Remove the --gh flag from release.sh

release.sh --gh ran `gh release create` against GitHub. This project
publishes releases to Forgejo, and CI does it automatically on a v* tag
push (.forgejo/workflows/android-apk.yml attaches the signed APK for
Obtainium). The flag could not do anything useful here, and having it in
the usage text implied a manual publish step that does not exist.

Drops the flag, its DO_RELEASE branch, and the usage/header references.
--push remains the only option.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/api-reference.md

@@ -103,8 +103,7 @@ Authenticate a user. Supports optional TOTP two-factor authentication. On succes
   {
     "email": "string",
     "password": "string",
-    "totpCode": "string (optional, required if 2FA is enabled)",
+    "totpCode": "string (optional, required if 2FA is enabled)"
-    "turnstileToken": "string"
   }
   ```
 - **Response:**

docs/authentication.md

@@ -123,9 +123,23 @@ necessary UX tradeoff over perfect indistinguishability.
 
 ## Turnstile (Cloudflare bot protection)
 
-Applied to `/api/auth/login`, `/register`, `/forgot-password` when
+Applied to `/api/auth/register` and `/api/auth/forgot-password` when
 `TURNSTILE_SECRET_KEY` is set. No-op when unset (dev mode).
 
+`/api/auth/login` is deliberately **not** gated: the widget could not
+reliably complete a challenge inside the Capacitor WebView, which locked
+mobile users out of the app. Login is covered instead by its per-IP rate
+limit (10 / 15 min), the constant-time credential check, and TOTP 2FA.
+
+The two remaining widgets are rendered explicitly (`api.js?render=explicit`)
+the first time their form becomes visible — Turnstile does not reliably
+complete a challenge inside a `display:none` container, and both forms start
+hidden. Tokens are captured from the render callback, not read back out of
+the injected `[name="cf-turnstile-response"]` input.
+
+Note that the site key is currently **hardcoded** in `public/index.html`.
+`TURNSTILE_SITE_KEY` exists in OpenBao but is not read by any code.
+
 ## Encryption at rest
 
 `src/utils/crypto.js` provides AES-256-GCM helpers. Key loaded from

e2e/tests/session-persistence.spec.js

@@ -2,14 +2,15 @@
 // SESSION PERSISTENCE — full logout → login → still on the same
 // tab + same sub-pill.
 //
-// The UI's login form is gated by a Cloudflare Turnstile token
+// The test does a programmatic logout (clear the ped_auth cookie,
-// whose site key is hardcoded in index.html, which can't be
+// same effect server-side as clicking Logout) followed by a fresh
-// completed in the e2e container (Turnstile rejects the non-prod
+// programmatic login. This exercises the same localStorage
-// origin). So the test does a programmatic logout (clear the
+// persistence path a real logout/login would.
-// ped_auth cookie, same effect server-side as clicking Logout)
+//
-// followed by a fresh programmatic login — this exercises the
+// (Historically this was a workaround for the Turnstile challenge on
-// same localStorage persistence path a real logout/login would,
+// the login form, which could not be completed in the e2e container.
-// without depending on the bot challenge.
+// Login is no longer gated, but driving it programmatically keeps
+// the test focused on persistence rather than form mechanics.)
 // ============================================================
 
 const { test, expect, E2E_BASE, loginAs } = require('../fixtures');

mobile/android/app/build.gradle

@@ -9,8 +9,8 @@ android {
         targetSdkVersion rootProject.ext.targetSdkVersion
         // Version values below are overwritten by scripts/release.sh from
         // the root package.json. versionCode auto-increments per release.
-        versionCode 714011
+        versionCode 714016
-        versionName "7.14.11"
+        versionName "7.14.16"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.

mobile/android/app/src/main/java/com/pedshub/scribe/MainActivity.java

@@ -15,6 +15,8 @@ import android.print.PrintDocumentAdapter;
 import android.print.PrintManager;
 import android.provider.MediaStore;
 import android.util.Base64;
+import android.view.WindowManager;
+import android.webkit.CookieManager;
 import android.webkit.PermissionRequest;
 import android.webkit.WebChromeClient;
 import android.webkit.WebViewClient;
@@ -36,6 +38,11 @@ public class MainActivity extends BridgeActivity {
     private PermissionRequest pendingPermissionRequest;
     private WebView printWebView;
 
+    // True between startForegroundService() and stopForegroundService(), i.e.
+    // while the web app has an active MediaRecorder. Drives the keep-screen-on
+    // flag and the timer-throttling workaround below.
+    private volatile boolean recordingActive = false;
+
     @Override
     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
@@ -47,6 +54,9 @@ public class MainActivity extends BridgeActivity {
                     new String[]{ Manifest.permission.RECORD_AUDIO }, MIC_PERMISSION_CODE);
         }
 
+        // Allow the Cloudflare Turnstile iframe to use storage.
+        setupThirdPartyCookies();
+
         // Setup WebView mic permission granting
         setupWebViewPermissions();
 
@@ -60,6 +70,79 @@ public class MainActivity extends BridgeActivity {
         setupFileBridge();
     }
 
+    // ── Recording Lifecycle ────────────────────────────────────
+    //
+    // Recording happens in the WebView (MediaRecorder), not in native code,
+    // so keeping the foreground service alive is necessary but not sufficient
+    // — the WebView also has to keep executing JS. Two things protect that:
+    //
+    //  1. FLAG_KEEP_SCREEN_ON while recording, so the device does not
+    //     auto-lock mid-encounter. This is the case that actually bites
+    //     clinicians: a long pause in conversation and the screen times out.
+    //
+    //  2. resumeTimers() if the activity is paused anyway (user presses the
+    //     power button, or a call comes in). Chromium throttles timers hard
+    //     for hidden WebViews, which starves MediaRecorder's chunk delivery.
+    //     Capacitor never calls webView.onPause(), so the WebView itself is
+    //     still live — it is only the timers that need rescuing.
+    //
+    // Note resumeTimers()/pauseTimers() are process-global in WebView, not
+    // per-instance; calling resume here is safe because this app has no other
+    // WebView that wants throttling (printWebView is transient).
+
+    void setKeepScreenOn(final boolean on) {
+        runOnUiThread(() -> {
+            if (on) {
+                getWindow().addFlags(WindowManager.LayoutParams.FLAG_KEEP_SCREEN_ON);
+            } else {
+                getWindow().clearFlags(WindowManager.LayoutParams.FLAG_KEEP_SCREEN_ON);
+            }
+        });
+    }
+
+    void setRecordingActive(boolean active) {
+        recordingActive = active;
+        setKeepScreenOn(active);
+    }
+
+    // NB: BridgeActivity declares these public — narrowing to protected would
+    // not compile.
+    @Override
+    public void onPause() {
+        super.onPause();
+        if (recordingActive && this.bridge != null && this.bridge.getWebView() != null) {
+            this.bridge.getWebView().resumeTimers();
+        }
+    }
+
+    @Override
+    public void onResume() {
+        super.onResume();
+        if (this.bridge != null && this.bridge.getWebView() != null) {
+            this.bridge.getWebView().resumeTimers();
+        }
+    }
+
+    // ── Third-Party Cookies ────────────────────────────────────
+    //
+    // Android WebView blocks third-party cookies by default (unlike Chrome,
+    // which still allows them for now). Cloudflare Turnstile runs inside a
+    // cross-origin iframe from challenges.cloudflare.com and needs its own
+    // storage to run and persist a challenge — without this the widget
+    // silently stalls or errors and never emits a token, so registration and
+    // password reset are impossible from inside the app.
+    //
+    // This is scoped to our own WebView, which only ever loads the PedScribe
+    // origin (see allowNavigation in capacitor.config.json), so it is not a
+    // general relaxation of the app's cookie policy.
+
+    private void setupThirdPartyCookies() {
+        WebView webView = this.bridge.getWebView();
+        CookieManager cookieManager = CookieManager.getInstance();
+        cookieManager.setAcceptCookie(true);
+        cookieManager.setAcceptThirdPartyCookies(webView, true);
+    }
+
     // ── WebView Microphone Permission ──────────────────────────
 
     private void setupWebViewPermissions() {
@@ -124,6 +207,7 @@ public class MainActivity extends BridgeActivity {
         public void startForegroundService() {
             Intent intent = new Intent(activity, AudioRecordingService.class);
             ContextCompat.startForegroundService(activity, intent);
+            activity.setRecordingActive(true);
         }
 
         @android.webkit.JavascriptInterface
@@ -131,6 +215,17 @@ public class MainActivity extends BridgeActivity {
             Intent intent = new Intent(activity, AudioRecordingService.class);
             intent.setAction(AudioRecordingService.ACTION_STOP);
             activity.startService(intent);
+            activity.setRecordingActive(false);
+        }
+
+        // Standalone keep-awake, exposed so the web app can hold the screen on
+        // for non-recording work too. window.nativeKeepAwake() previously
+        // called Capacitor's KeepAwake plugin, which is not installed in this
+        // project — so it silently did nothing and the screen slept during
+        // recordings.
+        @android.webkit.JavascriptInterface
+        public void keepAwake(boolean on) {
+            activity.setKeepScreenOn(on);
         }
     }
 

mobile/android/app/src/main/res/values/styles.xml

@@ -13,7 +13,7 @@
     <style name="AppTheme.NoActionBar" parent="Theme.AppCompat.DayNight.NoActionBar">
         <item name="windowActionBar">false</item>
         <item name="windowNoTitle">true</item>
-        <item name="android:background">@null</item>
+        <item name="android:background">@color/colorPrimary</item>
         <item name="android:statusBarColor">@color/colorPrimaryDark</item>
         <item name="android:navigationBarColor">@color/colorPrimaryDark</item>
     </style>

mobile/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pedscribe-mobile",
-  "version": "7.14.11",
+  "version": "7.14.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pedscribe-mobile",
-      "version": "7.14.11",
+      "version": "7.14.14",
       "dependencies": {
         "@aparajita/capacitor-biometric-auth": "^8.0.0",
         "@capacitor/android": "^6.0.0",

mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pedscribe-mobile",
-  "version": "7.14.11",
+  "version": "7.14.16",
   "description": "PedScribe native mobile app — Capacitor wrapper for Pediatric AI Scribe",
   "private": true,
   "scripts": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pediatric-ai-scribe",
-  "version": "7.14.11",
+  "version": "7.14.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pediatric-ai-scribe",
-      "version": "7.14.11",
+      "version": "7.14.14",
       "dependencies": {
         "@marp-team/marp-cli": "^4.3.1",
         "@marp-team/marp-core": "^4.3.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pediatric-ai-scribe",
-  "version": "7.14.11",
+  "version": "7.14.16",
   "description": "AI-powered pediatric clinical documentation platform",
   "main": "server.js",
   "scripts": {

public/components/wellvisit.html

@@ -11,6 +11,9 @@
           <button class="wv-subtab-btn" data-subtab="milestones">
             <i class="fas fa-baby"></i> Milestones
           </button>
+          <button class="wv-subtab-btn" data-subtab="lincoln">
+            <i class="fas fa-clipboard-list"></i> Lincoln
+          </button>
           <button class="wv-subtab-btn" data-subtab="shadess" style="display:none;">
             <i class="fas fa-brain"></i> SSHADESS (12+)
           </button>
@@ -119,6 +122,65 @@
 
         </div>
 
+        <!-- Lincoln quick-reference sub-panel -->
+        <div id="wv-panel-lincoln" class="wv-subpanel hidden">
+          <div class="card" style="margin-bottom:10px;">
+            <div class="card-header output-header">
+              <h3><i class="fas fa-clipboard-list"></i> Lincoln Well-Child Quick Reference</h3>
+              <div class="output-actions">
+                <button class="btn-sm btn-primary" data-action="copy" data-target="wv-lincoln-reference"><i class="fas fa-copy"></i> Copy</button>
+              </div>
+            </div>
+            <div id="wv-lincoln-reference" class="wv-lincoln-reference">
+              <div class="wv-lincoln-grid">
+                <section class="wv-lincoln-card">
+                  <h4>Infancy</h4>
+                  <ul>
+                    <li><strong>Newborn:</strong> POC visit; check for jaundice.</li>
+                    <li><strong>2 weeks:</strong> weight gain, newborn screen, umbilicus check.</li>
+                    <li><strong>1 month:</strong> maternal PHQ-9.</li>
+                    <li><strong>2 months:</strong> Vaxelis, rotavirus, Prevnar.</li>
+                    <li><strong>4 months:</strong> Vaxelis, rotavirus, Prevnar.</li>
+                    <li><strong>6 months:</strong> routine vaccines and Prevnar; confirm rotavirus eligibility by product and age.</li>
+                    <li><strong>9 months:</strong> SWYC; no routine vaccines noted.</li>
+                  </ul>
+                </section>
+
+                <section class="wv-lincoln-card">
+                  <h4>Toddler / Preschool</h4>
+                  <ul>
+                    <li><strong>12 months:</strong> MMR, varicella, Hep A; CBC and lead.</li>
+                    <li><strong>15 months:</strong> Pentacel, Prevnar, influenza.</li>
+                    <li><strong>18 months:</strong> POSI, SWYC; Hep A second dose.</li>
+                    <li><strong>2 years:</strong> POSI/SWYC; CBC and lead.</li>
+                    <li><strong>3 years:</strong> blood pressure check and vision screening; BP is commonly missed and can be added on diagnosis.</li>
+                    <li><strong>4 years:</strong> hearing and vision start; ProQuad and Kinrix.</li>
+                  </ul>
+                </section>
+
+                <section class="wv-lincoln-card">
+                  <h4>School Age / Adolescence</h4>
+                  <ul>
+                    <li><strong>Lipid screening:</strong> AAP screening at 9-11 years and 17-21 years.</li>
+                    <li><strong>Depression screening:</strong> begin at 12 years and older.</li>
+                    <li><strong>MenB:</strong> discuss Bexsero/MenB at 16-23 years, preferably 16-18 years, when chosen or indicated.</li>
+                    <li><strong>Age &ge;18 years:</strong> Hep C testing.</li>
+                    <li><strong>Cervical cancer screening:</strong> start Pap smear screening at 21 years.</li>
+                  </ul>
+                </section>
+
+                <section class="wv-lincoln-card">
+                  <h4>Catch-Up / Screening Reminders</h4>
+                  <ul>
+                    <li><strong>Influenza:</strong> if a child 6 months through 8 years needs 2 doses, give doses 4 weeks apart.</li>
+                    <li><strong>Lead:</strong> continue lead screening reminders through age 6 years; add diagnosis when needed.</li>
+                  </ul>
+                </section>
+              </div>
+            </div>
+          </div>
+        </div>
+
         <!-- SSHADESS sub-panel (age 12+) -->
         <div id="wv-panel-shadess" class="wv-subpanel hidden">
           <div class="card" style="margin-bottom:10px;">
@@ -305,4 +367,3 @@
             </div>
           </div>
         </div>
-

public/css/styles.css

@@ -397,6 +397,21 @@ textarea.full-input{resize:vertical;}
 .wv-section-title{font-size:14px;font-weight:700;color:var(--g700);margin-bottom:12px;display:flex;align-items:center;gap:8px;}
 .wv-section-title i{color:var(--blue);}
 
+/* Lincoln quick reference */
+.wv-lincoln-reference{padding:14px 16px;background:var(--g50);}
+.wv-lincoln-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(250px,1fr));gap:14px;}
+.wv-lincoln-card{border:1px solid var(--g100);border-radius:12px;padding:14px 16px;background:white;box-shadow:0 1px 2px rgba(15,23,42,0.04);}
+.wv-lincoln-card h4{margin:0 0 10px;font-size:14px;color:var(--g800);}
+.wv-lincoln-card ul{margin:0;padding-left:18px;color:var(--g700);font-size:13px;line-height:1.65;}
+.wv-lincoln-card li{margin-bottom:6px;}
+.wv-lincoln-card li:last-child{margin-bottom:0;}
+@media(max-width:640px){
+  .wv-lincoln-reference{padding:10px;}
+  .wv-lincoln-grid{grid-template-columns:1fr;gap:10px;}
+  .wv-lincoln-card{padding:12px;}
+  .wv-lincoln-card ul{font-size:12.5px;line-height:1.55;}
+}
+
 /* Billing */
 .wv-billing-grid{display:flex;flex-wrap:wrap;gap:12px;align-items:center;}
 .wv-billing-cell{display:flex;align-items:center;gap:8px;}

public/index.html

@@ -11,7 +11,11 @@
   <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&display=swap" rel="stylesheet">
   <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css"
         integrity="sha384-/o6I2CkkWC//PSjvWC/eYN7l3xM3tJm8ZzVkCOfp//W05QcE3mlGskpoHB6XqI+B" crossorigin="anonymous" referrerpolicy="no-referrer">
-  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+  <!-- Explicit render mode: the register/forgot widgets live inside forms that
+       start hidden, and Turnstile's implicit auto-render does not reliably
+       complete a challenge inside a display:none container. auth.js renders
+       each widget the first time its form is shown. -->
+  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit" async defer></script>
   <script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/3.1.6/purify.min.js"
           integrity="sha384-+VfUPEb0PdtChMwmBcBmykRMDd+v6D/oFmB3rZM/puCMDYcIvF968OimRh4KQY9a"
           crossorigin="anonymous" referrerpolicy="no-referrer" defer></script>
@@ -70,7 +74,6 @@
           <label>2FA Code</label>
           <input type="text" id="login-totp" placeholder="6-digit code" maxlength="6">
         </div>
-        <div class="cf-turnstile" id="turnstile-login" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6" data-theme="light"></div>
         <button type="submit" class="btn-auth" id="btn-local-login">Sign In</button>
         <div id="sso-divider" class="hidden" style="display:none;text-align:center;margin:16px 0 12px;position:relative;">
           <span style="background:white;padding:0 12px;color:#9ca3af;font-size:12px;position:relative;z-index:1;">or</span>
@@ -104,7 +107,7 @@
           <label>Password (8+ characters)</label>
           <input type="password" id="reg-password" required minlength="8" placeholder="••••••••">
         </div>
-        <div class="cf-turnstile" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6" data-theme="light"></div>
+        <div id="turnstile-register" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6"></div>
         <button type="submit" class="btn-auth">Create Account</button>
         <div class="auth-links">
           <a href="#" id="show-login">Back to sign in</a>
@@ -118,7 +121,7 @@
           <label>Email</label>
           <input type="email" id="forgot-email" required placeholder="your@email.com">
         </div>
-        <div class="cf-turnstile" id="turnstile-forgot" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6" data-theme="light"></div>
+        <div id="turnstile-forgot" data-sitekey="0x4AAAAAAC0VtKAhC8rzpMx6"></div>
         <button type="submit" class="btn-auth">Send Reset Link</button>
         <div class="auth-links">
           <a href="#" id="show-login-2">Back to sign in</a>
@@ -131,7 +134,7 @@
       </div>
 
       <div id="apk-download-link" style="text-align:center;margin:14px 0 0;font-size:13px;">
-        <a href="https://github.com/ifedan-ed/pediatric-ai-scribe-v3/releases/latest" target="_blank" rel="noopener" style="color:#2563eb;text-decoration:none;font-weight:500;">
+        <a href="https://git.danvics.com/danvics/pediatric-ai-scribe-v3/releases/latest" target="_blank" rel="noopener" style="color:#2563eb;text-decoration:none;font-weight:500;">
           <i class="fas fa-mobile-screen"></i> Download Android app (APK)
         </a>
       </div>

public/js/app.js

@@ -600,9 +600,19 @@ window.nativeStopRecordingService = function() {
   try { if (window.NativeRecording) window.NativeRecording.stopForegroundService(); } catch(e) {}
 };
 
-// Keep screen awake during recording (Capacitor KeepAwake or InsomniaCap)
+// Keep screen awake during recording.
+//
+// Prefer the NativeRecording bridge (addJavascriptInterface, so it is present
+// on the remote origin the launcher navigates to). The Capacitor KeepAwake
+// plugin is kept as a fallback but is NOT installed in this project — relying
+// on it alone meant this function silently did nothing and the screen slept
+// mid-recording, killing the MediaRecorder.
 window.nativeKeepAwake = function(on) {
   try {
+    if (window.NativeRecording && typeof window.NativeRecording.keepAwake === 'function') {
+      window.NativeRecording.keepAwake(!!on);
+      return;
+    }
     if (window.Capacitor && window.Capacitor.Plugins && window.Capacitor.Plugins.KeepAwake) {
       if (on) window.Capacitor.Plugins.KeepAwake.keepAwake();
       else window.Capacitor.Plugins.KeepAwake.allowSleep();

public/js/assistant/images.js

@@ -5,9 +5,9 @@ export function createAssistantImageStore() {
   var generatedImageSeq = 0;
   var previewKeyHandler = null;
 
-  function renderGeneratedImage(src, alt) {
+  function renderGeneratedImage(src, alt, downloadUrl) {
     var id = 'img-' + (++generatedImageSeq);
-    generatedImages[id] = src;
+    generatedImages[id] = { src: src, downloadUrl: downloadUrl || '' };
     return '<div class="assistant-generated-image"><img src="' + escapeAttr(src) + '" alt="' + escapeAttr(alt || 'Generated image') + '">' +
       '<div class="assistant-image-actions">' +
       '<button type="button" class="btn-sm btn-ghost" data-assistant-open-image="' + escapeAttr(id) + '"><i class="fas fa-expand"></i> Preview</button>' +
@@ -16,7 +16,8 @@ export function createAssistantImageStore() {
   }
 
   function openImagePreview(id) {
-    var src = generatedImages[id];
+    var item = generatedImages[id];
+    var src = item && (item.src || item);
     if (!src) return;
     closeImagePreview();
     var modal = document.createElement('div');
@@ -41,14 +42,24 @@ export function createAssistantImageStore() {
   }
 
   async function downloadImage(id) {
-    var src = generatedImages[id];
+    var item = generatedImages[id];
+    var src = item && (item.src || item);
+    var downloadUrl = item && item.downloadUrl;
     if (!src) return;
     try {
+      if (downloadUrl) {
+        await downloadFromServer(downloadUrl);
+        return;
+      }
       if (await saveWithNativeShare(src)) return;
       if (isNativeApp()) {
         if (typeof window.showToast === 'function') window.showToast('Image saving is not available in this app build yet. Update the app and try again.', 'error');
         return;
       }
+      if (isMobileBrowser()) {
+        if (typeof window.showToast === 'function') window.showToast('Mobile browser download is not supported here. Use Preview and long-press the image to save it.', 'info');
+        return;
+      }
       await downloadWithBrowser(src);
     } catch (e) {
       if (typeof window.showToast === 'function') window.showToast(e.message || 'Image download failed', 'error');
@@ -123,7 +134,7 @@ async function saveWithCapacitorShare(src) {
     if (typeof window.showToast === 'function') window.showToast('Image prepared', 'success');
     return true;
   } catch (e) {
-    if (typeof window.showToast === 'function') window.showToast('Could not save with the app. Opening browser download instead.', 'error');
+    if (typeof window.showToast === 'function') window.showToast('Could not save with the app. Use Preview and long-press the image to save it.', 'error');
     return false;
   }
 }
@@ -136,10 +147,14 @@ async function shareWithWebFile(src) {
     if (!navigator.canShare({ files: [file] })) return 'unavailable';
     await navigator.share({ files: [file], title: 'Clinical visual', text: 'Clinical Assistant generated visual' });
     return 'shared';
-  } catch (e) { return isShareCancel(e) ? 'cancelled' : 'unavailable'; }
+  } catch (e) { return isShareCancel(e) ? 'unavailable' : 'unavailable'; }
 }
 
 async function downloadWithBrowser(src) {
+  if (isMobileBrowser()) {
+    if (typeof window.showToast === 'function') window.showToast('Mobile browser download is not supported here. Use Preview and long-press the image to save it.', 'info');
+    return;
+  }
   var blob = await imageSourceToBlob(src);
   var objectUrl = URL.createObjectURL(blob);
   var a = document.createElement('a');
@@ -150,10 +165,79 @@ async function downloadWithBrowser(src) {
   a.click();
   a.remove();
   setTimeout(function() { URL.revokeObjectURL(objectUrl); }, 60000);
+}
 
-  if (isMobileBrowser() && typeof window.showToast === 'function') {
+async function downloadFromServer(url) {
-    window.showToast('If the download did not start, use Preview and long-press the image to save it.', 'info');
+  var response = await fetch(url, { headers: authHeadersForDownload(), credentials: 'same-origin' });
+  if (!response.ok) throw new Error('Image download failed');
+  var blob = await response.blob();
+  var name = 'clinical-visual-' + new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19) + '.png';
+  if (await saveBlobWithNativeImageBridge(blob, name)) return;
+  if (await saveBlobWithCapacitorShare(blob, name)) return;
+  if (await shareBlobWithWebFile(blob, name)) return;
+  if (isMobileBrowser()) {
+    if (typeof window.showToast === 'function') window.showToast('Could not start download here. Use Preview and long-press the image to save it.', 'error');
+    return;
   }
+  downloadBlobWithAnchor(blob, name);
+}
+
+function authHeadersForDownload() {
+  var headers = window.getAuthHeaders ? window.getAuthHeaders() : {};
+  var clean = {};
+  Object.keys(headers || {}).forEach(function(key) {
+    if (key.toLowerCase() !== 'content-type') clean[key] = headers[key];
+  });
+  return clean;
+}
+
+async function saveBlobWithNativeImageBridge(blob, name) {
+  if (!window.NativeFiles || typeof window.NativeFiles.saveImage !== 'function') return false;
+  try {
+    var base64 = await blobToBase64(blob);
+    var result = String(window.NativeFiles.saveImage(name, base64) || '');
+    if (result.indexOf('saved:') === 0) {
+      if (typeof window.showToast === 'function') window.showToast('Image saved to Photos', 'success');
+      return true;
+    }
+  } catch (e) {}
+  return false;
+}
+
+async function saveBlobWithCapacitorShare(blob, name) {
+  var plugins = window.Capacitor && window.Capacitor.Plugins ? window.Capacitor.Plugins : null;
+  if (!plugins || !plugins.Filesystem) return false;
+  try {
+    var base64 = await blobToBase64(blob);
+    var saved = await plugins.Filesystem.writeFile({ path: name, data: base64, directory: 'CACHE' });
+    if (plugins.Share && saved && saved.uri) {
+      await plugins.Share.share({ title: 'Clinical visual', text: 'Clinical Assistant generated visual', url: saved.uri, dialogTitle: 'Save or share clinical visual' });
+    }
+    if (typeof window.showToast === 'function') window.showToast('Image prepared', 'success');
+    return true;
+  } catch (e) { return false; }
+}
+
+async function shareBlobWithWebFile(blob, name) {
+  if (!navigator.share || !navigator.canShare || typeof File === 'undefined') return false;
+  try {
+    var file = new File([blob], name, { type: blob.type || 'image/png' });
+    if (!navigator.canShare({ files: [file] })) return false;
+    await navigator.share({ files: [file], title: 'Clinical visual', text: 'Clinical Assistant generated visual' });
+    return true;
+  } catch (e) { return false; }
+}
+
+function downloadBlobWithAnchor(blob, name) {
+  var objectUrl = URL.createObjectURL(blob);
+  var a = document.createElement('a');
+  a.href = objectUrl;
+  a.download = name;
+  a.rel = 'noopener';
+  document.body.appendChild(a);
+  a.click();
+  a.remove();
+  setTimeout(function() { URL.revokeObjectURL(objectUrl); }, 60000);
 }
 
 function isMobileBrowser() {
@@ -172,6 +256,10 @@ function isShareCancel(error) {
 async function imageSourceToBase64(src) {
   if (/^data:image\//i.test(src)) return src.split(',')[1] || '';
   var blob = await imageSourceToBlob(src);
+  return blobToBase64(blob);
+}
+
+async function blobToBase64(blob) {
   return new Promise(function(resolve, reject) {
     var reader = new FileReader();
     reader.onload = function() { resolve(String(reader.result || '').split(',')[1] || ''); };

public/js/auth.js

@@ -47,50 +47,86 @@ document.addEventListener('DOMContentLoaded', function() {
   // 2FA still applies on top: biometric replaces the password step but
   // a 2FA-enabled account still gets the TOTP prompt afterwards. That
   // is the intended defense-in-depth.
-  var BIO_SERVER = 'pedscribe-bio';        // namespace for the keychain/keystore item
+  // Two plugins cooperate here, because the one that does the biometric
+  // prompt does not store anything:
+  //   - BiometricAuthNative (@aparajita/capacitor-biometric-auth) — presents
+  //     the Face ID / fingerprint prompt. checkBiometry() + authenticate().
+  //   - SecureStoragePlugin (capacitor-secure-storage-plugin), via the
+  //     window.SecureStorage wrapper — holds the credentials in the iOS
+  //     Keychain / Android EncryptedSharedPreferences.
+  //
+  // This previously called window.Capacitor.Plugins.NativeBiometric, the API
+  // of capacitor-native-biometric — a package that is not a dependency of this
+  // project. The plugin object was always undefined, so bioAvailable() always
+  // resolved {ok:false} and the biometric button was never revealed. The
+  // feature has been dead since it was written.
+  var BIO_CREDS_KEY   = 'ped_bio_creds';   // SecureStorage key holding {username,password}
   var BIO_ENABLED_KEY = 'ped_bio_enabled'; // localStorage flag — used to decide whether to even probe
+
+  // BiometryType enum from the plugin (numeric) → human label.
+  var BIO_TYPE_NAMES = {
+    1: 'Touch ID',
+    2: 'Face ID',
+    3: 'fingerprint',
+    4: 'face recognition',
+    5: 'iris recognition'
+  };
+
   function bioPlugin() {
     try {
       if (!isNativeApp()) return null;
-      var p = window.Capacitor && window.Capacitor.Plugins && window.Capacitor.Plugins.NativeBiometric;
+      var p = window.Capacitor && window.Capacitor.Plugins && window.Capacitor.Plugins.BiometricAuthNative;
       return p || null;
     } catch (e) { return null; }
   }
   function bioAvailable() {
     var p = bioPlugin();
     if (!p) return Promise.resolve({ ok: false });
-    return p.isAvailable()
+    return p.checkBiometry()
-      .then(function (r) { return { ok: !!(r && r.isAvailable), type: r && r.biometryType }; })
+      .then(function (r) {
+        return {
+          ok: !!(r && r.isAvailable),
+          type: r && r.biometryType,
+          typeName: (r && BIO_TYPE_NAMES[r.biometryType]) || 'biometric'
+        };
+      })
       .catch(function () { return { ok: false }; });
   }
   function bioStored() {
     // Cheap check first — was biometric ever enrolled? If not, skip the
-    // verifyIdentity prompt path entirely so we don't rattle the user.
+    // prompt path entirely so we don't rattle the user.
     try { return localStorage.getItem(BIO_ENABLED_KEY) === '1'; } catch (e) { return false; }
   }
   function bioEnroll(email, password) {
-    var p = bioPlugin();
+    if (!bioPlugin()) return Promise.reject(new Error('Biometric plugin unavailable'));
-    if (!p) return Promise.reject(new Error('Biometric plugin unavailable'));
+    if (!window.SecureStorage) return Promise.reject(new Error('Secure storage unavailable'));
-    return p.setCredentials({ username: email, password: password, server: BIO_SERVER })
+    return Promise.resolve(
-      .then(function () { try { localStorage.setItem(BIO_ENABLED_KEY, '1'); } catch (e) {} });
+      window.SecureStorage.set(BIO_CREDS_KEY, JSON.stringify({ username: email, password: password }))
+    ).then(function () { try { localStorage.setItem(BIO_ENABLED_KEY, '1'); } catch (e) {} });
   }
   function bioRetrieve() {
     var p = bioPlugin();
     if (!p) return Promise.reject(new Error('Biometric plugin unavailable'));
-    return p.verifyIdentity({
+    if (!window.SecureStorage) return Promise.reject(new Error('Secure storage unavailable'));
+    // authenticate() resolves on success and rejects on cancel/failure, so the
+    // credentials are only read after the OS has verified the user.
+    return p.authenticate({
       reason: 'Sign in to PedScribe',
-      title: 'PedScribe',
+      androidTitle: 'PedScribe',
-      subtitle: 'Use biometric to sign in',
+      androidSubtitle: 'Use biometric to sign in',
-      description: 'Confirm your identity to continue.'
+      cancelTitle: 'Use password',
+      allowDeviceCredential: false
     }).then(function () {
-      return p.getCredentials({ server: BIO_SERVER });
+      return window.SecureStorage.get(BIO_CREDS_KEY);
+    }).then(function (raw) {
+      if (!raw) throw new Error('No stored credentials');
+      return JSON.parse(raw);
     });
   }
   function bioForget() {
-    var p = bioPlugin();
     try { localStorage.removeItem(BIO_ENABLED_KEY); } catch (e) {}
-    if (!p) return Promise.resolve();
+    if (!window.SecureStorage) return Promise.resolve();
-    return p.deleteCredentials({ server: BIO_SERVER }).catch(function () { /* fine if missing */ });
+    return Promise.resolve(window.SecureStorage.remove(BIO_CREDS_KEY)).catch(function () { /* fine if missing */ });
   }
   // Expose a small surface so settings/logout/etc can call into it.
   window.PedBio = { available: bioAvailable, stored: bioStored, enroll: bioEnroll, retrieve: bioRetrieve, forget: bioForget };
@@ -113,9 +149,8 @@ document.addEventListener('DOMContentLoaded', function() {
       if (!s.ok) return;
       // Tweak the label to the actual biometry type when known.
       var label = document.getElementById('bio-login-label');
-      if (label && s.type) {
+      if (label && s.typeName) {
-        var typeMap = { 'FACE_ID': 'Sign in with Face ID', 'TOUCH_ID': 'Sign in with Touch ID', 'FACE_AUTHENTICATION': 'Sign in with face recognition', 'FINGERPRINT': 'Sign in with fingerprint' };
+        label.textContent = 'Sign in with ' + s.typeName;
-        label.textContent = typeMap[s.type] || 'Sign in with biometric';
       }
       btn.classList.remove('hidden'); btn.style.display = '';
       if (div) { div.classList.remove('hidden'); div.style.display = ''; }
@@ -214,6 +249,71 @@ document.addEventListener('DOMContentLoaded', function() {
     }
   }
 
+  // ---- CLOUDFLARE TURNSTILE ----
+  // Gates registration and password reset. Login is deliberately NOT gated:
+  // it is already covered by a 10-per-15-min rate limit and a constant-time
+  // credential check, and the widget is unreliable inside the Capacitor
+  // WebView — which locked mobile users out of the app entirely.
+  //
+  // Tokens are captured from the render callback rather than read back out of
+  // the injected [name="cf-turnstile-response"] input. That lookup is easy to
+  // leave unscoped, which is exactly how the register form ended up
+  // submitting the login widget's token (single-use, 5-minute expiry).
+  //
+  // Rendering is explicit and deferred until the owning form is visible:
+  // both widgets live in forms that start at display:none, and Turnstile does
+  // not reliably complete a challenge inside a hidden container.
+  var turnstileWidgets = {
+    register: { el: 'turnstile-register', id: null, token: '', pending: false },
+    forgot:   { el: 'turnstile-forgot',   id: null, token: '', pending: false }
+  };
+  var turnstileReady = false;
+
+  // api.js?render=explicit invokes this once the Turnstile API is available.
+  window.onloadTurnstileCallback = function() {
+    turnstileReady = true;
+    Object.keys(turnstileWidgets).forEach(function(name) {
+      // Catch up on any form shown before the script finished loading.
+      if (turnstileWidgets[name].pending) renderTurnstile(name);
+    });
+  };
+
+  function renderTurnstile(name) {
+    var w = turnstileWidgets[name];
+    if (!w || w.id !== null) return;            // already rendered
+    var el = document.getElementById(w.el);
+    if (!el) return;
+    if (!turnstileReady || !window.turnstile) { w.pending = true; return; }
+    w.pending = false;
+    w.id = window.turnstile.render(el, {
+      sitekey: el.getAttribute('data-sitekey'),
+      theme: 'light',
+      callback: function(token) { w.token = token; },
+      'expired-callback': function() { w.token = ''; },
+      'timeout-callback': function() { w.token = ''; },
+      // Without this a widget failure is silent and the user only ever sees
+      // the generic "complete the verification" toast with no way to tell
+      // whether the challenge failed, expired, or never loaded at all.
+      'error-callback': function(code) {
+        w.token = '';
+        console.error('[Auth] Turnstile error on ' + name + ' widget:', code);
+        showToast('Verification unavailable (' + (code || 'error') + '). Check your connection and try again.', 'error');
+      }
+    });
+  }
+
+  function turnstileToken(name) {
+    var w = turnstileWidgets[name];
+    return w ? w.token : '';
+  }
+
+  function resetTurnstile(name) {
+    var w = turnstileWidgets[name];
+    if (!w) return;
+    w.token = '';
+    if (w.id !== null && window.turnstile) window.turnstile.reset(w.id);
+  }
+
   // ---- HELPER FUNCTIONS ----
 
   function showLoginForm() {
@@ -226,12 +326,14 @@ document.addEventListener('DOMContentLoaded', function() {
     if (loginForm) loginForm.style.display = 'none';
     if (registerForm) registerForm.style.display = 'block';
     if (forgotForm) forgotForm.style.display = 'none';
+    renderTurnstile('register');
   }
 
   function showForgotForm() {
     if (loginForm) loginForm.style.display = 'none';
     if (registerForm) registerForm.style.display = 'none';
     if (forgotForm) forgotForm.style.display = 'block';
+    renderTurnstile('forgot');
   }
 
   function enterApp(user, token) {
@@ -527,7 +629,7 @@ document.addEventListener('DOMContentLoaded', function() {
   // ---- BIOMETRIC LOGIN BUTTON ----
   // Reads the email + password from the OS-secured keychain (gated behind
   // Face ID / Touch ID / fingerprint) and fills the login form. Submits the
-  // form so all the existing flow (turnstile, 2FA prompt, error handling,
+  // form so all the existing flow (2FA prompt, error handling,
   // session storage) runs unchanged. If biometric verification fails, the
   // user just gets a toast and falls through to typing the password.
   var bioBtn = document.getElementById('btn-bio-login');
@@ -544,10 +646,7 @@ document.addEventListener('DOMContentLoaded', function() {
           if (emailEl) emailEl.value = creds.username;
           if (pwEl)    pwEl.value    = creds.password;
           // Trigger the same submit path as the password form so all the
-          // existing handling (turnstile token, 2FA, session storage, etc.)
+          // existing handling (2FA, session storage, etc.) runs unchanged.
-          // runs unchanged. If turnstile hasn't auto-solved yet the form
-          // will toast "Please complete the verification" — same as a
-          // manual login attempt before turnstile resolves.
           if (loginForm && typeof loginForm.requestSubmit === 'function') loginForm.requestSubmit();
           else if (loginForm) loginForm.dispatchEvent(new Event('submit', { cancelable: true, bubbles: true }));
         })
@@ -577,17 +676,9 @@ document.addEventListener('DOMContentLoaded', function() {
         return false;
       }
 
-      // Cloudflare Turnstile
-      var loginTurnstile = document.querySelector('#login-form [name="cf-turnstile-response"]');
-      var loginToken = loginTurnstile ? loginTurnstile.value : '';
-      if (!loginToken) {
-        showToast('Please complete the verification', 'error');
-        return false;
-      }
-
       showLoading('Signing in...');
 
-      var body = { email: email, password: password, turnstileToken: loginToken };
+      var body = { email: email, password: password };
       if (totpCode) body.totpCode = totpCode;
 
       fetch('/api/auth/login', {
@@ -625,7 +716,7 @@ document.addEventListener('DOMContentLoaded', function() {
           if (isNativeApp() && !bioStored()) {
             bioAvailable().then(function (s) {
               if (!s.ok) return;
-              var typeName = ({ 'FACE_ID': 'Face ID', 'TOUCH_ID': 'Touch ID', 'FACE_AUTHENTICATION': 'face recognition', 'FINGERPRINT': 'fingerprint' })[s.type] || 'biometric';
+              var typeName = s.typeName || 'biometric';
               if (typeof showConfirm === 'function') {
                 showConfirm('Enable ' + typeName + ' for faster sign-in next time?', function () {
                   bioEnroll(email, password)
@@ -637,14 +728,12 @@ document.addEventListener('DOMContentLoaded', function() {
           }
         } else {
           showToast(data.error || 'Login failed', 'error');
-          if (window.turnstile) turnstile.reset('#turnstile-login');
         }
       })
       .catch(function(err) {
         hideLoading();
         console.error('[Auth] Login error:', err);
         showToast('Connection error', 'error');
-        if (window.turnstile) turnstile.reset('#turnstile-login');
       });
 
       return false;
@@ -703,9 +792,8 @@ document.addEventListener('DOMContentLoaded', function() {
       }
 
       // Cloudflare Turnstile verification
-      var turnstileResponse = document.querySelector('[name="cf-turnstile-response"]');
+      var regToken = turnstileToken('register');
-      var turnstileToken = turnstileResponse ? turnstileResponse.value : '';
+      if (!regToken) {
-      if (!turnstileToken) {
         showToast('Please complete the verification challenge', 'error');
         return false;
       }
@@ -715,7 +803,7 @@ document.addEventListener('DOMContentLoaded', function() {
       fetch('/api/auth/register', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ name: name, email: email, password: password, turnstileToken: turnstileToken })
+        body: JSON.stringify({ name: name, email: email, password: password, turnstileToken: regToken })
       })
       .then(function(r) { return r.json(); })
       .then(function(data) {
@@ -729,17 +817,20 @@ document.addEventListener('DOMContentLoaded', function() {
           showToast(data.message || 'Account created!', 'success');
         } else if (data.success && data.needsVerification) {
           showToast(data.message || 'Check email to verify', 'success');
+          // The token was just consumed server-side — clear it so coming back
+          // to this form doesn't resubmit a spent one.
+          resetTurnstile('register');
           showLoginForm();
         } else {
           showToast(data.error || 'Registration failed', 'error');
-          if (window.turnstile) turnstile.reset();
+          resetTurnstile('register');
         }
       })
       .catch(function(err) {
         hideLoading();
         console.error('[Auth] Register error:', err);
         showToast('Connection error', 'error');
-        if (window.turnstile) turnstile.reset();
+        resetTurnstile('register');
       });
 
       return false;
@@ -756,8 +847,7 @@ document.addEventListener('DOMContentLoaded', function() {
       if (!email) { showToast('Enter email', 'error'); return false; }
 
       // Cloudflare Turnstile
-      var forgotTurnstile = document.querySelector('#forgot-form [name="cf-turnstile-response"]');
+      var forgotToken = turnstileToken('forgot');
-      var forgotToken = forgotTurnstile ? forgotTurnstile.value : '';
       if (!forgotToken) {
         showToast('Please complete the verification', 'error');
         return false;
@@ -774,12 +864,13 @@ document.addEventListener('DOMContentLoaded', function() {
       .then(function(data) {
         hideLoading();
         showToast(data.message || 'Check your email', 'success');
+        resetTurnstile('forgot');
         showLoginForm();
       })
       .catch(function(err) {
         hideLoading();
         showToast('Error', 'error');
-        if (window.turnstile) turnstile.reset('#turnstile-forgot');
+        resetTurnstile('forgot');
       });
 
       return false;

public/js/clinicalAssistant.js

@@ -492,10 +492,11 @@ import {
       if (!src) throw new Error('No image returned');
       lastGeneratedImageSrc = src;
       exporter.invalidate();
-      if (out) out.innerHTML = imageStore.renderGeneratedImage(src, 'Generated clinical visual');
+      var downloadUrl = data.downloadUrl || '';
+      if (out) out.innerHTML = imageStore.renderGeneratedImage(src, 'Generated clinical visual', downloadUrl);
       if (fromChat) {
         setBusy(false, 'Ready');
-        var html = imageStore.renderGeneratedImage(src, 'Generated clinical visual');
+        var html = imageStore.renderGeneratedImage(src, 'Generated clinical visual', downloadUrl);
         replaceLoadingMessage(loading, html, [], [], true);
       }
     })

scripts/release.sh

@@ -5,7 +5,6 @@
 # Usage:
 #   scripts/release.sh 6.1.1                 # bump to 6.1.1
 #   scripts/release.sh 6.1.1 --push          # also git push + tag push
-#   scripts/release.sh 6.2.0 --push --gh     # also create GitHub release
 #
 # What it does:
 #   1. Updates version in root package.json
@@ -13,31 +12,32 @@
 #   3. Updates versionName + bumps versionCode in Android build.gradle
 #   4. Commits the version bump
 #   5. (optional) git push + push the new tag
-#   6. (optional) create a GitHub release via gh CLI
 #
 # It does NOT:
 #   - Build the Docker image (run `docker compose build`/`up -d` yourself
 #     or wire it to a deploy script / CI hook)
-#   - Build the Android APK (run `cd mobile/android && ./gradlew ...`
+#   - Build the Android APK itself. Forgejo CI does that
-#     yourself). This script just marks the version so the build tags
+#     (.forgejo/workflows/android-apk.yml): any branch push builds a signed
-#     correctly.
+#     APK as a 30-day workflow artifact, and a v* tag push additionally
+#     attaches it to a Forgejo release, which is what Obtainium tracks for
+#     updates. So --push is all you need to ship a build.
+#   - Publish the release itself. CI does that on the tag push; there is no
+#     manual publish step to run.
 # ============================================================
 
 set -euo pipefail
 
 VERSION="${1:-}"
 PUSH=false
-DO_RELEASE=false
 for arg in "${@:2}"; do
   case "$arg" in
     --push) PUSH=true ;;
-    --gh)   DO_RELEASE=true ;;
   esac
 done
 
 if [[ -z "$VERSION" ]]; then
-  echo "usage: $0 <version>  [--push]  [--gh]"
+  echo "usage: $0 <version>  [--push]"
-  echo "       example: $0 6.1.1 --push --gh"
+  echo "       example: $0 6.1.1 --push"
   exit 1
 fi
 if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -90,30 +90,25 @@ git tag -a "v${VERSION}" -m "Release v${VERSION}"
 echo "    tagged v${VERSION}"
 
 if $PUSH; then
-  git push origin HEAD
+  # This repo's remote is "forgejo", not "origin". Prefer forgejo, fall back
-  git push origin "v${VERSION}"
+  # to origin, otherwise use the only remote there is — so this keeps working
-  echo "    pushed to origin"
+  # if the remote is ever renamed. Pushing the tag is what makes CI attach the
-fi
+  # signed APK to a Forgejo release for Obtainium; the branch push alone only
-
+  # builds it as a 30-day workflow artifact.
-if $DO_RELEASE; then
+  REMOTE=""
-  if ! command -v gh >/dev/null; then
+  for candidate in forgejo origin; do
-    echo "WARN: gh CLI not installed, skipping GitHub release creation" >&2
+    if git remote get-url "$candidate" >/dev/null 2>&1; then REMOTE="$candidate"; break; fi
-  else
+  done
-    APK="mobile/android/app/build/outputs/apk/release/app-release.apk"
+  if [[ -z "$REMOTE" ]]; then
-    if [[ -f "$APK" ]]; then
+    REMOTE=$(git remote | head -1)
-      gh release create "v${VERSION}" "$APK" \
-        --title "PedScribe ${VERSION}" \
-        --notes "Release ${VERSION}" \
-        --latest
-      echo "    created GitHub release with APK"
-    else
-      gh release create "v${VERSION}" \
-        --title "PedScribe ${VERSION}" \
-        --notes "Release ${VERSION}" \
-        --latest
-      echo "    created GitHub release (no APK attached — run gradle first then gh release upload)"
-    fi
   fi
+  if [[ -z "$REMOTE" ]]; then
+    echo "ERROR: no git remote configured — cannot push. Commit and tag are still local." >&2
+    exit 1
+  fi
+  git push "$REMOTE" HEAD
+  git push "$REMOTE" "v${VERSION}"
+  echo "    pushed to $REMOTE"
 fi
 
 echo "==> Done. v$VERSION."

src/routes/adminConfig.js

@@ -9,7 +9,7 @@ var { authMiddleware, adminMiddleware } = require('../middleware/auth');
 var PROMPTS = require('../utils/prompts');
 var logger = require('../utils/logger');
 var { gatewayUrl } = require('../utils/errors');
-var { getTTSEnvProvider, getLiteLLMTTSDiscoveryItems, getTTSProvider, getTTSVoiceLists } = require('../utils/ttsProvider');
+var { getTTSEnvProvider, getLiteLLMTTSDiscoveryItems, getLiteLLMTTSRequestOptions, getLiteLLMTTSVoicesForModel, isLiteLLMTTSVoiceCompatible, getTTSProvider } = require('../utils/ttsProvider');
 var { getLiteLLMHeaders, getLiteLLMAdminHeaders } = require('../utils/litellm');
 var { getSTTDependencies, getLiteLLMSTTModels, getSTTModelLists, getSTTProvider } = require('../utils/sttProvider');
 var { getLiteLLMEmbeddingModels } = require('../utils/embeddings');
@@ -550,12 +550,17 @@ router.get('/config/tts', async function(req, res) {
     var dbModel = await db.getSetting('tts.model') || '';
     var envVoice = process.env.LITELLM_TTS_VOICE || '';
     var envModel = process.env.LITELLM_TTS_MODEL || '';
+    var currentModel = dbModel || envModel;
+    var voices = getLiteLLMTTSVoicesForModel(currentModel, { currentVoice: dbVoice });
+    var currentVoice = [dbVoice, envVoice, voices[0]].find(function(voice) {
+      return isLiteLLMTTSVoiceCompatible(currentModel, voice);
+    }) || '';
     res.json({
       success: true,
       provider: activeProvider,
       envProvider: envProvider,
-      currentVoice: dbVoice || envVoice,
+      currentVoice: currentVoice,
-      currentModel: dbModel || envModel,
+      currentModel: currentModel,
       dbVoice: dbVoice,
       dbModel: dbModel,
       envVoice: envVoice,
@@ -563,7 +568,9 @@ router.get('/config/tts', async function(req, res) {
       configured: {
         litellm: !!process.env.LITELLM_API_BASE
       },
-      voices: getTTSVoiceLists()
+      voices: {
+        litellm: voices
+      }
     });
   } catch (e) { res.status(500).json({ error: 'Request failed' }); }
 });
@@ -616,11 +623,15 @@ router.post('/config/tts/test', async function(req, res) {
     var adminModel = await db.getSetting('tts.model') || '';
     var adminVoice = await db.getSetting('tts.voice') || '';
     var ttsModel = adminModel || process.env.LITELLM_TTS_MODEL || '';
-    var usedVoice = voice || adminVoice || process.env.LITELLM_TTS_VOICE || '';
+    var defaultVoices = getLiteLLMTTSVoicesForModel(ttsModel, { currentVoice: adminVoice });
+    var usedVoice = [voice, adminVoice, process.env.LITELLM_TTS_VOICE || '', defaultVoices[0]].find(function(candidate) {
+      return isLiteLLMTTSVoiceCompatible(ttsModel, candidate);
+    }) || '';
     if (!ttsModel) return res.json({ success: false, error: 'No LiteLLM TTS model configured' });
+    var payload = Object.assign({ model: ttsModel, voice: usedVoice, input: text }, getLiteLLMTTSRequestOptions(ttsModel));
 
     var ttsResp = await axios.post(gatewayUrl('/audio/speech'),
-      { model: ttsModel, voice: usedVoice, input: text },
+      payload,
       { headers: getLiteLLMHeaders('application/json'), responseType: 'arraybuffer', timeout: 60000 }
     );
     var buffer = Buffer.from(ttsResp.data);

src/routes/auth.js

@@ -299,19 +299,15 @@ router.post('/resend-verification', async (req, res) => {
 // ============================================================
 router.post('/login', async (req, res) => {
   try {
-    var { email, password, totpCode, turnstileToken } = req.body;
+    var { email, password, totpCode } = req.body;
     if (!email || !password) return res.status(400).json({ error: 'Email and password required' });
 
-    // Cloudflare Turnstile verification
+    // No Turnstile on login. The widget could not reliably complete a
-    if (process.env.TURNSTILE_SECRET_KEY) {
+    // challenge inside the Capacitor WebView, which locked mobile users out.
-      if (!turnstileToken) return res.status(400).json({ error: 'Please complete the verification' });
+    // Brute-force cover here comes from the 10-per-15-min per-IP rate limit
-      var tsRes = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
+    // (server.js), the constant-time bcrypt comparison below, and TOTP 2FA.
-        method: 'POST', headers: { 'Content-Type': 'application/json' },
+    // Registration and password reset — the endpoints that actually attract
-        body: JSON.stringify({ secret: process.env.TURNSTILE_SECRET_KEY, response: turnstileToken, remoteip: req.ip })
+    // bots — are still gated.
-      });
-      var tsData = await tsRes.json();
-      if (!tsData.success) return res.status(400).json({ error: 'Verification failed. Please try again.' });
-    }
 
     var user = await db.get('SELECT * FROM users WHERE email = ?', [email.toLowerCase()]);
     // Enumeration-resistant: always run bcrypt to keep timing constant, and return

src/routes/clinicalAssistant.js

@@ -325,6 +325,7 @@ router.get('/clinical-assistant/image/jobs/:id', async function(req, res) {
       imageUrl: job.imageUrl || null,
       url: job.url || null,
       base64: job.base64 || null,
+      downloadUrl: job.status === 'done' && job.base64 ? '/api/clinical-assistant/image/jobs/' + encodeURIComponent(job.id) + '/download' : null,
       error: job.error || null
     });
   } catch (e) {
@@ -332,6 +333,22 @@ router.get('/clinical-assistant/image/jobs/:id', async function(req, res) {
   }
 });
 
+router.get('/clinical-assistant/image/jobs/:id/download', async function(req, res) {
+  try {
+    var job = await getImageJob(req.params.id);
+    if (!job || String(job.userId) !== String(req.user.id) || job.status !== 'done' || !job.base64) {
+      return res.status(404).json({ error: 'Image job not found' });
+    }
+    var buffer = Buffer.from(String(job.base64), 'base64');
+    res.setHeader('Content-Type', 'image/png');
+    res.setHeader('Content-Disposition', 'attachment; filename="clinical-visual.png"');
+    res.setHeader('Cache-Control', 'private, max-age=900');
+    res.send(buffer);
+  } catch (e) {
+    res.status(500).json({ error: 'Image download failed' });
+  }
+});
+
 async function prepareAssistantChat(body) {
   body = body || {};
   var message = String(body.message || '').trim();

src/routes/tts.js

@@ -3,7 +3,7 @@ const router  = express.Router();
 const { authMiddleware } = require('../middleware/auth');
 var logger = require('../utils/logger');
 var { gatewayUrl } = require('../utils/errors');
-var { getTTSProvider } = require('../utils/ttsProvider');
+var { getLiteLLMTTSRequestOptions, getLiteLLMTTSVoicesForModel, isLiteLLMTTSVoiceCompatible, getTTSProvider } = require('../utils/ttsProvider');
 var { getLiteLLMHeaders } = require('../utils/litellm');
 
 // TTS is intentionally routed only through LiteLLM. Provider-specific voice
@@ -22,19 +22,22 @@ router.post('/text-to-speech', authMiddleware, async (req, res) => {
     var userVoice = userPrefs?.tts_voice;
     var adminVoice = await db.getSetting('tts.voice') || '';
     var adminModel = await db.getSetting('tts.model') || '';
-    var resolvedVoice = userVoice || adminVoice || '';
 
     if (ttsProvider !== 'litellm' || !process.env.LITELLM_API_BASE) {
       return res.status(400).json({ error: 'TTS not configured. Set LITELLM_API_BASE.' });
     }
     var ttsModel = adminModel || process.env.LITELLM_TTS_MODEL || '';
-    var ttsVoice = resolvedVoice || process.env.LITELLM_TTS_VOICE || '';
+    var defaultVoices = getLiteLLMTTSVoicesForModel(ttsModel, { currentVoice: adminVoice });
+    var ttsVoice = [userVoice, adminVoice, process.env.LITELLM_TTS_VOICE || '', defaultVoices[0]].find(function(voice) {
+      return isLiteLLMTTSVoiceCompatible(ttsModel, voice);
+    }) || '';
     if (!ttsModel) return res.status(400).json({ error: 'No LiteLLM TTS model configured.' });
+    var payload = Object.assign({ model: ttsModel, input: text, voice: ttsVoice }, getLiteLLMTTSRequestOptions(ttsModel));
 
     var ttsResp = await fetch(gatewayUrl('/audio/speech'), {
       method: 'POST',
       headers: getLiteLLMHeaders('application/json'),
-      body: JSON.stringify({ model: ttsModel, input: text, voice: ttsVoice })
+      body: JSON.stringify(payload)
     });
     if (!ttsResp.ok) {
       var errBody = await ttsResp.text();

src/routes/userPreferences.js

@@ -7,7 +7,7 @@ var router = express.Router();
 var db = require('../db/database');
 var { authMiddleware } = require('../middleware/auth');
 var { getSTTModelLists, getSTTProvider } = require('../utils/sttProvider');
-var { getTTSProvider, getTTSVoiceLists } = require('../utils/ttsProvider');
+var { getLiteLLMTTSVoicesForModel, getTTSProvider } = require('../utils/ttsProvider');
 
 router.use(authMiddleware);
 
@@ -49,14 +49,18 @@ router.get('/preferences/options', async function(req, res) {
     var provider = getSTTProvider();
     var ttsProvider = getTTSProvider();
 
+    var dbModel = await db.getSetting('tts.model') || '';
+    var dbVoice = await db.getSetting('tts.voice') || '';
+    var ttsModel = dbModel || process.env.LITELLM_TTS_MODEL || '';
     var sttModels = getSTTModelLists().litellm.map(function(model) { return { value: model, label: model }; });
-    var ttsVoices = getTTSVoiceLists().litellm.map(function(voice) { return { value: voice, label: voice }; });
+    var ttsVoices = getLiteLLMTTSVoicesForModel(ttsModel, { currentVoice: dbVoice }).map(function(voice) { return { value: voice, label: voice }; });
 
     res.json({
       success: true,
       sttProvider: provider || 'none',
       sttModels: sttModels,
       ttsProvider: ttsProvider || 'browser',
+      ttsModel: ttsModel || null,
       ttsVoices: ttsVoices
     });
 

src/utils/ttsProvider.js

@@ -7,6 +7,20 @@ function parseList(value) {
     .filter(Boolean);
 }
 
+var KITTEN_TTS_VOICES = ['Bella', 'Jasper', 'Luna', 'Bruno', 'Rosie', 'Hugo', 'Kiki', 'Leo'];
+var SUPERTONIC_TTS_VOICES = ['F1', 'F2', 'F3', 'F4', 'F5', 'M1', 'M2', 'M3', 'M4', 'M5'];
+var GROQ_ORPHEUS_ENGLISH_VOICES = ['autumn', 'diana', 'hannah', 'austin', 'daniel', 'troy'];
+var GROQ_ORPHEUS_ARABIC_VOICES = ['abdullah', 'fahad', 'sultan', 'lulwa', 'noura', 'aisha'];
+
+function uniqueList(values) {
+  var seen = new Set();
+  return (values || []).filter(function(value) {
+    if (!value || seen.has(value)) return false;
+    seen.add(value);
+    return true;
+  });
+}
+
 function getTTSProvider() {
   var env = process.env.TTS_PROVIDER;
   if (env === 'litellm') return 'litellm';
@@ -20,10 +34,58 @@ function getTTSEnvProvider() {
 
 function getTTSVoiceLists() {
   return {
-    litellm: parseList(process.env.LITELLM_TTS_VOICES)
+    litellm: uniqueList(parseList(process.env.LITELLM_TTS_VOICES).concat(KITTEN_TTS_VOICES, SUPERTONIC_TTS_VOICES, GROQ_ORPHEUS_ENGLISH_VOICES, GROQ_ORPHEUS_ARABIC_VOICES))
   };
 }
 
+function getLiteLLMTTSModelFamily(model) {
+  var id = String(model || '').toLowerCase();
+  if (id === 'local-kitten-tts') return 'kitten';
+  if (id === 'local-supertonic-tts') return 'supertonic';
+  if (id === 'local-kokoro-tts') return 'kokoro';
+  if (id === 'groq-orpheus-english' || id === 'canopylabs/orpheus-v1-english') return 'groq-orpheus-english';
+  if (id === 'groq-orpheus-arabic-saudi' || id === 'canopylabs/orpheus-arabic-saudi') return 'groq-orpheus-arabic';
+  return 'unknown';
+}
+
+function getLiteLLMTTSRequestOptions(model) {
+  var family = getLiteLLMTTSModelFamily(model);
+  if (family === 'groq-orpheus-english' || family === 'groq-orpheus-arabic') {
+    return { response_format: 'wav' };
+  }
+  return {};
+}
+
+function isLiteLLMTTSVoiceCompatible(model, voice) {
+  if (!voice) return true;
+  var family = getLiteLLMTTSModelFamily(model);
+  if (family === 'kitten') return KITTEN_TTS_VOICES.indexOf(voice) !== -1;
+  if (family === 'supertonic') return SUPERTONIC_TTS_VOICES.indexOf(voice) !== -1;
+  if (family === 'groq-orpheus-english') return GROQ_ORPHEUS_ENGLISH_VOICES.indexOf(String(voice).toLowerCase()) !== -1;
+  if (family === 'groq-orpheus-arabic') return GROQ_ORPHEUS_ARABIC_VOICES.indexOf(String(voice).toLowerCase()) !== -1;
+  if (family === 'kokoro') {
+    return KITTEN_TTS_VOICES.indexOf(voice) === -1 && SUPERTONIC_TTS_VOICES.indexOf(voice) === -1 &&
+      GROQ_ORPHEUS_ENGLISH_VOICES.indexOf(String(voice).toLowerCase()) === -1 && GROQ_ORPHEUS_ARABIC_VOICES.indexOf(String(voice).toLowerCase()) === -1;
+  }
+  return true;
+}
+
+function getLiteLLMTTSVoicesForModel(model, opts) {
+  opts = opts || {};
+  var family = getLiteLLMTTSModelFamily(model);
+  var voices = [];
+  if (family === 'kitten') voices = KITTEN_TTS_VOICES.slice();
+  else if (family === 'supertonic') voices = SUPERTONIC_TTS_VOICES.slice();
+  else if (family === 'groq-orpheus-english') voices = GROQ_ORPHEUS_ENGLISH_VOICES.slice();
+  else if (family === 'groq-orpheus-arabic') voices = GROQ_ORPHEUS_ARABIC_VOICES.slice();
+  else voices = parseList(process.env.LITELLM_TTS_VOICES);
+
+  [opts.currentVoice, process.env.LITELLM_TTS_VOICE].forEach(function(voice) {
+    if (isLiteLLMTTSVoiceCompatible(model, voice)) voices.push(voice);
+  });
+  return uniqueList(voices.filter(function(voice) { return isLiteLLMTTSVoiceCompatible(model, voice); }));
+}
+
 function isLiteLLMTTSModel(model) {
   var mode = model && model.model_info && model.model_info.mode ? String(model.model_info.mode) : '';
   return mode === 'audio_speech';
@@ -56,6 +118,26 @@ function getLiteLLMTTSDiscoveryItems(models, opts) {
   getTTSVoiceLists().litellm.forEach(function(voice) {
     pushUniqueTTSItem(items, { id: voice, name: voice, source: 'configured-voice-list', kind: 'voice' });
   });
+  if (getLiteLLMTTSModels(models).indexOf('local-kitten-tts') !== -1 || opts.currentModel === 'local-kitten-tts') {
+    KITTEN_TTS_VOICES.forEach(function(voice) {
+      pushUniqueTTSItem(items, { id: voice, name: 'Kitten ' + voice, source: 'local-kitten-tts', kind: 'voice' });
+    });
+  }
+  if (getLiteLLMTTSModels(models).indexOf('local-supertonic-tts') !== -1 || opts.currentModel === 'local-supertonic-tts') {
+    SUPERTONIC_TTS_VOICES.forEach(function(voice) {
+      pushUniqueTTSItem(items, { id: voice, name: 'Supertonic ' + voice, source: 'local-supertonic-tts', kind: 'voice' });
+    });
+  }
+  if (getLiteLLMTTSModels(models).indexOf('groq-orpheus-english') !== -1 || opts.currentModel === 'groq-orpheus-english') {
+    GROQ_ORPHEUS_ENGLISH_VOICES.forEach(function(voice) {
+      pushUniqueTTSItem(items, { id: voice, name: 'Groq Orpheus ' + voice, source: 'groq-orpheus-english', kind: 'voice' });
+    });
+  }
+  if (getLiteLLMTTSModels(models).indexOf('groq-orpheus-arabic-saudi') !== -1 || opts.currentModel === 'groq-orpheus-arabic-saudi') {
+    GROQ_ORPHEUS_ARABIC_VOICES.forEach(function(voice) {
+      pushUniqueTTSItem(items, { id: voice, name: 'Groq Orpheus Arabic ' + voice, source: 'groq-orpheus-arabic-saudi', kind: 'voice' });
+    });
+  }
   return items;
 }
 
@@ -64,7 +146,10 @@ module.exports = {
   getLiteLLMTTSDiscoveryItems,
   getLiteLLMHeaders,
   getLiteLLMTTSModels,
+  getLiteLLMTTSRequestOptions,
+  getLiteLLMTTSVoicesForModel,
   getTTSProvider,
   getTTSVoiceLists,
+  isLiteLLMTTSVoiceCompatible,
   isLiteLLMTTSModel
 };

test/tts-provider.test.js

@@ -1,7 +1,7 @@
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
 
-const ENV_KEYS = ['TTS_PROVIDER', 'LITELLM_API_BASE', 'LITELLM_API_KEY', 'LITELLM_MASTER_KEY', 'LITELLM_TTS_VOICES'];
+const ENV_KEYS = ['TTS_PROVIDER', 'LITELLM_API_BASE', 'LITELLM_API_KEY', 'LITELLM_MASTER_KEY', 'LITELLM_TTS_VOICES', 'LITELLM_TTS_VOICE'];
 
 function withEnv(overrides, fn) {
   const previous = {};
@@ -36,10 +36,11 @@ test('TTS provider ignores non-LiteLLM provider overrides', () => {
 test('LiteLLM TTS voice list comes from configured voice catalog', () => {
   const ttsProvider = require('../src/utils/ttsProvider');
   withEnv({ LITELLM_TTS_VOICES: 'sherpa/kokoro:am_adam, sherpa/kokoro:af_bella' }, () => {
-    assert.deepEqual(ttsProvider.getTTSVoiceLists().litellm, [
+    const voices = ttsProvider.getTTSVoiceLists().litellm;
-      'sherpa/kokoro:am_adam',
+    assert.equal(voices[0], 'sherpa/kokoro:am_adam');
-      'sherpa/kokoro:af_bella'
+    assert.equal(voices[1], 'sherpa/kokoro:af_bella');
-    ]);
+    assert.equal(voices.includes('Jasper'), true);
+    assert.equal(voices.includes('F1'), true);
   });
 });
 
@@ -92,6 +93,19 @@ test('LiteLLM TTS discovery includes metadata models and configured fallbacks',
   });
 });
 
+test('LiteLLM TTS discovery expands Kitten and Supertonic voices', () => {
+  const ttsProvider = require('../src/utils/ttsProvider');
+  withEnv({}, () => {
+    const items = ttsProvider.getLiteLLMTTSDiscoveryItems([
+      { model_name: 'local-kitten-tts', model_info: { mode: 'audio_speech' } },
+      { model_name: 'local-supertonic-tts', model_info: { mode: 'audio_speech' } }
+    ], {});
+    assert.equal(items.some(function(item) { return item.id === 'local-kitten-tts' && item.kind === 'model'; }), true);
+    assert.equal(items.some(function(item) { return item.id === 'Jasper' && item.kind === 'voice'; }), true);
+    assert.equal(items.some(function(item) { return item.id === 'F1' && item.kind === 'voice'; }), true);
+  });
+});
+
 test('LiteLLM TTS discovery still shows configured model if metadata lookup fails', () => {
   const ttsProvider = require('../src/utils/ttsProvider');
   assert.deepEqual(ttsProvider.getLiteLLMTTSDiscoveryItems([], {
@@ -103,6 +117,38 @@ test('LiteLLM TTS discovery still shows configured model if metadata lookup fail
   ]);
 });
 
+test('LiteLLM TTS voices are scoped to the active local model', () => {
+  const ttsProvider = require('../src/utils/ttsProvider');
+  withEnv({ LITELLM_TTS_VOICES: 'sherpa/kokoro:am_adam,sherpa/kokoro:af_bella', LITELLM_TTS_VOICE: 'sherpa/kokoro:am_adam' }, () => {
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('local-kitten-tts'), ['Bella', 'Jasper', 'Luna', 'Bruno', 'Rosie', 'Hugo', 'Kiki', 'Leo']);
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('local-supertonic-tts'), ['F1', 'F2', 'F3', 'F4', 'F5', 'M1', 'M2', 'M3', 'M4', 'M5']);
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('local-kokoro-tts'), ['sherpa/kokoro:am_adam', 'sherpa/kokoro:af_bella']);
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('groq-orpheus-english'), ['autumn', 'diana', 'hannah', 'austin', 'daniel', 'troy']);
+    assert.deepEqual(ttsProvider.getLiteLLMTTSVoicesForModel('canopylabs/orpheus-arabic-saudi'), ['abdullah', 'fahad', 'sultan', 'lulwa', 'noura', 'aisha']);
+  });
+});
+
+test('LiteLLM TTS compatibility rejects cross-model local voices', () => {
+  const ttsProvider = require('../src/utils/ttsProvider');
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-kokoro-tts', 'Bella'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-kokoro-tts', 'M1'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-kitten-tts', 'Bella'), true);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-kitten-tts', 'M1'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-supertonic-tts', 'M1'), true);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('local-supertonic-tts', 'Bella'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('groq-orpheus-english', 'hannah'), true);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('groq-orpheus-english', 'sherpa/kokoro:af_bella'), false);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('groq-orpheus-arabic-saudi', 'aisha'), true);
+  assert.equal(ttsProvider.isLiteLLMTTSVoiceCompatible('groq-orpheus-arabic-saudi', 'troy'), false);
+});
+
+test('Groq Orpheus TTS requests force wav response format', () => {
+  const ttsProvider = require('../src/utils/ttsProvider');
+  assert.deepEqual(ttsProvider.getLiteLLMTTSRequestOptions('groq-orpheus-english'), { response_format: 'wav' });
+  assert.deepEqual(ttsProvider.getLiteLLMTTSRequestOptions('canopylabs/orpheus-arabic-saudi'), { response_format: 'wav' });
+  assert.deepEqual(ttsProvider.getLiteLLMTTSRequestOptions('local-kokoro-tts'), {});
+});
+
 test('LiteLLM headers include optional content type without exposing key value', () => {
   const ttsProvider = require('../src/utils/ttsProvider');
   withEnv({ LITELLM_API_KEY: 'secret-token' }, () => {