mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 21:46:49 +00:00
b598b978655d00a538dec6bd04dfe3dac8a334bf
43 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Maurice
|
52461a6cd8 |
fix(admin): stop a stale base URL from reaching the Anthropic config on the phone
The phone AI parsing form saved the base URL left over from a Local or OpenAI setup after switching to Anthropic, so Anthropic requests went to the old host. It now saves an empty base URL for Anthropic, as the desktop form does since #1777. |
||
|
Maurice
|
2a242f29fb |
fix(admin): keep a parallel addon toggle when a photo provider toggle fails on the phone
The phone rolled a failed photo provider toggle back by restoring the whole addon list it saw at the click, which also undid any switch flipped while the request was in flight. Photo providers now go through the same toggle as every other addon, with a per row rollback, as on desktop. |
||
|
Maurice
|
2acef40c35 |
fix(admin): keep a later notification toggle when an earlier one fails on the phone
When a toggle on the phone matrix failed after a later toggle had already rendered, its catch put back the preferences from its own click and so also undid the later cell. The live preferences are now mirrored in a ref and a failure reverts only its own cell, as the desktop panel already does. The test hangs the first save, lets the second one through and then fails the first. |
||
|
Maurice
|
9a7c17e7cc |
fix(i18n): a quantity under another name than count is a plural group too
The count-string gate only knew {count} and {n}, the params t() picks a
plural form by. A quantity named anything else kept one form in every
language and passed: Russian read "Все {days} дней" for 2 days and
"{objects} объектов" for 3 objects, Greek "{minutes} λεπτά" for 1 minute.
Twelve such en strings become plural groups with their forms in all 27
locales, the quantity renamed to {count}: the trip length limit, the
chat image limit, the API key limit, the storage move prompt and its
reclaimable line, the Dawarich wish rule and suggestion duration, the
road trip lateness warnings, and the road trip echo and window texts.
Their callers pass the count as a number; the storage panels used to
pass it as a string, which no form is picked by. The reclaimable line
loses its dash for a comma in every locale while it is rewritten.
i18n-parity now treats the quantity names in QUANTITY_PARAMS ({days},
{minutes}, {objects}, {max} and the like) like {count}. The four strings
where the number is followed by nothing but a unit symbol (the Dawarich
durations, the upload size limit) go on NOT_PLURAL with that reason.
|
||
|
Maurice
|
bdaddc44ac |
fix(i18n): every count-bearing string is a plural group
The plural parity check only knows the groups en already declares, so a
"{count} ..." string added as a plain key kept one form in every
language: Polish read "Usuń 1 spakowanych", Czech "Odstranit 1
hotových" and Greek "1 λεπτά". 44 such en keys become plural groups with their
forms in all 27 locales: the collection, packing, day plan and offline
banner counts, the relative times, the audit log, the tour and transit
minutes, the share and photo hints. Labels like "Notes: {count}" get
their forms too, so a language can still inflect them later. The
dashboard's hand-rolled activeOne/activeMany pair, unused, becomes one
group, dashboard.subtitle.active.
i18n-parity now refuses an en string with {count} or {n} that is no
plural group. NOT_PLURAL lists the eleven where the number is never a
quantity (a day number, a step, a waypoint, the equator multiplier),
each with its reason, and an entry that stops matching fails as well.
Callers that worked around the engine:
- Copy to trip switched between two keys on placeIds.length > 1;
collections.copyN now carries the one-place wording as its `one` form,
where the language's `one` is the number 1 alone.
- The plugin dependency toasts said "addon(s)" and "plugin(s)"; they are
groups now and the panels pass the list length as the count.
- The dismissed suggestions count went in as a string and the comp days
as a formatted string, so no form was picked; both pass numbers.
|
||
|
Maurice
|
bee500880e |
fix(i18n): every language says one file and five files its own way
Finishes the plural work the previous wip commit started. t() picks a count string's form by the language's own Intl.PluralRules, and every locale now spells out the forms its language reaches with whole numbers, about 160 count strings in all: one, few and many in Russian, Ukrainian and Polish, one and few in Czech and Slovak, five forms in Arabic, one in the others, none in Japanese, Korean, Chinese, Thai, Vietnamese and Indonesian. Each language was translated and then reviewed on its own. English no longer reads "1 files", "1 updates available" or "photo(s)". Count labels shown next to a number now take that number too: the atlas and admin statistics, the trip cards, journey and shared trip pills, packing templates, receipts, storage usage, the Studio export note. A heading that shared its key with a counted label keeps a key of its own (the boarding pass heading, the Bookings tab), so languages that put a noun after a number in the singular keep a plural heading. The plugin hosts chip passed its count through .replace() after t() and never got a form; three toasts sent the count as text. Mail and push texts for shared photos and suppressed storage failures pick their form in code through pluralForm. A whole number sent as text counts too, which is how in-app notification params arrive, and the plural rule follows the language of the strings on screen while another one still loads. The parity check knows which forms each language needs and refuses missing and impossible ones. It also reads keys that contain a colon now: it skipped them, which hid 58 missing plugin permission texts in Catalan and 35 in Vietnamese, both translated. The client parity test covers every language of the registry instead of a hand-kept list of 19, and the placeholder spec lets a form spell its number out only where its category is that one number. Brazilian Portuguese error screens were in Breton, and an Arabic dashboard label held Hebrew text. |
||
|
Maurice
|
de128cc4ae |
wip(i18n): plural forms through Intl.PluralRules
Unfinished, continued in the next session: t() resolves key.one/.few/... by the language's own plural rule, the parity check knows which forms a language needs, 16 singular/plural key pairs are merged in every locale and every count === 1 branch in the client uses the plural form. Still open: the forms each locale needs for the remaining count strings, the two new labels in every locale, and 35 tests that expect the old English wording. |
||
|
Maurice
|
237f42a493 |
fix(llm-parse): harden photo reading and finish the receipt scan
A photo is now decoded only when its header says it is within 40 megapixels, and bytes TREK cannot shrink, such as a WebP, are sent only up to 3.5 MB. A scanned PDF page is drawn by its long edge, and pdf.js skips an embedded image above the same pixel cap instead of decoding it. The receipt reading is held to bounds in the shared contract, keeps the minus sign of a discount and leaves such lines out so the Ticket split can save, and its prompt states the JSON shape, so a server without json_schema still answers something the parser reads. The model lookup sends the configured key, the import error names the photo formats, the scanned photo is attached only for someone who may upload files, and the phone settlement reloads after a receipt is saved from the trip sheets. Test ids that clashed after the rebase are renumbered, and the wiki describes the image setting, photo import and receipt scan. |
||
|
RemEx
|
b1c05bca83 |
feat(llm-parse): read a photo, as a booking or as a receipt in Costs
Whether the AI Parsing model reads images is an admin setting now, and it lands with the two features that send a photo, so it has something to control. The setting is `vision: 'auto' | 'on' | 'off'` on the addon config. On Automatic a local Ollama is asked what the model can do (`/api/show`), and a cloud provider means no; Yes and No are applied as set. The old `multimodal` flag is not read: the admin screens wrote it false on every save, so a stored false meant nothing. The per-user toggle keeps its on/off meaning and is read by the extraction now. The lookup is server-side only: capped read, validated body, never throws, cached per server and model. GET /api/llm/capabilities answers it for the signed-in caller, and both photo pickers below ask it. The booking import takes JPG, PNG and WEBP when the model reads images. The photo goes as an image to every provider (image_url, an Anthropic image block, Ollama's native chat with `images`), capped at 1600px, and skips KDE Itinerary. A scanned PDF, which used to reach the model as empty text, has its first two pages drawn by pdf-parse and sent the same way. The rest is the import as it was: background job, review, the file attached to the booking, the linked cost. On a real qwen3.5:4b a train ticket came back as bare clock times until the router gave the model every type's field meanings, and its price as an object inside a string, which read as 4900; both are handled. Costs gets Scan receipt: a dialog laid out like the booking import's takes one photo, read on the import job queue, then reviewed in the existing expense editor pre-filled with merchant, total, currency, day and lines, the photo waiting in Receipts & Invoices to be uploaded on save. No table, no migration, no category guess, no document-type detection. |
||
|
Maurice
|
1727732841 |
feat(plugins): plugins can add POI categories to the map and answer them
A new manifest capability poiCategories (up to 4, icon from an allow-list, strict #rrggbb color) and the hook poiCategoryProvider.getPois behind the hook:poi-category-provider permission. GET /api/plugin-pois in the plugin contributions module answers them in the /api/maps/pois shape, with search_plugin_pois as the MCP twin. plugin: ids no longer count as Google place ids. SDK 1.8.0 carries the types, validation and docs. On the map, one hook merges the built-in categories with the ones active plugins declare, and the pill shows the plugin chips after a divider on desktop and phone, scrolling sideways instead of shrinking a chip below its touch target. A plugin chip searches through a repo that refuses offline and parses the answer strictly. Its pins, on Leaflet and GL, use the category's own icon and color, both checked again before they reach any markup, and the hover card lists the plugin's details as escaped text. A plugin POI can be added as a place like any other. The admin panels on desktop and phone show a chip for the new permission and the categories a plugin would add, from one shared module. Addresses discussion #1781. |
||
|
Maurice
|
650451bdf7 |
feat(notifications): Web Push delivers notifications to every device, even with TREK closed
A fourth built-in channel next to email, webhook and ntfy. Browsers register per device, the server encrypts per RFC 8291 and signs per RFC 8292 with node:crypto and sends only to known push services through the SSRF guard. The event matrix decides per category what arrives by push; admins switch the channel on under Notifications. VAPID keys come from the environment or are generated once, only while neither stored row exists, and kept encrypted. A pair that does not decrypt or match is never overwritten and never swapped for another one: push stays off with an error in the log and every device stays registered until the key is fixed. The subject is VAPID_SUBJECT, then an https APP_URL, then the project URL. Only chat messages collapse into one notification per trip, and a replacement still alerts. A 403 removes a device only after three failures in a row; 404 and 410 remove it at once. Password change, reset and an admin setting a password drop the user's devices with the other credentials. The request log redacts subscriptions and endpoints, boot errors print *** for every secret variable, and logout forgets the device with a plain fetch so an expired session cannot redirect midway. Addresses discussion #894. |
||
|
Maurice
|
7ce31756a3 |
feat(settings): every date picker starts its week on the day you pick
Settings > General > Language & region gets "Week starts on" (Monday, Sunday or Saturday), and Admin > User Defaults a default for everyone who has not picked one. Monday stays the built-in value, so nothing changes for anyone who leaves it alone. Both calendar implementations follow it: CustomDatePicker, used by trip dates, bookings, costs, to-dos and the admin school holidays on desktop and phone, and the journey date picker, whose weekday headers were hardcoded English and now speak the app language. The grid math and the header row live in one helper (utils/calendarWeek.ts). The day names on the options come from Intl, so only the label and a hint needed translating. Vacay keeps its own per-plan week start. The value is validated like the other regional settings: VALID_VALUES for admin defaults, the display-settings MCP tool, and the managed key list. Addresses discussion #2029. |
||
|
Maurice
|
8906b66bc8 |
feat(settings): set the Google Maps key through PLACES_API_KEY
The server already put PLACES_API_KEY ahead of the key saved in the admin panel, but nothing said so: the variable was in no template and the admin field kept showing a stored value that no search used. GET /me/settings now answers env_keys, the variable behind each key the environment sets (Google, Unsplash, Amap), and null for that key's value. The admin field turns read-only and names the variable, Test still probes the key a search resolves to, and a save leaves those names out so the stored fallback survives. The variable is documented in .env.example, docker-compose.yml, the Helm chart (as a secret) and the wiki. Addresses discussion #1881. |
||
|
Maurice
|
85b5756e89 |
fix(client): the audit round over the 4.3.1 release
Ride minutes and late marks follow an edited timetable instead of the routing that fetched them; a landing day's join band reads as the ride it is rather than a nine hour drive of no length; the refuel offer is there on the road out of a terminal or a pick-up desk; the phone's stage map draws the ride; the share page numbers its stops the way the planner does; the PDF lists a day the way the day plan lists it, from both shells; a poster-less clip draws its play badge everywhere, not only in the editor; the hero title has room for its descenders and the list card keeps its badge clear; the release notice keeps its close control in reach when it stacks; a link chip's actions are thumb-sized and its delete asks first; the Google retry line and the Google-only switch appear only where Google answers. |
||
|
Maurice
|
ed18c37903 |
fix: the findings of the final 4.3.0 audit
Every file the release touches was read once more, and what survived an independent check against the code is fixed here, with a test for each. Data and credentials - A document sync connection edited to a new address no longer carries the stored token along: a blank form under another origin is refused, the same rule the probe route already had. Dawarich and AirTrail testConnection send the stored key only to the host it was stored for. - The key rotation script now covers document_connections.secrets and trip_document_links.webhook_secret, which it had skipped. - Turning a booked night into a pause in the road trip popup asks first and says that the booking and its expense go with it. Deleting a place says the same when a night is booked there, on the desktop and on the phone. - A moved version marker over unchanged bytes no longer replaces the TREK file and its attachments; a real revision carries the attachments over. Planner - A drop in the day plan names the row it lands ahead of in the full day, so a hidden hotel stop no longer shifts it one slot early; the store sorts before it splices. Via re-anchoring, the booked-night guard and the sidebar's day membership read the stored day, the index space the server uses. - A hotel stop placed mid-day re-pins the road trip vias of that day, and the booking session receives the new stop order too. The Public API and the iCal feed list a booked hotel once. A plugin can no longer write a stay against another trip's day. Road trip and map - The route overview paces its requests to the public routers and retries a rate limit, and it says which legs it could not route instead of quietly reporting a shorter trip. A click on a via handle no longer drops a second via; handles hide when zooming out. Read-only members cannot edit the driving limits. The phone shows a way back when no day is picked and prints the night drive departure in the chosen clock format. Integrations and search - Google transit keeps conventional trains when the train chip is on. TREK_PLACES_ENABLED=false stops the details and enrichment calls too, and accepts the whole boolean family. A caller-supplied description no longer lands in the instance-wide enrichment cache. Nominatim searches carry a timeout. An OSM place id is checked for shape before it reaches Overpass. - Dawarich puts a stay on the trip whose dates hold it, the Atlas hand-off knows what the Atlas already shows, and a host change with a new key clears the old instance's state. - Document sync: a webhook address pasted by hand works on the token alone, deleting a connection unregisters its subscriptions, Nextcloud under a sub-path connects, Synology answers a name collision before uploading and verifies a move into the bin, Paperless titles are capped at 128 characters, a DNS failure reads as unreachable rather than as a policy verdict, videos from the store are accepted like uploads, and remote_missing has a way out. Conflict buttons only for the owner, a refused choice is reported, a refused credential gets a Reconnect button, disconnecting asks first on the desktop as it does on the phone, and the folder picker no longer spins forever. Release - The server holds the release notice back from a bundle that cannot draw it, so the previous shell served from the service worker cache after an update no longer shows bare keys and no longer lets a click use the notice up. - Import into an existing list gets the same body limit as a new list. Chat images say when the limit is reached and the new controls are translated. The transit backend switch reports a failed save. The Helm chart carries the Amap credentials in its Secret; the shipped templates document the Places API and Amap variables and the Overpass default. The wiki follows. |
||
|
Maurice
|
843582863c |
fix(docsync): offer the sync button only where something is behind it
The Documents addon put a "Document sync" button on every trip's Files tab, and the seed ships every provider switched off, so after the upgrade each of those buttons led into "No document providers are available". The button now shows on a trip that is already bound, to every member, and otherwise only to somebody who may bind the trip on an instance that offers a provider. Without it the Files toolbar is the one from before the feature, trash flush right, on both shells. /api/addons carries no document providers for a normal user, so the answer comes from the docsync routes through a new online-only docSyncRepo and is kept per session in docSyncOfferStore. A revisit renders the last answer at once and checks it again; offline nothing is asked and the last answer stands. Creating a binding, removing one and removing a connection now ping the trip with docsync:changed and zero counts, so a member already on the Files tab sees the button come and go without leaving it. Both shells keep listing a binding whose provider the admin has since switched off instead of claiming there are no providers, and name its store through one storeName() helper. A load that answers 403 or 404 clears the bindings as well, so they do not linger once the Documents addon is gone. The phone admin screen gets the Documents shelf the desktop one has: the document providers as sub rows under the addon, toggled through the same admin route and re-read after Documents itself is toggled, because the server switches the providers off with it. isTripOwner and the isOwner prop become canManageSync and canManage, which is what canManageDocSync answers. Both folder pickers take loadScopes out of the sync object before their effect, so exhaustive-deps is satisfied without the effect running on every render. |
||
|
Maurice
|
76f45512d1 |
feat(admin): the phone's API-keys card, rebuilt like the desktop tab
The desktop tab was reshaped around one idea: a key should be the exception rather than the thing you are expected to paste. The phone still had the older shape, where Google wore the "Recommended" chip and the TREK Places API was not on the screen at all. Two pages, opposite advice, same setting. So the phone gets the same three comparable blocks in the same order: the TREK index first, with its own ribbon and a folded panel of what it does and does not carry, then the two keys under theirs. The Google caveat is said before the field rather than after it, because somebody about to paste a key should read it while deciding. The four Google switches moved under the key they spend, folded away: they are set once and never touched again, and open they were longer than the rest of the card together. Open-Meteo left the card entirely, as it did on the desktop, since it takes no key and had the loudest treatment of anything there. The provider choice is TREK's own picker now. A native select is drawn by the operating system and was the one control on the page that did not belong to the app. Its description was also describing a TREK that no longer exists: it said one service answers place search. The index and OpenStreetMap answer every search and the setting only decides who is asked once they come up empty (maps.service.ts, keyedProvider). Both that line and the missing-key notice say so now, in all 23 languages, and the two key hints have short forms for the narrow screen. |
||
|
Maurice
|
aa0d62f063 |
fix(admin): read key presence from the app config, not the form
The place search provider block now renders on a managed install too, and there the key fields are empty by design: the operator owns the credentials and user-profile never sends them. An operator key set through the environment is invisible in the fields either way. The warning behind the provider select read those fields, so it told every managed admin that search "falls back to OpenStreetMap" while their key was answering. app-config already carries the answer as has_maps_key, and it resolves the same chain the search itself uses, environment included. has_amap_key sits beside it, so both come into the store at boot and both follow a save. |
||
|
Maurice
|
2fd5b6b00a |
fix(admin): keep the place search provider reachable on a managed install
The API keys card was hidden wholesale on a managed install, which took the provider choice with it although the server leaves places_provider to the admin there. The card stays; the keys, their Save button and the Google switches fold away, on the phone shell now too. The mobile warning uses the pending token instead of an undefined one. The desktop tests find a key input through its labelled toggle rather than by position, which is where the accessible name sits. |
||
|
A1phaN
|
57eac32f9f |
feat(map): amap as map api provider and display template
|
||
|
Maurice
|
ac57321840 | merge dev and reconcile roadtrip planning | ||
|
RemEx
|
b58771fd4c |
fix(admin): recommend the local model that also reads images
The one model the addon offers to pull was Qwen3 8B, which is text-only, so a scanned page or a photographed document reached it as no text at all and came back empty. Qwen3.5 4B is multimodal at a third of the size: one download covers every kind of document instead of leaving the operator to work out that the recommended model cannot read half of them. The list stays one entry long. A self-hosted host needs a model, not a menu, and any other id can still be typed in or picked from what Ollama already has. |
||
|
Maurice
|
491cfccc56 | feat(roadtrip): add daily scheduling and configurable day endings | ||
|
Maurice
|
72935d7e40 |
test(admin): wait for the migration POST instead of reading it after the toast
FE-MOB-MSTOR-013 read migrationBody straight after the save toast. The toast comes from the PUT, the migration POST is fired by the queue effect one commit later, so the two are not the same tick. It only passed while that effect happened to flush first, which on a loaded runner it does not. The desktop twin FE-ADMIN-STOR-030 has waited here since 8069b8805; the mobile file was left behind. |
||
|
jubnl
|
bc10fba389 |
feat(plugins): TREK_PLUGINS_IGNORE_TREK_RANGE turns the version gate into a warning (#2226)
* feat(plugins): TREK_PLUGINS_IGNORE_TREK_RANGE turns the version gate into a warning A plugin whose author has not updated its `trek` range for the running TREK can now be installed, updated and activated when the operator sets TREK_PLUGINS_IGNORE_TREK_RANGE to a truthy value. Every gate (registry picker, post-extraction re-check, sideload, dev-link, activation) warns instead of refusing; a missing range is tolerated the same way; "install latest" takes the newest published version. The plugin-API version gate is not lifted and the Discover compatibility verdict stays truthful. The admin is warned at every step: each bypass is logged, install/upload/link/ update responses carry a `trekRangeBypassed` marker, and both admin panels show a "Version checks off" pill, an "Install anyway" confirm dialog before a registry install, the same notice after a path that could not ask first, and a persistent chip on the row while the plugin runs outside its range. Nine new i18n keys in every locale; wiki pages updated (Environment-Variables, Admin-Plugins, Plugin-Development, Security-Hardening). * refactor(plugins): one useRangeBypass hook behind both admin shells SonarQube flagged PR 2226 at 10.8% duplicated new code: the range-bypass logic had been added to the desktop and phone plugin panels as identical copies. The marker/warning types, the row chip, the "Install anyway" offer, the dialog copy and the confirm-or-notice state now live in useRangeBypass (next to useInstanceSettings, the existing shared-logic precedent); each panel keeps only its own dialog/sheet markup. * docs(claude): record the SonarQube gate rules and the no-English-placeholder i18n rule The CI SonarCloud gate (Sonar way, on new code: >=80% coverage, <=3% duplication, A ratings, hotspots reviewed) was only discoverable by waiting 20-25 minutes for the workflow. The root CLAUDE.md now states the conditions, the desktop/mobile shell-mirror duplication trap and its shared-hook fix, and how to check a PR with the sonarqube MCP first; client and server CLAUDE.md point at it. shared/CLAUDE.md says every locale needs a real translation — parity cannot tell an English placeholder from a translation. * docs(claude): keep CLAUDE.md to commands, invariants, gates and philosophy Verified every concrete claim in the five CLAUDE.md files against the code and fixed the stale ones: the websocket server is the Nest realtime gateway, MCP tools live in <domain>.mcp.ts files, the client "native shell" section described code that was never written, offline maps also prefetch vector basemaps, plus several renamed files and wrong table names. Then trimmed everything that drifts on its own: dates, migration history, counts, and inventories of stores, slices, domains, sync files and CLI commands. What stays is the commands, the invariants with the file that enforces each one, what CI actually runs, the reference implementations to copy, and the rules for new code. Each file now opens with that rule. |
||
|
jubnl
|
b82962f95b |
Feat/plugin instance actions (#2209)
* feat(shared): scope plugin action descriptors * feat(plugin-sdk): instance-scoped settings actions * feat(plugins): run instance-scoped actions from the admin settings dialog * feat(admin): instance-scoped plugin actions in the settings dialog * fix(plugins): surface instance actions without instance fields and harden the action gate * docs(plugin-sdk): note that hosts before 4.2.0 ignore action scope * fix(admin): open the dialog for instance actions, explain inactive 404s, guard the save window * docs(wiki): plugin pages for instance actions and the admin panel changes |
||
|
Maurice
|
3f49ef8d21 |
fix(plugins): readable save button, honest respawn, scrolling hosts dialog (#2170, #2159)
The instance-settings save button paired bg-accent with a hard text-white and vanished in dark mode; it uses the accent pair token now. A failed activate() after saving no longer reports success over a dead plugin: the config stays, the response says what happened. The allowed-hosts dialog scrolls like the ones
|
||
|
Maurice
|
4cd25d3047 |
fix(admin): the addons page re-reads after a journey toggle instead of trusting itself (#2156)
Disabling Journey cascades the photo providers off on the server, but the panel kept its local rows, so after off and on the providers showed active while being disabled. The desktop and the mobile panel re-read the list after a journey toggle; the write itself still rolls back a single row on failure. |
||
|
Maurice
|
b6a86275f6 |
fix(notifications): the smtp test names its failure and the log carries it (#2196)
testSmtp logged nothing and the transport ran on nodemailer's two-minute defaults while the client gave up after eight seconds, so every failure was a generic toast over an empty log. The transport gets real timeouts, every outcome is logged without credentials, and a classified, scrubbed cause (auth, DNS, refused, filtered port, TLS mismatch, certificate) goes into the response the admin sees; the channel test calls wait long enough to receive it. The password field also rendered its mask as value, so replacing a stored password silently saved the bullets as part of the new one; it is a placeholder now, on desktop and the phone admin. |
||
|
jubnl
|
394201cd32 |
feat(plugins): instance-wide settings editor in the admin UI (#2170)
* chore: bump version to 4.1.0 [skip ci] * fix(collections): stop findDuplicateCollectionPlace merging places by coordinates alone Three places answered "is this a place the trip already has?", not two: PlacesService.findDuplicatePlace and isPlaceDuplicate got the shared strategy list in #2130; CollectionsService.findDuplicateCollectionPlace was missed and kept its own hand-rolled copy of the pre-#2130 order. Unlike findDuplicatePlace, this one had no isPlaceDuplicate() guard in front of it — savePlace calls it directly — so the coordinate fallback for a NAMED candidate was live, not latent: two distinct places sharing an address (a restaurant and the bar upstairs) would report each other as duplicates the moment their coordinates round to the same ~11 m box, regardless of name. It also never read google_place_id/google_ftid/osm_id at all, even though every collection_places row stores them, so a place renamed since it was saved could be saved again instead of being recognised by its provider id. Now walks placeMatchStrategies() from @trek/shared, same as findMatchingPlaceId: provider id, then name, then coordinates only when there is no name. savePlace passes the provider id fields through since they are already on the request body; the two bulk call sites (importablePlaces, saveFromTripPlaces) are unchanged, since their source rows don't carry provider ids to pass. Closes #2137 * fix(collections): ask the same question at all three call sites savePlace was not the only caller of findDuplicateCollectionPlace. The bulk copy already carries google_place_id/google_ftid/osm_id into the row it writes but asked without them, and the import picker never selected them at all, so a renamed place was recognised on one path and not on the other two. The picker answering differently from the import is the drift the method exists to prevent: a row shown as new would come back refused. COLLECTIONS-SVC-102 and -103 cover the bulk copy and the picker. * fix(map): give the Leaflet map its own zoom ceiling, so a vector basemap cannot take the planner down Opening a trip on 4.1.0 could land on the error boundary with "Map has no maxZoom specified", and so could the map settings tab, which left no screen from which to pick a different basemap. Leaflet answers getMaxZoom() from the map options first and otherwise from a layer that brought one, and only a GridLayer ever contributes via its beforeAdd hook. A vector basemap is a GL canvas on a plain L.Layer, so it contributes nothing, and MapContainer set no ceiling of its own. MarkerClusterGroup.onAdd refuses an infinite one by throwing, before any clustering, so an empty trip hit it too. That path opened when the default basemap became a MapLibre style. It reaches further than an operator choosing OpenFreeMap: resolveTileUrl sends a keyless CARTO template to the app default, which is now a vector style, so every instance still carrying the old CARTO basemap fell into it on upgrade. The ceiling belongs on the map rather than on the base layer, because it has to hold whichever of the three branches renders. 19 matches what the raster and satellite layers already carried, so nothing changes for the maps that worked. SharedTripPage gets the same treatment: it has no cluster to throw, but it draws the same vector basemap and its fitBounds asks for a ceiling. mapZoomCeiling.test.ts pins Leaflet's own semantics against the real library rather than a mock, since a mocked react-leaflet would have kept passing through all of this. * fix(map): put the CARTO key back on the template the settings preview draws The map settings fields hold what the user is editing rather than what useTileUrl already resolved, so the preview received a bare template with no key on it. resolveTileUrl then read it as a keyless CARTO url and did what it is meant to do with one: fall back to the app default. The preview drew OpenFreeMap while the fields said CARTO, whether or not a key was saved. Same reason the tab crashed for anyone on a CARTO basemap even after entering a key, which is the loop that made this hard to escape: the key is entered on the page the fallback had taken down. FE-COMP-MAP-033b pins the template the preview is handed, with and without a key. * fix(admin): put the CARTO key back on the default-settings map preview too Same shape as the user-facing map tab, and reported alongside it: the field holds what the admin is editing, so the preview resolved a keyless CARTO template and drew the app default instead of the basemap being set. * fix(mobile): put the CARTO key back on the phone map settings preview too The third preview with the same shape, and the one that matters most while the crash is live: the phone layout is where someone would go to change the basemap when the desktop tab will not open. * fix(calendar): a fully timed stay is its two hand-overs, not a week-long bar Closes #2136 A stay was always exported as an all-day block across its whole range, and the check-in and check-out markers came on top of it. When the stay records both ends of its clock the markers already say everything the block does, and the block is the half nobody can act on: it takes a week of calendar to repeat what two one-hour events state precisely. Same shape as the parking and rental windows in #2068. Only where the markers actually stand in for the booking, though. They are emitted once per stay and titled from its lowest-id reservation, so a second room on the same stay would otherwise be left with nothing at all. A stay that knows only one end keeps its block too, since nothing else carries the other end's date. CAL-025b covers the drop, -025c the one-sided stay, -025d the second room. * fix(mobile): the phone admin map preview needs the CARTO key too The fourth preview with the same shape, missed when the other three were fixed. Sonar pointed at it: the desktop and phone admin pages are near-identical, so the duplication report named the file the change had not reached. * chore: bump version to 4.1.1 [skip ci] * feat(plugins): admin editor for instance-wide plugin settings The scope:'instance' settings a plugin declares had API endpoints but no UI. - shared: plugins.schema.ts — the settings-field descriptor and the admin instance-config GET/PUT wire contracts, imported by both sides - server: GET /api/admin/plugins/:id/config now returns the declared fields alongside the (masked) values; PUT re-spawns an ACTIVE plugin (its child reads config once, at init) and reports it via 'restarted'; the admin list carries instanceSettingsCount so the UI gates its menu item without a fetch - client: 'Instance settings' row action opening a form modal (desktop) / MSheet (phone) in both admin shells — checkbox/select/secret rendering as in the user settings form; an untouched secret mask is never sent back - i18n: three new admin.plugins.* keys in every locale * refactor(plugins): move the admin body contracts to @trek/shared The remaining plugin DTO schemas (install, link, activate, uninstall, retrust, update, egress-hosts, user-settings update, route) now live in shared/src/plugins/plugins.schema.ts with their inferred types, alongside the instance-config contracts. The journey-contract doctrine notes (#1842) moved with them — each body stays deliberately loose so the handlers keep the rejections and fallbacks they already own, and new spec tests pin that looseness so a well-meant tightening breaks a test that explains itself. plugins.dto.ts is now thin createZodDto wrappers over the shared schemas (same class names, no controller changes), and the client's pluginInstall types its options and body against PluginInstallRequest. * fix(admin): offer Allowed hosts only to plugins that declared operatorEgress The row's egress chip was already gated on the declaration, but the kebab menu (desktop) and row action sheet (phone) offered Allowed hosts on every installed plugin — inviting the admin to widen egress for plugins that never asked for it. Both entries now render only when the plugin declares operatorEgress; the dialog's unsupported-notice fallback stays as the truth-teller for stale list data. * test(admin): close the Sonar gaps on the instance-settings form The PR gate flagged new-code coverage (76.4%) and duplication (10.9%). - The two identical 39-line handler blocks were logic, not markup — they move into one shared useInstanceSettings hook; each shell keeps its own markup (the deliberate desktop/phone divergence stays) - New tests per shell cover the untested branches: every field type renders and round-trips into the save payload (select, checkbox/MToggle, number, hint, no-label key fallback), a failed fetch is a toast, a rejected save shows the server reason and keeps the edits, and the dialog/sheet closes without saving - INS-009 covers the controller's no-body '|| {}' fallback --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: michael-bohr <263459669+michael-bohr@users.noreply.github.com> Co-authored-by: Maurice <mauriceboe@icloud.com> |
||
|
Maurice
|
1f66ef1d32 |
fix(maps): let users and admins enter a CARTO API key (#2060)
CARTO stamps an "API KEY REQUIRED" watermark onto every basemap tile fetched without a key since 26.08.2026, and both CartoDB presets plus the built-in fallback are CARTO. The key is free and needs no account, so add it as a setting rather than dropping the provider. carto_api_key sits next to mapbox_access_token: per user in Settings/Map, instance-wide under Admin/User Defaults, encrypted at rest, injected from CARTO_API_KEY on managed instances. Unlike Mapbox it never switches the map provider, since a raster key says nothing about the renderer. The key is appended as ?key= at render time instead of being stored in the template, so a saved URL stays portable and survives a rotation. That is also what reaches the four maps that pinned CARTO and ignored the user's tile setting: atlas, collections, the public trip share and the public journey. The two share pages read it from their token-gated payload, the same way baseCurrency already travels. Also lifts the release notice above page chrome. Its overlay sat at z-index 50, under the Vacay mode toolbar at 61, so the dialog was neither on top nor modal. Adds a six-step layer scale to index.css and moves the three notice shells onto it. Closes #2054 Closes #2052 |
||
|
jubnl
|
4ba407aead |
feat(plugins): install an older version of a plugin (#2035)
Adds a version picker to the plugin admin panel, on desktop and mobile: every published version with its own server-computed compatibility verdict, so the client never re-derives semver range logic. A deliberate non-latest pick sets an update hold on the row, which keeps the update banner and "Update all" from immediately nagging the rollback away. The hold releases when an install lands back on the newest compatible version by any path, or when the admin resumes updates explicitly. An unresolvable registry never sets one: refusing to pin on missing information beats silently muting future updates. |
||
|
Maurice
|
fe5c6f182e |
fix(ci): restore the peer dep the swc install drops, and close a test race (#2040)
Two separate reasons v4.0.0 (#1719) is red. The SonarQube workflow killed all 616 client test files with "Cannot find module '@testing-library/dom'". That package is a peer dependency of @testing-library/react and not a direct dependency of the client, and the step that installs @swc/core's Linux binary passes --legacy-peer-deps, which tells npm not to put peer dependencies back when it re-resolves the tree. In test.yml that step lives in the server job, which never runs client tests, so folding the jobs into one (#2039) is what brought the two together. It now installs alongside the swc binary, with its version read from the peer range rather than pinned, and a one-line resolve check right after fails fast with the module name instead of six hundred identical failures twenty minutes later. MAdminStoragePanel's FE-MOB-MSTOR-015 was a genuine race in the test, not in the panel. Its POST handler incremented postCount, then awaited request.json(), and only then pushed to migrationPosts — so between the two there was a window where one POST had been counted but migrationPosts was still empty. The GET handler reports `migrations: []` for an empty migrationPosts, i.e. "nothing running", so a poll landing in that window told the queue it was free to start the second migration, and the waitFor(postCount === 1) above could resolve inside it too. Parsing before counting closes it. Verified by running the whole mobile suite at --maxWorkers=8, where it used to surface. |
||
|
Maurice
|
e3c524dd02 |
test: give every test case an assertion of its own
SonarQube's S2699 flagged 196 test cases as assertion-less. Almost all of them end on a bare `await screen.findByText(...)`, which does throw when the text never shows up — the test is real, the analyser just cannot see it. Spelling the check out keeps the behaviour identical and makes it readable. Writing them out turned three tests red, each for a good reason: - FE-COMP-NOTES-008 read the heading out of the loading panel, which renders its own copy and swaps the whole node out once the fetch settles. It now waits for the loaded state. - FE-COMP-PHOTOPROVIDERS-014 matched /connected/i, which also matches the "Not connected" the badge starts as — the test passed whether or not the button did anything. Exact text now. - FE-FILES-002 compared an empty list against the empty list it already was. It seeds a file first, so the 500 has something to leave alone. JOURNEY-SVC-066 asserted nothing at all behind a "should not throw" comment; it now says that out loud and checks no journey entry is left orphaned. |
||
|
Maurice
|
27be764164 |
test(client): the coverage that goes with the previous commits
Left out of the commits they belong to by hand, not by intent: the mobile screen suites, the tripRepo cache-first read behind the startup-destination fix, and the MSW handlers the stricter unhandled-request setting needs. |
||
|
jubnl
|
305b113d5f |
Feat/storage driver (#1949)
* feat(storage): storage key validation, driver contract suite, LocalDriver * feat(storage): MirrorDriver composite backend * feat(server): add TREK_UPLOADS_DIR env var for the uploads root * feat(storage): settings-backed registry, StorageService facade, module wiring * test(storage): pin src/nest/storage coverage thresholds * feat(storage): multer upload options factory * refactor(files): spool trip-file uploads through storage * refactor(collab): spool note attachments through storage; normalize files/ prefix * refactor(journey): spool journey media uploads through storage * refactor(trips): spool trip cover upload through storage * refactor(places): spool place-image and collection uploads through storage * refactor(auth): spool avatar upload through storage * fix(server): consolidate allowed_file_types onto AllowedFileTypesService * fix(storage): default defParamCharset to utf8 in the upload factory * test(db): re-point the trailing-migration guard at the trip_files prefix strip * fix(storage): age-gate the boot spool sweep * test(files): key FILE-P02 residue checks on upload size * test(storage): raise src/nest/storage coverage pin * refactor(platform): serve /uploads routes through storage * refactor(files): serve trip-file downloads through storage * refactor(memories): serve photo bytes through storage * refactor(maps): stream place-photo bytes through storage * refactor(share): stream shared place-photo bytes through storage * refactor(journey): serve public journey assets through storage * fix(share): answer place-photo cache miss with 204 like the maps proxy * test(server): close serving-swap gaps surfaced by the full tier * test(storage): raise src/nest/storage branches pin * refactor(place-photos): route place-photo cache through storage * refactor(places): reclaim place images and collection covers through storage * refactor(trips): trip covers through storage * refactor(auth): avatar reclaim through storage * refactor(collab): note-file deletion through storage * refactor(files): trash deletion through storage * refactor(memories): trek photo cache internals through storage * refactor(memories): thumbnail service category-addressed * refactor(memories): immich upload reads through storage; drop uploads-root * refactor(journey): photo deletion through storage * fix(memories): reclaim orphaned trek photo cache objects in the ttl sweep * feat(journey): journey-thumbs orphan sweep and delete-site derived-artifact reclaim * test(server): close slice-4 gaps surfaced by the full tier * test(coverage): raise slice-4 domain pins * refactor(backup): list, existence and delete through storage * refactor(backup): download through storage sendToResponse * refactor(backup): create backup through per-category storage enumeration * refactor(backup): restore and upload-restore through storage * refactor(backup): auto-backup retention through storage * refactor(server): boot dir-creation to driver init * test(server): close slice-5 gaps surfaced by the coverage tier * test(coverage): raise slice-5 backup pin * test(server): resolve async backupFileExists mocks for the tests typecheck * test(server): pin ranged-read stat and zero-byte roundtrip in the storage driver contract * feat(server): TREK_S3_* env wiring — schema, s3 namespace, all-or-nothing boot rule * feat(server): S3 driver core — aws-lite client seam, stat/delete, driver-owned deadlines * refactor(server): type the aws-lite S3 client via s3-types reference * feat(server): S3 driver getStream and list — ranged full-object stat, iterator pagination * feat(server): S3 driver put — bounded-peek routing, Upload inactivity deadline * fix(server): S3 driver Upload monitoring — Transform interposition, stream cleanup * feat(server): env-declared s3-main storage backend; settings-declared s3 rejected * test(server): env-gated S3 driver contract suite against MinIO * fix(server): S3 driver zero-byte put — work around aws4 duplicate Content-Length signing defect * fix(server): scope the zero-byte put workaround to buffered bodies; bind test MinIO to localhost * ci(server): MinIO-backed S3 driver contract job * ci(server): align s3-contract shim comment and MinIO bind with references * docs: S3 storage backend configuration and off-box backup mirroring * docs: restore README formatting, keep S3 additions only * ci(server): make live-MinIO contract runs manual-only (AIStor licensing) MinIO's community line is discontinued entirely; the maintained successor, AIStor, requires a license key that can't safely live in a shared CI runner. The s3-contract CI job is removed; live-provider contract runs against MinIO/AIStor are now a manual, license-gated procedure documented in docker-compose.minio-test.yml's header. * chore(server): final-review polish — stale CI refs, dockerignore key, boundary pins, zero-byte tempfile contract case * expose admin ui * feat(shared): storage backend type registry, wire schemas, category relocation * feat(server): accept settings-declared s3 backends — shared-schema options, decrypt-at-build, registry preview() * feat(server): remove TREK_S3_*/TREK_UPLOADS_DIR — tombstone boot rule, built-in override as the relocation path * feat(server): deriveSecurity.encryptionKeySet and storage secret plumbing (gate, encrypt, unmask, mask, redact) * chore(server): drop storage-secrets import that only Task 8's probe helper will use * feat(server): seed-once storage-config.json boot import — fail closed on any invalid seed * feat(server): registry snapshot() — effective storage config with provenance * feat(server): api/admin/storage GET/PUT — masked secrets, preview-gated saves, wired reload, audits * feat(server): api/admin/storage/test — per-target ephemeral probes, mirror targets probed individually * test(server): e2e coverage for api/admin/storage — guards, managed refusal, envelope, probes * test(server): give e2e harness DBs the app_settings table the storage registry reads at boot * test(coverage): raise pins after the storage admin-config slice * fix(server): final-review polish — encryption-gate wording, all-field sentinel guard, README/e2e notes * test(server): storage slice-1 review follow-ups — mirror s3-replica probe decrypt, all-encrypted seed without key, test-route 401 * feat(i18n): storage admin domain + tab label in every locale * feat(client): adminApi storage endpoints — getStorage, updateStorage, testStorageBackend * feat(client): storage admin draft-document helpers + relative-time util * feat(client): schema-driven storage BackendForm — fields by kind, mask echo, encryption banner * feat(client): admin storage panel — backends list, category map, health strip, one-PUT save * feat(client): storage tab on the admin page * feat(client): storage admin panel and section on the phone shell * fix(client): block renaming a storage backend onto an existing name * feat(server): allow mirrors on any storage category — lift the backups-only rule * feat(i18n): replicas-on-primary mirror strings in every locale * feat(client): mirror fold/synthesize model helpers for replicas-on-primary * feat(client): BackendForm mirror-targets composer; raw mirror type hidden * feat(client): desktop storage panel folds mirrors into their primaries * feat(client): phone storage panel folds mirrors into their primaries * fix(client): strip removed backends from remaining mirror replicas — no phantom refs * feat(storage): retire photos as a configurable category — served-only via the ServedCategory seam * feat(i18n): descriptive storage category names and descriptions in every locale * feat(client): descriptive category names, descriptions and id badges in the storage panel * docs(storage): fix stale nine-category comments after the eight-category shrink * docs: storage configuration via the admin UI and seed file — README + compose * docs(wiki): Admin Storage page and storage cross-links * docs(server): storage domain blueprint entry; TREK_PLACE_PHOTO_DIR tombstone clarifier * refactor(server): drop the storage env-var tombstones — the variables never shipped * docs: storage config is simply new in v4 — drop the removed-variables story * feat(shared): backfill-status and usage wire schemas on the storage admin state * feat(server): MirrorDriver.backfill — prefix-scoped, size-compared, cancellable replica catch-up * feat(server): one-at-a-time storage backfill jobs + the storage events bridge * feat(server): storage usage scan — nightly cron, on-demand service, persisted with computedAt * feat(server): replica_failure admin notifications — events bridge, hourly debounce, channel registration * feat(i18n): replica-failure notification text in every locale * feat(server): storage backfill and stats-refresh admin endpoints * feat(client): adminApi backfill and stats-refresh endpoints * feat(i18n): storage sync and usage strings in every locale * feat(client): desktop storage panel — sync now, usage display, backfill polling * feat(client): phone storage panel — sync now, usage display, backfill polling * fix(client): per-category usage line on the phone storage panel * docs: sync now, usage stats and replica-failure notifications * test(server): admin scope now includes replica_failure, not just version_available Commit |
||
|
Maurice
|
9dd0a851ca |
fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923)
* fix(mcp): accept per-leg times on create_transport and update_transport metadata was pinned to Record<string, string>, so a legs array could not get through and a multi-leg flight built over MCP lost every intermediate time. The booking ended up with correct endpoints and no legs, which every reader then treats as a single segment. legs is now a real, typed parameter with its contract in @trek/shared, shaped exactly the way the planner form and the importers write metadata.legs. The folding checks what the readers depend on: one leg fewer than endpoints (the AirTrail dedupe builds its signatures on that), day ids that belong to the trip, airport codes that agree with their endpoint, and the times, where a stopover endpoint carries the departure and the last one the arrival. metadata keeps its type and its replace semantics. Segments smuggled through metadata.legs as a JSON string used to be stored and then ignored by everything that read them; they are refused now and point at the legs parameter instead. Closes #1914 * fix(atlas): refuse a bucket list entry that is already on the list Nothing gave a bucket entry an identity, so the same country could be added as often as it was clicked. A wish is now identified by name, country, target date and, where it has them, coordinates. A different target date is a different wish and still lands, which is what the report asked for; two real places sharing a name stay separate because their coordinates differ. Empty string and NULL are normalised on both sides of the comparison, otherwise the dateless case, which is the one that was reported, would slip through. Deliberately no unique index and no migration. better-sqlite3 is synchronous and the server is a single process, so the race an index would guard against cannot happen here, and an index would have needed a destructive dedupe of existing rows first. create_bucket_list_item had no target_date parameter at all, so over MCP the allowed "same place, other date" case was unreachable. It takes one now. The plugin RPC reports the duplicate as bad params instead of letting it surface as an internal error. Closes #1898 * fix(settings): keep a free-form LLM endpoint in admin hands Any account could name the address the server calls, and the guard in front of it deliberately allows loopback and LAN so a self-hosted Ollama works. That is a reasonable trade for whoever runs the instance, because the network is theirs. It is not one for an arbitrary account, which could aim a request from inside that network at a target only it chose and read how the target answered. A free base URL, and the local provider that is one by another name, now come only from an admin controlled source: the addon config, the instance-wide defaults, or an admin's own settings. OpenAI and Anthropic stay available to everyone, because they go to a fixed address with the user's own key. The resolver is where this is enforced, since it is the single point both the booking import and the plugin host pass through, and the only one that also covers values already sitting in the database. The write path refuses as well, so nothing is stored that would never be read. The hint text promised something users no longer have, so it changed with it. Closes #1772 * fix(calendar): span a date-only booking to its end date A DATE event without DTEND is exactly one day per RFC 5545, so a multi-day booking that carries an end date still collapsed onto its first day. It gets an exclusive DTEND now, built the same way the stay branch already builds one. A booking without an end date serialises byte for byte as before. While in here: the stays query joins reservations on the accommodation, and two bookings pointed at the same stay fanned it out into two events sharing one UID. Duplicate UIDs in a feed are undefined behaviour and calendar clients pick one at random. The same "at most one booking per stay" assumption sat in the accommodations service, where it was worse than cosmetic: accommodation_id carries no foreign key, so deleting a stay took only the first booking and left the second pointing at something that no longer existed. Both the sync and the delete walk all of them now. The callers keep reading linkedReservationId; the list is additional. Refs #1869 * fix(vacay): say that the region is required, because it is The placeholder called the region optional while the add button stayed disabled until one was picked. The wording predates multiple calendars per plan, which is what introduced the gate. Only the value of the existing key changed, in all locales, so the key set stays identical. Two things the same screen got wrong were in the way of a clean answer: The button was clickable while the region list was still loading, which put the user in exactly the state the wording describes, and it is the state the report was filed from. It waits for the list now. Changing the country on an existing calendar kept the previous country's regions on screen, so a German region could be picked for the Netherlands. The list is cleared with the country, which only works in combination with the loading gate: without it, the empty list would happen to enable the button instead. Closes #1813 * fix(collections): let a saved place's address be corrected The edit form offered name, category and labels, and the address only on the way in. The cause was not the form: the update contract never declared address, so the validation pipe stripped it and the UPDATE had no column for it. Coordinates were pulled through for #1435 and the address was missed. It travels the whole chain now, contract to service to both forms. No migration, the column has always been there. The mobile add sheet had no address input at all, showing whatever the search result carried as read-only, so editing would have worked while creating still would not. It has one. The MCP tool description had drifted further than the address, never having mentioned the coordinates either. Both are in it now. Closes #1870 * fix(collections): keep the place search usable after the first save The add dialog stays open on purpose so several places can be added in a row, but after a save it gave no way back into the search. A search with no results was silent, with no empty state and no toast, so typing another name and pressing enter looked like nothing happened. The reporter described both halves and it is the silent search that matches "nothing happens" most closely. There is an empty state now, using a key that already existed in every locale and was unused. The search row is sticky inside the dialog body, so it stays reachable after the save instead of sitting above the scroll position. Also fixed while in here: refreshing the collection after each add reset the select mode, the selection and the label filter. In the very flow this dialog is built for, the user quietly lost all three. Closes #1921 * fix(vacay): make the phone year grid and the dock button do what they look like Two separate faults met on this screen. Tapping a day in the year grid did nothing unless the edit mode was already on, and the only way into it was a floating button that looks exactly like the one the dock draws in the same spot. A tap now opens that month in the editor, where the cells are big enough to hit. At 390px the grid cells are around 21px, which is too small to be mutating data with in the first place. The dock's plus was not wired for this route, so it fell through to creating a trip on the dashboard. Two different actions were stacked in one place, and the wrong one was on top whenever the screen had not painted yet, which includes the time its chunk is still loading. The dock leaves the slot to the screen now, and holds the geometry so the tab groups stay symmetric. Closes #1811 * fix(budget): settle in whole cents so balances stop drifting The report is a balance that moves on its own, with nothing added, edited or removed, on a trip where everything is in euro. Two mechanisms were behind it and both are real. The display currency is a fourth value, a per-user setting, so "everything is in euro" never covered it. Each balance was converted and rounded on its own, and the set no longer summed to zero: at 0.855 and 0.9312 it came out one cent over, at 0.94 it came out even. That cent appears and disappears with the six hour rate cache alone, which is exactly the symptom. The flows were rounded separately from the balances, so the two never had to agree. And a receipt line nobody was ticked for counted toward the total, and therefore toward the payer's credit, while landing in no share. That difference is permanent, and the client sent it that way. The settlement converts once, at the edge, and does integer arithmetic after that. Equal splits distribute the credited cents by largest remainder rather than the entered total, so credits and debits of one expense cancel exactly even in a foreign currency. Display conversion goes through the same largest-remainder allocation, so the sum survives it. With that, the 0.01 epsilon can go. It could never create a cent, but it stranded them: a one cent balance was filtered out of the flows while staying visible in the list, which is the "settle up offers nothing" half of the report. Closes #1382 * fix(journey): reach the book export and the suggestion toggle on a phone Below 1024px the hero card is dropped, and it held the only way to either action. The floating bar that replaces it was never given them. It has them now, and the hero is unmounted rather than hidden, so there is no second invisible copy of the same controls in the document. The bar's own buttons moved onto the appearance tokens while they were being touched. The phone screen never had either action at all and now carries both. The book itself was hardwired to English, cover and dates included, while the keys for it had been sitting in every locale unused. It takes the page's translator and locale, sets the document language, and prints mood and weather, which were on screen but never in the book. Closes #1848 * fix(journey): offer the connected photo providers in the phone entry editor The desktop editor grew an external photo source in #1632; the phone editor that came out of the mobile rewrite never did, so editing an entry on a phone had no way to Immich or Synology. It mirrors the desktop mechanics, including the part that is easy to miss: a save that creates the entry and then fails on the photos keeps the sheet open, and without remembering what was just created the retry creates a second entry. The sheet no longer kicks off its own addon load. The list is loaded once on boot and this only reacts to it; a second load races the other consumers and overwrites the store when it lands. Closes #1808 * fix(mobile): let the document scroll so Safari can collapse its URL bar iOS Safari only shrinks its address bar when the document scrolls, and TREK's never did: the root was locked and the mobile shell put a scroll container inside it. On the bottom tab layout that costs about a sixth of the viewport, permanently. Below 768px the document is the scroller again and the full-bleed screens measure their own height instead of leaning on the shell. That makes the body scroll locks real for the first time on a phone, and they were not ready for it. Three of them reset the overflow unconditionally, one of those on every run of its effect rather than on unmount, so a system notice could hand the page back while a sheet was still open. They all go through one reference counted lock now, which is the part that had to land first. Worth knowing for the issue: this reaches the flow screens. The trip planner, the journal, the atlas and the vacay screen keep their own full-height scrollers and still will not collapse the bar. Closes #1809 * fix(mobile): keep the screen gradient visible behind the translucent cards The gradient layer introduced with the scroll change sat at z-index -10. A negative layer paints above the canvas but below the backgrounds of ordinary blocks, and body carries an opaque one, so the gradient was hidden behind it. The mobile cards are translucent and take their depth from what is behind them, so every surface ended up compositing against a single flat colour and the whole phone UI read as one tone. The layer is positioned at z-index 0 now and the content above it at 10, which puts both over body's background. Same visual as before the scroll change, and the shell still owns no scroll container. * test(reservations): teach the accommodation delete stub about the id lists The RPC walks every linked booking since the delete stopped stopping at the first one. The stub still answered with the two singular fields, so the loop had nothing to iterate and the cascade events never fired. * fix(settings): move the free-form LLM endpoint out of user settings entirely Hiding it from non-admins closed the hole, but it left the option sitting in the admin's own personal settings, which is not what was asked for and not where it belongs: an instance has exactly one address it calls out to, and there was a second, invisible place to set it. The provider list is now the two hosted ones for everybody, the endpoint field is gone, and the resolver takes the address from the admin-controlled instance defaults for every caller including an admin. It no longer reads the users table at all. The write path refuses the keys for everyone, so nothing can be stored that would never be read. The endpoint is configured on the addon in the admin settings, which already carries provider, model, base URL and key, plus the Ollama model list. Nothing is lost, it just has one home now. Behaviour change worth a release note: an admin who set a personal Ollama endpoint has to move it to the addon config. A non-admin was already in that position after the previous commit. Refs #1772 * fix(journey): make the book preview usable on a phone The preview document carried no viewport, so a phone laid it out at its default 980px while the page is A4 landscape and about 1123px wide. It spilled out of the frame, which reads as being zoomed far in. Declaring the real width lets the browser scale the page to fit. Printing is unaffected, it goes by @page. The preview chrome had the same problem in miniature: a title and two labels on one row, sized inline, which does not fit a phone and fits translated labels even less. It moved to a stylesheet, and below 640px the card goes full-bleed, the decorative title steps aside and the two actions share the width. Refs #1848 * fix(mobile): stop the shell trapping the screens' own overlays Lifting the background layer into the positioned range meant the content wrapper had to be positioned too, and a positioned wrapper with a z-index is a stacking context. Every fixed overlay a screen renders inside it got clamped to that level: the vacay view/edit FAB sits at z-50 precisely so it beats the dock at z-40, and it disappeared behind it. The layer goes back to a negative z-index and the wrapper back to no positioning at all. What it needed in the first place was for body to stop painting over it, which is one line in the phone media block rather than a new stacking context. * fix(mobile): let the phone background override actually win A media query adds no specificity, so the themed body rule further down the file kept winning on source order and painted over the shell's background layer. The override is on html body now. The gradient was back to being invisible, which is the flat single-tone phone UI again. * fix(vacay): draw today's ring around the day instead of replacing it On the phone, today short-circuited the day-cell matrix and returned a ring on an empty cell. A vacation day or a company holiday logged for today was stored and counted in the totals, but the cell showed nothing, so it read as if the tap had not taken. Today is an annotation now, layered like the school band and the shared-calendar rings, which is how the desktop month card has always treated it. The strong ink stays only where the cell has no fill of its own, since --m-ink is light in dark mode and would disappear on a pastel. * fix(map): stop serving a stale GL style document from the service worker The Workbox rule for Mapbox matched every URL under api.mapbox.com, and the style document lives there too. Under StaleWhileRevalidate the map was built from the previous revision on every load, with the refresh landing one load too late, so a style republished in Studio with different label languages kept rendering the old ones. The network tab showed a 200 throughout, because the service worker's own answer is a real 200, which is why this looked like the app rewriting text-field at runtime. The style now has its own rule ahead of the tile rules, on NetworkFirst so it is current whenever the network is, and still cached so the map opens offline. Its own small cache too: sharing an LRU with three thousand tiles made the staleness come and go at random. OpenFreeMap styles had the same problem and are covered by the same rule. Closes #1924 |
||
|
Maurice
|
6c63a9bb60 |
fix(client): move to react-router 7.18.2 (#1804)
* refactor(client): opt into the v7 router behaviour while still on v6 Turning the behaviour on separately from the version bump keeps the two failure modes apart: red here means a behaviour change, red on the bump means the import rewrite. The suite is unchanged either way — 527 files, 11099 tests. Only the two flags a non-data router understands are set; the rest belong to createBrowserRouter, which this app doesn't use. Both are applied at all six router mounts, so the tests exercise the same behaviour as production rather than validating v6 while prod runs v7. * fix(client): move to react-router 7.18.2 6.30.4 is affected by GHSA-wrjc-x8rr-h8h6 — open redirect through a backslash in Link and useNavigate, which this app uses in 41 places — and the 6.x line has no fix: react-router-dom 6.30.2 to 6.30.4 carries GHSA-jjmj-jmhj-qwj2 with no patched version at all. Staying is not an option, and 7.0 to 7.17 only swaps it for GHSA-chx6-hx7r-mcp5. The package rename comes with it: react-router-dom is a re-export shim in v7, so using it would only defer the same rewrite to the v8 jump. 77 occurrences across 60 files, all of them import specifiers and vi.mock strings. The surface is small — useNavigate, useParams, useSearchParams, useLocation, Routes, Route, Link, Navigate, useMatch, MemoryRouter, BrowserRouter — no data router, no loaders or actions. Nothing else had to change; the future flags from the previous commit are simply how v7 behaves, so they come back out. npm audit still reports GHSA-qwww-vcr4-c8h2 on react-router (RSC mode CSRF, fixed in 8.3.0). It needs RSC mode, which needs a server; this is a static SPA. Closing it means the v8 major, which is its own piece of work. |
||
|
Maurice
|
4f99834965 |
test(admin): stop the plugin sheet test racing its own Escape
MSheet binds the Escape listener in an effect, so a key fired the moment the sheet content appears can land before the listener exists. Under a loaded full-suite run that made the test fail on its own timing. It retries until the sheet is gone rather than pressing once. |
||
|
Maurice
|
9ecca404c5 |
fix(map): drop the retired OpenStreetMap tile subdomains (#1733)
The a/b/c shards stopped being necessary in 2022 and d has since lost its DNS record. The map never asked for d — Leaflet defaults to abc — but the offline prefetcher rotated over a to d, which is where the failing requests came from, and it cached most tiles under a host the map never requests. Presets and the prefetcher use the apex host now. A URL already saved in user_settings is rewritten where it is read and written back, so existing instances heal without a migration touching what someone typed themselves. The CSP only allowed https://*.tile.openstreetmap.org, and a wildcard host never matches the apex domain, so the prefetch fetch would have been blocked. The service worker rule had the same gap and would have stopped filling the tile cache. |
||
|
Maurice
|
72a82b3c44 |
fix(client): work through the findings from the coverage pass
214 items came out of writing the tests. Real defects are corrected, dead code is removed rather than covered, and the tests that pinned the old behaviour move with them. Also drops two agent coverage scratch files that slipped into the coverage PR and adds the ignore rule that keeps them out. |
||
|
Maurice
|
12558fe9c4 | test(mobile): cover admin, settings and the remaining screens | ||
|
Maurice
|
b6a3cced43 |
Comprehensive mobile UI rewrite + desktop Vacay & Journey redesign (#1577)
* 3.3.0 (#1472) * feat(plugins): grow the frame bridge — fill pages, confirm, openExternal, live context - page/trip-page hosts pass fill: the frame pins to 100% height and ignores trek:resize, so a kit plugin's auto height report no longer collapses a full page into a floating island with dead space below (widgets keep self-sizing) - trek:confirm renders the native ConfirmDialog host-side (the sandbox has no allow-modals) and answers trek:confirm:result; one at a time - trek:openExternal opens validated http(s) URLs in a noopener tab — the sandbox has no allow-popups, so plugins simply couldn't link out before - trek:notify accepts an optional duration, clamped to 1.5-15s - context gains dir (rtl/ltr) and is re-pushed when locale or format settings change, not just on appearance mutations - core events for the trip in view are forwarded as trek:event — names only, never payloads, mirroring the server-side events surface * fix(plugins): move trip warnings out of the content area The warning pills overlaid the top of every planner tab at full width, sitting on the map and its toolbar. Now a warning from a plugin that owns a trip-page tab renders as a compact chip in the navbar centre (click jumps to the tab; the navbar centre is free on trip pages), and everything else floats above the content at the bottom instead. Mobile keeps all warnings in the bottom overlay since the desktop navbar isn't there. The trip tab's frame also opts into the new fill mode. * feat(plugin-sdk): 1.4.0 — motion library + new bridge helpers in the kit Mirrors the host's animation vocabulary 1:1 into TREK_UI_CSS (menu/popover/ modal/backdrop/toast enters, drawer variant under 640px, page-enter, stagger, skeleton shimmer, chart reveals) including the reduced-motion degrade to a gentle fade. window.trek grows confirm(), openExternal(), onEvent() and a notify duration, and applyContext now stamps lang/dir on the document so RTL hosts get RTL plugin UIs. * feat(plugins): surface registry download counts in browse The registry now aggregates GitHub release download counts per plugin (TREK-Plugins#18) as an entry-level downloadCount. Project it through browse/detail and show it as a compact stat on the browse cards and in the detail meta grid. Counts are raw asset downloads (updates and CI included), so the UI says downloads, not installs. * docs(plugins): document the grown bridge surface and motion classes * fix(plugins): harden the new bridge paths Review pass over the bridge additions: - keep the unstable useToast() object out of the effect deps (ref instead) — it re-created the effect on every parent render, and with the new live repost that meant a trek:context flood into the frame - reset loads/height/confirm state and key the iframe when a host swaps pluginId in place (tab bar, /plugins/:id) — the new plugin's document was refused as a 'navigated' frame and every kit promise hung - confirm dialogs always lead with the host-controlled plugin name so a plugin can't dress its dialog up as a TREK system prompt; answer/refuse moved out of setState updaters (StrictMode ran them twice) - Number.isFinite on the notify duration (NaN parked a sticky toast) - don't forward other plugins' namespaced broadcasts as trek:event; a plugin's own plugin:{id}:* broadcasts now reach its frame though - teach the SDK dev preview the confirm/openExternal contract so trek.confirm() resolves in /preview - 999,950 downloads formats as 1M, not 1000k * fix(planner): let plugin warning chips grow wider before truncating The nav-centre chip capped at 340px, so a longer warning (e.g. the TREK x Japan weather prompt) was ellipsised almost immediately. Scale it with the viewport up to 520px so most messages read in full while still yielding on narrow desktops. * feat(plugins): sort the plugin browser by download count Discover now honours the sort dropdown (it was always alphabetical) and adds a 'Most downloads' option that ranks the registry by downloadCount. The sort keys are scoped per tab — updates-first stays with Installed, most-downloads with Discover — and snap back to name when the tab can't offer them. * feat(plugin-sdk): auto-upgrade native <select> to a host-styled dropdown A sandboxed plugin can't reach the host's components, and a native <select> draws its popup from the OS — so plugin dropdowns never matched TREK. The design kit now enhances every <select> into a keyboard-accessible listbox that uses the kit tokens, keeping the real element as the value/form source (it still fires change). Authors write a plain <select> and get the host look for free; opt a field out with data-trek-native. validate warns when a plugin ships a <select> without inlining the kit. * feat(plugins): add issue url link * feat(plugins): reservations write + cross-trip reads - db:write:reservations -> reservations.create/update/delete, gated exactly like the REST/MCP path (reservation_edit + trip membership, acting user host-bound, no impersonation) and delegating to ReservationsService so the accommodation, budget-sync, booking-notification and reservation:* broadcasts match the web app 1:1 — a booking/flight/import plugin can finally write a reservation - trips.listMine / reservations.listMine: enumerate every trip and booking the acting user can access (membership baked into listTrips, never a raw cross-tenant SELECT) — dashboards/aggregates were impossible before - audit: derive auditability from METHOD_PERMISSION so a new capability method can't be added un-audited by omission - typed ctx.reservations.* / ctx.trips.listMine, perm label (en/de), wiki * feat(plugins): read scopes for journal, atlas, vacay and day notes - db:read:journal / db:read:atlas / db:read:vacay expose the acting user's OWN journals / visited countries+regions / vacation plan across all their trips (user-scoped like costs.listMine, each gated on its addon being enabled), reusing the addon's existing readers - db:read:daynotes -> daynotes.list(tripId, dayId), trip-scoped and membership-checked like the other trip reads - typed ctx.journal / atlas / vacay / daynotes, perm labels (en/de), wiki, audit resource labels, tests * feat(plugins): day notes write scope - db:write:daynotes -> daynotes.create/update/delete, gated under the app's 'day_edit' permission (like days) with the day verified to belong to the trip; reuses dayNoteService and broadcasts the same dayNote:* events so open sessions update live - typed ctx.daynotes.create/update/delete, perm label (en/de), wiki, tests * feat(plugins): run declared background jobs on a schedule - plugins already declared jobs {id, schedule} but the cron was never wired. The host now schedules them: host-entry reports each job's schedule, the supervisor starts the jobs (node-cron) when the plugin goes active and stops them on kill/deactivate so nothing leaks - opt-in via a new jobs:run permission — scheduled work runs with NO acting user (its trip reads stay refused; it can only use ctx.db and declared egress), so background execution is a distinct, admin-granted capability. Invalid crons are skipped and a throwing job can't break the host - extracted a small, unit-tested scheduler (plugin-jobs.ts); perm label (en/de), wiki, tests * feat(plugins): read scope for saved-place collections - db:read:collections -> collections.listMine() / collections.get(id): the acting user's own collections (user-scoped, gated on the Collections addon), reusing collectionsService - typed ctx.collections, perm label (en/de), wiki, audit resource labels, tests * fix(plugins): translate new permission labels to all locales + cover the new wiring - add the 8 new admin.plugins.perm.* labels (reservations/day-notes writes, the journal/atlas/vacay/day-notes/collections reads and jobs:run) to the remaining 20 locales so the strict i18n key-parity test passes again - cover the create-rpc-host reservation / day-note / cross-trip / addon-read deps (the real side-effect wiring the mocked rpc-host tests don't exercise) so the src/nest 80% branch-coverage gate holds * feat(plugins): dev-link — hot-reload a local plugin against real data Answers a plugin developer's ask: today you either get `trek-plugin-sdk dev` (fast hot-reload but MOCK/fixture data) or the full build->pack->upload->activate cycle (real data, no watcher). Neither gives "local dir + hot-reload + real data". - POST /admin/plugins/link registers a plugin from a LOCAL built directory by symlinking it into the plugins volume — the loader already forks the resolved real path, so ZERO loader change — and registering it INACTIVE as `local:link`. Validates the manifest + refuses native binaries exactly like a sideload. - POST /admin/plugins/:id/reload re-forks a linked plugin via the existing deactivate->activate primitive (same grants, no re-consent unless the manifest widened perms). A best-effort fs.watch auto-reloads on rebuild. - It runs through the UNCHANGED capability RPC host: real, membership-gated data, acting user host-bound, no impersonation — code origin never touches the gate. - Gated behind TREK_PLUGINS_DEV_LINK on top of admin + kill-switch, because a linked plugin bypasses the install-time signature model and, under `npm run dev`, the OS jail is off. Off by default; never reachable in production. - discovery follows a symlinked <root>/<id>; uninstall/link never delete the author's source (link-safe removal for POSIX symlinks and Windows junctions). * docs(plugins): document the dev-link real-data hot-reload workflow Adds a "Test against a real instance's data (dev-link)" subsection next to the mock-data SDK preview: TREK_PLUGINS_DEV_LINK, POST /link with a local built dir, activate + consent, hot-reload via the file-watch / POST /:id/reload / Restart, and the dev-only security caveats. * feat(plugins): dev-link admin UI - surface devLink (TREK_PLUGINS_DEV_LINK) in GET /admin/plugins so the panel shows the link form only where dev-link is enabled - AdminPluginsPanel: a "Link a local plugin" form (path -> POST /link), a Dev-Link badge for source_repo=local:link, and adminApi.pluginLink/pluginReload - fix: the plugin menu treated any non-local:upload source_repo as a GitHub repo, so a dev-linked plugin rendered github.com/local:link links — exclude local:link - labels for the 6 new dev-link UI strings across all 22 locales * docs(plugins): document the dev-link admin UI The dev-link section showed only the curl call — surface the Admin → Plugins "Link a local plugin" field (the primary path) and the Dev-link badge, with curl kept as the scripting alternative. * feat(plugins): enrich core events with { entity, entityId } Subscribed plugins now learn WHICH entity changed, not just the event name — a reservation/place/day/... id derived host-side from an explicit per-family whitelist. Threaded through the six event hops WITHOUT touching actingUserId: the handler still runs with no user, so the id is not dereferenceable (a trip read is still refused; the id says what to react to, not what it contains). A non-entity id can never surface — budget:member-paid-updated yields the itemId, never the userId — and bulk/reorder/sub-entity payloads carry no id. The mapper is pure, synchronous and never throws into the core broadcast. No new permission (reuses events:subscribe); backend-only. * feat(plugins): packing write scope with #858 privacy-scoped broadcasts - db:write:packing -> packing.create/update/delete, gated under the app's 'packing_edit' permission (like the REST path) with the host-bound acting user as owner; reuses packingService - replicates the packing privacy model 1:1 (the controller/service helpers aren't exported): create/delete fan out to the item's viewers only (owner + recipients, or the whole room for a Common item); update runs the four public<->private transitions, dropping a freshly-privatized item from the room BEFORE re-adding it owner-only so it never leaks. A stale write is BAD_PARAMS with no broadcast - typed ctx.packing.create/update/delete, perm label (22 locales), wiki, tests (rpc-host gating + the four transitions + owner-scoped delete) * feat(plugins): tableContributor hook — host-rendered view columns/actions (backend) The registry backend for plugin-contributed columns/actions in the native planner views (the tabular-reservations use case), mirroring placeDetailProvider: - hook:table-contributor + the tableContributor hook (getContributions(view, tripId, ctx) -> TableContribution[]), double-gated (implement + grant) like the other provider hooks - GET /api/view-contributions/:view/:tripId — view whitelist + membership gate + per-provider timeout/fail-safe, plus the hardening the older provider hooks lack: every field is String-coerced + length-capped, kind/tone/target enum-whitelisted, per-provider counts capped (<=20 columns / <=10 actions), and a column url must be http/https/mailto (a javascript:/data: url is click-XSS into the native DOM) - typed pluginsApi.viewContributions + the ViewContribution union, perm label (22 locales), wiki, hardening tests * feat(plugins): render tableContributor columns/actions in the reservations view The frontend for the tableContributor hook: a reusable PluginContributions layer (usePluginViewContributions + PluginColumns/PluginActions) that renders the host-normalized column/action leaves NATIVELY — a column is text/badge/link, an action is a button that calls the plugin route or opens its sandboxed frame in a modal (plugin markup only ever runs inside the opaque-origin iframe). Wired into the reservations cards (both ReservationCard and TransitJourneyCard) as a strictly- additive footer keyed by reservation id: zero change to a card when no plugin contributes. Fetched once per view, fail-safe. * docs(plugins): bring the permissions wikis current with this cycle Plugin-Permissions.md was missing every permission added this cycle — add rows for the read scopes (journal/atlas/vacay/daynotes/collections), the write scopes (reservations/daynotes/packing, packing noting the #858 owner-scoping), jobs:run and hook:table-contributor, and correct the events:subscribe row for the new { entity, entityId } hint. Add the jobs:run row to Plugin-Development.md too. * fix(maps): stop quick one-finger pans zooming the map on mobile (#1440) The global drag-drop-touch polyfill installs document-level touch listeners on phones. On every single-finger touchend it records a timestamp, and if the next touch starts within 500ms it synthesises a dblclick on the target, which the map's default double-click-zoom turns into a zoom-in. Two quick one-finger pans therefore zoomed instead of panning. The polyfill only bridges HTML5 drag-and-drop to touch for planner reordering, which is already disabled on mobile (#1432), so gate its import to viewports >=1024px (the lg breakpoint useIsMobile uses). Removes the phantom-dblclick source on phones while keeping touch DnD on large viewports; fixes both the Leaflet and GL renderers. * fix(feeds): emit TZID + VTIMEZONE so subscribed calendars respect time zones (#1453) exportICS emitted timed DTSTART/DTEND as bare floating times (no Z, no TZID), which iOS/Google Calendar render in the subscriber's local zone instead of the zone TREK shows. Resolve an IANA zone per timed event — transport endpoints use their stored timezone (departure drives DTSTART, arrival drives DTEND), while assignments and hotel/restaurant reservations derive it from place coordinates via tz-lookup — and attach TZID backed by a VTIMEZONE component. The all-trips feed now carries deduped VTIMEZONE blocks so TZID references still resolve. * feat(plugins): render tableContributor contributions in the places + day views Extends the tableContributor frontend to all three planner views: hoist the shared PluginCardFooter into PluginContributions, wire the places sidebar (keyed by place id, rendered as a sibling after each row so the drag/scroll row stays untouched) and the day panel (keyed by day id, guarded for a null day). Strictly additive + fail-safe like the reservations view — nothing renders when no plugin contributes. * fix(vacay): source holiday subdivisions from ISO 3166-2 so all states show The state/region picker for public-holiday calendars was built from the union of each holiday's counties for the current year, so a subdivision only appeared if some holiday that year was tagged with it. States with no state-specific holiday (e.g. US-WA, and AR/FL/NV/WY in 2026) silently vanished, blocking calendar creation (#1456). Source the full, correctly-named subdivision list per country from ISO 3166-2 instead, merged with any nager county code ISO lacks. Only region-partitioned countries get a picker, so nationwide-only countries keep allowing a country-level calendar. No server change needed — selecting a state already yields federal holidays via applyHolidayCalendars. * fix(costs): settlements honor custom per-member splits (#1458) calculateSettlement read each member's custom split amount but its query never selected budget_item_members.amount, so hasCustomSplit was always false and every settlement fell back to the equal split. Select bm.amount so custom amounts drive the balances. Also blank the Overview 'Per Person' / 'Per Person·Day' columns and CSV for custom-split items, where a single averaged figure is meaningless. * feat(plugins): read-convenience + todos + packing bags + tags + roster A wave of small, high-value capabilities: - weather:read (ctx.weather.get) — the host's cached forecast, tenant-free - db:read:categories (ctx.categories.list) — the global place-category list - db:read:tags / db:write:tags (ctx.tags) — the acting user's own tags, ownership re-checked before each write - trips.members (ctx.trips.members) — the trip roster (id + display fields), membership-checked - db:read:todos / db:write:todos (ctx.todos) — a trip's to-dos, gated by the app's packing_edit like the REST path, broadcasts todo:* - packing bags on ctx.packing (listBags/createBag/updateBag/deleteBag/setBagMembers) under db:write:packing — no privacy, plain room broadcasts perm labels (22 locales), both wikis, rpc-host gating + create-rpc-host wiring tests * fix(dashboard): render next-trip boarding pass stats on Safari (#1459) The boarding-pass bar carved its ticket-stub notches with a two-layer radial-gradient mask composited via mask-composite: intersect (and legacy -webkit-mask-composite: source-in). Safari mis-composites that multi-layer path to fully transparent, hiding the entire stats bar while Chrome renders it fine. Split .hero-pass into an outer wrapper (left notch) and a .hero-pass-inner glass panel (right notch), each carrying a single-layer mask so the mask-composite path is never exercised. Renders identically across engines and degrades safely where mask-image is unsupported. * feat(plugins): write scopes for atlas, vacay, journal and collections The write half of the user-scoped addon reads: - db:write:atlas -> ctx.atlas.markCountry/unmarkCountry/markRegion/unmarkRegion + bucket-list create/delete. Every row is the acting user's own (visited_countries/ visited_regions/bucket) — no trip scoping, no cross-tenant surface. Unblocks AirTrail-style two-way sync (#214) - db:write:vacay -> ctx.vacay.toggleEntry/toggleCompanyHoliday. The plan is resolved HOST-SIDE from the acting user's active plan — a plugin can never name another plan, and toggleEntry only toggles the acting user's own PTO day - db:write:journal -> ctx.journal.createEntry/updateEntry/deleteEntry, self-gated by journeyService.canEdit (owner/contributor) against the acting user - db:write:collections -> ctx.collections.create/update/savePlace/copyToTrip/ deletePlace, schema-validated; the service's per-collection role checks (assertAccess 404 / assertCanEdit 403) map onto RESOURCE_FORBIDDEN All addon-gated, userless contexts refused, audited. Perm labels (22 locales), both wikis, gating + wiring tests. * fix(admin): name the Costs add-on consistently in the catalog The budget add-on catalog entry still resolved to 'Budget' while the feature is labeled 'Costs' everywhere else (trip tab, navbar). Align admin.addons.catalog.budget.name with each locale's trip.tabs.budget label. Closes #1464 * feat(plugins): file attach, collab content and gated member-add - db:write:files -> ctx.files.create/createLink/update/softDelete under the app's separate file_upload/file_edit/file_delete rights. Content arrives as bounded base64 (10MB decoded cap, well under the app's 50MB), the extension is validated against the central blocklist BEFORE anything touches disk, and link targets must live on the same trip (findForeignLinkTarget). Broadcasts file:* - db:write:collab -> ctx.collab.createNote/createPoll/votePoll/createMessage under collab_edit + the Collab addon, emitting the same collab:* events as the app; service-reported errors surface as BAD_PARAMS - db:write:members -> ctx.trips.addMember. Adding a member GRANTS TRIP ACCESS, so it is deliberately its own permission behind the app's member_manage right (default: trip owner only) and never bundled with a lower-risk write; the acting user is recorded as the inviter, target must exist, owner/duplicate adds no-op Perm labels (22 locales), both wikis, gating + wiring tests. * fix(maps): honor check-in/out times for hotel bookend legs (#1465) The day route drew the accommodation as the day's start/end whenever the edge stop was a place, ignoring the morningIsSleptHere/eveningIsOvernight provenance already computed by getDayBookendHotels. On a check-in day an airport placed before check-in got a spurious hotel -> airport leg, and on a check-out day a later "home" stop still got a home -> hotel return leg. Add time-aware shouldDrawMorningLeg/shouldDrawEveningLeg helpers: the morning leg is the home-base default on a check-in day but is dropped when the first place is timed before check-in; the evening return leg is off on a check-out day unless the last place is timed at/before check-out. Wire them into the map polyline, the sidebar hotel connectors, and the Google Maps export so all three stay consistent. * feat(plugins): host-mediated notifications and LLM access Two host-owned integration primitives — the plugin supplies intent, the host owns the sensitive part: - notify:send -> ctx.notify.send({title, body, link?, scope, targetId}). Delegates to notificationService.send with a new plugin_notification event (raw title/body carried as passthrough params), so recipient resolution, channel fan-out (bell inbox + email/ntfy/webhook) and per-user preferences all match core 1:1. Recipients are FORCED to the acting user (scope 'user', targetId === uid) or a trip they belong to (scope 'trip'); scope 'admin' refused; the in-app link must be a relative /path (open-redirect-safe). No arbitrary recipient, no impersonation. Users can mute plugin notifications like any other event. - ai:invoke -> ctx.ai.complete(prompt) / ctx.ai.extract(text, jsonSchema). Runs the admin/user-configured provider via resolveLlmConfig + the existing extraction client under the acting user; the host holds the (encrypted) key, the plugin never sees it. Refused when no provider is configured; 20k-char caps. Output is DATA (complete -> {text}, extract -> {results}) and never auto-written, so prompt-injection can't reach a write without the plugin's own gated call. plugin_notification wired through the shared NotificationEventKey + all 22 locales (inbox passthrough + external channels). Perm labels (22 locales), both wikis, gating + wiring tests. * fix(budget): offer every Frankfurter-supported currency (#1470) The cost currency picker was gated by a hardcoded 47-code list, so currencies the app can actually convert (OMR, CRC, UGX, MKD, ALL, and ~115 more) couldn't be selected. Replace CURRENCIES/SYMBOLS with the full set the Frankfurter v2 FX API supports (archived BGN/HRK dropped), unify the dashboard offline fallback onto it, and teach currencyDecimals about the newly reachable zero- and three-decimal currencies. A currenciesWith helper keeps a previously saved (now-archived) selection selectable so it isn't silently wiped. * feat(plugins): tableContributor into the costs, packing and files views Extends the shipped tableContributor hook to three more native views — no new permission, no new attack surface: the same host-normalized, length-capped, url-allowlisted (http/https/mailto), enum-bounded, fail-safe pipeline, just more render sites. - server: add costs/packing/files to the view-contributions whitelist - client: widen the ViewName union + the api view type; render PluginCardFooter keyed by entityId in the budget category table (a colSpan footer row per item), the packing category group (footer after each item row, drag untouched) and the files list (footer after each row) A currency plugin can now drop a converted-amount column onto a cost row, a receipts plugin a 'view receipt' action onto a file, etc. Controller test asserts the three new views are accepted; both wikis updated. * fix(pdf): repeat day header on overflowing itinerary export pages (#1471) * feat(plugins): map-marker provider hook — plugins can overlay trip-map markers New declarative provider hook `mapMarkerProvider` (#587 "show bookings on map", the single most-requested contribution class, with zero contribution point until now): - hook:map-marker-provider permission + MapMarkerProvider/MapMarkerContribution SDK types + HOOK_PERMISSION wiring - GET /api/map-markers/:tripId (MapMarkersController) mirrors the view-contributions hardening: membership-gated, providers invoked host->plugin on a 5s timeout, fail-safe. Every field normalized server-side — coordinates range-checked (-90..90 / -180..180), strings String-coerced + length-capped, icon/tone enum- whitelisted, popup url http/https/mailto only (a javascript:/data: url would be click-XSS), marker count capped at 200 per plugin - client: PluginMapMarkers layer renders the markers as plain Leaflet Marker+Popup inside the trip map; plugin JS NEVER runs on the map canvas, every value is host-vetted data. Threaded tripId through MapView; fail-safe fetch Declarative-only by design, mirroring placeDetailProvider/tableContributor. Perm label (22 locales), controller hardening test, both wikis. * feat(plugins): show page plugins in the mobile bottom nav Page plugins were reachable from the desktop nav pill (Navbar) but not the mobile tab bar — you had to type /plugins/:id. BottomNav now reads page plugins from the plugin store and appends them the same way global addons are, mirroring Navbar. One-file client nav wiring; no new capability surface. * feat(plugins): per-user plugin settings form + ctx.settings runtime read Users can now enter their own per-plugin config (an API key, a preference) — the prerequisite for almost every real integration, previously unreachable (scope:'user' settings were only listed read-only in the admin panel). - migration: plugin_user_config (plugin_id, user_id, config JSON) — each user's own values, separate from the admin-owned instance plugins.config - PluginsService.getUserConfig / updateUserConfig / getUserConfigDecrypted + readUserSettingDecrypted: secrets encrypted at rest (apiKeyCrypto), masked to the client, an unchanged secret (the mask) keeps its stored ciphertext, and only DECLARED scope:'user' keys are ever stored - GET/POST /api/plugin-settings/:id (PluginUserSettingsController) — its own user-gated path (not the admin surface, not the /:id/* proxy), JwtAuthGuard only, scoped to the acting user - runtime: ctx.settings.get(key) -> the acting user's decrypted value (unconditional RPC, not sensitive cross-tenant; userless job/onLoad gets undefined) - client: a Plugins tab in Settings host-renders each active plugin's scope:'user' fields as an editable form (secrets write-only), reusing the declarative field shape — no plugin markup executes i18n (22 locales), wiki, rpc-host + service + masking/encryption tests. * fix(journey): keep skeleton suggestions in sync with linked trip places (#1473) Journey skeleton suggestions mirror a linked trip's day-assigned places, but sync relied on scattered per-event hooks that several assignment mutation paths never called: unassign, move and time-change fired nothing, no remove-on-unassign capability existed, and every MCP assignment tool synced nothing. Skeletons drifted from the trip. Add an idempotent reconcileTripSkeletons(tripId) that re-mirrors the trip's day-assigned places onto every linked journey (add missing skeletons, refresh date/time/location on move, remove skeletons for unassigned places; filled entries are detached + noted, never destroyed). Call it from every REST assignment handler and MCP assignment tool, and fire onPlaceDeleted on single MCP delete_place for parity. Extract a shared insertSkeletonEntry helper. * fix(memories): drop hidden Immich assets so Live Photo motion parts don't show a broken thumbnail (#1474) * fix(transit): anchor arrive-by search time to the destination timezone (#1479) * feat(plugins): host-brokered OAuth client + trustworthy inbound webhooks Two integration primitives where the host owns the sensitive part. Trustworthy webhooks: - auth:false routes now receive req.headers, but ONLY an explicit, credential-free allowlist (the common provider signature/event headers — stripe-signature, x-hub-signature-256, svix-*, x-gitlab-event, …). Cookie/Authorization/X-Socket-Id and every session/forwarded-auth header are stripped; authenticated routes get {}. A plugin can finally verify a provider signature without any way to leak a session. Host-brokered outbound OAuth (oauth:client): - the HOST runs the whole flow — authorize -> callback -> token exchange -> refresh — with PKCE + single-use, user-bound, TTL'd state, and HOLDS the tokens. The client secret + refresh token never leave the host; the plugin only triggers connect and reads a short-lived access token via ctx.oauth.getAccessToken() for the acting user. - provider config (authorize/token url + scopes + client id/secret) is the plugin's admin-owned instance settings; endpoints must be https (SSRF backstop, private/local hosts refused). Tokens per-user + encrypted at rest (apiKeyCrypto). - GET/POST /api/plugin-oauth/:id/{status,connect,callback,disconnect} — JwtAuth-gated, the callback always redirects to an in-app /settings path (never leaks an error). - Settings -> Plugins gains a Connect/Disconnect control per configured plugin. migration: plugin_oauth_tokens + plugin_oauth_state. Perm labels + form strings (22 locales), both wikis, service (PKCE/state/exchange/refresh/encrypt) + controller + proxy header-allowlist + rpc-host gating + create-rpc-host wiring tests. * fix(navbar): re-measure sliding tab pill after font load and resize (#1481) The active tab pill was measured once in a layout effect keyed only on activeTab, so on a hard reload it captured the active (bold) label's width against fallback-font metrics and never re-ran when the web font swapped in, leaving the pill slightly offset. Re-measure after document.fonts.ready resolves and on ResizeObserver changes (container + active button), with an idempotent state update to avoid redundant renders. * fix(collections): keep the Add-place button reachable after the first save On a wide/desktop layout the collection toolbar (which hosts the Add button) was gated on !mapOverlay, so it unmounted as soon as the list gained its first place with coordinates — leaving only an easy-to-miss "+" in the map overlay. Keep the toolbar rendered whenever the user can add a place, and drop the now-redundant map-overlay Add button so there is a single, predictable Add affordance in every state. Fixes #1485 * feat(plugins): days + accommodations reads/writes, endpoints on the reservation write path Community feedback on the 3.2.1 plugin surface: a plugin could write days but never list them (no way to learn day ids), day_accommodations had no surface at all, and trips.getReservations was the one reservation read that dropped the endpoints/day_positions hydration. - trips.getDays / trips.getAccommodations under db:read:trips (tripRead gate), wired to the same dayService lists the REST GETs use - trips.getReservations now returns the hydrated REST-parity list (endpoints, day_positions, joins, normalized accommodation_id) - strict superset - new db:write:accommodations scope: ctx.accommodations create/update/delete gated by day_edit like the accommodations REST path, with the partner-hotel reservation + delete cascade and broadcasts intact - reservation create/update pin the endpoints shape up front (BadParams instead of a mid-transaction NOT-NULL or a silently dropped row) - perm label in all 22 locales, consent PERM_KEYS, wiki tables * feat(plugins): day-detail widget slot in the day panel Widgets can now mount inside the trip planner's day panel (capabilities.widget.slot: 'day-detail'), scoped to the open day via a dayId in trek:context - the same pattern as the place-detail slot. Covers the requested per-day plugin content (logistics, outfit planning, live flight status) without a new plugin type. Day-detail widgets stay off the dashboard, the consent panel labels the slot in all 22 locales. * feat(plugins): let the frame CSP serve a plugin's own static assets The sandboxed frame runs at an opaque origin, so script-src 'self' never matched and a plugin's own <script src>/<link> files were blocked - authors had to inline entire React builds into index.html. Add a scheme-less host-source pinned to the plugin's own /plugin-frame/<id>/ path (charset-checked Host + plugin id so a stray token can't widen the policy; malformed Host falls back to inline-only). Multi-file client builds now load as-is; remote hosts stay blocked, so script URLs remain useless as an egress channel. * fix(plugin-sdk): catch the package up to the server capability surface The npm SDK's validator still knew only the 3.2.1 permission set, so 'trek-plugin-sdk validate' (and pack/publish, which run it) hard-rejected any manifest using the newer scopes - db:write:reservations, notify:send, hook:map-marker-provider and 25 more. Sync KNOWN_PERMISSIONS with the server envelope (48 entries), mirror the full PluginContext (reservations, accommodations, notify/ai/oauth/settings, packing writes + bags, file writes, collab, tags/todos/daynotes/collections/atlas/vacay/journal, weather, categories), type the tableContributor/mapMarkerProvider hooks + the entity/entityId event hint, accept the day-detail widget slot, and extend createMockHost so plugin unit tests can exercise all of it. * feat(plugins): grant-scoped entity snapshots on core events An events:subscribe handler so far learned only WHICH entity changed - useful for cache busting, useless for reacting to content, and the userless handler can't refetch. Now the broadcast tap derives a whitelisted field snapshot of the changed entity and the supervisor attaches it per plugin, only where the granted set holds the family's matching db:read:* permission (trips family -> db:read:trips, budget -> db:read:costs, packing -> db:read:packing, dayNote -> db:read:daynotes, file -> db:read:files). No acting user is ever synthesized. The whitelists are explicit per family, so user ids (owner/paid_by/uploaded_by/ participants/members), trips.feed_token and future migration columns never travel; a private packing item (#858) yields no snapshot at all because its core broadcast is owner-scoped; deletes/reorders/bulk ops carry none. * feat(plugins): pdf-section, atlas-layer and journal-entry provider hooks Three more declarative provider surfaces in the map-marker mould - plugins return data specs, the host normalizes, caps and renders; a slow or failing provider contributes nothing: - hook:pdf-section-provider: sections (title + paragraphs + a simple table) appended to the trip PDF export, escaped into the same HTML/print pipeline as the core content - hook:atlas-layer-provider: per-user country tint layers on the Atlas map (ISO 3166-1 alpha-2 codes only, tone-whitelisted, non-interactive pane so mark/unmark clicks keep working) - hook:journal-entry-provider: extra rows on a journal entry card, gated by the same journey access check as the journal routes + the Journey addon Permission labels in all 22 locales, consent PERM_KEYS, SDK types + manifest validator in both SDK copies, wiki tables, per-controller hardening tests. * feat(plugins): trip-page plugins can replace core planner tabs and pick their spot A trip-page plugin that takes over a core surface (a transit planner superseding Transports, a costs plugin superseding the budget tab) had to sit awkwardly next to the tab it replaces. capabilities.tripPage now names the core tabs to hide while the plugin is active - whitelisted (transports, buchungen, listen, finanzplan, dateien, collab), 'plan' deliberately not replaceable, and the tabs return the moment the plugin is deactivated - plus an optional 0-based position for the plugin's own tab. The feed re-validates the values out of the DB blob so a hand-edited row can't hide anything else, the admin list chips a replacing plugin (all 22 locales), and a saved session tab that got replaced falls back to the plan view. Also fixes the plugins feed dropping the day-detail widget slot to 'sidebar', which would have mounted a day-panel widget on the dashboard. * fix(plugins): audit follow-ups — normalization, secret cleanup, cron leak, slot filter Adversarial audit of the whole plugin PR surfaced 12 confirmed issues; this addresses them: - place-details provider was the ONE hook controller with no normalization: a plugin's href/label/value went to the client raw and unbounded. Now normalized like journal-entry-rows (safeUrl http/https/mailto, length + count caps). - trip-warnings capped message length + per-provider count (was unbounded). - uninstall(deleteData) now also purges plugin_user_config, plugin_oauth_tokens, plugin_oauth_state, plugin_meta_migrations and the capability audit — encrypted per-user API keys + OAuth refresh tokens no longer survive a 'delete all data' and get silently re-adopted on a same-id reinstall. - supervisor: a crash-restart cycle leaked the dead child's node-cron tasks and re-scheduled fresh ones, so a job fired N+1 times per tick after N crashes. onExit now stops them, mirroring kill(). - dashboard sidebar no longer mounts place-detail/day-detail widgets (they belong in the planner panels). - reservation endpoint validation relaxed to match the 3.2.1 service: a coord-less endpoint is accepted and dropped downstream instead of BadParams (no breaking change), while a bad role/non-string still rejects up front. - a replaced core tab reached by programmatic nav now falls back to the plan view. - trips.update caps title/description like the places path; plugin-db guard bans load_extension as defense-in-depth. - wiki: event snapshots, string-typed context ids, dayId in the payload, the live provider hooks and the costs update/delete grant are now documented correctly. * feat(plugins): phase-0 lifecycle hardening + per-plugin RPC rate limit Operational-readiness fixes from the completeness audit: - Re-activation after a failure worked again: a plugin left in 'error' state by a load-failure or crash-auto-disable stayed in the running map, so the admin's 'enable' button was a silent no-op. activate() now replaces a dead entry. - Per-plugin RPC rate limit at the dispatch boundary: every ctx.* call runs synchronously on the host thread, so a plugin in a tight loop could freeze the whole instance (and the reap sweep). A token bucket (generous burst) + an in-flight cap now throttle a runaway plugin with a retryable HOST_ERROR; a legitimate plugin never notices. - plugin_error_log retention (500 rows/plugin) so a crash-looper can't grow trek.db without bound; the crash-timestamp array is trimmed to its window too. - TREK_PLUGIN_PERMISSIONS=off now logs a loud one-time warning that the OS permission jail is disabled. * feat(plugins): read symmetry + broker — collab/journal/atlas reads, file content, trip create, rates The plugin API leaned write-heavy: collab and journal could be written but not read, files listed but not read, and there was no way to create a trip or see exchange rates. This closes those gaps in the established RPC+gate pattern (zero architecture risk), and it's what unlocks the importer + finance plugin classes: - collab reads: ctx.collab.listNotes/listPolls/listMessages under a new db:read:collab (membership + Collab addon, like the REST GETs) - ctx.journal.getEntries(journeyId): a journey's entries, journey-access-checked, under the existing db:read:journal - ctx.atlas.bucketList(): the acting user's bucket list, under db:read:atlas - ctx.files.getContent(tripId, fileId): a file's bytes as base64 under a NEW db:read:files:content grant (reading a passport scan is more sensitive than its filename), size-capped at 10MB before it crosses the IPC pipe, trashed files refused - ctx.trips.create(input): a new trip owned by the acting user, gated by the app's trip_create right + a bound user — the capability importers need - ctx.rates.get(base): cached currency exchange rates, tenant-free like weather Also caps trips.update title/description like the places path, and the plugin-db guard now bans load_extension (defense-in-depth). SDK, mock-host, i18n (22 locales), consent labels and the wikis are all in lockstep. * feat(plugins): deeper integration + user-facing activity transparency Wave 2 of the completeness work — richer extension points, deeper metadata, and the transparency that makes the broad read grants accountable: - db:meta now attaches to reservations + accommodations too (not just trip/place/day), gated by reservation_edit / day_edit respectively — the natural home for an external-id mapping (AirTrail/calendar/booking-import sync) without forking the core schema. - reservation-detail widget slot: a widget can mount on a booking card, scoped to the open reservation via reservationId in trek:context (the place-detail / day-detail pattern, third instance). - tableContributor gains the transports + todos views, so a plugin can add host-rendered columns/actions there too. - User activity log: GET /api/plugin-activity + a Settings → Plugins panel showing every host-mediated action a plugin took bound to the signed-in user, across all plugins, newest first — the user-facing half of the hash-chained audit. This is what legitimizes the deliberately broad read grants: not just the admin, the person whose data is read can see what was done in their name. - DX: the local dev server now binds a default acting user, so the canonical ctx.trips.getPlaces(tripId) call works locally instead of failing RESOURCE_ FORBIDDEN; the create scaffold drops the dead manifest routes[] / capabilities.nav fields the host ignores. SDK, i18n (22 locales), consent labels and the wikis are all in lockstep. * fix(memories): load Immich album photos on Immich v3 Immich v3 removed the `assets` property from AlbumResponseDto, so `GET /api/albums/:id` no longer carries album contents. TREK read album photos from that property, which now parses as undefined and degrades to an empty array — hence "No photos yet" in the Journey gallery picker even though the album header shows the right count (that count comes from `GET /api/albums` -> assetCount, which v3 still returns). Two call sites read the removed property. Besides getAlbumPhotos (the reported bug), syncAlbumAssets failed silently on v3: it reported `success: true, added: 0` while syncing nothing. Fetch album contents via an `albumIds`-filtered `POST /api/search/metadata` when `assets` is absent, and feature-detect rather than probe a version. The two paths are not interchangeable: on v2, searchMetadata unconditionally scopes results to `[self, ...partners]` (`asset.ownerId = ANY(userIds)`), so an albumIds search against an album shared by a non-partner returns nothing. v3 added an albumIds branch that checks AlbumRead and skips that owner filter. v2 also hard-defaults `visibility` to `timeline`, dropping archived assets. So v2 must keep reading the album detail body, which this preserves exactly. `withExif: true` is required on the search path: it has no default and gates an inner join, so without it Immich omits `exifInfo` entirely and every photo's city/country goes null. The existing test mock returned an album detail body *with* `assets` — it encoded the v2 assumption, which is why this shipped green. It now models v3 by default, with explicit v2 coverage asserting no search call is made. Fixes #1492 * feat(plugins): daily AI/notify budgets, runtime scheduler & reliable event redelivery Per-plugin daily caps on ai.complete/ai.extract and notify.send (defaults 200 / 100, overridable via TREK_PLUGIN_AI_PER_DAY / TREK_PLUGIN_NOTIFY_PER_DAY), seeded from the capability audit so a mid-day restart resumes the count instead of resetting it. Surfaced at GET /plugins/:id/budget. ctx.scheduler (at / in / every / cancel): persistent, userless timers that survive restarts and fire a scheduled() handler, riding the existing jobs:run grant so no new consent or admin setup is needed. Backed by plugin_scheduled_tasks, swept every 30s, capped at 100 tasks/plugin with an 8 KB payload and a 60s recurring floor; rows are removed on uninstall. Core events that fire while a subscriber is mid-restart are now held in a bounded in-memory buffer (200/plugin, 15 min TTL) and replayed once it goes active again, with the events:subscribe grant and snapshot gating re-evaluated at replay time so nothing leaks if a grant was revoked while the plugin was down. * feat(plugins): GDPR data-subject rights — durable per-plugin erasure + export New hook:user-data grant with two userless lifecycle handlers a plugin can put on its definition: deleteUserData and exportUserData. Neither carries an acting user — the plugin only learns the userId and touches its own db — so the grant reads nothing from core data; it exists purely so a plugin can honour a GDPR erasure or data-access request. When a TREK account is deleted (admin or self-service), every installed plugin holding the grant gets a row in a new durable erasure queue and its deleteUserData runs on the next sweep, retried until it ACKs — so erasure survives the plugin being offline or the server restarting. The core deletion path notifies the runtime through a dependency-free relay (like the event sink), keeping the auth/admin services decoupled from the plugins layer, and a plugin bookkeeping error can never fail the account deletion. Portability is served by GET /api/admin/plugins/user-data/:userId/export, which fans exportUserData out to the active granted plugins and aggregates what each holds about the user. Queue rows are purged on uninstall; the grant is labelled in all 22 locales. * feat(plugins): atomic ctx.db.tx for consistent multi-write on a plugin's own db Plugins could already query/exec/migrate their own SQLite file, but a multi-step write (move an item between tables, decrement one row and increment another) had no way to be atomic. db.tx([{sql, args?}, …]) runs up to 100 statements in a single transaction — all commit or all roll back — and reads within the batch see its own earlier writes, so read-modify-write is safe. Each op is one statement: a read returns { rows }, a write { changes }. The same guard (no ATTACH/PRAGMA/ RECURSIVE, size + row caps) applies to every statement in the batch. * fix(memories): filter hidden Immich assets at the source, not just the picker #1474 has the same root cause as #1492: the Immich v3 migration. On v2, searchAssetBuilder hard-defaulted metadata search to `timeline` visibility (`visibility = options.visibility ?? Timeline`), so hidden Live Photo motion parts could never come back from a search. v3 defaults to any visibility except `locked`, so they do — which is why the reporter is on Immich 3.0.1 and why the bug never appeared before. Ask for `visibility: 'timeline'` explicitly on the search path. That restores v2 semantics on both versions and stops hidden assets crossing the wire, which also fixes a pagination wart: a full page half-made of motion parts previously rendered as a half-empty page, because hasMore counts the raw page length while the filter shrinks the rendered set. The client-side filter was display-only, applied in searchPhotos and getAlbumPhotos — both picker-listing paths. Nothing guarded persistence or rendering: getOrCreateTrekPhoto stores any id it is handed, pipeAsset forwards Immich's 400/404 verbatim, and the photo grid is a plain <img> with no onError. So syncAlbumAssets, which filtered `type === 'IMAGE'` only, could persist a hidden IMAGE as a permanently broken tile. It now applies the same guard, extracted as isVisibleAsset(). Albums keep their filter rather than requesting `timeline` visibility: albums legitimately contain archived assets, and both the v2 album body and the v3 album search return them. Does not address tiles already persisted before this — those still render broken and need a separate fix. Refs #1474 * docs(memories): correct Immich version boundaries in the hidden-asset comments Verified against the v1.120.0 → v3.0.0 OpenAPI specs and server source. The previous comments said "Immich v2 hard-defaulted metadata search to timeline visibility". That is true only for 1.133–1.144. - `visibility` was added in 1.133.0. Before that, searchAssetBuilder applied `.$if(options.isVisible !== undefined, ...)` with no default, so pre-1.133 servers returned hidden assets too. #1474 was therefore not purely a v3 regression. - Those servers strip the `visibility: 'timeline'` filter rather than rejecting it: Immich validates with `whitelist: true` and no `forbidNonWhitelisted`. So the request stays valid, the filter is a no-op, and isVisibleAsset() is the ONLY guard there. Say so, so it does not get removed later as redundant. - `albumIds` only exists from 1.135.0. Because unknown properties are stripped, an albumIds search against an older server would silently drop the album filter and return the entire library as the album's contents. Feature detection on `assets` (present through 1.144.1, absent on v3) makes that unreachable; a version probe with a wrong boundary would not. Also cite Immich's own enum, which documents AssetVisibility.Hidden as "Video part of the LivePhotos and MotionPhotos". Comments only — no behavior change. * feat(plugins): dashboard trip-card badges + a mock-host driver for plugin tests Two additions that round out the plugin platform's breadth and its authoring DX. tripCardProvider hook (hook:trip-card-provider): a plugin returns small declarative badges for the dashboard trip cards. The dashboard fetches all visible cards in one call; the host access-checks every tripId for the acting user, bounds each field (label/value length, enum tone, http/https/mailto-only url), caps the count and drops any badge for a card that wasn't requested — plugin JS never runs on the dashboard. Rendered as text chips under the card meta; labelled + gated in all 22 locales. createMockHost now exposes run(def) — the other half of a plugin unit test. Where the ctx recorders capture what a plugin read, run() fires its own entry points (route, job, scheduled, event, plugin-event, deleteUserData, exportUserData, provider hooks) against the same mock ctx, and host.scheduled surfaces the timers it armed. A handler the plugin didn't declare throws a clear error instead of a silent no-op. * feat(plugins): include plugin data + code in backups, applied on restart A TREK backup archived travel.db + uploads + the encryption key, but each plugin's own SQLite file — the ONLY copy of the user data it holds — and its installed code lived in separate trees that were never captured, so a restore left the plugins rows with no data or code behind them. createBackup now adds plugins-data/ (each plugin's db + WAL sidecars, so SQLite recovers a consistent snapshot) and plugins-code/ (skipping dev-links by realpath, so an author's linked source is never bundled). Restore can't swap those live — the runtime holds each plugin db open — so it STAGES the extracted trees beside the live ones and the runtime swaps them in at the next boot, before it opens anything. Same "applies on restart" model the bundled encryption key already uses: no plugin quiesce, no swap under open handles, no new admin setup. Older archives without the trees restore exactly as before. * fix(plugins): audit — runtime robustness, security & data-lifecycle fixes Fixes from an adversarial audit of the plugin system, host/runtime side: Robustness: - getPluginDataDb recreated a handle a terminal-failure dispose had closed but left cached, so a re-enabled plugin's db:own threw on every call — recreate when the cached handle is shut. - ctx.ws.broadcast* now carry _inv, so the host can bind the acting user (the capability was silently refused, i.e. dead, without it). - ctx.events.emit swallows a rejected emit instead of crashing the child into a terminal 'error'; an uncaught throw AFTER activation is treated as a crash (restart with backoff), not a load failure. - A crash-respawned child gets the same activation deadline as a first activation and the buffered-event queue is cleared on the timeout path, so a hung onLoad after a crash can't peg a core and orphan events forever. - Expired buffered events are pruned by the reaper, not only at flush; the scheduler + erasure sweeps scope their LIMIT window to ACTIVE plugins so a backlog for inactive plugins can't starve deliverable work. Security / integrity: - Unix-domain-socket / named-pipe connects are refused by default in the egress guard (a host-local pivot to docker.sock / DB sockets), under the same policy as private IPs. - db.tx refuses transaction-control statements (a raw COMMIT would break its atomicity) and caps rows across the WHOLE batch, not per statement. - plugin_capability_audit is retention-capped per plugin (chain-safe: retained rows stay self-verifying), so it can't grow unbounded in the shared db. - A cap of 0 in TREK_PLUGIN_AI_PER_DAY / _NOTIFY_PER_DAY now disables the broker instead of falling back to the default. GDPR data lifecycle: - Account deletion now erases host-side per-user plugin tables (config, OAuth tokens/state) and enqueues the own-db erasure from the CORE path, so it works even when the runtime is disabled or pre-boot; guest deletion does the same. - uninstall keeps a pending erasure when data is retained (deleteData=false); erasure delivery is no longer grant-re-checked (a queued erasure is a duty); export flags installed-but-inactive plugins as pending instead of omitting them. Backup/restore: - Plugin DBs are WAL-checkpointed before archiving (no torn/stale snapshots). - Restore applies the staged trees immediately by quiescing the plugins (no unbounded gap where a later unrelated restart would revert diverged data); the swap is content-level (safe on a volume-mounted root) and preserves dev-links; the decompressed-size cap is operator-raisable. * fix(plugins): audit — hook-output hardening, dashboard slot & mock-host parity - Map-marker and atlas-layer tones were validated on String(tone) but emitted raw, so a non-string tone (an object with a matching toString) slipped through and crashed the client that renders it — check the raw value against the enum. - View-contribution column/action caps are now PER ENTITY, not per view, so a plugin's columns no longer vanish from every table row past the first 20; the dashboard trip-card badge cap is per card (≥ one on every visible card). - A reservation-detail widget no longer also renders as a context-free dashboard sidebar card (the inline filter was missing that slot). - mock-host matches the real host: it ignores asUserId on trip reads (bind the acting user), throws on a wrong user-scope notify target instead of coercing, enforces the scheduler caps, and detects RETURNING as a read in db.tx — so a passing author test can't hide a production RESOURCE_FORBIDDEN. * feat(plugins): full ctx parity in the dev server + fire jobs/events/hooks locally The trek-plugin dev server injected only ~6 of the ~35 ctx areas, so any plugin touching ctx.costs/packing/files/notify/ai/settings/scheduler/meta/oauth/db.tx/… hit a TypeError in local dev while the same code passed mock-host tests and worked installed. It also could only exercise routes. Delegate every non-db-own capability to a grant-enforcing mock host (the same one unit tests use) while keeping the real node:sqlite for db:own and dev-native ws capture + logging — so the whole surface works in dev with the exact production permission rules. dev-fixtures.json now takes the createMockHost options shape, so you can seed the full surface. New GET /__dev/fire/<kind>[/<name>][/<fn>] fires a job, scheduled timer, event subscription, GDPR handler or provider hook against the dev ctx, closing the "can't test non-routes locally" gap. * feat(plugins): wire the photoProvider + calendarSource hooks to real core consumers Both hooks were declared, typed and documented but NO core code ever invoked them, so an author could build, mock-test and install a photo or calendar plugin that silently did nothing. Give each a real consumer that fans out to it, exactly like the other eight provider hooks: - GET /api/plugin-photos/search (+ /sources, /item) aggregates photoProvider results for the picker — {id, title?, thumbnailUrl, fullUrl, takenAt?}, thumbnail/full URLs http/https-only (they become <img src>), per-source count capped, failing source skipped. - GET /api/plugin-calendar?start=&end= aggregates calendarSource events for the signed-in user — {id, title, start, end, allDay} ISO, count capped, failing source skipped, sensible default window. Both run with the acting user bound. The SDK interfaces now pass ctx as the last arg (so a source can reach ctx.settings/oauth/http for its backend), and the wiki marks them live instead of "reserved — no core consumer". * feat(plugins): close the create-heavy API asymmetries importers/sync hit Core services implemented these but plugins had no path to them, so the flagship importer/sync integrations hit real walls. Added, each reusing the EXISTING grant (no new consent): - ctx.trips.removeMember(tripId, userId) — reconcile DEPARTURES, not just additions (db:write:members + member_manage). Never removes the owner (that would orphan the trip); ownership transfer stays a separate deliberate action. - ctx.journal.createJourney({title, subtitle?, trip_ids?}) / deleteJourney(journeyId) — an importer can now bootstrap the journal it fills with entries and clean it up (db:write:journal), instead of only appending to journals a human created first. Wired end-to-end (envelope → rpc-host → create-rpc-host reusing tripService/ journeyService → both SDK copies → mock-host) and documented. (trips.delete needs its own destructive permission + consent copy and collab edit/delete + collections.delete remain — tracked as small follow-ups.) * feat(plugins): strip emojis from plugin-rendered text so it matches TREK's lucide UI Plugin authors (especially AI-generated ones) sprinkle emojis into the declarative text TREK renders in its OWN chrome — hook contributions (badges, columns, warnings, PDF sections, map-marker/atlas labels, journal rows, place details, trip-card badges, calendar + photo titles) and notifications — which clashes with TREK's lucide-only icon language. A shared stripEmoji() removes emojis (incl. flag/ZWJ/variation-selector sequences) and tidies the leftover whitespace, applied at the render boundary in every hook-contribution normalizer and in notify.send — so no matter what a plugin returns, the text TREK draws stays emoji-free. It does NOT touch a plugin's own sandboxed /ui frame (the author's to design), and it leaves photo ids verbatim (they round-trip to getById). The validate CLI warns when a manifest name/description contains emojis, nudging authors to the declarative `icon` field (a lucide name) instead. * fix(plugins): harden the restore-apply path — regressions from the backup/dev fix pass A final audit of the fix pass caught three regressions clustered in the two newest surfaces; the restore path could both crash the server and destroy data. - CRITICAL: a restore quiesces plugins via supervisor.shutdownAll() AFTER closeDb(), but shutdownAll killed children without first marking them stopped, so each child 'exit' took the CRASH path and wrote crash-accounting rows into the now-closed core DB — the throw escaped an EventEmitter listener as an uncaughtException and killed the whole process mid-restore. shutdownAll now marks every entry stopped and drops it from `running` BEFORE the kills (so onExit early-returns), and the onStatus/onLog DB hooks are wrapped in try/catch (also covers the stderr→onLog path). This also stops a normal shutdown from logging phantom "crashed" rows. - HIGH: swapContents cleared live entries then MOVED staged ones in, so a crash mid-move permanently deleted a plugin's only data copy (staging was already emptied, so a retry couldn't restore it). It now COPIES each staged entry over the live one and only deletes staging at the very end — `staged` stays the complete source of truth, making the whole operation crash-idempotent. - HIGH: the dev server lost the actingUserId=1 default in the mock-host refactor, so a fresh scaffold refused every user-bound capability. Restored. * fix(plugins): final-audit medium/low findings - GDPR export flags an active plugin whose export errored/timed out as `pending` instead of silently omitting it (collectUserExport now returns a discriminated result), so a data-access export never reads complete while missing data. - Account deletion also enqueues an erasure for plugins UNINSTALLED with retained data (an orphan data dir) — a same-id reinstall now honours the deletion instead of re-adopting the user's data forever. - oauth.getToken returns null in a userless context (matching the SDK/mock contract) instead of throwing RESOURCE_FORBIDDEN a background caller can't handle. - Crash-backoff restart is identity-guarded (+ the timer is tracked and cleared like the activation timer), so a disable + re-enable during the backoff window can no longer respawn a ghost child from the replaced entry. - db.tx transaction-control guard strips leading comments first, so `/* */COMMIT` can't slip past the start-anchored check and break batch atomicity. - createJournal inherits its cover only from a trip that was actually LINKED (access-checked), closing a cross-tenant cover-image read on plugin + REST paths. - trip-warnings drops a null array element instead of losing ALL of that provider's warnings; plugin-activity floors a non-integer ?limit so it can't 500. - The trek-plugin dev server binds loopback only and refuses cross-site requests to its side-effectful /__dev/fire endpoints (it serves real routes + no-auth dev actions). * fix(plugins): clear no-misleading-character-class in the emoji stripper The character class listed the ZWJ, variation selectors and combining keycap marks as members, which eslint reads as an accidental combined grapheme and rejected on CI. Pull the emoji glyphs out into Extended_Pictographic / Regional_Indicator alternatives so only the joiner/selector code points stay in the class, with a scoped disable where the rule still can't tell them apart. While here, reset lastIndex before the /g regex is reused in hasEmoji() so a second call can't resume mid-string and miss a leading emoji. * fix(security): trip-scope note-file deletion and guard the LLM base URL Two reported issues: - deleteNoteFile only matched on the note id and file id, so a member of trip A could delete a file attached to a note in trip B by guessing its id. Thread the trip id through the service and controller and scope the delete to it, the way every other collab operation already does. - The LLM extraction clients fetched the user-configured base URL directly, so a user could point it at the cloud-metadata endpoint (169.254.169.254) and read the echoed error body. Route both clients through a new safeFetchLlm() that blocks the link-local/metadata range while still allowing a local or LAN Ollama (loopback and private ranges stay reachable), pinned to the resolved IP so a hostname can't rebind to the metadata address after the check. * fix(security): route every LLM client through the SSRF guard The base-URL SSRF fix covered the openai-compatible and anthropic clients but missed the native Ollama /api/chat client and the /api/tags + /api/pull model- management calls, whic… * fix(plugins): repair plain-HTTP egress and forward the private-egress opt-out Two pre-existing bugs in the plugin egress guard, found by running a plugin against a real service end to end. 1. Every plain-HTTP request a plugin made was refused, whatever host it had declared. Node pre-normalises `net.connect()` args into an [options, cb] array and passes THAT array as the single argument; undici's plain-HTTP connector takes this path, its TLS connector does not. classifyConnect read `host` off the array, got undefined, and fell back to 'localhost' — so a fetch to a declared, public host was rejected with the nonsense message "localhost is not in the plugin's declared hosts". It failed closed, so it was never a security hole, and it went unnoticed because the only shipped egress plugin uses HTTPS. unwrapConnectArgs() unwraps the normalised form before anything reads host/path. 2. TREK_PLUGIN_ALLOW_PRIVATE_EGRESS could never have any effect. The guard that reads it runs INSIDE the child, whose env is scrubbed to a four-entry whitelist that never included it — so a documented setting (wiki/ Environment-Variables.md) was wired to nothing, and no plugin could reach a self-hoster's LAN service no matter what the operator set. Forwarded only when set, so the default stays the secure block-private policy. Regression tests cover the normalised form in both directions: the real host is now resolved, and an undeclared host, a private IP and a unix socket are all still refused when passed that way. * feat(notifications): let a plugin register a notification channel TREK's four channels (in-app, email, webhook, ntfy) were a closed set: notificationService.send() dispatched with four copy-pasted `if` blocks and no provider abstraction, so a fifth channel meant editing eight files by hand. A plugin could produce a notification via ctx.notify.send(), but never deliver one. A plugin now registers a channel with `hooks.notificationChannel` + `hook:notification-channel` on a plain `type: 'integration'` — not a new manifest type, so the TREK-Plugins registry schema and both its CI gates are untouched. Core refactor - New channel registry (services/notifications/): email/webhook/ntfy become ExternalChannel providers wrapping the EXISTING send functions — no delivery logic is rewritten, only relocated. In-app deliberately stays out: it writes typed rows with scope/target/callbacks, not a rendered title+body, the same line shared/ already draws with i18n/externalNotifications. - The event text is now rendered once per recipient instead of once per channel. - The channel set is open: NotifChannel becomes a string, the matrix is registry-derived, and the UI columns are server-driven. The DB column was already bare TEXT and the Zod contract already a string record — only the TypeScript and the two UIs were ever closed. The hook runs USERLESS. Every other hook is user-initiated, so actingUserId falls out of the request; a notification is host-initiated for an ARBITRARY recipient, so ctx.settings.get() would return undefined. The host resolves the recipient's decrypted scope:'user' settings itself and passes them as an argument. That is what lets a channel plugin be handed someone's push token WITHOUT being handed the right to read their trips as them. Enabling the plugin is the opt-in: a plugin channel is not gated on the admin's `notification_channels` list. A built-in always exists in code and needs an explicit switch; a plugin channel only exists because an admin enabled that plugin. (Nothing could write a `plugin:` id into that CSV anyway, and the admin toggle rebuilt it from three booleans, silently dropping anything else — so requiring a second opt-in meant the channel could never be turned on at all.) Also fixed, found while building this: - Plugin settings keys were unvalidated, so a field named `__proto__` or `constructor` resolved off Object.prototype: a REQUIRED field with such a name reported as configured for every user who had configured nothing — enough, for a channel, to be dispatched to everyone with no credentials. Keys are now constrained at install and the config blob is parsed null-prototype, so it is impossible even for an already-installed plugin. - A `select` field's options were cast straight through, so the obvious `["1","5"]` form rendered every dropdown entry BLANK (the client reads value/label). Now coerced, and malformed options are rejected. Also adds: operator-supplied egress hosts (a plugin talking to a self-hosted service can't name the operator's host at publish time, so an admin adds it post-install and the runtime re-spawns the child with the widened allow-list — only for a plugin that DECLARED operatorEgress, and only an admin, never a user); settings-page actions (a "Test connection" button, user-initiated so ctx.settings.get() returns the clicking user's own value); and a Gotify-shaped notification-channel template in the SDK. Verified end to end against a real Gotify container, not just in tests. * docs(wiki): document the plugin notification-channel surface Covers the pieces added in the previous commits, in the pages a reader would actually reach for: - Plugins.md (the admin-facing page) had none of it: notification channels, settings actions, and a full "Allowed hosts" section — including what operator-supplied egress deliberately does NOT let anyone do. - Plugin-Development.md: the notificationChannel hook (and why it is the one hook with no acting user), settings-page actions, operatorEgress, and the manifest reference rows. - Plugin-Cookbook.md: a "become a notification channel" recipe and a "Test connection button" recipe. - Plugin-Permissions.md: hook:notification-channel, operatorEgress under the outbound section, and settings actions under "not a permission". - Notifications.md: plugin channels alongside the four built-ins. * fix(sdk): allow empty egress if and only if operatorEgress is true * ci: don't run repo-specific workflows on forks Guard release, publish, wiki-deploy and issue/PR-triage workflows with a `github.repository` check so they no-op in forks instead of failing or acting on the fork's own issues, PRs, tags and registries. Also skip the Docker Scout scan for pull requests from forks: Docker Hub secrets are never exposed there, so the login step could not succeed. Tests and lint stay ungated — they need no secrets and are the gate for incoming fork PRs. * feat(sdk): add missing methods in mock-host * fix(airports): rebuild the json file * fix(airports.json): add small airports too * fix(public transit): only show public transit option when a trip has actual dates * fix(plugins): reap a queued erasure only once the plugin's data is gone The orphan reap deleted every queue row whose plugin had left the registry, but uninstall(deleteData=false) removes the plugins row while deliberately keeping the data dir AND the queued erasure so a same-id reinstall can still honour it. The reap now deletes a row only when the plugin's data dir is actually gone; a deleteData=true uninstall already clears the rows itself. * fix(backup): snapshot the core DB and swap restores atomically createBackup archived travel.db via the archiver's lazy live-file read, so a WAL auto-checkpoint firing mid-stream could write a torn database into the zip. It now VACUUM INTOs a point-in-time snapshot and archives that, the same guarantee plugin DBs already get. restoreFromZip swapped the DB by unlink-then-copy, which on an interrupted restore could leave no valid travel.db; it now copies to a temp file and renames it into place (atomic), dropping the stale -wal/-shm sidecars first. * fix(deploy): Recreate strategy for the SQLite volume, pin the root compose image The Helm Deployment had no strategy, so the default RollingUpdate would start a second pod holding the same ReadWriteOnce PVC before the old one exits — a Multi-Attach deadlock or two writers on one SQLite file. Default to Recreate (overridable for ReadWriteMany). The root docker-compose.yml pinned trek:dev, a tag no workflow builds, so a clone-and-up at the release tag ran a stale image; pin it to :latest like the README. * fix(security): re-validate LLM endpoint fetch redirects per hop (GHSA-fmq9) safeFetchLlm left undici's default redirect:'follow', so a configured LLM endpoint could 302 to http://169.254.169.254/ and reach cloud-metadata credentials — the DNS pin does not cover an IP-literal redirect hop, since net.connect skips the pinned lookup for a literal IP. Follow redirects manually now, re-resolving/re-checking/re-pinning each hop (allowing LAN/ localhost as before). Also block the Alibaba metadata IPs directly. * fix(plugins): throttle the plugin log channel to prevent host-thread DoS The per-plugin RpcRateLimiter only guarded the ctx.* (req) channel; ctx.log.*, stdout/stderr and unknown evt topics reached a synchronous INSERT+prune on the host thread unthrottled, so a while(true) ctx.log.error(...) loop could freeze the instance. Route every plugin-driven log path through a per-plugin log token bucket; excess lines are dropped with a summary line on resume. * fix(plugin-sdk): serve dev /ui frame at /ui/index.html so relative assets resolve (#1526) The dev server embedded the plugin UI as <iframe src="/ui"> (no trailing slash), so a multi-file build's relative asset URLs (./assets/x.js from Vite base:'./') resolved against the origin root -> /assets/x.js -> 404, even though the files are served at /ui/assets/*. The real host loads the frame at /plugin-frame/<id>/index.html where the same relative URLs resolve correctly, so dev now matches it by loading /ui/index.html (and also serves /ui/ as index.html). * i18n: improve Russian translations (#1539) * v3.4.0 (#1527) * fix(plugins): unknown column * fix(mcp): reuse MCP sessions instead of creating one per tool call The /mcp CORS layer never set exposedHeaders, so Access-Control-Expose-Headers was absent and browser-context MCP clients (Claude Desktop connectors, Claude.ai, MCP Inspector) could not read Mcp-Session-Id off the initialize response. Unable to echo it back, every request looked like a fresh initialize: one McpServer and one session per tool call, until the per-user cap returned a 429 and the integration died until the container was restarted. The idle sweep was not at fault — it expires on lastActivity with a 1h default, so sessions born seconds apart are nowhere near expiry, hence 'cleaned 0'. - expose Mcp-Session-Id, MCP-Protocol-Version and WWW-Authenticate - evict a user's least-recently-active session at the cap rather than refusing the request, so a client that cannot persist its session id (or a proxy that strips the header) can never wedge the server - close the McpServer/transport orphaned by every session-less non-initialize POST, which was leaked: never mapped, never swept, never closed - return the cap error as JSON-RPC so clients surface the real reason - warn on session-less POSTs to make a header-stripping proxy diagnosable * chore(deps): declare @modelcontextprotocol/sdk ^1.29.0 Matches the version already resolved in the lockfile; no dependency-tree change. * docs(mcp): add the reverse proxy specs for MCP * fix(plugins): stop the row ⋯ menu being clipped by the sidebar The menu was an in-flow `absolute` div, and its ancestor (PageSidebar) is `overflow-hidden` — which clips absolutely-positioned descendants regardless of z-index. With enough plugins installed a row sits low enough that its menu runs past the sidebar's bottom edge and gets chopped, taking Delete with it, so the plugin could no longer be uninstalled from the UI. Portal the menu to <body> and position it `fixed` against the ⋯ button, flipping upward when the bottom is tight and re-anchoring on scroll/resize. A fixed child of <body> has no overflow ancestor, so nothing can clip it. Closes #1523 * feat(plugins): surface author-signature status and add a scoped re-trust override TREK has always verified an author's Ed25519 signature and TOFU-pinned the key on first install, but none of it was ever shown: a successfully-installed UNSIGNED plugin looked identical to a signed one, and a signature-refused update left the plugin quietly pinned at its old version with the reason dying in a toast. Give the four refusal conditions machine-readable codes (SIGNATURE_MISSING / _INCOMPLETE / _KEY_CHANGED / _INVALID), persist a refusal on the plugin row so the admin list keeps showing it, and badge Signed/Unsigned in the list and in Discover. Only SIGNATURE_KEY_CHANGED is overridable — an author can legitimately rotate a key; a signature that does not verify means the bytes are not what the author signed, and there is no story where waving that through is right. The override re-pins and updates in ONE call (POST :id/retrust): a re-pin that waited for a follow-up /update would leave the plugin pinned to a key no install had ever been verified against if that second call never came. The artifact must still verify under the new key, so a re-trust moves the pin from one verified key to another. assertRetrustable re-derives the condition server-side, so the UI hiding the button is a convenience, not the control, and it echoes back the full key the admin was shown so a re-key since the dialog rendered is refused. The rotation is written to the admin audit log with both fingerprints — after an incident, "which key did we move from, and to what?" is the question a single key cannot answer. * fix(plugins): let a plugin's frame reach the hosts an admin added for it The frame's connect-src was built from the manifest's http:outbound grants alone, but the child's egress guard is the UNION of those and the hosts an admin added after install for an operatorEgress plugin (a self-hosted Gotify, an ntfy — hosts the author cannot know in advance). So such a plugin WITH A UI could call the operator's host from its server and was CSP-blocked in its own iframe. Match the frame to the child. The admin consented to these hosts at install and the child already reaches them, so this widens no trust boundary that isn't already crossed. Both sources stay validated on the way in, and the interpolation filter is unchanged. * fix(plugins): report a rejected events.emit on the plugin's own log stream The host can reject an emit (an undeclared event name, a rate limit). The rejection must not escape — a detached rejection crashes the child and terminally disables the plugin over one bad emit — but swallowing it silently left an author with no way to discover that `emits` was missing from their manifest. Surface it as a warning instead. * feat(plugin-sdk): expose the raw request body for webhook signature checks A webhook author must run their HMAC over the exact bytes the sender signed. `body` is the PARSED value, and re-serializing it will not reproduce those bytes — key order, whitespace and unicode escaping all differ — so the signature never matches. Document `rawBodyBase64`, which the host already sets on auth:false routes. * fix(plugin-sdk): refuse to overwrite a released artifact, and keep the packed zip A released artifact is IMMUTABLE: the registry pins its sha256, so overwriting the bytes of a release already in the registry breaks the checksum for everyone who installed that version — they can no longer install or update it. The old code blanket-caught every `gh release create` failure (auth, network, a bad repo) and turned it into a --clobber upload. Probe for the release explicitly and refuse unless --force. Also stop deleting plugin.zip on the way out. It is the exact bytes the release and the entry's sha256 pin were computed from; a re-pack on another machine or SDK version can differ (CRLF, walk order), so anyone re-running `entry`/`sign` afterwards must hash THAT file, not a rebuild. * fix(plugin-sdk): don't fail submit when the fork already has an upstream remote `gh repo clone` of a fork may already have wired `upstream`, in which case a bare `remote add` exits non-zero and took the whole submit down. Set it either way. * fix(plugin-sdk): make the dev server behave like the host Three ways `dev` lied to an author about how their plugin would run in production: - ctx.db: one try/catch wrapped both the node:sqlite probe AND opening the database, so an mkdir/permission failure silently degraded to the in-memory stub — which swallows every write while reporting success. A db:own plugin "worked" in dev and persisted nothing. Probe separately: fail loudly on a real error, degrade only on old Node, and say plainly that the stub discards writes. - notificationChannel: the host fires it with no acting user and hands the recipient's decrypted settings in as a separate `config` argument — send(msg, config, ctx) / test(config, ctx). Firing it like an ordinary hook passed `ctx` where `config` belongs, so a channel plugin read its settings off ctx and was broken in production. - /preview pinned tripId 42 while the scaffold seeds trip 1, so the widget's first trek:invoke hit assertMember(42) and 500'd. Preview against a trip that exists. * fix(plugin-sdk): reject unknown flags, wire up create's new flags, and add --help `parse()` accepts any --x, so a flag a command does not read was silently dropped: `create --template notification-channel` cheerfully scaffolded a blank plugin. Silently ignoring an author's explicit instruction is worse than refusing it, so unknown flags are now an error, and create actually forwards --template/--egress/--required-addons. A bare --permissions used to split the string "true" into a permission literally named `true`; listFlag() now treats a valueless flag as absent. Since an unknown flag is now fatal, `--help` has to exist: it is intercepted before the flag check and prints usage on stdout with exit 0. * chore(plugins): drop three unused eslint-disable directives The no-console rule is not enabled for these files, so the directives were dead and eslint reports them as unused. * fix(plugin-sdk): bring preflight back in step with the registry's gates preflight exists to tell an author what TREK-Plugins' CI will say before they open the PR. The registry now verifies author signatures, and preflight didn't — so it drifted into the one failure mode it must never have: a false green. An author trusts a green. - Verify the signature against the artifact bytes. preflight already downloads them for the sha256 check, so this costs one call. Without it, signing with the wrong key (or re-packing after signing) sails through and is caught at review. - Check the signature SHAPE (checkSignatureShape): a key with no signed version, a signature with no key, a malformed key or signature. TREK refuses to install a half-signed entry, so such an entry is dead on arrival. - Default apiVersion to 1 before comparing. It is OPTIONAL in the manifest — install/ manifest.ts and `entry` both default it — so a manifest that legally omits it was failing preflight with "manifest apiVersion undefined != entry 1" while the registry passed it. A false RED, which teaches authors to ignore the tool. - Check requiredAddons/pluginDependencies parity, and operatorEgress without an http:outbound grant. The verifier is a port of the host's install/verify-signature.ts (the registry has its own port); sign.ts's verifyArtifact only understands the bare key/signature pair the SDK itself emits and cannot judge a minisign key. A test pins all three to the same verdicts. * feat(plugins): enforce compatibility range * chore: bump sdk version * test(e2e): repair the trip-creation specs create-trip and trip-planner have been failing for a while — long enough for three separate UI changes to drift past them, which nothing caught because CI runs vitest only and never invokes Playwright. Each failure was masking the next: - The release-notice modal greets a freshly seeded user and its backdrop swallowed the click on .add-trip-card. Added a shared dismissSystemNotices() helper (the X only shows on the notice's last page, so it has to page through first). - .modal-backdrop no longer exists — the class was namespaced to .trek-modal-backdrop so content blockers stop hiding it. - input[type=text].first() is no longer the Title field: the cover-image search inputs now sit above it, so the specs were typing the trip name into the photo search box and creating an untitled trip that never matched getByText(title). * fix(planner): gate drag & drop on pointer type, not viewport width (#1432) The 3.2.1 fix disabled drag on "mobile", but nothing in the client has ever detected touch — "mobile" was inferred from viewport width, at four independent breakpoints. A tablet is a coarse-pointer device at a *desktop* width, so an iPad (820-1366px) fell on the wrong side of all four, which is why iPhone was fixed and iPad was not: - useTripPlanner's isMobile (<768px) is what disarmed `draggable`, so on iPad rows stayed draggable and a scroll swipe became an HTML5 drag. - TripPlannerPage hardcoded isMobile={false} on the desktop PlacesSidebar, so its drop handlers and the drop-to-import overlay could never be disabled — that overlay is the reported symptom. - The arrow-button reorder fallback was revealed only below 767px, leaving iPad with no drag *and* no fallback. - touchDragPolyfill loaded drag-drop-touch at >=1024px, synthesising drags from touchmove — on a landscape iPad that re-armed the very gesture hijack 3.2.1 removed. Adds useIsTouch() ((pointer: coarse)) as a signal separate from isMobile: layout stays width-driven, so the iPad keeps the desktop two-pane planner, while every drag affordance is gated on isMobile || isTouch. The reorder arrows now show on coarse pointers, and the polyfill loads only on hybrid laptops ((pointer: fine) and (any-pointer: coarse)), which also removes the #1440 phantom-dblclick map zoom on tablets. Guarded by unit tests plus an e2e spec on real WebKit in an iPad Pro 11 context — the engine matters, since every browser on iPadOS is WebKit underneath, which is why the reporter hit this in all three they tried. * test(planner): guard the day-plan reorder arrows against phantom clicks The hover rule that reveals the reorder arrows had been dead since the TypeScript migration: it targeted `.place-row:hover .reorder-btns`, and neither class exists — the component renders `.reorder-buttons` inside an unclassed row. The buttons sat at opacity:0 on desktop with nothing to reveal them. That was not merely invisible. opacity:0 still hit-tests, so every itinerary row and day note carried an invisible, fully clickable target that silently reordered the trip: opacity: "0", visibility: "visible", pointerEvents: "auto" elementFromPoint(centre) -> BUTTON, inside .reorder-buttons The repair — pointer-events: none while hidden, plus a working .dp-row:hover/:focus-within reveal (focus-within so the buttons are also reachable by keyboard, which the file's JS-hover pattern cannot do) — lives in index.css and DayPlanSidebar.tsx. Both files also carry the #1432 drag gating, so they went with that commit rather than being split mid-file; this commit is the regression guard for them. E2E rather than unit, because jsdom does not evaluate :hover. Against the old CSS it fails on exactly the right assertion: "hidden arrows must not swallow clicks" — expected false, received true. * fix(pdf): keep the header gap on day-header overflow pages (#1531) The repeated <thead> day header (#1471) carried no gap before the first card on overflow pages: the 12px sat in .day-body's block-start padding, which a fragmented box only paints on its first fragment. Move it to the thead cell so it repeats with the header; the day's first page renders pixel-identically. * fix(budget): keep "no one paid yet" when editing an expense (#1533) The ExpenseModal payer initializer fell back to the current user whenever the edited item had no payer, so reopening an expense saved with "no one paid yet" silently reselected "You" — and re-saving then recorded the current user as the payer, corrupting the balances. An absent payer on an existing expense is a deliberate value, so only a brand-new expense defaults to me. * feat(sdk): support for plugin icons * fix(planner): keep the places filter applied and visible across tab switches The category and all/unplanned/tracks filters lived twice: a local copy in the sidebar driving the checkboxes and the list, and a page-level copy driving the map markers, synced only when a checkbox was clicked. Switching planner tabs unmounts the sidebar, so the local copy reset to "All Categories" while the markers stayed filtered — and the only way out was toggling any category on and off again (#1541). The filter now lives once in the trip store, next to selectedDayId: it survives the Plan tab unmounting (and the mobile places sheet closing), keeps both sidebar instances in agreement, and resets when another trip loads. * feat(airtrail): import connecting flights as one multi-leg booking AirTrail flights always imported as separate single-leg reservations, so a layover could not be expressed and the connection country ended up counted as visited in Atlas (#1535). The import picker now detects connection chains among the listed flights — each leg departing from the airport the previous one landed at, onward within 24 hours, and never back to the origin (an out-and-back is a return, not a connection) — and offers to import each chain as one flight with layover stops, on by default. The joined booking keeps per-leg airline, flight number, times and seat in metadata.legs, files every leg on its own trip day, and mirrors the first/last leg flat, exactly like the manual multi-leg form. With the connection stored as a stop endpoint, the existing Atlas role filter excludes the layover country on its own. AirTrail has no multi-leg flight a joined booking could round-trip to, so it imports detached from live sync, with every source flight id recorded in metadata.airtrail_ids — the picker and the server-side dedupe both treat those legs as imported, per leg, even across trip members. The server re-validates each requested chain and falls back to individual imports when it does not actually connect. * fix(airtrail): stop syncing a booking once it grows extra stops A linked flight that becomes multi-leg locally no longer matches the single AirTrail flight it was imported from: pushing would rewrite that flight to span the whole route, and the next pull would flatten the layover chain back to a plain from/to. Both sync directions now detach the link instead — the same state a joined import starts in, surfaced by the existing "Not synced" badge. TransportModal also carries metadata.airtrail_ids through re-saves (like it already does for transit itineraries and day positions), so editing a joined booking cannot cost it its import dedupe and get its legs re-offered in the picker. * fix(planner): default a new accommodation to checking out the next day The hotel picker pre-filled "Apply to days" with the same day for check-in and check-out — a stay that ends the day it begins. New accommodations now default to the following day for check-out; the last trip day keeps the same-day range, and editing still seeds from the stored range. * docs(wiki): document the AirTrail import and connection joining * fix(plugins): fold resolvePluginIcon into PluginIcon pluginIcon.ts and PluginIcon.tsx resolve to the same file on the case-insensitive filesystems dev checkouts commonly sit on (Windows, macOS) — tsc sees both casings of one module and fails with TS1149 in every importer. Keep the resolver and the component in one module. * feat(sdk): add update verification * chore: remove test files * fix(sdk) rework the sdk helpers and DX/UX * fix(sdk) harden dev environment * fix(budget): add back the multi payer selection * fix(map): stop MapLibre mouse rotation from reversing near mid-screen Since MapLibre 5's camera rewrite, the right-button rotate handler flips its sign whenever the cursor sits above a mid-screen line it derives by re-projecting the map center. That line drifts with the bearing by a fraction of a pixel, so inside the 100px band around the screen center a steady horizontal drag lands alternately above and below it — every processed movement reverses the previous one and the camera ping-pongs in place instead of rotating (#1545). A real hand crossing the line mid-drag flips the rotation direction outright. maplibre-gl 4.x rotated from plain horizontal movement and had none of this. Passing aroundCenter: false opts the handler out of the around-center mode and restores the 4.x/mapbox-gl behaviour: horizontal drag rotates, vertical drag pitches, in one continuous motion. Applied to all three GL map builds (planner, journey, settings preview); mapbox-gl keeps its options untouched. * fix(budget): settle in the trip's real currency, not always EUR The settlement route read `currency` off the row returned by canAccessTrip, whose SELECT never included the column. A cast hid the mistake, so trip.currency was always undefined and the settlement was told every trip is in EUR. Balances are netted in the trip currency and converted to the display currency once. With the trip mislabelled EUR, expenses in the trip's own currency still cancelled out, but an expense booked in a foreign currency was divided by its frozen rate into trip-currency units, then converted again as if those were euros — inflating balances by the EUR/trip rate (~27x for a RUB trip with a USD expense, #1543). MCP was unaffected: it reads the currency with its own SELECT. Select the currency in canAccessTrip so the read is real. The settlement maths was correct all along; it was simply being lied to about the base currency. Fixes #1543 * feat(trips): let users set the trip currency, and rebase the budget when it changes The trip currency is the base every expense and settle-up is netted against, but the only picker for it lived in the legacy Budget addon panel — so on the Costs panel a trip was stuck with whatever it was created as. Add the field to the trip form, on create and on edit, gated on trip_edit. The REST and MCP write paths already accepted `currency`; only the form was missing. Changing it is not a rename, though: an expense's frozen `exchange_rate` is "units of its currency per 1 trip currency", and `currency = NULL` means "the trip's own", so both are relative to the outgoing base. Swapping it out from under them redenominates the implicit rows (9 000 RUB becoming 9 000 EUR) and leaves the frozen rates pointing at a currency the trip no longer uses — the same mismatch that inflated #1543. So rebaseTripCurrency() runs first, while the old currency is still on the row: it pins the implicit rows to the outgoing currency and re-freezes every rate against the incoming one, for expenses and settle-up transfers alike. No stored amount is rewritten — each keeps the figure the user typed, in the currency they typed it in, and its real-world value survives the switch. Also covers the #1543 data as a settlement regression test. * feat(budget): give settle-up payments their own currency A transfer settling a shared bill can be made in any currency — paying a rouble debt in euros is normal — and the server has stored `currency` + a frozen `exchange_rate` on every transfer since #1445, re-freezing it on edit. The UI just never let anyone choose one, so a payment silently inherited whatever the viewer's display currency happened to be. Add the picker to the payment modal, mirroring the expense modal, and reopen an existing payment in the currency it was actually recorded in. The ledger row now shows a foreign payment as `$30.00 -> 27,00 EUR` like a foreign expense does, instead of stamping the display currency's symbol onto the raw stored number. The Settle buttons on the suggested flows keep sending the display currency: those amounts are computed in it. * feat(settings): make the display currency optional, falling back to the trip's Costs already resolved `default_currency || trip.currency || 'EUR'`, but the setting could never actually be empty: the store seeded 'USD', so a user who had never touched it silently had every trip converted into dollars, and the picker offered no way to unset it. Seed it empty and lead the picker with a "Trip currency" option, so an unset preference means "show each trip in its own currency" instead of forcing them all through one code. An explicit empty value persists and beats the admin-set instance default — it is a deliberate choice, not an absence. This also brings the public share's fallback to life: the share payload has resolved sharer's currency -> trip currency since #1361, but the trip-currency branch was unreachable while every owner had a currency forced on them. Plugins are handed `formats.currency` as a concrete code, so PluginFrame now resolves the same chain rather than passing an empty string through the bridge. * docs(wiki): explain the three currencies and how they relate Trip currency, expense currency and display currency answer three different questions, and nothing said so: the trip currency wasn't documented at all (it had no picker until now), and Budget-Tracking conflated the other two while still claiming 47 currencies and a display currency that always came from Settings. Add a Currencies page as the one place they're defined together — the trip currency as the accounting base, the expense currency as the receipt with its rate frozen at entry, the display currency as presentation-only — plus what happens when a trip's currency changes, which currency a public share renders in, and what belongs to the Costs addon versus the trip itself. Rewrite Budget-Tracking's currency section against it, document the currency field in Creating-a-Trip and the display currency in Display-Settings (which never mentioned it), and note the sharer-or-trip fallback in Public-Share-Links. * feat(help): serve the in-app wiki from disk instead of fetching GitHub The /help pages fetched their markdown from raw.githubusercontent.com at runtime, so a self-hosted install was served docs from main rather than the version it was actually running, and help was unusable without network access. The wiki/ directory was in the repo the whole time; the bundled-snapshot fallback the code reached for was gitignored and never populated by any build step, so it was dead code. Read wiki/ straight from disk instead. server/{src,dist}/services both sit three levels under the repo root, so a single __dirname anchor resolves in dev, a built source install, vitest and Docker with no copy or build step. GitHub is kept strictly as a fallback for when the directory cannot be resolved, decided once at load by probing for _Sidebar.md: a page missing from a present wiki is a genuine 404, since falling back per-file would reintroduce the version skew this removes. Ship wiki/ in the image: .dockerignore excluded it outright, so the COPY alone would have produced an image with no wiki, and the GitHub fallback would have masked that at runtime. Add a real path-containment check on assets now that the path becomes a filesystem read rather than a URL, and document TREK_WIKI_DIR as an off-by-default escape hatch across the deployment configs. * fix(plugins): serve frame assets root-relative and cross-origin loadable res.sendFile(absolutePath) resolves against the rewritten req.url under the Nest ExpressAdapter and 404s spuriously (files-download already works around the same trap), which broke every plugin frame document. And helmet's CORP: same-origin made the browser drop the opaque-origin frame's own script/style subresources, so a multi-file plugin client could never boot. Serve root-relative and mark frame responses cross-origin — sandbox + per-plugin CSP stay the isolation boundary. * feat(plugins): let a plugin ship its own settings page A plugin that declares capabilities.settingsUi: true gets its client/settings.html framed as a card under Settings -> Plugins — same opaque-origin sandbox and postMessage bridge as its widget, sized via trek:resize. Hosts that predate the flag strip it at install, so old instances keep working and simply don't show the card. * feat(map): open maps framed on their places (builds on #1393) (#1556) * fix(map): fit MapLibre routes reliably * fix(map): default planner map to world view * fix(map): only await route geometry when a route is actually pending The fit armed a pending route-refit slot on every fitKey change, even with no route drawn, and only ever cleared it when a route arrived. So a route toggled on much later — after the user had panned elsewhere — was mistaken for the awaited geometry and yanked the camera back, and only on the first toggle. Arm the slot only when a route is already on screen: updateRouteForDay lays down straight lines in the same batch as the fit and upgrades them to real geometry a moment later, so an empty route at fit time means none is coming. * fix(collections): open the empty collection map on the world view A collection with no mappable places centred on Paris, the same hardcoded default this branch removes everywhere else. * feat(map): open the map framed on its places A trip in Japan opened on the world view at 0,0 and only then animated a fitBounds flight across the planet — the hardcoded default was the map's answer to a question its own places already answer. Each renderer now derives its opening camera from the places it receives, at construction: MapView for Leaflet, MapViewGL for MapLibre and Mapbox (whose zoom runs one level below Leaflet's, measuring against a 512px world tile rather than 256px). Doing it at construction is what confines it to load — the map is built once, and by then the trip's places are in hand. Nothing recomputes it afterwards, so the camera stays where the user leaves it, and the opening fit stands down rather than overruling the gentler zoom a lone place opens at. A trip with no coordinates still falls back to the world view. Collections and the public shared-trip page frame themselves the same way. * refactor(settings): drop the default map centre and zoom Nothing reads them now that every map frames itself on its own places, and a home-city default was the wrong answer for the next trip on the other side of the world. The style preview keeps a fixed location of its own: it needs a city to show label density and 3D buildings, which open ocean cannot. * fix(map): frame the map the way each renderer can actually draw Two defects the unit tests missed and running the app exposed. MapLibre and Mapbox opened on Null Island at zoom 2 regardless of the places: the effect that mirrors an external centre prop onto the camera also ran on mount, so it jumped straight to the default nobody passed and threw away the camera the map had just been built with. It now only responds to actual changes, which is what it was for. Leaflet was unaffected — its controller already guarded on the centre changing. A trip spanning Sydney, Reykjavik and Santiago lost Sydney's marker entirely. The narrowest arc containing all three crosses the antimeridian, and framing there is only sound on a renderer that repeats the world: MapLibre and Mapbox draw a marker on whichever copy is nearest the camera, Leaflet draws one world and puts the marker at its absolute position — off-screen. Leaflet now spans the long way round, as L.latLngBounds would. The test that should have caught this wrapped the x-offset in its own projection helper, quietly assuming behaviour Leaflet does not have; it now models each renderer's real wrapping. --------- Co-authored-by: Azalea <noreply@aza.moe> * feat(mcp): expose public transit planning tools (#1558) * feat(mcp): add public transit planning tools * refactor(transit): reuse local time conversion * fix(mcp): harden transit journey validation * refactor(transit): centralize itinerary processing * fix(mcp): return the transit itineraries the provider actually offers search_transit_routes validated each itinerary leg's mode against SCHEDULED_TRANSIT_MODES, but that constant is the request-side filter whitelist — the modes a caller may ask for — not the modes MOTIS can return. Its default TRANSIT mode expands to TRAM,FERRY,AIRPLANE,BUS,COACH,RAIL,ODM, RIDE_SHARING,FUNICULAR,AERIAL_LIFT,OTHER, and street legs can be BIKE/CAR/ RENTAL. Any itinerary carrying one of those failed the parse and was dropped by the flatMap, so the tool reported fewer routes than exist — or none at all. Against the live provider, Trondheim → Ålesund returns 5 itineraries and 3 of them contain an AIRPLANE leg, so the tool silently discarded them; the web app shows all 5, because it treats mode as a free string and renders anything non-WALK as a transit leg. Accept any mode token on a leg and keep the existing "at least one non-WALK leg" rule as the real gate, which restores parity with the web app. Everything downstream keeps its mode !== 'WALK' semantics, so a journey created over MCP is identical to one created in the app. Dropping an itinerary is still possible when provider data fails the remaining consistency rules, but it is indistinguishable from "no routes exist" — so search_transit_routes now reports a `dropped` count alongside the results. --------- Co-authored-by: Uzini <43294422+Uziniii@users.noreply.github.com> * fix: show map poi search controls on mobile (#1555) * fix(pdf): use the trip's actual currency instead of hardcoded EUR (#1519) * fix(pdf): use the trip's actual currency instead of hardcoded EUR Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(i18n): drop hardcoded currency text from pdf.costLabel across locales Remove redundant EUR/currency references from pdf.costLabel translations across 21 locales now that the PDF export correctly renders amounts with their actual trip currency via formatMoney(). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(pdf): drop hardcoded euro-shaped icon from place price chip svgEuro rendered a fixed € glyph next to the price chip regardless of the trip's actual currency, undermining the currency fix. Swap for a currency-neutral coin icon. --------- Co-authored-by: Nguyen Trong Binh <nguytb15@VN1N07HO1CD1015.local> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> * fix(trips): pin place prices when the trip currency changes A place price with no currency of its own means "the trip's own currency" — that is how the PDF export and the place chips read it since #1519. But rebaseTripCurrency() only pinned budget_items and budget_settlements, so switching a trip's currency silently redenominated every implicit place price: a €15 museum on a trip moved to JPY started reading as ¥15. Same class of mismatch as #1543, on the places surface. Pin priced, currency-less places to the outgoing currency inside the same transaction. No amount is rewritten — the figure the user typed keeps its real-world value, it just stops being ambiguous about which unit it is in. Bump updated_at as well: it doubles as the optimistic-concurrency token (#1135), so a client holding the pre-switch row can no longer write the pin away. Document place prices in the wiki's currency model, and drop the now-stale "in EUR" from the PDF export's estimated-cost stat. * fix(budget): re-split expenses when a member is removed * fix(plugins): derive plugin req.user.isAdmin from role, not is_admin * chore(test): make jsdom Storage work under Node's native Web Storage globals * fix: recompute vacay calendar when week start changes (#1554) * feat(mobile): comprehensive mobile UI rewrite Add a dedicated phone UI (<768px) under client/src/mobile/, mounted by MobileShell while the desktop/tablet code paths stay untouched. Each page delegates to an M-screen that reuses the existing hooks, stores and services. Covers dashboard, trip planner (plan timeline, map, places, tabs and sheets), vacay, atlas, journey, collections, settings, admin and notifications, with a shared component kit (MSheet, MBottomNav, MGlassBar, MSegmented, MToggle, …) and design tokens in mobile.css. Empty states use an animated TREK mascot (MDancingTrek) with per-scene props. Adds the mobile* i18n namespaces (mobileTrip/mobileJourney/mobileVacay/ mobileAtlas/mobileNav/mobileAdmin/mobileSettings/mobileCollections) across all 22 locales. * fix(websocket): handle socket 'error' events to prevent crash on malformed frames (#1584) * fix(packing): apply templates into the active list tab (#1581) * Fix packing list readability on mobile * Localize packing quantity label in overflow menu * feat(mobile): accommodation & save-to-collection sheets, trip loading splash Add a dedicated mobile accommodation sheet and a save-to-collection sheet, plus an animated trip loading splash with stepped status copy. Make the vacay day/company-holiday toggles optimistic so cells react instantly and roll back on error. Wire up the "subscribe to all trips" calendar feed and cover-image add on the new-trip sheet. Sync the new dashboard/trip i18n keys across all 22 locales. * fix(atlas): stream boundary GeoJSON instead of caching parsed bundles (#1585) * fix(atlas): stream boundary GeoJSON instead of caching parsed bundles * fix(atlas): scan admin1 features in one pass to avoid O(n^2) build createFeatureSplitter re-scanned each partial Feature from the start on every gunzip chunk, so a large feature (Canada ~5.5MB, ~340 chunks) made the one-time admin1 store build O(n^2). That pushed the streaming build (~4.2s) past the 15s test timeout under CI coverage/fork contention and added the same latency to the first live region request. Carry scan state (position, brace depth, string state) across chunks so each character is examined once. Output is byte-identical (3228 features, 197 countries) and peak build memory is unchanged (~192MB RSS under a hard 512MB cap); build time drops to ~1.7s. * fix(i18n): add packing.quantity to all locales The packing.quantity key existed only in en (Qty) and de (Menge), so i18n:parity:strict and the client parity test failed for the other 20 locales. Add the key everywhere; en/de are unchanged. --------- Co-authored-by: jubnl <jgunther021@gmail.com> * fix(trips): keep accommodations on their dates when the trip range shifts (#1288) The v3.1.3 fix re-anchored dated bookings after a trip date change but explicitly excluded hotels: day_accommodations has no absolute date columns, so stays remained glued to positionally re-dated day rows and shifted with the range. updateTrip now snapshots day dates before generateDays and a new resyncAccommodationDays re-anchors each stay (and its linked hotel reservation, restamping its stale reservation_time) to the days holding its pre-change dates; out-of-range stays stay glued so whole-trip moves still shift together. Unlinked dated hotels resync like any booking, and the date-change block is wrapped in a transaction. Changing the start date now also asks how plans should follow via a new date_shift_mode field ('keep_bookings' default / 'shift_all', which reuses the reorder/insert restamp path to glue everything), exposed in the trip edit modal (all 22 locales), the shared contract, and the MCP update_trip tool. Clients no longer show stale state: the initiator reloads reservations + accommodations after saving, collaborators refetch on a date-changing trip:updated, and reconnect hydration nudges the planner's accommodations too. * fix(extract): retry with json_object and surface AI import failures (#1546) OpenAI-compatible providers that only support json_object (DeepSeek, Mistral, some vLLM/llama.cpp) reject the json_schema response_format with a 400, and the resulting error was swallowed silently: not logged server-side and never rendered by the background-task widget, leaving only a generic "no reservations" message. - Retry the chat/completions request once with response_format json_object when the json_schema attempt returns 400 (non-NuExtract only); the system prompt already dictates the output shape - Log swallowed llm-parse errors with an [llm-parse] tag so failures show up in server logs - Render task warnings under the empty-preview note in the background tasks widget so the actual provider error reaches the user * fix(costs): keep ticket item amounts visible on narrow screens (#1568) * chore: update repo url * chore: update repo url * chore: update repo url * chore: update repo url * fix(security): block IPv6 transition addresses (NAT64/6to4/Teredo) in SSRF guard An attacker-controlled DNS record pointing at a NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001:0000::/32) address that embeds a private IPv4 (e.g. 64:ff9b::a9fe:a9fe = 169.254.169.254) bypassed the SSRF guard: none of the guard functions recognised these ranges, so on a host that routes the transition prefix the connection reached the embedded private target (cloud metadata / internal SSRF). Add a shared embeddedTransitionIpv4() detector and re-apply each guard's own blocklist to the extracted IPv4 in isAlwaysBlocked, isPrivateNetwork, isLinkLocal (ssrfGuard.ts) and isBlockedIp (egress-policy.ts). A transition address to a public IPv4 stays allowed so legitimate IPv6-only egress is unaffected. egress-policy.ts keeps the detector inline to preserve its dependency-free contract for the isolated plugin subprocess. * chore: Add star history * Revert "chore: Add star history" This reverts commit |