HealthLog v1.1.0 — AI Insights Overhaul

Complete overhaul of the AI-powered health insights system with medical guideline-based analysis and ChatGPT subscription integration.

Highlights

ChatGPT Proxy Integration

• Insights now run through your ChatGPT Plus/Pro subscription via a local proxy — no separate API billing
• Admin fallback: global API key (OpenAI/OpenRouter) for users without their own connection
• Provider abstraction with automatic failover (Codex OAuth → Admin Key → Fallback texts)

Medical Insight Prompts

7 specialized prompts based on current clinical guidelines:

• Blood Pressure: ESC/ESH 2023 classification, morning stroke risk ladder (J-HOP), pulse pressure, seasonal variation
• Weight: 5%/10% milestone recognition, plateau detection, body composition divergence, sleep-weight correlation
• Pulse: Fitness interpretation ladder, 80–100 bpm elevated-risk band, rate-pressure product
• BMI: Age-adjusted DEGAM classification for 65+, body fat context
• Medication: Chronotherapy hints, mood-adherence risk prediction, 90-day tracking
• General Status: Cross-domain synthesis with cardiovascular risk stratification
• Mood: Bidirectional correlations with vitals and adherence

New Health Metrics

• Rate-Pressure Product (pulse × systolic BP — myocardial demand)
• Body composition divergence (weight stable + body fat rising = muscle loss)
• Mood-adherence risk predictor (mood decline → adherence drop in 2–5 days)
• Seasonal BP variation (winter vs summer)
• BP standard deviation + pulse pressure (arterial stiffness)
• Sleep duration and activity steps (previously ignored)
• 5 cross-metric Pearson correlations
• Historical comparison (current 7d vs previous 30d baseline)

New UI Components

• InsightStatusCard — compact per-metric card with classification indicator and fade-in animation
• InsightAdvisorCard — premium structured card with findings, correlations, recommendations (ready for integration)
• Personal advisor tone ("Dein Blutdruck zeigt...") with positive-first pattern
• Dracula-themed with proper dark/light support

Security

• Rate limiting on all OAuth and admin endpoints
• PKCE (S256) + state parameter for OAuth CSRF protection
• Encrypted token storage at rest (AES-256-GCM)
• Error message truncation to prevent upstream body leaks
• 3 security audits applied
• prefers-reduced-motion support

Breaking Changes

• openaiKeyEncrypted field removed from User model (replaced by provider abstraction)
• Settings API now returns codexStatus instead of hasKey
• Per-metric insight generators return hasProvider instead of hasKey