Changelog

Current version

v1.94.2

Fix Smart Engine online-flap: an engine heartbeating near the 120s window edge would flap online↔offline every sweep. The control plane now SERVES the heartbeat cadence (heartbeat_interval_seconds=60) in the engine config so both sides agree instead of the engine guessing, and the offline window is held at 3× that cadence (STALE_SECONDS 120→180) so an engine can miss up to ~2 beats (network blip / a long job pausing the loop) without being swept offline. Invariant unit-tested (window ≥ 2× cadence). Server-side; no migration. Prior label retained below. — Engine results in the audit log: the legacy CSV-result engine path (POST /api/v1/engine/result) now writes an engine.result audit entry the same way the structured ingest path writes engine.ingest, so every form of SmartEngine processing is visible in the admin Audit Log (cyan engine badge, link to the resulting analysis). Additive; no migration. Prior label retained below. — Upload bundle in the audit log (links to every processed file): a Smart Upload submits all its files together (datalogs, GPS, presets, photos, video) — now the whole upload is recorded as ONE upload.bundle audit entry, grouped by the batch id, with the per-kind counts and a clickable link to each resulting processed file (analysis page for datalogs, the GPS/photo/preset views for the rest). The admin Audit Log renders those links inline. Purely additive + guarded (best-effort, never blocks the upload); no migration. Prior label retained below. — Trip photos as a player layer (image proximity): geotagged photos attached to a session's trip now appear in the datalog player — dropped as clickable camera pins on the map, and as the car marker passes within a radius (default 25m, adjustable; auto-popup toggle) of where a photo was taken, the photo auto-pops as a dismissible overlay layer. The player() controller loads the trip's ready photos with GPS coords (media.trip_id, type=photo); player.php exposes window.CV_PLAYER (map + active marker) + CV_TRIP_IMAGES; a separate, syntax-validated trip-image-layer.js asset does the pins + proximity popup as a READ-ONLY observer that never touches the playback loop (so it can never break the player). Guarded for installs without the media table. Prior label retained below. — Webhooks: surface the last delivery error. A failing webhook now explains itself at a glance — the Account → Webhooks page shows the most recent delivery's error (TLS/connection/non-2xx) under each hook when its last attempt did not succeed, via a last_error/last_success annotation added to listForUser. Failed deliveries are also error_log'd so a server-log tail surfaces them. Diagnostic only; the delivery machinery is unchanged. Prior label retained below. — Multi-source GPS reconciliation — pick a trip's source of truth: a trip can carry several GPS sources of differing trust (the first-party phone app, a dedicated GPS file, GPS extracted from GoPro/Insta360 video, or an AP-speed-derived track). Migration v1.82 adds gps_tracks.source_type + source_priority (lower = more authoritative) + is_primary. New GpsSourceReconciler elects the primary by a ladder (phone app › GPS file › video › AP-derived; ties → most points → newest), and the Trip page lists every GPS source with its type/points and a "Make source of truth" override. The /api/v1/gps-track upload now tags source_type (the iOS app sends device_app, which auto-wins) + its priority and re-elects the trip primary. Pure ladder/election logic (priorityFor/inferSourceType/pickPrimaryId) is unit-tested. Additive + guarded — the existing trip path/correlation display is untouched; wiring the primary to DRIVE the displayed path is the next step. Prior label retained below. — Desktop Smart Engine module (server-half): a Smart Engine can now run as a downloadable Desktop module, not just a Docker container. Migration v1.81 adds user_engines.kind (docker|desktop, default docker for back-compat) + user_engines.hostname (self-reported computer name). The register/heartbeat endpoints accept and persist kind+hostname via persistEngineRuntime (kind whitelisted to docker|desktop), publicEngine surfaces them, and the Account → Smart Engine list shows a Docker/Desktop badge + @hostname so you can tell your machines apart. Same auth + encrypted-result path for both kinds — the desktop module gets an engine key, never a DB credential. Prior label retained below. — Security: webhook SSRF guard. Webhook delivery POSTs to a user-supplied URL; validateUrl previously allowed HTTPS to ANY host, so a user could register a webhook at a private/internal address (10/8, 172.16/12, 192.168/16, 127/8 loopback, 169.254.169.254 metadata, IPv6 ::1/fe80::) and use the server as an SSRF probe. validateUrl now resolves the host and rejects any target that maps to a private/loopback/link-local/reserved IP (the explicit localhost dev affordance is exempt; unresolvable hosts are rejected). New pure WebhookService::isPublicIp seam is unit-tested. Prior label retained below. — Mobile: global overflow safety net (stop formatting going off iPhone screens). Long unbreakable identifiers (engine UIDs, API keys, VINs, hashes, URLs, file paths) now wrap instead of stretching their column; media + tables are capped to the viewport; bare tables (not using .table/.table-scroll) scroll instead of widening; and any stray horizontal overflow is clipped at ≤980px. Pre-formatted command blocks keep their own overflow-x:auto so they still scroll rather than wrap. Prior label retained below. — Webhooks: wire the 5 events that never fired. Five catalog events were subscribable in the UI but had NO dispatch() call site, so they silently never posted: engine.online / engine.offline (now fired from EngineControlPlane::registerOrHeartbeat on a real offline→online transition + new registration, and from setOffline + the stale-engine sweep), engine.job_completed (EngineController::result AND the new ingest), trip.completed (RouteJob::finishRoute), and subscription.updated (PaymentController on renew + status change). The delivery machinery (HMAC signing, retries, TLS, webhook_deliveries logging) was already correct — this was purely missing call sites. vin.locked / vin.mismatch were already wired (the stale doc comment wrongly listed them as TODO; corrected). Engine events fire only on real transitions, never per-heartbeat. Prior label retained below. — Smart Engine direct ingest (server is the sole DB writer; engine holds no DB credential): NEW POST /api/v1/engine/ingest lets a Smart Engine submit its ALREADY-PARSED result — typed datalog rows + extracted GPS + AP-info — so shared hosting inserts directly instead of decompressing + re-parsing a CSV. SECURITY MODEL: the engine never holds a database credential and never connects to MySQL (the DB is shared/multi-tenant, MySQL has no row-level security, and the engine — especially the coming Desktop module — runs on hardware we don't control). The decrypted payload is DATA only; the server (the sole DB writer) derives ownership itself (session must belong to the token user AND be assigned to THAT engine), whitelists columns to a fixed schema, coerces/validates values, rejects oversized payloads, and re-runs analysis SERVER-SIDE so client-computed verdicts are never trusted. Naturally idempotent (rows/anomalies/gps replaced). DatalogController::ingestEngineResult reuses the exact insert columns + AnalysisEngine + VIN-lock + fingerprint + tune + render + webhooks as processSession; EngineController::ingest does chunked-CVRS reassembly + decrypt + inflate + validate (validateIngestPayload, unit-tested) + ownership + audit (engine.ingest in both engine_audit_log and audit_log, with a link to the analysis). The legacy compressed-CSV path (POST /api/v1/engine/result) keeps working for older engines. Prior label retained below. — AP-Connect: bound the last unbounded fetches (no more connect/upload hang): the WebUSB device reads were already time-bounded, but two NETWORK calls were not — the VIN-first vehicle-prepare POST (runs on connect, before logs load) and the preset-batch upload POST. A server that accepted the connection but never responded left either pending forever, freezing the flow at "Reading device info…" or "Uploading presets…". A shared fetchWithTimeout (AbortController + timer) now bounds EVERY connect-ap network call — vehicle prepare (30s), datalog upload + preset upload (120s) — so a hung/slow server fails fast and the batch always advances. READER_VERSION bumped (asset() mtime cache-bust ensures the browser gets the new JS). Prior label retained below. — Downloads pages: install/use walkthroughs + accurate Docker deploy guide: The Smart Engine download page now carries a full deploy guide (pull, CPU + GPU runs, env-var reference, docker-compose, verify, update, troubleshoot) and the Desktop page an install + first-use walkthrough. Corrected the engine run instructions to match the shipped container: it authenticates with CV_KEY ALONE (no CV_USERNAME / CV_ENGINE_KEY), image grioghar/cobbvision-smartengine:0.4.0 (not a ghcr :latest), volumes cv_temp + cv_cache, host port 8443->6088 — the old copy-paste would have failed. docs/help/smart-engine.md mirrors the deploy guide. Prior label retained below. — Parser also inflates zlib/deflate (defense-in-depth + recovers pre-fix engine results): DatalogParser already transparently gunzips .csv.gz; it now also inflates zlib (RFC 1950, the engine compress2 format) and raw DEFLATE, header-sniffed. This makes the parser robust to ANY compressed log handed to it AND recovers datalog sessions whose storage was overwritten with the engine's zlib result before the v1.89.2 server-side inflate — a plain reprocess now inflates the stored blob back to real rows (no re-upload). Prior label retained below. — Engine offload result inflate fix (empty "Health 100%" analysis): The Smart Engine zlib-compresses (compress2) the normalized CSV before CVRS-encrypting it, but the server wrote the DECRYPTED-yet-still-COMPRESSED bytes straight to the session storage — so the worker parsed a zlib blob, inserted 0 rows, and the log finalised as a dataless "Health 100%". EngineController::result now inflates the decrypted payload (zlib/gzip/raw-deflate, header-sniffed, 256 MB bomb cap) back to plain CSV before the authoritative pipeline runs. Scoped to the engine path; the native encrypted-upload path does not compress. Prior label retained below. — Engine offload result decrypt fix (OAEP-SHA256) + multi-platform parser + processing-page UX: The Smart Engine offload now completes end-to-end. Its encrypted result is RSA-OAEP wrapped with SHA-256 (as every native client does), but the server decrypted with PHP openssl_private_decrypt, which only does SHA-1 OAEP — so every result was rejected (HTTP 422) and the engine re-claimed the job forever. New CobbVision\Services\RsaOaep (RFC 8017 RSAES-OAEP, SHA-256 + MGF1-SHA256, over raw RSA) is wired into BOTH server decrypt paths — EngineEnvelope::openResult AND ApiController::decryptBundle — so engine offload AND native encrypted upload both work (verified: a 9.4 MB log finalises in ~4s post-offload vs ~210s on DreamHost). DatalogParser gained verified per-make column aliases (Subaru EJ/FA + VW/Audi MQB EA888 Gen3) behind a case/whitespace-tolerant canonicalizer; unverified makes (Mazdaspeed, Ford EcoBoost, GT-R, Porsche, BMW) are left as commented TODOs (no fabricated headers). The Smart Upload processing page no longer shows a false "Failed" for a log that is merely still queued/processing — it shows a calm "still processing, check History" and keeps polling. Prior label retained below. — Webhooks + Smart Engine mesh/DNS/audit + collapsible nav + VIN-lock + download landings + worker self-heal: Outbound WEBHOOKS — users register endpoints and tick which events each receives (analysis.completed/failed, anomaly.critical, datalog.uploaded, trip.created/completed, engine.online/offline/job_completed, vin.locked/mismatch, subscription.updated); deliveries are HMAC-SHA256 signed (X-CV-Signature), logged to webhook_deliveries, manageable from the account page + an admin oversight page + JSON API. SMART ENGINE control plane is now fully control-plane-served: bootstrap/heartbeat hand the engine its ENTIRE runtime config (listen_port, log_level, TLS, DNS, mesh peers, ap_connect) so NOTHING resides on the container; per-engine configurable PORT + four LOG LEVELS (error/warn/info/debug) set on the control plane; engines ANNOUNCE activity to POST /api/v1/engine/audit, recorded into engine_audit_log at/above the engine threshold and surfaced as a per-engine audit log (jobs done + types). Each engine registers DNS as <hostname>.<username>.<apex> via the DreamHost DNS API (public A record), polled every ~10 min until it resolves; traffic is routed internal-first when the user shares the engine's WAN (failover to the public hostname). User-supplied or Let's-Encrypt TLS certs can be pushed from the control plane (engine_certs). Smart Upload, when you have an online engine, offers to upload DIRECTLY from that engine (least-loaded, internal/external URL). NAV reworked into a collapsible, 3-level, scrollable sidebar with the user block pinned bottom-left. Every download now has a LANDING page (/downloads hub + per-component). A top-of-page PROCESSING BANNER shows live Smart Engine/Smart Upload progress (how many of what, done, left, elapsed). VIN-LOCK: the first time an AccessPort's logs are processed, its identity is locked to the vehicle VIN (anti-frogging); later mismatches are flagged. WORKER self-heal: the pending-datalog drain is wall-clock-budgeted, per-session timeout-wrapped, and dead-letters crashed/OOM sessions so one bad log can no longer block the queue. Migration v1.80 adds webhooks, webhook_deliveries, engine_audit_log, engine_certs, ap_vin_locks and the user_engines DNS/port/log/tls/config/jobs_done columns. Prior label retained below. — AP-connect download-all no longer hangs + key-only engine bootstrap + robust .gz ingest: The WebUSB "Upload all logs" flow on /connect-ap could hang forever on "Downloading <name>…" because a stalled AccessPort read (WebUSB transferIn never rejects when the device simply stops sending) left the promise pending. Every device read and every upload fetch is now time-bounded (withTimeout race + AbortController), so one stuck or failed file is skipped + reported and the batch always advances; the summary lists which files were skipped. Gzipped AP logs (.csv.gz) are decompressed SERVER-SIDE, streamed in 1 MB chunks with a 256 MB decompressed cap (gzip-bomb guard); detection is by GZIP MAGIC BYTES (1f 8b), not extension, so a gzipped file named .csv is still inflated, across the AP-connect ingest, the per-vehicle upload, and the universal Smart Upload dispatcher. Smart Engine bootstrap (/api/v1/engine/bootstrap) now authenticates by the engine KEY ALONE — no username: the server looks the user up via a new indexed users.engine_key_lookup (SHA-256 hex of the key, populated on mint/rotate) then verifies against the bcrypt engine_key_hash (defense in depth). A username is accepted but ignored for back-compat. Migration v1.79 adds users.engine_key_lookup (VARCHAR(64) UNIQUE). Existing engine keys must be re-minted once (the old plaintext is unrecoverable) to populate the lookup. Original pretty-URL / Smart Engine label retained below. — Human-readable URL hierarchy (pretty URLs): pages now live at /{username}/{vehicle-slug}/{category}/{rest} — e.g. /jdoe/bugeye-wrx, /jdoe/bugeye-wrx/datalogs/{session}, /jdoe/bugeye-wrx/trips/{trip}, /jdoe/bugeye-wrx/player/{session}. This is a COSMETIC routing layer over the existing controllers: every legacy URL keeps working unchanged. A new users.username (v1.78; unique, ^[a-z0-9][a-z0-9-]{1,38}$, editable on the Account page) is the first path segment; existing users get an auto-generated, de-duped handle on migrate. A username can never shadow a real top-level route — UsernameService maintains a RESERVED blocklist derived programmatically from every first path segment in routes.php. The pretty hierarchy is registered as the router's LAST, low-priority catch-all (Router::fallback): all explicit routes win first, so the resolver only sees requests nothing else claimed. PrettyUrlController resolves {username}->user and {vehicle}->that user's slug, then enforces the SAME ownership/visibility as the legacy routes (owner/admin see all; a public vehicle's overview mirrors /v/{slug}; otherwise 404 — another user's private vehicle is never leaked). GET-only: it never intercepts POST actions, /api/*, webhooks, or /cron. Canonical links: a new canonicalUrl($vehicle,$category,$rest) helper generates the pretty links on the vehicle page, dashboard cards, datalog/trip/player links, and each restructured page emits <link rel=canonical>. Original Smart Engine v1.77 label retained below. — Smart Engine control plane + job offload: a user can run one or more cobbvision-smartengine Docker containers and the site now offloads heavy datalog processing to them. The engine is zero-config except CV_USERNAME + a per-user ENGINE KEY (a 64-hex secret distinct from api_key, stored only as a password_hash on users.engine_key_hash). It POSTs /api/v1/engine/bootstrap and gets its whole runtime config — including the user's BYO AI key — back as an app-layer-encrypted CVRS envelope (AES-256-GCM; the 32-byte key derived on both sides from the engine key via HKDF-SHA256, key_len=0) layered on top of TLS, so a TLS-terminating MITM sees only an opaque blob. Engines register/heartbeat into user_engines (capabilities {gpu,ollama,cpu_cores}, status, active_jobs); a stale engine (no heartbeat >120s) is swept offline by the cron tick AND the process-pending worker, and its in-flight work is reclaimed back to DreamHost. Smart Upload + reprocess route a session to the user's least-active online engine (balanced; round-robin on ties; status=engine_queued + assigned_engine_id), showing "your Smart Engine is processing this — it may take a moment". With NO online engine, behaviour is unchanged (DreamHost). The engine claims its session via /api/v1/engine/claim (raw CSV), processes, and pushes an encrypted result package back via the CHUNKED /api/v1/engine/result (CVRS, RSA-OAEP-wrapped AES key to the SITE public key) which the server decrypts, writes back, and re-queues for authoritative finalisation. Account page lists connected engines (status/capabilities/last heartbeat) and lets a user mint/rotate the engine key and revoke an engine. Migration v1.77 adds users.engine_key_hash, the user_engines table, compute_jobs.assigned_engine_id + datalog_sessions.assigned_engine_id (FK fk_compute_jobs_engine / fk_datalog_sessions_engine), and the datalog_sessions.status engine_queued value. · DB 1.82