 'serve'
@@ -71,6 +70,7 @@ tesla serve                      → start REST API + web dashboard
 ```bash
 # Requirements: Python 3.12+
 uv tool install "tesla-cli[serve,fleet]"   # or: pipx install "tesla-cli[serve,fleet]"
+# Colombian registries (RUNT, SIMIT…): add the heavy `query` extra → "tesla-cli[serve,fleet,query]"
 tesla setup
 ```
 
@@ -384,6 +384,10 @@ Notes:
 - You do not need to set `localStorage.tesla_api_url` for local dev.
 - For a non-default API target, set `VITE_TESLA_API_URL` before `make ui`.
 
+Prebuilt multi-arch images (amd64 + arm64) are published to
+`ghcr.io/dacrypt/tesla-cli`; see the [self-hosting guide](docs/self-hosting.md)
+for remote access (Tailscale / reverse proxy), upgrades and backups.
+
 ### Full Stack (with TeslaMate + Grafana)
 
 Requires `DB_PASSWORD`, `ENCRYPTION_KEY` and `GRAFANA_PASSWORD` in `.env` (no

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/README.md

@@ -22,6 +22,7 @@ tesla serve                      → start REST API + web dashboard
 ```bash
 # Requirements: Python 3.12+
 uv tool install "tesla-cli[serve,fleet]"   # or: pipx install "tesla-cli[serve,fleet]"
+# Colombian registries (RUNT, SIMIT…): add the heavy `query` extra → "tesla-cli[serve,fleet,query]"
 tesla setup
 ```
 
@@ -335,6 +336,10 @@ Notes:
 - You do not need to set `localStorage.tesla_api_url` for local dev.
 - For a non-default API target, set `VITE_TESLA_API_URL` before `make ui`.
 
+Prebuilt multi-arch images (amd64 + arm64) are published to
+`ghcr.io/dacrypt/tesla-cli`; see the [self-hosting guide](docs/self-hosting.md)
+for remote access (Tailscale / reverse proxy), upgrades and backups.
+
 ### Full Stack (with TeslaMate + Grafana)
 
 Requires `DB_PASSWORD`, `ENCRYPTION_KEY` and `GRAFANA_PASSWORD` in `.env` (no

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/SECURITY.md

@@ -28,6 +28,16 @@ We will respond within 48 hours and provide a fix timeline.
 - **Network**: All API calls direct to Tesla (no third-party relay). Self-hosted telemetry.
 - **Docker**: Non-root container, health checks, named volumes for persistent data.
 
+## Past incidents
+
+- **October 2026** — a configuration backup (`tesla-config-backup.json`)
+  generated inside the project checkout was committed, exposing a Telegram bot
+  token (revoked), a VIN, an order reservation and a Fleet API client ID.
+  History was rewritten, affected pull requests and cached objects were purged
+  by GitHub Support, and contaminated PyPI sdists were deleted. Since 5.4.0
+  the CLI refuses to write backups/exports inside a git work tree and writes
+  them `0600` under `~/.tesla-cli/backups/`.
+
 ## Publication checks
 
 CI scans all reachable history and tracked files using pinned Gitleaks, plus VIN, reservation and Telegram rules. Package publication also scans generated archives. Findings are never uploaded as public reports. GitHub secret scanning and push protection should remain enabled.

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/docker-compose.full.yml

@@ -12,6 +12,9 @@
 
 services:
   tesla-cli:
+    # Prebuilt multi-arch image (amd64 + arm64: Raspberry Pi, most NAS).
+    # Pin a release with TESLA_CLI_TAG=5.4.0; `docker compose build` builds locally.
+    image: ghcr.io/dacrypt/tesla-cli:${TESLA_CLI_TAG:-latest}
     build: .
     container_name: tesla-cli
     ports:

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/docker-compose.yml

@@ -1,5 +1,8 @@
 services:
   tesla-cli:
+    # Prebuilt multi-arch image (amd64 + arm64: Raspberry Pi, most NAS).
+    # Pin a release with TESLA_CLI_TAG=5.4.0; `docker compose build` builds locally.
+    image: ghcr.io/dacrypt/tesla-cli:${TESLA_CLI_TAG:-latest}
     build: .
     container_name: tesla-cli
     ports:

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/docs/architecture.md

@@ -11,7 +11,7 @@ src/tesla_cli/
 ├── app.py                # Entry point — registers all Typer sub-apps
 ├── config.py             # Pydantic-Settings config model (~/.tesla-cli/config.toml)
 ├── output.py             # Rich rendering + JSON mode + --anon anonymizer
-├── i18n.py               # Lightweight i18n: t(key) — en/es/pt/fr/de/it
+├── i18n.py               # Translation catalog t(key) (experimental: commands not yet translated)
 ├── exceptions.py         # AuthenticationError, ApiError, BackendError, etc.
 │
 ├── core/

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/docs/configuration.md

@@ -32,6 +32,11 @@ qos = 0
 retain = false
 tls = false
 
+[order]
+reservation_number = ""
+country = "US"                   # deviceCountry sent to Tesla's order-tasks API (e.g. "CO")
+language = "en"                  # deviceLanguage (e.g. "es")
+
 [server]
 api_key = ""                     # full-control key; auto-generated when serving off-localhost
 read_only_key = ""               # optional GET-only key (wall dashboards, Home Assistant)
@@ -155,7 +160,7 @@ tesla config auth fleet          # Fleet API OAuth2 flow
 
 | Variable | Description |
 |----------|-------------|
-| `TESLA_LANG` | UI language (`en`, `es`, `pt`, `fr`, `de`, `it`) |
+| `TESLA_LANG` | Reserved for CLI translations (experimental — output is English today) |
 | `TESLA_API_KEY` | API server full-control key (overrides config) |
 | `TESLA_READ_ONLY_KEY` | API server read-only key (overrides config) |
 | `TESLA_CLI_TOKEN_STORE` | `file` forces the encrypted file token store (default in Docker; automatic when no keyring exists) |

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/docs/nav-route.md

@@ -135,7 +135,7 @@ the real path. Single-user CLI — no lockfile.
 
 - `docs/fleet-signed-setup.md` — how to get `share` working (VCP pairing).
 - `docs/roadmap.md` — v4.9.2.1 plan (real `TelemetryArrivalSource`).
-- `.omc/plans/nav-route-telemetry.md` — full design + ADR-012.
+- the `nav-route-telemetry` design notes (internal, not published) — full design + ADR-012.
 
 ## ADR-012 — Why the split?
 
@@ -154,4 +154,4 @@ ABRP-Premium UX minus one keypress.
 - `ArrivalSource` protocol lets v4.9.2.1 plug in a real subscriber with zero
   changes to the detector, dispatcher, or CLI.
 
-Full rationale: `.omc/plans/nav-route-telemetry.md` §7.
+Full rationale: the `nav-route-telemetry` design notes (internal, not published) §7.

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/docs/roadmap.md

@@ -5,9 +5,9 @@
 
 ---
 
-## Current State (v5.3.0)
+## Current State (v5.4.0)
 
-180+ commands across 26 groups, 1970+ tests, 86 API endpoints, 27 Prometheus gauges, React dashboard with live map + Recharts analytics + Planner page, 7 providers, managed TeslaMate + Fleet Telemetry stacks, 15 data sources, 6 i18n languages, Claude Code plugin (11 skills), automation engine, Powerwall/Solar support, **VCP signed commands (fleet-signed backend)**, **multi-stop navigation with manual advance + simulated auto-advance**, **favorites importer for Google Takeout / KML / GPX**, **native EV route planner (Phases 1 + 2 + 3) with OpenRouteService + OpenChargeMap + open-elevation + OpenWeatherMap + ABRP deep-link, TeslaMate-calibrated consumption model, A\* alternatives, GPX/KML export, REST API + dashboard page**.
+180+ commands across 26 groups, 1970+ tests, 86 API endpoints, 27 Prometheus gauges, React dashboard with live map + Recharts analytics + Planner page, 7 providers, managed TeslaMate + Fleet Telemetry stacks, 15 data sources, Claude Code plugin (11 skills), automation engine, Powerwall/Solar support, **VCP signed commands (fleet-signed backend)**, **multi-stop navigation with manual advance + simulated auto-advance**, **favorites importer for Google Takeout / KML / GPX**, **native EV route planner (Phases 1 + 2 + 3) with OpenRouteService + OpenChargeMap + open-elevation + OpenWeatherMap + ABRP deep-link, TeslaMate-calibrated consumption model, A\* alternatives, GPX/KML export, REST API + dashboard page**.
 
 ---
 
@@ -37,7 +37,7 @@
 - ✅ **Favorites Importer (v4.9.3)** — `tesla nav place import` pulls favorites from Google Takeout (CSV + GeoJSON), KML, and GPX into the local place book. Stable `(source, source_id)` dedupe survives renames in Google Maps; hand-created places are never overwritten by imports. `tesla nav place send <alias>` dispatches any stored place to the car via the signed share command. Stdlib-only parsers, 25 MB file guard, 20-call geocode cap.
 - ✅ **Route Model Extension (v4.9.4)** — `Route` dataclass gains optional `source` / `source_id` fields (mirroring `Place`). `save_route` adopts the filter-None serialization pattern with hand-created dedupe. Unblocks planner-generated routes that can't overwrite user routes. Backward-compatible with existing `nav.toml` files.
 - ✅ **Native EV Route Planner — Phase 1 MVP (v4.10.0)** — `tesla nav plan <from> <to>` auto-suggests charging stops using OpenRouteService (routing) + OpenChargeMap (chargers). Default 150 km interpolation (LATAM-safe), `--network tesla|ccs|any`, `--min-power`, `--save-as` (persists as nav Route, `source="native-planner"`), `--json` output, `--abrp-link` deep URL for SoC-aware second opinion. BYOK required for both APIs (free tier signups at [openchargemap.org](https://openchargemap.org/site/profile/applications) and [openrouteservice.org](https://openrouteservice.org/dev/#/signup)). `--router osrm` for zero-key public demo.
-- ⚠️ **Native EV Route Planner — Phases 2 + 3 (v5.0.0, speculative)** — ships probe-deferred. Phase 2: TeslaMate-calibrated consumption model with `tesla nav consumption calibrate`, SoC prediction along route, elevation + weather integration, `--soc-start/--soc-target/--min-arrival-soc/--battery-kwh` flags. Phase 3: A\* alternatives (`--alternatives N`), GPX/KML export (`tesla nav route export`), REST API (`POST /api/nav/plan`), React Planner dashboard page. **Accuracy caveat**: shipped with published Tesla baseline coefficients; per-vehicle calibration requires running the Jupyter probe notebook (`notebooks/consumption-model-probe.ipynb`) against real TeslaMate data. Full design: [.omc/plans/native-ev-planner.md](../.omc/plans/native-ev-planner.md).
+- ⚠️ **Native EV Route Planner — Phases 2 + 3 (v5.0.0, speculative)** — ships probe-deferred. Phase 2: TeslaMate-calibrated consumption model with `tesla nav consumption calibrate`, SoC prediction along route, elevation + weather integration, `--soc-start/--soc-target/--min-arrival-soc/--battery-kwh` flags. Phase 3: A\* alternatives (`--alternatives N`), GPX/KML export (`tesla nav route export`), REST API (`POST /api/nav/plan`), React Planner dashboard page. **Accuracy caveat**: shipped with published Tesla baseline coefficients; per-vehicle calibration requires running the Jupyter probe notebook (`notebooks/consumption-model-probe.ipynb`) against real TeslaMate data. Design notes are internal (not published).
 
 ---
 
@@ -53,16 +53,21 @@ work takes priority over new features.
 - ✅ Encrypted file token store for Docker / headless hosts (Docker-secret master key)
 - ✅ Release pipeline: version consistency, tests before publish, UI + Docker jobs in CI, coverage floor
 
-### S1 — Next stabilization release
-- **Typed error handling** — global FastAPI exception handlers keyed on `core/exceptions.py`; replace 32 `"429" in str(exc)` checks and `detail=str(exc)` leaks; log instead of `except Exception: pass`.
-- **Uniform HTTP resilience** — retries on transport errors/timeouts for every backend (Owner and Order backends bypass the shared helper); per-vehicle rate budget instead of a global 5 req/min bucket shared with the hub poller.
-- **Layering** — move `_fetch_sessions` / config checks out of `cli/` into `core/`; remove `rich`/CLI imports from `core/`.
-- **Rate limiting** on login/scrape endpoints that spawn headless browsers.
-- **Multi-arch image on GHCR** (amd64 + arm64 for Pi/NAS) built by the release workflow.
-- **Config schema versioning** with real migrations (rename/remove keys).
-- **Backups** — `tesla backup` / `restore` for config, events DB and TeslaMate.
-- Raise coverage floor toward 70% for `core/` + `api/`; fix the 128 ESLint errors and add ESLint to CI.
-- Mark unofficial-API features (order tracking, portal scraping, RUNT/SIMIT, speculative planner) as **experimental** with health alerts when they break.
+### Done in 5.4.0
+- ✅ Typed error handling: central mapping + global handlers; silent `except: pass` now logged; `--debug`
+- ✅ HTTP resilience: safe transport retries everywhere; rate limits per Tesla quota class
+- ✅ Layering enforced by test (core ↛ cli/rich/fastapi, api ↛ cli); no HTTP calls inside routes
+- ✅ Single-flight guard on headless-browser endpoints; full audit log; dossier refresh is POST
+- ✅ Multi-arch image on GHCR; self-hosting guide (remote access, upgrades, manual backups)
+- ✅ Config `schema_version` with step-by-step migrations
+- ✅ ESLint clean + in CI; dashboard bundle halved; compiled UI out of git
+
+### S2 — Next
+- **Backups as a command** — `tesla backup` / `restore` (today: documented `tar` + `pg_dump`).
+- **Experimental features** — flag unofficial-API features (order tracking, portal scraping, RUNT/SIMIT, speculative planner) in CLI help and dashboard; raise an alert when they start failing.
+- **CLI translations** — decide: wire `cli/i18n.py` into commands or drop `--lang`.
+- **God-modules** — split `cli/commands/vehicle.py` (3.2k lines), `teslaMate.py`, `dossier.py`, `core/sources.py`; `ui/src/pages/Settings.tsx`, `api/client.ts`.
+- **Tests** — regroup the version-named files (`test_v260.py` … `test_v340.py`) by feature; raise the coverage floor (58% today) toward 70% for `core/` + `api/`; replace the 113 legacy `any` types in the dashboard.
 
 ## Remaining Gaps
 
@@ -72,7 +77,7 @@ work takes priority over new features.
 - Wire a concrete `TelemetryArrivalSource` into `tesla nav route go` (currently `NullArrivalSource` only).
 - Requires a publish-sink decision (SSE / Kafka / NATS) for the in-tree Fleet Telemetry receiver.
 - Removes the hardcoded `external-blocker` on the `nav_route_auto_advance` doctor row.
-- Trigger: open the v4.9.2.1 spike PR within 7 days of v4.9.2 merge. See ADR-012 in `.omc/plans/nav-route-telemetry.md`.
+- Trigger: open the v4.9.2.1 spike PR within 7 days of v4.9.2 merge. See ADR-012 in the `nav-route-telemetry` design notes (internal, not published).
 
 ### P3 — Lower Priority
 

tesla_cli-5.4.0/docs/self-hosting.md

@@ -0,0 +1,123 @@
+# Self-hosting guide
+
+tesla-cli is built to run on hardware you own — a home server, NAS, Raspberry
+Pi or VPS. There is no hosted/SaaS version. This guide covers a production
+setup: installation, remote access, upgrades and backups.
+
+## 1. Install
+
+### Docker (recommended)
+
+Prebuilt images for `linux/amd64` and `linux/arm64` are published to
+`ghcr.io/dacrypt/tesla-cli` on every release (`latest`, `X.Y.Z`, `X.Y`).
+
+```bash
+curl -O https://raw.githubusercontent.com/dacrypt/tesla/main/docker-compose.yml
+docker compose up -d
+docker compose logs tesla-cli | grep -A1 "API key generated"   # first start only
+```
+
+Pin a version for reproducible upgrades: `TESLA_CLI_TAG=5.4.0 docker compose up -d`.
+
+Full stack with TeslaMate, Grafana, Postgres and Mosquitto:
+`docker-compose.full.yml` (requires `DB_PASSWORD`, `ENCRYPTION_KEY`,
+`GRAFANA_PASSWORD` in `.env` — see the README).
+
+### Bare metal / VM
+
+```bash
+uv tool install "tesla-cli[serve,fleet]"    # or: pipx install ...
+tesla setup
+tesla serve install-service --host 0.0.0.0   # systemd (Linux) / launchd (macOS)
+```
+
+## 2. Security model (read this)
+
+- Binding beyond `127.0.0.1` **requires an API key**; one is generated on first
+  start. Show or rotate it with `tesla serve api-key [--rotate]`. A read-only
+  key for wall displays / Home Assistant: `tesla serve api-key --read-only --rotate`.
+- The dashboard signs in once with the key and keeps an HttpOnly cookie.
+- Cross-site requests and DNS-rebinding attempts are blocked; raw vehicle
+  commands are allowlisted (`server.extra_allowed_commands` to extend).
+- Tokens live in the OS keyring, or — in Docker/headless — in an AES-256-GCM
+  encrypted file. Keep the master key outside the volume with
+  `TESLA_CLI_MASTER_KEY_FILE` (Docker secret).
+- Every state-changing API call is written to `~/.tesla-cli/events/audit.jsonl`
+  (secrets redacted). `GET /api/audit` shows it.
+
+## 3. Remote access
+
+Never port-forward the API to the internet. Pick one:
+
+| Option | Effort | Notes |
+|--------|--------|-------|
+| **Tailscale / WireGuard** | low | Best default. Reach `http://<tailnet-host>:8080` from your phone; nothing is exposed publicly. |
+| **Reverse proxy with HTTPS** (Caddy, Traefik, nginx) | medium | Terminate TLS at the proxy; keep the API key. With the proxy on the same host, uvicorn trusts its `X-Forwarded-Proto` and the session cookie is marked `Secure`. |
+| **Cloudflare Tunnel + Access** | medium | Put Cloudflare Access (SSO) in front; keep the API key as a second factor. |
+
+Caddy example (`Caddyfile`):
+
+```
+tesla.example.com {
+    reverse_proxy 127.0.0.1:8080
+}
+```
+
+Only if the proxy itself authenticates every request may you run
+`tesla serve --insecure-no-auth`; add the public hostname to
+`server.allowed_hosts`.
+
+TeslaMate, Grafana and Mosquitto bind to `127.0.0.1` by default
+(`STACK_BIND` / `TM_BIND_ADDR` to change) — they have weak or no auth of their
+own, so reach them through the same VPN/proxy.
+
+## 4. Upgrades
+
+```bash
+docker compose pull && docker compose up -d        # Docker
+uv tool upgrade tesla-cli && tesla config migrate   # bare metal
+```
+
+`config.toml` carries a `schema_version`; older files are migrated
+automatically on load, and `tesla config migrate` writes the upgraded file
+(keeping a `0600` backup). Read the CHANGELOG "Upgrading" section of each
+release before jumping major versions.
+
+## 5. Backups
+
+Everything tesla-cli owns lives in one directory (`~/.tesla-cli`, or the
+`tesla-config` Docker volume):
+
+| Path | Contents |
+|------|----------|
+| `config.toml` | settings, API keys, integration tokens (secret) |
+| `tokens.enc.json` + `master.key` | encrypted Tesla OAuth tokens (Docker/headless) |
+| `events/` | events, alerts, audit log |
+| `dossier/`, source caches | vehicle dossier and data-source history |
+
+```bash
+# Docker volume → encrypted-at-rest location of your choice
+docker run --rm -v tesla-config:/data -v "$PWD":/backup alpine \
+  tar czf /backup/tesla-cli-$(date +%F).tgz -C /data .
+chmod 600 tesla-cli-*.tgz
+```
+
+Treat backups as secrets. If you keep `master.key` outside the volume (Docker
+secret), back it up separately — tokens cannot be decrypted without it.
+TeslaMate data lives in Postgres: `docker exec tesla-postgres pg_dump -U teslamate teslamate > teslamate.sql`.
+
+## 6. Health and troubleshooting
+
+- `GET /api/health` (public) for uptime checks; `GET /api/health?deep=true`
+  and `tesla doctor` for diagnostics.
+- `tesla --debug <command>` (or `TESLA_LOG_LEVEL=DEBUG`) prints suppressed
+  errors with tracebacks.
+- Features built on unofficial Tesla endpoints (order tracking, ownership
+  portal scraping) and Colombian registry scrapers (RUNT, SIMIT) can break
+  without notice when the upstream site changes.
+
+## Maintainer note: GHCR visibility
+
+The first image push creates the `tesla-cli` package as **private**. Make it
+public once in GitHub → Packages → tesla-cli → Package settings → Change
+visibility, so `docker compose pull` works without a login.

{tesla_cli-5.3.0 → tesla_cli-5.4.0}/docs/user-guide.md

@@ -11,7 +11,8 @@ tesla -j <command>         # JSON output (pipe to jq)
 tesla --json <command>     # same
 tesla --vin modely <cmd>   # target specific vehicle (VIN or alias)
 tesla --anon <command>     # anonymize PII (VIN, RN, email masked)
-tesla --lang es <command>  # Spanish output (also: TESLA_LANG=es)
+tesla --lang es <command>  # experimental: translation catalog only; output is English today
+tesla --debug <command>   # verbose logs to stderr, incl. errors that are otherwise suppressed
 tesla --verbose <command>  # debug logging
 ```