# Release v0.18.12 - Changelog

Released: 2026-02-24

## Overview

Continued reliability improvements and codebase hardening.

## Features

### Autobiography Story Prompt System
- New digital twin feature that prompts the user on a regular basis to write 5-minute autobiographical stories based on thematic prompts — builds a personal autobiography over time
- 12 life themes with 60 total prompts: Childhood, Family, Friendship, Education, Career, Travel, Challenges, Joy, Love, Identity, Creativity, Turning Points
- Prompts rotate across themes, balanced to least-written theme first, and never repeat until all are used
- Configurable prompt interval (12h to weekly) with CoS notification integration — clicking the notification deep-links to the writing UI with the prompt pre-loaded
- New Autobiography tab in Digital Twin page with writing mode, theme filtering, story editing/deletion, word count, and settings panel
- Registered as a default autonomous job (`job-autobiography-prompt`) that checks timing and sends notifications when due

## Improvements

### Guard remaining unprotected JSON.parse calls (S7 complete)
- Replaced bare `JSON.parse` with `safeJSONParse` in 7 more files (8 call sites): `agentContentGenerator.js`, `pm2Standardizer.js`, `automationScheduler.js`, `git.js` (2 locations), `aiDetect.js`, `memoryClassifier.js`, `clinvar.js`
- Continues the v0.17.8 effort that converted 5 services — all remaining unprotected JSON.parse calls on external/file data are now guarded
- Corrupted schedule files, malformed git log output, bad LLM responses, and damaged ClinVar index now gracefully return defaults or clear error messages instead of crashing the process

### Fix parseInt missing radix parameter (S10 complete)
- Added explicit radix (base 10) to all `parseInt()` calls across the codebase — prevents subtle bugs when parsing strings with leading zeros or unexpected prefixes
- Fixed 45+ call sites across 18 files: routes (notifications, detect, logs, genome, brain, scripts, cos, ports, agents, apps, history, memory), services (streamingDetect, digital-twin), client components (Apps, CreateApp, SchedulesTab, WorldTab, AIProviders, ConfigRow, ProductivityTab, DocumentsTab, OverviewTab), and tests

### Deduplicate consecutive identical decisions in CoS decision log
- Consecutive identical decisions (same type + reason) are now collapsed into a single entry with an incrementing `count` field — previously, repetitive idle/not_due entries every 60 seconds filled the 200-entry buffer within ~100 minutes, pushing out meaningful decisions
- UI shows repeat count (e.g., "142x") on collapsed entries so the user can still see how often a decision recurred
- Summary counts now reflect actual decision occurrences, not just collapsed entry count
- Meaningful decisions (task_selected, task_skipped, task_switched, rehabilitation) survive much longer in history since they're no longer evicted by noise

### Self-heal corrupted model tier learning metrics on startup
- The learning system's `byModelTier` aggregate data had drifted badly from reality — the "heavy" tier showed 0.5% success (650 failures from historical misconfiguration) and "user-specified" showed 22%, while the accurate per-task `routingAccuracy` data showed 73-97% actual success rates
- Added `recalculateModelTierMetrics()` that rebuilds `byModelTier` entirely from `routingAccuracy` (the authoritative per-task-type per-tier source of truth), using task type average durations for timing estimates
- Runs automatically on startup to self-heal corrupted data, and exposed via `POST /api/cos/learning/recalculate-model-tiers` for manual triggering
- The "Model Performance" cards in the Learning tab now show accurate metrics instead of misleading historical noise

### Mark S8 and S9 as complete in PLAN.md
- S8 (cron parser iteration limit) was already implemented: `MAX_CRON_ITERATIONS`, `validateCronFieldRange()`, early null return
- S9 (validation boilerplate extraction) was already implemented: `validateRequest()` helper used across 80 call sites in 12 route files

### Add GOALS.md
- Comprehensive project goals document generated from codebase analysis covering 9 core goals, non-goals, current state, and project direction
- Added reference link from PLAN.md to GOALS.md

### Improve unknown error extraction in agent failure analysis
- When agent failures don't match any of the 25+ known error patterns, the system previously returned a generic "Agent failed with unknown error" message — discarding all output context
- Now extracts actual error-relevant lines from the output (scanning for keywords like error, fail, exception, fatal, etc.) and includes them in the failure message and details
- This makes the 60% of failures previously classified as "unknown" much more diagnosable — the Learning tab's Error Patterns section and agent detail views now show real error context instead of a generic placeholder
- Directly improves the learning system's ability to distinguish between different failure modes

### Mark security audit items S1-S6 as complete in PLAN.md
- S1 (npm CVEs): All actionable CVEs resolved; only remaining is 1 low-severity unfixable pm2 ReDoS
- S2 (provider API key leak): `sanitizeProvider()` strips keys, returns `hasApiKey: boolean`
- S3 (PTY env vars): `buildSafeEnv()` uses allowlist, no `...process.env` spread
- S4 (mutex deadlock): `createMutex()` with `try/finally` in shared `lib/asyncMutex.js`
- S5 (Socket.IO validation): Zod schemas in `lib/socketValidation.js` for all socket events
- S6 (error context secrets): `sanitizeContext()` strips sensitive fields before broadcast

### Improve agent error categorization with missing API patterns and unknown error tracking
- Added error patterns for API 400 (bad request / invalid_request_error) and API 403 (forbidden) responses — previously these fell through to the "unknown" category, inflating the 70-error unknown count in the learning system
- Unknown errors now store recent samples (last 20) in learning data with message, details, task type, and timestamp — making them diagnosable through the dashboard instead of being a black hole of lost information
- New "Recent Uncategorized Errors" section in the Learning tab's Error Patterns panel shows the last 10 unknown error messages, helping identify missing patterns that should be added
- This directly improves the CoS adaptive learning system's ability to make routing and cooldown decisions — 60% of failures were previously categorized as "unknown", limiting the system's ability to learn from its mistakes

### Fix text enrichment answers not updating Twin Confidence / Soul Health
- Text-based enrichment answers (boundaries, decision heuristics, etc.) were saved to documents but never recalculated confidence scores — only scale (Likert) questions triggered the confidence boost and metadata save
- Added category-to-dimension mapping so each enrichment category boosts the correct confidence dimension (e.g., `non_negotiables` → `boundaries`, `decision_heuristics` → `decision_making`)
- Confidence, overall score, and gap recommendations now recalculate and persist after every enrichment answer, not just scale questions

## Removed

### App Templates (M7)
- Removed planned M7 milestone — PortOS is a personal tool and doesn't need generalized app scaffolding for other stacks
