Merge branch 'pre-release-candidate' into feature/email-summarizer-plugin

Author: AnkushMalaker

CLAUDE.md

@@ -325,6 +325,31 @@ OLLAMA_BASE_URL=http://ollama:11434
 SPEAKER_SERVICE_URL=http://speaker-recognition:8085
 ```
 
+### Plugin Security Architecture
+
+**Three-File Separation**:
+
+1. **backends/advanced/.env** - Secrets (gitignored)
+   ```bash
+   SMTP_PASSWORD=abcdefghijklmnop
+   OPENAI_API_KEY=sk-proj-...
+   ```
+
+2. **config/plugins.yml** - Orchestration (uses env var references)
+   ```yaml
+   plugins:
+     email_summarizer:
+       enabled: true
+       smtp_password: ${SMTP_PASSWORD}  # Reference, not actual value!
+   ```
+
+3. **plugins/{plugin_id}/config.yml** - Non-secret defaults
+   ```yaml
+   subject_prefix: "Conversation Summary"
+   ```
+
+**CRITICAL**: Never hardcode secrets in `config/plugins.yml`. Always use `${ENV_VAR}` syntax.
+
 ## Quick API Reference
 
 ### Common Endpoints

backends/advanced/.env.template

@@ -58,23 +58,49 @@ LANGFUSE_SECRET_KEY=
 # Tailscale auth key (for remote service access)
 TS_AUTHKEY=
 
-# Home Assistant long-lived access token (for voice control plugin)
-HA_TOKEN=
-
 # ========================================
-# Email Summarizer Plugin (Optional)
+# Plugin Configuration
 # ========================================
+# Plugin-specific configuration is in: backends/advanced/src/advanced_omi_backend/plugins/{plugin_id}/config.yml
+# Plugin orchestration (enabled, events) is in: config/plugins.yml
+# This section contains ONLY plugin secrets
+
+# ---------------------------------------
+# Home Assistant Plugin
+# ---------------------------------------
+# Enable in config/plugins.yml
+# Configure in backends/advanced/src/advanced_omi_backend/plugins/homeassistant/config.yml
+
+# Home Assistant server URL
+HA_URL=http://homeassistant.local:8123
+
+# Home Assistant long-lived access token
+# Get from: Profile → Security → Long-Lived Access Tokens
+HA_TOKEN=
 
-# SMTP Configuration for sending email summaries
+# Wake word for voice commands (optional, default: vivi)
+HA_WAKE_WORD=vivi
+
+# Request timeout in seconds (optional, default: 30)
+HA_TIMEOUT=30
+
+# ---------------------------------------
+# Email Summarizer Plugin
+# ---------------------------------------
+# Enable in config/plugins.yml
+# Configure in backends/advanced/src/advanced_omi_backend/plugins/email_summarizer/config.yml
+
+# SMTP server configuration
 # For Gmail: Use App Password (requires 2FA enabled)
 # 1. Go to Google Account → Security → 2-Step Verification
 # 2. Scroll to "App passwords" → Generate password for "Mail"
 # 3. Use the 16-character password below (no spaces)
-
 SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
 SMTP_USERNAME=your-email@gmail.com
 SMTP_PASSWORD=your-app-password-here
 SMTP_USE_TLS=true
+
+# Email sender information
 FROM_EMAIL=noreply@chronicle.ai
 FROM_NAME=Chronicle AI