DreamLoop v0.2.1

If you installed v0.2.0 and run DreamLoop on anything but loopback, upgrade. v0.2.0 was tagged before the audit fixes merged, so it shipped without the authentication fix.

A six-dimension audit of v0.2.0 (architecture, code quality, security, frontend, tests, docs) produced 31 findings. The fixes landed after the v0.2.0 release was cut, so v0.2.0 does not contain them.

Security

• Binding a non-loopback host (--host 0.0.0.0, the Docker demo) now enables token authentication, prints the access URL at startup, and accepts the token via cookie, header, or query. Previously the app had no authentication at all and relied on a spoofable Host header, so a published Docker port exposed every dream to the local network and let anyone repoint the AI provider.
• Refuse header-less writes from non-loopback clients unless they authenticate. --no-auth / DREAMLOOP_NO_AUTH=1 keeps them open, because that mode has no token to offer a scripted client.
• Hand ?token= to a cookie and redirect it out of page URLs, and redact it from uvicorn's access log, which records full query strings.
• Compare tokens as bytes: compare_digest raises TypeError on non-ASCII input, which turned a bad token into a 500.
• Return JSON rather than HTML for 401s on /api/ paths.

Data safety

• migrate_analysis_table dropped the renamed old table unconditionally, so an analysis table missing a required column lost every stored analysis silently. Unmigratable rows are now preserved in a backup table, and the migration paths have test coverage.
• Recover from a corrupt config.json instead of returning 500 from every page, including the settings page needed to fix it. Both config writers now replace the file atomically.
• Wrap invalid model JSON as AnalysisIncomplete; a truncated or fenced response from a local model surfaced as a 500.

Fixes

• POST /drafts/analyze stores the draft and redirects, so a refresh no longer re-runs a slow LLM call and the URL survives navigation.
• Log the three swallowed exceptions in web.py (the project had no logging at all), stop reporting a missing dream as a provider error, and surface image-generation failures to the user.
• Map import errors to 400/404 instead of 500.
• init() is idempotent; every DreamLoop method re-ran the full migration.
• feedback_summary uses one join instead of a query per feedback row.
• Clamp dream text in cards, fix heat-cell contrast to WCAG AA, add a skip link, reset loading buttons on bfcache restore, and preload the bundled fonts.
• Add SECURITY.md, issue and PR templates, and document that .dreamloop/ is created relative to the working directory.
• 212 tests pass; coverage 87% -> 91%.

Install

pipx install dreamloop==0.2.1

docker run --rm -p 127.0.0.1:8765:8765 ghcr.io/saime428/dreamloop:0.2.1

Full diff: v0.2.0...v0.2.1

DreamLoop v0.2.0

DreamLoop v0.2.0 completes the local-first dream journal loop with stronger capture, pattern discovery, export, and presentation.

Highlights

• Keeps the default workflow local-first: dreams, settings, secrets, generated images, and exports stay under .dreamloop/.
• Adds Markdown and Obsidian-friendly export with one file per dream plus a wikilink index.
• Adds the source-based Docker Compose demo and release image workflow.
• Adds a symbol relationship graph, Chinese demo data, and improved bilingual analysis handling.
• Refreshes all six web pages with responsive layouts, offline CJK fonts, accessible motion fallbacks, and clearer visual hierarchy.
• Includes reliability, security, and maintainability fixes for query performance, import paths, feedback validation, packaged assets, and stored visual accents.

AI and image providers remain optional. DreamLoop does not send dream data anywhere by default; content leaves the machine only when you explicitly configure an external provider.

Install or upgrade

pipx install dreamloop==0.2.0
# Existing pipx installation:
pipx upgrade dreamloop

Source users can update master and run uv sync --extra dev --locked.

See the full changelog.

DreamLoop v0.1.2

DreamLoop's second patch tightens first-screen quality and introduces an explicit image-generation path:

• Reduced Dashboard hero title weight and spacing so the screenshot screen no longer visually overflows.
• Added subtle page-enter transitions and sidebar active-state motion, with prefers-reduced-motion support.
• Fixed the language toggle mojibake so Chinese renders as expected.
• Added optional image provider configuration: local visual cards by default, ComfyUI readiness checks, and a custom OpenAI-compatible cloud image endpoint.
• Added dream_images storage and .dreamloop/assets/images/ output for generated image files.
• Added dream image web/API routes and dreamloop image test.
• Gallery now prefers real generated images and falls back to local visual memory cards.

DreamLoop v0.1.1

DreamLoop's first patch focuses on first-impression reliability and the trust loop around interpretation quality:

• Fixed Dashboard hero overflow in English and Chinese so the README-ready screenshot no longer breaks at common desktop widths.
• Added dreamloop doctor for local setup checks covering data directory, SQLite, AI provider, Ollama/custom endpoints, and hidden key status.
• Added dreamloop demo to seed sample local dreams, mock analyses, and visual memory cards without requiring cloud AI.
• Added local feedback on interpretation reports: resonates, not accurate, and unsure.
• Added a user_feedback SQLite table plus API endpoints for feedback capture and summary.
• Added high-resonance theme summaries to Patterns.
• Added Settings privacy audit copy explaining what may leave the machine for cloud AI, weather sync, and future sync features.

DreamLoop v0.1.0

Changelog

v0.1.0 - 2026-06-13

DreamLoop's first public release turns the project into a usable local-first dream journal:

• Six-page Web loop: Dashboard, Log, Detail, Patterns, Gallery, and Settings.
• Draft-first dream capture: analyze first, then save locally when the result looks useful.
• Detailed interpretation reports with optional reflection prompts, multiple hypotheses, reality-grounded questions, and backward-compatible structured output.
• Local SQLite storage under .dreamloop/, automatically ignored by Git.
• AI providers: Ollama, DeepSeek, OpenAI, custom OpenAI-compatible endpoints, and capture-only mode.
• Multilingual UI and per-language AI analysis for English and Chinese.
• Clickable pattern calendar, symbol trends, theme trends, local gallery cards, and detail pages.
• CLI entry point: dreamloop init, dreamloop add, dreamloop web, AI provider commands, imports, weather sync, and export.
• English and Chinese README files with privacy-first positioning and Obsidian-oriented roadmap.

Release assets:

• Real dashboard screenshot in docs/assets/dashboard-screenshot.png.
• Social preview image in docs/assets/social-preview.png.
• Reproducible demo recording guide in docs/demo-recording.md.

Full Changelog: https://github.com/saime428/DreamLoop/commits/v0.1.0