v1.0.1

Added

• Origin-country flag on OFF search results in Pantry. Each Open Food Facts result now shows a small flag emoji next to the food name when OFF has origin data for it (from origins_tags, falling back to manufacturing_places_tags). Lets you see at a glance whether that "olive oil" is Italian, Greek, or Spanish without opening the entry. Countries OFF doesn't have origin data for show no flag rather than a misleading placeholder.
• Data-completeness indicator on OFF search results in Pantry. Small colored dot next to each OFF row: green when the entry has most nutriment fields filled in, orange for partial, grey for sparse. Long-press or hover shows the exact percentage.
• USDA data-type badge on USDA search results in Pantry. Small color-coded label next to each USDA row (Foundation / SR Legacy / Survey / Branded / Experimental) so you can favor curated Foundation entries over manufacturer-submitted branded ones for common ingredients.
• Per-source tier filter dropdowns on Pantry search. A caret next to the OFF and USDA source chips opens a checkbox panel to narrow results by tier. Defaults to all tiers active; a small dot on the source chip signals when a subset is applied. Filter is client-side (no extra API calls) and also applies in All-mode and multi-source mode.
• All-mode Pantry search. New "All" chip fans out to Pantry + OFF + USDA in parallel with per-row source badges, so you can compare local matches against external DBs in one list.
• Long-press to combine sources on Pantry search. Long-press any external source chip to pin it alongside another — results become a merged multi-source view with per-row source badges (same fan-out as All-mode, but limited to your pinned set). Long-press an already-pinned chip to remove it. Regular tap exits multi mode back to single-source.
• "Custom…" option on the Model dropdown for Claude, OpenAI, and Gemini. Enter any model ID the vendor supports without waiting for the preset list to catch up. Same behavior the OpenAI Compatible provider has always had.
• Retirement remap for retired Gemini models. Saved selections of gemini-1.5-* or gemini-2.0-* (both retired by Google) are quietly upgraded to the current default at request time.
• SSO-only mode via environment variable. Set OIDC_ENABLE_EMAIL_PASSWORD_LOGIN=0 (or false / no) at boot to disable password login server-wide, so users must sign in via an OIDC provider. Locks the corresponding admin UI toggle with an env-lock note. Mirrors the pattern across the TraceApps family (asked for on LT #16).
• Settings search covers new territory: auto-share, send test, cookbook sharing.

Changed

• OFF search results in Pantry are now sorted by data quality within each fetched page. Entries with images and more complete nutrition data surface higher than sparse ones. OFF's server-side relevance still picks the initial batch; the re-rank runs within the batch to reduce the "many near-identical variants" search noise.
• USDA search results in Pantry are now sorted by data-type tier within each fetched page. Foundation and SR Legacy entries surface above the millions of Branded entries that would otherwise dominate common searches like "chicken" or "milk".
• Claude model presets refreshed. Sonnet bumped to Sonnet 5, Opus 4.8 added as a "smartest" tier option, older Sonnet 4.6 removed.

Fixed

• AI Assistant section in Settings would not expand. The Trace settings component ran an initialization block that referenced a Svelte $: reactive variable before Svelte had a chance to run the reactive declaration, throwing TypeError: Cannot read properties of undefined (reading 'includes') at mount time. That crash left the parent openSections state half-applied, so tapping the section-toggle looked like nothing happened. Fixed by inlining the lookup so no reactive dependency is required at init.
• OIDC sign-in now works on Android first-install for OIDC-only servers. NativeSetup previously required a username + password to submit, blocking users on Authentik / Keycloak / Authelia-backed servers with password login disabled. The setup form is now a two-step flow: enter server URL → app fetches /api/auth/status → renders whichever auth methods the server actually supports (password fields only when enabled, OIDC provider buttons with logos when configured, both when both).
• OIDC callbacks no longer fail on the first attempt with a spurious callback_failed. openid-client v5's default 3.5 s outgoing HTTP timeout was tight enough that cold token-exchange requests to slower IdPs would sometimes time out. Bumped to 10 seconds.

Security

• fast-uri bumped to 3.1.4 (GHSA-4c8g-83qw-93j6, high). ReDoS in URI parsing.
• brace-expansion bumped to 5.0.8 (GHSA-mh99-v99m-4gvg, high). DoS via unbounded expansion length.
• body-parser bumped to 2.3.0 (GHSA-v422-hmwv-36x6, low). DoS when an invalid limit value silently disables size enforcement.

v1.0.0

Retiring -rc.N and moving to strict semver. Docker images now
publish under multiple tags so you can pin :1.0, :1, or :latest
depending on how aggressively you want updates. Also delivers a real
Send Test email flow with recipient dialog, fixes two Android bugs
(recipes showing the wrong creation date, and SMTP settings loading
blank), patches a high-severity adm-zip CVE in the backup restore
path, and adds public contributor docs.

Every future release uses strict semver: PATCH for bug fixes, MINOR
for new features, MAJOR for breaking changes. Existing rc.N image
tags and release assets stay live indefinitely; anyone pinned to a
specific rc release is unaffected.

Added

• Multi-Tag Docker Publishing. :1.0.0, :1.0, :1, :latest.
  Pin :1.0 to auto-receive patches without opting into future
  1.1.0 features.
• :dev Docker Tag. Rolling image built from the dev branch.
• Send Test Email Dialog. Asks where to send the test,
  pre-filled with your account email.
• Public Contributor Docs. ARCHITECTURE.md and ROADMAP.md.

Changed

• Retired the -rc.N suffix.
• Send Test actually sends an email now (was just verifying SMTP
  auth).
• Email section moved under Admin.
• Password field uses a Change button when the server has a
  stored value.

Fixed

• Recipes on Android showed the first-connect date instead of the
  real creation date. Heals on next sync after upgrade.
• Email settings blank on the Android app.
• Trace AI chef hat clipped at the top of the FAB.

Security

• adm-zip 0.5.x → 0.6.0 (CVE-2026-39244, high). Crafted ZIP file
  could trigger a 4GB memory allocation during full-backup restore.

---

Signed APK attached. Docker image is multi-arch (amd64 + arm64):

docker compose pull && docker compose up -d

Dev Build (latest)

Rolling dev build. Signed release APK from the tip of dev.

Not for production. This build tracks daily-driver dev work and may contain unreleased features, incomplete UX, or bugs. Use ghcr.io/traceapps/cooktrace:latest and the release APKs on tagged versions for stable installs.

• Docker: docker pull ghcr.io/traceapps/cooktrace:dev
• APK: attached below

The download URL is stable across dev pushes: app-release.apk

v1.0.0-rc.5

Fifth release candidate. All about sharing.

A Kitchen can now Auto-Share every recipe you own with the current members automatically, past and future. Recipes others share with you land in a dedicated Shared tab that lives between Recipes and Cookbooks, with a chip on each card showing which Kitchen the grant came through when relevant. Cookbooks are shareable end-to-end (per user or per Kitchen), and cookbooks can now hold recipes others have shared with you, not only your own. Leaving or being removed from a Kitchen no longer takes your contributions with you; only incoming grants revoke.

Added

• Auto-Share with a Kitchen. Turn on Auto-Share Your Recipes in any Kitchen and every recipe you own (past and future) is shared with current members automatically. New members who join later pick up existing members' recipes too. Great for household setups where everyone should see the same library without having to share each recipe by hand.
• Shared Recipes Tab. A dedicated Shared tab sits between Recipes and Cookbooks and lists every recipe others have shared with you, directly or via a Kitchen. Each card shows a chip for which Kitchen the grant came through, plus a count badge on the tab itself.
• Blend Shared Recipes into Main List (Optional). Toggle under Settings → Cooking. Off by default. On to see your own and shared recipes together in the main Recipes tab.
• Cookbook Sharing. Share a cookbook with specific users or a whole Kitchen. Shared cookbooks appear alongside your own with a Shared chip. Recipes inside a shared cookbook that you haven't been granted individually appear as a locked placeholder, so cookbook access can't be used to bypass recipe permissions.
• Cookbooks Can Hold Shared Recipes. Previously you could only add your own recipes to your cookbooks. Now anything someone else has shared with you can be organized into your cookbooks the same way.

Changed

• Leaving a Kitchen Leaves Your Contributions Behind. If you leave or are removed from a Kitchen, recipes and cookbooks you shared into it stay with the remaining members. Only incoming grants (things others shared with you via that Kitchen) are revoked.

Fixed

• Trace AI panel raw keys. A duplicate trace block in the English translation file was silently dropped by the JSON parser, so several AI-panel labels rendered as their raw key (e.g. trace.panel_sub). Merged and de-duped.

---

Signed APK attached. Docker image is multi-arch (amd64 + arm64):

docker compose pull && docker compose up -d

v1.0.0-rc.4

Fourth release candidate. Kitchens created on the PWA now appear on the Android app, along with pending invites, users list, share peers, and other server-only endpoints that were silently empty in native + server-connected mode. Self-hosted OpenAI-compatible LLMs on a private Docker network (Ollama, LM Studio, LocalAI) can now be proxied through the server via a new AI_BASE_URL env var. Full-backup restore now schema-driven so future ALTER migrations don't silently drop columns.

Added

• AI Base URL support in env-locked mode. Proxy Trace chat to an OpenAI-compatible endpoint (Ollama, LM Studio, LocalAI, or any `/v1/chat/completions` server) via `AI_BASE_URL`. Previously the OpenAI-compatible flow ran client-only; now `AI_PROVIDER=oai-compat` + `AI_BASE_URL=http://ollama:11434\` in `.env` works end-to-end.

Fixed

• Kitchens created on the PWA now appear on the Android app. Same class of bug also affected the pending invites list, users list, share peers, session config, and Mealie/Tandoor/Paprika ZIP import.
• Pending invites populate correctly. The User Management section's data-load hook was orphaned, so Settings → Users showed empty state even when invites had been created.
• Full-backup restore no longer silently drops recipe columns. Restore was using hardcoded INSERT column lists; any column added by later ALTER migrations would silently vanish on restore. Now schema-driven so future ALTER TABLE additions are automatically covered.

v1.0.0-rc.3

Third release candidate. Shopping list gets aisle grouping, drag reorder, hide-checked toggle, and per-row edit. Pantry items gain AI Scan Label for one-shot nutrition capture. Cook Mode reliably keeps the screen awake on Android. Recipe editor gets a mobile kebab menu on ingredient rows. Multi-select on Pantry and Recipes matches NutriTrace. Dependency security bumps clear every actionable Dependabot alert.

Added

• Shopping List Aisle Grouping. By Aisle / By Recipe / Flat chip row, per-category Default Aisle, auto-populate from linked pantry items.
• Change Aisle Per Item. Long-press a row to pick a known aisle or type a fresh label. Custom aisles work as their own groups.
• Drag to Reorder Shopping Items. Cross-group drops in By Aisle mode reassign the moved item's aisle.
• Hide Checked Items Toggle. Settings → Cooking. Sink to Bottom (default) or Hide with a one-tap show-again toggle.
• AI Scan Label for Pantry Nutrition. Photograph a nutrition label, Trace extracts name, brand, serving size, and every nutrient. Complementary to the existing barcode scanner.
• Per-Row Edit on Shopping Rows. Long-press for Edit, Change Aisle, or Delete. Edit modal for name, quantity, and unit.

Changed

• Simplified Shopping Quick-Add. Name plus optional qty plus a labeled Add pill, matching Google Keep, Bring!, AnyList, and OurGroceries.
• Consolidated Bulk-Add into a + Menu. Header is now Share + a single + button. Tapping + opens Add from Recipe or Add from Planned Cooks.
• "Add from Meal Plan" Renamed to "Add from Planned Cooks". Matches the Diary's language.
• Recipe Editor Ingredient Rows on Mobile. Three per-row action buttons collapse behind a single kebab menu on small screens. Notes edited in a second inline row.
• Multi-Select on Pantry and Recipes. Long-press to enter, header shows N Selected, top-right icons for trash and cancel (Recipes also has add-to-cookbook). Replaces the floating action pill.
• Recipe Editor Landscape on Phone. Ingredients and Steps stay stacked in phone landscape. Two-column view only on tablet-landscape widths and up.

Fixed

• Cook Mode reliably keeps the screen awake on Android via the native `KeepAwake` plugin. PWA continues to use the Web Wake Lock API.
• Cook photos taken during a diary log render immediately on the Diary Photos tab. Older photos still render via a backstop conversion.
• Bulk-add from a recipe or planned cook populates each row's aisle from the linked pantry item's category.
• Long-pressing a Shopping row no longer lets you drag it while the action menu is open.
• Cancel out of Pantry multi-select no longer leaves an invisible layer blocking taps until reload.
• The Shopping quick-add box no longer freezes on mobile when the pantry has hundreds of items. The suggestion list is now capped.

Security

• Dependency Security Updates. Bumped `multer` 1.4.5-lts.1 → 2.2.0 (three high-severity DoS CVEs), `nodemailer` 8.0.7 → 9.0.3 (five CVEs including TLS OAuth cert-validation bypass and CRLF header injection), and `vite` 7.3.3 → 7.3.6 (dev-only `server.fs.deny` bypass). Package overrides pull `esbuild` forward to ^0.25.0 to clear a dev-server CORS advisory nested under svelte-i18n. Clears every actionable Dependabot alert. Self-hosters on Docker just need to pull the new image.

v1.0.0-rc.2

[1.0.0-rc.2] - 2026-07-02

Added

• Pantry Variants. A pantry row can now carry brand-specific
  rows underneath it. Recipes link to the parent (Whole Milk); each
  variant (Greenwise, Publix) has its own barcode, photo, stock,
  and expiration date. Add Variant with inline suggestions: type
  a brand and existing pantry items surface as tap-to-attach chips.
  Delete of a parent with variants asks whether to keep the variants
  as standalone items (default, safer) or remove them together.
• Recipe Nutrition Source on the Parent. A generic pantry item
  can either use its own nutrition numbers (default) or pull from
  one of its variants, so recipe math reflects the label of the
  product you actually cook with.
• Pantry Expiration Dates. Every pantry row gains an Expires On
  field with an in-sheet calendar picker. Amber pill on cards for
  anything expiring within two weeks, red for past. Expiring Soon
  filter chip surfaces the whole set in one tap. Variant expiries
  surface as chips inside the parent sheet's Variants list.
• Expiration Digest Notification. Once-a-day roll-up covering
  everything expiring within a chosen window (1 / 3 / 5 / 7 / 14
  days), delivered at a chosen time. Push goes out through Apprise,
  Gotify, or ntfy plus the local device channel. Past-expiry items
  always included regardless of window. Settings → Notifications →
  Reminders → Expiration Digest.
• Rest Time Field on Recipes. Any hands-off period, bread rise,
  meat rest, dough chill, marinate, soak, ferment. Left blank stays
  hidden on the recipe view; set adds a Rest meta pill next to Prep
  and Cook. Rolls into the auto-calculated Total Time below.
• Total Time Manual Override. Optional field in the recipe
  editor. Leave blank and the app auto-calculates from prep + cook
  • rest; set a value and it wins. Placeholder shows the auto-calc
    live so you see the fallback before overriding.
• Clear Link on the Category Picker. A small Clear link appears
  in the pantry item's Category label when a category is set,
  wiping the selection in one tap.
• New Preserves Recipe Category. Jams, pickles, curds,
  chutneys, ferments, canning recipes, none of which fit cleanly
  under Sauce, Bread, or Dessert. Added to the default seeded
  chapter list with a berry / pomegranate color that reads clearly
  distinct from Bread. Existing accounts keep their category list
  untouched; only fresh installs get the new default automatically
  (add it in Settings → Recipe Categories if you want it on an
  existing account).
• Animated Variant Expand and Collapse. Chevron rotates
  smoothly on the parent card, variant cards drop in from above
  with a spring easing on expand, slide back up on collapse.
  Honors OS-level reduce-motion preferences.
• Import Cookbook. A single multi-recipe PDF (a whole cookbook,
  a printed booklet, a folder of scanned recipe pages) can now
  import as multiple recipes in one pass. The AI parser splits the
  file into individual recipes, previews each, you pick which to
  save. (Issue #2 phase 3)
• Bulk File Import. Pick a folder or a ZIP archive of recipe
  files and import everything in one go. Per-file preview and
  dedup before commit. (Issue #2 phase 2)
• Hybrid File Import. PDF, RTF, TXT, and Markdown files import
  through a heuristic parser first (fast, no AI cost); the AI
  parser catches anything the heuristic can't structure. Both
  paths land in the same preview + edit flow.
• Batch URL Import. Paste a list of recipe URLs and import them
  all in one pass. Scanned PDFs and image-only pages route through
  an AI vision fallback so they parse instead of failing silently.
• Use Camera Shortcut in File Import. Snap a photo of a
  handwritten recipe card or a printed page directly from the
  import dialog, alongside the file picker.
• Swedish Translation. Contributed by @olsson82 via PR #3.
  Switch in Settings → Regional & Units → Language. Coverage is
  what @olsson82 translated at PR time: primarily the auth flows
  (Login, Register, Reset Password, Accept Invite, Profile),
  User Management, sidebar labels, and a couple of common UI
  components. The rest of the app went through an i18n
  instrumentation pass this release so a much larger set of
  strings (bottom nav, main-route titles, empty states, Settings
  section headers, Recipe view labels, Recipe editor fields,
  Pantry item sheet, Trace welcome) is now extractable and
  registered under English keys. Those newly-extracted keys
  fall through to English for Swedish users until a Swedish
  speaker translates them in a follow-up PR — we didn't want
  to put in-house wording into @olsson82's file. A pull request
  filling in the remaining sv.json entries is warmly welcome.
• Language Picker. Regional & Units gains a Language dropdown
  populated from the registered locale list, so Swedish (and any
  future translation) is actually reachable from the UI. The
  translation existed in PR #3, but the picker to select it was
  never wired.

Changed

• Animated Page Banners. The illustrated SVG headers on
  Recipes, Pantry, Diary, Shopping, and Settings are retired in
  favor of four animated background styles picked in Settings →
  Appearance: Shimmer (subtle sweep, default), Drift (slow
  horizontal float), Pulse (color breathe), and Aurora (Northern
  Lights sweep). All four honor the OS's reduce-motion preference.
• Import Menu Collapsed. URL and File imports used to be two
  separate top-level entries; they now sit under a single Import
  entry that expands to show both sub-options. Same functionality,
  cleaner surface.
• Password Rule Hints for Autofill. Password inputs on the
  wizard, register, reset, and profile screens now declare their
  requirements via the passwordrules attribute, so iOS and
  Chrome autofill generate a password that actually passes CookTrace's
  8-plus-mixed-plus-symbol check instead of one that gets rejected.
• Recipe Category Colors Tightened. Snack, Sauce, and the new
  Preserves each moved off crowded hue bands so the chip row scans
  cleanly at a glance. Snack shifted from yellow to teal (was too
  close to Breakfast's amber), Sauce shifted from violet to indigo
  (was too close to Appetizer's purple), and Preserves sits at
  berry / pomegranate rather than rust (was too close to Bread).
  Existing accounts keep their current colors; only fresh installs
  get the new palette.
• Recipe Times Show Hours and Minutes. Every recipe-time display
  now reads in hours and minutes instead of raw minutes. A 75-minute
  recipe shows as 1h 15m on list cards, detail view, cookbook
  cards, public share pages, the shareable card, and the
  file-import preview. The editor input still takes raw minutes.
• Smart Pantry Search Under Variants. Query the parent name and
  you get the parent card alone. Query only a variant's brand and
  you get that variant alone with a "Variant of Whole Milk"
  subtitle, no duplicate parent. Query both and the parent expands
  with the matching variant nested underneath.
• Expires On Uses the In-Sheet Calendar Picker. Matches every
  other date entry in the app instead of the browser's default
  mm/dd/yyyy widget.
• Tandoor Imports: waiting_time Maps to Rest. Tandoor's
  waiting_time is a hands-off signal by convention, so it lands in
  Rest Time instead of Cook Time. Working_time still maps to Prep.
  Cook stays null on Tandoor imports; the auto-calculated Total
  covers everything correctly.
• Native Pantry Updates Only Write Fields the Payload Carries.
  A stock toggle no longer rewrites brand, category, or FK columns
  as a side effect. Prevents unrelated data from getting nulled
  on partial edits.

Fixed

• Pantry Stock Toggle No Longer Crashes on Native. The
  top-right quick-toggle on any pantry card threw "NOT NULL
  constraint failed: pantry_items.name" because the partial update
  was writing every column with undefined placeholders. Only
  present fields get written now.
• Variant Relationships Survive Mobile Edits. Setting Greenwise
  as a variant of Whole Milk on the PWA now stays set on the phone
  through unrelated stock toggles, quantity bumps, and brand edits.
  Was silently reverting because the sync order was push-then-pull,
  so a stale local row propagated back to the server before the
  server's fresher state pulled down. Order is pull-then-push now,
  and the server preserves FK columns via COALESCE when the client
  sends NULL.
• [object Object] Category Pill on Mobile. The category pill
  on the pantry sheet was rendering the raw category object rather
  than its name on Android. Native queries now join the category
  the same way the PWA server does.
• Category Casing Mismatch Between PWA and Mobile. "Dairy &
  eggs" on Android vs "Dairy & Eggs" on the PWA. The pill now
  reads the live category row instead of falling into a hardcoded
  slug-to-label map with older casing.
• Dropdown Menus Close on Outside Scroll. Combobox dropdowns
  portaled to the body layer were blocking wheel and touchmove
  events from reaching the sheet underneath, so scrolling the page
  while a dropdown was open did nothing. Outside scroll now closes
  the dropdown and lets the scroll through.
• Confirm Dialogs Stack Correctly Over the Sheet. "Remove from
  pantry?" and similar confirms were rendering behind the item's
  own edit surface, making the buttons invisible.
• Native DB Init Survives Upgrades. A pantry index creation
  ran against an old schema on first launch after an APK upgrade
  and blocked the whole database from initializing. Moved the
  index into the migration that adds the column so it runs after
  the ALTER.
• Trace AI Provider Fields Are Read-Only After Save. Once an
  AI provider config is saved in Settings → Trace, the API key
  and Base URL fields lock so you can't accidentally overwrite
  them by tapping through the fo...

v1.0.0-rc.1 — first public release candidate

CookTrace v1.0.0-rc.1 — first public release candidate.

Self-hosted recipe, pantry, and cooking tracker. Single Docker container, AGPL-3.0, no telemetry, no cloud sync, all data on your hardware. Third app in the Trace family alongside NutriTrace and LiftTrace.

📷 Screenshots · 📦 Docker image · 📖 Deploy guide · 🔐 Privacy

---

After several months of private dev as the v0.x-beta series, CookTrace is going public for wider testing. This release candidate snapshots the dev branch at feature completeness — Recipes, Pantry, Cook Diary, Meal Planner, Shopping, importers, federation, AI assistant, and a native Android app are all end-to-end.

What's in v1.0.0-rc.1

Aggregate feature surface (everything below is shipped):

• Recipes — full model (hero photo, rating, favorite, yield, prep / cook / total time, servings, ingredient groups, step list, kitchen gear, source / video URLs, rich-text notes), per-step photos, inline markdown formatting, live recipe scaling with snap-to-fraction quantities, inline unit converter with 250-entry density table, Cook Mode (Screen Wake Lock + bigger fonts + persistent checkboxes), per-recipe cook history, FDA-style Nutrition Facts box with sodium ↔ salt auto-derive
• Recipe Editor — drag-to-reorder ingredients + steps, pantry-link button per ingredient row, Add-from-Pantry picker, auto-save drafts to localStorage, sticky save bar, sanitized rich-text Notes
• Pantry — slide-up details sheet with in-place edit, inline nutrient editing, Grid + List view modes, bulk multi-select, Open Food Facts + USDA lookup, native barcode scanner (ML Kit on Android, QuaggaJS on web), pantry-match pill on every recipe card
• Diary — Cook Diary + Meal Planner: list view (60 back / 30 forward), month calendar with drag-to-re-plan, per-recipe history, one-tap planned → cooked
• Shopping — aisle-grouped list, from-recipe pull (skips stocked items), bulk clear-checked, cross-recipe dedup
• Importers — three URL engines (schema.org JSON-LD, recipe-scrapers Python lib with 300+ extractors, AI Smart Mode), AI photo import, Mealie / Tandoor / Paprika exports + bulk-zip with thumbnail picker, category carry-over, NutriTrace foods → Pantry
• NutriTrace federation — bidirectional integration: search NT's food library + bulk-import as pantry items, link recipe ingredients to NT foods, log cooked recipes back to NT's diary. Tokens never reach the browser
• Trace AI assistant — Claude / OpenAI / Gemini / OpenAI-compatible (Ollama, LM Studio, LocalAI, DeepSeek, Groq), tool use across all providers with 18 tools (real recipe / pantry / diary / shopping / cookbook reads + writes), hold-to-record voice Smart Log, image attach, persistent cross-device chat history
• Multi-user — wizard onboarding (local-only or connect-to-server), invite tokens, SMTP-backed password reset, OIDC SSO with multi-provider admin UI + encrypted client secrets + RP-initiated logout (Authentik / Keycloak / Authelia / Pocket-ID / Google / etc.), Kitchens (multi-user soft groups), optional strong-password policy, biometric sign-in on Android
• Android app — Capacitor 8, runs standalone (fully offline, on-device SQLite) or server-connected (differential sync engine, merge dialog on connect), Health Connect for Trace family parity, native ML Kit barcode scanner, native notifications, biometric sign-in, OIDC deep-link SSO
• Branding & display — 12 named accent colors + HSL/RGB/Hex picker, light / dark / system theme, imperial / metric × kcal / kJ unit independence (locale-aware default), persistent sidebar on desktop, skeleton loaders, sticky search + filter
• Backup & restore — full ZIP backup (admin, server mode) with zip-slip + zip-bomb defenses, scheduled auto-backups (off / daily / weekly / monthly + retention), portable JSON, Android local-mode self-contained .zip for phone-to-phone transfer
• Diagnostics — in-app 500-line log ring buffer, crash report banner, file logging on Android (7-day retention)
• Print — Cmd-P on a recipe view yields a clean one- or two-page recipe card

Distribution

• Source: github.com/traceapps/cooktrace (AGPL-3.0)
• Docker image (multi-arch: linux/amd64 + linux/arm64): ghcr.io/traceapps/cooktrace:1.0.0-rc.1 and :latest
• Android APK: attached to this release, signed with the shared TraceApps release keystore (same cert as NutriTrace and LiftTrace, so all three apps install side-by-side with no reinstall)

docker compose pull && docker compose up -d

Known limitations

• iOS — not currently available. Pending hardware + Apple Developer account access
• Local / self-hosted LLM via OpenAI-compatible adapter — works today for AI chat + tool use; image-import (photo of a recipe page) is most accurate against cloud providers (Claude / OpenAI / Gemini) with vision support

Reporting bugs

Settings → Diagnostics → View Logs → Copy / Share → attach to a GitHub issue.

---