Daniel 46112e1221 feat: connect Nextcloud by signing in to Nextcloud ... Asking someone to find Settings → Security → Create new app password is a poor first run, and it is the step people give up on. Nextcloud has its own answer: Login Flow v2. The person enters their server address, signs in on Nextcloud the way they normally do — SSO, 2FA, a password manager — and Nextcloud generates an app password for this app. We never see their real password. Pasting an app password still works, behind "Use an app password instead". It is the fallback, not the front door. The security of this is all in what is trusted. The remote server chooses both the login URL and the poll endpoint, so both are SSRF-checked and both must be on the host the person actually typed — an endpoint pointing elsewhere would make this a request-forgery gadget aimed at whatever it named. The server Nextcloud reports at the end is re-checked before it is stored. The poll token is a credential, so polling happens server-side and the browser holds only an opaque handle bound to its own account. Flows live in memory with a 20 minute life, matching Nextcloud's own expiry: a login lasts minutes, and a restart mid-flow is a retry rather than a loss. Starting a second flow replaces the first, which is what clicking again means. The tab is opened from the click itself, before the request — opening it after an await is what a popup blocker stops. Removed with Learning Hub: the WebDAV browse path. Its field, its route and its column are gone, since nothing browses Nextcloud any more. nextcloud_folder is a different column and still in use. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU		2026-09-12 20:55:00 +02:00
..
account-boundary.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
admin-clinical-assistant-wiring.test.js	fix: the assistant settings page says what saves what	2026-09-11 04:04:31 +02:00
admin-docs-toc.test.js	test docs toc links	2026-05-09 01:33:06 +02:00
assistant-attachment-roundtrip.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
assistant-autosave.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-citation-modal.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-citations.test.js	feat: citation quality tracking, and the SSO settings fit a phone	2026-09-10 23:44:43 +02:00
assistant-component-css.test.js	refactor: drop the "Saved Chats" header and collapse arrow from the rail	2026-09-10 13:27:29 +02:00
assistant-enter-to-send.test.js	feat: Enter sends in the assistant, and the person chooses	2026-09-12 18:05:36 +02:00
assistant-export-owner.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-image-attachments.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
assistant-image-done.test.js	fix: image Done state, chat titles that keep whole words, and readable extension cards	2026-09-10 06:44:22 +02:00
assistant-image-intent.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
assistant-math-mhchem.test.js	fix: reviewer findings — mhchem macro wrapping, regenerate history dedupe, strict safe image allowlist, stale docs	2026-09-08 19:25:31 +02:00
assistant-message-actions.test.js	fix: send button morphs into a clickable STOP icon while working (no more disabled spinner); grouped bottom-left tools; silent-recording message; completed images auto-join the library; transient image-status retries	2026-09-09 04:12:30 +02:00
assistant-mobile.test.js	fix: recordings that produced nothing, and the boxes that zoomed on iOS	2026-09-11 00:16:19 +02:00
assistant-saved-tables.test.js	feat: saved chats grouped by recency, a visible sidebar toggle, and acknowledgements answered cheaply	2026-09-09 18:59:45 +02:00
assistant-sharing-boundary.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
assistant-sources-cleaning.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
assistant-translate.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
assistant-user-markdown.test.js	feat: Open WebUI-style assistant workspace — 3-column layout, markdown/math/code/tables, autosave with images, translation (LibreTranslate+DeepL), citation modal, Learning Hub moved in, handoff removed	2026-09-08 18:52:35 +02:00
assistant-voice-mode.test.js	fix: voice mode reads the answer that just arrived, and reads what the page shows	2026-09-11 21:10:50 +02:00
assistant-voice.test.js	fix: OWUI-style polish — fullscreen workspace replaces main menu, row-click saved chats (delete stays as hover), markdown-rendered patient handout, admin-only raw transcript, /api TTS URL, scrollable unclipped tables, action buttons hidden in exports, autosave-only copy	2026-09-08 22:41:08 +02:00
assistant-workspace-layout.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
attachment-magic-bytes.test.js	fix: an assistant attachment must be the image type it claims to be	2026-09-12 19:00:10 +02:00
backend-hardening.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
bedside-respiratory-ventilation.test.js	allow bedside respiratory without weight	2026-05-08 09:10:33 +02:00
build-id.test.js	feat: a deploy you can repeat, and prove afterwards	2026-09-11 00:41:11 +02:00
calc-math.test.js	feat: B — extract drug data to public/data/drugs.json (schema v1.0)	2026-04-20 04:23:24 +02:00
calculators-data.test.js	consolidate calculator growth helpers	2026-05-08 04:36:39 +02:00
clinical-assistant-prompt-pool.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-conversation.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
clinical-generation-options.test.js	Send reasoning options only to supported model	2026-08-27 21:25:38 +02:00
clinical-mcp-session-lifecycle.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-notes-entrypoints.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
clinical-release-integration.test.js	fix: the assistant settings page says what saves what	2026-09-11 04:04:31 +02:00
clinical-retrieval-title.test.js	refactor: retrieval is text-only; admins can add model ids discovery never returns	2026-09-09 23:35:06 +02:00
clinical-table-preservation.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
corpus-retrieval.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
deck-review.test.js	feat: modifying a deck can see it	2026-09-12 06:55:16 +02:00
deck-themes.test.js	feat: deck themes — a palette you pick, previewed by the renderer itself	2026-09-12 19:40:19 +02:00
doc-spec.test.js	feat: Word is built by python-docx from the same typed source as the deck	2026-09-11 21:58:53 +02:00
e2e-harness.test.js	test(e2e): repair the harness, taking the browser suite from 96 failures to 11	2026-09-11 18:54:03 +02:00
embeddings-provider.test.js	fix litellm metadata model discovery	2026-05-09 04:46:06 +02:00
empty-answer.test.js	fix: an empty answer from the model was the one failure never caught	2026-09-12 07:41:04 +02:00
extension-transfer.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
frontend-prompt-env.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
frontend-rendering-safety.test.js	feat: the announcement banner renders Markdown, safely	2026-09-10 19:08:12 +02:00
generated-image-cache.test.js	feat: an image library — every picture this account has made	2026-09-12 14:36:30 +02:00
generated-image-storage.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
generated-image-tools.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
generated-images-ui.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
image-fallback-chain.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
image-key-collision.test.js	fix: a second deck reused the first deck's pictures	2026-09-12 08:26:09 +02:00
image-library.test.js	feat: image fallback chains for every workflow, and a library worth looking at	2026-09-12 14:53:04 +02:00
login-codes.test.js	feat: sign in with a code emailed to you, offered beside the password	2026-09-11 20:12:03 +02:00
mcp-shutdown.test.js	feat: integrate durable image jobs/private assets into current core	2026-09-07 16:53:42 +02:00
metrics.test.js	fix metrics route normalization	2026-05-08 20:22:14 +02:00
model-defaults.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
model-roster-pruning.test.js	feat: send a resource to your own Nextcloud, as the rendered file	2026-09-12 20:34:58 +02:00
models-changed-propagation.test.js	fix: a newly added model reaches every picker, including the user-facing ones	2026-09-12 17:46:18 +02:00
module-entrypoints.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
my-resources-refine.test.js	feat: send a resource to your own Nextcloud, as the rendered file	2026-09-12 20:34:58 +02:00
my-resources-stale-results.test.js	fix: the last run's illustration no longer sits under an empty form	2026-09-12 17:43:19 +02:00
my-resources.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
nextcloud-login-flow.test.js	feat: connect Nextcloud by signing in to Nextcloud	2026-09-12 20:55:00 +02:00
notes-sanitize.test.js	fix diagram delete confirmation	2026-05-08 06:28:12 +02:00
patient-takehome.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
pe-guide-data.test.js	move pe guide data to json	2026-05-08 08:56:21 +02:00
policy-flows.test.js	feat: connect Nextcloud by signing in to Nextcloud	2026-09-12 20:55:00 +02:00
policy-ui.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
prompt-administration.test.js	fix: mobile layout regression, workspace menu in the assistant rail, prompt as principles	2026-09-09 22:24:10 +02:00
release.test.js	feat: ship reviewed prompt history, conversation limits and account protections	2026-09-07 04:01:01 +02:00
resource-to-nextcloud.test.js	feat: send a resource to your own Nextcloud, as the rendered file	2026-09-12 20:34:58 +02:00
review-model-vision-guard.test.js	feat: a text-only model can ask a model that can see; and the image regex is gone	2026-09-12 15:43:36 +02:00
session-quiz-ed-regressions.test.js	feat: retire Learning Hub	2026-09-12 20:14:20 +02:00
slide-shapes.test.js	feat: record what a deck wanted and could not have	2026-09-11 22:51:15 +02:00
slide-spec.test.js	fix: a deck the model fumbles once is asked for again, not abandoned	2026-09-12 05:34:14 +02:00
stt-provider.test.js	simplify speech and embeddings through litellm	2026-05-09 05:09:02 +02:00
transcription-memory-policy.test.js	feat: a retried transcript goes back to the tab the audio came from	2026-09-11 12:39:50 +02:00
tts-provider.test.js	chore: Kitten and Supertonic retired; Kokoro is the local voice	2026-09-12 16:45:05 +02:00
vision-tool.test.js	fix: the active library view is unmistakable, and a leading question cannot mislead the vision model	2026-09-12 16:27:21 +02:00
web-search.test.js	feat: My Resources says what it is, offers its sources in one place, and Modify gets them too	2026-09-11 18:54:17 +02:00
well-visit-data.test.js	remove legacy well visit schedule data	2026-05-08 08:59:23 +02:00