Smart-home toolkit

Six tabs, one for each job. Devices are reached by the address you type, never by scanning your network. When a page cannot reach a device itself (an https page calling http:// on your network, a self-signed certificate, no CORS headers), the gitwebsite app’s LAN relays carry the request. The app asks you to approve each new device the first time.

Home Assistant

Enter Home Assistant’s address (for example http://homeassistant.local:8123) and a long-lived access token. To make one in Home Assistant, open your profile, then Security → Long-lived access tokens. Connect opens Home Assistant’s WebSocket API (/api/websocket). Auto tries a direct connection first, then the gitwebsite app’s WebSocket relay. A direct connection works when the page is allowed to open it: from this https site that means an https:// Home Assistant (Nabu Casa or your own certificate), and from the app’s preview or a local copy over http:// it means any address.

Entities: every entity with its state, live (through a state_changed subscription). You can search by id or name and filter by domain. Pick one to see its attributes and a history chart (1 hour to 7 days, from the recorder): a line for numbers, with the unit on the axis, and coloured bands for states such as on/off.
Services: pick a domain and a service, and the form is built from the service’s own schema, the way Home Assistant’s UI builds it. Numbers, selects, colours, entities and booleans each get the matching control, and target entities autocomplete. Call service sends call_service and shows the result (the response too, for services that return one). The same call is shown as YAML to copy into a script.
Template: render a Jinja template with render_template and see the result, its type, and what makes it re-render (which entities, every state change, or each minute for now()). Live keeps it updating. Errors show Home Assistant’s message.
Events: watch the event bus (subscribe_events), for one event type or all of them. You can filter, pause, and save the events as JSON.

The token stays in memory unless you tick Remember. It is never put in a link.

Automations

Paste an automation, a whole automations.yaml, or a configuration with automation:, and it is checked as you type. Nothing leaves the page for this. For each automation you get a plain-English explanation ("When … and only if … then: …") and a list of problems:

errors: no triggers or actions; unquoted on/off/yes/no in to:, from: or state: (Home Assistant’s YAML reads them as true/false, not as text); malformed entity ids; numeric_state without above/below, or with above ≥ below; times that are not HH:MM; bad durations; repeat without a count, while, until or for_each; an action that is not domain.service
warnings: time_pattern minutes: 5 (which means at :05 each hour, not every 5 minutes; write "/5"); a state trigger without to:, which also fires on attribute changes; data_template; unknown trigger types; webhooks reachable from the internet
notes: the 2024 renames (triggers:/conditions:/actions:, trigger: for platform:, action: for service:); no id; mode: single with delays or waits, which drops triggers that arrive while it runs (restart suits a motion light); waits without a timeout; device triggers, which break when a device is replaced

Validate with Home Assistant sends the triggers, conditions and actions to Home Assistant’s own validate_config command, when you are connected on the first tab.

Shelly

Add the device’s address. Read identifies it from /shelly (generation, model, firmware), shows its switches, covers, lights, power, energy and temperature, and gives each one controls: on, off, toggle, brightness, open, close, stop and a position slider. Below that are the raw status and the configuration (read-only). Gen1 devices use HTTP GETs (/status, /relay/0?turn=on) with basic authentication. Gen2, Gen3 and Gen4 devices use JSON-RPC on POST /rpc (Shelly.GetStatus, Switch.Set, Cover.GoToPosition, …). When a password is set, the tool answers their SHA-256 digest challenge, as described in Shelly’s API documentation under Authentication.

Tasmota

Read runs Status 0 and shows the device name, firmware, IP address, Wi-Fi and uptime, its relays (with on, off and toggle), and its sensors. The Console sends any command through http://DEVICE/cm?cmnd=…, the same as Tasmota’s web console, and keeps a history (↑/↓). Timers lists and edits Timer1… with time or sunrise/sunset mode, days (Sunday first), repeat, output and action.

Hue

Add the bridge’s address and press the round link button on the bridge. Then press Pair within 30 seconds (POST /api with generateclientkey), and the bridge returns an application key. Load lights reads CLIP v2 (/clip/v2/resource/…) and shows each room and zone with an on/off switch, its scenes, and its lights. Each light has on/off, brightness, colour (converted to CIE xy) and colour temperature. The bridge only speaks HTTPS with a self-signed certificate, so this goes through the gitwebsite app’s LAN relay with certificate checks off for that host.

Matter codes

Decode an MT: QR payload or an 11- or 21-digit manual pairing code. A QR payload gives the vendor and product IDs, the 12-bit discriminator, the passcode, the commissioning flow, the discovery methods (BLE, SoftAP, on-network), any optional TLV data (serial number, vendor tags), and the matching manual codes. A manual code is checked with its Verhoeff check digit, and gives the passcode, the 4-bit short discriminator and, for 21 digits, the vendor and product IDs. Several devices joined with * in one QR code are split apart.
Make a code from the fields, as QR text and an image, and as manual codes. Random passcode avoids the passcodes the spec forbids.
Commissioning notes cover BLE discovery and PASE, Wi-Fi (2.4 GHz), Thread border routers and sharing Thread credentials, multi-admin, and Home Assistant’s Matter server.

This follows the Matter Core Specification §5.1.3 (QR code payload) and §5.1.4 (manual pairing code). It is checked against the published example code used by the connectedhomeip example apps and the chip-tool guide: VID 0xFFF1, PID 0x8000, discriminator 3840 and passcode 20202021 give MT:Y.K9042C00KA0648G00 and 3497-011-2332. The Verhoeff digit is checked against the textbook value (236 → 2363) and against every single-digit error and adjacent swap.

Linking to an example

Links carry only the Matter code, the template and the automation YAML, never addresses, tokens or keys. Add the tab after #: ha, automation, shelly, tasmota, hue or matter.

Parameter Meaning Example

Parameter	Meaning	Example
`matter`	A setup code to decode (`MT:…` or digits)	`matter=MT:Y.K9042C00KA0648G00`
`tpl`	The Home Assistant template on the Template panel	`tpl={{ states('sun.sun') }}`
`yaml`	Automation YAML for the Automations tab	`yaml=…`
`example`	One of the presets below	`example=automation-motion`

matter

A setup code to decode (MT:… or digits)

matter=MT:Y.K9042C00KA0648G00

tpl

The Home Assistant template on the Template panel

tpl={{ states('sun.sun') }}

yaml

Automation YAML for the Automations tab

yaml=…

example

One of the presets below

example=automation-motion

Presets: matter-qr (the example QR code), matter-manual (its 11-digit code), matter-long (the 21-digit code with vendor and product IDs), automation-motion (a motion light with typical mistakes), automation-good (the same, fixed), template-lights (which lights are on).

A Matter setup code lets anyone nearby commission the device while it is in pairing mode. Share only test codes.

Limits

Shelly, Tasmota, Hue, and Home Assistant over plain http://, need the gitwebsite app’s LAN relays (companion v1.2) when used from this https site. Without the app, they work only from a page served over http (the app’s preview, or a local copy), and only where the device sends CORS headers. Shelly Gen2+ does; Tasmota needs its CORS command; Hue never does.
The automation checker reads the YAML with js-yaml (YAML 1.2). Home Assistant’s own loader is YAML 1.1, which is why unquoted on/off are flagged from the source text. It checks the structure and the common mistakes, not that your entities exist. Validate with Home Assistant does that.
Service forms cover the common selectors. Unusual ones (target inside data, action sequences) are edited as JSON.
Shelly configuration is read-only here. Tasmota timers are edited one by one.
Hue: Entertainment areas and the event stream are not covered. Colours are converted with the sRGB matrix, and each lamp then clips to its own gamut.
Matter: the tool works with codes only. It does not commission devices (that needs BLE and a commissioner).

How it is tested: the Matter codes are checked against the published example above. The automation linter and explainer have their own cases. The Home Assistant client was run against a fake HA, and also live against a throwaway Home Assistant 2026.10 container (entities, services, templates, events, history and validate_config), both directly and through the gitwebsite app’s WebSocket relay. Shelly (Gen1, and Gen2 with digest authentication), Tasmota and Hue (HTTPS with a self-signed certificate) were tested against fakes through a companion relay. The tool has not been tried with real Shelly, Tasmota or Hue hardware here.

Works with