v0.1.4

Added

• Per-token client visibility. Each API token now remembers the last
  client User-Agent seen on it (written alongside the existing throttled
  last_used_at bookkeeping — an agent change, e.g. an app update, always
  writes immediately). Token lists in the dashboard (admin Users screen and
  own Settings) show a compact client label — e.g. Loopback iOS 1.0,
  browser — with the full string on hover, and the lastUserAgent field is
  on both token wire shapes. Groundwork for the iOS app's version handshake:
  once the app sends Loopback-iOS/<version>, the admin can answer "which
  devices still run an old app" before shipping a breaking change.

Full changelog: CHANGELOG.md

v0.1.3

Added

• Stranded-device visibility. A device still presenting a revoked,
  expired, or deactivated-account bearer token used to fail with silent 401s;
  those rejections now appear as token_rejected events in the admin
  auth-activity feed. Expired/inactive rejections name the user and token
  ("alice's token 'iPhone' rejected — expired"); unknown tokens can't be
  attributed and show a short token fingerprint instead, so repeats are
  recognizable. Events are throttled per device (per source IP for unknown
  tokens) to at most one per 6 hours, so a retrying device or a scanner can't
  flood the feed.

Full changelog: CHANGELOG.md

v0.1.2

Added

• First-run setup screen. A fresh install now greets the browser with a
  create-admin-account screen instead of a dead login form: the dashboard
  detects that no admin password exists (GET /api/auth/setup) and walks you
  through creating the account (POST /api/auth/setup), landing you signed
  in. The endpoints close permanently once a passworded admin exists — a
  deactivated admin keeps them closed, and an existing passworded account can
  never be taken over; lockout recovery stays the CLI. The POST is
  rate-limited like login and completing setup shows up in the admin
  auth-activity feed. BOOTSTRAP_ADMIN_PASSWORD works unchanged for
  headless/scripted installs and skips the screen entirely.

Full changelog: CHANGELOG.md

v0.1.1 — server-managed backups

The server now backs itself up — no host cron required.

Added

• Server-managed backups: a nightly pg_dump into the /backups mount (BACKUP_TIME, default 03:30 container time; newest BACKUP_KEEP dumps retained, default 30), a catch-up backup shortly after startup when the newest dump is stale, and an automatic dump right before pending database migrations run on an upgrade — so a bad migration is always recoverable.
• Back up now button on the admin System screen (POST /api/admin/backup).
• Prefer managing backups yourself? Set BACKUP_ENABLED=false and mount the backup dir :ro — freshness reporting works either way. See the README's Backups section.

Changed

• The compose /backups mount is read-write by default now (was :ro). Host-managed setups should add :ro back in an override file alongside BACKUP_ENABLED=false.
• The Docker image includes postgresql-client (pg_dump).

Full notes in CHANGELOG.md.

v0.1.0 — first release

First tagged release of Loopback Server — everything before this shipped straight from main.

Install / upgrade: see the README Quick Start and Releases & upgrading. Images: ghcr.io/aderaaij/loopback-training-server:{0.1.0, 0.1, latest} (amd64/arm64).

Highlights

• Workout storage & analytics for all HealthKit workout types with splits, heart-rate samples, cadence, GPS routes, and week/month/year aggregation
• Apple Watch training queue: structured workouts served as WorkoutKit compositions to the companion iOS app, with device inventory, edit/delete actions, and missed-workout feedback
• Training plans with goals, guardrails, phases, recurring strength schedules, a unified conflict-flagging calendar, and an explicit completion flow
• Plan validation — a deterministic schedule "linter": ramp/taper checks, missing down weeks, back-to-back hard days, guardrail breaches
• Daily health metrics: sleep, heart rate, HRV, weight, VO₂max, steps, body composition
• Multi-user auth: argon2 passwords, per-device revocable tokens, rate-limited login, auth audit trail
• Web dashboard (React SPA served same-origin): athlete screens plus an admin console for user/token management and system monitoring
• MCP server so any MCP client can act as an AI running coach over your own data (per-user token passthrough, coaching playbook)
• Self-host niceties: single .env config, GHCR multi-arch images, automatic migrations, backup-freshness reporting, isolated demo stack with seeder

Full details in CHANGELOG.md.