Release v2.58.0

.changelog/v2.58.0.md

@@ -0,0 +1,53 @@
+# Release v2.58.0
+
+Released: 2026-09-04
+
+## Highlights
+
+**CoS / agent orchestration**
+- CoS runs can now split into architect/implementer/reviewer roles, each with its own reasoning-effort setting, instead of one monolithic pass.
+- A run that ships clean code for the wrong task is now held for review instead of merging silently.
+- pr-reviewer's Stage 3 can run as an attachable TUI session you can watch and interact with, rather than only headless.
+- pr-reviewer stages that produce no output are now blocked instead of being silently re-spawned, and a stage that produces multiple conflicting outputs is resolved consistently.
+- Per-app provider overrides were renamed to per-app options, and the run toggle now reads "Enabled" instead of the ambiguous "Run".
+- Agent worktrees now attach to fork PR head branches, so external contributor PRs are actually workable by the CoS pipeline.
+- Fork detection now classifies by owner alone, so renaming a fork no longer disables it.
+- Fixed a reviewer-chain gap where a claim-work reviewer override pinned for GitHub/GitLab/PLAN.md runs silently didn't apply to a JIRA ticket run's play button.
+
+**Local LLM / model management**
+- Slotstream checkpoints can now be downloaded directly from Models → LLMs, with correct byte accounting and unfinished checkpoints hidden until complete; a weightless repo is refused up front.
+- Local model tuning (context window, pinned settings) now survives daemon-unreachable conditions and context-window reloads instead of resetting.
+- A local provider whose offered models have disappeared from its daemon is now reported as not-ready rather than silently stale.
+- Ollama-backed Claude harnesses get a pinned 128K context window, and the numCtx migration correctly stands down when `OLLAMA_CONTEXT_LENGTH` is already set.
+- A large local prompt's prefill is now budgeted so a big context window doesn't look like a wedged/hung run.
+
+**Animation / sprites / rigging**
+- A new RigPanel UI drives retargeting end-to-end: clip picker, diagnostic preview, and write handoff.
+- Rigged animated records can now be exposed to CoS avatars.
+- The degenerate-frame probe is memoized on frame content, cutting redundant sprite-processing work.
+
+**Reliability and data integrity**
+- Fixed a real race where the PromptManager variable race reappeared after a prior fix only relocated it; unsaved prompt-stage edits are now guarded consistently.
+- Bulk-star, media-collection moves, and yt-dlp import cancellation now report failure/cancellation accurately instead of a false success.
+- FableLoom's asset manifest and restorable-field set were both missing coverage that caused older peers to erase delivery plans/beat outlines on sync — fixed.
+- Tribe now reports emails/phones shared by more than one contact, helping catch duplicate-identity records.
+- `safeJSONParse`'s scalar-parsing change had broken object-shape assumptions downstream — guarded, and the related `isValidJSON` fork was inlined back into `safeJSONParse` to stop the two from drifting.
+
+**Performance**
+- Client tests now run on happy-dom instead of jsdom, and 36 DOM-free client test files skip jsdom entirely.
+- Server test suites no longer statically import modules they never exercise, cutting CI import overhead twice this release (#6009, #6156).
+- Tribe's contact list and care summary no longer scan the entire contact table; iMessage handle-frequency counting moved into SQL instead of loading thousands of rows into memory.
+
+**Windows & platform fixes**
+- The in-app update now actually runs on Windows instead of reporting a phantom success.
+- `npm install`'s inline audit no longer stalls install paths.
+- Fixed a path-separator mismatch in the Slotstream in-flight check on Windows.
+
+**Accessibility & UI polish**
+- Swept sub-44px icon buttons tree-wide and widened the tap-target guard.
+- Practice rating hints are now visible as button subtext (with the redundant tooltip removed), and their accessible name is fixed after the change.
+- Fixed mobile responsive layout regressions in POST tests and the songbook transpose readout.
+
+## Full Changelog
+
+**Full Diff**: https://github.com/atomantic/PortOS/compare/v2.57.0...v2.58.0

.env.example

@@ -194,6 +194,12 @@ PGPASSWORD=portos
 # ~/.slotstream/models). The binary always lives in ~/.slotstream/bin.
 # SLOTSTREAM_MODEL_DIR=/path/to/slotstream/models
 
+# Abandon a Slotstream checkpoint download after this many milliseconds with no
+# bytes received (slotstreamModelManager.js; default: 1200000 / 20 minutes). A
+# transfer that is still receiving bytes is never cut off by this, and an
+# abandoned one keeps its progress so a retry resumes rather than restarts.
+# SLOTSTREAM_IDLE_STALL_MS=1200000
+
 # Abort a speculative-decoding model download after this many milliseconds with
 # no bytes received (specDecodeModels.js; default: 1200000 / 20 minutes). Raise
 # it for a slow Hugging Face/CDN handshake; a download still receiving bytes is

.gitignore

@@ -63,6 +63,11 @@ Thumbs.db
 /.agent-done
 /.agent-done-*
 
+# Public-review input bundle PortOS materializes into a reviewer's worktree
+# (see server/lib/agentScratchPaths.js) — pipeline state, never work product
+/PORTOS_PUBLIC_REVIEW_INPUT.json
+/.portos-public-review/
+
 # BTW messages (ephemeral agent context, cleaned up after ingestion)
 BTW.md
 

.npmrc

@@ -27,3 +27,15 @@ ignore-scripts=true
 # root `setup` / `start` / `dev` scripts instead — a check that gates on this
 # project's floor and nothing else. `engines` stays for the npm warning and as
 # the machine-readable declaration.
+
+# Skip the advisory lookup `npm install` runs AFTER it has already resolved and
+# written node_modules. It only prints a summary, but npm BLOCKS on it — a
+# stalled request costs `fetch-timeout` (300s) times `fetch-retries` (2) before
+# npm moves on. On 2026-09-03 that endpoint began completing the TLS handshake
+# and never answering, and a 0.15s warm install took 153s; every managed install
+# path runs four of them in sequence. Set here rather than as `--no-audit` on a
+# dozen call sites for the same reason `ignore-scripts` is: npm reads config from
+# the local prefix only, so a flag one path forgets is a silent regression.
+# Rationale and what enforces dependency safety instead: docs/DEPS.md
+# "Inline Audit Policy".
+audit=false

AGENTS.md

@@ -14,7 +14,7 @@ npm run install:all   # includes git submodule update --init --recursive
 # Root `npm test` runs both workspaces in sequence (server, then client). Run them
 # per workspace to scope to one — both are Vitest, with different environments:
 cd server && npm test            # Vitest (node) — ALSO globs ../scripts, ../lib, ../autofixer
-cd client && npm test            # Vitest (jsdom) — component/unit tests
+cd client && npm test            # Vitest (happy-dom) — component/unit tests
 # No NODE_ENV prefix needed: server/vitest.config.js FORCES NODE_ENV=test (#4554).
 # Vitest only defaults it when unset, and PortOS runs under PM2 with
 # NODE_ENV=development — a suite run that inherits that aims at the real Postgres.

GOALS.md

@@ -42,7 +42,7 @@ AI agents should be capable of operating fully autonomously across all connected
 
 ### 9. Knowledge Legacy
 
-Preserve personal knowledge, identity, decision-making patterns, creative output, and life story beyond a single lifetime. The autobiography system, genome data, behavioral profiles, captured memories, written work, and built worlds form a durable record — not just of what you built, but of who you are and how you think.
+Preserve personal knowledge, identity, decision-making patterns, creative output, and life story beyond a single lifetime. The autobiography system, genome data, behavioral profiles, captured memories, written work, and built worlds form a durable record — not just of what you built, but of who you are and how you think. PortOS itself is the backup of record (local data + automatic snapshots); download/export buttons exist only for sharing or handoff to other tools (e.g. Sharing buckets, Legacy Bundle), never as a parallel backup mechanism.
 
 ### 10. Anywhere Access on Private Network
 

PRD.md

@@ -22,7 +22,7 @@ Reused verbatim (condensed to objective statements) from [GOALS.md](./GOALS.md)'
 6. **Developer Productivity Toolkit** — shell, git, browser control, and process tooling available from any device.
 7. **Self-Improving Intelligence** — the system tunes its own routing/metrics from observed outcomes rather than staying static.
 8. **Full Digital Autonomy** — agents can act across connected platforms (voice, Telegram, messaging, social) around the clock.
-9. **Knowledge Legacy** — personal knowledge, identity, and creative output are preserved as a durable, exportable record.
+9. **Knowledge Legacy** — personal knowledge, identity, and creative output are preserved as a durable, local record. PortOS itself is the backup of record (data lives on the user's hardware and is covered by automatic snapshots — see `docs/BACKUP.md`), so per-domain backup-style exports are out of scope; download/export buttons exist only for sharing or handoff to other tools (Sharing buckets, Legacy Bundle, format-specific creative deliverables).
 10. **Anywhere Access on Private Network** — every feature is reachable from any device on the user's Tailnet, with no public exposure.
 11. **Health & Longevity** — health data (MeatSpace) is tracked and made actionable via mortality/longevity-aware goal scoring.
 12. **Personal Productivity & Life Management** — calendar, goals, and communications are unified with the same tooling that manages digital projects.
@@ -208,6 +208,7 @@ Reused verbatim (condensed to objective statements) from [GOALS.md](./GOALS.md)'
 | NR-7 | The system MUST NOT treat leakage of a free, non-monetary third-party API key (e.g. CivitAI) to an unintended host as a security finding requiring host-allowlisting or key-stripping. | Won't-fix precedent (#2200): worst case is quota abuse against a free service, borne by that service — no monetary loss or meaningful security consequence. Does not extend to paid/quota-billed providers or money-bearing/destructive-action keys, which retain full hardening requirements. |
 | NR-8 | The system MUST NOT send an AI-drafted outbound message (email, social post) without explicit user review-and-approve, regardless of how confident the draft is. | Full digital autonomy (Goal 8) extends to task execution, not to irreversible outward-facing communication acting under the user's identity without a human gate. |
 | NR-9 | The system MUST NOT instruct the user to run a shell/terminal command in order to complete a workflow PortOS can perform itself — including installing or removing a runtime, and searching for, downloading, or deleting a model. Blocked-state copy points at the in-app control, not at a command line. | PortOS is the control surface for the machine; sending the user to a terminal for one step of an otherwise-managed lifecycle is a dead end that breaks remote/mobile use (Anywhere Access) and leaves the app's own state stale. **Carve-out:** genuinely privileged one-time host setup PortOS deliberately refuses to perform (`pm2 startup`, `sudo` fan-control helpers, `gcloud auth login`) may be named as an operator step — the refusal must be deliberate and documented, not a gap in the UI. |
+| NR-10 | The system MUST NOT add per-domain backup-style export endpoints (e.g. a generic "export my Brain/memories/thoughts to file" download) as a durability or backup story. | PortOS is a locally hosted app that is itself the user's backup of record — data lives on the user's hardware and is covered by automatic snapshots (`docs/BACKUP.md`). Download/export buttons exist only for sharing or handoff to other tools (Sharing buckets, Legacy Bundle, format-specific creative deliverables), never as a parallel backup mechanism. |
 
 ---
 
@@ -222,6 +223,7 @@ Reused verbatim (condensed to objective statements) from [GOALS.md](./GOALS.md)'
 - **Federated peer-to-peer sharing beyond bucket-based Sharing** — direct P2P distribution between instances is a secondary goal, not yet built.
 - **Federated media-provider routing for image/video generation** — the queued-job delegation contract (FR-52/FR-53) is implemented and live for audio/music generation today; extending the same provider/consumer contract to image and video generation is tracked separately (issue #4348), not yet built.
 - **User-directed assignment of a CoS task to a specific federated peer instance** — task coordination across peers is currently opportunistic only (first peer to see a synced task claims it via the existing lease mechanism); an explicit "run this task on instance X" control is a decided, ready-to-work follow-up (issue #4520), not yet implemented.
+- **Per-domain backup-style exports** — PortOS is locally hosted and is itself the backup of record (automatic snapshots); exports exist only for sharing or handoff to other tools, per NR-10.
 
 ---
 

autofixer/.npmrc

@@ -17,3 +17,10 @@ ignore-scripts=true
 # root `setup` / `start` / `dev` scripts instead — a check that gates on this
 # project's floor and nothing else. `engines` stays for the npm warning and as
 # the machine-readable declaration.
+
+# Skip the post-install advisory lookup. npm BLOCKS on it (`fetch-timeout` 300s
+# times `fetch-retries` 2), so an endpoint that stalls hangs this workspace's
+# install for minutes to print a summary. Same local-prefix rule as above — the
+# repo-root file does not cover this workspace's install path.
+# Rationale: docs/DEPS.md "Inline Audit Policy".
+audit=false

browser/.npmrc

@@ -6,3 +6,11 @@
 # it means the guard is already in place if any are ever added, rather than the
 # addition silently arriving with an install-time execution slot.
 ignore-scripts=true
+
+# Skip the post-install advisory lookup. npm BLOCKS on it (`fetch-timeout` 300s
+# times `fetch-retries` 2), so an endpoint that stalls hangs an install for
+# minutes to print a summary. Pre-emptive here for the same reason as the setting
+# above — this workspace has no dependencies today, so the guard is in place
+# before any arrive rather than added afterwards.
+# Rationale: docs/DEPS.md "Inline Audit Policy".
+audit=false

client/.npmrc

@@ -24,3 +24,10 @@ ignore-scripts=true
 # root `setup` / `start` / `dev` scripts instead — a check that gates on this
 # project's floor and nothing else. `engines` stays for the npm warning and as
 # the machine-readable declaration.
+
+# Skip the post-install advisory lookup. npm BLOCKS on it (`fetch-timeout` 300s
+# times `fetch-retries` 2), so an endpoint that stalls hangs this workspace's
+# install for minutes to print a summary. Same local-prefix rule as above — the
+# repo-root file does not cover this workspace's install path.
+# Rationale: docs/DEPS.md "Inline Audit Policy".
+audit=false