create-pmos 0.20.0 → 0.20.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@ec75724
+kernel-source: pmos@1d54a27
 assembled: 2026-07-31
 mode: vendor

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "private": true,
   "description": "PMOS Terminal Workspace \u2014 local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/index.html

@@ -40,6 +40,12 @@
      rather than only in a browser. pm/mobile.js reads it from the global; the module graph does not
      import it, because a second copy of the reducer is exactly the drift it was extracted to stop. -->
 <script src="/lib/mobile-nav.js"></script>
+<!-- ONE classifier, both sides (workspace-reader-preview). What the reader may do with a file —
+     markdown, escaped text, an HTML page, an image — is decided by this module, which server.js
+     requires for its read endpoints and the doc tab reads here as window.PreviewKind. A second
+     opinion about what an .html file is would mean the endpoint and the pane disagreeing about the
+     same document. Classic script (a UMD), like the three above. -->
+<script src="/lib/preview-kind.js"></script>
 <link rel="preload" href="/vendor/ibm-plex-mono-500.woff2" as="font" type="font/woff2" crossorigin />
 </head>
 <body>

package/workspace/public/pm/tab-doc.js

@@ -1,8 +1,13 @@
 /* pm/tab-doc.js — the document tab body: view · raw · edit · diff, with save, revert and a dirty flag.
  *
  * A port of the prototype's doc pane (template lines 869–927, derivation 2020–2045). The four modes
- * are the whole design: `view` renders the markdown, `raw` shows the file tinted by line kind,
+ * are the whole design: `view` renders the document, `raw` shows the file tinted by line kind,
  * `edit` is the buffer, and `diff` is a real LCS line diff of the buffer against what is on disk.
+ *
+ * `view` renders the markdown — EXCEPT for an HTML file, which is a page, not prose. Handing one to
+ * the markdown parser prints its own markup back at the PM: the document read as its source code.
+ * So an `.html` document renders, in `view`, as the page it is; `raw` is the one click that still
+ * shows the code. See `htmlFrame` for why rendering it is not a new privilege.
  * The diff is COMPUTED, never narrated — a "2 sections differ" that nothing read is the watermelon
  * this repo has a word for, and the same rule that governs artifact sync governs this pane.
  *
@@ -31,6 +36,7 @@ const iv = (v) => el('span', null, v === null || v === undefined ? '' : String(v
 const disk = new Map();        // path -> text read from this machine
 const pending = new Set();     // paths whose read is in flight
 const saveErr = new Map();     // path -> why the last save was refused
+const unread = new Set();      // paths whose read FAILED — what `disk` holds for them is a stub
 
 let dataMod = null;
 import('./data.js').then((m) => { dataMod = m; }).catch(() => { dataMod = null; });
@@ -77,9 +83,12 @@ function requestDoc(tab) {
     : fetch('/api/doc?ws=' + encodeURIComponent(wsId()) + '&path=' + encodeURIComponent(path))
       .then((r) => (r.ok ? r.text() : Promise.reject(new Error('HTTP ' + r.status))));
   Promise.resolve(load).then(
-    (text) => done(typeof text === 'string' ? text : String(text == null ? '' : text)),
-    (e) => done(stub(tab, 'This file could not be read: ' + (e && e.message ? e.message : e)
-      + '\n\nNothing was rendered from it. That is the failure being stated rather than an empty page shown.')),
+    (text) => { unread.delete(path); done(typeof text === 'string' ? text : String(text == null ? '' : text)); },
+    (e) => {
+      unread.add(path);
+      done(stub(tab, 'This file could not be read: ' + (e && e.message ? e.message : e)
+        + '\n\nNothing was rendered from it. That is the failure being stated rather than an empty page shown.'));
+    },
   );
 }
 
@@ -180,6 +189,71 @@ function rawBody(text) {
   }));
 }
 
+/* ── the HTML page body ────────────────────────────────────────────────────────────────────────
+ *
+ * `previewKind` is the single classifier both sides of this app already trust (server.js requires
+ * it; index.html loads it as a classic script), so "what counts as HTML" is decided in exactly one
+ * place and cannot drift from the read endpoints. If it somehow did not load, `isHtmlDoc` answers
+ * false and the pane behaves exactly as it did before — a missing classifier degrades to the old
+ * view, never to an unclassified render.
+ */
+const isHtmlDoc = (p) => {
+  const PK = typeof window !== 'undefined' ? window.PreviewKind : null;
+  if (!PK || typeof PK.previewKind !== 'function') return false;
+  return PK.previewKind(String(p || '')) === 'html';
+};
+
+/* A STUB IS NOT THE DOCUMENT, AND MUST NOT BE RENDERED AS ONE. When a read is in flight or has
+ * failed, `docText` hands back this pane's own prose — "reading …", or the failure with its reason.
+ * Rendering that inside a frame would bury the one sentence the PM needs behind an iframe boundary,
+ * and an .html file that could not be read would look like an empty page: the exact "never a blank
+ * page" rule this pane already keeps for every other kind. So a page is drawn only from text that
+ * genuinely came from disk (or from an edit saved in this window). A reference URI never renders —
+ * nothing was read from it to render. */
+function rendersAsPage(tab) {
+  const p = tab.path;
+  if (!isHtmlDoc(p) || isReference(p)) return false;
+  if (state.savedDocs[p] != null) return true;
+  if (FIXTURE) return true;
+  return disk.has(p) && !unread.has(p);
+}
+
+/* Rendering an HTML document adds no privilege over showing it. The frame is fully sandboxed —
+ * `sandbox=""` grants nothing, so scripts and same-origin access are both denied — and the injected
+ * CSP is `default-src 'none'`, which blocks every network fetch the page could attempt. A poisoned
+ * explainer therefore can neither execute nor beacon out, which is the same no-remote-fetch-on-view
+ * invariant the markdown image rule holds (R4). Only inline styles, data: images and data: fonts
+ * resolve — enough for a page to look like itself, not enough to reach anything. */
+const HTML_CSP = '<meta http-equiv="Content-Security-Policy" content="'
+  + "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:" + '">';
+
+const frames = new Map();     // tab id -> { text, node } — the frame currently showing that text
+
+/* THE FRAME IS NEVER RE-POINTED, IT IS REPLACED. Writing a new `srcdoc` onto a frame that is
+ * already in the document does navigate it — but the replacement document does NOT get the meta
+ * CSP applied to its subresource loads, so the remote <link>s in the new page are fetched. That
+ * is not a theory: the panel-4 suite opens `web/index.html`, whose remote font stylesheet went out
+ * exactly this way, and the containment assertion caught it. Setting `srcdoc` BEFORE the frame is
+ * inserted is enforced correctly, so a text change builds a new frame and the old one is dropped.
+ *
+ * The cache is therefore keyed on the TEXT, not just the tab: a repaint that changed nothing hands
+ * back the identical node — which is what `setChildren` needs to leave a live frame alone — while a
+ * changed document gets a frame built from scratch. The cost is that saving an open HTML file
+ * returns it to the top; the alternative is a page that renders contained only until it is edited. */
+function htmlFrame(tab, text) {
+  const cur = frames.get(tab.id);
+  if (cur && cur.text === text) return cur.node;
+  const node = el('iframe', {
+    style: 'flex:1;min-height:0;width:100%;border:0;background:var(--background)',
+    sandbox: '',                        // no allow-scripts, no allow-same-origin
+    referrerpolicy: 'no-referrer',
+    title: String(tab.path || 'document'),
+    srcdoc: HTML_CSP + text,            // set HERE, on a node not yet in the document — see above
+  });
+  frames.set(tab.id, { text, node });
+  return node;
+}
+
 function diffBody(raw, text, dirty) {
   const rows = dirty ? FX.diffLines(raw, text) : [FX.NO_DIFF_ROW];
   return el('div', {
@@ -212,6 +286,7 @@ function editBox(tab) {
 /** Release what a closed doc tab held. Called by panel-tabs.js when the tab goes away. */
 export function disposeDoc(id) {
   boxes.delete(id);
+  frames.delete(id);
 }
 
 /* ── mount ─────────────────────────────────────────────────────────────────────────────────── */
@@ -270,7 +345,7 @@ export function mountDoc(host, tab) {
      * genuinely differs, which is what keeps the caret still mid-sentence. */
     if (body.defaultValue !== text) body.defaultValue = text;
     if (body.value !== text) body.value = text;
-  } else body = viewBody(text);
+  } else body = rendersAsPage(tab) ? htmlFrame(tab, text) : viewBody(text);
 
   setChildren(host, [modeBar, body]);
   return host;