# Release v1.1.x - Changelog

Released: Unreleased

## Overview

Configurable embedding provider for the memory system, plus HealthTab layout improvements.

## Features

### PortOS baseline app always present
- On fresh installs (or empty `data/apps.json`), PortOS is auto-seeded as a managed app with stable ID `portos-default`
- PortOS cannot be deleted or archived — server returns 403, UI hides delete/archive buttons
- Ensures dashboard and app list always show at least PortOS

### Configurable embedding provider/model
- Memory embedding system now reads provider from CoS config instead of hardcoding `lmstudio`
- When embedding service is unavailable, MemoryTab shows inline provider/model selector with "Save & Retry"
- ConfigTab has a new "Memory Embeddings" section for permanent provider/model selection
- Server reinitializes embedding config automatically when provider or model changes

## Fixes

### Code review remediation (30 files)
- Replace bare `JSON.parse` with `safeJSONParse` across 8 server files and client `Security.jsx`
- Fix broken app lookup in `git.js` routes — use `appsService.getAppById()` instead of `req.app.get('apps')`
- Wrap async handlers in `scripts.js` and `media.js` with `asyncHandler`
- Remove scaffold double-mount in `index.js`; update client API paths to `/scaffold/templates`
- Add `deviceId` regex validation in `mediaService.js` to prevent injection
- Replace `exec` with `execFile` in `autofixer/server.js` and `cos.js` for shell safety
- Add mutex locks + atomic writes (temp-then-rename) to `notifications.js`, `taskLearning.js`, `autonomousJobs.js`
- Extract shared `commandSecurity.js` module from duplicated constants in `commands.js` and `scriptRunner.js`
- Add `MAX_SESSIONS_PER_SOCKET` limit in `shell.js`
- Replace hardcoded `localhost:5555` with configurable `PORTOS_UI_URL` in 3 service files
- Add peer IP `.refine()` validation in `instances.js` rejecting loopback/link-local
- Add TLS warning log in `jira.js` when `allowSelfSigned` is enabled
- Delete dead code `logger.example.js`

## Improvements

### Dashboard mobile responsive layout
- Quick Task form stacks vertically on mobile instead of cramming all inputs on one row
- App cards grid uses single column on phones, 2 columns at sm breakpoint
- Touch targets on Quick Task inputs meet 44px minimum for mobile accessibility

### HealthTab layout refresh
- Compacted HealthTab into a 2-column grid layout for better information density
- Activity stats and system health side-by-side on wider screens
