From 6a4e1f61c838faf80bb74d63416959c2ecd2a96e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 11 Sep 2026 14:36:38 +0200 Subject: [PATCH] =?UTF-8?q?chore(release):=20v1.38.19=20=E2=80=94=20the=20?= =?UTF-8?q?setup=20says=20what=20is=20true,=20and=20the=20AI=20has=20budge?= =?UTF-8?q?t=20left=20when=20you=20ask?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump the version, the service-worker fallback and the OpenAPI document, and add the CHANGELOG entry for v1.38.19. --- CHANGELOG.md | 64 +++++++++++++++++++++++++++++++++++++++++++ docs/api/openapi.yaml | 2 +- package.json | 2 +- public/sw.js | 2 +- 4 files changed, 67 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 774a8e526..ecd50e0c2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,69 @@ # Changelog +## [1.38.19] — 2026-09-11 + +The first run tells you what is actually true about your account, an +invitation link behaves, and the AI you ask a question to has budget left +when you ask it. + +### Fixed + +- **An invitation link opened while you are already signed in no longer + offers to register.** It showed a registration form, and completing it + quietly swapped the session you were in for a brand new account. The link + now says you are signed in and what you can do about it, and the server + refuses the registration outright rather than relying on the screen to + hide the button. + +- **The setup step that connects a device says what is true about it.** + Every provider was described as "connected, first sync running", including + ones that had never synced and ones nobody had connected. A provider with + no history of its own says so now, and the step offers to connect it. + +- **The last screen of the setup no longer claims the AI works when nobody + has asked it anything.** The offer appeared, and said insights were ready, + as soon as an instance had a provider configured. It appears only when + that provider has actually answered, and a freshly installed instance says + its provider has not been tried yet instead of announcing a failure. + +- **A page whose module is switched off says which switch it is** instead of + showing an empty page, and the getting-started checklist no longer asks + for things that are already done. + +- **Background insights can no longer use up the day before you ask a + question.** The daily AI limit counted every request against one number, + whoever was paying for the model behind it, so a day of automatic insights + could leave your own question refused. It is counted per payer now, and a + fifth of it is held back for what you do by hand: on a plan you bring + yourself the automatic work runs up to 1 600 000 tokens a day and your + questions keep 400 000. Nothing changes for an instance whose AI is only + used by hand. + +### Security + +- **The demo account can no longer be taken over through the setup step.** + The step that asks for date of birth, height and sex went through a route + that accepts eleven fields, including the contact address of the account + everyone shares. It writes those three and nothing else now, refused on + the server rather than left out of the form. + +### Changed + +- **`GET /api/integrations/status` can answer `unknown`** for a provider + with no sync history, next to the existing values; that case used to be + reported as `connected`. The native client does not read this field. + +- **`GET /api/user/ai-provider` gains three fields** describing the + instance's shared AI: whether it is healthy, untried or failing, whether + it may be offered, and whether the person already agreed to it. + +- **When the AI limit stops a request, the answer says which ceiling was + reached** and whose budget it was. + +- **Two migrations run on start** (`0340_coach_usage_operator_tokens`, + `0341_arrival_reaction_cost_owner`), both adding one column with a + default. + ## [1.38.18] — 2026-09-10 The first run asks what you need and switches on exactly that; the old diff --git a/docs/api/openapi.yaml b/docs/api/openapi.yaml index 7cc1841f9..3649c8157 100644 --- a/docs/api/openapi.yaml +++ b/docs/api/openapi.yaml @@ -1,7 +1,7 @@ openapi: 3.1.0 info: title: HealthLog API - version: 1.38.18 + version: 1.38.19 description: >- Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest. diff --git a/package.json b/package.json index bbd705680..d4de393df 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "healthlog", - "version": "1.38.18", + "version": "1.38.19", "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.", "license": "PolyForm-Noncommercial-1.0.0", "homepage": "https://healthlog.dev", diff --git a/public/sw.js b/public/sw.js index 40593f0ee..99bfccfd2 100644 --- a/public/sw.js +++ b/public/sw.js @@ -36,7 +36,7 @@ try { // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild. const CACHE_VERSION = (typeof self !== "undefined" && self.__APP_VERSION__) || - /* @sw-version-fallback */ "v1.38.18"; + /* @sw-version-fallback */ "v1.38.19"; const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`; const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`; // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`