CHANGELOG.md

Rama main · réplica de lectura del repositorio original.

# Changelog

All notable changes to Spectarr will be documented in this file. Releases follow Semantic Versioning.

## 0.5.0 - Unreleased

- Add an explicit native conversion backend with capability checks, immutable recipe provenance, cancellation, output verification, and a read-only Docker executable mount.
- Reject unsupported native settings before jobs are queued, and preserve 64-bit native intensity defaults through recipe creation and updates.
- Keep native profiles out of the ProteoWizard settings editor so their preservation policies cannot be discarded.
- Upgrade mzMLPy to 0.10.1 and Spxtacular to 0.9.2 for metadata, MS2 output, and annotation corrections.
- Refresh compatible Python and dashboard dependencies, fix the source-map-js audit finding, and update immutable runtime image digests.
- Use uv-aware dependency updates for the backend lock and update the pinned setup-uv action.

- Use Spectarr consistently in the public introduction, dashboard labels, browser title, and API title.

- Replace the long README with a short project introduction, live demo screenshots, and a documentation index.
- Document the first import, remote server access, HTTPS proxy configuration, storage, updates, and troubleshooting.
- Keep MCP on loopback independently of the dashboard's network bind address.
- Allow exact HTTPS origins through Compose configuration for reverse proxies.
- Fail early when the configured Docker socket does not exist.
- Keep automatic secret generation when copying either environment example, and validate release Compose without requiring an environment file.

## 0.4.0 - 2026-09-25

- Use loopback for isolated backup restore checks so production hostname restrictions do not reject valid backups.

- Migrate Python to 3.14, SQLAlchemy to 2.1, TypeScript to 7, Vitest to 5, Node to 26, and the reader runtime to .NET 10.
- Pin the September stable ProteoWizard build, verify vendor conversions and read-only discovery, and close SQLite backup connections explicitly.

- Upgrade Spxtacular to 0.9 and mzMLPy to 0.10 with schema 2 support and rapidgzip access.
- Harden browser request boundaries, webhook DNS handling, converter isolation, XML parsing, and concurrent administrator setup.
- Refresh dependency locks and container images, remove runtime installer tooling, and pin CI actions to commits.

- Added local external inventory with explicit folder registration, project permissions, coverage-aware scans, content revisions, confirmed relocations, and selected resumable imports
- Added read-only MCP external search and host-scoped location resolution without changing managed artifact access
- Added optional producer publication markers and safer source reads, with consistent bundle checksum ordering
- Added read-only Docker inventory rehearsals and a small local TimSim fixture generator

- Added an isolated simulated instrument rehearsal with real agent processes, resumable HTTP fault injection, native bundle replay and a portable CI gate
- Thermo RAW and Bruker TDF spectrum viewing uses the extraction reader when available, preserving catalog native IDs, profile or centroid representation, and peak arrays
- Documented the acquisition completion heuristic and reproduced its unmarked-pause limitation without uploading incomplete data

- Simplified run processing with primary formats, stored output links, live job details, and collapsed completed history
- Unavailable artifacts are rejected as explicit conversion inputs
- Idle converter workers retry temporary maintenance responses without restarting the application
- Real-file release rehearsals now verify reimported mzML, MCP pagination and file resolution, independent scientific counts, project renaming, maintenance, restart, and restore
- Captured source archives include exact dependency changes and checksums. CI applies the pinned Sage centroiding correction and uses the tested dependency revisions

- Rebranded the workspace as MassSpec with compatible existing configuration and storage identifiers
- Replaced the wide SDRF grid with searchable entries, focused field groups, and collapsible project details and column management

- Named conversion presets now recognize gzipped outputs and index mzML without adding a duplicate gzip suffix
- RAW extraction preserves nested OpenMassSpec precursor m/z, charge, isolation windows, collision energy, and activation metadata
- The integrations page displays and copies a configured public MCP endpoint for custom ports and reverse proxies

- Long dialogs remain scrollable when profile or experiment lists exceed the viewport
- Activity queued-job cancellation with atomic server state checks, viewer write restrictions, and accurate cancelled status
- Retry controls for cancelled processing batches and recovery from transient polling failures without discarding unsaved backup settings
- Extended GUI verification of webhook controls, repository package checksums, derived-file reclamation, populated experiment deletion, navigation, and session expiry

- GUI hardening for dialog keyboard navigation, pending submissions, readable API errors, download session expiry, viewer permissions, and settings navigation
- SDRF validation and export save current edits, column editing keeps keyboard focus, and repeated imports can retry the same file
- Processing previews discard stale results, metadata-only automation stays selected, advanced profile filters survive editing, and expanded batches refresh with live progress
- Dedicated browser regression coverage for imports, spectra, SDRF, processing, settings, accounts, project membership, agent enrollment, storage previews, and experiment deletion

- Public PRIDE dataset lookup and selected acquisition downloads with a persistent server queue, configurable parallel transfers, restart recovery, cancellation, retry, integrity checks, and repository provenance
- Available PRIDE SDRF preview and import for selected acquisitions, preserving existing annotations and multiplexed sample labels
- Administrator download concurrency settings that apply without restarting, plus filename search, bulk selection, and progressive file listing for large PRIDE datasets
- Gzipped MGF and MS2 metadata extraction now streams compressed input and detects gzip content in immutable objects

## 0.3.0 - 2026-09-04

### Fixed

- Project membership filters now cover collection endpoints, overview totals, processing batches, events, and webhook delivery listings
- Viewers and read-scoped API clients can query spectrum catalogs without write access
- Run browsing and search use server-side filters and pagination, and CSV export includes every matching run
- Project, experiment, and job selectors fetch all available pages
- Completed agent uploads release their staging copy, expired uploads resume with the same retry key, and interrupted verification reuses any already committed artifact
- Periodic storage maintenance reclaims abandoned upload payloads and old unreferenced objects while preserving active work
- Backup snapshots coordinate database and storage access and verify every ready artifact and vendor-directory member
- Restore rehearsals explicitly isolate their mounts and disable processing and outbound workers
- Stable image tags are promoted from the tested candidate digest only after release gates pass
- Production API dependency constraints match the backend lock, including current Starlette security fixes
- Blocking API operations and downloads run outside the event loop, token activity writes are throttled, and run pages load related data with bounded query counts

### Added

- Administrator backup settings with persisted schedules, on-demand backups, retention, destination identity checks, and visible verification and failure status
- Periodic isolated restore checks that verify extracted acquisitions, boot the restored API, and enforce read-only recovery mode
- Optional Compose backup mount, with missing-mount protection and independent verification and restore instructions

- Browser batch import with shared project and experiment assignment, filename-based naming previews, editable samples, per-file progress, and retries that reuse already committed runs and artifacts
- Multiple allowlisted server paths can be queued together, including atomic vendor directories
- `SPECTARR_STORAGE_DIR` in the release Compose file mounts bulk artifact storage separately from the data directory, so the SQLite database can stay on local disk while artifacts live on large or network storage
- Conversion side-cars now translate paths using every mount of the Spectarr container (longest prefix wins), so a separately mounted storage root converts correctly
- The storage root is stamped with an identity marker at startup; Spectarr refuses to start when the expected marker is missing or belongs to another instance, so an unmounted storage share fails loudly instead of writing artifacts to the wrong disk
- Startup now warns when the SQLite database sits on a network filesystem (CIFS, NFS, and similar), where SQLite locking is unsafe

## 0.2.0 - 2026-08-31

### Added

- Zero-configuration production startup with persistent, automatically generated application and worker secrets
- Automatic discovery of bind mounts and named volumes used by nested conversion containers
- Release-readiness validation, clean-room rehearsal tooling, and production smoke coverage
- Public conversion-library contracts for reproducible ProteoWizard execution
- Security reporting and release governance documentation
- Unsigned Windows acquisition-agent MSI packaging with native service registration, rotating logs, and lifecycle scripts
- Dashboard controls for agent disablement and one-time token rotation
- Concurrent SQLite restart soak testing and reusable real-vendor acceptance tooling

### Changed

- The published image now starts with one Docker command and the standalone Compose file requires no environment file
- Backups now include persistent runtime secrets and work with bind mounts or named volumes
- The full local and release stack now runs as one container with one published image
- SQLite is now the only application database, with WAL mode, integrity checks, and online backups
- The dashboard and REST API now share one HTTP port
- Dashboard navigation now follows Projects to Runs to Run details, with experiments acting as project-level filters
- Run details now separate Summary, Spectra, Files, Processing, and Provenance into stable routes
- Project and run routes now reload on identifier changes and repair stale project, experiment, legacy, and tab URLs
- Loading, empty, filtered-empty, and unavailable states are now distinct throughout the project workflow
- Imports launched from a project preserve that destination and suggest its existing experiments
- Dashboard-only image rebuilds now reuse the installed backend and worker dependency layers
- OpenMassSpec is now limited to vendor acquisitions, leaving open formats to their native streaming parsers without fallback noise
- Forced metadata extraction now refreshes the stored result and removes stale warnings
- Spectrum details selected from the catalog now preserve the catalog scan identity
- Running processing jobs now honor batch cancellation through the converter worker
- Version consistency is validated against the canonical `VERSION` file
- Acquisition identity now preserves distinct occurrences with identical content while retaining checksum-based storage deduplication
- Scientific source dependencies, Python runtime packages, and base container images are now pinned for release builds
- ProteoWizard peak-picking levels now compile as valid ranges, and failed conversions preserve stderr in job errors
- Backup validation now boots and checks an independent restored Spectarr instance
- Container shutdown now cancels named ProteoWizard jobs cleanly and leaves leased work recoverable after restart

## 0.1.0

Initial release candidate for the self-hosted mass spectrometry library, processing, extraction, acquisition, webhook, dashboard, REST, and MCP services.