[Home Assistant] Add custom HTTP headers support

[m4t1eu]

Description

Adds support for custom HTTP headers on all requests (REST API and WebSocket).

This enables users behind reverse proxies with header-based authentication
(Cloudflare Zero Trust, Authentik, Authelia, Traefik Forward Auth, etc.)
to use the extension without disabling their auth layer.

A new optional preference Custom HTTP Headers accepts key-value pairs
in the format Header1:Value1,Header2:Value2. These headers are injected
into all HTTP fetch calls and the WebSocket handshake.

Checklist

• I read the extension guidelines
• I read the documentation about publishing
• I ran npm run build and tested this distribution build in Raycast
• I checked that files in the assets folder are used by the extension itself
• I checked that assets used by the README are placed outside of the metadata folder

[raycastbot]

Thank you for your first contribution! 🎉

🔔 @tonka3000 @altrdev @rspeicher @amuelli @xilopaint @krsntn @mikikiv @techmaved you might want to have a look.

You can use this guide to learn how to check out the Pull Request locally in order to test it.

📋 Quick checkout commands

BRANCH="homeassistant/custom-headers"
FORK_URL="https://github.com/m4t1eu/raycast-extensions.git"
EXTENSION_NAME="homeassistant"
REPO_NAME="raycast-extensions"

git clone -n --depth=1 --filter=tree:0 -b $BRANCH $FORK_URL
cd $REPO_NAME
git sparse-checkout set --no-cone "extensions/$EXTENSION_NAME"
git checkout
cd "extensions/$EXTENSION_NAME"
npm install && npm run dev

We're currently experiencing a high volume of incoming requests. As a result, the initial review may take up to 10-15 business days.

[greptile-apps]

Greptile Summary

Adds a customHeaders preference (semicolon-delimited Key:Value pairs, stored as a password-type field) that is parsed once at startup and injected into every HTTP fetch call and the WebSocket handshake. The previous feedback on comma-delimiter ambiguity and masking sensitive values has been addressed.

Confidence Score: 5/5

Safe to merge — all prior concerns addressed and no new blocking issues found.

The implementation is correct: the semicolon delimiter avoids the comma-in-value conflict flagged previously, password type masks the input, and custom headers are spread before Content-Type/Authorization so built-in auth is never overridable. No P0 or P1 findings remain.

No files require special attention.

Important Files Changed

Filename	Overview
extensions/homeassistant/src/lib/common.ts	Adds parseCustomHeaders (semicolon-delimited) and wires it into both the HA client and WebSocket connection; logic is correct.
extensions/homeassistant/src/lib/haapi.ts	Adds customHeaders field to HomeAssistantOptions and HomeAssistant class; spreads them before fixed headers in all three fetch calls so Authorization/Content-Type are never overridable by user input.
extensions/homeassistant/src/lib/socket.ts	Threads customHeaders into the ws WebSocket constructor options; headers: undefined is safely ignored by the ws library.
extensions/homeassistant/package.json	New customHeaders preference added with type: password, correct title case, and semicolon-delimited placeholder matching the parser implementation.
extensions/homeassistant/CHANGELOG.md	New [Update] - {PR_MERGE_DATE} entry added at the top; follows the required changelog convention.

_{Reviews (2): Last reviewed commit: "Fix PR comments" | Re-trigger Greptile}

[0xdhrv]

Looks good to me, approved ✅

[github-actions]

Published to the Raycast Store:
https://raycast.com/tonka3000/homeassistant

[raycastbot]

🎉 🎉 🎉

Such a great contribution deserves a reward, but unfortunately we couldn't find your Raycast account based on your GitHub username (@m4t1eu).

Please link your GitHub account to your Raycast account to receive your credits and soon be able to exchange them for some swag.