Cancelling no longer loses all actions. Cancel stays visible as state feedback, and a cancelled processing job with no usable heartbeat can expose a guarded Force delete action after server-side liveness revalidation. Live/quiet runners and active diarization remain protected.Feed paywall notices now also cover curated selections and direct runs. Unknown access produces an explicit caveat in the share itself.
Botstudio can read group notifications and mentions, draft source-grounded answers and publish verified replies with deduplication.
Audio Library (#2459): Audio uploads now show progress and errors without a full-page failed request. Temporary database locking receives a bounded retry, with failed files cleaned up safely.
Statuspage stale-state correction (#2456): The Tools status page now repairs the known stale Job Search, Suggestions and OpenAI degradation markers when their latest state is still the automated bridge failure that should have been cleared. The correction preserves the original history, refuses to overwrite newer manual/provider state, and publishes a resolved incident explaining that Statuspage failed to reset recovered services.
DNSBL - temporary IP allowlist: Migration adds or reactivates 68.183.71.133 for api/dnsbl/records/*. Admins can disable or remove the entry when no longer needed. DNS write locks and existing authentication remain unchanged.
Shared Tools navigation catalog: More first-party Services links are available for pinning, subject to each tool's account permissions. External sites and native apps are not integrated yet.
Tools navigation (#2453): The Services directory can now be searched, and signed-in users can pin, reorder and reset shortcuts in the shared navbar. Preferences are now stored per signed-in account for an expanded permission-filtered set of Tools services.
Suggestions GitHub search hardening: Administrator duplicate searches now normalize GitHub query syntax and enforce a UTF-8 byte limit before calling the issue-search API, preventing malformed titles/search text from surfacing as HTTP 422.
Job Search low-result Helper (#2438): Configurable 7/14/30-day counts of freshly published, active and deduplicated ads, per-profile persistent dismissals, compact review badges and one-shot email alerts with manual rearming.
Job Search Android profile editor API: Added owner-scoped, revision-checked configuration read/write endpoints for the native Android profile editor. Saved instruction history and ownership checks are preserved.
Job Search lifecycle public-URL retry follow-up (#2436): Fresh discovery still rejects unsafe/private destinations, but a previously verified stored listing now treats the same SearchFactory public-URL safety failure as inconclusive rather than proof that the job disappeared. HTTP 404/410 and explicit dead-listing evidence remain permanent.
Job Search lifecycle verification safety follow-up (#2434): Scheduled/full-link listing rechecks now use SearchFactory's guarded public HTTP transport, prefer the stored canonical destination before the original source and keep listings current when a successful page is identity-inconclusive. A listing expires only after all stored routes provide permanent evidence such as 404/410 or an explicit dead-listing marker.
Job Search profile-review prompt and localization (#2433): What went wrong? now opens a problem-description box before the AI review starts. Users can describe the mismatch or choose No, analyse directly to continue without extra feedback. Supplied feedback is used as review context, and review output follows the reviewing user's supported preferred language (English or Swedish).
Job Search automatic listing revalidation (#2413): Older active listings are now checked again automatically in small bounded batches. Confirmed removed/expired advertisements leave the current list, while temporary network, provider or server failures keep the job active for a later retry. The checks reuse the existing link verification and do not start another AI search.
X-bot mentions can appear anywhere: A direct @mention of the configured X bot no longer has to be the first thing in a post. Later-position mentions now enter normal reply handling instead of being rejected solely because of their position. Posts with neither a bot mention nor a concrete question/request may still be skipped.
Suggestion GitHub handoff privacy and duplicate hardening (#2419): Linked private ToolsAPI issue URLs stay out of public suggestion pages, AI title proposals no longer receive private GitHub candidate titles, and new issue creation now performs a server-side search and requires explicit confirmation when matches exist. Public admin controls use the same support.manage permission predicate as the protected endpoints.
Statuspage recovery safety follow-up (#2425): Operational-error and recovery writes now serialize on the same component lock, preventing a fresh failure from being overwritten by a concurrent recovery. Anonymous route probes only clear failures known to come from the same anonymous request context; authenticated Job Search failures remain degraded until separately verified.
Android Job Search application workspace (#2428): Android Job Search can now request a short-lived, single-use handoff into the existing Tools application workspace for an owned listing. The long-lived mobile bearer is not copied into the browser URL; the handoff is owner/profile/listing bound and expires after three minutes. Draft review, attachments, test mail and real sending continue through the existing web workflow, and a real application is still never sent automatically.
Statuspage post-deploy component recovery (#2423): Successful ToolsAPI deploys now re-check eligible auto-managed components instead of leaving a repaired service degraded indefinitely. Suggestions and Job Search have deterministic HTTP recovery probes; only a passing probe records an operational component recovery. Failed probes preserve the outage, and OpenAI/provider states are never cleared merely because the app deployed successfully.
Suggestions production render and Statuspage routing (#2420): Repaired the public /suggestions Blade status-control rendering after the post-merge endforeach production failure. Suggestions now has its own automatic Statuspage component rule, so matching public/admin Suggestions failures are attributed to Suggestions and can auto-create that component instead of remaining unmatched or being confused with Job Search. Focused render and operational-bridge regressions cover the production path.
Suggestion GitHub discovery and public admin actions (#2417): Authorized suggestion administrators can now choose a separate GitHub ticket title, request proposal-only AI title suggestions, search the configured Tornevall/toolsApi repository before creating work and explicitly link an existing issue. The same configured GitHub integration is used for search, validation, linking and creation. Administrators browsing the public suggestion board can also change status inline and jump directly to the matching admin detail, while normal visitors receive no admin controls.
Votech database-backed media lifecycle (#995): Votech's owner and administrator workspaces include database-backed media management for poll covers, question/option/candidate images, project/community artwork and permitted attachments. Media metadata stays separate from binary payloads, image variants are generated in Votech storage, ownership/MIME/size/checksum rules are enforced server-side, and media operations remain authenticated, auditable and independent of filesystem storage or a generic Storage API. This item documents functionality already shipped through PR #1815; no runtime behavior changed in this documentation follow-up.
Automatic Statuspage components for operational errors (#2386): Error-level Tools diagnostics can now update a configured component on the public Tools status page. Missing configured components can be created automatically on first use without duplicating an existing same-name component. Job Search failures default to degraded, while critical OpenAI account/provider failures such as exhausted credits or quota mark the OpenAI component major_outage. Repeated identical failures are deduplicated and internal diagnostic metadata remains private.
Job Search bounded parallel profile batches (#2054): Administrator all-profile runs, CLI --all and scheduled/cron execution now share a bounded worker pool instead of waiting for each profile sequentially. Four profiles run at once by default, with a hard ceiling of eight and the remainder queued; profiles for the same owner may occupy multiple slots while transactional Job Search allowance/credit reservations remain authoritative. Admin progress shows a real bar per queued/running/completed/failed profile. Long healthy link rechecks no longer have an arbitrary batch wall-clock timeout, and diagnostic dry-runs remain sequential.
Job Search targeted admin interval override (#2403): The administrator now has Ignore interval for a narrow manual exception on single-user and all-profile reruns. It skips only the profile minimum interval; daily allowance, Job Search credits, active-profile limits, the generic AI budget and provider-side restrictions still apply. The override is separately audited and propagates through parallel batch children without becoming Force. Aggregate completion now also clears stale per-profile context, so the final batch summary cannot be written into the last profile row.
Job Search independent parallel admin progress (#2400, #2401): Run for all active profiles now keeps one visible progress row per profile while several profiles execute concurrently through the bounded backend pool. Queued profiles remain visible, aggregate progress is only a summary, and exact queued/running/completed/deferred/failed states are preserved. Minimum-interval or allowance deferrals are shown as waiting and counted separately from real failures.
Job Search bounded parallel profile batches (#2054): Administrator all-profile runs, CLI --all and scheduled/cron execution now share a bounded worker pool instead of waiting for each profile sequentially. Four profiles run at once by default, with a hard ceiling of eight and the remainder queued. Profiles from different owners can run in parallel; same-owner profiles can also share slots when the generic Job Search AI budget is unlimited/bypassed or skipped by the scheduler contract. Finite-budget owners are admitted one profile at a time. Admin progress shows a real bar per queued/running/completed/failed profile. Long healthy link rechecks no longer have an arbitrary batch wall-clock timeout, and diagnostic dry-runs remain sequential.
Job Search parallel budget guard (#2398): A post-merge race in the new batch pool is closed. Multiple profiles for the same finite-budget owner can no longer all pass the same remaining daily AI budget before usage is recorded; that owner is serialized at admission while other owners, scheduled runs and budget-exempt/unlimited owners keep the available parallelism.
Job Search OpenAI-credit budget bypass (#2389): The existing Job Search funding bypass now also skips the generic per-user daily Job Search AI-budget guard for administrators and users with can_jobsearch_without_openai_credits. Ordinary users keep the budget guard, and provider limits plus the separate Job Search profile/entitlement rules still apply.
OpenAI/Job Search diagnostics follow-up: OpenAiEngine::runProfile() now preserves the provider HTTP status as safe metadata. Job Search profile-review failures can therefore distinguish statuses such as 429 from other provider failures without exposing provider error text.
Job Search profile-review hardening: AI profile reviews now use a bounded model-only snapshot even when saved instructions or criteria are very large. The stored profile remains untouched, and non-exception provider failures plus invalid review output are reported through the always-on operational diagnostics path using safe metadata only.
Job Search guided profile refinement (#2373): The profile editor now includes What went wrong?, which reviews saved criteria against a bounded recent-results snapshot and asks focused questions about missing or over-broad priorities. Those answers can feed the existing AI instruction helper, which now returns substantially more detailed alternatives with a short rationale. Saved instructions also keep a private per-profile revision history with explicit restore; reviews and suggestions remain proposal-only.
Job Search table-first sortable listings (#2382): The signed-in listing page now opens in compact table view by default. Title, employer, location, published date, priority, source and status headers can toggle ascending/descending sorting, while card view remains an optional temporary switch for the current page session. Clearing filters now also clears any stale sort arrow/pressed state so the visible table matches the restored default ordering.
Browser Social scheduler fairness (#2376): The central Browser Social schedule now checks notifications/mentions and automatic feed posting inside one shared locked run instead of launching two every-minute jobs that could race for the same non-blocking browser lock. This prevents notification scans from repeatedly losing to auto-post ordering. A failure in one scheduled stage no longer prevents the other stage from being attempted. Manual commands and existing reply/publication safeguards are unchanged.
Job Search AI access fix (#2378): Job Search AI helpers no longer require the separate account-level OpenAI permission. Instruction suggestions, AI profile names, negative-keyword suggestions and CV/professional helper actions now follow Job Search's own access, capacity and funding rules instead.
Browser Social notification scheduler (#2344): Botstudio workflows that opt into Facebook notifications and mentions are now woken automatically by ToolsAPI's central scheduler, so direct tags no longer depend on someone manually running the notification command. Each workflow's saved interval, reply permission, daily limit, shared browser serialization and no-resend protection remain unchanged. Deterministic coverage was added; no live Facebook reply was sent for verification.
Job Search gifts and administrator-sponsored capacity (#2370): Administrators can now give Job Search credits as an explicit gift, permanently waive the requirement for a user to top up credits themselves, or set the same waiver for a time-limited complimentary period. Included capacity is still used first; later eligible runs preserve the user's existing balance, while profile limits, search intervals, ownership checks and provider limits remain unchanged. The owner capacity view and entitlement API expose the safe waiver/free-period state.
Single suggestion confirmation (#2371): Publishing a suggestion now shows one success banner on the public detail page instead of rendering the same confirmation twice.
SMS callback device identity (#2368): Serialized inbound reprocessing now preserves the stored gateway SMS_DEVICE_ID for prefix callbacks instead of replacing it with an internal processing label.
SMS auto-reply hardening (#2366): HTTP-created inbound SMS now carry a reliable source marker and use the same per-message lock as scheduler/manual processing, closing the duplicate-processing race found in post-merge review. Conversation context also keeps earlier AI replies after the modem consumes their outbox rows by merging durable SMS audit excerpts.
Automatic conversational SMS replies (#2364): New inbound modem SMS that arrive through the existing database path are now picked up automatically for the same prefix/AI handling used by Handle now. Unknown-prefix AI replies can use a bounded recent history for the same sender and earlier linked replies, so follow-up texts can continue the conversation without manual intervention.
Whisper public share lazy loading and job-detail polish (#2320): The magazine share no longer embeds raw, human-friendly, translated or speaker-aware transcript bodies in its initial page. The readable transcript loads as the reader reaches it, raw/speaker text loads only on disclosure, language switching fetches the selected transcript on demand, and internal content reads do not inflate share visits. The authenticated job detail also has a cleaner source-first header, responsive actions and clearer raw/readable transcript cards. The legacy ?full share remains compatible.
SMS manual processing and status (#2361): Administrators can now use Handle now on a stored Incoming SMS that has not reached a final result. Tools reuses the current prefix/AI handling without creating another inbox row, marks deliberate no-reply decisions as handled instead of leaving them pending, and keeps failed processing retryable. The detail page also correctly identifies SMS_CENTRAL as the SMS center (SMSC), not a callback URL.
Job Search AJAX filtering and application review (#2359): The signed-in listing page can now filter owner listings by visible fields such as title, employer, location, source or status and sort them by active/newest, date, title, employer, location, priority, source or status without a full page reload. Application drafts and owner-directed test mail can be prepared before an employer email is verified, while the editable preview still uses advertisement evidence and real delivery remains blocked until the recipient is freshly verified immediately before send. Duplicate application-page success/error flash boxes were removed.
SMSTools inbound SMS persistence (#2353): Local modem/SMSTools receives are now stored in the common incoming SMS inbox before prefix routing. Ordinary messages without a configured prefix therefore remain visible in SMS admin and can enter the optional AI personal-reply fallback instead of being discarded by the old prefix-only receive path. Duplicate receive retries stay deduplicated and the local bridge does not depend on the external SMS API credential.
Job Search layouts and public syndication (#2348): Signed-in users can switch each profile's listings between card and compact table presentation, with responsive fallback on narrower screens. A later week-41 follow-up makes the compact table the default on every page load instead of persisting the layout choice. An explicitly public search profile now also exposes the same active, current, non-dismissed jobs as RSS and through the unversioned GET /api/job-search/public/{slug} JSON endpoint, with links shown in the owner/public UI for WordPress and other integrations.
Job Search run-report redaction (#2345): Owner and administrator run reports now redact credential-like values from free-form stored provider/run errors before rendering them. Useful error wording remains visible, while bearer/basic authorization values, token/API-key/secret/password/credential forms and common provider token prefixes are masked in addition to the existing structured audit-context redaction.
Job Search owner lists and run reports (#2340): The signed-in listings page now keeps each search profile in its own responsive collapsible section instead of one wide table, avoiding page-level horizontal scrolling. Owners can also expand recent run reports directly from the page and open a full owner-scoped report with safe status, result, web-search and audit diagnostics. Historical run ownership remains authoritative after profile transfers, and sensitive prompt/provider/credential data stays redacted.
Job Search owner lists and run reports (#2340, #2341): The signed-in Job Search page now groups listings into independently collapsible responsive profile sections and adds recent owner-scoped run reports plus a full owner-only report view. Historical reports redact private provider material and no longer expose a profile's current name after ownership transfer; they fall back to the historical profile id instead.
Job Search admin run-history pagination (#2339): The administrator user/profile inspection now pages its 20-row run history inline when JavaScript is available, preserves expanded report state per history URL and supports browser back/forward navigation. Ordinary server-rendered pagination remains the fallback.
Job Search admin run reports: Each historical run on the administrator user/profile inspection now has an expandable report showing whether it completed successfully, safe web-search evidence counters and the latest audit events. A successful 0/0/0/0 run is no longer left ambiguous: the report explains likely zero-result states without calling them provider failures, while failed runs surface their stored safe error. Raw prompts, provider bodies, credentials and provider output excerpts remain hidden.
Job Search admin criteria cards (#2333): The read-only administrator profile inspection now presents keywords, locations, exclusions, instructions and relevance rules as a responsive magazine-style card layout. Long free-form instructions get a wider feature card, while compact criteria keep clear count and empty states. Job Search behavior and authorization are unchanged.
Quick generator stale network-error fix (#2329): A network failure from an older page/global state request can no longer overwrite the currently selected scope with an obsolete error. Stale fetch rejections are discarded before caller-level status handling, while failures from the active request still surface normally.
Quick generator scope race fix (#2327): Switching quickly between page-specific and site-wide fallback scope can no longer let an older state request overwrite the newly selected scope. Stale success/error responses are ignored, and closing the dialog invalidates any in-flight state load.
Quick generator site-wide fallback (#2325): Administrators can now manage one generic social image from Quick generator. It is inherited by pages and public share URLs that do not have their own current Quick image. Page/share-specific Quick images override it, explicit page-owned Open Graph or Twitter images stay authoritative, and inherited fallback never carries the generic title/description or visible-cover setting into child/share pages.
Quick generator modal scrolling (#2323): The Quick generator now keeps its header and action footer reachable on shorter viewports while the form content scrolls inside the dialog. This fixes the case where Cancel/Generate could be clipped below the viewport and only reachable by tabbing. Authorization is unchanged and remains administrator-only in this fix.
Whisper lazy transcript sections (#2318): Full transcript and Human-friendly transcript on the authenticated job page are now collapsed by default and load their content only when opened. The shared language selector still works; open sections reload when the display language changes, while closed sections stay unloaded. Normal detail polling no longer carries the completed raw/Markdown display copies just to keep those cards ready.
Added the McpFactory foundation: compatible MCP clients can connect to the unversioned /mcp endpoint using an owner-bound Tools API key with the mcp.connect scope. Available tools are filtered by the key's scopes, and signed-in users can inspect MCP setup under /me/mcp.
Browser Social empty accessibility context fallback (#2309): Read-only Facebook follow-up now falls back to bounded visible thread text when a valid permalink renders content but exposes an empty accessibility snapshot. Exact destination checks and the no-publication/no-resend contract remain unchanged, while notification submission still requires a unique target. A deterministic Playwright fixture covers the fallback; no live Facebook publication was performed.
Whisper stuck-job/session hotfix (#2290): Whisper's authenticated JSON/AJAX requests now read the existing web session for login, permissions and CSRF without writing the same database session row back at request shutdown. This removes session-row lock waits between queue polling, uploads and actions such as cancel/delete. Remote lease-expiry polling also no longer takes broad row locks on active transcription/diarization jobs. Normal HTML requests keep ordinary session persistence. No migration or API URL change.
Remaining npm audit fixes (#2310): Axios moves from 0.33.0 to patched 0.34.0 for two prototype-pollution gadget advisories, avoiding an unnecessary forced jump to Axios 1.x, and the transitive fast-uri pin moves to patched 3.1.8 for the host case-normalization advisory. The security-lock verifier now enforces both baselines. No public API or GUI behavior changes.
fast-uri security update (#2307): The transitive npm dependency is pinned to patched 3.1.7 for Dependabot alert #158, replacing vulnerable 3.1.6. The repository security-lock verifier now requires the patched version so later lock refreshes cannot silently restore the affected baseline. No public API, GUI or provider behavior changes.
Whisper speaker audition and grouped turns (#2292): The owner job page can now play retained source media in place, audition a sample for each detected/manual speaker and play individual segment or grouped-turn ranges while assigning names. Adjacent segments for the same speaker are displayed as readable speaker-turn cards instead of one dense text block. Media playback remains behind the ordinary authenticated visible-job authorization boundary and is not added to public transcript shares.
Job Search user guide synchronization (#2303): the public English and Swedish guides now reflect shipped Job Search capabilities including structured JobTech/Platsbanken discovery, personal and global sources, profile CV/cover-letter material, reviewed CV entries and professional-source lookup, assisted application drafts with explicit send safeguards, and owner-scoped Android access. The stale Swedish text describing broader source coverage as future work was removed. This is documentation-only and does not change runtime behavior.
Mail Support transient lock recovery (#2300): standalone case sync now allows a second retry for the already-classified transient MySQL lock/deadlock conditions, for three total attempts. Unrelated database errors still fail immediately and existing idempotent case-key recovery is unchanged. Focused regression coverage proves third-attempt recovery and the hard bound.
RNDC and Browser Social production reliability (#2298): DNSBL Tor synchronization no longer sends the unsupported rndc -t option to BIND 9.18, while the existing server/port/key controls and real-failure diagnostics remain intact. Browser Social read-only follow-up also no longer depends on Facebook exposing an ARIA main landmark on permalink pages; it uses a bounded safe fallback while preserving exact destination checks and the no-resend/no-publication follow-up contract. Read-only notification inspection now also tolerates duplicate renderings of the exact requested comment, while submission still requires a unique target. Focused deterministic regressions cover the failures. Refs #2246.
Whisper full provider diagnostics (#2288): Debug-mode diarization now retains up to 8,000 sanitized provider-diagnostic characters so multi-cause TorchCodec/FFmpeg failures are not cut off after the first explanation. Secret/path redaction and bounded history remain unchanged.
Whisper diarization failure detail (#2286): Debug-enabled remote diarization now preserves a bounded provider exception class/message when pyannote fails before producing speaker turns. Worker-side redaction removes secrets and local paths, and ToolsAPI sanitizes the diagnostic again before persistence; ordinary non-debug failures remain generic.
Whisper diarization diagnostics: Speaker diarization can now be put in debug mode from the first transcription attempt, not only on a later re-run. The same flag follows delegated worker jobs. Debug-capable workers expose safe pyannote/runtime data plus the overlap candidates used to choose a speaker for each timestamped transcript segment, while transcript text, media paths and credentials stay out of the diagnostic payload. Older workers that do not advertise the new debug capability cannot claim debug-marked jobs. The latest payload and a bounded attempt history are visible on both the normal Whisper detail page and the administrator view.
SMS fast-departure tracking (#2279): Outbound SMS progress now reconciles the durable queue audit trail as well as the one-minute gsm.pduout snapshot. This closes the case where a modem worker can consume a newly queued PDU before the first poll ever sees it. Recent 24-hour queue evidence is replayed on tracker startup, exact PDU presence is still verified before reporting queue departure, and failed progress notifications remain retryable. Queue departure is operational evidence only, not carrier delivery confirmation.
SMS queue accuracy and Menstrual resend (#2276): SMS activity no longer reports a PDU as having left the queue merely because newer messages pushed it outside the bounded polling window; Tools now re-checks the exact PDU first. Menstrual Tracking shows the latest queued reminder separately for the profile owner and linked parent, labels queue acceptance as distinct from carrier delivery, and offers an authorized resend action per recipient.
Menstrual Tracking family profiles (#2274): The normal tracker now lists the signed-in account and every directly linked child, including children with no menstrual profile or history yet. A linked parent can open and manage a direct child's profile and cycle history through dedicated family routes, with the relationship enforced server-side on every read/write. Forecast confirmation remains owner-only, and existing self/admin routes are unchanged.
DNSSEC lifecycle management for BIND zones (#231 / #233): DNS administrators can now manage BIND/KASP DNSSEC from the existing zone page. Tools applies dnssec-policy, derives registrar-ready DS records from public DNSKEY data, verifies parent publication and resolver validation, and uses a staged insecure workflow before removing DNSSEC. Configuration changes are validated and rolled back on failure, provider-backed zones cannot use local BIND controls, reconciliation is scheduled, and failures/audit records are kept on separate operational paths. The rebuilt implementation uses the local rndc client only and does not restore the abandoned SSH fallback.
Visit statistics performance, privacy and classification (#2250, #2268, #2271, #2281, #2296): /visit-stats remains cache-only on the HTTP path, while the scheduler precomputes the 7/30/90/365-day snapshots. The public view now strips query strings, redacts token/hash-like URL material, masks client IP addresses and uses wrapping recent-request cards instead of an eight-column horizontally scrolling table. Internal referral domains and operational API prefixes are global admin settings under /admin/visit-stats; configured domains include their subdomains, and /api/whisper/worker is separated by default so worker chatter does not dominate client/public API rankings. A same-day hotfix also corrected privacy-sanitization regular expressions that could turn ordinary requests into server errors under Laravel's production error handler. Settings changes are audited and change the snapshot cache identity automatically. Existing statistics URLs remain unversioned.
Job Search - CV workspace and professional lookup (#2255): The profile document page now renders Markdown beside the editor and supports reviewed LinkedIn-like CV entries for work, assignments/projects, education, certifications, skills and public professional links. A complete Markdown export combines those entries with the saved CV, and reviewed entries also feed Job Search instruction/application drafting. The workspace can propose entries from the saved CV, generate an editable cover letter from reviewed CV evidence and run an owner-authorized professional web lookup. Web-derived findings require exposed citation evidence and explicit owner acceptance; person-search/data-broker, genealogy, court/criminal-record and sensitive private-dossier sources are excluded. Profile transfers now reconcile the structured CV entries as profile-owned mutable state.
Native Android Job Search (#2257): Tools now has a dedicated owner-bound Job Search credential for first-party Android clients. The native client can use the existing unversioned Job Search API to read its own profiles, entitlement and verified listings, start the normal manual owner run, and dismiss or restore its own listings. The credential is separate from SocialGPT and the account session, while administrator and cross-user operations remain unavailable.
OpenAI model discovery (#2263): User-scoped model-list discovery now resolves the active credential without creating an inference funding reservation. This prevents a metadata lookup from temporarily consuming prepaid AI credit before the actual helper or answer request reserves its own usage, while normal inference funding checks remain unchanged.
Quick generator context follow-up (#2265): The page-context collector now truncates by Unicode code points instead of raw UTF-16 units, preventing emoji/supplementary characters from being split into invalid JSON. Link-style Bootstrap controls and ARIA action controls are also excluded while ordinary content links remain available as context.
Quick generator page context and text fidelity (#2259): The administrator Quick generator now reads relevant page-body text into an editable context field while excluding forms, controls, navigation, dialogs and rendered-hidden/collapsed content. New quick covers use GPT Image 2.5 Sunburst at max quality, the combined UTF-8 prompt is kept within safe persistence bounds, and the generation prompt requires exact page-title spelling when text is shown or no visible text when exact rendering is uncertain. Current-image model details are shown only when they belong to the asset actually being displayed.
RSS feed questions (#2261): Feed questions no longer fail when a reasoning-model helper pass reaches the platform model policy: local helper analysis and web-search retries prefer alternatives that the active provider credential actually exposes, and keyword extraction stays local instead of starting an unnecessary web search. The current period, category filter and site filter have also moved into compact badges beside the Ask action rather than sitting above the question field.
Quick generator image history and live refresh (#2175): The administrator Quick generator now shows the current page image plus retained image history, lets an older image become current again without another OpenAI request, and saves the visible page-cover setting separately from generation. AJAX regeneration now refreshes the newly created asset immediately instead of leaving the cached previous preview visible until a page reload. The stable Open Graph/Twitter image URL remains unchanged.
Job Search application hardening: Follow-up review fixes now reject incomplete AI document conversions before they can replace Markdown, validate the real PDF/DOCX structure before conversion so malformed uploads cannot replace an existing document or reach the external fallback, and keep explicit application mailto: links working when the visible link text hides the address. Generic contact mailboxes remain excluded.
Job Search document upload recovery: CV and cover-letter originals are now kept privately even when automatic text conversion fails. PDF/DOCX conversion tries local extraction first and can use the configured OpenAI file-input path as a faithful transcription fallback; if both paths fail, the original and any existing Markdown remain available so the owner can continue in the editor. Private file contents are omitted from ordinary AI request logs, and nearby general contact addresses are no longer mistaken for application emails simply because application wording exists elsewhere on a listing page.
Browser Social replies stay on the question: The notification flow now marks concrete questions and explanation requests as part of the reply intent through the full AI pipeline. If the answer is explicitly present in the original post or visible thread, the bot can answer directly from that context; external factual claims require verified research. Final review rejects topic drift such as offers to formulate something else, asking what the person wants help with when that is already clear, or summaries that replace the actual answer.
Job Search profile names: Profile owners can now rename their own search profiles directly from the profile list without opening an administrator surface. Saving updates the visible name in place with AJAX while retaining a normal POST fallback, and AI name suggestions still require an explicit save. The administrator rename path was also hardened after a runtime failure so its AJAX and fallback responses no longer depend on the shared profile-action response helper.
Job Search content routes after job prefixes: Exact or compound content-route markers such as /jobs/blog/job-123 and /jobs/news-update/8393017 remain blocked even after a job prefix, while role slugs such as /jobs/news-editor/8393017 stay eligible.
Job Search document-aware AI: The instruction helper can now use the selected profile's CV and cover letter together with saved search criteria to suggest broader, adjacent and transferable role paths rather than relying only on literal keywords. Remote/local/geographic preferences remain constraints, raw application material is omitted from ordinary OpenAI request/response logs, and the old application-level character caps on saved instructions and editable document text have been removed.
Job Search route-marker blocking: Content/navigation blocking now targets route markers instead of every token inside a job slug. Direct ads such as /jobs/team-lead/8393017 remain eligible, while real search/category/content routes stay excluded.
Job Search application workspace: Search profiles can now keep private CV and cover-letter originals plus editable Markdown working copies. PDF/DOCX uploads are converted for AI use, each saved listing has an application workspace, email application routes are verified and backfilled, AI drafts ask follow-up questions instead of inventing missing facts, test mail defaults to the owner, and real mail is only sent after re-verifying the advertisement's published application address. The outgoing HTML is deliberately restrained and uses the applicant as Reply-To.
Job Search compound URL context: Direct ads using compound route segments such as /job-details/8393017 or /application-detail/8393017 are recognized as job/application context for numeric ad IDs, while compound content paths such as /news-update/8393017 remain blocked.
SocialGPT fact verification: The currently published SocialGPT client can keep using the same unversioned endpoint, while Tools now gives verification substantially more output headroom: 16,000 tokens for the main verify pass and 8,000 each for source lookup and the final rewrite. An OpenAI Responses result that ends incomplete because of max_output_tokens gets one bounded larger retry up to 32,768 tokens instead of failing immediately. Configured reasoning is preserved rather than forced down for the preliminary pass.
Job Search numeric ad-ID context: Long numeric path components now count as ad evidence only when the URL also has job/application context. Direct ad paths such as /openings/8393017-platform and /apply/8393017 stay valid, while pages such as /company/12345 and /press/20260929-update no longer qualify from the number alone.
Job Search embedded numeric ad IDs: Direct job URLs keep working when a long numeric advertisement ID is embedded in the path, such as /openings/8393017-platform or /apply/8393017, while content/search/category paths remain excluded.
Job Search CLI progress and URL evidence: Live CLI runs now print the real Job Search service stages and percentages immediately instead of appearing idle after the profile header. URL verification also honors explicit job/requisition query IDs on generic-looking roots, accepts short numeric ad IDs under job-like paths, rejects job-like identifiers inside content paths, and handles hyphenated title slugs consistently.
Job Search individual-ad evidence: Partial/OpenAI-inferred verification now requires positive individual-ad URL evidence instead of treating arbitrary nested paths as job ads. Locale-prefixed career roots, nested career/category pages and content pages are rejected, while numeric/requisition IDs and role-specific title slugs remain supported.
Job Search verification hardening: Partial identity matches now require an individual job URL, canonical redirect targets participate in de-duplication, and incomplete JobTech identity payloads are treated as transient instead of deactivating an existing Platsbanken listing.
Job Search link verification: Canonical Platsbanken ad links are verified against Arbetsförmedlingen JobTech's structured ad endpoint instead of raw browser HTML. Other live, non-generic job pages may pass with a documented partial identity match when at least two supplied fields among title, employer and location match. If a fresh OpenAI web-search candidate comes from an individual live page whose raw HTML hides all browser-rendered identity fields, Tools can retain the structured title/employer/location supplied by that OpenAI search instead of throwing the candidate away. This fallback is fresh-run only, not used for historical rechecks, and source/final URL de-duplication prevents duplicate inserts.
Job Search admin force and bulk diagnostics: The administrator rerun controls now include an explicit Force option for one user or all active profiles. Force bypasses internal Job Search limits only and is audited; provider-side failures remain authoritative. Bulk runs also show safe per-profile failure reasons instead of only an aggregate failed count.
Admin-owned Job Search capacity: Profiles owned by administrators no longer consume the normal included daily allowance or require extra Job Search credits. The exemption is recorded as admin capacity, while cadence/minimum intervals, profile limits and provider-side limits still apply.
Job Search manual-run rate-limit fix: Manual Job Search runs now use their own per-user request bucket instead of sharing one with listing, entitlement, settings and configuration traffic. Browsing or editing Job Search can therefore no longer exhaust the transport allowance needed to start a search. Existing search cooldowns, daily allowance, Job Search credits and provider-side rate limits are unchanged.
Online geography/Referer follow-up (#2179): The Online Users filters now take country/continent data from the maintained local MaxMind database instead of obsolete historical visit columns. Referer filtering still uses the latest tracked visit, keeping the collapsed list useful without starting ASN, DNSBL or full page-history diagnostics.
Online counters and responsive admin diagnostics (#2177): The shared online counter and the public /online view now use the same configured activity window and consistently deduplicate authenticated users and grouped machine visitors. The detailed Online Users admin page no longer blocks its initial render on per-session page-history, GeoIP/ASN and DNSBL enrichment; those diagnostics load on demand when a visitor is expanded. The collapsed admin list can also be filtered by region, country and Referer source without triggering those expensive diagnostics.
Statuspage admin dropdowns (#2146): The Statuspage administrator editor now shows explicit choices instead of free-text fields for page/component state, incident lifecycle, impact and incident updates. Unsupported new admin values are rejected, while existing legacy values can remain unchanged and the owner surface keeps its existing behavior.
Transit Planner - bounded share retention (#2172): Persisted short share links now expire after 30 days. Expired state is pruned automatically and daily, while public share creation is limited to 5 requests per minute and a smaller share-only schedule payload to prevent unbounded storage growth. Legacy self-contained links remain compatible.
Quick social image generator (#2171): Administrators can now open a Quick generator from the shared Tools navbar and create a 1200x630 social cover without leaving the current page. Title, description and prompt are pre-filled but editable. The generated image uses the existing stable Platform Image Target pipeline and is delivered through server-rendered Open Graph/Twitter metadata even when it is hidden from the page itself; visible rendering is an explicit option, and page-specific social images still take precedence.
Transit Planner - shorter share links (#2169): Newly generated share links now use a short opaque ID instead of embedding the full weekly schedule in the URL. The saved plan still restores margins, line preferences, cached schedule images and an optional separate after-school route, while older long links remain compatible.
Transit Planner - preferred transport/line selector restored (#2167): The preferred transport/line multiselect is visible again before the first journey lookup instead of appearing only after Skånetrafiken has already returned lines. The empty state explains that available bus/train lines are populated by the first weekly lookup. Existing safety-first ranking and shared-link persistence are unchanged.
Transit Planner - correct year handling and clearer journey progress (#2161): Schedule screenshots without a visible year no longer get stuck on a model-guessed historical year such as 2020; Tools normalizes those dates to the nearest current/upcoming calendar occurrence while preserving an explicitly visible year. Skånetrafiken progress now sits with the weekly lookup/journey plan and shows the active day plus elapsed seconds, while past dates are rejected before provider lookup.
Transit Planner - general place search and faster vision (#2159): Place autocomplete now uses Skånetrafiken's actual Points contract and supports stations, stops, addresses and POIs rather than effectively matching only the earlier Klippan/Helsingborg fallbacks. The first two GPT-5.6 Sol passes run concurrently, and a validation error now falls through to a third image adjudication instead of aborting immediately.
Transit Planner - post-merge OpenAI reliability (#2158): Fixed the live #toolsapi failure where GPT could emit a reasoning output item before the message and trigger "OpenAI returned no schedule text". OpenAI credentials now resolve through the shared KeyStore, and image analysis shows elapsed activity while allowing the full multi-pass request budget instead of the previous three-minute client abort.
Transit Planner - deterministic schedule-image reading and one travel margin (#2155): The actual admin upload now uses GPT-5.6 Sol with high reasoning and high-detail images instead of the older generic OpenAI path. The model transcribes every timed lesson block per day and Tools deterministically derives the first start and final end; two independent readings are compared and disagreement triggers a third image check. One travel margin now applies to both outbound and return journeys.
Direct Facebook mentions no longer pass through relevance filtering. Bots can acknowledge a mention when evidence is insufficient, while persistent comment IDs prevent repeated replies. Regression tests cover the change; verification did not publish a new live reply.
Statuspage history hardening (#2104): Follow-up review fixed edge cases after the uptime-history merge. Page-wide observations now drive the overall public status even without components and can clear stale stored page state after recovery. Legacy component/page state is preserved as a baseline before its first recorded transition, automated health observations preserve the same baseline, and fallback deploy health recording is explicitly executed with the resolved web runtime identity. The existing unversioned GET /api/statuspage/{slug} contract is unchanged.
Turnstile credential pairing (#2105): A follow-up to the feed-scan captcha fix now keeps Cloudflare Turnstile environment credentials paired by namespace. A complete TURNSTILE_AUTH_* pair remains preferred; an incomplete primary namespace falls back only to a complete legacy CLOUDFLARE_TURNSTILE_* pair, so site and secret values cannot be mixed.
RSS feed scan captcha (#2021): The public feed-scanning request form now reuses the configured Cloudflare Turnstile fallback when no complete global Turnstile key pair is stored in Tools. Complete database-managed credentials still take precedence, an incomplete newer database row no longer hides an older complete pair, and site/secret values are never mixed across credential sources.
Browser Social existing-post verification (#2100): Read-only verification of uncertain Facebook feed posts now scans a small bounded portion of the configured group feed when no exact post permalink is available, instead of waiting on one static title lookup. Marker candidates are accepted only on the configured numeric Page/group post card, then existing full-text, source-preview and permalink checks still apply. No resend is authorized by this verification path. Follow-up #2102 preserves the previous overall 20-second wait budget while revisiting only that same bounded region, so slowly materialized Facebook cards are not rejected after only a few seconds.
Browser Automation diagnostics (#2093): Failed Browser Social runs now send more directly useful safe context to #toolsapi: run duration, whether publication had started, a bounded sanitized Playwright call-log detail and a normalized stored-script/runtime location when available. Generic browser scripts do not forward raw locator call logs, and credentials, cookies, authorization values and full publication text remain excluded.
Botstudio feed progress resets after completion: When a manual feed run targets an older queue item outside the current page, the previous running state is now cleared once the run finishes. The last percentage or possible-Facebook-submit warning can no longer remain visible as if Chrome were still working.
Botstudio live Chrome status for feed selection (#2095): Manual curated-feed runs and read-only checks of uncertain Facebook posts now show a real progress bar backed by the Browser Social/Chrome chain, including browser startup, Facebook navigation, sender checks, composer setup, link-preview verification and final verification. The GUI marks the point where a send may have reached Facebook and keeps the existing no-automatic-resend safety rule unchanged. Known 409 operator states now return concrete safe GUI messages and are no longer duplicated as generic client fetch errors. Progress data is private, short-lived and excludes article bodies, credentials, cookies and browser storage; the regression coverage does not claim a live Facebook publication.
Browser Social grounded paywall detection (#2017): Paywall checks now require OpenAI web search before accepting an access decision. The detector evaluates the specific article's current page, metadata and search evidence semantically rather than matching fixed publisher phrases or site-specific selectors. Direct article-page evidence can establish restricted access, while crawler, robots, geoblock or HTTP transport failures alone remain inconclusive. Existing warn/skip/off behavior and the confidence threshold are unchanged. Focused deterministic coverage verifies the request/evidence contract; no live OpenAI paywall verification is claimed.
Botstudio feed selection hotfixes (#2089, #2091): Fixed the server error that prevented the curated feed-selection page from opening, and fixed a second HTTP 500 that could occur when Add to queue was used for an article with no previous publication record. Existing publication-history duplicate protection remains active, and publication recovery plus scheduling behavior are otherwise unchanged.
Job Search run hotfix: Fixed a regression that could make manual and administrator Job Search runs fail immediately after personal discovery sources were introduced. The search service now receives the personal-source dependency correctly before building the effective search profile; search/provider behavior is otherwise unchanged.
Job Search profile ownership transfer (#2086): Reassigning a search profile now moves its current profile-scoped job inventory and configuration to the new owner as one authoritative ownership change. New searches are required to use the profile's current owner, and in-flight result finalization is serialized against ownership transfer so stale results cannot be persisted after the transfer or notify the previous owner. Administrator-created listings tied to a profile inherit that profile owner, while historical run and Alert Engine provenance is preserved.
Browser Social reply-field recovery (#2083): Facebook may expose the top-level "Kommentera som" composer and a nested "Svara som" field at the same time. Botstudio now prefers the unique top-level comment composer instead of failing on the combined locator, while reply-only pages still work and genuine same-label ambiguity still stops before input. Read-only follow-up checks remain read-only.
Mail Support transient lock recovery (#2083): Case synchronization now retries one transient database lock/deadlock conflict before returning an error. Other database failures still fail immediately, and existing case/message identities keep the repeated sync idempotent.
Personal Job Search sources (#2068): Users can now keep an account-owned list of public job websites that is reused across their own search profiles. A site supplied explicitly for a manual run is remembered idempotently, account-wide profile revisions are advanced consistently, and private/local targets are rejected. These sources change discovery only and do not alter listing profile ownership, deduplication or notification counting.
Statuspage uptime history and deploy health (#2016): Statuspage now exposes a compact 90-day daily history for each service together with 24-hour and 30-day availability. Days without a recorded disturbance remain operational, while incidents and health observations change the affected day and availability figures. Existing non-operational components without event history keep their persisted state as the baseline, and active incidents also affect the page-level status when no components exist. ToolsAPI deployment health checks feed the same history. The public API remains the existing unversioned GET /api/statuspage/{slug} endpoint.
Dynamic Job Search employer registries (#2063): Administrators can add manual or public CSV/TSV/JSON/JSONL/XLSX employer registries without a code deployment, map source fields and choose whether matches warn or exclude. Matching stays exact and explainable; warnings are shown on retained listings while exclusions happen before persistence. Remote sync uses SearchFactory protections, is serialized per source and fails closed on truncated/empty/unmappable downloads instead of clearing previous entries.
Global Job Search employer watches (#2074): Administrators can now maintain a global preferred-employer list with optional direct careers URLs alongside the existing search-source controls. Global watches apply to every profile, while profile owners keep their own additive per-profile watches and can see inherited global watches read-only in the profile editor. Manual, scheduled and remote-worker searches include both scopes without changing the owner's profile revision history.
Public support repository and Job Search feedback (#2056): Tools now links to a public GitHub support/changelog repository from the global footer without adding anything to the main navbar. Job Search also links directly to both the built-in suggestion board and the public issue tracker; the suggestion link opens with Job Search preselected.
Job Search notification deduplication (#2067): The admin Notifications inbox and shared job_search.new_results messages now use the linked profile's Alert Engine new-result count when that bridge completed successfully. Rediscovered jobs already known to the same profile no longer create a false new-job announcement, while separate profiles keep independent result histories.
Job Search remote OpenAI workers (#2055): Job Search can now hand the OpenAI web-search request to the standalone worker pool without moving profile ownership, source discovery, verification or result storage out of ToolsAPI. Worker authentication does not bypass AI Credits; shared-credit preflight happens before provider execution, with an explicit admin/permission exception only for the credit gate. Remote completion is lease-safe and finalized through the ordinary Job Search pipeline, with local provider execution retained when no compatible worker is online.
Job Search structured source factory (#2061): Job Search now queries Arbetsförmedlingen JobSearch and JobAd Links as independent structured discovery providers before OpenAI analysis. Their normalized candidates are evaluated together with normal web-search evidence, while a failure in one structured provider does not prevent the other source or ordinary web search from continuing.
Browser Social automatic interaction revisits (#2028): Committed neutral automatic-reply runs now revisit one verified interaction read-only before each fresh scan and prime every newly verified reply from the bounded run afterwards. Exact verified comment links are preferred and checked after Facebook navigation, collapsed direct replies are opened in a bounded way, and failed/unavailable revisits are surfaced through operational diagnostics without allowing an automatic resend. Botstudio run history shows the bounded revisit result.
Botstudio feed queue and publication recovery (#1909): Curated feed queue state and shared publication memory are now shown separately. A publication receipt no longer disables a legal Remove from queue action, while duplicate protection still blocks adding or re-adding an article until the receipt is safely resolved. Operators who have manually checked Facebook and confirmed that an uncertain post does not exist can use the explicit Not published - release action; only an uncertain receipt can be released through the existing guarded recovery path. Automatic previews blocked by older publication memory are now recorded as blocked instead of being mislabeled as a new uncertain send.
Job Search public profile settings, AJAX reruns and longer priority labels (#2048, #2049, #2050): A public Job Search link can now separately expose the profile's instructions, exclusions, relevance rules, active state and email/SMS channel choices while contact details stay private. Sharing is switched off when ownership changes so the new owner must opt in again. The profile editor's manual run also stays on the page through AJAX, showing elapsed time and the result without a full reload while keeping the ordinary form fallback. Verified listings with longer descriptive priority labels can now be saved without hitting the old 64-character database limit. Administrator all-profile reruns also count the profile that actually failed and keep the failure visible in the operational Tools channel with safe Job Search context.
Let's Encrypt bundle-aware renewals (#2044): Missing-renewal monitoring now stays quiet when every exact DNS name from an older individual certificate is already covered by other active certificate bundles. Partial or expired coverage still warns, while a successful fingerprint-changing renewal emails the current certificate owner.
GPT Image 2.5 option completion (#2037): Sunburst and Flare now expose xhigh/max quality and transparent PNG backgrounds across the authenticated generator, archive follow-ups, the OpenAI image test and reusable image targets. The shared size planner also recognizes GPT Image 2.5 flexible native dimensions wherever a flow accepts target/provider dimensions. Existing defaults stay unchanged, and older image models reject 2.5-only quality values.
GPT Image 2.5 (#2034): The authenticated Image Generator, archive follow-ups, OpenAI image test selector and reusable image targets can now select GPT Image 2.5 Sunburst or Flare while keeping the existing default model unchanged. AI billing recognizes both new models using OpenAI's published token rates. Deterministic catalog/pricing coverage is included; no live-provider verification is implied.
Scanning now defaults to 90 seconds, configurable from 30 to 180 seconds in Botstudio. Startup and identity switching have separate time margins. Reaching the scan budget returns a partial selection; it does not mean publication failed. Runs sharing a browser profile remain serialized.
Botstudio wide feed selection (#1909): Feed selection no longer turns a legitimate first-party cards page into HTTP 502 merely because a page with up to 100 source entries exceeds the old 2 MB cap. The first-party reader keeps a 16 MiB safety limit, exposes every eligible returned article, and sends safe source/status/size/request diagnostics to #toolsapi when the source actually fails. Numeric feeds such as 28, category slugs and matching first-party Tools URLs keep the same unversioned contract.
Botstudio category depth (#1909): Automated review found that the first follow-up only attached a category-depth parameter to the cards endpoint, which does not consume it. Feed selection now reads categories through the existing unversioned RSS category JSON reader, where max_per_feed is actually enforced per underlying source feed. The default is 30 per source, first-party RSS/cards URLs may preserve a bounded value from 1 to 100, the picker reads bounded 100-row pages before applying the workflow age filter, and numeric feed IDs keep their existing cards behavior. Deterministic regressions validate the real category reader and mapped article data; no live Facebook/OpenAI verification is implied.
Browser Social uncertain-send recovery (#2006): Botstudio can now reconnect an uncertain curated feed item to its exact local verification receipt after a lost dispatcher response, so operators can verify an existing Facebook post without risking an automatic resend. Browser diagnostics also show a bounded safe error reason.
HD article previews now recognize the publisher’s Bonnier image host while retaining source and title verification.
An expired Facebook login is now reported explicitly before sender verification. Sign in again using the configured browser profile and close the login window before retrying. No publication is attempted, and pending articles remain protected against duplicate sending.
Automatic Facebook feed posting is now an explicit opt-in Botstudio feature, separate from the curated article queue. Failures that are proven to happen before Facebook submission no longer consume the daily post allowance or permanently block the article; uncertain sends still require manual verification and are never resent automatically. An uncertain commit pauses automatic posting whether it was started from Botstudio, the direct CLI command or the scheduler.
Facebook replies now support both "Svara som" and "Kommentera som" labels while still requiring the correct sender and a unique reply field.
Browser commands now preserve the runtime owner when launched administratively, preventing private receipts that later GUI or scheduled runs cannot read. Publication verification also handles verified-page badges and confirms the author's numeric identity. Automatic-reply reports also show rejected proposal scores and reasons, making an empty selection explainable.
Botstudio adds neutral automatic replies for all group workflows: preview, explicit permission and pause, relevance settings and a shared daily counter per sender. GUI and scheduled runs share duplicate protection and never blindly repeat uncertain submissions. Existing workflows are not enabled automatically.
Run buttons are removed from Tools Cron and browser script administration. Execute through server commands or scheduling; settings and history remain. Botstudio review and publication actions are unchanged.
Link previews can now be verified across Facebook's current direct and CDN-proxied preview-card variants. The exact article source must still be bound to the card, and detached placeholder cards still require matching publisher and title evidence before their loaded thumbnail is accepted.
Publishing now supports Facebook's fixed Public/Private group audience label after verifying the destination group URL and sender.
Job lists, browser settings and Botstudio run history have clearer boundaries and more spacing between entries.
Botstudio has prominent links from script views and brings together bots, assignments, mood and AI instructions.
Page switching now waits for Facebook to render its profile list before finding the selected sender.
Botstudio can now revisit recorded own interactions, compare visible thread context and show a read-only report without publishing or using AI.
This changelog highlights user-facing improvements across the Tools platform.
From ISO week 36 of 2026 onward, user-facing changes are consolidated into one weekly section instead of one section per platform version or individual dated change. The repository-root CHANGELOG.md remains the comprehensive engineering history.
Job Search capacity and discovery (#1879, #1988): Job Search keeps an included baseline allowance and can use separate Job Search credits for extra successful logical searches without charging again for provider retries or failed runs. It is also easier to find: the dashboard keeps it featured, /services highlights it for guests and signed-in users, and My Profile pins the owner workspace by default instead of linking standard users to admin. Generic AI Credits remain separate.
X-bot Force reply now really forces candidate generation (#454): The operator action no longer reruns the normal routing pipeline and then stops on the same local veto. For one authenticated Force reply action, local candidate-generation blockers such as opt-out state, routing/addressing checks, loop guards, AI-chain depth and incomplete thread ancestry are bypassed. Tools still tries to recover the thread first, then uses the best stored same-thread context if recovery remains incomplete. The generated candidate never auto-posts and still requires the normal manual review/posting path; provider failures remain real failures and are surfaced to operators.
X-bot quoted/reposted image references (#2002): Image requests can now recover a photo that is visibly embedded through a quoted or reposted X source post instead of falling through to text-only generation. Directly attached media still has priority, quote/repost traversal is bounded, and normal reply ancestry remains handled by thread recovery. Deterministic provenance regressions cover the behavior; no live X-provider verification is claimed.
X-bot human requests in AI-populated threads (#1998): A human-authored request that explicitly addresses the configured X bot is no longer rejected by the AI-to-AI loop-depth guard merely because Grok or other known AI accounts also appear in the recovered thread. The loop limit remains active for turns actually authored by the configured bot or a known AI account. Manual reprocessing also no longer shows a green Done state when no candidate was produced; the action now fails visibly with the stored reason instead.
X-bot manual reprocess recovery (#1998): Production retesting after the conversation-search fix exposed a second failure: a manual reprocess discarded the stored source payload and captured thread history before recovery ran. Reprocessing now keeps that immutable reply/thread evidence while recalculating routing, rules and the candidate from fresh state. If full thread context is genuinely unavailable, the operator card says so and no longer suggests Force reply as a context bypass.
X-bot thread recovery (#1998): Addressed questions no longer have to remain pending merely because direct per-post X reads cannot reconstruct a known reply chain. Tools now tries a bounded conversation search before deferring, while still requiring a complete path back to the conversation root before generating a reply. Multi-mention concrete questions to the configured bot are covered by deterministic routing regression tests. No live X-provider verification is claimed.
One account mobile number (#1989): SMS-capable services now reuse the same account mobile number and shared verification flow. Normal users always confirm a new or changed number with a six-digit SMS code, while an administrator can explicitly trust a number from user management without sending that challenge.
Job Search verified SMS and owner reruns (#1962): The structured profile controls from #1958 now require six-digit ownership verification before a new or changed mobile number can be used for SMS. A real search-criteria change permits one fresh owner search immediately; unchanged reruns still obey cooldown, daily-run and AI-budget guards.
Browser Social sender identity hardening (#1972): Facebook may change or decorate the accessibility label on the active Page link without changing the underlying sender. Browser Social now verifies the configured numeric group/Page identity from the canonical sender URL instead of requiring the exact Profil som tillhör <Page> wording. Wrong group/Page identities still fail before input or publication, and deterministic Playwright coverage also protects identity resolution and threaded replies. No live Facebook publication is claimed by these tests.
Job Search profiles now have a cleaner control panel with Search now, inline SMS mobile-number setup, in-place notification tests, and a direct AI Credits Shop entrypoint (#1958).
Browser Social group verification and recovery (#1969): Facebook group-title decorations or wording changes no longer stop a valid saved workflow when the configured numeric group and sender IDs still match. If shared publication memory blocks an uncertain article, needs_verification uses the original local hash job when available; valid non-hash request keys from the shared publication API stay blocked and are identified by publication metadata instead of a fabricated local job. The fix is covered by deterministic browser/ledger tests; no live Facebook publication is claimed.
Readable Statuspage contrast (#1964): The public Statuspage now deploys standalone client 0.1.4. Dark mode keeps the dark outer canvas while status cards use explicit dark foreground and muted text on their light surfaces, fixing the washed-out component and incident text seen on /status. The static bundle remains under /status-client/, the public application route remains /status, and the status API remains unversioned.
Automatic Facebook feed posting now uses the central scheduler (#1963): After automatic feed posting is explicitly enabled in Botstudio, ToolsAPI's normal scheduler now checks due workflows automatically. The saved per-workflow interval still controls when a post may run, and the manual CLI remains available for preview and diagnostics; a separate autopost scheduler installation is no longer required.
Suggestion administration and statuses (#1955): The suggestion board now uses readable status labels, administrators can change statuses directly from the suggestion list, the Copilot/GPT instruction area uses the available card width, Suggestions & feedback is discoverable from /admin, and administrators can delete unwanted/test suggestions without changing an already linked GitHub issue.
Suggestion badge colors (#1959): Published suggestions now distinguish service, feedback type and status with separate theme-aware badge colors. Implemented, planned, rejected, closed and in-progress states remain identified by visible text as well as color, while the Open action is visually separated from metadata badges.
Job Search and the suggestion board (#1954): Job Search documentation now links directly to the public suggestion board. Select Job Search as the service when reporting a poor match, missing source, bug or improvement idea so the feedback is connected to the correct part of Tools.
Social previews for Job Search and docs (#1953): /job-search now reuses its existing public platform thumbnail as an explicit Open Graph and Twitter preview image. Documentation pages emit their generated thumbnail and page description explicitly in early page metadata as well, so social crawlers do not have to infer the image from visible page content. Private or incomplete image targets stay excluded.
Suggestion checkbox layout (#1950): The public suggestion form now keeps both checkbox controls compact and directly beside their explanatory text instead of inheriting full-width text-input sizing. The fix also resets inherited input padding/border presentation and has focused rendered-view regression coverage.
Public service-scoped suggestion board (#1944): The existing suggestion box is now a public feedback board. Suggestions can target a service from the live /services catalogue, distinguish positive/negative feedback from features, improvements and bugs, and expose a copyable implementation instruction for Copilot or GPT. Submitter identity and private support context stay private. Reviewed public suggestions can be turned into idempotently linked Tornevall/toolsApi GitHub issues by authorized support administrators.
Whisper remote retry diagnostics (#1896): A remote-worker retry now keeps a safe, useful cause on the job page and in operator diagnostics, including model support/load, runtime/accelerator, input-media and empty-transcript classes. Apple Silicon workers distinguish Preparing MLX Whisper from actual segment-producing Transcribing. A same-lease progress request already in flight across terminal acknowledgement is absorbed as a no-op instead of producing a misleading lease-loss error. Raw provider/worker details and secrets remain private.
Tools platform version: 1.38.1
Image Generator adjusted-prompt visibility (#1913): When automatic reject retry rewrites a blocked image request, the Generation console now shows the exact adjusted prompt used for the retry. Owner and administrator archives highlight the adjusted prompt and label it separately in full prompt provenance. Public images show both the original and adjusted prompts only when prompt publication is enabled. Provider-revised prompt text remains a separate field. Focused deterministic UI and archive coverage protects the behavior; provider transport is unchanged and no live-provider call is required.
Android SocialGPT sign-in (#1041): Android Preferences can now sign in with the user's Tools account and receive a dedicated owner-bound SocialGPT credential without copying a bearer token. The account-session JWT remains separate, and browser-pairing credentials are not reused. Token creation, reuse and rotation are structured-audited and operational failures remain visible without exposing credentials. The flow is covered by focused deterministic backend and Android checks; no live-provider call is required.
Scheduled Job Search provider recovery (#1878): Scheduled searches now recover from short-lived OpenAI TPM/rate-limit responses with bounded retries, honoring the provider-requested wait when it is available and using bounded backoff otherwise. Incomplete max_output_tokens responses get one low-reasoning recovery attempt so structured listing output can finish. Permanent authentication, billing and exhausted-credit/quota failures still stop and report the run. Scheduled searches continue to bypass interactive per-user Job Search budget/cooldown guards because they are system work for enabled profiles; provider capacity limits remain external constraints.
Job Search profile ownership and admin inspection (#1914): Moving a search profile now keeps its current criteria, verified listing inventory and profile-scoped dismissals with the current owner while historical runs, audit records and Alert Engine run/result history retain their original provenance. Administrators can open read-only user/profile and run inspection views, see ownership inconsistencies and explicitly reconcile current profile state. Returning a profile to a former owner can relink that owner's own compatible historical Alert instead of failing on a duplicate Alert name; another owner's Alert history is never transferred.
Job Search provider budget and structured helpers (#1919, #1920): Job Search now caps one mandatory provider request at eight web-search tool calls and scheduled runs use low reasoning effort by default, reducing TPM pressure without weakening manual searches. The instruction, profile-name and negative-keyword helpers now use native strict Structured Outputs instead of prompt-only JSON, fixing the HTTP 422 invalid-JSON failure mode.
Job Search admin profile editing and AI progress (#1934, #1936): Administrators can open another user's full Job Search profile editor without impersonation or ownership transfer, while mutations are explicitly authorized and audited against the target profile. The instruction helper now shows an indeterminate progress bar with elapsed time, prevents duplicate clicks during an active AI request and ends in a clear completed/failed state instead of a static loading line.
Broader Swedish Job Search source coverage (#1939): Swedish searches now deliberately cover Platsbanken and LinkedIn, add profile-relevant sources such as green, public-sector or technical job boards, and still search the broader web and direct employer career pages. Discovery stays bounded inside the existing provider tool budget, while stored results still use verified individual advertisement URLs and are de-duplicated across sources.
Public Job Search guide (#1941): Job Search now has a separate English user guide for people who want to understand the service without starting in the technical reference. It explains the adaptable side-project origin, personal search profiles, AI-assisted relevance, automated searches, notifications and how unwanted results can be used to refine a profile. Planned broader source coverage is clearly marked as ongoing work.
Clearer platform image targets (#1943): The image-target admin keeps flexible service/resource identity fields but now uses explicit choices for purpose, output size, visibility, model and quality. Documentation page IDs come from the canonical docs catalog, and docs + page targets can build an editable prompt suggestion locally from the selected page without an extra provider call.
X-bot image references (#1877): When an X image-generation or correction request includes a photo on the newest post, that photo is now the primary visual reference. If the newest post has no usable photo, the bot falls back to the same reply ancestry and only then to broader forwarded thread media. This prevents a previously generated wrong bot image from overriding a newly attached reference during a correction.
Group-name aliases now produce stable numeric post permalinks after publication. A missing or foreign permalink is an uncertain result and never triggers an automatic resend.
AI draft generation now gives reasoning models enough bounded output capacity to finish structured reply suggestions. An incomplete response still stops before publication. AI draft generation now gives reasoning models enough bounded output capacity to finish structured reply suggestions. An incomplete response still stops before publication.
Tools platform version: 1.38.1
Detailed release records through Tools 1.36.1 remain preserved in the historical changelog archive. The complete week 36 public report remains in docs/wp-posts/tools-2026-w36.en.md.
AI draft generation now gives reasoning models enough bounded output capacity to finish structured reply suggestions. An incomplete response still stops before publication.
Preview checks verify that Facebook fetched and displays the article image, including in permalink dialogs, without requiring its image server to match the news website. AI service errors before publication keep selected articles queued.
In Botstudio → Feed selection, Run one article now processes at most one waiting selected article immediately, including while its schedule is paused. Manual execution preserves the paused/active setting and keeps the next scheduled attempt at least one saved interval away. Resume schedule restores scheduled processing using the displayed interval. Reactivate article explicitly accepts the current workflow configuration for a safe waiting or blocked item. Check existing post verifies an uncertain publication without sending it again; an unverified result remains protected from duplicate sending. AI service errors before sending leave the article waiting. Facebook image checks confirm a loaded article image, without inspecting every upstream image address.