thebigjoe1 · Oct 22, 2026 · Aug 23, 2026 · Aug 23, 2026 · Aug 23, 2026 · Aug 23, 2026
diff --git a/.env.example b/.env.example
@@ -143,6 +143,17 @@ JWT_SECRET=change-me-to-a-long-random-secret
 # default; public-internet-facing installs should leave this off.
 # ALLOW_PRIVATE_WEBHOOK_URLS=1
 
+# Importing a recipe from a link, and smart import's AI address when an
+# account sets its own, fetch from this server. An admin may reach addresses
+# on the server's own network; other accounts may not, so they can't read
+# services only the server can see. Set these to let every account (and a
+# single-user install, which has no sign-in). Cloud-metadata addresses stay
+# blocked.
+# ALLOW_PRIVATE_RECIPE_URLS=1
+# ALLOW_PRIVATE_AI_URLS=1
+# Behind HTTP_PROXY/HTTPS_PROXY these checks still run, but the proxy makes
+# the connection, so what it can reach (its own network) is up to the proxy.
+
 # ── Update checks ─────────────────────────────────────────────────────────
 # Off until you turn them on: setup asks, and Settings, Updates can change it.
 # When on, the server asks github.com for the latest release every few hours

diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/DEPLOY.md b/DEPLOY.md
@@ -20,20 +20,19 @@ is a discoverability mirror. Both are first-class; pick whichever fits.
 - **`ghcr.io/traceapps/cooktrace`** (primary)
 - **`traceapps/cooktrace`** on [Docker Hub](https://hub.docker.com/r/traceapps/cooktrace) (mirror)
 
-Pin to whatever risk level fits (examples below use GHCR; swap the prefix
-for Docker Hub if preferred):
+Two tags are published (examples below use GHCR; swap the prefix for
+Docker Hub if preferred):
 
 | Tag | Updates when | Use case |
 |-----|--------------|----------|
-| `ghcr.io/traceapps/cooktrace:1.0.0` | Never (pinned exact) | Reproducible pin to a specific version |
-| `ghcr.io/traceapps/cooktrace:1.0` | Any 1.0.x patch release | Auto-receive bug fixes, no new features |
-| `ghcr.io/traceapps/cooktrace:1` | Any 1.x.y minor release | Auto-minor within a major, no breaking |
-| `ghcr.io/traceapps/cooktrace:latest` | Every stable release | Absolute latest stable |
+| `ghcr.io/traceapps/cooktrace:latest` | Every stable release | Running the app |
 | `ghcr.io/traceapps/cooktrace:dev` | Every push to `dev` branch | Leading edge, not for production |
 
-Legacy `1.0.0-rc.N` tags from before the semver switch remain published
-indefinitely on GHCR; anyone pinned to a specific rc release is unaffected.
-Docker Hub mirroring started post-1.0, so it only carries stable-era tags.
+There are no version-number tags (`:1`, `:1.4`, `:1.4.0`); the ones published
+for the first releases stopped updating and were retired. To hold a server on
+one exact build, pin it by digest
+(`ghcr.io/traceapps/cooktrace@sha256:...`; `docker inspect --format
+'{{index .RepoDigests 0}}' ghcr.io/traceapps/cooktrace:latest` prints the one you run).
 
 ## Testing pre-release builds
 
@@ -45,9 +44,9 @@ Every dev-worthy build refreshes the [`dev-latest`](https://github.com/traceapps
 
 ### Milestone `v<version>-devNN` (occasional, pinnable)
 
-When a specific feature or fix is worth its own tester milestone (a new AI capability, a wearable integration, a big backup change), a numbered pre-release gets cut: `v1.0.4-dev01`, `v1.1.0-dev01`, etc. These get their own permanent GH release, their own tester-facing notes, and their own Docker tag (`ghcr.io/traceapps/cooktrace:1.0.4-dev01`) alongside `:dev`. `dev-latest` is refreshed to point at the same commit.
+When a specific feature or fix is worth its own tester milestone (a new AI capability, a wearable integration, a big backup change), a numbered pre-release gets cut: `v1.0.4-dev01`, `v1.1.0-dev01`, etc. These get their own permanent GH release, their own tester-facing notes, but no Docker tag of their own: the server side of a milestone is the `:dev` image. `dev-latest` is refreshed to point at the same commit.
 
-Iteration numbers are zero-padded two digits for 1 through 9 (`dev01`, `dev02`, …, `dev09`) and natural two digits from 10 onward (`dev10`, `dev11`, …). No dot between `dev` and the number. That keeps the identifier inside SemVer 2.0.0 §9 and gives correct lex ordering everywhere (GitHub Tags, `gh release list`, Docker Hub).
+Iteration numbers are zero-padded two digits for 1 through 9 (`dev01`, `dev02`, …, `dev09`) and natural two digits from 10 onward (`dev10`, `dev11`, …). No dot between `dev` and the number. That keeps the identifier inside SemVer 2.0.0 §9 and gives correct lex ordering everywhere (GitHub Tags, `gh release list`).
 
 Use numbered dev builds when reporting bugs ("I saw this on `v1.1.0-dev02`") or if you want to install a specific milestone and stay on it. Everyone else, `dev-latest` covers you.
 

diff --git a/README.md b/README.md
@@ -67,7 +67,7 @@ Third app in the Trace family alongside [NutriTrace](https://github.com/traceapp
 
 ### AI + Federation
 - **Trace AI.** Reads your recipes, pantry, diary, and cookbooks; can log a cook, plan a meal, add to shopping, or import a recipe from a URL, all conversationally. 19 tools total. Multi-provider (Claude / OpenAI / Gemini / any OpenAI-compatible endpoint). Smart Log voice, image attach, cook-mode voice control. → [full guide](https://traceapps.github.io/docs/cooktrace/trace/)
-- **NutriTrace federation.** Pull food data per-user with a Bearer token; log cooks back to the NT diary. → [full guide](https://traceapps.github.io/docs/cooktrace/nt-federation/)
+- **NutriTrace federation.** Pull food data from NutriTrace into your pantry, per user, with a Bearer token. → [full guide](https://traceapps.github.io/docs/cooktrace/nt-federation/)
 - **Model Context Protocol (MCP).** Expose your recipes, pantry, shopping list, and cook diary to external AI agents (Claude Desktop, Cursor, Codex) via the standard MCP Streamable HTTP transport. Off by default; opt in with `MCP_ENABLED=1`. Read, write, and destructive tool tiers, each independently gated by its own env flag and token scope. → [full guide](https://traceapps.github.io/docs/cooktrace/mcp/)
 
 ### Accounts + platforms
@@ -139,6 +139,7 @@ The most-asked knobs. Full list at [docs/self-hosting/env-vars](https://traceapp
 | `UPLOADS_PATH` | `/data/uploads` | Uploaded images and server-side backups. |
 | `PORT` | `3003` | Port the server listens on inside the container (3001 before 1.3.0). |
 | `BASE_URL` | - | Mount at a subpath, e.g. `/cooktrace`. |
+| `PUBLIC_URL` | - | The full address people open the app at, subpath included (e.g. `https://recipes.example.com`). Links in emails (password reset, invites, sharing) use it. Unset, they use an address an admin has opened the app at. |
 | `LOG_LEVEL` | `info` | `error` \| `warn` \| `info` \| `debug`. |
 | `INSECURE_COOKIES` | unset | Set to `1` on plain-HTTP LAN deployments so the auth cookie isn't dropped. See [LAN-HTTP notes](https://traceapps.github.io/docs/getting-started/lan-http/). |
 | `MAX_SESSION_HOURS` | `8760` | Session-length cap in hours. Lower for shared / kiosk machines. |

diff --git a/android/app/build.gradle b/android/app/build.gradle
@@ -19,8 +19,8 @@ android {
         applicationId "com.cooktrace.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 105
-        versionName "1.4.0"
+        versionCode 106
+        versionName "1.4.1"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
@@ -3,6 +3,8 @@
 
     <application
         android:allowBackup="true"
+        android:fullBackupContent="@xml/backup_rules"
+        android:dataExtractionRules="@xml/data_extraction_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:networkSecurityConfig="@xml/network_security_config"

diff --git a/android/app/src/main/java/com/cooktrace/app/InstallMarkerPlugin.java b/android/app/src/main/java/com/cooktrace/app/InstallMarkerPlugin.java
@@ -0,0 +1,43 @@
+package com.cooktrace.app;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+
+import com.getcapacitor.JSObject;
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+
+/**
+ * This install's id, kept where backups never go (res/xml/backup_rules.xml
+ * and data_extraction_rules.xml leave out this one preferences file). The
+ * app's database is backed up, and comes back on a new phone, or a second
+ * one, with the install id inside it. The app compares the two
+ * (src/lib/db-native.js dbInstallId): when they differ, the database came
+ * from somewhere else and this install takes a new id, so two phones never
+ * send the server the same key for different rows.
+ */
+@CapacitorPlugin(name = "InstallMarker")
+public class InstallMarkerPlugin extends Plugin {
+    static final String FILE = "ct_install_marker";
+    private static final String KEY = "install_id";
+
+    private SharedPreferences prefs() {
+        return getContext().getSharedPreferences(FILE, Context.MODE_PRIVATE);
+    }
+
+    @PluginMethod
+    public void get(PluginCall call) {
+        JSObject ret = new JSObject();
+        ret.put("value", prefs().getString(KEY, null));
+        call.resolve(ret);
+    }
+
+    @PluginMethod
+    public void set(PluginCall call) {
+        String value = call.getString("value");
+        boolean ok = prefs().edit().putString(KEY, value).commit();
+        if (ok) call.resolve(); else call.reject("could not keep the install id");
+    }
+}
diff --git a/android/app/src/main/java/com/cooktrace/app/MainActivity.java b/android/app/src/main/java/com/cooktrace/app/MainActivity.java
@@ -9,6 +9,7 @@ public void onCreate(android.os.Bundle savedInstanceState) {
         // bridge picks them up when it builds its plugin handle map.
         registerPlugin(WearPairingPlugin.class);
         registerPlugin(FoldPlugin.class);
+        registerPlugin(InstallMarkerPlugin.class);
         super.onCreate(savedInstanceState);
     }
 

diff --git a/android/app/src/main/res/xml/backup_rules.xml b/android/app/src/main/res/xml/backup_rules.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Auto Backup up to Android 11: everything as before, except this install's
+     id (InstallMarkerPlugin), which must never reach another phone. -->
+<full-backup-content>
+    <exclude domain="sharedpref" path="ct_install_marker.xml" />
+</full-backup-content>
diff --git a/android/app/src/main/res/xml/data_extraction_rules.xml b/android/app/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Android 12 and later: cloud backup and moving to a new phone keep
+     everything as before, except this install's id (InstallMarkerPlugin),
+     which must never reach another phone. -->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="sharedpref" path="ct_install_marker.xml" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="sharedpref" path="ct_install_marker.xml" />
+    </device-transfer>
+</data-extraction-rules>
diff --git a/android/wear/build.gradle b/android/wear/build.gradle
@@ -17,8 +17,8 @@ android {
         minSdkVersion 30
         targetSdkVersion rootProject.ext.targetSdkVersion
         // Its own numbering; the name tracks the phone app it pairs with.
-        versionCode 2
-        versionName "1.4.0"
+        versionCode 3
+        versionName "1.4.1"
     }
 
     buildFeatures {

diff --git a/index.html b/index.html
@@ -2,6 +2,22 @@
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
+  <!--
+    Workbox also precaches the build-time index so an installed app can open
+    offline. That document has no Express-injected config. A controlled page
+    can recover the same mount path from its active worker's URL before the
+    app's module graph reads __CT_CONFIG__; a server-injected value remains
+    authoritative on network responses.
+  -->
+  <script data-base-path-fallback>
+    (function() {
+      if (window.__CT_CONFIG__ || !navigator.serviceWorker) return;
+      var controller = navigator.serviceWorker.controller;
+      if (!controller || !controller.scriptURL) return;
+      var basePath = new URL('.', controller.scriptURL).pathname.replace(/\/$/, '');
+      window.__CT_CONFIG__ = { basePath: basePath === '/' ? '' : basePath };
+    })();
+  </script>
   <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover" />
   <meta name="mobile-web-app-capable" content="yes" />
   <meta name="apple-mobile-web-app-capable" content="yes" />

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cooktrace",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "private": true,
   "type": "module",
   "scripts": {