we-promise/sure v0.7.4

Sure v0.7.4 - Passkeys, new `/plan` area (budgets + goals) and more!

on GitHub

Sure v0.7.4 brings a new unified planning experience (under /plan - via preview features), passwordless login using Passkeys plus expanded external AI harness work for wealth tax analysis. And a public roadmap for users and contributors!

New /plan Area

The dedicated /plan area brings budgets and goals together in one place (still behind preview features!) The "Goals" experience uses an envelope-style approach inspired by YNAB, making it easier to assign money, track what is available, and connect everyday budgeting decisions to longer-term goals. We also added rollover and personal budgets on top of the Family-wide ones!

Passkeys Login

Users can now sign in with passkeys for a faster, simpler, and more secure login experience. This reduces reliance on passwords while keeping account access convenient across supported devices. This enhances the previous MFA-only usage of Passkeys significantly!

Wealth Tax External AI Harness

The release also expandeds Sure’s external AI harness support via extensive MCP (and tool calling!) work, and a wealth tax treatment meta-prompt in experimental landing. The goal is to make AI-assisted financial analysis more structured, testable, and transparent as Sure continues building toward richer agentic workflows.

As summarized above, we now have a public roadmap at sure.am/roadmap, backed directly by the repo’s roadmap document. It gives users and contributors a clearer view of what is planned, what is in progress, and where the project is headed next.

Thank you once again to everyone who contributed, tested release candidates, and reported issues. This month particularly to @buzzromain who polished the Goals area tremendously! Approximate stats updated by our friendly hallucinator bot:

What's Changed

• docs: add redbark hosting guide by @oscargws in #2817
• chore(deps): bump oauth2 from 2.0.18 to 2.0.22 by @dependabot[bot] in #2846
• Update Rails for Active Storage security advisory by @sure-admin in #2849
• feat: show counterpart account in transfer transaction list row by @shrestha-bishal in #2643
• Don’t re-create pending SimpleFIN transactions when pending sync is disabled by @PrplHaz4 in #2835
• Fix transactions posting a day early when booked around midnight. by @OtterBoops in #2744
• fix(ds): keep DS::Menu/Popover panels anchored across Turbo morphs by @gariasf in #2812
• fix(accounts): make the sync toolbar and toast agree, fix toast overlap by @gariasf in #2813
• Fix(exchange_rate): Handle RecordInvalid in find_or_fetch_rate race condition by @sentry[bot] in #2734
• perf(accounts): preload transfer, category, and split-parent associations on show by @JSONbored in #2441
• design-system(mobile): polish Dashboard with Sure tokens by @JSONbored in #2457
• fix(tags): return 404 for missing or cross-family tag deletion by @pro3958 in #2703
• fix(layout): persist sidebar collapse preference across reloads by @pro3958 in #2764
• fix(accounts): skip digest on sidebar fragment cache by @pro3958 in #2776
• Wire @kraken_items into the accounts index by @pro3958 in #2770
• Fix SnapTrade account setup and reconnection by @maxjb-xyz in #2858
• Stabilize net worth breakdown series tests by @sure-admin in #2863
• fix(oidc): honor http issuer scheme during OIDC discovery by @thewillwilson in #2853
• chore(deps): bump msgpack from 1.8.0 to 1.8.2 by @dependabot[bot] in #2866
• Fix uncategorized budget spending UI state by @sure-admin in #2877
• fix(insights): keep rolling period labels on month boundaries by @bittensorrider in #2880
• fix: tolerate Trade Republic Enable Banking pagination/PDNG errors (#392) by @gfr-free in #2828
• fix(insights): correct the budget card's figure, badge noise and toast a11y by @gariasf in #2799
• fix(enable-banking): preserve manual card limit when provider reports zero by @carloslindo in #2841
• fix(exports): include merchants.csv in family data export by @kai392 in #2758
• fix(insights): respect recurring_transactions_disabled in subscription_audit by @gariasf in #2831
• feat(plan): unify Budgets and Goals under a single Plan tab by @gariasf in #2687
• feat(mcp): Add MCP transaction update tool by @Mart1M in #2719
• fix: update Claude MCP connector instructions by @sure-admin in #2915
• feat(transactions): surface recently-used categories in the category picker by @gariasf in #2829
• fix(mcp): assign OAuth clients read_write scope by @atlas-maxjb in #2884
• fix(design-system): resolve DS Drift Patrol findings (#2836) by @thewillwilson in #2867
• Fix chained assistant tool calls by @mauriciopolvora in #2767
• fix(list-filter): match accented text regardless of typed diacritics by @gariasf in #2814
• Preload transfer counterparty associations on transactions index by @bittensorrider in #2819
• Tooling for the wealth + tax agent harness by @jjmata in #2848
• fix(binance): correct base_url for futures api endpoint, start_time param by @UnamedRus in #2839
• fix(messages): handle chat not found during message creation by @sentry[bot] in #2896
• Add tags support for transfer transactions by @bittensorrider in #2921
• Add “Is not equal to” operator for transaction amount rules by @bittensorrider in #2922
• fix(ui): satisfy DS Drift Patrol Rule 4 in redbark disclosure by @bittensorrider in #2919
• fix(ci): avoid bumping prerelease versions on PR branches by @sure-admin in #2886
• fix(pages): set breadcrumbs for changelog and feedback pages by @KenTandrian in #2889
• fix(settings): give API key copy buttons success feedback by @WolfBrandon in #2948
• fix(goals): keep the projection chart's saved line inside the plot by @gariasf in #2971
• fix(insights): blur amounts in insight prose under privacy mode by @gariasf in #2865
• fix(splits): let category selector size to its content instead of clipping names by @WolfBrandon in #2962
• chore(deps): bump json from 2.21.1 to 2.21.2 by @dependabot[bot] in #2990
• Fix Wise API token setup instructions by @bderenzi in #2988
• fix(accounts): resolve N+1 query for Trade entryables by @sentry[bot] in #2973
• fix: add Schwab to SimpleFIN total-basis cost_basis allowlist by @Falloutman in #2986
• fix(pwa): give the installed app icon a safe area by @gariasf in #2966
• fix(insights): drop the dismiss toast and fix both empty states by @gariasf in #2965
• fix(goals): recover goals left invalid by account deletion by @gariasf in #2964
• Fix wise imports only 90 days history on initial setup by @packetsnscripts in #2998
• feat(icons): add search field for icon selection by @vdusart in #2862
• feat(mcp): Add MCP budget update tool by @WolfBrandon in #2908
• feat(i18n): complete the German locale by @dakora-solutions in #2847
• fix(i18n): add missing German locale keys by @sure-admin in #3004
• feat(i18n): complete and correct the Traditional Chinese (zh-TW) locale by @drink970082 in #2994
• Enable Banking: progressive date_from fallback on WRONG_TRANSACTIONS_PERIOD by @pedrosantospt in #2992
• feat(yahoo_finance): add Indonesia Stock Exchange (XIDX) support by @faldyif in #3000
• feat(auth): sign in with a passkey, without a password by @gariasf in #2911
• test(i18n): stop gating CI on German coverage by @sure-admin in #3012
• fix(wise): add missing sync button to Wise account group header by @xBlaz3kx in #3009
• feat(mcp): add pagination to get_tags and get_categories tools by @xBlaz3kx in #2492
• fix(pagination): stop the pager wrapping on narrow screens by @gariasf in #2967
• fix(dashboard): fit money-flow month labels and put its figures on scale by @gariasf in #2969
• fix(goals): stop the days-left phrase splitting across lines by @gariasf in #2970
• Add Ukrainian (uk) locale support by @d-degtyar in #2993
• fix: gracefully handle invalid family timezone instead of crashing by @gfr-free in #2821
• fix(ai): drop empty data-driven enums from assistant function schemas by @winters27 in #3016
• chore: drop dead transactions-section preferences by @gariasf in #3021
• Fix SSO JIT new family creator role by @sure-admin in #3024
• fix(chat): make the assistant response timeout configurable by @andrewb-nz in #2910
• Log async rule run failures to debug log by @sure-admin in #3045
• Add comprehensive debug logging to AI cache reset job by @jjmata in #3046
• fix(generators): stop provider:family emitting a broken migration and invalid enum by @markhaines in #3047
• fix(ds): resolve remaining DS Drift findings (#1951) by @bittensorrider in #2979
• fix(ds): resolve remaining DS Drift Patrol findings (#2157) by @bittensorrider in #2977
• fix(ui): resolve DS Drift Patrol findings (#2745) by @bittensorrider in #2975
• chore(deps-dev): bump postcss from 8.5.21 to 8.5.26 in /desktop by @dependabot[bot] in #2947
• fix(i18n): drop redundant Questrade t() default: strings by @bittensorrider in #2976
• Add expandable dialog for debug log table by @jjmata in #3051
• fix(goals): allow deleting a goal without archiving it first by @gariasf in #2963
• Make report income/expense categories clickable by @bittensorrider in #2923
• fix(recurring): include amount in manual recurring duplicate check by @gfr-free in #2972
• fix(dashboard): shorten money-flow drill-down URLs when possible by @gfr-free in #3018
• Use moniker interpolation for user family labels by @sure-admin in #3060
• i18n: complete Spanish (es) translations by @webprojectxeventos-sudo in #2669
• Fix SnapTrade holdings by using the /positions/all endpoint by @globalreset in #3043
• Remove Cloudflare Containers preview deployment infrastructure by @jjmata in #3074
• feat(budgets): add per-user personal budgets with strict isolation by @jubbakka in #2891
• fix(demo): Scope budget auto-fill to family entries to prevent FK violations by @sentry[bot] in #3078
• fix(accounts): remember transaction page size across account navigation by @gfr-free in #3084
• Fix onboarding country and currency defaults by @atlas-maxjb in #3070
• docs: refresh Sure MCP and external AI setup by @sure-admin in #2608
• fix: memory leak in sidekiq by @ahnv in #1940
• fix(providers): capture API error response body in PDF processor span output by @itsLeonB in #2937
• feat(ai): analytical tool-set upgrade for the builtin assistant by @winters27 in #3064
• fix: disable Mark as Recurring button when a manual recurring transaction already exists by @gfr-free in #3103
• fix(ui): keep the account chart view selector in sync on reload by @vdusart in #3121
• fix(enable_banking): recognize N26's PERIOD_INVALID error shape as retryable by @gfr-free in #3112
• Reconcile PDF statement imports against transactions that already exist by @jjmata in #3105
• fix: support DD/MM/YY date format for CSV imports by @gfr-free in #3110
• fix(process-pdf-job): discard on RuntimeError and guard failed status by @ahnv in #2453
• fix: allow saving a budget without any category allocation by @gfr-free in #3101
• fix(charts): round series values to the currency's display precision by @vdusart in #3091
• i18n: remove dead transfers.form exchange-rate keys from ru/zh-CN locales by @gfr-free in #3109
• fix: respect SURE_IMPORT_MAX_NDJSON_SIZE_MB in Sure import GUI upload by @gfr-free in #3111
• Add inline category creation to transaction form by @rottenit in #3088
• chore(security): update Pipelock integration to 3.4.0 by @luckyPipewrench in #3122
• fix(import): tolerate null Rule names and orphaned rejected transfers by @pro3958 in #2775
• fix(transfers): isolate concurrent transfer match in a savepoint by @pro3958 in #2769
• fix: keep excluded entries visible in account activity by @pro3958 in #2772
• fix(lunchflow): refresh stored transaction on pending to posted by @pro3958 in #2778
• fix(transactions): re-render form when creating with no account by @pro3958 in #2777
• fix(simplefin): stop repair_stale_linkages from hijacking a live linkage on a same-name twin by @gfr-free in #3116
• fix(ds): resolve remaining DS Drift findings (#1971) by @bittensorrider in #2978
• feat(self-hosting): surface Sidekiq-unhealthy nudge + admin system health page by @Khaostica in #1906
• feat(rules): add a Transaction tag condition filter by @ultrahighsuper in #2558
• perf: memoize Family#balance_sheet + sync status lookups (sidebar renders every page) by @jjmata in #2553
• feat(up): map Up category slugs to Sure categories on import by @threatsurfer in #2487
• ci: skip Chrome install in unit test job by @sure-admin in #3125
• fix(i18n): remove duplicate locale keys and guard with a regression test by @rsnetworkinginc in #2789
• Track self-custody wallets natively: Bitcoin, EVM and Solana by @buzzromain in #3081
• feat: add safe admin user removal by @luckyPipewrench in #3131
• Improve async AI rule error reporting by @sure-admin in #2271
• fix(onchain-wallets): show linked wallets on the accounts page, and drop the tracking row on unlink by @buzzromain in #3136
• fix(enable-banking): use real merchant instead of POS terminal line for name by @gfr-free in #2968
• Add Sure client overview docs by @sure-admin in #2832
• fix(securities): give prefixed crypto tickers their logo back by @buzzromain in #3151
• Fix Mintlify docs workflow by @jjmata in #3156
• docs(api): sync openapi.yaml with merchants import and transfer fee fields by @WolfBrandon in #2961
• chore(goals): drop copy-pasted duplicates and an unused lock-key helper by @buzzromain in #3159
• Add live AI checks to system health by @jjmata in #3155
• fix(lunchflow): mark sync unhealthy when importer reports fetch failures (#1796) by @jeffrey701 in #1873
• Exclude pending transactions from balances by @atlas-maxjb in #2897
• perf: memoize Family#balance_sheet/investment_statement, cache transactions-index side queries by @gfr-free in #3058
• Fix budget cache invalidation after transaction deletion by @sure-admin in #2808
• Add experimental Swift-native Sure Insights app by @jjmata in #3134
• feat(snaptrade): add device-flow OAuth alongside the browser redirect by @jjmata in #3126
• feat(mcp): support Streamable HTTP transport (protocol 2025-06-18) by @secretsound in #2631
• Rename native Swift app to Sure Insights by @jjmata in #3172
• Allow API transaction create to opt into sync protection (user_modified) by @colinedwardwood in #3162
• fix(i18n): add missing Italian translations by @alessiocappa in #3170
• Fix AI health check for OpenAI-compatible endpoints by @sure-admin in #3184
• feat(budgets): carry a category's unspent budget into the next month by @buzzromain in #3143
• feat(budgets): move money between envelopes in one gesture by @buzzromain in #3164
• fix(trades): let the header call a trade what the importer recorded by @buzzromain in #3150
• fix(goals): stop two goals from each claiming the same account in full by @buzzromain in #3160
• fix(rules): validate Rule::Condition type registry + normalize legacy values by @Khaostica in #1908
• feat(goals): a reached goal lets go of the money it was holding by @buzzromain in #3165
• fix(lunchflow): keep balances current during rate limits by @tatoalo in #3129
• Warn before provider setup without encryption keys by @sure-admin in #3007
• Feature/category hierarchy and account search by @DataEnginr in #2845
• fix(desktop): support a server hosted under a sub-path by @nSimonFR-ai in #3127
• feat(goals): reserves you maintain, not goals you finish by @buzzromain in #3167
• fix(onchain): let the account take its wallet row with it by @buzzromain in #3182
• feat(goals): tell the user when a reserve has dropped below its level by @buzzromain in #3175
  promise/sure/pull/3185
• feat(goals): let a goal be spent without looking like it fell behind by @buzzromain in #3176
• fix(onchain-wallets): call transfers transfers, and drop the address swap by @buzzromain in #3153
• feat(goals): show what each account still has room to earmark by @buzzromain in #3166
• feat(goals): surface money that left a goal's accounts unexplained by @buzzromain in #3177
• feat(budgets): show what is actually free, beside the plan by @buzzromain in #3179
• feat(goals): a reserve measured in months of spending, not a fixed sum by @buzzromain in #3180
• docs: add Hostim.dev as a one-click hosting option by @pavel1337 in #2567
• feat: create merchant inline from transaction detail by @gfr-free in #3106
• Fix SimpleFIN balances-only liability signs by @marty0x in #3187
• Verify PDF support with a synthetic health probe by @jjmata in #3191
• Regenerate schema for Rails 8.1 by @jjmata in #3194
• Plaid: add accounts to an existing connection by @timkatz in #3199
• Fix flaky sign_out teardown in test suites by @winters27 in #3208
• Fix duplicate names before family name indexes by @sure-admin in #3211
• Fix(lunchflow): Missing template on validation failure in create action by @sentry[bot] in #2724
• fix(transactions): Resolve N+1 query in bulk update controller by @sentry[bot] in #3072
• bugfix: Fix category merge form submission by @DataEnginr in #3225
• fix(goals): stop a whole-account spend counting the same money twice by @buzzromain in #3219
• Fix demo refresh monitoring key reuse by @sure-admin in #3217
• Fix user-triggered Plaid transaction refresh by @timkatz in #3206
• fix(account): resolve N+1 query in cleanup_transfers by @sentry[bot] in #3066
• fix(sparklines): prevent crash when trend is nil for empty series by @sentry[bot] in #3171
• fix(security): prevent Security::Price uniqueness validation error by @sentry[bot] in #3120
• fix(goals): define RELEASED_STATES once by @buzzromain in #3232
• fix(goals): make the figure beside the ring agree with the ring by @buzzromain in #3213
• fix(goals): let a months-of-expenses reserve be created at all by @buzzromain in #3229
• fix(reports): a transfer out is not a sale by @buzzromain in #3192
• Remove native Swift app by @sure-admin in #3235
• feat(goals): call a reserve's amount what the rest of the app calls it by @buzzromain in #3230

New Contributors

• @gfr-free made their first contribution in #2828
• @Mart1M made their first contribution in #2719
• @mauriciopolvora made their first contribution in #2767
• @UnamedRus made their first contribution in #2839
• @WolfBrandon made their first contribution in #2948
• @bderenzi made their first contribution in #2988
• @Falloutman made their first contribution in #2986
• @packetsnscripts made their first contribution in #2998
• @vdusart made their first contribution in #2862
• @dakora-solutions made their first contribution in #2847
• @drink970082 made their first contribution in #2994
• @pedrosantospt made their first contribution in #2992
• @faldyif made their first contribution in #3000
• @d-degtyar made their first contribution in #2993
• @winters27 made their first contribution in #3016
• @markhaines made their first contribution in #3047
• @webprojectxeventos-sudo made their first contribution in #2669
• @globalreset made their first contribution in #3043
• @rottenit made their first contribution in #3088
• @Khaostica made their first contribution in #1906
• @rsnetworkinginc made their first contribution in #2789
• @secretsound made their first contribution in #2631
• @colinedwardwood made their first contribution in #3162
• @tatoalo made their first contribution in #3129
• @nSimonFR-ai made their first contribution in #3127
• @pavel1337 made their first contribution in #2567
• @timkatz made their first contribution in #3199

Full Changelog: v0.7.3...v0.7.4