The Ledger

October 10, 2026

Juhandu v0.2.0

Added

  • Visible Juhandu can run in Docker with the included Dockerfile and compose.yaml. The container runs as an unprivileged user, keeps the database and secrets in a data volume, reports its health from /api/health, and publishes the port on 127.0.0.1 only. The image includes yt-dlp for reading video captions, and building with VIDEO_TOOLS=full adds ffmpeg as well.
  • VisibleUI The Connect screen sets up models and video reading, with a Test button for each. Chat and embedding endpoints, Cogitator, the Gemini key, and the speech and vision servers can be saved without a restart. Keys go to the secret store, and an environment variable still wins over a saved value. When the Gemini key fails its Test, the card says so until a later Test passes or a new key is saved.
  • VisibleUI A Getting started list on the Briefing and Reading screens tracks the first steps. It covers adding a feed, connecting a chat model, setting up video reading, and choosing where the briefing goes, and links each step to its screen. Once hidden, it comes back from a button at the top of the Connect screen.
  • VisibleUI Discord delivery can send the briefing as a direct message from a Discord bot. The Discord card on the Connect screen chooses between posting to a channel through a webhook and a direct message, which needs the bot’s token and your Discord user id. Both secrets can be saved, and only the chosen way’s secret is used.
  • VisibleUI Keyword and regular expression rules can search an item’s link as well as its title, text, and author. The rule editor has a link checkbox beside the other fields, so a regular expression on the link that matches youtube.com/shorts/ hides YouTube Shorts.

Changed

  • VisibleUI The reasons a way of reading videos is off name the fix in plain words. The Connect screen says when yt-dlp or ffmpeg is missing and how to add it, in Docker or on the host.
  • VisibleUI Small text on several screens is larger, and the light theme’s dim accent and the pressed toolbar buttons meet WCAG AA contrast.

Fixed

  • Visible A new release shows up on the first load, even behind a caching proxy. Script and stylesheet addresses carry a fingerprint of the app’s files, the page is checked with the server on every load, and the offline copy is rebuilt for each release.
  • VisibleSecurity The MCP endpoint no longer treats a request through a proxy as local. Without an access token, a request that carries a proxy header such as X-Forwarded-For or Cf-Connecting-Ip, or that is addressed to a name in JUHANDU_PUBLIC_HOST, is refused.
  • Visible A Gemini key that Google reports as invalid pauses Gemini for an hour, as a refused key already did. An invalid key used to be tried again on every video.
  • VisibleUI The AI assistants section describes what assistants can do with the switches as they are set. It used to say assistants could only read, even when changes were switched on.
  • VisibleAPI Paging the reading list with before (and the MCP tool’s before_id) now visits every item once. Pages used to repeat or skip items when published dates and item ids disagreed, as with a feed that backfills older posts. An id that does not exist now returns an empty page instead of the first page again.
  • VisibleSecurity OPML import no longer stores a login found inside a feed address in the clear. An address with a name and password before the host, or a query value such as token or key, is now added as a masked private link with the real address in the secret store, the same as adding one by hand. Without a secret store, those feeds are left out and the import result says how many.