README.md: backfill the Changelog with the 2026.9.5, 2026.8.31.1, 2026.8.31,
and v1.2.0 releases that were missing (it jumped straight from 1.0.0 to
1.1.0). Also correct the stale "Mobile App Support"/"Mobile App
Integration" sections - the native Android app is retired, and the
sync protocol they describe now powers the offline PWA instead.
Remove Firebug IT branding/contact info across README.md, API.md, and
the site footer, and drop the stale tasks.firebugit.com fallback from
development.py's ALLOWED_HOSTS/CSRF_TRUSTED_ORIGINS.
AllowMobileAppFramingMiddleware detected the native app via a
'com.firebugit.keepitgoing' User-Agent check to allow WebView iframe
embedding. With that app retired, replaced it with
SecurityHeadersMiddleware, which applies the same X-Frame-Options/CSP
headers unconditionally instead of only for non-mobile requests -
same protection for real users, dead branch and dead branding gone.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
API.md: document the reminder/due_soon/overdue notification schedule
(including the due_time-aware is_overdue fix and the 1-hour overdue
delay) and how default_reminder_minutes/reminder_at interact.
README.md: add Offline Support (PWA) and Notifications & Reminders to
the feature list - both were fully functional but never listed. Also
fixes a real gap in the manual systemd deployment guide: it only set
up the Celery worker, never Celery Beat, so the daily digest, recurring
task safety net, and now reminders would never fire for anyone
following that guide.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Wires up the previously-scaffolded VAPID/DeviceToken infrastructure end
to end: browser subscription flow on the Profile page's existing "Push
Notifications" toggle, a service worker push/notificationclick handler,
and server-side sending from the daily task digest. Also broadens that
digest's eligibility query so push-only users (email notifications off)
aren't silently skipped, and adds `generate_vapid_keys` since the pinned
py-vapid's own key generator is broken against current cryptography.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
API.md now lists the supported custom RRULE patterns (every Wednesday,
every other Wednesday, every second Tuesday, every 15th, etc.) matching
the newly implemented dateutil.rrule evaluation. CLAUDE.md's Task model
reference also gets corrected: it listed recurrence_type/recurrence_interval
fields that never existed on the model.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Complete REST API documentation including authentication, rate limiting, all endpoints (users, tasks, tags, time tracking, sharing, sync, notifications), error handling, and usage examples. Intended for developers building applications that integrate with KeepItGoing via the API.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
