Update config persistence, crypto, and dev script

internal/config/persistence.go

@@ -901,6 +901,9 @@ func (c *ConfigPersistence) saveNodesConfig(pveInstances []PVEInstance, pbsInsta
 		return err
 	}
 
+	// DEBUG: Log the JSON data being saved to check for TemperatureMonitoringEnabled
+	log.Info().Str("json", string(data)).Msg("DEBUG: Saving nodes config JSON")
+
 	if err := c.EnsureConfigDir(); err != nil {
 		return err
 	}
@@ -1051,6 +1054,9 @@ func (c *ConfigPersistence) LoadNodesConfig() (*NodesConfig, error) {
 		}
 	}
 
+	// DEBUG: Log the JSON data loaded from disk
+	log.Info().Str("json", string(data)).Msg("DEBUG: Loaded nodes config JSON")
+
 	var config NodesConfig
 	if err := json.Unmarshal(data, &config); err != nil {
 		return nil, err

internal/crypto/crypto.go

@@ -52,15 +52,21 @@ func getOrCreateKeyAt(dataDir string) ([]byte, error) {
 
 	// Try to read existing key from new location
 	if data, err := os.ReadFile(keyPath); err == nil {
-		key := make([]byte, 32)
+		// Use DecodedLen to allocate sufficient space, then slice to actual length
-		n, err := base64.StdEncoding.Decode(key, data)
+		// This prevents panics if the file contains more data than expected
-		if err == nil && n == 32 {
+		decoded := make([]byte, base64.StdEncoding.DecodedLen(len(data)))
-			log.Debug().Msg("Found and loaded existing encryption key")
+		n, err := base64.StdEncoding.Decode(decoded, data)
-			return key, nil
+		if err == nil {
+			if n == 32 {
+				log.Debug().Msg("Found and loaded existing encryption key")
+				return decoded[:n], nil
+			}
+			log.Warn().
+				Int("decodedBytes", n).
+				Msg("Encryption key has invalid length (expected 32 bytes)")
 		} else {
 			log.Warn().
 				Err(err).
-				Int("decodedBytes", n).
 				Msg("Failed to decode encryption key")
 		}
 	} else {
@@ -70,9 +76,10 @@ func getOrCreateKeyAt(dataDir string) ([]byte, error) {
 	// Check for key in old location and migrate if found (only if paths differ)
 	if dataDir != "/etc/pulse" && keyPath != oldKeyPath {
 		if data, err := os.ReadFile(oldKeyPath); err == nil {
-			key := make([]byte, 32)
+			decoded := make([]byte, base64.StdEncoding.DecodedLen(len(data)))
-			n, err := base64.StdEncoding.Decode(key, data)
+			n, err := base64.StdEncoding.Decode(decoded, data)
 			if err == nil && n == 32 {
+				key := decoded[:n]
 				// Migrate key to new location
 				if err := os.MkdirAll(filepath.Dir(keyPath), 0700); err != nil {
 					// Migration failed, but we can still use the old key

scripts/hot-dev.sh

@@ -24,9 +24,28 @@ load_env_file "${ROOT_DIR}/.env.dev"
 FRONTEND_PORT=${FRONTEND_PORT:-${PORT:-7655}}
 PORT=${PORT:-${FRONTEND_PORT}}
 
+# Try to detect LAN IP
+if [[ -z ${LAN_IP:-} ]]; then
+    # Try hostname -I (Linux)
+    if command -v hostname >/dev/null 2>&1 && hostname -I >/dev/null 2>&1; then
+        LAN_IP=$(hostname -I | awk '{print $1}')
+    fi
+    
+    # Fallback for macOS
+    if [[ -z ${LAN_IP:-} ]]; then
+        LAN_IP=$(ipconfig getifaddr en0 2>/dev/null || echo "")
+    fi
+    
+    # Fallback to 0.0.0.0 if detection fails
+    if [[ -z ${LAN_IP:-} ]]; then
+        LAN_IP="0.0.0.0"
+    fi
+fi
+
 FRONTEND_DEV_HOST=${FRONTEND_DEV_HOST:-0.0.0.0}
 FRONTEND_DEV_PORT=${FRONTEND_DEV_PORT:-${FRONTEND_PORT}}
-PULSE_DEV_API_HOST=${PULSE_DEV_API_HOST:-127.0.0.1}
+# Use LAN IP for API host so other devices can connect
+PULSE_DEV_API_HOST=${PULSE_DEV_API_HOST:-${LAN_IP}}
 PULSE_DEV_API_PORT=${PULSE_DEV_API_PORT:-7656}
 
 if [[ -z ${PULSE_DEV_API_URL:-} ]]; then
@@ -43,9 +62,13 @@ if [[ -z ${PULSE_DEV_WS_URL:-} ]]; then
     fi
 fi
 
+# Allow all origins for LAN access
+ALLOWED_ORIGINS="*"
+
 export FRONTEND_PORT PORT
 export FRONTEND_DEV_HOST FRONTEND_DEV_PORT
 export PULSE_DEV_API_HOST PULSE_DEV_API_PORT PULSE_DEV_API_URL PULSE_DEV_WS_URL
+export ALLOWED_ORIGINS
 
 # Auto-detect pulse-sensor-proxy socket if available
 HOST_PROXY_SOCKET="/mnt/pulse-proxy/pulse-sensor-proxy.sock"
@@ -77,7 +100,8 @@ cat <<BANNER
 Starting HOT-RELOAD development mode
 =========================================
 
-Frontend: http://${FRONTEND_DEV_HOST}:${FRONTEND_DEV_PORT} (with hot-reload)
+Frontend: http://${FRONTEND_DEV_HOST}:${FRONTEND_DEV_PORT} (Local)
+          http://${LAN_IP}:${FRONTEND_DEV_PORT} (LAN)
 Backend API: ${PULSE_DEV_API_URL}
 
 Mock Mode: ${PULSE_MOCK_MODE:-false}