create-pmos 0.100.0 → 0.102.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.100.0",
+  "version": "0.102.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@42d0a34
+kernel-source: pmos@6b369e8
 assembled: 2026-10-08
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-08T00:23:24Z"}
+generated: {by: process:create-pmos, at: "2026-10-08T00:36:21Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-08T00:23:24Z"}
+generated: {by: process:create-pmos, at: "2026-10-08T00:36:21Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-08T00:23:24Z"}
+generated: {by: process:create-pmos, at: "2026-10-08T00:36:21Z"}
 status: stable
 ---
 

package/workspace/guide/layout.md

@@ -30,7 +30,7 @@ Each place is drawn when its run is built. Until then the place says which run b
 Settings holds settings only, in eight sections. On a wide screen they are cards in two columns, like Agenda: Repositories, New sessions, Profiles and Theme on the left, and Validate consent, People, Online and Updates on the right. On a narrow screen the cards stack in one column. Each switch (Validate consent, People, Online) turns on when you press it. **Check for updates** is at the top right of the page.
 
 - **Repositories**: every registered repository. Press a repository to make it the current one. Press its ⋯ for **Rename** or **Remove from PMOS**. Each asks in a sheet, and a remove asks you to confirm. **Add repository** shows the scan of a folder before you add it.
-- **Profiles**: the Claude profiles a session can start with. Press **New profile** to make one. This writes `~/.claude/profiles/<id>.json`. Account secrets are never shown in the browser.
+- **Profiles**: the Claude profiles a session can start with. These are the descriptors in `~/.claude/profiles`, and also the profiles you already run: a shell command that sets `CLAUDE_CONFIG_DIR` (for example `alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'`), a launcher script named `claude-*`, or a config folder such as `~/.claude-work`. A profile found this way says where it was found, and a session under it sets only `CLAUDE_CONFIG_DIR`. Press **New profile** to make one. This writes `~/.claude/profiles/<id>.json`. Account secrets are never shown in the browser.
 - **New sessions**: the default CLI, the default model, the default Claude profile and the default launch flags for a new session. The flags come from `claude --help`, for example `--chrome`. A flag that needs a value lists the values it accepts.
 - **Validate consent**: the consent of the current repository. Use its switch to turn it on or off. **Open Validate** opens the Validate page as a tab.
 - **People**: whether the morning brief keeps attendee names from the calendar for the current repository. It is off until you turn it on. Turning it off also hides the names recorded before.

package/workspace/lib/kit-update.js

@@ -166,6 +166,20 @@ async function latest({ exec = cp.execFile, source: src = source() } = {}) {
   return { ok: true, version: v };
 }
 
+/** Check the local repository's package version (for dev/testing without npm). Reads npm-pkg/package.json for kit. */
+function latestLocal({ repoRoot = null } = {}) {
+  try {
+    const pkgPath = path.join(String(repoRoot || ''), 'npm-pkg', 'package.json');
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    if (!pkg.version || !validVersion(pkg.version)) {
+      return { ok: false, error: 'Local package.json has no valid version' };
+    }
+    return { ok: true, version: pkg.version, source: 'local-git' };
+  } catch (e) {
+    return { ok: false, error: `Could not read local version: ${e.message}` };
+  }
+}
+
 /**
  * npm lists a new version in the check a moment before its download is served everywhere. A download asked for in that
  * gap answers 404, and npm's CDN keeps the 404 for up to five minutes (Cache-Control max-age=300), so the same press
@@ -250,4 +264,4 @@ function upgradeApp(root, { version, logFile, spawn = cp.spawn, env = updateEnv(
   }
 }
 
-module.exports = { PKG_NAME, cmpVer, notServedYet, validVersion, source, npxArgs, readKit, fromCheckout, status, compare, latest, updateKit, updateEnv, upgradeApp, whereFrom };
+module.exports = { PKG_NAME, cmpVer, notServedYet, validVersion, source, npxArgs, readKit, fromCheckout, status, compare, latest, latestLocal, updateKit, updateEnv, upgradeApp, whereFrom };

package/workspace/lib/profile-discovery.js

@@ -0,0 +1,194 @@
+'use strict';
+/*
+ * Detected Claude profiles — a PURE reader (initiative `workspace-profile-detection`).
+ *
+ * Most people who run Claude Code under more than one account do not keep a PMOS descriptor. They keep a second
+ * CONFIG DIRECTORY and a command that points Claude at it:
+ *
+ *     alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'
+ *
+ * `CLAUDE_CONFIG_DIR` is how Claude Code picks where its settings, credentials and history live, so one directory is
+ * one profile. PMOS can start a session under such a profile with the same environment overlay a descriptor gives:
+ * the one variable `CLAUDE_CONFIG_DIR`. This module finds them. It reads three places under the home directory and
+ * writes nothing, runs nothing and never opens a credential file:
+ *
+ *   1. shell start-up files and fish functions — an `alias`, a function or a one-line command that sets
+ *      `CLAUDE_CONFIG_DIR` and runs `claude`. The alias name is the profile id.
+ *   2. launcher scripts named `claude-*` in the usual bin directories that set `CLAUDE_CONFIG_DIR`.
+ *   3. config directories that look like Claude's own — `~/.claude-<name>`, `~/.claude_<name>`,
+ *      `~/.config/claude-<name>` — recognised by a file or folder only Claude writes there. The id is
+ *      `claude-<name>`.
+ *
+ * Every result names WHERE it was found (`source`), because a detected profile is a guess from files PMOS did not
+ * write, and the surface must say so. The overlay is exactly `{ CLAUDE_CONFIG_DIR: <absolute path> }`: any other
+ * variable an alias sets (a key, a proxy) is left alone, and the surface says only one variable is applied.
+ *
+ * A descriptor under `~/.claude/profiles` always wins over a detected profile of the same id (see profiles.js).
+ */
+const fs = require('fs');
+const path = require('path');
+
+const ID_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+/** Something only Claude Code writes into its config directory. A folder with none of these is not offered. */
+const CONFIG_MARKERS = ['settings.json', '.claude.json', '.credentials.json', 'projects', 'CLAUDE.md', 'commands', 'agents', 'todos', 'statsig', 'shell-snapshots'];
+const RC_FILES = ['.zshrc', '.zprofile', '.zshenv', '.zlogin', '.bashrc', '.bash_profile', '.bash_login', '.profile', '.aliases', '.bash_aliases', '.config/fish/config.fish'];
+const FISH_FUNCTIONS = '.config/fish/functions';
+const BIN_DIRS = ['.local/bin', 'bin', '.bin', '.config/claude/bin'];
+const MAX_TEXT = 256 * 1024;       // a start-up file larger than this is not read
+const MAX_SCRIPT = 16 * 1024;      // a launcher script larger than this is a binary or something else
+
+const safeRead = (file, max) => {
+  try {
+    const st = fs.statSync(file);
+    if (!st.isFile() || st.size > max) return null;
+    return fs.readFileSync(file, 'utf8');
+  } catch { return null; }
+};
+const isDir = (p) => { try { return fs.statSync(p).isDirectory(); } catch { return false; } };
+
+/** `~`, `$HOME` and `${HOME}` at the start of a path, resolved against `home`; quotes removed. null when the value is
+ *  not a plain path (it holds another variable, a command substitution or a glob). */
+function resolveDir(raw, home) {
+  let v = String(raw || '').trim().replace(/^["']|["']$/g, '');
+  if (!v) return null;
+  v = v.replace(/^\$\{?HOME\}?(?=\/|$)/, home).replace(/^~(?=\/|$)/, home);
+  if (/[$`*?]|\$\(/.test(v)) return null;
+  if (!path.isAbsolute(v)) return null;
+  return path.normalize(v).replace(/\/+$/, '') || null;
+}
+
+/** The value after `CLAUDE_CONFIG_DIR=` in one line of shell: quoted or bare. */
+function configDirOf(line, home) {
+  const m = /CLAUDE_CONFIG_DIR=(?:"([^"]*)"|'([^']*)'|([^\s;'"`)}]+))/.exec(line);
+  if (!m) return null;
+  return resolveDir(m[1] != null ? m[1] : m[2] != null ? m[2] : m[3], home);
+}
+
+/** `claude` run as a command: after the assignment, as a word of its own (not part of the alias name `claude-work`). */
+const runsClaude = (s) => /(^|[\s;&|(])(?:command\s+|exec\s+|env\s+)?(?:\S*\/)?claude(?=[\s;&|)'"}]|$)/.test(s);
+
+/** Names defined on one line of a shell start-up file: `alias n=…`, `n() { … }`, `function n …`, fish `alias n '…'`. */
+function definedNames(line) {
+  let m = /^\s*alias\s+(?:-\w+\s+)?([A-Za-z0-9._-]+)(?:=|\s)/.exec(line);
+  if (m) return m[1];
+  m = /^\s*(?:function\s+)?([A-Za-z0-9._-]+)\s*\(\s*\)\s*\{/.exec(line);
+  if (m) return m[1];
+  m = /^\s*function\s+([A-Za-z0-9._-]+)/.exec(line);
+  return m ? m[1] : null;
+}
+
+/** Profiles named in the text of one start-up file. `file` and the line number are kept as provenance. */
+function fromShellText(text, file, home) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line.includes('CLAUDE_CONFIG_DIR') || /^\s*#/.test(line)) continue;
+    if (/^\s*(?:export|set\s+-\w*x|declare|typeset)\b/.test(line)) continue;   // a plain export names no command
+    let name = definedNames(line);
+    let tail = [line];
+    // a function written over several lines: the name is on an earlier line, the command on this one or the next two
+    if (!name) {
+      for (let j = i - 1; j >= 0 && j >= i - 4 && !name; j--) {
+        if (/^\s*(?:\}|end\b)/.test(lines[j])) break;
+        if ((/\{\s*$/.test(lines[j]) || /^\s*function\s/.test(lines[j])) && definedNames(lines[j])) name = definedNames(lines[j]);
+      }
+      tail = lines.slice(i, i + 3).filter((l) => !/^\s*#/.test(l));
+    }
+    const dir = configDirOf(line, home);
+    const assign = line.indexOf('CLAUDE_CONFIG_DIR=');
+    const first = (assign < 0 ? line : line.slice(assign + 'CLAUDE_CONFIG_DIR='.length)).replace(/^(?:"[^"]*"|'[^']*'|[^\s;'"`)}]+)/, '');
+    const after = [first, ...tail.slice(1)].join('\n');
+    if (!name || !dir || !runsClaude(after)) continue;
+    out.push({ id: name, dir, source: 'shell', from: file, line: i + 1 });
+  }
+  return out;
+}
+
+/** Launcher scripts: `claude-work` on PATH whose text sets CLAUDE_CONFIG_DIR. */
+function fromLauncher(file, home) {
+  const text = safeRead(file, MAX_SCRIPT);
+  if (!text || text.includes('\0') || !text.includes('CLAUDE_CONFIG_DIR')) return null;
+  for (const line of text.split(/\r?\n/)) {
+    if (/^\s*#/.test(line)) continue;
+    const dir = configDirOf(line, home);
+    if (dir) return { id: path.basename(file), dir, source: 'launcher', from: file, line: null };
+  }
+  return null;
+}
+
+function looksLikeConfigDir(dir) {
+  return CONFIG_MARKERS.some((m) => { try { fs.accessSync(path.join(dir, m)); return true; } catch { return false; } });
+}
+
+/** `~/.claude-work`, `~/.claude_work`, `~/.config/claude-work` → `claude-work`. */
+function fromConfigDirs(home) {
+  const out = [];
+  const scan = (parent, re) => {
+    let names = [];
+    try { names = fs.readdirSync(parent); } catch { return; }
+    for (const n of names.slice().sort()) {
+      const m = re.exec(n);
+      if (!m) continue;
+      const dir = path.join(parent, n);
+      if (!isDir(dir) || !looksLikeConfigDir(dir)) continue;
+      out.push({ id: ('claude-' + m[1]).toLowerCase(), dir, source: 'config-dir', from: dir, line: null });
+    }
+  };
+  scan(home, /^\.claude[-_.]([A-Za-z0-9][A-Za-z0-9._-]*)$/);
+  scan(path.join(home, '.config'), /^claude[-_]([A-Za-z0-9][A-Za-z0-9._-]*)$/);
+  return out;
+}
+
+/**
+ * detectProfiles(homeDir) → [{ id, label, account:null, mcp:[], env:{CLAUDE_CONFIG_DIR}, path, detected:{source, from, line} }]
+ * Sorted by id. When one id turns up in several places the shell definition wins over a launcher, a launcher over a bare
+ * directory: the command is what the PM types, so its directory is the one that is meant. A profile whose directory does
+ * not exist is dropped (the command would start Claude on an empty home, which is a new login, not a profile).
+ */
+function detectProfiles(homeDir) {
+  if (typeof homeDir !== 'string' || !homeDir) return [];
+  const found = [];
+
+  for (const rel of RC_FILES) {
+    const file = path.join(homeDir, rel);
+    const text = safeRead(file, MAX_TEXT);
+    if (text) found.push(...fromShellText(text, file, homeDir));
+  }
+  const fishDir = path.join(homeDir, FISH_FUNCTIONS);
+  try {
+    for (const n of fs.readdirSync(fishDir).sort()) {
+      if (!n.endsWith('.fish')) continue;
+      const file = path.join(fishDir, n);
+      const text = safeRead(file, MAX_SCRIPT);
+      if (!text || !text.includes('CLAUDE_CONFIG_DIR')) continue;
+      const dir = configDirOf(text, homeDir);
+      if (dir) found.push({ id: n.slice(0, -5), dir, source: 'shell', from: file, line: null });
+    }
+  } catch { /* no fish functions */ }
+  for (const rel of BIN_DIRS) {
+    const bin = path.join(homeDir, rel);
+    let names = [];
+    try { names = fs.readdirSync(bin); } catch { continue; }
+    for (const n of names.slice().sort()) {
+      if (!/^claude[-_.]/.test(n)) continue;
+      const hit = fromLauncher(path.join(bin, n), homeDir);
+      if (hit) found.push(hit);
+    }
+  }
+  found.push(...fromConfigDirs(homeDir));
+
+  const rank = { shell: 0, launcher: 1, 'config-dir': 2 };
+  const byId = new Map();
+  for (const f of found) {
+    if (!ID_RE.test(f.id) || f.id === 'claude' || !isDir(f.dir)) continue;
+    const cur = byId.get(f.id);
+    if (!cur || rank[f.source] < rank[cur.source]) byId.set(f.id, f);
+  }
+  return [...byId.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0)).map((f) => ({
+    id: f.id, label: f.id, account: null, mcp: [], env: { CLAUDE_CONFIG_DIR: f.dir },
+    path: f.from, detected: { source: f.source, from: f.from, line: f.line },
+  }));
+}
+
+module.exports = { detectProfiles, resolveDir, configDirOf, fromShellText, ID_RE };

package/workspace/lib/profiles.js

@@ -151,7 +151,7 @@ function validate(raw, stem) {
  * with no home directory gets a stated failure; guessing one would be the same class of invention
  * this whole module refuses.
  */
-function readProfiles(homeDir) {
+function readDescriptors(homeDir) {
   if (typeof homeDir !== 'string' || !homeDir) {
     return {
       ok: false, absent: false, dir: null, profiles: [], broken: [],
@@ -212,6 +212,23 @@ function readProfiles(homeDir) {
   return { ok: true, absent: false, dir, profiles, broken, error: null };
 }
 
+/*
+ * readProfiles(homeDir, { detect }) — the descriptors above, and with `detect: true` also the profiles PMOS can SEE but
+ * the PM never wrote down: a config directory plus the command that points Claude at it (lib/profile-discovery.js).
+ * A detected profile carries `detected: { source, from, line }` so every surface can say where it came from. A descriptor
+ * of the same id always wins, and the four-way discrimination above is about the descriptor directory only: `absent`
+ * stays true when that directory is missing even though detected profiles are listed.
+ */
+function readProfiles(homeDir, opts) {
+  const read = readDescriptors(homeDir);
+  if (!opts || !opts.detect || typeof homeDir !== 'string' || !homeDir) return read;
+  let found = [];
+  try { found = require('./profile-discovery').detectProfiles(homeDir); } catch { found = []; }
+  const taken = new Set([...read.profiles.map((p) => p.id), ...read.broken.map((b) => b.file.replace(/\.json$/, ''))]);
+  const extra = found.filter((p) => !taken.has(p.id));
+  return extra.length ? { ...read, profiles: [...read.profiles, ...extra] } : read;
+}
+
 /*
  * The one line naming what a pane is running under — PRD R6, verbatim sentences.
  *

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.100.0",
+  "version": "0.102.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.100.0",
+      "version": "0.102.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.100.0",
+  "version": "0.102.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/dest-settings.js

@@ -189,7 +189,7 @@ function profilesSection() {
   if (sess.msg) kids.push(el('p', { class: 'fr-set__note', role: 'status', 'data-fr': 'profiles-msg' }, sess.msg));
   kids.push(el('p', { class: 'fr-set__note', 'data-fr': 'profiles-found' }, !sess.profiles ? P.profilesReading
     : sess.profiles.ok === false ? P.profilesUnread(sess.profiles.error)
-      : found.length ? P.profilesFound(found.map((x) => x.id)) : P.profilesNone(sess.profiles.dir)));
+      : found.length ? P.profilesFound(found.map((x) => x.id), found.filter((x) => x.detected).map((x) => x.id)) : P.profilesNone(sess.profiles.dir)));
   const add = button({ label: P.profileNew, variant: 'outline', size: 'sm', icon: 'plus', attrs: { 'data-fr': 'profile-new', 'aria-expanded': sess.formOpen ? 'true' : 'false' },
     onClick: () => { sess.formOpen = !sess.formOpen; sess.msg = ''; setState({}); } });
   return section('profiles', P.profiles, kids, add, 'bot');
@@ -395,12 +395,12 @@ function readKitStatus(ws, force) {
 
 const say = (fields) => { Object.assign(upd, fields); setState({}); };
 
-async function checkUpdates(ws) {
+async function checkUpdates(ws, local) {
   say({ phase: 'check', message: '', error: '', output: '' });
-  const j = await pmPost('/api/kit/check', { ws });
+  const j = await pmPost('/api/kit/check', { ws, local });
   if (j && j.ok !== false) {
     kitByWs.set(ws, { st: j, at: Date.now() });
-    say({ phase: null, latest: j.latest, compare: { appBehind: !!j.appBehind, kitBehind: !!j.kitBehind } });
+    say({ phase: null, latest: j.latest, compare: { appBehind: !!j.appBehind, kitBehind: !!j.kitBehind }, source: j.source });
   } else say({ phase: null, error: (j && j.error) || P.updateFailed });
 }
 
@@ -480,9 +480,14 @@ function updatesSection(scope) {
       onClick: () => updateAll(ws, app, { appBehind: !!cmp.appBehind, kitBehind: !!cmp.kitBehind && kitPresent }),
     })));
   }
+  kids.push(el('div', { class: 'fr-set__line' }, el('label', { class: 'fr-set__checkbox' },
+    el('input', { type: 'checkbox', checked: !!upd.checkLocal, onChange: (e) => { upd.checkLocal = e.target.checked; setState({}); } }),
+    el('span', null, 'Check local git version')
+  )));
   const line = upd.phase === 'check' ? P.updatesChecking : upd.phase === 'kit' ? P.updateKitBusy
     : upd.message ? upd.message : upd.latest ? (cmp.appBehind || cmp.kitBehind ? P.updatesLatest(upd.latest) : P.updatesCurrent(upd.latest)) : P.updatesNever;
-  kids.push(el('p', { class: 'fr-set__note', role: 'status', 'aria-live': 'polite', 'data-fr': 'update-state' }, line));
+  const sourceNote = upd.source === 'local-git' ? ' (from local git)' : upd.source ? ` (from ${upd.source})` : '';
+  kids.push(el('p', { class: 'fr-set__note', role: 'status', 'aria-live': 'polite', 'data-fr': 'update-state' }, line + sourceNote));
   if (upd.error) kids.push(el('p', { class: 'fr-set__note fr-set__error', role: 'alert', 'data-fr': 'update-error' }, upd.error));
   if (upd.output) kids.push(el('pre', { class: 'fr-set__output', 'data-fr': 'update-output' }, upd.output));
   kids.push(el('p', { class: 'fr-set__note' }, P.updatesNote));
@@ -495,7 +500,7 @@ function checkButton(scope) {
   const ws = wsOfRepo(repo) || wsOfRepo(activeProduct());
   return button({
     label: P.updatesCheck, variant: 'outline', size: 'sm', icon: 'refresh-cw', disabled: !!upd.phase || !ws,
-    attrs: { 'data-fr': 'check-updates' }, onClick: () => checkUpdates(ws),
+    attrs: { 'data-fr': 'check-updates' }, onClick: () => checkUpdates(ws, upd.checkLocal),
   });
 }
 

package/workspace/public/pm/frame-copy.js

@@ -176,7 +176,7 @@ export const COPY = {
     profileNew: 'New profile',
     profilesReading: 'Reading ~/.claude/profiles…',
     profilesUnread: (e) => 'The profiles could not be read — ' + (e || 'no reason given'),
-    profilesFound: (ids) => 'Found ' + ids.length + ': ' + ids.join(', ') + '.',
+    profilesFound: (ids, seen) => 'Found ' + ids.length + ': ' + ids.join(', ') + '.' + (seen && seen.length ? ' ' + seen.join(', ') + (seen.length === 1 ? ' was' : ' were') + ' detected from your shell commands or config folders; a session under ' + (seen.length === 1 ? 'it' : 'one') + ' sets only CLAUDE_CONFIG_DIR.' : ''),
     profilesNone: (dir) => 'No profile in ' + (dir || '~/.claude/profiles') + ' yet.',
     pfId: 'Id (the file name)', pfLabel: 'Label', pfAccount: 'Account, shown as written and not checked', pfMcp: 'MCP server names, declared only',
     pfEnvHead: 'Environment variables applied to the session',

package/workspace/public/pm/panel-cockpit.js

@@ -124,8 +124,12 @@ export function mountView(host, tab) {
   if (!v) inner.appendChild(el('div', { style: 'color:var(--muted-foreground);font-size:12px' }, 'this view is not known to this version'));
   else if (board) {
     inner.style.maxWidth = 'none';
-    try { board.renderBoard(inner, { tab, view: tab.view, renderMode, ready: !v.mode || !!m, el, setChildren, state, setState, FIXTURE, openView, repo: currentProduct() }); }
-    catch (e) { console.error('[pm] board ' + tab.view + ' failed:', e); renderMode(inner); }
+    const ctx = { tab, view: tab.view, renderMode, ready: !v.mode || !!m, el, setChildren, state, setState, FIXTURE, openView, repo: currentProduct() };
+    board.renderBoard(inner, ctx)
+      .then((boardEl) => {
+        if (boardEl) setChildren(inner, [boardEl]);
+      })
+      .catch((e) => { console.error('[pm] board ' + tab.view + ' failed:', e); renderMode(inner); });
   } else if (boardMods[tab.view] === null) {
     // the board module is still loading: draw nothing rather than flash the old list
   } else if (m && typeof m.renderMode === 'function') {

package/workspace/public/pm/panel-newsess.js

@@ -503,12 +503,18 @@ function profileSection() {
         : 'no default is set — new ' + agent + ' sessions start with no profile'))));
   }
 
-  if (p.absent) {
+  if (p.absent && !good.length) {
     out.push(el('div', { style: SUB }, iv('no profile directory at ' + (p.dir || '?')
       + ' — nothing was read, so nothing is offered but “no profile”')));
   } else if (!good.length && !broken.length) {
     out.push(el('div', { style: SUB }, iv((p.dir || 'the profile directory') + ' was read and holds no descriptors')));
   }
+  const seen = good.filter((x) => x && x.detected);
+  if (seen.length) {
+    out.push(el('div', { class: 'fr-fp-sub', 'data-profile': 'detected' }, iv(seen.map((x) => x.id).join(', ')
+      + (seen.length === 1 ? ' was' : ' were') + ' found from your shell commands or config folders — a session under '
+      + (seen.length === 1 ? 'it' : 'one') + ' sets only CLAUDE_CONFIG_DIR')));
+  }
   if (broken.length) {
     out.push(el('div', { style: WARN },
       iv(broken.length + ' descriptor' + (broken.length === 1 ? '' : 's') + ' could not be parsed and '

package/workspace/public/pm/view-notes-menu.js

@@ -54,12 +54,9 @@ function groupByInitiative(notes) {
 }
 
 function renderNoteRow(note, isSelected, onClick) {
-  const summary = note.summary || '';
-  const summaryText = summary
-    .split('\n')
+  const summaryLines = (note.summary_lines || []);
+  const summaryText = summaryLines
     .slice(0, 2)
-    .map((line) => line.trim())
-    .filter(Boolean)
     .join(' ')
     .substring(0, 60);
 

package/workspace/server.js

@@ -424,7 +424,7 @@ function sessionEnv() {
 //
 // The read is not cached. A descriptor added while the workspace is open must appear on the next
 // look, and a stale copy of a file whose whole purpose is provenance is worse than a re-read.
-function readProfilesNow() { return profilesLib.readProfiles(os.homedir()); }
+function readProfilesNow() { return profilesLib.readProfiles(os.homedir(), { detect: true }); }
 /** One descriptor by id, or null. Returns the READ too, because profileLine(null, read) needs it
  *  to tell "no profiles on this machine" from "the read failed and we cannot say". */
 function profileById(id) {
@@ -442,6 +442,8 @@ function profileWire(p, read) {
   return {
     id: p.id, label: p.label == null ? null : p.label, account: p.account == null ? null : p.account,
     mcp: Array.isArray(p.mcp) ? p.mcp.slice() : [],
+    // where a profile PMOS found (rather than was given) came from: a shell file, a launcher script or a config folder
+    detected: p.detected ? { source: p.detected.source, from: p.detected.from, line: p.detected.line } : null,
     env_count: keys.length, env_keys: keys,
     // Computed HERE, once, so no surface can re-word R6's five sentences.
     line: profilesLib.profileLine(p, read),
@@ -3752,7 +3754,7 @@ function prepareNextStep(body) {
   const preview = startPreview({ initiative: id, ws: w.id });
   if (!preview.ok) return { ...head, refused: { code: 'no-plan', why: preview.error || 'no branch and tree could be chosen' }, plan: null, prompt: null, prompt_sha: null, sources: [], judgment: { on: judgmentOn } };
   let mcp = [];
-  if (body.profile) { try { const rp = require('./lib/profiles').readProfiles(os.homedir()); const pr = rp.ok && (rp.profiles || []).find((x) => x.id === body.profile); if (pr && Array.isArray(pr.mcp)) mcp = pr.mcp; } catch { mcp = []; } }
+  if (body.profile) { try { const rp = readProfilesNow(); const pr = rp.ok && (rp.profiles || []).find((x) => x.id === body.profile); if (pr && Array.isArray(pr.mcp)) mcp = pr.mcp; } catch { mcp = []; } }
   const sources = nextStepActions.sourcesFor(item, mcp);
   const prompt = nextStepActions.buildPrompt({ initiative: id, title: got.title, item, branch: preview.branch || null, sources, judgment: judgmentLib.fragment(judgmentOn) });
   const sha = nextStepActions.planHash({ prompt, branch: preview.branch, wsId: preview.wsId, plan: preview.plan, judgment: judgmentOn });
@@ -7327,12 +7329,12 @@ async function handleRequest(req, res) {
     // the page did not show.
     const w = body.ws ? workspaces.get(String(body.ws)) : null;
     if (!w) return json(res, { ok: false, error: 'no such workspace' }, 400);
-    const st = () => kitUpdate.status({ root: w.root, appVersion: APP_VERSION, appDir: __dirname });
+    const st = () => kitUpdate.status({ root: w.root, appVersion: APP_VERSION, appDir: __dirname, env: process.env });
     if (p === '/api/kit/check') {
       const r = await kitUpdate.latest({ source: kitUpdate.source() });
       const now = st();
       if (!r.ok) return json(res, { ok: false, error: r.error, ws: w.id, ...now }, 502);
-      return json(res, { ok: true, ws: w.id, ...now, latest: r.version, ...kitUpdate.compare(now, r.version) });
+      return json(res, { ok: true, ws: w.id, ...now, latest: r.version, source: r.source || 'npm', ...kitUpdate.compare(now, r.version) });
     }
     if (kitBusy) return json(res, { ok: false, error: kitBusy === 'app' ? 'The workspace is already updating' : 'A kit update is already running' }, 409);
     if (p === '/api/kit/update') {

package/workspace/test-lists/workspace-profile-detection.json

@@ -0,0 +1,9 @@
+{
+  "_comment": "workspace-profile-detection: lib/profile-discovery.js and the profiles it adds to /api/profiles.",
+  "modules": [
+    "profile-detection.test.js"
+  ],
+  "seconds": {
+    "profile-detection.test.js": 8
+  }
+}