Phone layout, Apple Health from iPhone (status, steps), and a data/ folder

[SeanathanVT]

Summary

• Phone layout (3.19). base.html had no viewport meta, so phones rendered a shrunken desktop page. Under 480px: the speed reading fills the screen, presets and Pause/End are full-width rows docked at the bottom, every tap target is at least 44px, the header controls fold into a ⋮ menu, and Recent Sessions shows as cards. Desktop layout is pixel-identical to before at 1280px.
• Screen wake lock (3.12). Native navigator.wakeLock on the Active screen. Browsers only allow it on localhost/HTTPS, so it keeps the computer's screen on but not a phone on LAN HTTP.
• Home-screen app. static/manifest.json (display: standalone), so Add to Home Screen opens full-screen.
• Apple Health on iPhone/iPad. A phone can't scan its own screen, so on iOS/iPadOS both QR codes become buttons: Log to Apple Health runs the Shortcut directly, and Install Shortcut opens Apple's Get Shortcut page. Computers keep the QR codes (macOS has no Health app).
• Prompt auto-clears. The log link is now a shortcuts://x-callback-url/run-shortcut URL whose x-success opens /health_logged/<id>. That marks the session logged, and every open page updates within about a second over SSE, including the desktop that showed the QR. This works with the already-installed Shortcut.
• Steps in Apple Health. WalkingDad now sends the session's step count, and the updated Shortcut logs it as a Steps sample next to the workout, so treadmill steps count toward the daily total. The install link and the exported apple_health/log-walkingdad-workout.shortcut point to the new version.
• Per-session status, retroactive log, delete.
  • With export on, each Recent Sessions row shows a filled (logged) or outline (not logged) heart, with a tooltip on hover, tap or focus.
  • Edit reveals a per-row Log (QR on desktop, direct link on iOS) and a Delete button (completed sessions only).
• data/ folder. Settings, the database, crash-recovery state and the JSON-migration backups move out of the code folder into data/ (backups in data/backups/).
• Tool configs. pytest.ini, ruff.toml and .coveragerc are merged into pyproject.toml.

Upgrade notes

• Files move on first start. The first start after upgrading moves config.json, the database (with its -wal/-shm, as one group), session_state.json and any session_history.json.* backups into data/. Nothing is overwritten; a blocked move is skipped and logged. Until then, config.py still reads a root config.json.
• Settings file location. To edit settings by hand, use data/config.json from now on. config.json.example stays in the root.
• Reinstall the Shortcut to log steps. Use Install Shortcut (or the setup QR) in Settings. The old Shortcut keeps working and ignores the new steps field. The first run asks for permission to write Steps to Health.
• Health status values. sessions.health_logged now holds three values: 0 pending, 1 logged, 2 dismissed. Before this, Dismiss also wrote 1, so existing 1 rows show as logged even if some were only dismissed. No schema change or migration.
• Callback needs the network. The phone has to reach WalkingDad for auto-clear: host must be 0.0.0.0 (the default), and when the desktop uses localhost the callback URL uses its LAN IP instead. If the phone can't reach it, the workout is still logged and only the prompt stays.

Notable implementation details

• /health_logged/<id> is a GET, because x-success opens as a Safari navigation. It only acts on completed sessions and returns 404 otherwise. The CSRF guard skips GETs, so the most another website could do is mark one session logged.
• Dismiss acts on the prompt's own session, and never undoes a log. It sends that session's id, so a session ending on another device while the prompt is open can't be dismissed in its place. A Dismiss from a page that hasn't yet seen the log (or the Settings off/on path) leaves a logged session logged.
• Steps are a separate Health sample. The Shortcuts Log Health Sample action has no End Date and Log Workout can't attach samples, so the steps are stamped at the session start and aren't listed under the workout's Related Samples. Daily totals are correct.
• iOS detection. It runs before first paint (is-ios class; iPadOS is detected as a touch-capable "Macintosh"), and .ios-only/.not-ios only ever hide elements.
• Pressed states. Buttons previously faded to transparent while held: Bootstrap's --bs-btn-active-bg was never set. They now show a darker pressed color and shrink slightly, on desktop too.
• Logged heart color. It uses --text-color rather than the theme accent or Apple pink. Accents fall under 3:1 contrast on 9 of the 15 dark themes, and the pink read as the app's danger red.

Testing

• Tests: pytest passes (379) and ruff check . is clean. New tests cover:
  • the viewport and manifest
  • the x-callback URL (including steps in the data sent to the Shortcut) and the LAN-IP swap
  • /health_logged validation
  • Dismiss targeting its own session, and leaving a logged session logged
  • per-row Log URLs, and /delete_session (with the samples cascade and the in-progress refusal)
  • the data/ relocation (all-or-nothing database group, never overwriting)
  • the legacy config fallback
  • migration backups landing in data/backups/
• Headless browser (Playwright, iPhone and desktop user agents):
  • no horizontal overflow and no tap targets under 44px at 375/390px
  • the desktop is pixel-identical when export is off
  • the iOS/desktop swaps, live updates over SSE (prompt, row heart, QR modal), Edit/Log/Delete, and the heart tooltips
• Upgrade simulation: run on a repo copy with the real config.json, walkingdad.db and migration backups. All 32 sessions were preserved, the settings save went to data/config.json, and the root was left clean.
• Shared Shortcut: downloaded from the new iCloud link and checked that the Steps sample's value is the steps field.
• On a real iPhone (iOS 27.0.1):
  • phone layout and the ⋮ menu
  • Add to Home Screen
  • Log from the phone, plus auto-clear when scanning the desktop QR
  • Install Shortcut
  • retroactive Log and Delete
  • theme check of the hearts
  • steps: a test session logged its workout and a 68-step Steps sample, from one run

Not in this PR

• Wake lock on phones: it needs HTTPS (see 3.12).
• Android install prompt: it needs square 192/512 icons and HTTPS.
• Indoor Walk label and steps attached to the workout: Shortcuts' Log Workout has no indoor option and can't attach samples. Both need a native HealthKit app, which can be built free with a personal Apple ID but has to be reinstalled from Xcode every 7 days.
• Tablet breakpoint (3.17) and swipe gestures (3.7): both now build on the phone layout.

🤖 Generated with Claude Code