Skip to content

URSA-OSCAR 1.1.1 — Auth fix for in-app chat

Choose a tag to compare

View all tags
@burrellka burrellka released this 20 May 21:43
· 29 commits to main since this release
v1.1.1
636f338

URSA-OSCAR 1.1.1

A bugfix-only release ahead of the community launch.

Why 1.1.1 exists

While preparing the 1.1.0 community launch, a launch-day test of the in-app AI chat surfaced two latent auth bugs that would have been visible on the very first user query. 1.1.1 fixes both before the public Release.

If you already pulled :1.1.0, the right move is to bump to :1.1.1 directly. There is no :1.1.0 Release announcement — the tag exists but the Release object is being skipped.

Fixed in 1.1.1

  • In-app AI chat tool calls now authenticate (backend/src/ursa_oscar/ai_proxy/tools.py, backend/src/ursa_oscar/api/ai.py). Phase 6.4 added _AUTH_REQUIRED to every API router but the AI proxy's internal loopback to the API didn't forward the operator's JWT. Every tool call from the chat panel returned {"detail":"Not authenticated."}. The chat endpoint now reads the JWT from either the ursa_oscar_session cookie (browser session) or the Authorization: Bearer header (MCP/CLI client), constructs a Bearer header, and passes it via the new auth_header kwarg on execute_tool. The Test connection button in Settings worked because it calls the LLM provider directly without an URSA loopback — only tool-call queries hit the broken path. New regression test test_chat_forwards_session_cookie_as_bearer_to_loopback covers both auth paths.
  • generate_report MCP tool now authenticates (mcp-server/src/ursa_oscar_mcp/tools/generate_report.py). Same Phase 6.4 oversight in a different code path: this tool used raw httpx.Client() instead of the auth-attaching get_client() helper in client.py. Reports requested from a claude.ai Custom Connector returned 401. Now uses get_client() so the resolved service token is attached.
  • No data migrations. No env-var changes. Same /data volume layout.

1.1.0 content (carried into 1.1.1)

1.1.1 includes everything that was scheduled for 1.1.0:

  • In-app Help system — 37 topics across 7 sections covering installation, every feature, every statistical method, architecture, deployment, and troubleshooting. The Methodology section is verbatim with the PDF report's methodology disclosure (single source of truth, no drift).
  • AI assistant Help integration — the AI assistant queries Help content via the new get_help_topic MCP tool, grounding responses in URSA-OSCAR-specific documentation rather than general LLM knowledge.
  • About modal — version info, license, OSCAR attribution, GitHub link, accessible from the sidebar footer.
  • No-drift regression test — every tool / endpoint reference in the Help markdown is verified against the actual codebase. Catches stale references on every CI run.

Architecturally locked in 1.0 (carried into 1.1.x)

These are the architectural decisions that 1.0 committed to. They aren't likely to change in any near-term release:

  • Single-tenant. One operator, one instance.
  • Self-hosted. No cloud sync, no SaaS option.
  • Password authentication only. No SSO / OAuth providers for operator login.
  • No email password recovery. Recovery is filesystem-level (delete auth.json, re-bootstrap).
  • Statistical method declaration in every analytical response.
  • Sample-size discipline as refusals, not warnings (INSUFFICIENT_DATA returns when below the floor).

If any of these don't fit your needs, URSA-OSCAR may not be the right tool. See frontend/src/help/content/arch-single-tenant.md for the rationale.

Installation

See the README Quick Start or the in-app Help → Getting Started topics:

Upgrade from earlier versions

Operators on 0.12.x: see Docs/35-migration-0.12-to-0.13.md.

Operators already on 1.0.x or 1.1.0: just bump the four image tags to 1.1.1 and docker compose up -d --force-recreate. No data migrations, no env-var changes.

Docker images

All four images are available at brain40/ursa-oscar-*:1.1.1 + :latest:

  • brain40/ursa-oscar-api:1.1.1
  • brain40/ursa-oscar-mcp:1.1.1
  • brain40/ursa-oscar-web:1.1.1
  • brain40/ursa-oscar-watcher:1.1.1

Test coverage

  • Backend: 350+ tests pass (auth, AI proxy, ingestion, analytics, reports, help-no-drift)
  • MCP: 40+ tests pass (auth provider + tool layer + token resolution)
  • Watcher: 25+ tests pass (loop, API client, token resolution)
  • Frontend: tsc -b && vite build clean

What's next

URSA-OSCAR 1.1.x is feature-stable. Future releases respond to community demand. Items currently under consideration:

  • Multi-profile support (would require re-architecting the single-tenant boundary; non-trivial)
  • Richer authentication models (TOTP, OAuth providers for operator login)
  • Token usage / cost surfacing in the AI chat panel
  • Mobile-narrow UI polish
  • Conversation export (PDF / Markdown)

If any of these matter to you, file a GitHub Issue. Real user feedback shapes priorities; vague intent doesn't.

License

GNU GPL-3.0-or-later, preserving OSCAR's license terms.

Attribution

Built in the spirit and license terms of the OSCAR project. URSA-OSCAR is independent of OSCAR — different codebase, different deployment model — but downstream of OSCAR's file-format work. Without years of OSCAR-community reverse-engineering on ResMed's SD-card format, URSA-OSCAR wouldn't exist.

Assets 2
Loading