An open page kept running the old version after a deploy (the single page never reloads), so the new
People screens did not appear. Static files are now sent with no-cache + ETag (304 when unchanged), icons
are cached for a week, /api/config reports a build stamp, and the app shows "A new version is available -
Reload" when it comes back into view or every 10 minutes. The service worker cache name is bumped.
The server also logs, at most once a minute per reason, why it refused a session cookie (unknown account,
turned off, signed out everywhere, bad signature, expired) without printing the cookie.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The saved Plex server token or address can stop working (token rotated, server moved). That
looked like "signed out" and sent the person back to the sign-in screen. The proxy now asks plex.tv
(using the saved account sign-in) for a fresh token and address, retries once, and saves them.
Sign-ins saved before the server id was recorded are matched by server name. A revoked account
sign-in signs the person out cleanly; repairs are one at a time and pause 30s after a failure.
The server logs [plex] lines for sign-in, connect, repair and failure.
tools/plex-test.js (31 checks, fake plex.tv + fake Plex) runs in the Gitea workflow.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Accounts: the setup code (or an existing single-user install, migrated automatically) creates the admin;
the admin adds people in Settings -> People and gives each a one-time invite code to enrol their own passkey
- Each person's tasks, NE Hub events and subscribe link, settings, calendar links, iCloud connection and Plex
sign-in are private, stored in their own folder (/data/users/<id>/); Plex sign-in moved from browser cookies
into that folder (encrypted), so it also follows them across devices
- Tab access is enforced by the server (403) and reflected in the app (nav, Home, Settings, search, /api/config
hides addresses of tabs a person cannot use); browser storage is namespaced per person
- Admin tools: change tabs, invite a device, sign out everywhere (session epoch), turn off, make/remove admin,
delete a person and their data; the last admin cannot be removed
- Sessions carry the person (uid.epoch.expiry.signature); old single-user cookies still work as the admin
- tools/users-test.js (83 checks: isolation, access limits, invites, sign-out/disable/delete, Plex and iCloud
per person, migration) now runs in the Gitea workflow before the image is built
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Restore ddgAnswer, which an earlier edit deleted: /api/ddg threw a ReferenceError and killed the
whole server process whenever Search ran
- One failing request can no longer take the server down (errors are logged and answered with a 500)
- tools/smoke-test.js starts the real server and calls every endpoint; the Gitea workflow runs it before
building the image, so a missing function or a crash stops the build
- Search: also searches NE Hub tasks and calendar events; Seafile file search falls back to scanning file
names when the search index returns nothing; Plex search falls back to the library's artists/albums;
a status line shows what was searched, per-source counts and errors, with sign-in links
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
"mounted" was true even when /data was the hidden anonymous volume Docker creates for the
Dockerfile's VOLUME, so the app looked fine while the user's host folder stayed empty and the
data was lost when the container was recreated. Read the mount source and report host folder,
named volume or anonymous volume (flagged), in Settings and the startup log.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Preferences lived only in the browser, so clearing it, using another device or the separate iOS
home-screen storage lost them. They are now saved in /data/settings.json (the audiobooks sign-in
encrypted), loaded at start-up, and existing browser-only values are uploaded once. A failed save
is reported instead of silent.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- iOS ignores SVG touch icons: add 120/152/167/180 apple-touch-icons, 192/512 and maskable manifest icons,
and 25 splash screens (every iPhone size, iPad portrait+landscape incl. 12.9")
- Icons and splash screens are public so iOS can fetch them without a session
- Manifest: id, scope, categories, shortcuts; iOS standalone polish (no callout, no overscroll)
- Sessions last SESSION_DAYS (default 180) and renew daily while in use
- tools/make-icons.py regenerates the artwork
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Lists, quick add, due dates, notes, complete/reopen, delete; Home card for overdue/due today
- iCloud VTODO lists read and written over CalDAV (If-Match, edits patch the latest copy so
priority/alarms survive); NE Hub lists work regardless
- Fix: text inside a nested VALARM was read as the task's / event's own description and then
written back on edit; nested components are now skipped (regression tests added)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Passkeys, calendars and sessions were being lost on redeploy. The server now
reports whether /data is a mounted volume, whether it is writable, what it
holds, and where the session secret comes from, so a wiped volume is obvious.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The server asks DuckDuckGo's instant-answer service (summary, definition, quick
answers) and Search shows it as a card above the app's own results when there
is one. Lookups are cached for 10 minutes and a failure never breaks Search.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Audio and Podcast now share kept-alive frames that stay loaded while hidden.
A plain-http address still falls back to a launcher (a secure page cannot
frame http content).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Add, edit and delete events; month/agenda views open them on tap
- NE Hub calendar stored on the server and published as a private ICS subscribe link
- iCloud CalDAV read/write with an app-specific password (encrypted at rest,
only *.icloud.com contacted, event addresses checked against the calendar)
- Edits patch the existing entry so alarms/attendees survive; writes use If-Match / If-None-Match
- Time zone definitions (VTIMEZONE) generated so other apps read times correctly
- Podcast tab (PODCAST_URL) alongside Podcast Admin
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The site sends X-Frame-Options: SAMEORIGIN, so it cannot be embedded; the tab
and a Home tile open it in its own browser tab. Address is VERSE_URL.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
fetch() decompresses transparently, but the proxies forwarded the upstream
content-length, so browsers cut compressed Plex/Seafile responses short and
JSON.parse failed. Ask Plex for identity encoding and drop the stale length
whenever the upstream response was encoded.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Connecting through plex.direct names failed from the container (DNS and
hairpin NAT). Try http://<lan-ip>:<port> first, verify the server's
machine identifier before sending the token, and let the user type an
address when discovery fails.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Mobile-first PWA (phone tab bar with More menu, iPad/desktop rail)
- Passkey (WebAuthn) sign-in gates the whole app; first passkey via setup code
- Files: Seafile browse/upload/new doc/rename/move/share link/preview/delete
- In-app OnlyOffice editing with JWT-signed configs and save-back to Seafile
- Plex music player via plex.tv sign-in and a server-side proxy
- Calendar agenda from private ICS links (recurrence + time zones)
- Search, Home dashboard, webmail deep links, audiobooks frame
- Dockerfile, compose, and a Gitea Actions workflow that builds the image
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
