create-pmos 0.103.0 → 0.105.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.103.0",
+  "version": "0.105.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@3d2d579
+kernel-source: pmos@d4092b3
 assembled: 2026-10-08
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-08T00:46:10Z"}
+generated: {by: process:create-pmos, at: "2026-10-08T01:07:38Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-08T00:46:10Z"}
+generated: {by: process:create-pmos, at: "2026-10-08T01:07:38Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-08T00:46:10Z"}
+generated: {by: process:create-pmos, at: "2026-10-08T01:07:38Z"}
 status: stable
 ---
 

package/workspace/guide/layout.md

@@ -30,7 +30,7 @@ Each place is drawn when its run is built. Until then the place says which run b
 Settings holds settings only, in eight sections. On a wide screen they are cards in two columns, like Agenda: Repositories, New sessions, Profiles and Theme on the left, and Validate consent, People, Online and Updates on the right. On a narrow screen the cards stack in one column. Each switch (Validate consent, People, Online) turns on when you press it. **Check for updates** is at the top right of the page.
 
 - **Repositories**: every registered repository. Press a repository to make it the current one. Press its ⋯ for **Rename** or **Remove from PMOS**. Each asks in a sheet, and a remove asks you to confirm. **Add repository** shows the scan of a folder before you add it.
-- **Profiles**: the Claude profiles a session can start with. These are the descriptors in `~/.claude/profiles`, and also the profiles you already run: a shell command that sets `CLAUDE_CONFIG_DIR` (for example `alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'`), a launcher script named `claude-*`, or a config folder such as `~/.claude-work`. A profile found this way says where it was found, and a session under it sets only `CLAUDE_CONFIG_DIR`. Press **New profile** to make one. This writes `~/.claude/profiles/<id>.json`. Account secrets are never shown in the browser.
+- **Profiles**: the Claude profiles a session can start with. These are the descriptors in `~/.claude/profiles`, and also the profiles you already run: a shell command that sets `CLAUDE_CONFIG_DIR` (for example `alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'`), a launcher script named `claude-*`, or a config folder such as `~/.claude-work`. Each profile is a row with a **Detected** badge when PMOS found it rather than wrote it, and a **Default** badge when it is the default. Its ⋯ menu has **Use as default**. A profile found this way says where it was found, and a session under it sets only `CLAUDE_CONFIG_DIR`. The list reads again every few seconds while Settings is open, and **Look again** in the Claude profiles menu reads it at once. When nothing is found, the note names the start-up files and folders PMOS looked at. Press **New profile** to make one. This writes `~/.claude/profiles/<id>.json`. Account secrets are never shown in the browser.
 - **New sessions**: the default CLI, the default model, the default Claude profile and the default launch flags for a new session. The flags come from `claude --help`, for example `--chrome`. A flag that needs a value lists the values it accepts.
 - **Validate consent**: the consent of the current repository. Use its switch to turn it on or off. **Open Validate** opens the Validate page as a tab.
 - **People**: whether the morning brief keeps attendee names from the calendar for the current repository. It is off until you turn it on. Turning it off also hides the names recorded before.
@@ -39,7 +39,7 @@ Settings holds settings only, in eight sections. On a wide screen they are cards
 - **Updates**: the version of the workspace app and the version of the kit in the current repository. Press **Check for updates** at the top of the page to compare them with the latest published version of PMOS. This is the only time the workspace asks the internet for a version, and it asks only when you press. When a newer version is available, one button shows: **Update to** and the version. It updates every part that is older, in this order:
   - **The kit** in the current repository, when it is older. This does what `npx create-pmos@latest --update` does in a terminal. It changes only the kit's own files under `pmos/` (skills, scripts, templates and guides). Your records in `state/`, `planning/` and `okf/product/` do not change. The last lines of the output show under the button. The changed files are under `pmos/`, which Sync treats as records, so Sync (or automatic sync) sends them with your other records. To read them first, look at `git diff pmos/` before you sync.
   - **The workspace app**, when it is older. This does what `pmos upgrade` does in a terminal. The button asks you first. The workspace stops, installs the new version and starts again, and the page reloads when the new version starts. The reloaded page runs the new version's code: each start gives the page files a new address, so neither the browser nor the Online address's tunnel can keep the old ones. You do not need a terminal or a hard refresh. Sessions keep running in tmux. It works on the computer that runs the workspace and at its Online address, because the page comes back there after the restart. It also works on a phone or public address that signs in with a token set in `PMOS_TOKEN`, which the workspace keeps. When the workspace made its own token at start, the token changes on the restart, so the page refuses and says where to press it. When the workspace runs from a PMOS checkout, update it with `git pull` instead.
-  - **Testing an update before it is published.** In a PMOS checkout, run `bash scripts/build-local-package.sh`. It builds the package that a publish would build, in `~/.pmos-local-package`, with a version newer than the published one, and prints the command that starts the workspace on it. That command sets `PMOS_UPDATE_SOURCE` to the package on the same computer: its folder, or the `.tgz` that `npm pack` makes. Then **Check for updates** reads that package's version and does not ask npm, and both updates install that package. The Updates card names the package it checks. A checkout may update the app this way. When the path is wrong, the card says why and does not fall back to npm. Unset the variable, or set it to `npm`, to use the registry again.
+  - **Testing an update before it is published.** In a PMOS checkout, run `bash scripts/build-local-package.sh`. It builds the package that a publish would build, in `~/.pmos-local-package`, with a version newer than the published one, and prints the command that starts the workspace on it. That command sets `PMOS_UPDATE_SOURCE` to the package on the same computer: its folder, or the `.tgz` that `npm pack` makes. Then **Check for updates** reads that package's version and does not ask npm, and both updates install that package. The Updates card names the package it checks, and the line under the buttons says "from the local package" after a check. There is no checkbox for this; the variable is the only switch. A checkout may update the app this way. When the path is wrong, the card says why and does not fall back to npm. Unset the variable, or set it to `npm`, to use the registry again.
 
   A new screen or a renamed menu comes with the workspace app, not with the kit.
 

package/workspace/lib/kit-update.js

@@ -166,20 +166,6 @@ async function latest({ exec = cp.execFile, source: src = source() } = {}) {
   return { ok: true, version: v };
 }
 
-/** Check the local repository's package version (for dev/testing without npm). Reads npm-pkg/package.json for kit. */
-function latestLocal({ repoRoot = null } = {}) {
-  try {
-    const pkgPath = path.join(String(repoRoot || ''), 'npm-pkg', 'package.json');
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-    if (!pkg.version || !validVersion(pkg.version)) {
-      return { ok: false, error: 'Local package.json has no valid version' };
-    }
-    return { ok: true, version: pkg.version, source: 'local-git' };
-  } catch (e) {
-    return { ok: false, error: `Could not read local version: ${e.message}` };
-  }
-}
-
 /**
  * npm lists a new version in the check a moment before its download is served everywhere. A download asked for in that
  * gap answers 404, and npm's CDN keeps the 404 for up to five minutes (Cache-Control max-age=300), so the same press
@@ -264,4 +250,4 @@ function upgradeApp(root, { version, logFile, spawn = cp.spawn, env = updateEnv(
   }
 }
 
-module.exports = { PKG_NAME, cmpVer, notServedYet, validVersion, source, npxArgs, readKit, fromCheckout, status, compare, latest, latestLocal, updateKit, updateEnv, upgradeApp, whereFrom };
+module.exports = { PKG_NAME, cmpVer, notServedYet, validVersion, source, npxArgs, readKit, fromCheckout, status, compare, latest, updateKit, updateEnv, upgradeApp, whereFrom };

package/workspace/lib/profile-discovery.js

@@ -31,7 +31,8 @@ const path = require('path');
 const ID_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 /** Something only Claude Code writes into its config directory. A folder with none of these is not offered. */
 const CONFIG_MARKERS = ['settings.json', '.claude.json', '.credentials.json', 'projects', 'CLAUDE.md', 'commands', 'agents', 'todos', 'statsig', 'shell-snapshots'];
-const RC_FILES = ['.zshrc', '.zprofile', '.zshenv', '.zlogin', '.bashrc', '.bash_profile', '.bash_login', '.profile', '.aliases', '.bash_aliases', '.config/fish/config.fish'];
+const RC_FILES = ['.zshrc', '.zprofile', '.zshenv', '.zlogin', '.bashrc', '.bash_profile', '.bash_login', '.profile', '.aliases', '.bash_aliases', '.bash_functions', '.zshrc.local', '.zsh/aliases.zsh', '.zsh_aliases',
+  '.config/zsh/.zshrc', '.config/zsh/aliases.zsh', '.config/bash/aliases', '.config/shell/aliases', '.oh-my-zsh/custom/aliases.zsh', '.config/fish/config.fish'];
 const FISH_FUNCTIONS = '.config/fish/functions';
 const BIN_DIRS = ['.local/bin', 'bin', '.bin', '.config/claude/bin'];
 const MAX_TEXT = 256 * 1024;       // a start-up file larger than this is not read
@@ -191,4 +192,29 @@ function detectProfiles(homeDir) {
   }));
 }
 
-module.exports = { detectProfiles, resolveDir, configDirOf, fromShellText, ID_RE };
+/**
+ * searched(homeDir) → what detectProfiles looked at, for the surface to say when it found nothing: the start-up files that
+ * exist (and so were read), the launcher scripts named claude-*, and the `~/.claude-*` folders with whether each holds a file
+ * only Claude writes. Names only, under the home folder — no contents, no paths outside it.
+ */
+function searched(homeDir) {
+  const out = { files: [], launchers: [], folders: [] };
+  if (typeof homeDir !== 'string' || !homeDir) return out;
+  for (const rel of RC_FILES) if (safeRead(path.join(homeDir, rel), MAX_TEXT) != null) out.files.push('~/' + rel);
+  for (const rel of BIN_DIRS) {
+    let names = [];
+    try { names = fs.readdirSync(path.join(homeDir, rel)); } catch { continue; }
+    for (const n of names.slice().sort()) if (/^claude[-_.]/.test(n)) out.launchers.push('~/' + rel + '/' + n);
+  }
+  for (const [parent, re] of [[homeDir, /^\.claude[-_.][A-Za-z0-9]/], [path.join(homeDir, '.config'), /^claude[-_][A-Za-z0-9]/]]) {
+    let names = [];
+    try { names = fs.readdirSync(parent); } catch { continue; }
+    for (const n of names.slice().sort()) {
+      const d = path.join(parent, n);
+      if (re.test(n) && isDir(d)) out.folders.push({ name: '~/' + path.relative(homeDir, d), claude: looksLikeConfigDir(d) });
+    }
+  }
+  return out;
+}
+
+module.exports = { detectProfiles, searched, resolveDir, configDirOf, fromShellText, ID_RE };

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.103.0",
+  "version": "0.105.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.103.0",
+      "version": "0.105.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.103.0",
+  "version": "0.105.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/dest-settings.js

@@ -173,30 +173,58 @@ function addBoard() {
 }
 
 function profilesSection() {
-  const open = () => setState({ detail: { kind: 'prof' }, col2: true });
+  const open = (id) => setState({ detail: { kind: 'prof', id: id || null }, col2: true });
+  loadSessionReads();
+  const found = sess.profiles && Array.isArray(sess.profiles.profiles) ? sess.profiles.profiles : [];
+  const def = sessionDefaults().profile;
   // every row has its ⋯, here as on the repositories: on a phone it is the one control a row is known by
   const more = iconButton({
     icon: 'ellipsis', ariaLabel: P.more(P.profilesRow), attrs: { 'data-fr': 'profiles-more' },
-    onClick: () => menu({ anchor: more, ariaLabel: P.more(P.profilesRow), items: [{ label: P.profilesOpen, onSelect: open }] }),
+    onClick: () => menu({ anchor: more, ariaLabel: P.more(P.profilesRow), items: [
+      { label: P.profilesOpen, onSelect: () => open(found[0] && found[0].id) },
+      { label: P.profilesLookAgain, onSelect: () => readProfilesAgain() },
+    ] }),
   });
-  loadSessionReads();
-  const found = sess.profiles && Array.isArray(sess.profiles.profiles) ? sess.profiles.profiles : [];
   const kids = [row({
-    title: P.profilesRow, meta: [P.profilesMeta], onOpen: open, openLabel: P.profilesOpen, trail: [more],
+    title: P.profilesRow, meta: [P.profilesMeta], onOpen: () => open(found[0] && found[0].id), openLabel: P.profilesOpen, trail: [more],
     attrs: { 'data-fr-row': 'profiles' },
   })];
+  // one row per profile the reader returned, descriptors and detected alike: the list the default select and the New session form offer
+  for (const x of found) {
+    const isDef = def === x.id;
+    const rm = iconButton({
+      icon: 'ellipsis', ariaLabel: P.more(x.id), attrs: { 'data-fr': 'profile-more' },
+      onClick: () => menu({ anchor: rm, ariaLabel: P.more(x.id), items: [
+        { label: isDef ? P.profileNoDefault : P.profileUseDefault, onSelect: () => chooseDefaultProfile(isDef ? null : x.id) },
+        { label: P.profilesOpen, onSelect: () => open(x.id) },
+      ] }),
+    });
+    kids.push(row({
+      title: x.id, meta: [P.profileMeta(x)],
+      signals: [isDef ? badge({ text: P.profileDefaultBadge, tone: 'outline' }) : null, x.detected ? badge({ text: P.profileDetectedBadge, tone: 'outline' }) : null].filter(Boolean),
+      onOpen: () => open(x.id), openLabel: P.profilesOpen + ': ' + x.id, trail: [rm],
+      attrs: { 'data-fr-row': 'profile', 'data-profile': x.id, 'data-default': isDef ? 'true' : 'false', 'data-detected': x.detected ? 'true' : 'false' },
+    }));
+  }
   if (sess.formOpen) kids.push(profileForm());
   if (sess.msg) kids.push(el('p', { class: 'fr-set__note', role: 'status', 'data-fr': 'profiles-msg' }, sess.msg));
   kids.push(el('p', { class: 'fr-set__note', 'data-fr': 'profiles-found' }, !sess.profiles ? P.profilesReading
     : sess.profiles.ok === false ? P.profilesUnread(sess.profiles.error)
-      : found.length ? P.profilesFound(found.map((x) => x.id), found.filter((x) => x.detected).map((x) => x.id)) : P.profilesNone(sess.profiles.dir)));
+      : found.length ? P.profilesFound(found.map((x) => x.id), found.filter((x) => x.detected).map((x) => x.id)) : P.profilesNone(sess.profiles.dir, sess.profiles.searched)));
   const add = button({ label: P.profileNew, variant: 'outline', size: 'sm', icon: 'plus', attrs: { 'data-fr': 'profile-new', 'aria-expanded': sess.formOpen ? 'true' : 'false' },
     onClick: () => { sess.formOpen = !sess.formOpen; sess.msg = ''; setState({}); } });
   return section('profiles', P.profiles, kids, add, 'bot');
 }
 
+/** The default Claude profile, from a row or the select: kept for the dock, and remembered by the server for the New session form. */
+function chooseDefaultProfile(id) {
+  setSessionDefaults({ profile: id || null });
+  pmPost('/api/profiles/prefer', { agent: 'claude', profile: id || null });
+  setState({});
+}
+
 /* ── the Claude profile and launch flags a new session starts with (workspace-launch-flags) ───────────────────────── */
-const sess = { profiles: null, flags: null, asked: false, flagsOpen: false, filter: '', formOpen: false, msg: '' };
+const sess = { readAt: 0, profiles: null, flags: null, asked: false, flagsOpen: false, filter: '', formOpen: false, msg: '' };
 
 /** Both reads once per page load; a created profile asks for the profile read again. */
 function loadSessionReads() {
@@ -205,10 +233,21 @@ function loadSessionReads() {
     sess.asked = true;
     pmGet('/api/claude-flags').then((j) => { sess.flags = j || { ok: false, error: 'no answer', flags: [] }; setState({}); });
   }
-  if (!sess.profiles && !sess.reading) {
-    sess.reading = true;
-    pmGet('/api/profiles').then((j) => { sess.reading = false; sess.profiles = j || { ok: false, error: 'no answer', profiles: [] }; setState({}); });
-  }
+  // read again when it is a while old, so a profile added since (a folder, an alias) shows without a reload
+  if (!sess.reading && (!sess.profiles || Date.now() - sess.readAt > 15000)) readProfilesAgain();
+}
+
+/** Ask for the profiles again. The list on screen stays until the answer comes. */
+function readProfilesAgain() {
+  if (FIXTURE || sess.reading) return;
+  sess.reading = true;
+  pmGet('/api/profiles').then((j) => {
+    sess.reading = false; sess.readAt = Date.now();
+    sess.profiles = j || { ok: false, error: 'no answer', profiles: [] };
+    // the detail column and the New session form read the same answer
+    state.profiles = sess.profiles;
+    setState({});
+  });
 }
 
 let profFormNode = null;
@@ -239,7 +278,7 @@ function profileForm() {
       mcp: mcpF.control.value.split(/[\s,]+/).filter(Boolean), env };
     const j = await pmPost('/api/profiles/create', body);
     if (!j || j.ok === false) { err.textContent = (j && j.error) || P.pfFailed; return; }
-    reset(); sess.profiles = null; sess.msg = P.pfCreated(j.profile.id, j.profile.env_count);
+    reset(); sess.profiles = null; sess.readAt = 0; sess.msg = P.pfCreated(j.profile.id, j.profile.env_count);
     setState({});
   };
   profFormNode = el('form', { class: 'fr-set__form', 'data-fr': 'profile-form', onSubmit: (e) => { e.preventDefault(); submit(); } },
@@ -277,12 +316,8 @@ function sessionsSection() {
     label: P.profileDefault, kind: 'select', value: d.profile || '',
     options: [{ value: '', label: P.noProfile }, ...(stale ? [{ value: d.profile, label: P.profileMissing(d.profile) }] : []),
       ...live.map((x) => ({ value: x.id, label: (x.label && x.label !== x.id ? x.label + ' (' + x.id + ')' : x.id) }))],
-    onCommit: (v) => {
-      setSessionDefaults({ profile: v || null });
-      // the form's own per-agent memory follows, so both starts agree; a refusal is shown by the form itself
-      pmPost('/api/profiles/prefer', { agent: 'claude', profile: v || null });
-      setState({});
-    },
+    // the form's own per-agent memory follows, so both starts agree; a refusal is shown by the form itself
+    onCommit: (v) => chooseDefaultProfile(v),
     attrs: { 'data-fr': 'default-profile' },
   });
   const flags = d.flags;
@@ -395,9 +430,9 @@ function readKitStatus(ws, force) {
 
 const say = (fields) => { Object.assign(upd, fields); setState({}); };
 
-async function checkUpdates(ws, local) {
+async function checkUpdates(ws) {
   say({ phase: 'check', message: '', error: '', output: '' });
-  const j = await pmPost('/api/kit/check', { ws, local });
+  const j = await pmPost('/api/kit/check', { ws });
   if (j && j.ok !== false) {
     kitByWs.set(ws, { st: j, at: Date.now() });
     say({ phase: null, latest: j.latest, compare: { appBehind: !!j.appBehind, kitBehind: !!j.kitBehind }, source: j.source });
@@ -480,13 +515,9 @@ function updatesSection(scope) {
       onClick: () => updateAll(ws, app, { appBehind: !!cmp.appBehind, kitBehind: !!cmp.kitBehind && kitPresent }),
     })));
   }
-  kids.push(el('div', { class: 'fr-set__line' }, el('label', { class: 'fr-set__checkbox' },
-    el('input', { type: 'checkbox', checked: !!upd.checkLocal, onChange: (e) => { upd.checkLocal = e.target.checked; setState({}); } }),
-    el('span', null, 'Check local git version')
-  )));
   const line = upd.phase === 'check' ? P.updatesChecking : upd.phase === 'kit' ? P.updateKitBusy
     : upd.message ? upd.message : upd.latest ? (cmp.appBehind || cmp.kitBehind ? P.updatesLatest(upd.latest) : P.updatesCurrent(upd.latest)) : P.updatesNever;
-  const sourceNote = upd.source === 'local-git' ? ' (from local git)' : upd.source ? ` (from ${upd.source})` : '';
+  const sourceNote = upd.source === 'local' ? ' (from the local package)' : '';
   kids.push(el('p', { class: 'fr-set__note', role: 'status', 'aria-live': 'polite', 'data-fr': 'update-state' }, line + sourceNote));
   if (upd.error) kids.push(el('p', { class: 'fr-set__note fr-set__error', role: 'alert', 'data-fr': 'update-error' }, upd.error));
   if (upd.output) kids.push(el('pre', { class: 'fr-set__output', 'data-fr': 'update-output' }, upd.output));
@@ -500,7 +531,7 @@ function checkButton(scope) {
   const ws = wsOfRepo(repo) || wsOfRepo(activeProduct());
   return button({
     label: P.updatesCheck, variant: 'outline', size: 'sm', icon: 'refresh-cw', disabled: !!upd.phase || !ws,
-    attrs: { 'data-fr': 'check-updates' }, onClick: () => checkUpdates(ws, upd.checkLocal),
+    attrs: { 'data-fr': 'check-updates' }, onClick: () => checkUpdates(ws),
   });
 }
 

package/workspace/public/pm/frame-copy.js

@@ -5,6 +5,14 @@
  * rules. The words follow the PMOS-STE instructional register: short sentences, one instruction each, the active voice.
  */
 
+/** One sentence naming where detection looked, built from /api/profiles `searched` (names only). */
+function P_searched(sr) {
+  const files = sr.files && sr.files.length ? 'read ' + sr.files.join(', ') : 'found no shell start-up file';
+  const dirs = sr.folders && sr.folders.length ? '; folders ' + sr.folders.map((f) => f.name + (f.claude ? '' : ' (no Claude files in it)')).join(', ') : '; no ~/.claude-<name> folder';
+  const lau = sr.launchers && sr.launchers.length ? '; launchers ' + sr.launchers.join(', ') : '';
+  return 'Looked: ' + files + dirs + lau + '. Press Look again after you add one.';
+}
+
 export const COPY = {
   repo: {
     all: 'All repositories',
@@ -177,7 +185,12 @@ export const COPY = {
     profilesReading: 'Reading ~/.claude/profiles…',
     profilesUnread: (e) => 'The profiles could not be read — ' + (e || 'no reason given'),
     profilesFound: (ids, seen) => 'Found ' + ids.length + ': ' + ids.join(', ') + '.' + (seen && seen.length ? ' ' + seen.join(', ') + (seen.length === 1 ? ' was' : ' were') + ' detected from your shell commands or config folders; a session under ' + (seen.length === 1 ? 'it' : 'one') + ' sets only CLAUDE_CONFIG_DIR.' : ''),
-    profilesNone: (dir) => 'No profile in ' + (dir || '~/.claude/profiles') + ' yet.',
+    profilesNone: (dir, srch) => 'No profile in ' + (dir || '~/.claude/profiles') + ' yet.' + (srch ? ' ' + P_searched(srch) : ''),
+    profileDefaultBadge: 'Default', profileDetectedBadge: 'Detected', profileUseDefault: 'Use as default', profileNoDefault: 'Stop using as default',
+    profilesLookAgain: 'Look again',
+    profileMeta: (x) => x.detected
+      ? 'Detected from ' + ({ shell: 'a shell command', launcher: 'a launcher script', 'config-dir': 'a config folder' }[x.detected.source] || 'your machine') + ' · sets CLAUDE_CONFIG_DIR'
+      : [x.label && x.label !== x.id ? x.label : null, x.account, x.env_count ? x.env_count + ' variable' + (x.env_count === 1 ? '' : 's') : null].filter(Boolean).join(' · ') || 'Profile descriptor',
     pfId: 'Id (the file name)', pfLabel: 'Label', pfAccount: 'Account, shown as written and not checked', pfMcp: 'MCP server names, declared only',
     pfEnvHead: 'Environment variables applied to the session',
     pfEnvName: 'Variable name', pfEnvValue: 'Value', pfEnvValuePh: 'value (hidden)', pfAddVar: 'Add variable',

package/workspace/public/pm/modes.js

@@ -42,12 +42,24 @@ const PILL = 'font-family:var(--mono);font-size:10px;padding:2px 6px;background:
 /* ── the Claude profiles (the detail Settings opens) ─────────────────────────────────────────── */
 
 /** The registered profiles: the live data layer's, else (fixture mode only) the seed's. */
-const profileList = () => state.profiles || (FIXTURE ? FX.PROFILES : []);
+const profileList = () => {
+  const p = state.profiles;       // the /api/profiles answer ({ profiles: [...] }), or a bare list
+  return Array.isArray(p) ? p : p && Array.isArray(p.profiles) ? p.profiles : (FIXTURE ? FX.PROFILES : []);
+};
 
 function profBody(det) {
-  let pf = { id: '', account: '', mcp: [], noMcp: false, note: '' };
+  let pf = { id: '', account: '', mcp: [], noMcp: false, note: '', detected: null };
   const x = profileList().find((z) => z.id === det.id);
-  if (x) pf = { ...x, noMcp: x.mcp.length === 0 };
+  if (x) pf = { ...pf, ...x, account: x.account || '', mcp: x.mcp || [], note: x.note || (x.detected ? 'Found on this machine, not written by PMOS. A session started under it sets only CLAUDE_CONFIG_DIR.' : ''), noMcp: !(x.mcp && x.mcp.length) };
+
+  // a profile PMOS found rather than wrote has no descriptor file: say how it was found, in tokens-and-classes only
+  if (pf.detected) {
+    const how = { shell: 'a shell command', launcher: 'a launcher script', 'config-dir': 'a config folder' }[pf.detected.source] || 'this machine';
+    return [el('div', { class: 'fr-fp-stack', 'data-fr': 'profile-detected' },
+      el('span', { class: 'fr-fp-label' }, iv(pf.id)),
+      el('p', { class: 'fr-fp-sub' }, 'Detected from ' + how + '. ' + pf.note),
+      el('p', { class: 'fr-fp-sub' }, iv(pf.detected.from)))];
+  }
 
   const out = [];
   out.push(el('div', { style: HEAD_BLOCK },

package/workspace/server.js

@@ -436,6 +436,8 @@ function profileById(id) {
 // `env` VALUES NEVER CROSS THE WIRE (contract §1.3). An environment overlay is exactly where a
 // credential lives, and D08's never-log-headers discipline covers anything the browser receives.
 // The names are shipped so the pane can say WHAT was applied; the values are not.
+// a path shown with the home folder as ~, so a config folder (which is also the CLAUDE_CONFIG_DIR value) is not sent whole
+function tildePath(f) { const h = os.homedir(); return typeof f === 'string' && h && (f === h || f.startsWith(h + path.sep)) ? '~' + f.slice(h.length) : f; }
 function profileWire(p, read) {
   const env = p && p.env && typeof p.env === 'object' ? p.env : {};
   const keys = Object.keys(env);
@@ -443,7 +445,7 @@ function profileWire(p, read) {
     id: p.id, label: p.label == null ? null : p.label, account: p.account == null ? null : p.account,
     mcp: Array.isArray(p.mcp) ? p.mcp.slice() : [],
     // where a profile PMOS found (rather than was given) came from: a shell file, a launcher script or a config folder
-    detected: p.detected ? { source: p.detected.source, from: p.detected.from, line: p.detected.line } : null,
+    detected: p.detected ? { source: p.detected.source, from: tildePath(p.detected.from), line: p.detected.line } : null,
     env_count: keys.length, env_keys: keys,
     // Computed HERE, once, so no surface can re-word R6's five sentences.
     line: profilesLib.profileLine(p, read),
@@ -6108,6 +6110,8 @@ async function handleRequest(req, res) {
       dir: read.dir,
       profiles: (read.profiles || []).map((x) => profileWire(x, read)),
       broken: (read.broken || []).map((b) => ({ file: b.file, error: b.error })),
+      // what detection looked at, so an empty list can say where it looked (names only, under the home folder)
+      searched: (() => { try { return require('./lib/profile-discovery').searched(os.homedir()); } catch { return null; } })(),
       prefs: readPrefs(),
       error: read.error || null,
     });
@@ -7334,7 +7338,7 @@ async function handleRequest(req, res) {
       const r = await kitUpdate.latest({ source: kitUpdate.source() });
       const now = st();
       if (!r.ok) return json(res, { ok: false, error: r.error, ws: w.id, ...now }, 502);
-      return json(res, { ok: true, ws: w.id, ...now, latest: r.version, source: r.source || 'npm', ...kitUpdate.compare(now, r.version) });
+      return json(res, { ok: true, ws: w.id, ...now, latest: r.version, source: r.source || 'registry', ...kitUpdate.compare(now, r.version) });
     }
     if (kitBusy) return json(res, { ok: false, error: kitBusy === 'app' ? 'The workspace is already updating' : 'A kit update is already running' }, 409);
     if (p === '/api/kit/update') {

package/workspace/test-lists/workspace-profile-detection.json

@@ -4,6 +4,10 @@
     "profile-detection.test.js"
   ],
   "seconds": {
-    "profile-detection.test.js": 8
-  }
+    "profile-detection.test.js": 8,
+    "pm-profile-rows-test.js": 20
+  },
+  "panels": [
+    "pm-profile-rows-test.js"
+  ]
 }