avian/api/cutout.php: read ?pose=N parameter. pose=1 (default) serves
<slug>.png, pose=2 serves <slug>-2.png, etc. Pose >1 missing falls
back to pose-1 instead of skipping to the photo cutout so the flight
tab still shows something recognisable. Pose clamped to 1-99 to
block path-traversal payloads.
avian/api/wiki.php (new): Wikipedia REST summary proxy. Returns
{extract, thumbnail, title}. Thumbnail host pinned to wikimedia.org/
wikipedia.org to block SSRF. Cached for 24h.
avian/frontend/apt.js: fetch wiki descriptions from ./avian/api/wiki.php
(was hitting the worker's /api/wiki.json which 404'd in our overlay).
avian/api/menu.php: 4th drawer link label is now 'github' (shorter,
matches what the link actually points to).
avian/frontend/index.html: 'built by teddy' attribution sits below
the menu items (sibling of #dd-items inside #menu-dd) so it shows in
both local and forwarded modes. Drops the redundant 'built with
AvianVisitors' line that lived inside the lock screen - the github
menu item covers source-of-truth attribution.
install_services.sh now symlinks five frontend files (index.html,
styles.css, apt.js, masks.json, dims.json) from avian/frontend/ into
the Caddy site root. Caddy serves index.html before index.php, so /
shows the collage and BirdNET-Pi's stock UI moves to /index.php
(still linked from the menu drawer).
API shims stay under /avian/api/. apt.js fetches them with
./avian/api/birdnet-api.php?action=X now that the frontend lives at
root instead of /avian/frontend/.
avian/index.html redirect file removed (no longer needed - / serves
the collage directly).
README + menu drawer updated to reflect / as the entry point and
/index.php as the stock-UI link.
Verified in Docker:
/ 200 text/html (collage, 4 tiles)
/masks.json 200 (276 KB)
/avian/api/... 200 (all PHP shims working)
Caddy serves index.html as default index, index.php still reachable
- Add hidden admin-screen stub to index.html. The live JS calls
adminEl.setAttribute() on every hashchange (via openAdmin/closeAdmin);
with the element missing those threw a null-ref that killed
syncRouter mid-flight, so atlas card clicks set the hash but never
opened the detail modal. Stub is empty - menu items navigate to
BirdNET-Pi's stock pages instead of triggering in-app admin.
- Point the live-audio Audio() at /stream (BirdNET-Pi's existing
icecast reverse-proxy from install_services.sh:189) instead of the
worker's /birdnet/stream. The drawer's live-audio button now plays
real BirdNET-Pi audio on local installs.
Verified end-to-end in Docker container:
- Landing collage: 4 tiles render from seeded DB
- Atlas click: detail modal opens with image + sci/common name
- Menu drawer: opens, shows 4 items (no password in local mode)
- Auto-refresh: INSERTed Bubo virginianus into birds.db, forced
refresh via window picker re-click, tile count 4→5 with the new
species appearing in the collage.
Pulls the live rendered HTML/CSS/JS from the working repo:
- styles.css: 1449 lines, full live palette + chrome rules
- index.html: live <body> structure with stats sidebar, atlas with
svg sort icons, full detail-modal (pose toggle, recordings list,
wiki/ebird chips), about modal
- apt.js: 2760 lines of live JS verbatim, URLs rewired:
- /api/{recent,lifelist,firstseen,timeseries,stats,species}.json
→ ../api/birdnet-api.php?action=X
- /api/img and /api/sketch → ../api/cutout.php
- /api/recording and /api/spectrogram → ../api/{name}.php
- /api/menu → ../api/menu.php (new)
- /birdnet/stream → '' (live audio is admin-only, stripped)
- admin endpoints (/api/auth, /api/config, /api/status, /api/regen,
/api/wiki) left to 404 silently - the live .catch() handlers
already absorb them
Menu drawer restored. Defaults to <body class='av-local'> which CSS
toggles to show items directly without the lock screen. Forwarded
deploys switch to av-forwarded + set AV_REQUIRE_AUTH=1 in php-fpm
env + Caddy basic_auth on /avian/api/ - see avian/forwarding/.
avian/api/menu.php: returns AvianVisitors drawer items (BirdNET-Pi UI,
logs, system, github link). 401s in forwarded mode when no
Authorization header arrives.
The previous styles.css was a from-memory reconstruction with wrong
palette (tan paper #f4ede0 vs the live near-white #fcfcfb, red accent
vs warm-grey). HTML class names also diverged (.collage vs .gcollage,
#atlasList vs #atlasGrid, .stats-tl vs .stats-timeline). Result: the
overlay looked nothing like the live site.
Now:
- styles.css copied verbatim from the apt.ts <style> block (1449 lines)
- index.html mirrors the live body structure: header.top + main.stage
with view sections id=v0/v1/v2, nav.slider, about-modal
- apt.js updated for matching IDs/classes:
- View switching via translateX on .views container (live uses
flex: 0 0 100% per view, slides between them)
- Hover state via alpha-mask hit-testing in mousemove (.gtile is
pointer-events:none, bounding rects overlap)
- Atlas builds .bird-card elements (the live CSS class)
- atlasSort data-sort='alpha' (was 'first')
- #atlasGrid (was #atlasList)
Verified against Docker container faithfully replicating BirdNET-Pi's
runtime (Caddy + PHP-FPM as caddy user + php-fpm-socket-helper):
side-by-side screenshots with bird.onethreenine.net show identical
palette, typography, pill chrome, tile rendering. Differences are
content-only (different seeded species).
Blockers
- http://birdnet.local/avian/ now serves the collage (added avian/index.html
redirect to frontend/; previously the symlink target had no top-level
index, so users saw a directory listing of api/ assets/ forwarding/
frontend/ scripts/).
- Gemini model bumped from gemini-2.5-flash-image-preview (deprecated
2026-01-15) to the stable gemini-2.5-flash-image. Pregen was non-
functional out of the box.
- avian-mqtt.service: dropped %h (which expands to /root for system-mode
units regardless of User=). Use WorkingDirectory=~ which DOES respect
User=, plus a relative ExecStart.
- birdnet-api.php case 'lifelist' now aliases COUNT(*) AS n (was 'total'),
matching what apt.js reads for atlas card counts. Atlas previously
always displayed 0.
Bugs
- Retry-After parsing handles HTTP-date format without crashing.
- apt.js no longer fetches firstseen/timeseries (declared in state but
never consumed). Two wasted round-trips per page load removed.
- update_birdnet.sh defaults branch=avian-visitors so the (opt-in)
Sunday auto-update cron doesn't reset HEAD to upstream main and
delete the avian/ overlay.
- recording.php: removed dead $BIRDS_JSON_CANDIDATES.
Polish
- Pregen --sleep default raised 4→6s (more headroom under free-tier RPM).
- en-dash in README BOM (~$35–80) replaced with hyphen for style match.
- Slop sweep across user-facing docs: no em-dashes, no en-dashes, no
AI-slop word hits (robust/comprehensive/seamless/etc.).
Restructures the install so users run ONE command. The fork's
newinstaller.sh clones this repo (instead of upstream Nachtzuster) and
runs BirdNET-Pi's installer. install_services.sh symlinks the avian/
overlay into the Caddy site root, so http://birdnet.local/avian/ comes
up after reboot with no Caddy config needed.
Reviewer-flagged fixes:
Frontend (avian/frontend/apt.js)
- Switch all API paths from /api/*.json (which didn't route) to relative
action-based URLs (./api/birdnet-api.php?action=recent etc.).
- Fetch ./masks.json + ./dims.json relatively (were /avian/*.json).
- Replace every innerHTML user-content sink with createElement +
textContent + setAttribute — species labels are user-editable in
BirdNET-Pi, so untrusted.
- Add esc() helper for the few remaining innerHTML attribute contexts.
- fetchJson throws on non-200 (was silently parsing 404 HTML as JSON).
- Defensive null-check in loadMask if MASKS hasn't loaded.
Backend (avian/api/*.php)
- birdnet-api.php now derives DB_PATH from dirname(__DIR__, 3) so any
BirdNET-Pi install user works (no hardcoded /home/birdnet).
- recording/spectrogram/cutout use getenv('HOME') for the same reason.
- cutout.php reworked as the canonical image resolver: bundled
illustration → bundled cutout → cached rembg → fresh
Wikipedia+rembg, with the binomial regex guard and atomic rename
on cache write. Wikipedia URL host pinned to wikimedia.org /
wikipedia.org to block SSRF.
- Stale 'X-BirdNET-Proxy-Token' auth claims removed everywhere.
Pregen (avian/scripts/pregen.py)
- Gemini key moved from URL query to x-goog-api-key header.
- Model bumped to gemini-2.5-flash-image-preview.
- Bounded retry on 429 + 5xx with Retry-After honoured.
- Default --sleep raised from 1s to 4s (under free-tier RPM).
- Unified parser handles |/_/comma in all three input modes.
- responseModalities now [TEXT, IMAGE] (was IMAGE-only).
- --poses validated against POSES keys.
- ASCII [ok]/[fail] markers (was ✓/✗ — Windows console crash).
- Surfaces finishReason + blockReason on safety blocks.
Prompt template
- 'Two placeholders' typo → three.
- 'warm paper' / 'transparent background' contradiction resolved.
Forwarding
- mqtt-bridge.py: paho-mqtt 2.x CallbackAPIVersion compat shim.
- avian-mqtt.service: dropped broken %i, set User=birdnet + %h path.
- forwarding/README.md uses the actual action-based URLs.
README
- One-line install via curl … newinstaller.sh.
- No more 'install BirdNET-Pi separately' step (our fork does it).
- License section uses absolute github.com links.
- bird.onethreenine.net replaces the not-yet-existent project writeup.
- docs/thumb.png replaced with the 24-bird Twitter capture.
Removed
- avian/caddy/ and avian/scripts/install.sh — no longer needed; the
overlay symlink in install_services.sh handles everything.
Karina Macancela