v1.42.0

Release v1.42.0

Released: 2026-04-04

Added

• Submodules management page under Dev Tools — view status, check for updates, and update individual or all git submodules from the dashboard
• Update scripts (update.sh, update.ps1) now auto-update submodules (including slash-do) during PortOS updates
• CoS route test coverage — 170 new tests across 6 test files covering templates, learning, schedule, jobs, insights, and missing gaps in task/agent/report routes (83-100% route coverage, up from ~12%)
• Slash-do agent operations panel on app detail Overview tab — buttons for /do:push, /do:review, /do:release, /do:better, and /do:better-swift that queue CoS agent tasks with the full command instructions
• Multi-line task context now renders as a dedicated ### Task Context section in agent prompts instead of inline
• Enter key submits the task add form (Shift+Enter for newline)

Changed

• PM2 file watch restart delay set to 5 minutes to prevent rapid restarts during development
• Triggering agent operations (do:push, do:review, etc.) from the app overview page now navigates to the CoS agents page so the user can watch the agent run

Fixed

• Branch actions on mobile — delete/merge confirmations now wrap to a separate row instead of overlapping, added 40px touch targets to all buttons, header controls wrap gracefully, commit dates hidden on small screens
• Agent error handling in AgentsTab — API failures no longer trigger success toasts or state refreshes
• Resume agent modal now prevents double-submission with loading state and disabled button
• Slash-do quick actions (/do:push, /do:review, etc.) no longer run in a worktree — they now execute on the app's active branch where they have the correct context
• Feature-ideas prompt included "you are working in a git worktree on a feature branch" even when worktree was not configured — worktree context is now only injected by agentPromptBuilder when actually using a worktree
• app-improve- task IDs were getting task- prefix added by taskParser.js, causing updateTask lookups to fail — tasks were never marked in_progress or completed after agent runs
• Recovered app-improve- agents after server restart now correctly infer taskType: 'internal' instead of 'user'
• Extracted hasKnownPrefix() and isInternalTaskId() helpers to eliminate prefix check drift across 8 locations
• Screenshot and attachment uploads now clear after successful task form submission

Full Changelog

Full Diff: v1.41.2...v1.42.0

v1.41.2

Release v1.41.2

Released: 2026-04-04

Changed

• Status badges in ProcessesTab and StatusBadge now use muted translucent backgrounds (bg-color/15) with matching text colors instead of solid full-opacity fills, improving dark mode readability
• Extracted agentOptionButtonClass() helper to cos/constants.js for shared agent option toggle button styling; applied in ScheduleTab and AutomationTab
• Wrapped AppOverrideRow in memo to avoid unnecessary re-renders
• ScheduleTab agent option rows made fully tappable on mobile (44px touch targets, whole-row click area)
• Scheduler now synthesizes cron expression from scheduledTime + interval instead of post-hoc tolerance hack, eliminating drift-based day-skip bug

Fixed

• Scheduled jobs with scheduledTime could drift and skip a day after accumulating small timing errors — now cron is synthesized from scheduledTime at compute time for exact daily/weekday scheduling
• Per-app cron scheduled tasks (e.g. feature-ideas at 1am) could be delayed up to eligibleIn ms when the next check interval was too long — improvement check now caps at 1 hour so per-app schedules are always checked on time
• CoS agents that ran but made no code changes (worktree branch had no commits vs base) now silently clean up their worktree instead of leaving a stale branch and emitting a spurious warning
• Worktree merge/PR failures now auto-spawn a recovery task so stale branches don't accumulate in managed app repos
• Task edit form now closes after a successful save (shows error toast and stays open on API failure)

Full Changelog

Full Diff: v1.41.1...v1.41.2

v1.41.1

Release v1.41.1

Released: 2026-04-03

Added

• AI-powered narrative summaries for JIRA weekly status reports (tries each API provider until one succeeds)

Changed

• JIRA reports now filter to current user's tickets only via currentUser() JQL
• Status report UI simplified to personal weekly status format with copy-to-clipboard
• Ticket keys rendered as clickable JIRA links anywhere in report text

Changed

• Pin all npm dependencies to exact versions across all packages (no more ^ or ~ ranges) to prevent supply chain attacks
• Heavy-mode dependency audit — 15 packages flagged for removal, full replacement plan saved to PLAN.md
• Replace axios with owned server/lib/httpClient.js (fetch-based, AbortSignal.timeout, self-signed TLS via https.Agent)
• Replace multer with owned server/lib/multipart.js (streaming multipart parser, no memory buffering, safe for 500MB+ files)
• Replace unzipper with owned server/lib/zipStream.js (streaming ZIP parser via zlib.createInflateRaw, DEFLATE + stored entries)
• Remove cors package from scaffold-generated project templates; generated code now uses inline CORS middleware

Changed

• Replace node-telegram-bot-api with owned server/lib/telegramClient.js (fetch-based polling loop, all bot methods)
• Replace supertest with owned server/lib/testHelper.js (HTTP server lifecycle + fetch-based request wrapper; 9 test files updated)
• Replace react-hot-toast with owned client/src/components/ui/Toast.jsx (module-level store, Toaster component; 101 import sites updated)
• Replace react-markdown with inline regex block/inline parser in MarkdownOutput.jsx (h1–h6, bold, italic, code, tables, lists, links)
• Replace react-diff-viewer-continued with inline Myers LCS diff in CrossDomainTab.jsx; InlineDiff wrapped with React.memo
• Replace fflate direct usage with native DecompressionStream + inline EOCD ZIP parser in GenomeTab.jsx

Changed

• God file decomposition: split server/routes/cos.js (1,464 lines) into 9 focused sub-modules (cosStatusRoutes, cosTaskRoutes, cosAgentRoutes, cosReportRoutes, cosLearningRoutes, cosScheduleRoutes, cosJobRoutes, cosTemplateRoutes, cosInsightRoutes)
• God file decomposition: split server/routes/scaffold.js (1,667 lines) into 4 template generators (scaffoldVite, scaffoldExpress, scaffoldIOS, scaffoldPortOS)
• God file decomposition: split client/src/services/api.js (2,016 lines) into 27 domain sub-modules with barrel re-export; no consumer imports changed
• Block npm postinstall scripts by default via .npmrc ignore-scripts=true; install:all explicitly rebuilds trusted packages (esbuild, node-pty)
• Move Digital Twin work to backlog; promote god file decomposition to Next Up in PLAN.md
• God file decomposition: split server/services/digital-twin.js (2,970 lines) into 10 focused modules (digital-twin-constants, digital-twin-helpers, digital-twin-meta, digital-twin-documents, digital-twin-testing, digital-twin-enrichment, digital-twin-export, digital-twin-context, digital-twin-analysis, digital-twin-import, digital-twin-status); digital-twin.js is now a thin barrel re-export

Fixed

• Scheduled AI jobs (e.g. Daily Briefing) could get permanently stuck as "Due" if agent spawn failed — task:ready handler now catches errors and emits job:spawn-failed to re-register the timer; 5-minute spawning timeout also re-registers as safety net
• Bug: providerOverride was incorrectly passed as model argument in processEnrichmentAnswer; corrected to modelOverride
• Dynamic import() of safeJSONParse inside analyzeEnrichmentList replaced with static top-level import
• loadMeta() was called inside per-document loop in analyzeAssessment; hoisted out to load once

Changed

• getDocuments() now parallelizes all stat() calls with Promise.all
• getAllTwinContent() now parallelizes all readFile() calls with Promise.all
• Added extractJSON() and ensureDocumentInMeta() helpers to digital-twin-helpers.js; three duplicate document-push blocks in enrichment module replaced with helper calls

Changed

• God file decomposition: split server/services/subAgentSpawner.js (3,820 lines) into 9 focused modules (agentState, agentModelSelection, agentRunTracking, agentErrorAnalysis, agentCompletion, agentPromptBuilder, agentCliSpawning, agentLifecycle, agentManagement); main file is now a 187-line orchestrator with re-exports for backward compatibility
• isTruthyMeta/isFalsyMeta consolidated into agentState.js (single source of truth)
• terminateAgent/killAgent runner path de-duplicated via shared terminateRunnerAgent helper
• killAllAgents now terminates all agents in parallel with Promise.all
• buildAgentPrompt context fetches (memory, CLAUDE.md, digital twin, tools) and .planning/ file reads now run in parallel
• safeParse in agentCliSpawning.js replaced with safeJSONParse from fileUtils
• Removed TOCTOU existsSync guards in agentPromptBuilder.js; rely on .catch(() => null) instead

Fixed

• Auto-update from the UI was failing at git fetch step — switched from portos-update.sh (tag checkout) to update.sh (git pull --rebase) which adds STEP markers for UI progress, completion markers for boot-time result recording, and Windows support via update.ps1
• Scheduled AI jobs (e.g. Daily Briefing) could get permanently stuck as "Due" if agent spawn failed — task:ready handler now catches errors and emits job:spawn-failed to re-register the timer
• httpClient.js now rejects hanging promise when signal is pre-aborted; toast shown on task add failure
• JIRA report provider discovery now tries all available API providers instead of failing on first unreachable one
• agentCliSpawning.js imported completeExecution/errorExecution from executionLanes.js (wrong module); corrected to import from toolStateMachine.js, fixing server crash on startup
• OpenClaw stream route now calls res.flushHeaders() before proxying SSE so headers reach the client immediately
• OpenClaw stream reader loop wrapped in try/catch to handle AbortError on client disconnect without unhandled rejection
• Orphaned htmlFor="compact-task-app" sr-only label in TaskAddForm compact mode removed (referenced select id that no longer exists after AppContextPicker refactor)
• XSS: MarkdownOutput.jsx links now validate href protocol (allow http://, https://, / only); unsafe URIs render as plain text
• Toast notifications missing background color — added bg-port-card with border
• InlineDiff word diff used Set which collapsed duplicate common words; replaced with sequential LCS pointer matching
• httpClient.js now auto-sets Content-Type: application/json when sending JSON body
• zipStream.js sanitizes ZIP entry paths (normalizes separators, strips .. and . components)
• multipart.js sanitizes file extension to alphanumeric characters only

Added

• AppContextPicker component — reusable app selector with repo path display; replaces inline <select> in TaskAddForm (compact and full modes)
• OpenClaw operator chat: SSE streaming with optimistic UI (user + streaming assistant placeholder appear immediately)
• OpenClaw: file/image attachment support — drag & drop, paste screenshots, file picker
• OpenClaw: app context, directory context, and extra instructions fields sent with messages
• OpenClaw: Stop/Cancel button aborts in-flight stream via AbortController
• OpenClaw: Cmd/Ctrl+Enter keyboard shortcut submits the composer
• OpenClaw: auto-scroll to latest message during streaming
• OpenClaw: collapsible "older chats" section for sessions beyond the top 6 non-empty ones
• OpenClaw: synthetic default session injected when defaultSession config key has no matching session
• formatDateTime added to client/src/utils/formatters.js (medium date + short time via Intl.DateTimeFormat)
• readFileAsBase64 exported from client/src/utils/fileUpload.js for reuse across components

Changed

• OpenClaw integration rewritten to use OpenResponses /v1/responses API and /tools/invoke for session discovery
• normalizeAttachment builds OpenAI-compatible input_image/input_file blocks from base64 or URL sources
• streamSessionMessage proxies upstream SSE with timeoutMs: 0 for long-running streaming responses
• fetchWithTimeout accepts timeoutMs: 0 to opt out of the timeout (needed for streaming)
• loadRuntime stabilized via selectedSessionIdRef — session switches no longer trigger a full runtime reload
• After send, session lastMessageAt updated locally instead of triggering a full loadRuntime() reload
• context state in OpenClaw simplified — removed derived appName/repoPath; computed at send time
• Duplicate setMessages update pattern in handleSend extracted into updateAssistant(updater) helper

Full Changelog

Full Diff: v1.41.0...v1.41.1

v1.41.0

Release v1.41.0

Released: 2026-04-02

Full Changelog

Full Diff: v1.40.0...v1.41.0

Added

• AI-powered narrative summaries for JIRA weekly status reports (tries each API provider until one succeeds)

Changed

• JIRA reports now filter to current user's tickets only via currentUser() JQL
• Status report UI simplified to personal weekly status format with copy-to-clipboard
• Ticket keys rendered as clickable JIRA links anywhere in report text

Changed

• Pin all npm dependencies to exact versions across all packages (no more ^ or ~ ranges) to prevent supply chain attacks
• Heavy-mode dependency audit — 15 packages flagged for removal, full replacement plan saved to PLAN.md
• Replace axios with owned server/lib/httpClient.js (fetch-based, AbortSignal.timeout, self-signed TLS via https.Agent)
• Replace multer with owned server/lib/multipart.js (streaming multipart parser, no memory buffering, safe for 500MB+ files)
• Replace unzipper with owned server/lib/zipStream.js (streaming ZIP parser via zlib.createInflateRaw, DEFLATE + stored entries)
• Remove cors package from scaffold-generated project templates; generated code now uses inline CORS middleware

Changed

• Replace node-telegram-bot-api with owned server/lib/telegramClient.js (fetch-based polling loop, all bot methods)
• Replace supertest with owned server/lib/testHelper.js (HTTP server lifecycle + fetch-based request wrapper; 9 test files updated)
• Replace react-hot-toast with owned client/src/components/ui/Toast.jsx (module-level store, Toaster component; 101 import sites updated)
• Replace react-markdown with inline regex block/inline parser in MarkdownOutput.jsx (h1–h6, bold, italic, code, tables, lists, links)
• Replace react-diff-viewer-continued with inline Myers LCS diff in CrossDomainTab.jsx; InlineDiff wrapped with React.memo
• Replace fflate direct usage with native DecompressionStream + inline EOCD ZIP parser in GenomeTab.jsx

Changed

• God file decomposition: split server/routes/cos.js (1,464 lines) into 9 focused sub-modules (cosStatusRoutes, cosTaskRoutes, cosAgentRoutes, cosReportRoutes, cosLearningRoutes, cosScheduleRoutes, cosJobRoutes, cosTemplateRoutes, cosInsightRoutes)
• God file decomposition: split server/routes/scaffold.js (1,667 lines) into 4 template generators (scaffoldVite, scaffoldExpress, scaffoldIOS, scaffoldPortOS)
• God file decomposition: split client/src/services/api.js (2,016 lines) into 27 domain sub-modules with barrel re-export; no consumer imports changed
• Block npm postinstall scripts by default via .npmrc ignore-scripts=true; install:all explicitly rebuilds trusted packages (esbuild, node-pty)
• Move Digital Twin work to backlog; promote god file decomposition to Next Up in PLAN.md
• God file decomposition: split server/services/digital-twin.js (2,970 lines) into 10 focused modules (digital-twin-constants, digital-twin-helpers, digital-twin-meta, digital-twin-documents, digital-twin-testing, digital-twin-enrichment, digital-twin-export, digital-twin-context, digital-twin-analysis, digital-twin-import, digital-twin-status); digital-twin.js is now a thin barrel re-export

Fixed

• Bug: providerOverride was incorrectly passed as model argument in processEnrichmentAnswer; corrected to modelOverride
• Dynamic import() of safeJSONParse inside analyzeEnrichmentList replaced with static top-level import
• loadMeta() was called inside per-document loop in analyzeAssessment; hoisted out to load once

Changed

• getDocuments() now parallelizes all stat() calls with Promise.all
• getAllTwinContent() now parallelizes all readFile() calls with Promise.all
• Added extractJSON() and ensureDocumentInMeta() helpers to digital-twin-helpers.js; three duplicate document-push blocks in enrichment module replaced with helper calls

Changed

• God file decomposition: split server/services/subAgentSpawner.js (3,820 lines) into 9 focused modules (agentState, agentModelSelection, agentRunTracking, agentErrorAnalysis, agentCompletion, agentPromptBuilder, agentCliSpawning, agentLifecycle, agentManagement); main file is now a 187-line orchestrator with re-exports for backward compatibility
• isTruthyMeta/isFalsyMeta consolidated into agentState.js (single source of truth)
• terminateAgent/killAgent runner path de-duplicated via shared terminateRunnerAgent helper
• killAllAgents now terminates all agents in parallel with Promise.all
• buildAgentPrompt context fetches (memory, CLAUDE.md, digital twin, tools) and .planning/ file reads now run in parallel
• safeParse in agentCliSpawning.js replaced with safeJSONParse from fileUtils
• Removed TOCTOU existsSync guards in agentPromptBuilder.js; rely on .catch(() => null) instead

Fixed

• JIRA report provider discovery now tries all available API providers instead of failing on first unreachable one
• agentCliSpawning.js imported completeExecution/errorExecution from executionLanes.js (wrong module); corrected to import from toolStateMachine.js, fixing server crash on startup
• OpenClaw stream route now calls res.flushHeaders() before proxying SSE so headers reach the client immediately
• OpenClaw stream reader loop wrapped in try/catch to handle AbortError on client disconnect without unhandled rejection
• Orphaned htmlFor="compact-task-app" sr-only label in TaskAddForm compact mode removed (referenced select id that no longer exists after AppContextPicker refactor)
• XSS: MarkdownOutput.jsx links now validate href protocol (allow http://, https://, / only); unsafe URIs render as plain text
• Toast notifications missing background color — added bg-port-card with border
• InlineDiff word diff used Set which collapsed duplicate common words; replaced with sequential LCS pointer matching
• httpClient.js now auto-sets Content-Type: application/json when sending JSON body
• zipStream.js sanitizes ZIP entry paths (normalizes separators, strips .. and . components)
• multipart.js sanitizes file extension to alphanumeric characters only

Added

• AppContextPicker component — reusable app selector with repo path display; replaces inline <select> in TaskAddForm (compact and full modes)
• OpenClaw operator chat: SSE streaming with optimistic UI (user + streaming assistant placeholder appear immediately)
• OpenClaw: file/image attachment support — drag & drop, paste screenshots, file picker
• OpenClaw: app context, directory context, and extra instructions fields sent with messages
• OpenClaw: Stop/Cancel button aborts in-flight stream via AbortController
• OpenClaw: Cmd/Ctrl+Enter keyboard shortcut submits the composer
• OpenClaw: auto-scroll to latest message during streaming
• OpenClaw: collapsible "older chats" section for sessions beyond the top 6 non-empty ones
• OpenClaw: synthetic default session injected when defaultSession config key has no matching session
• formatDateTime added to client/src/utils/formatters.js (medium date + short time via Intl.DateTimeFormat)
• readFileAsBase64 exported from client/src/utils/fileUpload.js for reuse across components

Changed

• OpenClaw integration rewritten to use OpenResponses /v1/responses API and /tools/invoke for session discovery
• normalizeAttachment builds OpenAI-compatible input_image/input_file blocks from base64 or URL sources
• streamSessionMessage proxies upstream SSE with timeoutMs: 0 for long-running streaming responses
• fetchWithTimeout accepts timeoutMs: 0 to opt out of the timeout (needed for streaming)
• loadRuntime stabilized via selectedSessionIdRef — session switches no longer trigger a full runtime reload
• After send, session lastMessageAt updated locally instead of triggering a full loadRuntime() reload
• context state in OpenClaw simplified — removed derived appName/repoPath; computed at send time
• Duplicate setMessages update pattern in handleSend extracted into updateAssistant(updater) helper

v1.40.0

Release v1.40.0

Released: 2026-03-29

Fixed

• Scheduled tasks defaulting to enabled for existing apps when new task types are added — isTaskTypeEnabledForApp now defaults to disabled (opt-in) instead of enabled (opt-out)
• Autonomous job scheduler using UTC instead of local timezone for scheduled times — daily briefing at 4:30 AM local was firing at 4:30 AM UTC. Now uses nextLocalTime() to compute exact UTC target from local scheduled time
• Codex agent output flooding UI with full prompt/config dump from stderr — filtered to only show tool execution lines and errors
• On-demand tasks silently dropped when pipeline preconditions fail (e.g., REVIEW.md already exists) — on-demand tasks now skip precondition checks since the user explicitly requested them
• Pipeline stage 2+ tasks stuck in queue forever — follow-up tasks were missing id and status: 'pending' fields when created with raw: true, making them invisible to the task evaluator
• Pipeline tasks not marked completed after agent finishes — app-improve-* task IDs were misidentified as user tasks (expected sys- prefix), causing updateTask to look in the wrong file
• Pipeline stage 2 tasks blocked by app cooldown — pipeline continuations now bypass the 30-minute app review cooldown
• Pipeline artifacts (e.g., REVIEW.md) not cleaned up after final stage — automated cleanup now deletes fileNotExists precondition files when pipeline completes
• Self-update failing with "exit code null" at npm-install step — PM2 watch restarted the server during git checkout (which changes server/ files), breaking the stdout pipe to the update script. SIGPIPE killed the script before || true could handle it, leaving the update incomplete. Added trap '' PIPE to ignore SIGPIPE so the script runs to completion.
• Improved update error messages to show signal name (e.g., "killed by SIGPIPE") instead of opaque "exit code null"
• Setup falsely reporting "Setup Complete!" when native PostgreSQL is selected but not installed — now auto-runs db.sh setup-native to install and configure PostgreSQL via Homebrew, and exits with error if setup fails instead of silently continuing

Added

• Toggle to enable/disable all automations for an app on the Automation tab
• "Process Now" button on pending task cards to force-spawn a specific task, bypassing cooldowns and evaluation intervals

Full Changelog

Full Diff: v1.39.0...v1.40.0

v1.39.0

Release v1.39.0

Released: 2026-03-28

Added

• AI usage spike detection in proactive alerts — detects when daily token or session counts exceed 2.5x the 14-day rolling average
• PR reviewer now scans for malicious content (prompt injection, data exfiltration, supply chain attacks) and verifies GOALS.md alignment before approving
• PR reviewer verifies CI/CD passes and auto-merges clean PRs with squash + branch cleanup
• Global Pause toggle with info tooltip on task schedule UI — replaces ambiguous "Enabled" toggle
• Shared loadSlashdoFile utility in fileUtils.js for loading slashdo commands with !cat include resolution
• Multi-stage task pipeline system — chain sequential agent stages where each stage gates the next
• PR reviewer now runs as a 2-stage pipeline: security scan (read-only) → code review + merge
• Pipeline stage badge on agent cards showing current stage progress
• getStagePrompt() export in taskSchedule for resolving pipeline stage-specific prompts
• Pipeline UI: collapsed row shows purple "2-stage" badge, expanded view shows stage flow visualization
• Pipeline UI: tabbed prompt viewer shows each stage's full prompt with stage name tabs
• Code reviewer pipeline tasks (code-reviewer-a, code-reviewer-b) — 2-stage pipeline where stage 1 reviews the codebase and writes REVIEW.md, stage 2 triages and implements recommendations
• Per-stage provider/model support for multi-stage pipelines — each stage can use a different AI provider (e.g., Gemini reviews, Claude Opus implements)
• REVIEW.md and REJECTED.md added to allowed app documents
• MortalLoom export now includes goals, reads actual custom drink/nicotine presets, and parallelizes all I/O
• MeatSpace Settings tab with import/export functionality
• Browser download support via CDP Browser.setDownloadBehavior — downloads now land in data/browser-downloads/
• Downloads section on Browser page showing file list with size and date
• /api/browser/downloads endpoint for listing downloaded files
• Genome markers: summary dashboard with tappable status filter pills, "Attention Needed" section surfacing concerns first, category quick-jump dropdown, categories collapsed by default for mobile
• Genome markers: friendlier card UX with "What this means for you" framing, status-colored backgrounds, and renamed labels (Details, Your Notes, Learn More)
• Voice capture for Brain — microphone button on inbox uses Web Speech API to transcribe speech into thoughts
• Legacy Portrait export format — comprehensive human-readable Markdown document consolidating identity docs, traits, chronotype, taste profile, genome, longevity, goals, autobiography, and social presence
• Autobiography prompt chains — LLM-generated follow-up questions after saving a story, enabling deeper exploration of life themes with linked story chains
• RSS/Atom feed ingestion — subscribe to feeds, fetch/parse articles, read/mark-read from Brain > Feeds tab
• AI-powered goal check-ins — "Run Check-In" button on goal detail panel generates LLM assessment of goal health (on-track/behind/at-risk), actionable recommendations, and motivational encouragement based on progress, velocity, milestones, and activity attendance
• Chronotype-aware scheduling — Calendar Day and Week views now show genome-derived energy zone overlays (peak focus, exercise, wind-down) and cutoff markers (caffeine, last meal) based on the user's chronotype profile
• Pipeline agent cards: stage-tabbed output view — Show button displays separate output panes for each pipeline stage with status indicators and on-demand loading
• Agent cleanup warnings now surface in the UI — worktree merge failures, PR creation failures, and preserved worktrees show as yellow warnings in the agent card, completion toast, and notification bell

Changed

• MeatSpace Import tab renamed to Settings — consolidates import and export in one place
• Pipeline stages now display per-stage provider/model in Schedule tab UI
• Fixed metadata.provider field mapping so scheduled task provider overrides are correctly passed to the agent spawner
• PR reviewer prompt no longer requires global slash-do install — review checklist is inlined from bundled submodule
• Removed duplicate pr-reviewer skill template from data.sample (single source of truth in taskSchedule.js)

Fixed

• CoS orphan detection now checks if the agent completed successfully before treating a task as orphaned — prevents false orphan loops after server restarts
• handleAgentCompletion now logs when updateTask returns an error, making silent task update failures visible in server logs
• Digital twin sync now uses deep union merge for longevity/chronotype files, preserving genomic marker data across instances
• Character avatar image now synced between instances alongside character metadata
• Snapshot sync status no longer shows false "behind" when remote doesn't report checksums
• Agent worktree branches now cleaned up even when worktree directory is already gone (fixes lingering branches after server restarts)
• Instance names like "null", "void", "NaN", "undefined" are now accepted as valid hostnames
• Peer renames no longer revert when remote peer re-announces (handleAnnounce now preserves user-set names)
• Self instance card now shows sync status for all categories (Goals, Character, Digital Twin, Meatspace), not just Brain and Memory
• CoS task evaluation now blocks tasks that exceeded max spawn limit before reaching spawn logic
• Metadata count fields (totalSpawnCount, failureCount, orphanRetryCount) use Number() coercion to prevent string comparison bugs
• jira-status-report task now runs in PortOS context (not the app's directory) and uses the correct PortOS API endpoint
• jira-status-report agents no longer attempt to commit, push, or modify files (readOnly metadata flag)
• readOnly tasks skip unnecessary git pull, JIRA branch creation, and worktree setup
• Flaky test suite stabilized by increasing vitest timeout from 5s to 10s (parallel execution pressure caused intermittent timeouts)
• Added PORTOS_API_URL constant to ports.js for dynamic API URL resolution in task prompts
• Worktree merge failures now abort cleanly (merge --abort) instead of leaving the repo in MERGING state
• Failed merges now preserve the branch for manual recovery instead of force-deleting it and orphaning commits
• Orphaned worktree cleanup now attempts to merge committed work before removing (prevents losing PR/push failure preserved work)
• External-repo worktrees (managed app agents) now cleaned up properly — previously invisible to git worktree list and accumulated on disk
• Stash pop after rebase abort now handles conflicts consistently (checkout + drop) instead of leaving stale stashes

Removed

Full Changelog

Full Diff: v1.38.0...v1.39.0

v1.38.0

Release v1.38.0

Released: 2026-03-25

Added

• Time Capsule Snapshots for Digital Twin — create versioned archives of your complete digital twin (documents, traits, goals, genome, autobiography, test history) to track identity evolution over time. Includes create, view, compare, and delete functionality with a dedicated tab at /digital-twin/time-capsule
• Granular per-peer data sync categories for PortOS Federation — enable/disable sync independently for Brain, Memory, Goals, Character, Digital Twin, and Meatspace data per peer instance. All categories disabled by default. Expandable sync categories panel on each peer card with enable/disable all controls. Snapshot-based sync with entity-level merge using last-writer-wins conflict resolution — never loses data from either side
• Proactive alerts system with dashboard widget for system health monitoring
• Bulk cleanup of merged git branches
• Slashdo bundled as git submodule for reliable command access
• CoS agents generate rich PR descriptions from branch commits and diff stats

Changed

• Goals page: replace "Add Root Goal" button with inline quick-add input for faster goal creation
• Goals page: remove manual refresh button, use Loader2 spinner for loading state
• Goals page: mobile responsive redesign with drag-and-drop reparenting
• Goals page: add provider/model selector to organize button, default to list view
• CoS panel fully collapsible with 0px width when closed

Fixed

• Toggle switches rendering oversized due to min-h/min-w 44px touch-target constraints inflating the visual element
• Brain scheduler CLI error messages now include actual CLI output for diagnosability
• Brain CLI provider stdin warning by closing stdin on spawn
• Brain default model/provider in data.sample for new users
• CoS spurious orphan retries from agent completion race
• Goals nav link points to list view, expand all goals by default
• Schedule badge styling with consistent pill design
• Sidebar theme and ambient buttons hidden when collapsed

Full Changelog

Full Diff: v1.37.0...v1.38.0

v1.37.0

Release v1.37.0

Released: 2026-03-24

Added

• Image Generation Settings — New Settings > Image Gen tab for configuring Stable Diffusion API (AUTOMATIC1111 / Forge WebUI). Auto-detects Flux models and adjusts parameters accordingly.
• CoS Tools Registry — New onboard tools system (data/tools/) that lets CoS agents discover and use instance-specific capabilities like image generation. Tools are exposed in agent prompts via getToolsSummaryForPrompt().
• Character Avatar Generation — D&D Character Sheet now supports AI-generated avatars via the configured SD API. Hover over the avatar area to generate a new portrait.
• Image serving — Generated images stored in data/images/ and served via /data/images/ static route.
• Diffusion progress streaming — Image generation now streams intermediate diffusion steps via Socket.IO. The character avatar shows a live preview of the image forming, a progress bar, and step counter during generation.

Fixed

• Avatar images broken in dev mode — Added /data proxy to Vite dev config so generated images load correctly when running npm run dev.

Full Changelog

Full Diff: v1.36.0...v1.37.0

v1.36.0

Release v1.36.0

Released: 2026-03-24

Fixed

• New instances no longer trigger LLM calls on startup — seed drill cache in data.sample and skip brain digest/review when no data exists
• Job scheduling now uses user's configured timezone instead of UTC — daily briefing and all scheduled jobs fire at the correct local time
• Briefing notification date uses user timezone instead of UTC date
• Throttle LLM drill cache startup: serialize type replenishment and add 2s delay between LLM calls to prevent API spam on server restart
• Throttle JIRA sync: add 500ms delay between project ticket fetches to prevent 429 rate limit errors

Added

• Character Sheet page: D&D-style character tracking with XP, HP, leveling, dice-based damage, short/long rests, custom event logging, and JIRA/CoS task sync for XP
• Timezone setting in Settings > General — auto-detects from browser, configurable per user
• Cron expression support across all scheduling systems — full 5-field crontab syntax (minute hour dayOfMonth month dayOfWeek)
• Cron support in System Tasks (Jobs), per-app Task Type Overrides, and global CoS Schedule
• Shared CronInput component with presets dropdown and human-readable descriptions
• Schedule mode toggle (Interval vs Cron) in job create/edit forms
• Timezone-aware cron matching in event scheduler and task schedule evaluator
• Shared cron utilities (cronHelpers.js) — DRY across all scheduling UIs
• Timezone utility module with cached Intl.DateTimeFormat and comprehensive test coverage

Changed

• Task Type Overrides switched from table to card layout for mobile responsiveness
• Task type subtitle shows effective schedule (cron/override) instead of always showing global type

Full Changelog

Full Diff: v1.35.0...v1.36.0

v1.35.0

Release v1.35.0

Released: 2026-03-24

Added

• Claude Code changelog tracking: fetches GitHub Atom feed for new releases, caches with 1-hour TTL, surfaces new versions in daily briefing
• POST wordplay drill cache: pre-generates challenges on startup so drills load instantly from cache with background replenishment
• POST local scoring for deterministic drill types (bridge-word, compound-chain, verbal-fluency, story-recall) — instant results without LLM calls
• POST loading indicator with elapsed timer, progress bar, and cycling status messages replaces static spinner
• POST drill tutorial hints: compound chain shows example compounds, bridge word explains the goal, double-meaning and idiom-twist show example answers
• Ambient Dashboard Mode: fullscreen live status board at /ambient for wall-mounted displays — shows real-time clock, death clock countdown, today's calendar events, goal progress, and agent activity with auto-refresh, auto-hiding controls, and fullscreen toggle
• Agent options (Worktree+PR, /simplify, Review Loop) configurable per-app on both the Automation tab and CoS Schedule per-app overrides
• Review Loop agent option: runs PR review feedback loop after opening a PR until checks pass
• Nicotine tracking tab in MeatSpace with consumption logging, daily totals, rolling averages, custom product quick-add buttons, inline editing, and entry history
• Nicotine chart (7d/30d/90d bar chart) and nicotine vs heart rate correlation visualization
• Nicotine data integrated into health correlation endpoint (HR, resting HR alongside nicotine mg)
• Server-side nicotine service with daily log persistence, custom product management, and caching
• Date editing on alcohol and nicotine history entries (move items between dates)
• Nicotine sub-nav link in MeatSpace sidebar
• Telegram MCP Bridge mode: uses Claude Code's Telegram plugin for outbound notifications via direct Bot API HTTP calls, with inbound messages handled by Claude Code's natural language processing instead of rigid bot commands
• Settings toggle to switch between Manual Bot and Claude MCP Bridge integration methods
• Interactive storage backend chooser during setup: Docker PostgreSQL, Native PostgreSQL, or file-based JSON (deprecated) when Docker is unavailable
• Personal Goals dashboard widget: shows top-level goals with progress bars, category icons, horizon labels, and stall detection (14+ days idle) — replaces broken CoS task-based goal widget that never rendered

Changed

• Review Hub compacted: metrics cards → inline pills, empty action queue hidden instead of showing empty state, quick-add simplified to inline input, daily briefing moves up to be visible without scrolling
• Sidebar navigation reorganized: Review Hub promoted to top section, standalone items (Feature Agents, Loops, Shell, Instances, Security, Uploads) consolidated into parent groups (Dev Tools, Chief of Staff, Settings), AI Config dissolved into Settings, Ambient moved to footer icon button
• Release-check scheduled task now discovers the project's release process from CLAUDE.md, README.md, CONTRIBUTING.md, docs/, CI workflows, and changelog docs instead of hardcoding dev→main
• Exported cleanupAgentWorktree from subAgentSpawner.js with dedicated test file covering the openPR completion path (push, PR creation, failure preservation, auto-merge fallback)
• Exported isTruthyMeta from subAgentSpawner.js and applyAppWorktreeDefault from cos.js; tests now import production helpers instead of duplicating their logic inline
• Consolidated 5 duplicate timeAgo/formatTimeAgo implementations into a single timeAgo() in utils/formatters.js
• Deduplicated stripCodeFences from insightsService — now imports from shared lib/aiProvider.js
• Added MINUTE time constant to lib/fileUtils.js alongside existing HOUR/DAY
• Quick-add buttons for alcohol and nicotine now combine duplicate entries on the same date by incrementing count instead of stacking separate rows
• Extracted shared dayOfWeek utility and DAY_LABELS constant to meatspace constants (deduplicated from AlcoholTab)
• Health correlation endpoint now includes heart rate, resting heart rate, and nicotine data alongside existing HRV/alcohol/steps
• NicotineHealthCorrelation tooltip uses Tailwind classes instead of inline styles for consistency
• Extracted recalcAlcoholTotal() helper and reuse across logDrink, updateDrink, removeDrink
• AlcoholTab correlation date range wrapped in useMemo to prevent unnecessary API refetches
• Nicotine mg/unit form field uses placeholder instead of default value
• Nicotine page redesigned: compact stat bar, merged quick-add/custom entry card, collapsible custom form, table-based history, side-by-side charts
• Alcohol page summary compressed into a single compact stat bar row to maximize above-the-fold content

Fixed

• Notifications crash on missing metadata: added optional chaining in removeByMetadata() and exists()
• Telegram memory approve/reject: wrapped in try/catch to prevent unhandled errors, clears inline keyboard buttons after action
• ETA duration estimates skewed by failed agents: track success-only durations separately, add recalculate-durations endpoint for retroactive rebuild from agent archive
• CoS orphan retry over-spawning: resetOrphanedTasks() was bypassing retry limits by blindly resetting in_progress tasks to pending — now routes through handleOrphanedTask() for consistent spawn counting, cooldown, and max-retry enforcement
• CoS scheduled improvement tasks (feature-ideas, etc.) never spawning: event listener mismatch (tasks:user:added/tasks:cos:added vs actual tasks:changed event), missing dequeue trigger after improvement check timer, and no improvement queuing after daemon restart until timer fires
• App icons in CoS schedule per-app override list rendering at natural image size instead of respecting the size prop
• Calendar day view current-time red line now updates every 60 seconds instead of only on page load
• Stokes Pick default nicotine amount corrected from 3mg to 5mg
• UTC timezone shift showing tomorrow's date in alcohol/nicotine forms — replaced toISOString() with local localDateStr() utility
• Server-side rolling averages and summary use local dates instead of UTC — fixes today showing 0mg despite logged entries
• Chart date range comparison uses local date strings instead of UTC Date objects — fixes today/yesterday missing from 7-day chart
• Empty entry objects no longer accumulate in daily-log.json after moving the last item from a date
• README screenshot labels corrected to match actual screenshot content (all 6 were mislabeled)
• Agent commit detection disconnected from task status: handleAgentCompletion now checks for task commits before treating killed/crashed agents as failures, preventing false startup-failure classifications when work was actually committed
• Orphaned agent handler now checks for task commits before retrying, completing the task instead of endlessly re-spawning when work is already done
• Zod .default(false) on archived, defaultUseWorktree, and defaultOpenPR in appSchema caused appUpdateSchema.partial() to inject false for omitted fields, silently overwriting stored true values during partial updates

Removed

• Dead code: euclideanDistance, averageVectors, similarityMatrix from vectorMath.js (unused outside tests)
• Dead code: rootPath from fileUtils.js, getClient from db.js (never imported)

Full Changelog

Full Diff: v1.34.0...v1.35.0