wellness-nourish 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -6,6 +6,25 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-05-19
+
+### Added
+
+- **30 commonly-missing Brazilian regional foods added to the TACO subset.** The curated TACO dataset grew from 105 to 135 entries with regional specialties that agents frequently encountered as misses. New coverage: cassava family (`farinha de mandioca`, `polvilho azedo`, `biscoito de polvilho`), corn-based desserts (`pamonha`, `curau`, `canjica branca`), regional bean dishes (`feijão tropeiro`, `baião de dois`), jerked-beef preparations (`carne seca`, `paçoca de carne seca`, `arroz carreteiro`, `escondidinho de carne seca`), Bahian/Afro-Brazilian dishes (`acarajé`, `vatapá`, `caruru`, `bobó de camarão`, `moqueca baiana`), Amazonian (`tucupi`, `cupuaçu`, `açaí na tigela`), drinks (`guaraná`, `mate gelado`, `chocolate quente`, `caldo de cana`), and classic desserts (`beijinho`, `quindim`, `pudim de leite`, `goiabada cascão`, `cocada branca`, `paçoca de amendoim`). Each entry ships with realistic per-100g macros, common-serving size, pt-BR aliases, and TACO-style row id (700-range is reserved for regional entries not in the original 597-row publication). Source attribution: TACO 4 (NEPA/UNICAMP) primary, IBGE POF 2017-18 + USDA SR Legacy cross-reference for the entries that were never published in the original table.
+
+### Fixed
+
+- **`refrigerante, cola` no longer claims `guaraná` as an alias.** Guaraná is a distinct soda (now its own entry, taco_id 588). Searching "guaraná" used to incorrectly return cola.
+- **`açaí, polpa congelada` no longer claims `açaí na tigela` / `acai bowl` as aliases.** The complete bowl with toppings is a new dedicated entry (taco_id 392) with realistic macros; the polpa entry returns to representing just the frozen pulp.
+
+## [0.6.1] - 2026-05-11
+
+### Fixed
+
+- **Profile-store regex no longer false-positives on common wellness words.** Split `SECRET_PATTERNS` into two: `SECRET_KEY_PATTERNS` (broad, matches field names like `oauth_token`) and `SECRET_VALUE_PATTERNS` (high-specificity, only matches actual credential shapes: JWTs, `Bearer <token>`, `sk_live_`, `sk-proj-`, `xoxb-`, `github_pat_`, raw `Authorization:` headers). Previously, profile updates with legitimate text like "5 training sessions per week", "limit cookies", "I need to refresh my approach", or "secret sauce: more sleep" were rejected.
+- **Partial-profile reads no longer crash downstream.** `readProfileFile` now structurally merges with `DEFAULT_PROFILE` when legacy Hermes/OpenClaw profile-pack files lacked one or more sub-objects (goals, devices, training, nutrition, preferences, safety). Previously `buildProfileSummary` and `missingCriticalFields` would throw `Cannot read properties of undefined`.
+- **Onboarding `privacy_note` no longer hard-codes a single connector path.** Updated to list multiple example paths (`~/.whoop-mcp/`, `~/.oura-mcp/`, `~/.garmin-mcp/`, etc.) so the message reads correctly from every connector.
+
 ## [0.6.0] - 2026-05-11
 
 ### Added

package/README.md

@@ -86,6 +86,16 @@ Run Streamable HTTP locally:
 node dist/index.js --http
 ```
 
+### ChatGPT App / MCP Apps UI
+
+Nourish also exposes a compact MCP Apps-compatible dashboard for ChatGPT and other compatible hosts:
+
+- Tool: `nourish_chatgpt_dashboard`
+- UI resource: `ui://widget/nourish-dashboard-v1.html`
+- MIME type: `text/html;profile=mcp-app`
+
+The dashboard shows the daily nutrition summary, hydration progress, profile gaps and next-meal coaching, and it can call `nourish_estimate_meal` from the embedded UI for preview-only estimates. It does not write intake, water or goals; mutating tools still require explicit user confirmation through the normal MCP tools.
+
 Optional environment:
 
 ```bash

package/dist/apps/nourish-chatgpt-app.d.ts

@@ -0,0 +1,2 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function registerNourishChatGptApp(server: McpServer): void;