405 commits

Author	SHA1	Message	Date
Daniel	67e416c6d9	docs: merge the duplicate pairs and correct them against the running app ... Three pairs of docs described the same thing twice, and the copies had drifted apart. Merged each into one file, keeping the unique content from both: - ARCHITECTURE.md -> architecture.md (its operational map: ownership, request flow, runtime boundaries, source of truth, deployment shape) - DEVELOPMENT.md -> developer-guide.md (change workflow, Clinical Assistant high-risk areas, frontend rendering rules, deployment checks) - transcription-options.md -> speech.md (the clinic setup table, and the list of browser-Whisper paths that must stay removed) Then audited what remained against the code and the live database rather than against the previous docs. Corrected: - Google Vertex was still documented as a provider across nine files. The SDK is gone; AI_PROVIDER=vertex now logs an advisory and falls back to OpenRouter, and Gemini is reached through LiteLLM. Fixed the provider selection order to match src/utils/ai.js, which starts from LITELLM_API_BASE. - promptSafe was documented on 8 routes; it is on 13. - Node 20 -> 24, "24 vanilla JS modules" -> no fixed count, and transcribe.js/tts.js -> sttProvider.js/ttsProvider.js, which is what exists. - STT/TTS are LiteLLM-only; README listed direct Google, AWS Transcribe and ElevenLabs paths that are not in the runtime. - Learning Hub PPTX export was documented as pptxgenjs, which is not a dependency. It is pandoc against a reference deck. - POST /api/admin/milestones/seed does not exist; it is /bulk-import. - NEXTCLOUD_URL and NTFY_TOPIC are not read anywhere. Nextcloud is per-user in the users table, and the ntfy topic is derived as pedscribe-{userId}. - A prose paragraph sat inside the Clinical Assistant settings table, so half the rows rendered as text. Filled the gaps the audit exposed: - database.md was missing 12 of 29 tables, including user_resources, personal_notes, login_codes, registration_invites and generated_image_jobs. - developer-guide.md was missing 11 routers and 10 frontend modules. - api-reference.md detailed 121 of 244 endpoints and said so, but whole features were absent. Added an endpoint index covering Clinical Assistant, My Resources, Notes, Diagrams, ED Encounters, invites and sign-in codes. - configuration.md was missing METRICS_TOKEN, REDIS_URL, API_RATE_LIMIT_MAX, the LITELLM_* model variables, the DB_* ones maintenance.js reads, and the per-purpose S3 resolution scheme. - clinical-assistant.md documented 2 of its 17 environment variables. - features-explained.md had no entry for My Resources or Clinical Assistant. Renamed the three remaining SHOUTING filenames to kebab-case, which is what the docs viewer's prettyName() was working around, and rewrote README's index, which listed architecture.md twice and omitted nine files. Noted but not changed: the Turnstile site key is hardcoded in index.html rather than read from TURNSTILE_SITE_KEY, and /api/health/detailed can report tts: 'elevenlabs' though no ElevenLabs path exists. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-12 04:57:35 +02:00
Daniel	2c3fbbcf37	fix: decks were falling back to markdown, so no figure could ever be requested ... A deck's JSON is several times the size of the prose it holds, and generation used the default 4000-token budget — raised for refine and for slide review, but never here. A sixteen-slide deck ran past it, came back truncated, failed to parse, and fell back to markdown. Markdown has no way to ask for a figure, so the model described one instead and the slide rendered a literal "![Placeholder: Flow diagram — "Neonate with rash" → ...]" as its first bullet, above the steps it was meant to illustrate. That is why no generated deck was arriving with an image. Deck generation now gets room for a deck. The fallback also says how the reply failed — empty, cut short at N characters, or simply not a deck — because those want different fixes and "not usable" covered all three. Image markup is stripped wherever text enters a slide, on both the deck and markdown paths, since a described figure is not a figure and a bullet of raw markdown is worse than no bullet. The model is also told plainly: if a figure is wanted say so with image_prompt, and if that is not on offer, write the slide without one rather than describing the picture you would have drawn. Separately, the Documentation list showed ARCHITECTURE, CLINICAL_ASSISTANT, DEVELOPMENT, MODULE_CONVENTIONS and SCALING shouting in caps with underscores intact: the label builder replaced hyphens but not underscores, and uppercased the first letter of each word rather than normalising the case, so a SHOUTING_FILENAME stayed shouting. It now reads "Clinical Assistant", keeps acronyms as acronyms (AI, API, OpenID, LiteLLM) and leaves joining words lower. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-12 04:21:20 +02:00
Daniel	9d307fd442	feat: a vision model looks at the rendered deck and fixes the layout ... The model that writes a deck never sees it. It cannot tell that slide four overflowed, that a nine-item list would read better in two columns, or that two labelled groups want to be a comparison — those are facts about the rendered page, not about the text. So each generated deck is now rendered to PDF through Gotenberg, rasterised to one image per slide with pdftoppm, and shown to a vision model. Off unless an administrator names a reviewer, in its own admin card because it is the one setting that spends money on every generation without a user having asked for anything. One pass, on generation only: a second pass costs as much as the first and fixes far less, and refining is a text edit. It returns a patch, not a deck. Asking for the corrected deck back put the reply in proportion to the deck rather than to the number of problems, and a fourteen-slide deck came back cut off mid-object at every output budget the provider would honour — measured twice before changing shape. The patch is better for a second reason. The reviewer names a slide and an action — two columns, one column, split after bullet N, compare with these two labels — and the server moves the text it already has. The words never pass through the model, so a review cannot reword, drop or invent a single bullet. That is a stronger guarantee than instructing it not to and checking afterwards. The check runs anyway, because a bug in applyChanges would be as bad as a model rewriting the words and worse for being trusted: body text must come out the same multiset, figures the same set, and a heading may only be reused or extended. A continuation heading is the reviewer's one piece of text and is replaced when it does not continue anything. Nothing here can fail a generation — no reviewer, an unreachable one, an unparseable reply, a deck too long to look at, or a patch that applies to nothing each return the deck that was written. Verified end to end against a deck with a deliberately overloaded slide: three slides rendered and sent, one change returned, ten bullets split into five and five under "Stepwise Management … (continued)", text intact. Left switched off; enable it under Admin. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 21:38:18 +02:00
Daniel	f3c3f47d99	fix: voice mode reads the answer that just arrived, and reads what the page shows ... Two bugs, one cause each. It read the previous answer. setBusy(false) is what announces assistant-answer-done, and it ran before lastAnswer was assigned — so every listener was handed the answer before last. It now fires after the answer exists both in that variable and on the page. A test asserts the order, because the order is the whole bug. And it read the markdown. The better answer than unpicking the markup is not to have any: the rendered bubble is already the answer with its headings, emphasis and tables resolved, so voice mode reads that. It cannot drift from what the reader is looking at, and it needs no rules about what "##" sounds like. Read from a clone, with the parts that are not the answer removed — the action buttons, the sources list, the follow-up suggestions, code blocks and tables — so the page itself is untouched. A bubble still thinking is never read. speakableText() stays as the fallback for when the bubble cannot be found, since raw markdown read aloud is worse than silence. Separately: e2e/seed.js hashed with bcrypt directly, so seeded accounts did not exercise the argon2id path production writes. It uses the app's own hasher now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 21:10:50 +02:00
Daniel	0e17f553fc	fix: hanging up the voice call stops the voice, and the answer is read not its markup ... Ending the call stopped listening and aborted the request but never stopped playback, and the <audio> element was a local variable with no handle kept — so nothing could stop it and the answer talked on until the page was reloaded. conversationMode now holds whatever is speaking, whichever of the two players it is, and hanging up silences it before anything else. Starting a new turn does the same, because speaking over the previous answer is how an assistant talks past you, and a reply that arrives after the overlay has closed no longer starts talking into a closed call. The other half: the raw answer went straight to the speaker. It is markdown, so a browser voice reads "#" and "**" aloud or stumbles over them. speakableText() now reduces it to what a person would read out — headings and bullets become sentences, links keep their words, emphasis and code fences are dropped, tables are dropped entirely because a table read aloud is noise, and a removed citation marker leaves no gap before the punctuation it preceded. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 20:52:35 +02:00
Daniel	b98ffc61c7	fix: expired invitations can be cleared too, revoked ones still cannot ... An expired code is as dead as a used one and just as accounted for, so it is now deletable. The rule the code enforces is the one that matters: a code that could still be redeemed is never deleted, because that takes it off the list without taking it out of anybody's inbox — the holder keeps something that looks valid, it quietly stops working, and nothing is left to say who had it. One condition, shared by the single delete and the bulk clear: (used_at IS NOT NULL OR (revoked_at IS NULL AND expires_at <= NOW())) Written that way rather than as "used OR past its date" because the second form also catches a revoked code whose date has since passed — a row the list still labels revoked and offers no delete on, so the button and the query would have disagreed about the same row. Revoked codes keep their rows. Revoking records a decision somebody took, and a handful of them is not the clutter a pile of expired codes is. Verified against the live database across every state: active refused, used deleted, expired deleted, revoked refused, and revoked-with-a-past-date refused rather than slipping through as expired. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 20:41:18 +02:00
Daniel	7b084c7edf	fix: an invitation can only be deleted once it has been used ... The delete button was offered on every invitation regardless of state, and the query behind it deleted any row it was given. Deleting an unused code takes it off the list without taking it out of anybody's inbox: the person still holds something that looks like a valid invitation, it silently stops working, and there is no longer a record of who it went to or why. Revoke is what stops a live code — it leaves the row behind, marked. So the delete is now for spent codes only, in three places rather than one: the query carries AND used_at IS NOT NULL, the route answers 409 with the reason instead of pretending the row is missing, and the button is rendered only on a used row. A "Clear N used" control alongside, since the complaint was clutter and clearing them one at a time is not much of an answer. Same rule — nothing unused or revoked is touched — and it confirms first, because it is still a delete. The bulk route is declared before /invites/:id, or Express reads "used" as an id. Verified against the live database: deleting an unused invitation is refused and the row survives, deleting a used one works, the bulk clear removes only used ones, and the unused probe row was still there afterwards. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 20:30:06 +02:00
Daniel	22683f3584	feat: sign in with a code emailed to you, offered beside the password ... The sign-in screen asks for an email first, then offers both ways in together: a six-digit code sent to that address, or the password. Beside rather than instead — a code depends on mail being delivered and a password does not, so neither may be the only route. "Use a different email" goes back a step, and creating an account stays where it was. What keeps it from being a second, weaker front door: - Only a bcrypt hash is stored, so a code read out of the database is not a working credential. - Ten minutes, single use, marked used before the session is issued so a replay cannot race it, and requesting a new one deletes the old. - Five wrong guesses burn it. Six digits is a million possibilities, which is plenty against a person and nothing against a script with unlimited tries. - Requesting a code answers identically whether or not the address exists, and every verify failure returns one message. A sign-in screen that says "no such account" is a way of finding out who has one. - Two-factor still applies: a code proves you can read the mailbox, which is one factor, and an account that asked for a second still wants it. - Its own rate limits, tighter for requesting than for attempting, because requesting sends mail to someone else's address. These had to be separate limiters: Express matches app.use paths on segment boundaries, so /api/auth/login does not cover /api/auth/login-code — checked against a real router rather than assumed. Two bugs found while building it, both mine: authFetch keeps an allowlist of endpoints callable with no verified owner and rejects everything else before it is sent. The new endpoints were not on it, so the request never left the browser and surfaced as "Connection error". reveal() hid elements by appending 'hidden' to className and showed them with a non-global replace, so hiding twice left two copies and showing stripped one. The "use a different email" link never reappeared. It uses classList now, which is idempotent. Verified against the running server: correct code signs in, the same code again is refused, a superseded code is refused, five wrong guesses burn it, an expired one is refused, and the stored value is a hash. In the browser: requesting a code advances the screen, a wrong code is refused without losing the screen, and the password route still signs in. Not yet demonstrated: a correct code typed into the browser. The harness keeps racing the one-live-code rule — the page's own request supersedes whatever code the test holds, and with SMTP off the delivered one cannot be read. The same request reaches the server on the wrong-code path, and the endpoint itself is verified, but that last step is untested end to end. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 20:12:03 +02:00
Daniel	1ad72b134b	feat: a resource can have several illustrations, on its own path ... My Resources used imageTool.dispatch, which permits exactly one image per request — "Only one image tool invocation is permitted per request". That is the right rule for a chat reply and the wrong one for a twelve-slide deck where the author asked for three figures. Rather than relax a limit the clinical assistant and the Learning Hub also depend on, this adds a separate dispatcher for this feature. Same queue, same storage, same my_resources workflow, same asset endpoint — only the number of figures differs, bounded at six because each one is a paid request. "Use 3 diagrams" in the instructions is read as the number it is, and the illustration option now says several are possible rather than promising one. Three things had to be got right, each found by measuring rather than assuming: The illustration guidance has to be the last thing in the prompt. Placed before the output rules it lost — with the tool offered and the paragraph present, the model returned 3297 characters of markdown and zero tool calls, while the same tool and wording in a shorter prompt produced three calls. Even last, it loses to a prompt carrying thirty library excerpts: deterministically, with the library off "use 3 diagrams" made three calls and with the library on it made none and wrote a longer deck instead. So when the author names a number the call is required rather than merely offered. With no number named the choice stays the model's. And a model that has just made three tool calls tends to sign off instead of writing: "I'll create the presentation and the three teaching diagrams." was returned as the resource — 61 characters — because only a completely empty body counted as missing. A body with no title block and no heading is not a Pandoc document whatever its length, and if the continuation is no better than the first attempt, whichever actually reads like a resource is kept. Verified end to end with the library on: generate produced three figures and an eight-slide deck; modify added two more figures and a ninth slide. The figures were fetched and looked at — labelled airway anatomy, and a croup/epiglottitis/ bacterial tracheitis comparison. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 19:19:22 +02:00
Daniel	055a86bbb1	feat: My Resources says what it is, offers its sources in one place, and Modify gets them too ... The screen had been trimmed to controls with no explanation of what it was for; "Private to you" said who could see it, not what it did. It now opens with a sentence that says what you get and how you get it out, and the header reads "Only you can see these". The four choices — clinical library, PubMed, web, illustration — are one "Draw on" group instead of four separate rows, with the library ticked by default. Each option hides itself when an administrator has not enabled it, so nothing appears that a person could tick and then be refused. Modify offers exactly the same choices. It had none, so "add what the 2024 trial showed" was answered from the model's memory rather than by looking anything up. Generate and Modify now go through one gatherSources(), so they cannot drift into offering different things or searching them differently. Writing "include a diagram of the airway" in the instructions now switches the illustration option on and says why, rather than the request being dropped in silence. Switching it off by hand sticks — the hint then reminds instead of fighting — and when no image model is configured it says so rather than pretending. Both the generate and modify boxes behave this way. Two things found by testing this rather than assuming it. PubMed ANDs every mapped term, so one unrecognised word takes the query to zero. "febrile seizures" returns six results and "febrile seizures in under-fives" returns none; "the anatomy of croup: subglottic narrowing and the steeple sign" returned none until it was narrowed to "anatomy croup", which returns six. A query that finds nothing is now retried against progressively shorter versions of itself, longest first, and the response says which query actually worked so the screen cannot report one that found nothing. Those extra calls tripped NCBI's three-a-second limit and produced a 429, so retries are spaced and the first attempt waits for nothing. Separately, the searches run on the topic while the library retrieval also gets the instruction: retrieval is semantic and benefits from the context, but a keyword engine handed a whole sentence returns nothing. And when a search was asked for and came back empty, the prompt now says not to invent a citation, a PMID or a URL to fill the gap. Without that the model supplies them from memory, and a fabricated PMID looks exactly like a real one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 18:54:17 +02:00
Daniel	8cca5a4796	feat: instructions can ask for the illustration; library scrolls and searches; Modify ... Three things to My Resources. Illustration was entirely the model's call: someone who wanted a figure of something particular had no way to say so, because the instructions steered the prose and nothing else. The illustration guidance now tells the model to follow the author's instructions when they ask for a figure or name what it should show, and to treat that as the decision already made. Verified live: "include a diagram showing the age distribution and the simple-versus-complex distinction" produced exactly that, both halves in one figure. Exactly one image per generation is a real limit, not a wording choice — the shared imageTool dispatcher rejects more than one tool call per request, and it is used by the assistant and Learning Hub too. So the prompt says to draw the single most useful one if several are asked for, and the screen says the same. The library was an unbounded list that pushed everything below it off the page. It is now a 360px scrolling box with a search over title and topic, filtered locally because the rows are already in hand. "Nothing yet" and "nothing matches" are different messages, because telling someone whose search missed that they have never generated anything is wrong. Measured in a real render: 360px visible of 642px of content, and searching narrows 10 rows to 3. Modify is new UI over the refine endpoint, which existed with no way to reach it. Pick a resource, say what to change, and it is rewritten in place keeping its id, its downloads and its References section. The picker is built from the same library array, so it cannot drift, and a selection survives the refresh that follows a generation. Verified live: "add a Key Takeaways slide before References" inserted exactly that and left the other four slides alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 17:49:27 +02:00
Daniel	1270899dcb	feat: PubMed search for My Resources, and an image tool that actually fires ... PubMed joins web search as an optional source for a generated resource: a literature search on the topic, with abstracts, cited by PMID in References. Off by default, admin-enabled, with its own optional API key (NCBI raises the rate limit from 3/sec to 10/sec; it works without one). Neither search is a tool any more, and that is the point. Offering them as function calls meant the model decided whether to search, and with a prompt ending "Output ONLY Pandoc markdown" it decided not to — every time, with and without corpus grounding, no matter how the tool description was worded. Calling callAI with the tool directly produced a correct pubmed_search call, so the plumbing was never the problem. The search only ever needed the topic, and the route knows the topic before it calls the model, so both searches now run up front and their results go into the prompt as findings, exactly the way corpus excerpts do. Ticking the box now means the search happened. Verified live against deepseek-v4-flash: 30 corpus excerpts and 6 PubMed results, and a References slide carrying both the library sources and four real PMIDs (29562151, 38506440, 35721052, 28814254). Three fixes to illustration, which had never once fired: - The dispatch call had been lost in a refactor. The tool was still offered, the model still called it, and the call was dropped, so no job was ever enqueued. - imageContext was passed as a bare topic string where dispatch expects { request, history }, which made the bound request undefined. - The prompt never mentioned the tool existed while explicitly demanding only markdown — the same suppression that killed the searches. It now says an illustration is available and that calling it is not a violation of that rule. my_resources is its own image workflow rather than a reuse of learning_hub, because generated_image_links only accepts learning_hub assets, and that is exactly the barrier that keeps a private illustration out of published content. The illustration renders in the panel, rather than a toast pointing at an image history this feature does not have. Verified end to end: job queued, rendered, and the asset served to its owner as a correctly labelled subglottic-anatomy teaching diagram. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 16:47:08 +02:00
Daniel	571a013d29	feat: optional web search, admin-enabled and off by default ... The one feature here that sends text outside the building, so the defaults are the careful ones: disabled unless an administrator turns it on, opt-in per generation even then, and the option is hidden entirely rather than shown as something a user can tick and be refused. Only the search query leaves. Library excerpts, the generated resource and anything about the user never do. Both screens say so plainly, because a topic typed while drafting clinical material can carry clinical detail and the provider keeps its own logs. Four providers behind one shape, so swapping changes nothing downstream: Tavily, Serper over Google, Brave, and SearXNG — the only one where the query does not reach a commercial third party at all, which is why it is worth supporting even though it needs somewhere to run. The tool description says when NOT to search, because a model handed a search tool will reach for it constantly: not for settled clinical knowledge, which is what the indexed library is for, and one search per resource. That last one is enforced in the route with toolChoice: 'none' on the continuation rather than trusted to the model. A failed search never fails a generation — same contract as corpus retrieval. The resource is written without it and the response says what was searched for and what came back, so a query that left the network is visible rather than silent. The API key is masked on read and preserved when the field is left blank, the handling the OIDC client secret already gets, so changing provider cannot silently wipe a working key. Verified on the running instance: with nothing configured, webSearchAvailable is false, and a request asking for it anyway is ignored rather than honoured. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 15:47:06 +02:00
Daniel	7eca509b02	fix: slides shrink to fit, and an article is never offered as slides ... A generated deck was losing content. pandoc writes a bare <a:bodyPr/> on every shape, which leaves the body with no autofit even though the slide master has one, so a slide with too much on it is cut off mid-sentence and the rest is not rendered at all. Reproduced and counted: eight bullets went in, three came out, the third ending mid-word. Every generated deck now carries <a:normAutofit/> on its body placeholders. No fontScale, deliberately — the renderer works out the reduction, so a slide that already fits is untouched, where a fixed scale would shrink all of them. The same eight bullets now fit with nothing in the bottom 6% of the slide. This is a floor, not a licence to overcrowd. The prompt still asks for one idea per slide; this stops a long one becoming unreadable. Also: an article is no longer offered as PowerPoint. A deck of paragraphs is not a presentation. Word and PDF suit either kind, and the route refuses the combination rather than relying on the button being absent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 15:34:16 +02:00
Daniel	fac8757ce8	feat: My Resources has a menu, a library and three downloads ... The pathway existed but was reachable only by API. It now has a tab of its own next to the Learning Hub — related, not the same thing, and sitting together is how someone discovers the difference — visible to every signed-in user with no role gate in the markup. Generate a deck or an article, see everything you have made, download each as PowerPoint, Word or PDF, delete what you no longer want. The screen says "Private to you" and "Nobody else sees these", because the distinction from published Learning content is the thing a person needs to understand before typing a patient's condition into it. Downloads are fetched rather than linked: an <a href> cannot carry the Authorization header. The blob is saved under the filename the server chose and the object URL is revoked afterwards. Resource titles come from a model, so rows are built as elements and a title is only ever assigned to textContent. The e2e stack now joins danvics_convert too. It could previously reach only Postgres and Redis, so a PDF download failed there in a way production would not — which did at least prove the degradation path works: with Gotenberg unreachable the response is "PDF conversion is unavailable right now. PowerPoint and Word still work", and the other two formats download unaffected. Verified in a browser as an ordinary user: the tab appears and opens, the form swaps slide count for word count when the format changes, the library lists their own work, and pptx, docx and pdf all download with sensible filenames (36360, 13285 and 68310 bytes). Also documents retrieval sizing in docs/retrieval-tuning.md — the per-feature budgets, and RERANKER_TOP_K, which caps all of them and had until now appeared in no configuration file at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 15:00:19 +02:00
Daniel	99a72734fb	feat: the Learning screen can ask for grounding, and says what it got ... The route accepted useCorpus and reported grounding, but nothing in the admin screen sent the flag or showed the result — so the feature existed and was unreachable. Opt-out in the UI rather than opt-in. For clinical teaching the library is nearly always the right source, so someone who never notices the checkbox should get the grounded version. The help text explains when to turn it OFF, which is the non-obvious case: a topic the library does not cover is better written without grounding than padded with the nearest unrelated excerpts. Afterwards it says what happened — "Written from 12 library excerpts", or "Not grounded — nothing indexed matched. Written from the model alone." Ungrounded material presented as grounded is the failure worth preventing here, so the wording never implies the library was used when it was not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 14:39:49 +02:00
Daniel	b3d66caaca	feat: a retried transcript goes back to the tab the audio came from ... Retrying a kept recording transcribed it and put the text on the clipboard, leaving you to find the right tab and paste. The app already had the answer: the module was recorded with the audio. Retry now opens that tab and puts the text in its transcript box. Two things had to be true first. The module was not actually being recorded. transcribeAudio never sent one, so the server stored its default for every upload — all 28 rows in audio_backups said "recording", and a retry had nowhere to send anything back to. Each module's call now tags its own upload. And the names disagreed. The recorders tagged 'encounter', 'soap', 'dictation' while the recording-started events said 'enc', 'sick', 'dict'. One table now holds the mapping and resolves the aliases, so the recorder that tags the upload, the backup row that labels it and the retry that delivers it cannot drift apart again. Existing text is appended to, never replaced: a retry usually recovers something on top of a live transcript, and overwriting would lose the words the browser did hear. The box only exists once its tab's markup has been fetched, so delivery polls briefly rather than guessing a delay, and falls back to the clipboard if the tab never opens. An empty result says so rather than claiming success. Backup rows now name their source and the button reads "Retry into SOAP Note" instead of "Retry". Verified in a browser: enc resolves to encounter, delivery switched tabs and produced 'existing live transcript\n\nRECOVERED TEXT'. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 12:39:50 +02:00
Daniel	fadf09bf4a	revert: remove the signed-out assistant preview ... Removed at the owner's request, entirely rather than switched off: the route's allow-list, anonymous identity and flag lookup; the client's entry path, the authFetch exception that let four endpoints out without an account, and the workspace guard; the CSS, the in-page note, the admin flag and its save/load; the test file and the assertions elsewhere that pinned it. Both settings rows are deleted from app_settings. Two things were checked rather than assumed on the way out. Removing the anonymous identity collapsed every `if (!req.user.preview)` branch to its authenticated side, so image tools, audit logging and citation storage now run unconditionally — which is what they did before preview existed. And the route's gate went back to a bare router.use(authMiddleware), which on a /api mount gates every path below it in server.js; it is scoped to /clinical-assistant again, the guard test catches it either way. Verified after deploy: signed out, status, examples and chat all refuse with 401; signed in, chat still answers with 8 sources; extensions, encounters, documents and admin remain shut. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 05:09:02 +02:00
Daniel	cd37a9d728	fix: the preview page rendered nothing ... /assistant in the address bar, the preview class on the body, and a blank screen. The app container starts hidden and enterApp is what reveals it; enterPreview declined the login overlay without doing the same, which left a hidden app under a hidden overlay. One line. Verified in a browser: composer, chat view, example prompts and the preview note are all visible and sized, with no page or console errors. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 04:55:30 +02:00
Daniel	004fb80a60	fix: the signed-out preview is reachable from the page, from any path ... The server side has worked since this morning, but no browser could reach it. authFetch rejects every /api request that has no account before it is sent, and the four preview endpoints were not on its short list — so the status call that decides whether to show the login screen never left the browser, and the screen was always shown. The list now mirrors the server's own allow-list exactly: status, examples, chat, chat/stream, and nothing else. Preview now begins from any path. A visitor landing on the root met the login wall while /assistant did not, which read as "preview doesn't work"; both now enter the assistant, and the URL follows. Reaching for anything that needs an account raises the sign-in screen through one hook in authFetch rather than a check on every control — but only for something the visitor did. The page also fetches saved chats and config in the background on load, and the first version raised the screen for those too, burying the assistant before a word was typed. The hook is gated on navigator.userActivation. The HIPAA notice is hidden on that screen in preview: it is an invitation to sign in, not the compliance notice a clinician sees on first login. Verified in a browser: landing on / and on /assistant both show the assistant with no login wall and no HIPAA text; clicking Workspace raises sign-in. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 04:40:40 +02:00
Daniel	96a6a353fc	fix: the assistant settings page says what saves what ... The card holds more than one Save button and nothing said so. "Save image settings" is injected directly above "Save model & retrieval settings", with no indication of where one stops and the other starts, and the page saves nothing automatically. It now states that up front, and the bottom button says which settings it applies. "Retry loading settings" sat beside Save looking like an ordinary control, because it did: a bare button with the hidden attribute, which the browser's own [hidden] rule could not hide once .btn-sm set a display. It is now inside an error message that exists only on failure, says what failed, and says that nothing typed has been lost. The status line used to read "Settings ready." forever, which answers a question nobody asks. It now reports the thing an admin actually wants to know when they come back: whether the last save went through, and at what time. A toast is gone in three seconds; this stays on the page. The signed-out preview moves to Feature Flags, where it belongs. It was a second checkbox under a row labelled "Sources", followed by two paragraphs, the first about preview and the second about citations — so neither paragraph clearly belonged to either checkbox. It is stored as feature.assistant_preview now, with the old clinical_assistant.preview_enabled still honoured when the new key has never been written. That also means an ordinary admin can toggle it under ADMIN_LOCKDOWN: clinical_assistant.* is locked, and putting a day-to-day switch behind host access was never the intent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 04:04:31 +02:00
Daniel	fed4bd154f	fix: recordings that produced nothing, and the boxes that zoomed on iOS ... Measured in a real browser against the app rather than reasoned about. The transcript boxes are contenteditable divs, and an editable div zooms on focus exactly like an <input>. The earlier 16px sweep covered input, textarea and select, so every workspace tab still zoomed while the calculators did not — which is exactly what was reported. Every focusable text control in every tab now measures 16px at phone width; the count of ones below it is zero. Three ways a recording could end with nothing to show for it: - Safari supports none of the audio/webm types and throws NotSupportedError when handed one. Six modules built their own recorder on resume with "opus, else audio/webm", so resuming threw there and the recording stopped. There is now one codec chain in the app, and no module constructs a MediaRecorder of its own. - audio-recorder-failed is dispatched on document, and the encounter tab stopped its recording on any of them. The assistant's microphone failing ended a consultation being recorded in another tab. The recorder now travels with the event and the listener checks it is its own. - The server answers {success:true, text:''} for silence, and five modules assigned that straight into the transcript — emptying the box the browser had been filling live. It reads as a recording that vanished. Text is now required before overwriting, and a recording that captured nothing says so instead of resetting the button over an empty box. Also: the citation counters were registered on prom-client's default registry while the app serves its own, so they were never scraped. They read zero at /metrics now instead of being absent, which is what the Grafana panels need. And the reference linter passes for the first time, so scripts/e2e.sh gets past its preflight: KaTeX is vendored (it was referenced by the assistant's LaTeX rendering but never shipped — three 404s a page load and no math), and the JavaScript left behind by the removed image picker, saved-chats toggle, image gallery and visual-output panel is gone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-11 00:16:19 +02:00
Daniel	050a7d5241	feat: citation quality tracking, and the SSO settings fit a phone ... Citation quality - A citation naming a source that never came back is never rendered as a link, so it appears as plain text and nobody learns it happened. It is now measured on the server, where the answer and the sources both exist, so it is seen whether or not a browser rendered it. - Four Prometheus counters feed a Grafana dashboard (Ped-AI Citation Quality): answers, citations written, answers affected, and individual unresolved markers. Only answers with at least one unresolved citation are stored, with the question and the titles retrieval returned, so an operator can judge whether retrieval came back thin or the model over-cited. Rows expire after 30 days: this is a quality signal, not a transcript log. - Both answer paths are covered. /chat/stream is normal; /chat is the fallback the client uses when streaming fails, so auditing only the first would have hidden exactly the answers produced under failure. - The tracker is resolved on demand and allowed to be absent. Seven test files load this route with a hand-built list of permitted imports, and adding a hard dependency would mean editing all seven — and the eighth written later would break. Observation must never be able to fail an answer, so a missing module simply means no tracking. - Metric registration reuses an already-registered counter, because this module can legitimately load twice in one process. SSO settings on mobile - Six rows were laid out inline: flex with a 160px label and an input that would not shrink, so on a phone the row was wider than the screen with nothing to scroll and no way to reach the rest. They use .admin-row now, which already stacks below 640px. Verified at 390px and 360px: nothing off-screen, no sideways overflow. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 23:44:43 +02:00
Daniel	272ea94768	feat: admin lockdown, so several admins do not all get to change everything ... With more than one admin, every setting in the panel was editable by all of them — prompts, model policy, retrieval budgets, SMTP, email templates. ADMIN_LOCKDOWN separates running the service from changing how it behaves. It is an environment variable on purpose: a setting could be switched off by the very admin it restrains, so lifting this needs host access and a restart. The server is the control. One gate refuses configuration writes rather than a check in each of the fifteen write routes, because that list grows and a route added later would quietly miss it. Reads always pass — lockdown hides nothing. Day-to-day operation stays available: invitations, announcements, registration, feature flags, and the test endpoints, which persist nothing. A setting invented later is locked until someone deliberately makes it editable, rather than defaulting to open. The panel disables what it cannot save and says why, but that is courtesy; the refusal is what enforces it. Two things this taught me, both fixed: my first version painted the panel from an IIFE, which the module conventions forbid, and fetched the whole config a second time just to read one flag — breaking the test that pins admin loaders firing exactly once. The state now rides on the invites response the panel already requests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 23:20:29 +02:00
Daniel	39c1663334	feat: invite-only registration ... registration_enabled was a single switch: open to anyone, or closed to everyone. This adds the setting an operator actually wants in between — open to people you invited. A code is single-use, expires (7 days by default, 90 maximum), and can be revoked or deleted. It is stored hashed with only its last four characters kept, because an invite grants account creation and a database dump should not hand someone a working one. The code is readable exactly once, in the response that creates it. The claim is a single conditional UPDATE carrying every condition, so two registrations racing the same code cannot both succeed. It happens after the account exists, so a code is never spent on a failed registration — and if the race is lost, the just-created account is removed rather than left behind as a free registration. The rejection never says which of the four reasons applied; distinguishing them would tell someone probing codes which guesses were closer. Codes avoid I, L, O and U so they survive being read aloud or copied off a screen, and matching ignores case and separators. The sign-up field appears only when the server says a code is required. The admin card creates, lists, revokes and deletes, and carries the toggle. Verified against the live database: create, claim, second claim refused, unknown code refused, revoking a used code refused, delete. 684 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 23:12:07 +02:00
Daniel	6dcdf36c81	fix: resolve a citation by its number, not its position in the array ... A marker names a source by the `number` dedupeSources assigns server-side. Rendering looked it up as sources[n - 1], which works only while the array order and the numbers agree. Nothing breaks that today, but it is an implicit contract across a network boundary: any later filtering or reordering of the list — hiding low-score sources, say — would point citations at the wrong source silently, which is worse than not linking at all. Matching on the number cannot drift. Positional lookup remains as the fallback for a list whose entries carry no number. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 19:10:54 +02:00
Daniel	e2444066a0	feat: the announcement banner renders Markdown, safely ... It was textContent, so formatting appeared literally. It now renders inline Markdown only — bold, italic, code, links, breaks — because this text is injected into every page and must not be able to introduce headings, images or block layout that shifts the app around. parseInline rather than parse, a tag allow-list, event-handler and style attributes forbidden, data attributes off, and one innerHTML assignment that can only be reached through DOMPurify. Missing either library, or any failure while rendering, falls back to the literal text rather than to unsanitised markup. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 19:08:12 +02:00
Daniel	80d468a85d	feat: a recording survives switching to the Assistant, and signing out keeps it ... Switching to the Assistant set window.location, which reloads the document and silently ended any running recording. The assistant is a tab in the same page and activateTab already rewrites the URL to /assistant, so the switch now happens in place; the reload stays as a fallback. Verified in Chromium: recorder still running, no reload, URL /assistant, assistant visible. Signing out mid-recording used to end it with nothing kept. It now says so first — "the audio will be saved for 24 hours so you can transcribe it later" — and stores the audio either way, tagged with the module that produced it ('encounter', 'soap', 'dictation'), which is what makes it findable in Settings afterwards. Sign-out completes whether or not the save worked, and the rescue never rejects, because the caller is on its way out. Verified: the warning appears and the upload carries module=encounter. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 16:54:01 +02:00
Daniel	523926ab17	feat: keep the screen awake while recording, and keep every recording 24h ... Recording - A screen wake lock is held for as long as a recording runs. Browsers drop the lock whenever the page is hidden, so it is taken again on return — without that, one glance away ended it for the session. The lock is reference counted (two recorders cannot release each other's), never requested while hidden (the request would just be rejected), and a denial or an unsupported browser leaves the recording running. - Signing out releases it and stops the recording; nothing is sent, because the session that owned the audio is gone. - start() on an already-running recorder is now a no-op instead of replacing the MediaRecorder and silently dropping everything captured so far. - A recording that ends by itself — recorder error, or the microphone taken by another app, unplugged or revoked — takes the same path as pressing Stop, so it is transcribed and stored rather than left in a tab that still says "recording". Moving around the workspace already kept recording. Retention - Every recording is kept for 24 hours now, not only the ones whose transcription failed. /api/transcribe already has the audio, so this costs no second upload, and a storage failure is logged rather than thrown: it must never lose the transcription someone is waiting for. - One store (src/utils/audioBackupStore.js) is shared by /api/transcribe and /api/audio-backups so the two cannot drift. Payload goes to object storage when AUDIO_BACKUPS_S3_* is set and to the encrypted Postgres column otherwise; metadata always stays in Postgres, so listing, ownership and expiry behave the same either way. Object keys are scoped by owner, and the expiry sweep deletes the object with the row. Verified against the live database: round trip byte-identical, another user reads null, 950 -> 48 bytes compressed, expired rows take their objects. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 16:42:31 +02:00
Daniel	48a3b06ebb	feat: export a recording; report a recorder that has silently died ... Export - Both stores already held the audio (server /audio-backups/:id/audio and the local IndexedDB record) but nothing exposed it, so a recording could not be taken out of the app. Each backup row now has a download, naming the file by its timestamp and using the extension actually recorded (webm, or m4a on iOS). A local record is only handed over to the account that owns it. Robustness - MediaRecorder had no onerror and nothing watched the audio track, so a recorder that failed, or a microphone claimed by another app, unplugged, or revoked, left the tab saying "recording" while capturing nothing. Both are now reported once, with the chunks captured so far kept, so stopping still returns the audio up to the failure. Deliberately not added: a wake lock. Stopping when the screen sleeps or the session ends is the intended behaviour — recording is meant to be deliberate, and nothing is left behind. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 15:58:58 +02:00
Daniel	cf7a3161a8	fix: stop iOS zoom, compact model control, quieter composer, better search ... iOS zoom (and the menu button scrolling away with it) - Safari zooms the whole page when a text field under 16px takes focus and never zooms back; while zoomed, fixed chrome sits outside the visual viewport, which is why the menu button had to be scrolled to. All 144 visible text controls were 13-15px. They are 16px on phones now. !important is deliberate: per-component rules like `.demo-field select` outrank any element selector, and a new component would slip through. - The composer set 15px AFTER its own mobile 16px rule, so at equal specificity the base rule won; the size is per breakpoint now. - Pinch-zoom is untouched: no user-scalable=no. Desktop unchanged (13/15px). Composer - "Ready" / "Looking up sources..." / "saved" repeated what the send button already shows by turning into Stop, and on a phone they wrapped under the model control. Kept in the DOM as live regions; nothing is drawn. - The model control shows the word "Model" (76px) instead of ids as long as "openrouter-gemini-3.1-flash-image-preview", and opens the full list on click. The select stays as the state holder, so choosing still saves through the same change event. Search - Nothing typed lists the 19 destinations only; sub-items appear once there is something to match. - Listing, matching and opening now read one attribute list instead of three that could drift, and bedside's emergency sections are searchable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 15:26:43 +02:00
Daniel	609305538a	fix: drop the dead admin jump links; stop a test flake at its source ... Admin links - The [data-admin-jump] click handler had been pasted inside discoverModels(), so it only registered once someone pressed Search in AI Model Management, and re-registered on every later search. Normally nothing intercepted the click, so href="#" did what it says: jump to the top and leave "#" in the URL. - This is an app, so the pointers are plain text naming the sections rather than links, and the handler is gone. Test flake - admin-clinical-assistant-wiring failed about 1 run in 4 with "Unable to deserialize cloned data due to invalid or unsupported version": node:test reads a test file's results back over the child's stdout, and app.js's own console.log landed inside a serialized frame. - The page's console is now forwarded to stderr (jsdom 29: forwardTo). Verified: child stdout clean, 0 failures in 32 stress runs (was 6 in 24), and three full-suite runs at 668/668. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU	2026-09-10 15:16:47 +02:00
Daniel	adcea2a0ca	fix: image models can be added and offered; solid phone top bar on iOS ... Image models - The Clinical Assistant "Image models" list waited on an old #assistant-image-model dropdown that no longer exists, so discovery never reached it and only four hard-coded fallbacks appeared — with no way to add any of the gateway's 50 image models. - Image Generation search rows now have + Add / Added. Added models are saved as clinical_assistant.image_model_roster (validated server-side: up to 100 ids) and appear in the Clinical Assistant list at once; ticking one there offers it to users. Anything already allowed or configured stays listed. Unsaved ticks survive an add. - The roster notification is guarded, so it can never fail the settings load. Phone top bar - The page is drawn under the status bar (viewport-fit=cover) and its theme colour was the removed header's blue, so on an iPhone content showed scrolling at the top of the screen. The row is now a real fixed element that extends behind the status bar (env(safe-area-inset-top), 0 in a normal tab), the menu button, sources pill and drawers clear it, and the theme colour is white. Verified in Chromium: + Add -> saved roster -> listed unticked; tick kept; remove works. Top bar is the only thing in the top 48px on all 22 pages; phone menu positions unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W4rptBNvn6RYieQw54GXNS	2026-09-10 13:46:19 +02:00
Daniel	6e0609f285	refactor: drop the "Saved Chats" header and collapse arrow from the rail ... The list is simply there now. Its collapse preference is removed too, so a list someone had collapsed cannot come back hidden with no control to open it. The header's CSS (desktop, phone and preview) goes with it. Sizes, measured in Chromium before and after: switch, New chat and the name card are unchanged (desktop card 848, phone 790). The list takes the header's 16px, and the first date heading sits 10px below New chat on both desktop (167 -> 151) and phone (173 -> 165; phone list top padding 2px -> 10px), matching the menu's 10px rhythm. The rail itself still never scrolls. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W4rptBNvn6RYieQw54GXNS	2026-09-10 13:27:29 +02:00
Daniel	f93994ad69	fix: collapsed strip, workspace-mode search, image dialog chat list ... - Collapsed menu: its own plain white 52px column against the tiled ground, no border line, in both views. Flat, it had no edge. - Collapsed + workspace launcher: assistant.css set the rail track to 0 and beat the 52px rule, so the collapsed menu (name card included) vanished. - Search follows the view, not the URL: the workspace launcher keeps /assistant, so Workspace searched chats. - Create image, "Base it on": a native <select> list is as wide as its longest option, so full titles pushed it past the dialog. Labels now keep the whole words that fit the select's width; the full title is on hover. Verified in Chromium: account menu items on top in all 8 states; collapsed strip 52px white with the name card at the same place in all 3 views; search placeholder and results per mode; dropdown widest label 500px in a 506px box (279 in 280 on a phone). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W4rptBNvn6RYieQw54GXNS	2026-09-10 13:17:50 +02:00
Daniel	f3a2309536	fix: one menu shape in both views, measured; phone menu follows the view ... Measured in real Chromium (1440x900 and 390x844) rather than inferred. Desktop - The assistant rail sat inside the content area's 14px padding, on the tiled ground. So its background differed from the workspace sidebar's, its name card sat 6px lower and further in, and the page was 28px taller than the window. It is now the same flush white sidebar with the same insets; the chat and sources panels carry the 14px. Measured: name card 848-892 at x=8, brand, switch and 210px width identical in both views, expanded and collapsed, with no page scroll. Phone - The menu button opens the chat history in the assistant (its drawer) and the workspace list elsewhere. In workspace mode the drawer lists the workspace links. Choosing a page, switching mode or pressing « closes it. - The drawer no longer scrolls as a whole: only the chat list does, so the name card is pinned at the foot, the same place as in the workspace menu (790-836 at x=12 in both). - Both menus are one plain shape: same width, text rows, grey current row, no "Menu" header and one close control. - The assistant page no longer overflows the phone by 16px. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W4rptBNvn6RYieQw54GXNS	2026-09-10 12:07:26 +02:00
Daniel	b8d2153cca	fix: phone menu links, Workspace pill and sources column; image model discovery ... Phone - The desktop collapse rules (52px icon rail) were unscoped, and menu-hidden is remembered across viewports, so after collapsing on a desktop the phone sheet opened with its links, the Assistant/Workspace switch and the account name all display:none. Scoped them to min-width:769px. - Workspace pill: the sheet now closes on tap, and the launcher is no longer display:none below 640px, so the pill opens the workspace instead of toggling a view that could never appear. - The menu button has its own 48px row instead of floating over the page; layouts subtract --mobile-bar (0px on desktop, so desktop is unchanged). - Sources open as their own scrollable band under that row, and the toggle sits in the row, instead of a sheet/FAB covering the composer. - The sheet uses dvh, so the account card is not pushed below the visible screen by the browser toolbar. Admin - Image Generation card beside TTS and STT: search the gateway's image models and test one. No Set button: an image model is chosen per workflow. It searches only on demand, so opening Admin still makes one discovery call. - Account card sits at the same height in every rail state; the model availability list points to where new models are added. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W4rptBNvn6RYieQw54GXNS	2026-09-10 11:39:32 +02:00
Daniel	2c9c2d12c0	fix: one mobile menu, and sources reachable on a phone ... Three faults, all visible on a phone at once. Two hamburgers, neither useful. The assistant added a drawer button of its own AND the app's button was still there, stacked on top of it. Worse, the assistant hid the app sidebar unconditionally, so the app's button opened something invisible. A phone now has exactly one menu — the app sidebar — and the assistant only replaces it with its own rail on desktop. The collapse control had nothing to collapse on a phone, where the menu is a sheet rather than a rail. It closes the sheet instead. Sources were `display:none` below 640px with no alternative, so every SRC chip in an answer pointed at nothing. They now slide up as a dismissible sheet, opened by a button that appears only when an answer actually has citations, or by tapping a citation itself. Tapping away or pressing Escape closes it — a sheet with no way out is a trap. The menu itself is sized for a thumb, borrowing the reference layout: a wide sheet, close and search leading, tappable rows, and padding clear of the home indicator. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0161xNW1z4vPusrXKGWcQdQu	2026-09-10 10:19:20 +02:00
Daniel	500fe2c12a	fix: image Done state, chat titles that keep whole words, and readable extension cards ... The Create image popup showed "Generating image…" forever even after the job finished. The status poll called fetchAssistantImageJob, which was never imported, so every tick threw ReferenceError — and the catch treated that like a transient network failure and rescheduled, permanently. The import is added, a test now asserts that every api.js function the assistant calls is actually imported, and the poll distinguishes a programming error (surface it) from a transient one (retry, but not forever). Chat titles were hard-cut at 60 characters mid-word, so "Rickets Radiographic Fea" was all the Create image picker could ever show. The server already allows 160, so titles now keep whole words up to that, and each view decides its own visible length from the width it actually has rather than inheriting one cut made at save time. A single very long token still falls back to a hard cut. Extension cards led with the number at 20px with word-break:break-all, so "5616/3764/5619" wrapped as "5616/3764/56 19" — unreadable, and unsafe to dial from. The name leads now, since that is what the eye hunts for in a list of fifty; the number follows in tabular figures and may only break between groups, never inside a run of digits. Cards share a minimum height so a grid reads as rows rather than a ragged mosaic. The collapsed rail's brand kept its expanded margin-right:auto, which pushed the stethoscope off the axis the two buttons sat on. Every child of the collapsed head is now the same centred fixed-size box. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018e1PLqrKgAM9jQhFKRnbLd	2026-09-10 06:44:22 +02:00
Daniel	2f7233f317	perf: store real image previews in MinIO, generated at creation and on demand ... Gallery tiles are 56px but were downloading the full ~280kB original. Previews are now rendered with sharp and stored beside the originals in the same MinIO bucket under a thumbs/ prefix, so nothing about credentials, lifecycle or backup changes. Measured on live assets: 216-294kB originals become 13-19kB at 256px, about 16x smaller; 640px is about 4x. Both paths, as asked: - Rendered when a job completes, so the first viewer never waits for a resize. A preview failure never unmakes a finished job. - Rendered on demand for anything that has none — the existing 26 images work immediately with no backfill required, and the result is stored for next time. Boundaries that matter more than the speed: - Only 256 and 640 are honoured. An open width parameter would let a caller drive arbitrary resizes. - Permission is checked against the ORIGINAL before a preview is served, so a preview can never widen who can see an image. - Previews carry their own SHA-256 and owner headers, because the client verifies both on every asset; sending the original's checksum would be rejected as tampering, which is that check working correctly. - Still private, no-store. The client asset pattern was widened to exactly ?w=256 and ?w=640 and nothing else. Client-side downscaling stays as the fallback when a preview cannot be produced. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018e1PLqrKgAM9jQhFKRnbLd	2026-09-10 06:39:30 +02:00
Daniel	2096057ebd	perf: cache generated images for the session and decode thumbnails, not originals ... Generated assets are served `private, no-store`, which is right for a clinical app on a shared workstation — but it meant every gallery render re-downloaded every image. Measured: 26 images averaging 279kB, so 7.2MB fetched to draw 56px tiles, on every open of the Create image popup. Two changes, both reusable anywhere in the app: - A session cache holding decoded blobs in MEMORY ONLY, so nothing is written to disk and the no-store posture is unchanged. Entries are keyed by owner ticket as well as asset, and cleared when the account boundary moves, so one account can never read another's bytes out of memory. Concurrent tiles asking for the same asset share one request rather than racing. - Any img carrying data-image-thumb gets a downscaled copy instead of the original, so a 56px tile no longer decodes a 300kB image. The gallery asks for 256px and the in-chat preview for 640px; opening the full view still gets the original. Browsers without OffscreenCanvas, and any decode failure, fall back to the full image rather than showing nothing. This does not reduce the first fetch. Serving genuinely smaller bytes needs server-side resizing, which needs an image library this project does not carry — worth a deliberate decision rather than adding a native dependency in passing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GmpYHPSLGmXGZMyLpn2Lbe	2026-09-10 05:20:10 +02:00
Daniel	531996de1e	feat: search finds what is inside a tab, and the menu head reads toggle, mark, search ... Search now reaches sub-navigation, because people look for "bili" rather than "Calculators". It reads whatever a loaded component exposes — data-calc, data-subtab, data-section — so it covers every tab with sub-navigation instead of one hard-coded list, and the relevant components are warmed when the palette opens. Opening a result survives the component still loading, and reaching one from the assistant navigates first and opens it after. Menu head order is now show/hide menu, then the mark, then search. In the collapsed rail every item is the same centred 52px box, so the icons finally share one axis — the brand was a flex row with a gap and sat off-centre from the buttons beneath it. Settings, FAQ and Admin are no longer listed in the menu: they already have a place in the account card, and listing them twice only made the tab list longer. Their sections remain, and activateTab already tolerates a tab whose section exists without a sidebar button. The retry loops are named functions rather than IIFEs, which the module entrypoint rules forbid. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GmpYHPSLGmXGZMyLpn2Lbe	2026-09-10 05:16:05 +02:00
Daniel	c7820c5ae6	feat: one shell for every view, no header bar, and a search palette ... The header bar is gone. Settings and Log out moved into the account card, so a whole band of chrome had nothing left to hold. The brand now heads the menu alongside the search and collapse controls, on one row rather than three stacked full-width ones. btn-settings and btn-logout are retained hidden as the canonical handlers other code already calls, rather than duplicating that logic. One shell for every view. Each tab was a plain white page while the assistant and the workspace launcher sat on a tiled card, so opening any menu item changed the whole face of the app. The tiled ground and the card edge now belong to .main-content, and only the contents differ. The assistant replaces the shell card rather than nesting a second one inside it. Search, in both views, from the same palette: the workspace searches the app menu, the assistant searches saved chats. Both sources are already in memory, so this needs no new endpoint. Cmd/Ctrl+K opens it, arrows and Enter work, and the assistant publishes its chats rather than the palette reaching into its internals. The collapse icon is now directional angles that rotate when collapsed, so it always states what the click will do; fa-table-columns said nothing. Mobile: the sidebar slides in whole, so the in-sidebar collapse control is hidden there, the account card sticks to the foot of a scrolling menu, and the palette is full-bleed instead of a centred dialog on a small screen. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GmpYHPSLGmXGZMyLpn2Lbe	2026-09-10 04:56:37 +02:00
Daniel	91699e45cb	feat: one menu for both views, a slim top bar, and an account card ... The view now decides only what the menu LISTS. Everything structural is shared, so switching redraws the content and nothing else: - One width. The app sidebar is 210px; the assistant rail was 260px, so every switch shifted the content sideways. - One surface. The tiled ground belongs to the shared panel rather than to one view's empty state, so the transcript and the workspace launcher sit on the same background. - One menu ending. An account card closes both menus with Settings, FAQ, Log out and — for admins only — Admin. These were unlabelled icon buttons in the old header; log out reuses the existing flow rather than a second implementation. The blue gradient header is now a slim white bar. Being the loudest element on screen, it made any view without it look like a different product. Everything measured against it follows from 66px to 52px. The composer has room around it and centres on an empty transcript instead of sitting at the very top, and Create image joins take home, export and attach in the + menu — it acts on the conversation, so it belongs with them rather than as its own button on the rail. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GmpYHPSLGmXGZMyLpn2Lbe	2026-09-10 04:45:51 +02:00
Daniel	db83255c58	feat: display-only sources toggle, signed-out preview, and a composer that carries the toolbar ... Sources (correcting what I built earlier) The previous toggle branched the SYSTEM PROMPT, so the same question could get a different answer depending on a display setting — the bias this was meant to avoid. The prompt is now unconditional: buildSystemPrompt takes no display argument and is byte-identical either way. Hiding sources happens on the way out — the server omits them and strips the now-orphaned [n] markers from the copy it sends. The answer is generated, stored and exported with citations intact, so turning the setting back on restores them without re-asking anything. Renamed to clinical_assistant.show_sources; the old key is still honoured. Signed-out preview (admin opt-in, default off) A visitor may try the assistant; reaching for the workspace asks them to sign in. Deliberately narrow: - Reachable paths are an exact allow-list, not a pattern, so a new endpoint is private unless someone adds it on purpose. - A preview visitor gets no identity at all (id: null), so nothing can be owned, saved, billed or addressed to them. - The image tool is withheld rather than left to fail on a null owner, and no audit rows are written. - A caller presenting a token is authenticated normally, so preview can never downgrade a real session; if the setting cannot be read, authentication is required. - Actions needing an account are hidden rather than offered and refused. Composer The bar above the transcript is gone. Patient take home, Export PDF, Download transcript and Attach images moved into a + menu in the composer, and the model selector moved beside send — shown only when there is more than one model, as before. Both views now start at the same top edge, so switching modes cannot nudge the page up or down. On an empty transcript the tiled ground runs behind and below the composer, which floats on it above centre. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GmpYHPSLGmXGZMyLpn2Lbe	2026-09-10 04:12:36 +02:00
Daniel	b9038eafcc	fix: the assistant loads again, the switch fits, and a hidden menu can be brought back ... Three faults from moving the switch into the app sidebar: 1. Clicking Assistant did nothing. activateTab() bailed unless a matching .tab-btn existed, and removing the "AI Assistant" nav entry removed exactly that — so every /assistant visit fell through to the fallback tab. A tab reached from the mode switch legitimately has a section without a button, so activateTab now keys off the section and only touches the button if present. 2. The switch overflowed its box. The sidebar is 210px; without min-width:0 the two buttons refused to shrink below their content. They now shrink, with a slightly tighter font and gap so both labels fit. 3. "Hide menu" had no way back. The toggle sits inside the sidebar it collapses, so it disappeared with it. It now leaves the collapsing box and pins itself beside the content, in both the app sidebar and the assistant rail, and the label already flips to "Show menu". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WjVc5oaAaYFNbZGLeJp6TX	2026-09-10 02:56:40 +02:00
Daniel	dd25e0edb7	feat: one Assistant/Workspace switch and one menu toggle, shared by both screens ... The app IS workspace mode, so the switch belongs in both places and the only difference between the two screens is which pill is highlighted: - The app sidebar's "AI Assistant" nav entry is replaced by the switch, with Workspace highlighted. The assistant rail carries the same control with Assistant highlighted. Clicking Assistant from the app navigates to /assistant; inside the assistant, Workspace opens the launcher in place. - Accent corrected: I had it backwards last round and turned the assistant purple. The app's accent is blue (.tab-btn.active in styles.css); the assistant now uses it throughout, so neither screen looks like a different product. Citation chips keep purple so evidence stays distinct from interactive blue. - One menu toggle labelled "Hide menu", shared by the app sidebar and the assistant rail. It replaces three separate controls: a pin button, a floating expand button, and the assistant's own rail toggle. The toggle stays reachable when the rail it collapses is hidden, or there would be no way back. - Workspace cards list clinical work only. Settings, FAQ, Admin, Docs and Content Manager stay in the app sidebar under Account, where they belong. - Model availability is discovery-only again: a hand-typed id cannot be verified at that point, so the manual entry field is gone. The in-page mode state machine is removed along with the whole class of hidden-versus-display bugs it carried. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WjVc5oaAaYFNbZGLeJp6TX	2026-09-10 02:39:42 +02:00
Daniel	41ceaca413	fix: actually merge assistant and workspace into one interface ... The mode switch was toggling the `hidden` attribute on elements that each carry their own `display:` rule. A class selector beats the UA stylesheet's [hidden]{display:none}, so every one of those toggles silently did nothing — which is why workspace mode still showed the chat, and why coming back never restored the saved-chat list. Every affected element was in that state. CSS now owns both modes from a single body class, in one block, and the JS does nothing but set that class. No element.hidden juggling remains. One accent. The assistant used --blue for user bubbles, focus rings, blockquotes and example pills while citations, cards and the mode switch used --purple, so the two halves read as two different apps. Purple was already dominant (23 uses to 6) and is the assistant's identity, so blue is gone entirely. Source cards pick up the same shape, shadow and hover accent as the workspace cards, and a targeted citation highlights in the accent instead of a bare border. Go back is removed from both the topbar and the rail: the Assistant/Workspace switch is how you leave now, and the dead handler went with it. Create image no longer takes a full-width gradient row competing with New chat; it is a square icon button beside it with a tooltip and an aria-label. Also guards the delegated document listeners against double registration. initIfNeeded already prevented a second bind in production, but nothing stopped a stray bindEvents() from double-firing every click — which is exactly what the test harness hit, activating a tab twice from one click. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WjVc5oaAaYFNbZGLeJp6TX	2026-09-10 01:41:53 +02:00
Daniel	1971436c26	feat: workspace mode keeps both the rail menu and the cards, merged into one look ... Both surfaces render from the same pass over the app's real .tab-btn list, so neither can drift from the menu it mirrors. - The card view now shares the empty state's graph-paper ground, card language and spacing, and is centred with a max width, so switching modes reads as the same app instead of a page that looks nothing like it. - Cards carry the clinical work tabs only: Settings, Admin, Docs and FAQ stay in the rail list, where someone looking for them will go, rather than sitting alongside Encounter HPI and Calculators. - On phones the card grid is hidden entirely and the chat stays on screen — the drawer already is the menu there, so a second copy only pushed it away. - The Sources column and its 330px grid track both go in workspace mode. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BkfrkQwA4YGrGw9LZSpeAq	2026-09-10 00:04:25 +02:00
Daniel	5940ebede7	fix: Workspace swaps the menu, it does not jump to a page of its own ... Workspace mode rendered the app menu twice — once in the rail and again as a card grid that replaced the chat column — so clicking it landed you somewhere that looked nothing like the assistant. There is one menu now: the rail swaps, the chat column stays where it is. The Sources panel was already hidden in workspace mode, but its 330px grid track was not, leaving an empty gutter. Both collapse states now drop the track. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BkfrkQwA4YGrGw9LZSpeAq	2026-09-10 00:00:12 +02:00