v0.15: bug fixes, DRY/YAGNI audit, docs cleanup

.changelog/v0.11.17.md

@@ -1,6 +1,6 @@
 # Release v0.11.17 - Changelog
 
-Released: YYYY-MM-DD
+Released: 2026-02-07
 
 ## Overview
 

.changelog/v0.12.48.md

@@ -1,6 +1,6 @@
 # Release v0.12.48 - Changelog
 
-Released: YYYY-MM-DD
+Released: 2026-02-14
 
 ## Overview
 

.changelog/v0.13.20.md

@@ -1,6 +1,6 @@
 # Release v0.13.20 - Changelog
 
-Released: YYYY-MM-DD
+Released: 2026-02-17
 
 ## Overview
 

.changelog/v0.14.21.md

@@ -1,6 +1,6 @@
 # Release v0.14.21 - Changelog
 
-Released: YYYY-MM-DD
+Released: 2026-02-18
 
 ## Overview
 

.changelog/v0.15.x.md

@@ -0,0 +1,59 @@
+# Release v0.15.x - Changelog
+
+Released: YYYY-MM-DD
+
+## Overview
+
+Plan cleanup and documentation reorganization.
+
+## Fixes
+
+### CI: Release date placeholder not substituted
+- **Fixed `YYYY-MM-DD` never replaced** in release notes -- the `release.yml` workflow substituted version placeholders but not the date placeholder
+- **Added date substitution** to both the release body generation and the archived changelog file
+- **Backfilled 4 releases** (v0.11.17, v0.12.48, v0.13.20, v0.14.21) with correct dates
+
+### CI: Recurring changelog merge conflicts on every release
+- **Fixed cherry-pick divergence** in `release.yml` -- the workflow was archiving the changelog on `dev` then cherry-picking to `main`, creating parallel commit histories that caused merge conflicts on the next PR
+- **Changed to archive on `main` first**, then merge main into dev -- this creates a shared commit ancestor, eliminating the divergent histories
+
+### Hardening: Safe JSON parsing & output redaction
+- **Replaced raw `JSON.parse` with `readJSONFile`** in `apps.js`, `socialAccounts.js`, `scriptRunner.js` -- corrupted data files no longer crash the server
+- **Added null guard** on `data?.apps?.[id]` in `apps.js` to prevent undefined access
+- **Added `.catch()` handler** on fire-and-forget `cloneRepoInBackground()` in `brain.js` to prevent unhandled promise rejections
+- **Added sensitive output redaction** in `scriptRunner.js` -- env vars containing keys, tokens, passwords, and secrets are now `[REDACTED]` before persisting to `scripts-state.json`
+
+### Bugs Fixed
+- **Fixed index out of bounds** in `agents.js` Windows process parsing -- checked `parts.length >= 6` but accessed `parts[6]` (needs `>= 7`)
+- **Fixed non-unique React keys** in `UpcomingTasksWidget` -- `task.taskType` isn't unique, now uses compound keys
+- **Fixed missing optional chaining** in `agentTools.js` -- `commentsResponse.comments` would throw if null
+- **Fixed falsy value bug** in `apps.js` routes -- used `||` instead of `??` for PM2 process fallback
+- **Fixed unsafe `JSON.parse`** in `pm2.js` `listProcesses` -- now uses `safeJSONParse` with fallback
+- **Fixed silent error swallowing** in `cos.js` actionable insights -- `Promise.all` catches now log errors
+- **Fixed missing date validation** in `formatters.js` -- `formatTime()` now guards against null/invalid timestamps
+- **Fixed hardcoded localhost** in `vite.config.js` proxy -- now configurable via `VITE_API_HOST` env var
+- **Fixed dependency version mismatches** -- aligned Express, PM2, and portos-ai-toolkit between root and server `package.json`
+- **Removed forbidden `pm2:kill`** npm script that violated project rules
+
+### DRY Refactors
+- **Extracted `spawnPm2Cli` helper** in `pm2.js` -- eliminated 3x duplicated spawn+stderr+close blocks for stop/restart/delete
+- **Extracted `loadApp` middleware** in `apps.js` routes -- eliminated 11 repeated `getAppById` + null check patterns
+- **Used existing `extractJSONArray`/`safeJSONParse`** in `pm2.js` -- removed duplicated JSON extraction logic
+- **Created `useAutoRefetch` hook** -- consolidated identical fetch+interval `useEffect` pattern across 4 dashboard widgets
+- **Extracted `pickScheduleSettings`** in `cos.js` -- eliminated duplicated `if (X !== undefined)` settings pattern
+- **Removed duplicate `.pm2` entry** from `.gitignore`
+
+### YAGNI Cleanup
+- **Deleted 3 dead `.old.js` route files** -- `prompts.old.js`, `providers.old.js`, `runs.old.js`
+- **Removed unused `addAllowedCommand`/`removeAllowedCommand`** from `commands.js` -- never called from any route
+
+## Improvements
+
+### Plan & Documentation Cleanup
+- **Extracted M42 spec** to `docs/features/identity-system.md` -- removed ~600 lines from PLAN.md
+- **Extracted M40 summary** to `docs/features/agent-skills.md` -- completed milestone moved to feature docs
+- **Moved M40 to Completed** -- all 4 phases (skill templates, context compaction, negative routing, deterministic workflows) were done
+- **Removed pump.fun content** (M44) -- belongs in pump.funner repo, not PortOS
+- **Removed orphaned research docs** -- `pumpfun-data-sources.md` and `kalshibot-health-check-2026-02-17.md` were for other projects
+- **Added Scope Boundary rule** to CLAUDE.md -- CoS agents must write research/plans/docs for managed apps in those apps' repos, not PortOS
+- **Updated Next Actions** -- focused on M42 Identity System, M7 App Templates, M34 behavioral feedback

.changelog/v0.9.19.md

@@ -1,6 +1,6 @@
 # Release Notes - v0.9.19
 
-**Release Date:** YYYY-MM-DD
+**Release Date:** 2026-02-01
 
 ## 🎉 Features
 

.github/workflows/release.yml

@@ -60,7 +60,7 @@ jobs:
             # Use minor version pattern changelog (e.g., v0.10.x.md)
             CHANGELOG=$(cat "$CHANGELOG_FILE_PATTERN")
             # Replace version placeholder with actual version
-            CHANGELOG=$(echo "$CHANGELOG" | sed "s/v${MAJOR_MINOR}.x/v${VERSION}/g" | sed "s/${MAJOR_MINOR}.x/${VERSION}/g")
+            CHANGELOG=$(echo "$CHANGELOG" | sed "s/v${MAJOR_MINOR}.x/v${VERSION}/g" | sed "s/${MAJOR_MINOR}.x/${VERSION}/g" | sed "s/YYYY-MM-DD/$(date +%Y-%m-%d)/g")
           else
             # Fallback: Generate changelog from commits (exclude [skip ci] commits)
             PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || git rev-list --max-parents=0 HEAD)
@@ -113,37 +113,30 @@ jobs:
           NEW_MINOR=$((MINOR + 1))
           NEW_VERSION="$MAJOR.$NEW_MINOR.0"
 
-          # Checkout dev branch
-          git fetch origin dev
-          git checkout dev
-
-          # Rename and version the changelog file
+          # Archive changelog on main first (single source of truth)
+          # This avoids cherry-pick divergence that causes merge conflicts on the next PR
           PATTERN_FILE=".changelog/v${MAJOR_MINOR}.x.md"
           VERSIONED_FILE=".changelog/v${CURRENT_VERSION}.md"
 
           if [ -f "$PATTERN_FILE" ]; then
-            # Rename the file (preserves git history)
+            # Rename and version the changelog file on main
             git mv "$PATTERN_FILE" "$VERSIONED_FILE"
 
             # Replace version placeholders in the renamed file
-            sed -i.bak "s/v${MAJOR_MINOR}\.x/v${CURRENT_VERSION}/g; s/${MAJOR_MINOR}\.x/${CURRENT_VERSION}/g" "$VERSIONED_FILE"
+            sed -i.bak "s/v${MAJOR_MINOR}\.x/v${CURRENT_VERSION}/g; s/${MAJOR_MINOR}\.x/${CURRENT_VERSION}/g; s/YYYY-MM-DD/$(date +%Y-%m-%d)/g" "$VERSIONED_FILE"
             rm "${VERSIONED_FILE}.bak"
 
-            # Commit the renamed and updated changelog
             git add "$VERSIONED_FILE"
             git commit -m "docs: archive changelog for v${CURRENT_VERSION} [skip ci]"
-
-            # Capture the changelog commit hash before switching branches
-            CHANGELOG_COMMIT=$(git rev-parse HEAD)
-            git push origin dev
-
-            # Merge changelog back to main (without triggering CI)
-            git checkout main
-            git cherry-pick "$CHANGELOG_COMMIT"
             git push origin main
-            git checkout dev
           fi
 
+          # Checkout dev and merge main to share the changelog commit history
+          git fetch origin dev
+          git checkout dev
+          git fetch origin main
+          git merge origin/main -m "merge: incorporate v${CURRENT_VERSION} changelog archive [skip ci]"
+
           # Update package.json files for next version
           npm version $NEW_VERSION --no-git-tag-version
           cd client && npm version $NEW_VERSION --no-git-tag-version && cd ..

.gitignore

@@ -39,4 +39,3 @@ Thumbs.db
 
 # Browser service node_modules (code is committed)
 browser/node_modules/
-.pm2

CLAUDE.md

@@ -60,6 +60,10 @@ PortOS depends on `portos-ai-toolkit` as an npm module for AI provider managemen
 - The toolkit uses spread in `updateProvider()` so existing providers preserve custom fields, but `createProvider()` has an explicit field list
 - After updating the toolkit, run `npm update portos-ai-toolkit` in PortOS to pull changes
 
+## Scope Boundary
+
+When CoS agents or AI tools work on managed apps outside PortOS, all research, plans, docs, and code for those apps must be written to the target app's own repository/directory -- never to this repo. PortOS stores only its own features, plans, and documentation. If an agent generates a PLAN.md, research doc, or feature spec for another app, it goes in that app's directory.
+
 ## Code Conventions
 
 - **No try/catch** - errors bubble to centralized middleware
@@ -133,14 +137,12 @@ When you merge to `main`, the GitHub Actions workflow automatically:
 1. Reads `.changelog/v0.10.x.md`
 2. Replaces all instances of `0.10.x` with actual version (e.g., `0.10.5`)
 3. Creates the GitHub release with substituted changelog
-4. Checks out dev branch
-5. Renames `v0.10.x.md` → `v0.10.5.md` using `git mv` (preserves git history)
-6. Commits the renamed file to dev: `"docs: archive changelog for v0.10.5 [skip ci]"`
-7. Cherry-picks that commit to main
-8. Bumps dev to next minor version (e.g., 0.11.0)
+4. Archives the changelog on `main`: renames `v0.10.x.md` → `v0.10.5.md` using `git mv`
+5. Checks out dev branch and merges main into dev (shared commit history avoids future conflicts)
+6. Bumps dev to next minor version (e.g., 0.11.0)
 
 **Result:**
-- Both `dev` and `main` have `.changelog/v0.10.5.md` matching the tagged release
+- Both `dev` and `main` have `.changelog/v0.10.5.md` via shared commit ancestry
 - Git history shows: `v0.10.x.md` → `v0.10.5.md` (rename)
 - You create `.changelog/v0.11.x.md` to start the next development cycle