ci: Remove deploy job (deploy locally instead)

LED command: LED [QUIET|AUTO]
- QUIET: LED off, turns solid on motion/presence detection, blinks on OTA
- AUTO: Original behavior (constant blink)

Persisted via NVS key 'led_quiet'.

.gitea/workflows/lint.yml

@@ -7,19 +7,11 @@ on:
   pull_request:
     branches: [main]
   workflow_dispatch:
-    inputs:
-      deploy:
-        description: 'Deploy to ESP fleet after build'
-        required: false
-        default: 'false'
-        type: choice
-        options:
-          - 'false'
-          - 'true'
 
 jobs:
   build:
     name: Build Firmware
+    needs: [cppcheck, flawfinder, gitleaks]
     runs-on: anvil
     container:
       image: docker.io/espressif/idf:v5.3
@@ -53,6 +45,51 @@ jobs:
         run: |
           ls -lh get-started/csi_recv_router/build/*.bin
 
+      - name: Check firmware size
+        run: |
+          BIN="get-started/csi_recv_router/build/csi_recv_router.bin"
+          MAX_SIZE=1966080  # 0x1E0000 = 1920 KB partition
+          WARN_PERCENT=85
+
+          SIZE=$(stat -c%s "$BIN")
+          PERCENT=$((SIZE * 100 / MAX_SIZE))
+
+          echo "Firmware: $((SIZE/1024)) KB / $((MAX_SIZE/1024)) KB ($PERCENT%)"
+
+          if [ $SIZE -gt $MAX_SIZE ]; then
+            echo "::error::Firmware exceeds partition size!"
+            exit 1
+          fi
+
+          if [ $PERCENT -gt $WARN_PERCENT ]; then
+            echo "::warning::Firmware using $PERCENT% of partition"
+          fi
+
+      - name: Security checks
+        run: |
+          BIN="get-started/csi_recv_router/build/csi_recv_router.bin"
+          CFG="get-started/csi_recv_router/sdkconfig"
+
+          echo "=== Checking for hardcoded secrets ==="
+          if strings "$BIN" | grep -iqE '(password|secret|api_key|apikey)=[^$]'; then
+            echo "::error::Potential hardcoded secret found in binary"
+            exit 1
+          fi
+          echo "No hardcoded secrets detected"
+
+          echo "=== Checking release configuration ==="
+          LOG_LEVEL=$(grep 'CONFIG_LOG_DEFAULT_LEVEL=' "$CFG" | cut -d= -f2)
+          if [ "$LOG_LEVEL" -gt 3 ]; then
+            echo "::warning::Debug/verbose logging enabled (level $LOG_LEVEL)"
+          else
+            echo "Log level OK ($LOG_LEVEL)"
+          fi
+
+          echo "=== Component size breakdown ==="
+          . /opt/esp/idf/export.sh
+          cd get-started/csi_recv_router
+          idf.py size-components 2>/dev/null | head -30
+
       - name: Upload firmware artifact
         run: |
           mkdir -p /tmp/artifacts
@@ -63,125 +100,6 @@ jobs:
           echo "Artifacts ready in /tmp/artifacts"
           ls -la /tmp/artifacts/
 
-  deploy:
-    name: Deploy to ESP Fleet
-    runs-on: anvil
-    needs: build
-    if: github.event_name == 'workflow_dispatch' && github.event.inputs.deploy == 'true' || startsWith(github.ref, 'refs/tags/v')
-    container:
-      image: docker.io/espressif/idf:v5.3
-      options: --network host
-      volumes:
-        - /var/cache/ccache:/ccache
-    env:
-      CCACHE_DIR: /ccache
-      IDF_CCACHE_ENABLE: 1
-    steps:
-      - name: Install tools
-        run: |
-          apt-get update && apt-get install -y --no-install-recommends netcat-openbsd curl jq ccache
-
-      - name: Checkout
-        run: |
-          git clone --depth=1 --branch=${{ github.ref_name }} \
-            https://oauth2:${{ github.token }}@git.mymx.me/${{ github.repository }}.git .
-
-      - name: Build firmware
-        run: |
-          . /opt/esp/idf/export.sh
-          cd get-started/csi_recv_router
-          idf.py build
-          ccache --show-stats | head -5
-
-      - name: Create release and upload firmware
-        env:
-          GITEA_TOKEN: ${{ github.token }}
-        run: |
-          TAG="${{ github.ref_name }}"
-          REPO="${{ github.repository }}"
-          API_URL="https://git.mymx.me/api/v1"
-
-          echo "Creating release for tag: $TAG"
-
-          # Check if release exists
-          RELEASE=$(curl -s -H "Authorization: token $GITEA_TOKEN" \
-            "$API_URL/repos/$REPO/releases/tags/$TAG")
-
-          RELEASE_ID=$(echo "$RELEASE" | jq -r '.id // empty')
-
-          if [ -z "$RELEASE_ID" ]; then
-            # Create new release
-            RELEASE=$(curl -s -X POST -H "Authorization: token $GITEA_TOKEN" \
-              -H "Content-Type: application/json" \
-              -d "{\"tag_name\": \"$TAG\", \"name\": \"$TAG\", \"body\": \"Automated release from CI\"}" \
-              "$API_URL/repos/$REPO/releases")
-            RELEASE_ID=$(echo "$RELEASE" | jq -r '.id')
-            echo "Created release ID: $RELEASE_ID"
-          else
-            echo "Release exists with ID: $RELEASE_ID"
-          fi
-
-          # Upload firmware binary
-          echo "Uploading firmware..."
-          curl -s -X POST -H "Authorization: token $GITEA_TOKEN" \
-            -F "attachment=@get-started/csi_recv_router/build/csi_recv_router.bin" \
-            "$API_URL/repos/$REPO/releases/$RELEASE_ID/assets?name=csi_recv_router.bin"
-
-      - name: Deploy via OTA
-        run: |
-          SENSORS="muddy-storm:192.168.129.29 amber-maple:192.168.129.30 hollow-acorn:192.168.129.31"
-          OTA_PORT=8899
-          MAX_PARALLEL=3
-
-          # Get runner IP (first non-loopback interface)
-          RUNNER_IP=$(hostname -I | awk '{print $1}')
-          echo "Runner IP: $RUNNER_IP"
-
-          # Start HTTP server to serve firmware
-          cd get-started/csi_recv_router/build
-          python3 -m http.server $OTA_PORT &
-          HTTP_PID=$!
-          sleep 2
-
-          FIRMWARE_URL="http://${RUNNER_IP}:${OTA_PORT}/csi_recv_router.bin"
-          echo "Firmware URL: $FIRMWARE_URL"
-
-          # Verify server is running
-          curl -sI "http://localhost:${OTA_PORT}/csi_recv_router.bin" | head -1
-
-          # Deploy function
-          deploy_sensor() {
-            NAME="$1"
-            IP="$2"
-            URL="$3"
-            echo "=== Starting OTA on $NAME ($IP) ==="
-            RESPONSE=$(echo "OTA $URL" | nc -u -w 2 "$IP" 5501 2>/dev/null || echo "no response")
-            echo "$NAME: $RESPONSE"
-          }
-
-          # Deploy to all sensors in parallel (max $MAX_PARALLEL)
-          echo "=== Deploying to all sensors in parallel ==="
-          PIDS=""
-          for entry in $SENSORS; do
-            NAME="${entry%%:*}"
-            IP="${entry##*:}"
-            deploy_sensor "$NAME" "$IP" "$FIRMWARE_URL" &
-            PIDS="$PIDS $!"
-          done
-
-          # Wait for all OTA commands to be sent
-          for PID in $PIDS; do
-            wait $PID 2>/dev/null || true
-          done
-
-          echo "=== OTA commands sent, waiting for devices to update (60s) ==="
-          sleep 60
-
-          # Stop HTTP server
-          kill $HTTP_PID 2>/dev/null || true
-
-          echo "=== Deployment complete ==="
-
   cppcheck:
     name: C/C++ Static Analysis
     runs-on: anvil
@@ -240,27 +158,3 @@ jobs:
 
       - name: Run gitleaks
         run: gitleaks detect --source . --verbose --redact
-
-  shellcheck:
-    name: Shell Script Analysis
-    runs-on: anvil
-    container:
-      image: docker.io/koalaman/shellcheck-alpine:stable
-    steps:
-      - name: Install git
-        run: apk add --no-cache git
-
-      - name: Checkout
-        run: |
-          git clone --depth=1 --branch=${{ github.ref_name }} \
-            https://oauth2:${{ github.token }}@git.mymx.me/${{ github.repository }}.git .
-
-      - name: Find and check shell scripts
-        run: |
-          SCRIPTS=$(find . -name "*.sh" -type f 2>/dev/null || true)
-          if [ -n "$SCRIPTS" ]; then
-            echo "Checking: $SCRIPTS"
-            echo "$SCRIPTS" | xargs shellcheck --severity=warning
-          else
-            echo "No shell scripts found, skipping"
-          fi

get-started/csi_recv_router/main/app_main.c

@@ -36,6 +36,7 @@
 #include "esp_ota_ops.h"
 #include "esp_https_ota.h"
 #include "esp_partition.h"
+#include "esp_chip_info.h"
 #include "esp_http_client.h"
 #include "driver/gpio.h"
 #include "soc/soc_caps.h"
@@ -89,6 +90,7 @@ static int s_send_frequency = CONFIG_SEND_FREQUENCY_DEFAULT;
 static int8_t s_tx_power_dbm = 10;
 static esp_ping_handle_t s_ping_handle = NULL;
 static volatile led_mode_t s_led_mode = LED_OFF;
+static bool s_led_quiet = true;  /* quiet mode: off normally, solid on motion/presence */
 static volatile int64_t s_last_csi_time = 0;
 static volatile int64_t s_identify_end_time = 0;
 static volatile bool s_ota_in_progress = false;
@@ -300,11 +302,15 @@ static void config_load_nvs(void)
         if (nvs_get_i32(h, "chanscan_int", &chanscan_int) == ESP_OK && chanscan_int >= 60 && chanscan_int <= 3600) {
             s_chanscan_interval_s = (int)chanscan_int;
         }
+        int8_t led_quiet;
+        if (nvs_get_i8(h, "led_quiet", &led_quiet) == ESP_OK) {
+            s_led_quiet = (led_quiet != 0);
+        }
         nvs_close(h);
-        ESP_LOGI(TAG, "NVS loaded: hostname=%s rate=%d tx_power=%d adaptive=%d threshold=%.6f ble=%d target=%s:%d csi_mode=%d hybrid_n=%d powersave=%d presence=%d pr_thresh=%.4f baseline_nsub=%d",
+        ESP_LOGI(TAG, "NVS loaded: hostname=%s rate=%d tx_power=%d adaptive=%d threshold=%.6f ble=%d target=%s:%d csi_mode=%d hybrid_n=%d powersave=%d presence=%d pr_thresh=%.4f baseline_nsub=%d led_quiet=%d",
                  s_hostname, s_send_frequency, s_tx_power_dbm, s_adaptive, s_motion_threshold, s_ble_enabled,
                  s_target_ip, s_target_port, (int)s_csi_mode, s_hybrid_interval, s_powersave,
-                 s_presence_enabled, s_pr_threshold, s_baseline_nsub);
+                 s_presence_enabled, s_pr_threshold, s_baseline_nsub, s_led_quiet);
     } else {
         ESP_LOGI(TAG, "NVS: no saved config, using defaults");
     }
@@ -400,10 +406,25 @@ static void led_task(void *arg)
         if (s_led_mode == LED_SOLID && s_identify_end_time > 0) {
             if (esp_timer_get_time() >= s_identify_end_time) {
                 s_identify_end_time = 0;
-                s_led_mode = LED_SLOW_BLINK;
+                s_led_mode = s_led_quiet ? LED_OFF : LED_SLOW_BLINK;
             }
         }
 
+        /* Quiet mode: off normally, solid on motion/presence, OTA pattern during OTA */
+        if (s_led_quiet && s_led_mode != LED_OTA && s_identify_end_time == 0) {
+            bool activity = s_motion_detected ||
+                           (s_presence_enabled && s_baseline_nsub > 0 && s_pr_last_score > s_pr_threshold);
+            if (activity) {
+                gpio_set_level(LED_GPIO, 1);
+                led_on = true;
+            } else {
+                gpio_set_level(LED_GPIO, 0);
+                led_on = false;
+            }
+            vTaskDelay(pdMS_TO_TICKS(200));
+            continue;
+        }
+
         /* Auto-switch between slow/fast blink based on CSI activity */
         if (s_led_mode == LED_SLOW_BLINK || s_led_mode == LED_FAST_BLINK) {
             int64_t now = esp_timer_get_time();
@@ -1486,6 +1507,30 @@ static int cmd_handle(const char *cmd, char *reply, size_t reply_size)
         return strlen(reply);
     }
 
+    /* LED [QUIET|AUTO] */
+    if (strncmp(cmd, "LED", 3) == 0) {
+        if (cmd[3] == '\0' || cmd[3] == '\n') {
+            snprintf(reply, reply_size, "OK LED %s", s_led_quiet ? "quiet" : "auto");
+            return strlen(reply);
+        }
+        if (strncmp(cmd + 4, "QUIET", 5) == 0) {
+            s_led_quiet = true;
+            s_led_mode = LED_OFF;
+            config_save_i8("led_quiet", 1);
+            snprintf(reply, reply_size, "OK LED quiet (off, solid on motion)");
+            return strlen(reply);
+        }
+        if (strncmp(cmd + 4, "AUTO", 4) == 0) {
+            s_led_quiet = false;
+            s_led_mode = LED_SLOW_BLINK;
+            config_save_i8("led_quiet", 0);
+            snprintf(reply, reply_size, "OK LED auto (blink)");
+            return strlen(reply);
+        }
+        snprintf(reply, reply_size, "ERR LED [QUIET|AUTO]");
+        return strlen(reply);
+    }
+
     /* STATUS */
     if (strncmp(cmd, "STATUS", 6) == 0) {
         int64_t up = esp_timer_get_time() / 1000000LL;
@@ -1533,13 +1578,21 @@ static int cmd_handle(const char *cmd, char *reply, size_t reply_size)
         const esp_partition_t *running = esp_ota_get_running_partition();
         uint32_t part_size = running ? running->size : 0;
 
+        /* Chip info */
+        esp_chip_info_t chip_info;
+        esp_chip_info(&chip_info);
+        const char *chip_model = (chip_info.model == CHIP_ESP32S3) ? "ESP32S3" :
+                                 (chip_info.model == CHIP_ESP32C3) ? "ESP32C3" :
+                                 (chip_info.model == CHIP_ESP32)   ? "ESP32" : "ESP32xx";
+
         snprintf(reply, reply_size,
                  "OK STATUS uptime=%s uptime_s=%lld heap=%lu rssi=%d channel=%d tx_power=%d rate=%d csi_rate=%d"
                  " hostname=%s version=%s adaptive=%s motion=%d ble=%s target=%s:%d"
                  " temp=%.1f csi_count=%lu boots=%lu rssi_min=%d rssi_max=%d"
                  " csi_mode=%s hybrid_n=%d auth=%s flood_thresh=%d/%d powersave=%s"
-                 " presence=%s pr_score=%.4f chanscan=%s"
+                 " presence=%s pr_score=%.4f chanscan=%s led=%s"
-                 " nvs_used=%lu nvs_free=%lu nvs_total=%lu part_size=%lu",
+                 " nvs_used=%lu nvs_free=%lu nvs_total=%lu part_size=%lu"
+                 " built=%s_%s idf=%s chip=%sr%dc%d",
                  uptime_str, (long long)up, (unsigned long)heap, rssi, channel, (int)s_tx_power_dbm,
                  s_send_frequency, actual_rate,
                  s_hostname, app_desc->version,
@@ -1552,11 +1605,13 @@ static int cmd_handle(const char *cmd, char *reply, size_t reply_size)
                  s_flood_thresh, s_flood_window_s,
                  s_powersave ? "on" : "off",
                  s_presence_enabled ? "on" : "off", s_pr_last_score,
-                 s_chanscan_enabled ? "on" : "off",
+                 s_chanscan_enabled ? "on" : "off", s_led_quiet ? "quiet" : "auto",
                  (unsigned long)nvs_stats.used_entries,
                  (unsigned long)nvs_stats.free_entries,
                  (unsigned long)nvs_stats.total_entries,
-                 (unsigned long)part_size);
+                 (unsigned long)part_size,
+                 app_desc->date, app_desc->time, app_desc->idf_ver,
+                 chip_model, chip_info.revision, chip_info.cores);
         return strlen(reply);
     }
 
@@ -2261,7 +2316,7 @@ void app_main()
 
     ESP_LOGI(TAG, "BLE: NimBLE initialized, scan=%s", s_ble_enabled ? "on" : "off");
 
-    s_led_mode = LED_SLOW_BLINK;
+    s_led_mode = s_led_quiet ? LED_OFF : LED_SLOW_BLINK;
 
     udp_socket_init();
     wifi_csi_init();

get-started/csi_recv_router/sdkconfig.defaults

@@ -27,9 +27,9 @@ CONFIG_ESP32_WIFI_AMPDU_TX_ENABLED=
 CONFIG_ESP32_WIFI_AMPDU_RX_ENABLED=
 
 #
-# Compiler options
+# Compiler options (size optimization saves ~75 KB)
 #
-CONFIG_COMPILER_OPTIMIZATION_PERF=y
+CONFIG_COMPILER_OPTIMIZATION_SIZE=y
 
 #
 # FreeRTOS