create-pmos 0.18.1 → 0.20.0

package/workspace/public/pm/panel-detail.js

@@ -151,12 +151,33 @@ function hasConnector(kind) {
     return c.some((x) => (typeof x === 'string' ? x : x && x.kind) === kind
       && (typeof x === 'string' || x.configured !== false));
   }
+  // The server's shape: `{configured:[{kind, profile, ...}], note}`. Checked BEFORE the plain-map
+  // branch below, which would otherwise read `c['jira']` on this object, find undefined, and report
+  // "no connector" on a machine whose profiles declare one — a false negative dressed as caution.
+  if (c && Array.isArray(c.configured)) return c.configured.some((x) => x && x.kind === kind);
   if (c && typeof c === 'object') return !!c[kind];
   return false;
 }
 
 const NO_CONNECTOR = 'no connector configured — nothing was read, and nothing will be written.';
 
+/**
+ * Why the two sync approvals are inert in real mode even when a destination IS resolvable.
+ *
+ * They are publishing and read-back, and both are out of scope by name (PRD non-goals 1–2).
+ * Publishing puts PMOS content in two places and needs a fork/drift ruling the PM has not made;
+ * read-back has no surviving architecture at all, because D53's inbound half was a hosted-Supabase
+ * webhook and D64 deprecated that path. The buttons' old results — `pushed · repo → jira · in sync
+ * 12:41` — were a hardcoded clock time presented as a sync confirmation, which is the same defect
+ * as the fabricated identifier one level up.
+ *
+ * Deleting the buttons was the other option and is worse: the PM would be left wondering whether
+ * PMOS forgot how to sync. An inert control that states the reason is a surface telling the truth
+ * about its own limits.
+ */
+const SYNC_OUT_OF_SCOPE = 'publishing and read-back are not built. PMOS records which record this '
+  + 'corresponds to; it does not write to that record, and it has read nothing from it.';
+
 /* ── the sticky detail header (lines 332–335) ───────────────────────────────────────────────
  * Built once and re-used, so panel 3's chrome keeps its identity across renders the way panel 2's
  * header and search box do.
@@ -276,24 +297,89 @@ function phaseBlock(slug, rec) {
 }
 
 /* ── 5a · LINKS (lines 380–398, derivation 1757–1766, 1797–1798) ────────────────────────────
- * External references — NOT repo files. Sessions add them automatically; the three ＋ buttons let
- * the PM add one by hand, and adding one opens its preview immediately so the reference is
- * verified by looking at it rather than by trusting the row. Multiple links of a kind are allowed:
- * the Jira numbering counts the ones already filed rather than replacing them.
+ * External references — NOT repo files.
+ *
+ * WHAT CHANGED HERE, AND WHY IT IS THE POINT. This used to append a reference the moment a ＋ button
+ * was clicked, built out of the initiative slug and a counter: `ATL-501`, then `ATL-502`. The PM was
+ * never asked which epic. The row then labelled itself `connected`, and after a reload the same row
+ * read `declared · not connected` — one row, two labels, and the flattering one was the one visible
+ * at the moment of the click. Six clicks recorded six references to six epics that did not exist.
+ *
+ * A ＋ button now opens a FORM. Nothing is recorded until the PM supplies the reference or a session
+ * resolves it, because a reference nobody chose is not a reference — it is a guess written down in
+ * a place the PM will later trust. `makeLink` is gone rather than bypassed: a helper that can
+ * fabricate an identifier is a helper someone re-wires later.
+ */
+/**
+ * Hand the lookup to a session that can actually perform it.
+ *
+ * This is the seam the whole initiative turns on, so it is worth being explicit about what it does
+ * NOT do: it does not contact Jira, Confluence or Google, and it does not record a link. It asks
+ * the server to compose a task and shows that task to the PM to run in a session on the named
+ * profile — the session holds the credential, PMOS does not (D53). The session then records the
+ * resolved reference through the same validated endpoint the PM's own typing goes through, where
+ * it will be refused unless it names the profile that read it.
+ *
+ * The alternative — having the workspace perform the search itself — is the design D53 rejected and
+ * that `no-network.test.js` fails by construction. There is no version of this function that calls out.
  */
+function askSessionToResolve(slug, kind, resolver, hint) {
+  const data = sibling('data', './data.js');
+  if (!data || typeof data.lookupTask !== 'function') return;
+  Promise.resolve(data.lookupTask({ kind, subject: slug, hint, profile: resolver.profile }))
+    .then((out) => {
+      if (!out || out.ok === false) {
+        setState((s) => ({ linkTask: { ...s.linkTask, [slug]: { error: (out && out.error) || 'the task could not be composed' } } }));
+        return;
+      }
+      setState((s) => ({ linkTask: { ...s.linkTask, [slug]: { text: out.text, profile: resolver.profile, kind } } }));
+    })
+    .catch((e) => setState((s) => ({ linkTask: { ...s.linkTask, [slug]: { error: String((e && e.message) || e) } } })));
+}
+
+function linkStateStyle(st) {
+  if (st === 'resolved') return { color: 'var(--success)', label: 'resolved' };
+  if (st === 'unreachable') return { color: 'var(--warning)', label: 'unreachable' };
+  if (st === 'unattributed') return { color: 'var(--muted-foreground)', label: 'unattributed' };
+  return { color: 'var(--muted-foreground)', label: 'declared' };
+}
+
+/**
+ * The one sentence a link row is allowed to say about itself, built from what was actually observed.
+ * Every branch names its evidence or admits it has none — there is deliberately no branch that
+ * returns a bare status word, because a bare status word is what `connected` was.
+ */
+function linkStateText(lk) {
+  const st = lk.state || (lk.origin ? 'declared' : 'unattributed');
+  if (st === 'resolved') {
+    const when = String(lk.resolved_at || '').slice(11, 16);
+    return 'resolved by ' + (lk.profile || 'a session') + (when ? ' · read ' + when : '');
+  }
+  if (st === 'unreachable') return 'unreachable · ' + (lk.reason || 'the lookup failed');
+  if (st === 'unattributed') return 'recorded before provenance — origin unknown';
+  return 'declared · nothing read it';
+}
+
 function linksRow(slug) {
   const rec = records()[slug] || {};
   const manual = (state.initLinks || {})[slug] || [];
   const links = [...(rec.links || []), ...manual];
-
-  const addLink = (src) => {
-    const link = FX.makeLink(slug, src, manual);
+  const openSrc = (state.linkForm || {})[slug] || null;
+
+  /**
+   * Record what the PM typed. `origin: 'typed'` is sent explicitly and the server will refuse to
+   * store it as anything stronger — a typed reference is the PM's word, and the row says so.
+   */
+  const submitTyped = (src, ref) => {
+    const target = String(ref || '').trim();
+    if (!target) return;
+    const link = { kind: src, label: target, path: target, target, origin: 'typed', state: 'declared' };
     setState(
-      (s) => ({ initLinks: { ...s.initLinks, [slug]: [...((s.initLinks || {})[slug] || []), link] } }),
-      () => {
-        declare('recordInitiativeLink', { slug, ...link });
-        openDoc(slug, link.path, link.kind.toUpperCase());
-      },
+      (s) => ({
+        initLinks: { ...s.initLinks, [slug]: [...((s.initLinks || {})[slug] || []), link] },
+        linkForm: { ...s.linkForm, [slug]: null },
+      }),
+      () => declare('recordInitiativeLink', { slug, ...link }),
     );
   };
 
@@ -304,13 +390,80 @@ function linksRow(slug) {
   },
     el('span', { style: 'flex:none;width:76px;font-family:var(--mono);font-size:10px;letter-spacing:.1em;text-transform:uppercase;color:var(--info)' }, iv(lk.kind)),
     el('span', { style: 'font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap' }, iv(lk.label)),
-    el('span', { style: 'margin-left:auto;flex:none;font-family:var(--mono);font-size:10px;color:var(--muted-foreground)' }, iv(lk.st)),
+    // A row that CARRIES provenance states what was observed; a row that does not keeps whatever
+    // status copy it came with. The branch is on the row, not on the mode, which is the point: the
+    // prototype's seeded rows (`auto · session`) render unchanged so the parity comparator still
+    // sees a like-for-like surface, while every row this surface actually records — in either mode —
+    // is held to the three-word vocabulary. Branching on FIXTURE instead would have left a real row
+    // in a fixture-mode session rendering `undefined`.
+    (lk.state || lk.origin)
+      ? el('span', {
+        style: 'margin-left:auto;flex:none;font-family:var(--mono);font-size:10px;color:'
+          + linkStateStyle(lk.state || 'declared').color,
+      }, iv(linkStateText(lk)))
+      : el('span', { style: 'margin-left:auto;flex:none;font-family:var(--mono);font-size:10px;color:var(--muted-foreground)' }, iv(lk.st)),
   ));
 
+  // Which destinations a session could actually look up, and under which profile. Derived by the
+  // server from the PM's agent profiles — never a constant, and never a claim that PMOS is connected.
+  const conn = (state.connectors && state.connectors.configured) || [];
+  const resolverFor = (kind) => conn.find((c) => c.kind === kind) || null;
+
+  const form = openSrc ? (() => {
+    const resolver = resolverFor(openSrc);
+    const task = (state.linkTask || {})[slug] || null;
+    const inputId = 'linkref-' + slug + '-' + openSrc;
+    const read = () => {
+      const node = document.getElementById(inputId);
+      return node ? node.value : '';
+    };
+    return el('div', { style: 'margin-top:6px;padding:9px 11px;border:1px solid var(--border);background:var(--background)' },
+      el('div', { style: 'font-size:11.5px;color:var(--muted-foreground);line-height:1.5;margin-bottom:7px' },
+        iv(resolver
+          ? 'paste the reference, or ask ' + resolver.profile + ' to find it — that session holds your '
+            + openSrc + ' MCP. PMOS itself reads nothing.'
+          : 'paste the reference. No agent profile declares a ' + openSrc
+            + ' MCP, so nothing here can look it up for you — what you type is recorded as your own declaration.')),
+      el('input', {
+        id: inputId,
+        placeholder: openSrc === 'jira' ? 'ATL-482 or its URL' : 'the page or document URL',
+        style: 'width:100%;font-family:var(--mono);font-size:11.5px;padding:6px 8px;background:var(--secondary);border:1px solid var(--border);color:var(--foreground)',
+      }),
+      el('div', { style: 'display:flex;gap:6px;margin-top:8px;flex-wrap:wrap' },
+        el('button', {
+          onClick: () => submitTyped(openSrc, read()),
+          style: 'font-family:var(--mono);font-size:10.5px;padding:5px 10px;min-height:28px;background:var(--brand);color:oklch(0.987 0.002 197.1);font-weight:500',
+        }, 'record this reference'),
+        resolver && el('button', {
+          onClick: () => askSessionToResolve(slug, openSrc, resolver, read()),
+          style: 'font-family:var(--mono);font-size:10.5px;padding:5px 10px;min-height:28px;background:var(--secondary);border:1px solid var(--border);color:var(--foreground)',
+          hover: 'border-color:var(--ring)',
+        }, 'ask ', iv(resolver.profile), ' to find it'),
+        el('button', {
+          onClick: () => setState((s) => ({ linkForm: { ...s.linkForm, [slug]: null } })),
+          style: 'font-family:var(--mono);font-size:10.5px;padding:5px 10px;min-height:28px;background:transparent;border:1px solid var(--border);color:var(--muted-foreground)',
+        }, 'cancel'),
+      ),
+      task && (task.error
+        ? el('div', { style: 'margin-top:8px;font-size:11.5px;color:var(--warning);line-height:1.5' },
+          iv('the lookup task could not be composed — ' + task.error))
+        : el('div', { style: 'margin-top:8px' },
+          el('div', { style: 'font-size:11px;color:var(--muted-foreground);line-height:1.5;margin-bottom:5px' },
+            iv('run this in a session on ' + task.profile + '. it records the reference itself, and PMOS'
+              + ' will refuse the result unless it names the profile that read it.')),
+          el('pre', {
+            style: 'font-family:var(--mono);font-size:10.5px;line-height:1.5;white-space:pre-wrap;'
+              + 'padding:8px 9px;background:var(--secondary);border:1px solid var(--border);color:var(--foreground);margin:0',
+          }, iv(task.text)))),
+    );
+  })() : null;
+
   const addRow = el('div', { style: 'display:flex;gap:6px;align-items:center;flex-wrap:wrap;margin-top:4px' },
     el('span', { style: 'font-family:var(--mono);font-size:9.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted-foreground)' }, 'link'),
     FX.LINK_SRCS.map((ls) => el('button', {
-      onClick: () => addLink(ls.src),
+      onClick: () => setState((s) => ({
+        linkForm: { ...s.linkForm, [slug]: (s.linkForm || {})[slug] === ls.src ? null : ls.src },
+      })),
       style: 'display:flex;gap:5px;align-items:center;font-family:var(--mono);font-size:10.5px;padding:4px 9px;min-height:28px;background:var(--secondary);border:1px solid var(--border);color:var(--foreground)',
       hover: 'border-color:var(--ring)',
     }, '＋ ', iv(ls.l))),
@@ -321,6 +474,7 @@ function linksRow(slug) {
     el('div', { style: 'display:flex;flex-direction:column;gap:2px;min-width:0' },
       rows,
       addRow,
+      form,
       el('span', { style: 'font-size:11px;color:var(--muted-foreground);margin-top:3px;line-height:1.5' },
         'references — not in the repo. sessions add these automatically; link one yourself when you need it.'),
     ),
@@ -354,19 +508,69 @@ function artifactRow(slug, a) {
 
   if (!dest) {
     // Unlinked: the three destinations it could be linked to.
+    // In FIXTURE mode the prototype's own destination copy is drawn, so the parity comparator still
+    // sees a like-for-like surface. In REAL mode a click opens a FORM: `linkArtDest` built the
+    // destination out of the artifact's own FILENAME — `PM / <basename>`, `ATL epic · <basename>` —
+    // which is a name for a page nobody created, recorded as though the PM had chosen it.
+    const openHere = (state.artLinkForm || {})[key] || null;
+    const inputId = 'artref-' + key.replace(/[^A-Za-z0-9]/g, '-');
+    const conn = (state.connectors && state.connectors.configured) || [];
+
+    const submit = (kind) => {
+      const node = document.getElementById(inputId);
+      const target = String((node && node.value) || '').trim();
+      if (!target) return;
+      const d = { kind, target, origin: 'typed', state: 'declared' };
+      setState((s) => ({
+        artLinks: { ...s.artLinks, [key]: d },
+        artLinkForm: { ...s.artLinkForm, [key]: null },
+      }));
+      declare('recordArtifactLink', { artifact_path: a.path, slug, kind, target, origin: 'typed', state: 'declared' });
+    };
+
     const linkRow = el('div', { style: 'display:flex;gap:6px;align-items:center;flex-wrap:wrap;padding:3px 0 0' },
       el('span', { style: 'font-family:var(--mono);font-size:9.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted-foreground)' }, 'link'),
       FX.ART_LINK_SRCS.map((ls) => el('button', {
         onClick: () => {
-          const d = FX.linkArtDest(key, ls.kind);
-          setState((s) => ({ artLinks: { ...s.artLinks, [key]: d } }));
-          declare('recordArtifactLink', { artifact_path: a.path, slug, kind: d.kind, target: d.target });
+          if (FIXTURE) {
+            const d = FX.linkArtDest(key, ls.kind);
+            setState((s) => ({ artLinks: { ...s.artLinks, [key]: d } }));
+            return;
+          }
+          setState((s) => ({
+            artLinkForm: { ...s.artLinkForm, [key]: (s.artLinkForm || {})[key] === ls.kind ? null : ls.kind },
+          }));
         },
         style: 'font-family:var(--mono);font-size:10px;padding:3px 8px;min-height:24px;background:var(--secondary);border:1px solid var(--border);color:var(--foreground)',
         hover: 'border-color:var(--ring)',
       }, '＋ ', iv(ls.l))),
     );
-    return el('div', { style: 'min-width:0' }, head, linkRow);
+
+    const form = openHere ? el('div', { style: 'margin-top:6px;padding:8px 10px;border:1px solid var(--border);background:var(--background)' },
+      el('div', { style: 'font-size:11.5px;color:var(--muted-foreground);line-height:1.5;margin-bottom:6px' },
+        iv(conn.some((c) => c.kind === openHere)
+          ? 'paste the ' + openHere + ' reference this file corresponds to. a session on '
+            + (conn.find((c) => c.kind === openHere) || {}).profile + ' can find it for you — PMOS reads nothing.'
+          : 'paste the ' + openHere + ' reference this file corresponds to. nothing here can look it up,'
+            + ' so what you type is recorded as your own declaration.')),
+      el('input', {
+        id: inputId,
+        placeholder: openHere === 'jira' ? 'ATL-482 or its URL' : 'the page or document URL',
+        style: 'width:100%;font-family:var(--mono);font-size:11px;padding:5px 7px;background:var(--secondary);border:1px solid var(--border);color:var(--foreground)',
+      }),
+      el('div', { style: 'display:flex;gap:6px;margin-top:7px;flex-wrap:wrap' },
+        el('button', {
+          onClick: () => submit(openHere),
+          style: 'font-family:var(--mono);font-size:10px;padding:4px 9px;min-height:26px;background:var(--brand);color:oklch(0.987 0.002 197.1);font-weight:500',
+        }, 'record'),
+        el('button', {
+          onClick: () => setState((s) => ({ artLinkForm: { ...s.artLinkForm, [key]: null } })),
+          style: 'font-family:var(--mono);font-size:10px;padding:4px 9px;min-height:26px;background:transparent;border:1px solid var(--border);color:var(--muted-foreground)',
+        }, 'cancel'),
+      ),
+    ) : null;
+
+    return el('div', { style: 'min-width:0' }, head, linkRow, form);
   }
 
   // Linked: the destination pill, the sync button, and the persisted result of the last approval.
@@ -384,7 +588,9 @@ function artifactRow(slug, a) {
   let panel = null;
   if (syncOpen) {
     const live = hasConnector(dest.kind);
-    const inert = !live;
+    // FIXTURE mode draws the prototype's two working approvals so the comparator sees a like-for-like
+    // surface. REAL mode never enables them: they are publishing and read-back, both out of scope.
+    const inert = FIXTURE ? !live : true;
     const decide = (make) => () => {
       if (inert) return;
       setState((s) => ({
@@ -395,7 +601,7 @@ function artifactRow(slug, a) {
     const off = inert ? ';opacity:.5;cursor:not-allowed' : '';
     panel = el('div', { style: 'margin-top:6px;padding:9px 11px;border:1px solid var(--border);background:var(--background)' },
       el('div', { style: 'font-size:12px;line-height:1.5;color:var(--muted-foreground)' },
-        iv(live ? FX.artDiffText(dest) : NO_CONNECTOR)),
+        iv(FIXTURE ? (live ? FX.artDiffText(dest) : NO_CONNECTOR) : SYNC_OUT_OF_SCOPE)),
       el('div', { style: 'display:flex;gap:6px;margin-top:8px;flex-wrap:wrap' },
         el('button', {
           onClick: decide(FX.artSyncPushed), disabled: inert,

package/workspace/public/pm/panel-tabs.js

@@ -173,14 +173,68 @@ function nextSessionName() {
   return { n: max + 1, name: 'agent ' + (max + 1) };
 }
 
+/* ── who is already in the tree this session would land in ───────────────────────────────────
+ *
+ * The workspace used to answer this AFTER the fact: it started the session, then wrote "2 sessions
+ * already running in this working tree" into the new pane. That sentence is true and arrives one
+ * step too late — the PM has already made the thing they might not have wanted, and the sentence
+ * names a count they cannot act on. Worse, the answer they usually want is not "start another"
+ * at all; it is "which of those is the one I was already working in?".
+ *
+ * So the same facts are computed BEFORE the spawn, from data the page already holds:
+ *   • the tree the new session would land in — data.js publishes it per registered workspace id
+ *     (`/api/workspaces` → `tree`), which is available even when that tree has no session yet;
+ *   • the live sessions in it — `state.sessions`, each row carrying the server's own `tree`,
+ *     `tree_role`, presented state and rendered label;
+ *   • what ending each one would cost — lib/tree-share's `endRisk`, the same module the server uses
+ *     for the pane advisory, so the two readings are one reading.
+ *
+ * Nothing is derived twice and nothing is guessed. When any input is missing — fixture mode, no
+ * workspace selected, a folder with no git, the shared module not loaded — this answers "nobody",
+ * and `＋ session` behaves exactly as it always did. A chooser that appears on a bad guess would be
+ * worse than no chooser.
+ */
+function treePeersNow() {
+  if (FIXTURE) return null;
+  const TS = typeof window !== 'undefined' ? window.PMOSTreeShare : null;
+  if (!TS) return null;
+  const ws = state.wsId || null;
+  const tree = ws && dataMod && typeof dataMod.treeOfWorkspace === 'function'
+    ? dataMod.treeOfWorkspace(ws) : null;
+  if (!tree) return null;                       // no git, or nothing selected — no index to share
+  const rows = Array.isArray(state.sessions) ? state.sessions : [];
+  // The map coTenants() keys on. Built from each row's OWN `tree`, which the server derived — the
+  // client never runs git and must not pretend to. The target workspace is added explicitly so a
+  // tree whose only registration has no session yet still resolves.
+  const treeOfWs = new Map([[ws, tree]]);
+  for (const r of rows) if (r && r.ws && !treeOfWs.has(r.ws)) treeOfWs.set(r.ws, r.tree || null);
+  const mates = TS.coTenants(rows, treeOfWs, tree, null);
+  if (!mates.length) return null;
+  // The declared writer, read off the row the server already marked rather than recomputed.
+  const held = rows.find((r) => r && r.tree === tree && r.tree_role === 'writer');
+  return {
+    tree,
+    branch: (dataMod && typeof dataMod.branchOfWorkspace === 'function' && dataMod.branchOfWorkspace(ws)) || null,
+    peers: mates.map((m) => TS.describeTenant(m, held ? held.id : null)),
+  };
+}
+
 /**
  * `＋ session` (line 2087): file a new session against the selected initiative and open its tab.
  * The session lands in `extraSess` — the prototype's own list of sessions started in this window —
  * and the terminal tab is opened in the callback, i.e. after the render that added it.
+ *
+ * `opts.force` skips the chooser. It is what the chooser's own "start another session here anyway"
+ * calls, so the guard is asked exactly once per click and a PM who has already answered the
+ * question is never asked it twice.
  */
-export function newSession(slug) {
+export function newSession(slug, opts) {
   const target = slug || selSlug();
   if (!target) return;
+  if (!(opts && opts.force)) {
+    const found = treePeersNow();
+    if (found) { setState({ startPrompt: { slug: target, ...found }, endConfirm: null }); return; }
+  }
   const { n, name } = nextSessionName();
   /* `spawn` is carried on the session and thence onto the tab: it is an INSTRUCTION to start a PTY,
    * and it is the only thing that authorises one. Without it the terminal resolves by name, which
@@ -188,6 +242,8 @@ export function newSession(slug) {
   const sess = { name, st: 'working', label: 'working', profile: state.newSessProfile, spawn: true };
   setState((s) => ({
     startN: n + 1,
+    startPrompt: null,
+    endConfirm: null,
     extraSess: { ...s.extraSess, [target]: [...(s.extraSess[target] || []), sess] },
   }), () => openTermTab(target, sess));
   if (!FIXTURE && dataMod && typeof dataMod.startSession === 'function') {
@@ -195,6 +251,25 @@ export function newSession(slug) {
   }
 }
 
+/** Join a session that is already running instead of starting one: open its tab, start nothing. */
+export function joinSession(slug, peer) {
+  if (!peer) return;
+  setState({ startPrompt: null, endConfirm: null }, () => openTermTab(slug, {
+    name: peer.name, st: peer.shown, profile: peer.profile || null,
+    /* The SERVER's id, and NO `spawn`. Both halves matter and they are the exact difference
+     * between joining and starting: `id` is the join, so the tab attaches to precisely the PTY the
+     * PM pointed at rather than matching by a name that repeats across repositories; the absent
+     * `spawn` is what withholds authorisation to create one. A peer described by
+     * treeShare.describeTenant always carries its id, so this is never a name-match in practice. */
+    id: peer.id || null,
+  }));
+}
+
+/** Dismiss the chooser without starting or joining anything. */
+export function dismissStartPrompt() {
+  setState({ startPrompt: null, endConfirm: null });
+}
+
 /** `⫽ split` / `⫽ unsplit` (lines 2088–2092). */
 export function toggleSplit() {
   setState((s) => {
@@ -226,7 +301,7 @@ const emptyState = el('div', {
   style: 'flex:1;display:grid;place-items:center;color:oklch(0.55 0.02 213);font-size:12.5px;padding:20px;text-align:center',
 }, "nothing open — click a task's output or an artifact, or ＋ session above");
 
-const panesRow = el('div', { style: 'flex:1;display:flex;min-height:0' });
+const panesRow = el('div', { style: 'flex:1;display:flex;min-height:0;min-width:0;overflow:hidden' });
 
 /* ── the scratchpad (lines 983–991) ──────────────────────────────────────────────────────────
  * One textarea, created once. Its text is written back as a CHILD TEXT NODE as well as a value,
@@ -432,9 +507,117 @@ function copyActive() {
   setTimeout(() => setState({ copied: false }), 1200);
 }
 
+/* ── the ＋ session chooser ──────────────────────────────────────────────────────────────────
+ *
+ * Shown INSTEAD of a spawn when the working tree already has live sessions. It answers, in this
+ * order, the three questions the old one-line notice left the PM holding:
+ *
+ *   what is running?      — every peer named, with the sidebar's own word for its state, the
+ *                           agent's last words, and the writer claim where one is held.
+ *   is it safe to end?    — one sentence per peer from lib/tree-share's `endRisk`, worded from the
+ *                           EVIDENCE. Only `needs you` gets a plain "nothing is in flight"; quiet
+ *                           and maybe-blocked say, in as many words, that the workspace cannot
+ *                           tell — because a confident "safe" that discards a running turn is
+ *                           exactly the false confidence this repo calls a watermelon.
+ *   can I just use it?    — `open it`, which attaches a tab to that session and starts NOTHING.
+ *
+ * `end it` is the one destructive control on this surface and it is two clicks: the first arms it
+ * and the button says what will happen, the second sends it. Nothing else here can lose work.
+ *
+ * Rebuilt on each render, deliberately: it holds no PTY and no caret, so there is nothing for a
+ * persistent node to protect, and a chooser rebuilt from state cannot show a session that has
+ * since exited.
+ */
+const RISK_COLOR = {
+  'in-flight': 'var(--warning)',
+  settled: 'var(--success)',
+  unknown: 'var(--muted-foreground)',
+  gone: 'var(--muted-foreground)',
+};
+const CH_BTN = 'flex:none;font-family:var(--mono);font-size:10.5px;padding:4px 10px;min-height:26px;'
+  + 'background:oklch(1 0 0 / 6%);border:1px solid oklch(1 0 0 / 12%);color:oklch(0.85 0.01 214);white-space:nowrap';
+
+function peerRow(prompt, p) {
+  const armed = state.endConfirm === p.id;
+  return el('div', {
+    style: 'display:flex;gap:10px;align-items:flex-start;padding:8px 10px;border:1px solid oklch(1 0 0 / 10%);background:oklch(1 0 0 / 3%)',
+  },
+    el('span', { style: 'flex:none;font-size:9px;line-height:18px;color:' + RISK_COLOR[p.risk.level] }, '●'),
+    el('div', { style: 'flex:1;min-width:0;display:flex;flex-direction:column;gap:2px' },
+      el('div', { style: 'display:flex;gap:8px;align-items:baseline;flex-wrap:wrap' },
+        el('span', { style: 'font-family:var(--mono);font-size:11.5px;color:oklch(0.95 0.01 214)' }, iv(p.name)),
+        el('span', { style: 'font-family:var(--mono);font-size:10.5px;color:oklch(0.72 0.014 214)' }, iv(p.label)),
+        p.agent ? el('span', { style: 'font-family:var(--mono);font-size:10px;color:oklch(0.55 0.02 213)' }, iv(p.agent)) : null,
+        p.writer ? el('span', {
+          style: 'font-family:var(--mono);font-size:9.5px;color:var(--brand);border:1px solid oklch(1 0 0 / 12%);padding:1px 5px',
+        }, 'writer') : null,
+      ),
+      // The agent's own last words, when the workspace could read them. Absent rather than
+      // substituted: a placeholder here would be a claim about a session nobody read.
+      p.doing ? el('div', {
+        style: 'font-family:var(--mono);font-size:10.5px;color:oklch(0.62 0.02 213);overflow:hidden;text-overflow:ellipsis;white-space:nowrap',
+      }, iv(p.doing)) : null,
+      el('div', { style: 'font-size:11px;color:' + RISK_COLOR[p.risk.level] + ';line-height:1.45' }, iv(p.risk.why)),
+    ),
+    el('div', { style: 'flex:none;display:flex;gap:6px;align-items:center' },
+      el('button', {
+        onClick: () => joinSession(prompt.slug, p),
+        style: CH_BTN + ';color:var(--brand)', hover: CHIP_HOVER,
+      }, 'open it'),
+      el('button', {
+        onClick: () => {
+          if (!armed) { setState({ endConfirm: p.id }); return; }
+          if (termMod && typeof termMod.killSession === 'function') termMod.killSession(p.id);
+          setState({ endConfirm: null });
+        },
+        style: CH_BTN + (armed ? ';color:var(--destructive);border-color:var(--destructive)' : ''),
+        hover: CHIP_HOVER,
+      }, iv(armed ? 'end “' + p.name + '” — click again' : 'end it')),
+    ),
+  );
+}
+
+function startPromptBlock() {
+  const prompt = state.startPrompt;
+  if (!prompt) return null;
+  const peers = prompt.peers || [];
+  const n = peers.length;
+  return el('div', {
+    style: 'flex:none;max-height:52vh;overflow-y:auto;display:flex;flex-direction:column;gap:8px;'
+      + 'padding:12px 14px;border-bottom:1px solid oklch(1 0 0 / 10%);background:oklch(0.11 0.004 228.8)',
+  },
+    el('div', { style: 'display:flex;gap:8px;align-items:baseline;flex-wrap:wrap' },
+      el('span', { style: 'font-size:12.5px;color:oklch(0.95 0.01 214)' },
+        iv('⑂ ' + n + ' session' + (n === 1 ? '' : 's') + ' already running in this working tree')),
+      el('span', { style: 'font-family:var(--mono);font-size:10.5px;color:oklch(0.55 0.02 213);overflow-wrap:anywhere' },
+        iv(prompt.tree + (prompt.branch ? ' · ' + prompt.branch : ''))),
+    ),
+    el('div', { style: 'font-size:11.5px;color:oklch(0.72 0.014 214);line-height:1.5' },
+      iv('You would share one branch, one index and one set of files with '
+        + (n === 1 ? 'it' : 'them') + '. Open one instead, end one, or start another anyway.')),
+    peers.map((p) => peerRow(prompt, p)),
+    el('div', { style: 'display:flex;gap:6px;flex-wrap:wrap;padding-top:2px' },
+      el('button', {
+        onClick: () => newSession(prompt.slug, { force: true }),
+        style: CH_BTN, hover: CHIP_HOVER,
+      }, '＋ start another session here anyway'),
+      el('button', { onClick: () => dismissStartPrompt(), style: CH_BTN, hover: CHIP_HOVER }, 'cancel'),
+    ),
+    // The limit, where the PM meets the feature — never only in a comment. PMOS hosts the terminal;
+    // it does not sit between an agent and the files, and no button above changes that.
+    el('div', { style: 'font-size:10.5px;color:oklch(0.52 0.02 213);line-height:1.5' },
+      'Nothing here is enforced: PMOS hosts your agent’s terminal, it does not sit between it and '
+      + 'the files. To work in parallel for real, start on a new branch with its own folder (⑂).'),
+  );
+}
+
 /* ── pane hosts ────────────────────────────────────────────────────────────────────────────── */
 
-const PANE_STYLE = 'flex:1;min-width:0;display:flex;flex-direction:column;border-right:1px solid oklch(1 0 0 / 10%)';
+/* `min-height:0` is load-bearing, not tidiness. A pane is a flex COLUMN whose body declares
+ * `flex:1;overflow-y:auto` — and a flex item's automatic minimum is its content, so without this
+ * the pane grows to fit a long document instead of letting the document scroll inside it, and the
+ * growth escapes upward until the whole page scrolls. See the chain documented in pm/app.js. */
+const PANE_STYLE = 'flex:1;min-width:0;min-height:0;display:flex;flex-direction:column;border-right:1px solid oklch(1 0 0 / 10%)';
 const paneHosts = new Map();          // tab id -> the pane element, kept for the tab's whole life
 
 function paneFor(tab) {
@@ -618,7 +801,12 @@ export function renderTabs(host) {
 
   setChildren(host, [
     tabBar,
-    visTabs.length === 0 ? emptyState : null,
+    // Above the panes and below the tab bar: the chooser is about the click that was just made in
+    // that bar, and putting it here leaves every open pane — and every live PTY — exactly where it
+    // was. Replacing the panes with it would re-parent a terminal, which is the quiet regression
+    // the persistent pane hosts exist to prevent.
+    startPromptBlock(),
+    visTabs.length === 0 && !state.startPrompt ? emptyState : null,
     panesRow,
     state.scratchOpen ? scratchBlock : null,
     bottomBar,

package/workspace/public/pm/state.js

@@ -38,6 +38,12 @@ function initial() {
     tabs: [], active: null, splitId: null,
     initLinks: {}, artLinks: {}, artSyncOpen: {}, artSyncState: {},
     extraSess: {}, termHist: {}, startN: 1, docEdits: {}, docModes: {},
+    /* `＋ session` into a working tree that already has sessions in it opens a CHOOSER instead of
+     * spawning (workspace-session-choice): `{slug, tree, branch, peers}` while it is open, null
+     * otherwise. `endConfirm` is the id of the one peer whose `end it` has been armed — a
+     * second click ends it, and anything else disarms. Neither is persisted: a chooser that
+     * reappeared on reload would be a question about a moment that has passed. */
+    startPrompt: null, endConfirm: null,
     col0: true, col1: true, col2: true, scratchOpen: false, scratchText: '', copied: false,
     flowsMap: null, schedList: null, agentList: null, memory: null,
     savedDocs: {}, scratchCopied: false,

package/workspace/public/pm/tab-doc.js

@@ -148,7 +148,7 @@ function viewBody(text) {
   const fm = [];
   doc.fm.forEach((fp) => { fm.push(el('span', { style: FM_K }, iv(fp.k)), el('span', { style: FM_V }, iv(fp.v))); });
   return el('div', {
-    style: 'flex:1;overflow-y:auto;background:var(--background);color:var(--foreground);padding:20px 24px 60px;font-size:14px;line-height:1.65',
+    style: 'flex:1;min-height:0;overflow-y:auto;background:var(--background);color:var(--foreground);padding:20px 24px 60px;font-size:14px;line-height:1.65',
   },
     el('div', { style: 'max-width:72ch' },
       el('div', {
@@ -171,7 +171,7 @@ function viewBody(text) {
 
 function rawBody(text) {
   return el('div', {
-    style: 'flex:1;overflow-y:auto;background:var(--background);padding:14px 16px;font-family:var(--mono);font-size:12px;line-height:1.7',
+    style: 'flex:1;min-height:0;overflow-y:auto;background:var(--background);padding:14px 16px;font-family:var(--mono);font-size:12px;line-height:1.7',
   }, text.split('\n').map((l) => {
     const ln = FX.rawLine(l);
     return el('div', {
@@ -183,7 +183,7 @@ function rawBody(text) {
 function diffBody(raw, text, dirty) {
   const rows = dirty ? FX.diffLines(raw, text) : [FX.NO_DIFF_ROW];
   return el('div', {
-    style: 'flex:1;overflow-y:auto;background:var(--background);padding:14px 0;font-family:var(--mono);font-size:12px;line-height:1.7',
+    style: 'flex:1;min-height:0;overflow-y:auto;background:var(--background);padding:14px 0;font-family:var(--mono);font-size:12px;line-height:1.7',
   }, rows.map((dr) => el('div', {
     style: 'color:' + dr.c + ';background:' + dr.bg + ';padding:0 16px;white-space:pre-wrap;overflow-wrap:anywhere;min-height:1.2em',
   }, iv(dr.t))));
@@ -197,7 +197,7 @@ function editBox(tab) {
   let ta = boxes.get(tab.id);
   if (ta) return ta;
   ta = el('textarea', {
-    style: 'flex:1;background:var(--background);color:var(--foreground);padding:14px 16px;font-family:var(--mono);font-size:12px;line-height:1.7',
+    style: 'flex:1;min-height:0;background:var(--background);color:var(--foreground);padding:14px 16px;font-family:var(--mono);font-size:12px;line-height:1.7',
     onInput: (e) => {
       const v = e.target.value;
       saveErr.delete(tab.path);
@@ -253,7 +253,7 @@ export function mountDoc(host, tab) {
   const dirtyColor = err ? 'var(--destructive)' : (dirty ? 'var(--warning)' : 'var(--muted-foreground)');
 
   const modeBar = el('div', {
-    style: 'display:flex;gap:2px;align-items:center;padding:6px 10px;border-bottom:1px solid var(--border);background:var(--background)',
+    style: 'flex:none;display:flex;gap:2px;align-items:center;padding:6px 10px;border-bottom:1px solid var(--border);background:var(--background)',
   },
     modeBtns, saveBtn, revertBtn,
     el('span', { style: 'margin-left:auto;font-family:var(--mono);font-size:10px;color:' + dirtyColor }, iv(dirtyLabel)),

package/workspace/public/pm/tab-task.js

@@ -52,7 +52,7 @@ export function mountTask(host, tab) {
       'no artifact yet — produced when the agent runs this task');
 
   const body = el('div', {
-    style: 'flex:1;overflow-y:auto;background:var(--background);color:var(--foreground);padding:22px 26px 60px;font-size:14px;line-height:1.65',
+    style: 'flex:1;min-height:0;overflow-y:auto;background:var(--background);color:var(--foreground);padding:22px 26px 60px;font-size:14px;line-height:1.65',
   },
     el('div', { style: 'max-width:76ch' },
       el('div', { style: 'display:flex;gap:10px;align-items:center;flex-wrap:wrap;margin-bottom:5px' },