FormLogic v0.1.20

Before you update

• This release replaces v0.1.19, which was withdrawn. Everything in it is here. If your site is on v0.1.19, update as usual.
• Behind Cloudflare or another CDN? Purge /sw.js and /registerSW.js once, right after this update. From now on the site tells a CDN not to keep those files, but one already holding the old sw.js can go on serving it for hours. Until it stops, returning visitors stay on the page they had stored, and on a site coming from v0.1.17 or earlier that page never asks for a password when setting up two-factor. An administrator then sees "Incorrect password" and can't reach the admin panel. Your password is fine: reload with Ctrl+Shift+R and the password box appears. If you're still locked out, add ADMIN_MFA_REQUIRED=false to api/.env, set up two-factor, then remove it.
• Coming from v0.1.17? Read the v0.1.18 notes first. Your update still runs under the old updater, which deletes anything in the web root and api/ that isn't in the package, such as a .user.ini, robots.txt or api/.env.backup-*. Copy those out first. Administrators still need two-factor, and the scheduled jobs in DEPLOYMENT.md still need adding.
• Scheduled jobs: use the new log paths. The old lines wrote to /var/log/formlogic-*.log, which the web server's user can't create, so the job never started and nothing said so. If you copied them into that user's crontab, replace them with the lines in DEPLOYMENT.md or INSTALL.txt, which log under api/logs/.
• Connected a custom domain? APP_URL is still the right setting. Members can now sign in without it on a site installed with the wizard, because the site's address is read from CORS_ORIGIN, but a site still on the example localhost value has no address to send them to. New wizard installs write APP_URL for you, and connecting a new domain needs it.
• Hosted app databases now use WAL, so back up api/storage the safe way. A plain tar of a running site can miss recent writes to them. Use FormLogic's own backups, or stop the site first. See DEPLOYMENT.md.
• Custom screens on public forms. FormLogic.submit() gives a visitor back the answers they sent, with the record's id, status and timestamps. Calculated fields and tags stay with the form's owner, so a quiz has to work out its own score in the screen.
• A form whose script made an HTTP request and then stopped now answers 409 with scriptRan: true, not 503. If your own code retries on 503, this is what stops it charging a card twice. The same idempotencyKey keeps getting that answer and doesn't run the script again, so to send it again after checking, use a new key. A script that made no call answers as before.
• Form-limited API keys only reach form routes since v0.1.18. A script that also calls flows, AI or data nodes needs a key without that limit.
• Version history keeps the newest 200 versions of each form. Older ones are removed as new ones are saved.
• bin/upgrade-aokie-receptionist.php. Connector grants are no longer added back on their own, because a grant an owner declined looks the same as a missing one. A dry run lists them, and --approve-grant adds the ones you name.

What's fixed

Saving and editing

• Two people editing one record at the same moment: one of them got a server error, every time. Both edits now land, and neither is lost.
• Two tabs saving a form at the same instant could both succeed, and the later save removed the other's work. One now wins and the other is told.
• Answering a form while it's being deleted now says the form is gone, instead of a server error.
• A capped form with a script holds a person's place through the script, so nobody is charged by a script and then told the form is full. Such a form takes people one at a time, and anyone behind a slow script is told it's busy after a second, so a rush doesn't slow the rest of the site.
• If a form's script made an HTTP request and the record then isn't stored, or the script stops or refuses, no copy of it can run the script again, whether from an offline queue, the service worker, a second tab or a lost answer, so a script that charges a card can't charge twice by itself. The person is told to check first, and can still send it. A script that makes no call retries as before.
• A busy public form says it's busy, instead of telling the visitor to check their connection.
• Sending a record's answers in the wrong format through the API is refused. It used to wipe the record and its files.
• One invitation goes out when two people send it at once.
• Reports, documents and app settings changed by two AI tool calls at once no longer lose one of the changes.

Forms and the builder

• Add relation always failed. It works now, and from the Studio's Data step too.
• Uploading a real logo or background stopped the whole form saving and publishing, with nothing to say why. Images are now shrunk on upload.
• Simple Mode conditions on choice questions could never match after an option was renamed, because they compared the label. They now use a picker. Conditions on dates and calculated fields are fixed too.
• Version history has Restore on every row, shows a failed load instead of an empty list, and reaches past the newest 50.
• The Studio's Data step no longer erases fields added elsewhere, can add a field called Value or Count, and shows when a save failed.
• Opening the builder from the Studio no longer says a form needs an app.
• Clicking into an app's description and away no longer erases it.
• A chat that changes a form while another part of it is saving no longer leaves your next edit refused with no way out.
• A changed AI service key is no longer replaced by the old one after a test.
• "Run on server & log" recorded a run that never ran, so it's gone.

Apps

• Hosted apps no longer run one action at a time: readers don't wait for writers, and a busy app says so.
• Opening one app while another is still loading can no longer show the wrong app.
• A form link on a domain connected to a SoftN app opens the form again.
• A first visit to a connected domain shows its app, never FormLogic's pages, however slow the connection.
• Self-hosted sites no longer make every page wait for a domain lookup: only the first page in each browser does.
• Uninstalling a pack puts hosted and native apps in the bin, with their data. If the bin can't keep a copy, nothing is deleted, and you can choose Delete anyway: whatever can be copied still goes to the bin, and only what can't is gone for good.
• A form whose file is damaged can be deleted now, after one more question. It had no way out.
• A crash during an uninstall can no longer cost a live private form its keys.
• Deleting a staff account no longer deletes the app's call routing groups.
• A pack can no longer turn on public records for one of its forms.

Chat and AI

• A chat thread stopped working for good once its history got too big. Long threads now keep working, and the older images give way first.
• A chat with a broken template or a silent service no longer stays on "Thinking…". There's a Stop button, and a turn is given up on after five minutes of silence, or 15 minutes in all.
• One empty reply from a model no longer breaks its thread, and threads it already broke work again.
• With Site AI off, generating a form says to connect your AI, instead of "try rephrasing".

Offline

• "Saved on this device" could appear when nothing was saved, on a nearly full device.
• Answers queued by one account can no longer be sent under the next one to sign in.
• A slow desktop command now says it may have run, so a call or a message isn't sent twice by trying again.

Accounts and access

• "Forget this browser" failed every time, in every release that had it.
• Connecting a site's own address to an app locked everyone out of signing in. A site in that state now works again.
• Signing in to an app on its own domain says when the site couldn't be checked, with a Try again button, instead of saying it isn't connected.
• A password reset now says that it signed out API keys and linked apps.
• Two refreshes of one OAuth token no longer unlink a client.
• Any app member could read the Companion staff list.
• Erasing an account could report done with app data left on disk.
• A taken role or group name showed a database error. Database errors no longer reach the page: busy ones say to try again.

Running a site

• An administrator can pause a runaway flow without the owner's leave.
• The Companion relay no longer throttles apps during a live call.
• A CDN can no longer hold a release back. The site now sends sw.js, registerSW.js and index.html with Cache-Control: no-cache, so returning visitors get the new release instead of staying on the page they had stored.
• Two-factor setup from an out-of-date page now says the page is out of date, instead of "Incorrect password".
• A build file that no longer exists answers 404, instead of the app's home page under a script's name.
• A self-hosted site's home page no longer says "This domain isn't connected yet".
• A webhook whose worker died on its last attempt no longer stays stuck. webhook-worker.php --loop rides out a passing database error, and exits if the connection is lost, so run it under something that restarts it.
• Older form ids, such as one with a dot in it, can be restored and updated again.
• NATIVE_WORKERS_PER_APP sets how many native workers one app may use.

Tested with

SoftN v0.0.30 (ZIPP v0.0.32) and OAIY v0.1.11.