* fix(devcontainer): install corepack explicitly for Node 26+ (#3141)

Node 26 no longer bundles corepack, so 'corepack enable' fails with
'corepack: not found' on a clean build. Install it via npm first.

* chore: update agents workspace path

* docs: document development environment

* chore(ui): allow dev host in vite config

* docs: document remote devbox workflow

* fix(ui): drop BETA tag from notifications, mark download client BETA

* chore: point playwright MCP at system chromium in devbox

The per-session browser download fails in the IPv4-only egress-firewalled
devbox (CDN redirects to IPv6). Chromium is baked into the devbox image; the
MCP now uses --executable-path /usr/bin/chromium --no-sandbox. Docs updated.

* chore: default devcontainer workspace

* docs: simplify devbox workflow (work and push from inside the container)

* chore(devcontainer): use https apt mirrors

Plain http://deb.debian.org hangs when outbound port 80 is firewalled; https
works everywhere and is strictly an improvement.

* docs(agents): fix stale workspace path (/home/maintainerr-dev -> /workspace)

* docs(agents): document the L1/L2/L3 confinement model for agents in the devbox

* fix: initialize the active media server adapter after a switch

The switch refreshed settings and uninitialized the old adapter but never initialized the new one, so a target whose credentials carried over reported a false connection-test failure until the first real operation lazily initialized it. Initialize the now-active adapter once the switch lock releases (getService refuses mid-switch), mirroring updateSettings.

* fix(ui): standardize action buttons on the shared Button + consistent theme colors (#3143)

Several buttons bypassed the shared Button component with inline styles, giving inconsistent radii (rounded-sm vs rounded-md), text sizes/weights, and an arbitrary bright-vs-dark amber split. Standardize on the shared Button and a coherent hierarchy: maintainerr for primary, maintainerrdark for secondary brand actions, zinc for neutral.

- Rule group toolbar (Community/Import/Export): raw buttons -> Button success
- Community rule modal: Info + Upload my rules -> Button success (drops the one-off bg-zinc-900 black button)
- Pagination: bg-zinc-900 near-black -> zinc-600 neutral (matches Cancel)
- Radarr/Sonarr/Notifications Add buttons + collection log button: rounded-sm -> rounded-md
- Button: fix ghost variant typo bg-transaprent -> bg-transparent

* fix(ui): align ExecuteButton corner radius with the shared Button (rounded-md) (#3144)

* fix(server): log benign SSE client disconnects without a stack trace (#3145)

When a client disconnects from /api/events/stream mid-write, the write fails with a broken pipe (EPIPE / ERR_STREAM_DESTROYED). That is expected for SSE, but the onError handler logged the full Error stack at debug. Reuse the existing isBrokenPipeError guard to log a concise message for broken pipes, keeping real errors verbose.

* perf: bulk-prefetch Plex watch history (leaf items) before rule evaluation (#3082)

* perf: bulk-prefetch Plex watch history (leaf items) before rule evaluation

Replaces O(items × conditions) per-item /status/sessions/history/all calls with
a single paginated sweep at the start of each rule group, cached in a dedicated
plexwatchhistory cache (1 h TTL). Movies and episodes are served from a leaf map
keyed by their own ratingKey; show/season history falls through to the per-item
metadataItemID query, which Plex rolls up server-side.

- Leaf-only: the show/season rollup is dropped. It relied on grandparentKey/
  parentKey, undocumented on the history endpoint and absent over some Plex
  connections, so a missing key silently read as "never watched" (false-delete
  risk). Own ratingKey is documented and connection-stable.
- Dedicated plexwatchhistory cache (persistent, useClones: false, 1 h); the
  shared plexguid cache stays at its non-persistent defaults so general Plex
  reads stay cold-start per run. The snapshot is rebuilt fresh per scheduler
  batch (flushed at batch end) and on Plex re-init; getWatchHistory returns
  copies, so callers sorting in place can't mutate it.
- prefetchWatchHistory is a required IMediaServerService method gated by
  supportsFeature(CENTRAL_WATCH_HISTORY); Jellyfin/Emby keep their per-item path.

Original implementation and benchmarking by James Nobes (@stormshaker) in #3072.

* fix: make Plex history prefetch abortable

* style: format Plex history prefetch helper

* fix(plex): harden watch-history prefetch against partial and stale snapshots

- Only cache the bulk sweep when totalSize proves it complete; a missing or
  short totalSize falls back to per-item queries instead of trusting a
  truncated map as authoritative "never watched".
- useCache: false callers (getWatchState, which drives is-watched and thus
  deletion decisions) bypass the snapshot and read fresh per-item.

---------

Co-authored-by: maintainerr-automation[bot] <261505141+maintainerr-automation[bot]@users.noreply.github.com>
Co-authored-by: enoch85 <[email protected]>

…➔ 3.15.3) (#376)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/maintainerr/maintainerr](https://github.com/Maintainerr/Maintainerr) | patch | `3.15.2` → `3.15.3` |

---

### Release Notes

<details>
<summary>Maintainerr/Maintainerr (ghcr.io/maintainerr/maintainerr)</summary>

### [`v3.15.3`](https://github.com/Maintainerr/Maintainerr/blob/HEAD/CHANGELOG.md#3153-2026-06-23)

[Compare Source](Maintainerr/Maintainerr@v3.15.2...v3.15.3)

#### Highlights

- Improved Plex rule evaluation performance by prefetching watch history in bulk, reducing API calls and enhancing efficiency ([#&#8203;3082](Maintainerr/Maintainerr#3082)).
- Standardized UI action buttons with consistent corner radii, text styles, and theme colors ([#&#8203;3143](Maintainerr/Maintainerr#3143), [#&#8203;3144](Maintainerr/Maintainerr#3144)).

#### Fixes

- Log benign SSE client disconnects without a stack trace to reduce log noise ([#&#8203;3145](Maintainerr/Maintainerr#3145)).
- Initialize the active media server adapter immediately after a switch to prevent false connection-test failures.
- Dropped BETA tag from notifications and marked download client as BETA.
- Fixed `ExecuteButton` corner radius to align with the shared `Button` component ([#&#8203;3144](Maintainerr/Maintainerr#3144)).
- Standardized action buttons on the shared `Button` component and ensured consistent theme colors ([#&#8203;3143](Maintainerr/Maintainerr#3143)).
- Explicitly installed corepack in the dev container for compatibility with Node 26+ ([#&#8203;3141](Maintainerr/Maintainerr#3141)).

#### Performance

- Optimized Plex rule evaluation by prefetching watch history in bulk, reducing redundant API calls ([#&#8203;3082](Maintainerr/Maintainerr#3082)).

#### Internal

- Updated documentation for the development environment, including devbox workflows and agent confinement models.
- Fixed stale workspace path in agent documentation (/home/maintainerr-dev -> /workspace).

#### Dependencies

- Updated 1 dependency: explicitly installed corepack for Node 26+ compatibility.

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzQuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/376