release: v1.0.0-rc.54 — Health Connect sync fix, oai-compat LLM proxy, backup fidelity

Author: thebigjoe1

.env.example

@@ -95,14 +95,16 @@ JWT_SECRET=change-me-to-a-long-random-secret
 # Optional — AI Assistant (shared key for all users)
 # If set, AI calls are proxied through the server (key never reaches the browser)
 # and the provider/model/key fields are locked in Settings for all users.
-# Only the cloud providers below are server-proxied. The "OpenAI Compatible"
-# provider (Ollama, LM Studio, DeepSeek, Groq, etc.) runs entirely client-side
-# — the browser talks to your endpoint directly — and is configured per-user in
-# Settings, not via env vars.
-# AI_PROVIDER=claude        # claude | openai | gemini
-# AI_API_KEY=sk-ant-...
+# Supports every provider the app supports — cloud (claude / openai / gemini)
+# and OpenAI-compatible local endpoints (Ollama, LM Studio, LocalAI, vLLM,
+# DeepSeek, Groq, etc.). Set AI_PROVIDER=oai-compat + AI_BASE_URL + AI_MODEL
+# to point at a private-network LLM the browser can't reach directly (e.g.
+# a Docker Compose sidecar on an internal network).
+# AI_PROVIDER=claude        # claude | openai | gemini | oai-compat
+# AI_API_KEY=sk-ant-...      # required for cloud providers; optional for oai-compat
 # AI_API_KEY_FILE=/run/secrets/nutritrace_ai_api_key
-# AI_MODEL=claude-haiku-4-5-20251001   # optional, defaults to provider's fast model
+# AI_MODEL=claude-haiku-4-5-20251001   # optional for cloud (defaults to provider's fast model); REQUIRED for oai-compat
+# AI_BASE_URL=http://ollama:11434       # REQUIRED when AI_PROVIDER=oai-compat; must be reachable from the server container
 # AI_ENABLED=true           # optional, auto-enables the AI Assistant for all users
 
 # Optional — OIDC Single Sign-On (declared in env instead of the Settings UI)

CHANGELOG.md

@@ -9,6 +9,54 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ---
 
+## [1.0.0-rc.54] - 2026-07-10
+
+### Fixed
+
+- **Health Connect Users' Android Sync Unstuck.**
+  Pending wellness rows on the phone were tripping a SQL bug on
+  push, which stopped every subsequent pull. Symptom: items added
+  on the browser weren't reaching the phone. Every user with
+  Health Connect enabled on Android was silently affected. Fixed.
+  (#89, reported by duplaja)
+
+- **More Accurate Time to Sound Sleep.**
+  Server-side ttss derivation now credits the initial 5-10 min
+  settling-in awake segment, matching the Fitbit app. Closes the
+  consistent -5 to -7 min under-count on nights with a short
+  initial wake segment. Applies to Health Connect and Google
+  Health syncs.
+
+### Added
+
+- **Server-Side Proxy for Local LLM Endpoints.**
+  Env-locked AI now supports `AI_PROVIDER=oai-compat` alongside
+  claude / openai / gemini. Point `AI_BASE_URL` at a private
+  network Ollama, LM Studio, LocalAI, vLLM, or similar and the
+  server calls it directly, so the browser never has to see the
+  endpoint. Solves the mixed-content + Docker-internal-DNS gap
+  for self-hosters running a local LLM sidecar. Same capability
+  added to LiftTrace and CookTrace. (#90, reported by
+  gentlecolts)
+
+### Improved
+
+- **Backup + Restore Fidelity Pass.**
+  Eight silent data-loss scenarios closed across the full backup,
+  JSON export/import, and Android local backup flows. Highlights:
+  OFF unit metadata (nutrition_basis, alt_units, density_g_ml)
+  from rc.50 now survives a restore, federation API tokens
+  survive backups, JSON settings import correctly pushes to the
+  server on PWA, and native restore no longer double-inserts on
+  a second pass.
+
+- **"Copy to Another Date" Defaults to Today.**
+  Copying a meal or item from a past date now pre-fills today in
+  the picker instead of the source date. One less tap for the
+  common "same lunch again today" case.
+
+---
+
 ## [1.0.0-rc.53] - 2026-07-05
 
 ### Added

DEPLOY.md

@@ -89,9 +89,10 @@ services:
 | `SMTP_USER` | No | — | SMTP username |
 | `SMTP_PASS` | No | — | SMTP password |
 | `SMTP_FROM` | No | — | From address, e.g. `"NutriTrace" <noreply@example.com>` |
-| `AI_PROVIDER` | No | — | `claude` \| `openai` \| `gemini`. If set, AI calls are proxied server-side and the provider/model/key fields are locked in Settings for all users. |
-| `AI_API_KEY` | No | — | API key for the chosen provider. Server-only, never reaches the browser. |
-| `AI_MODEL` | No | provider default | Optional model override (e.g. `claude-haiku-4-5-20251001`). |
+| `AI_PROVIDER` | No | — | `claude` \| `openai` \| `gemini` \| `oai-compat`. If set, AI calls are proxied server-side and the provider/model/key fields are locked in Settings for all users. |
+| `AI_API_KEY` | No | — | API key for the chosen provider. Server-only, never reaches the browser. Optional when `AI_PROVIDER=oai-compat`. |
+| `AI_MODEL` | No | provider default | Optional model override (e.g. `claude-haiku-4-5-20251001`, `llama3.1:8b`). Required when `AI_PROVIDER=oai-compat`. |
+| `AI_BASE_URL` | No | — | Required when `AI_PROVIDER=oai-compat`. Base URL of your OpenAI-compatible endpoint, e.g. `http://ollama:11434`. Reached from the server container, not the browser — Docker Compose sidecars on internal networks work. |
 | `AI_ENABLED` | No | — | If `true`, auto-enables the AI Assistant for all users. |
 
 > **Note:** SMTP and AI settings can also be configured in **Settings → Email** / **Settings → AI Assistant** (admin only). Environment variables take priority over the UI and lock the corresponding fields when set.

README.md

@@ -289,7 +289,8 @@ On first launch, a setup wizard walks you through enabling user management and c
 | `SMTP_FROM` | No | — | From address, e.g. `NutriTrace <noreply@example.com>` |
 | `AI_PROVIDER` | No | — | Lock Trace to a specific provider for all users: `claude` \| `openai` \| `gemini` \| `oai-compat` |
 | `AI_API_KEY` | No | — | Shared AI API key. Key is server-side only — never sent to the browser. Optional when `AI_PROVIDER=oai-compat` and pointing at a local endpoint that doesn't require auth. |
-| `AI_MODEL` | No | provider default | Override the AI model (e.g. `claude-haiku-4-5-20251001`, `llama3.1:8b`) |
+| `AI_MODEL` | No | provider default | Override the AI model (e.g. `claude-haiku-4-5-20251001`, `llama3.1:8b`). Required when `AI_PROVIDER=oai-compat` |
+| `AI_BASE_URL` | No | — | Required when `AI_PROVIDER=oai-compat`. Base URL of your OpenAI-compatible endpoint, e.g. `http://ollama:11434`. Must be reachable from the server container (a Docker Compose sidecar on an internal network is the intended use — the browser never touches it, so mixed-content and internal DNS aren't blockers). |
 | `AI_ENABLED` | No | — | Set to `true` to auto-enable Trace for all users |
 
 SMTP and AI settings can also be configured in the Settings UI. Environment variables take priority over UI values and lock those fields for all users.

android/app/build.gradle

@@ -19,8 +19,8 @@ android {
         applicationId "com.nutritrace.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 122
-        versionName "1.0.0-rc.53"
+        versionCode 123
+        versionName "1.0.0-rc.54"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.

docker-compose.yml

@@ -67,12 +67,15 @@ services:
       # Optional — AI Assistant (shared key for all users). When set, AI calls
       # are proxied through the server (key never reaches the browser) and the
       # provider/model/key fields are locked in Settings for all users.
-      # NOTE: only the cloud providers below are server-proxied. The "OpenAI
-      # Compatible" provider (Ollama, LM Studio, DeepSeek, Groq, etc.) runs
-      # entirely client-side and is configured per-user in Settings, not here.
-      # - AI_PROVIDER=${AI_PROVIDER:-}            # claude | openai | gemini
-      # - AI_API_KEY=${AI_API_KEY:-}
-      # - AI_MODEL=${AI_MODEL:-}
+      # Supports every provider the app supports — cloud (claude / openai /
+      # gemini) and OpenAI-compatible local endpoints (Ollama, LM Studio,
+      # LocalAI, vLLM, DeepSeek, Groq, etc.). Set AI_PROVIDER=oai-compat +
+      # AI_BASE_URL + AI_MODEL to point at a private-network LLM the browser
+      # can't reach directly (e.g. an Ollama sidecar on this compose network).
+      # - AI_PROVIDER=${AI_PROVIDER:-}            # claude | openai | gemini | oai-compat
+      # - AI_API_KEY=${AI_API_KEY:-}              # required for cloud; optional for oai-compat
+      # - AI_MODEL=${AI_MODEL:-}                  # optional for cloud; REQUIRED for oai-compat
+      # - AI_BASE_URL=${AI_BASE_URL:-}            # REQUIRED for oai-compat, e.g. http://ollama:11434
       # - AI_ENABLED=${AI_ENABLED:-}
       # Optional — OIDC Single Sign-On declared in env instead of the Settings UI.
       # Single-provider shorthand (`OIDC_*` is an alias for `OIDC_PROVIDER_1_*`):

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nutritrace",
-  "version": "1.0.0-rc.53",
+  "version": "1.0.0-rc.54",
   "private": true,
   "type": "module",
   "scripts": {

server/ai.js

@@ -7,6 +7,13 @@ export function seedAiFromEnv() {
     AI_PROVIDER: 'ai_provider',
     AI_API_KEY:  'ai_api_key',
     AI_MODEL:    'ai_model',
+    // AI_BASE_URL enables server-side proxying for the `oai-compat`
+    // provider (Ollama, LM Studio, LocalAI, vLLM, etc.). Required when
+    // AI_PROVIDER=oai-compat; ignored otherwise. Lets self-hosters put
+    // their LLM on a private Docker network — the browser never talks
+    // to it directly, so mixed-content and internal-DNS resolution
+    // stop being blockers (#90 gentlecolts).
+    AI_BASE_URL: 'ai_base_url',
   };
   const upsert = db.prepare(
     'INSERT INTO app_config (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value'

server/lib/google-health.js

@@ -643,6 +643,7 @@ export async function fetchSleepForDate(accessToken, dateStr) {
   }
 
   const BRIEF_LIGHT_MAX = 5; // LIGHT segments < 5 min count toward Sound Sleep
+  const TTSS_SETTLING_CAP = 10; // initial AWAKE up to N min counts toward TTSS
   let interruptionsMin = 0;
   let fullAwakenings   = 0;
   let restlessnessMin  = 0;
@@ -658,10 +659,23 @@ export async function fetchSleepForDate(accessToken, dateStr) {
     const durMin = (new Date(e) - new Date(s)) / 60000;
     if (!Number.isFinite(durMin)) continue;
     if (seg.type === 'AWAKE') {
-      // First AWAKE >= 5 min: settling-in period, credit to Time to Sound Sleep.
+      // First AWAKE >= 5 min: settling-in period. Fitbit's app measures TTSS
+      // from when the wearable detected the start of the sleep session
+      // (including a short initial settling-in AWAKE) to the first DEEP
+      // block — BUT only for reasonably short initial AWAKE. For long initial
+      // AWAKE (Jun 30 2026: 15m), Fitbit apparently assumes the user was
+      // awake before going to bed and starts TTSS from the first sleep stage
+      // instead. Calibration data: 3.5m/5m/5.5m/7m AWAKE all include-in-ttss,
+      // 15m does not — threshold sits somewhere between. TTSS_SETTLING_CAP
+      // set at 10 min conservatively; revisit if a 10-15m point lands.
       if (!firstAwakeSeen) {
         firstAwakeSeen = true;
-        if (durMin >= FULL_AWAKE_MIN) continue;
+        if (durMin >= FULL_AWAKE_MIN) {
+          if (durMin <= TTSS_SETTLING_CAP && firstAsleepStart == null) {
+            firstAsleepStart = new Date(s).getTime();
+          }
+          continue;
+        }
       }
       // Last AWAKE >= 5 min: morning wake-up event, exclude.
       if (i === lastAwakeBigIdx) continue;

server/routes/ai.js

@@ -134,18 +134,29 @@ router.post('/chat', requireAuth, aiChatLimit, wrap(async (req, res) => {
   }
 
   const cfg = getAiConfig();
-  if (!cfg.ai_api_key) return res.status(503).json({ error: 'AI not configured on server. Set AI_API_KEY in environment.' });
-
   const provider = cfg.ai_provider || 'claude';
   const model    = cfg.ai_model    || AI_DEFAULT_MODELS[provider] || '';
   const apiKey   = cfg.ai_api_key;
+  const baseUrl  = cfg.ai_base_url;
   const toolsArr = Array.isArray(tools) ? tools : [];
 
+  // API key is required for cloud providers. `oai-compat` local endpoints
+  // (Ollama, LM Studio, etc.) often don't need one — mirror the client-side
+  // callAI() behaviour at aiChat.js:247-249.
+  if (!apiKey && provider !== 'oai-compat') {
+    return res.status(503).json({ error: 'AI not configured on server. Set AI_API_KEY in environment.' });
+  }
+  if (provider === 'oai-compat') {
+    if (!baseUrl) return res.status(503).json({ error: 'AI_PROVIDER=oai-compat requires AI_BASE_URL in environment.' });
+    if (!model)   return res.status(503).json({ error: 'AI_PROVIDER=oai-compat requires AI_MODEL in environment.' });
+  }
+
   let result;
   switch (provider) {
-    case 'claude':  result = await _callClaude(apiKey, model, messages, systemPrompt, toolsArr); break;
-    case 'openai':  result = await _callOpenAI(apiKey, model, messages, systemPrompt, toolsArr); break;
-    case 'gemini':  result = await _callGemini(apiKey, model, messages, systemPrompt, toolsArr); break;
+    case 'claude':     result = await _callClaude(apiKey, model, messages, systemPrompt, toolsArr); break;
+    case 'openai':     result = await _callOpenAI(apiKey, model, messages, systemPrompt, toolsArr, 'https://api.openai.com'); break;
+    case 'gemini':     result = await _callGemini(apiKey, model, messages, systemPrompt, toolsArr); break;
+    case 'oai-compat': result = await _callOpenAI(apiKey || 'no-key', model, messages, systemPrompt, toolsArr, baseUrl.replace(/\/+$/, '')); break;
     default: return res.status(400).json({ error: `Unknown provider: ${provider}` });
   }
   res.json(result);
@@ -214,7 +225,7 @@ async function _callClaude(apiKey, model, messages, systemPrompt, tools) {
   return { assistantMessage, toolCalls };
 }
 
-async function _callOpenAI(apiKey, model, messages, systemPrompt, tools) {
+async function _callOpenAI(apiKey, model, messages, systemPrompt, tools, baseUrl = 'https://api.openai.com') {
   const openaiTools = (tools || []).map(t => ({
     type: 'function',
     function: { name: t.name, description: t.description, parameters: t.parameters },
@@ -227,7 +238,7 @@ async function _callOpenAI(apiKey, model, messages, systemPrompt, tools) {
   };
   if (openaiTools.length) body.tools = openaiTools;
 
-  const res = await fetch('https://api.openai.com/v1/chat/completions', {
+  const res = await fetch(`${baseUrl}/v1/chat/completions`, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',