create-pmos 0.20.0 → 0.21.0

package/README.md

@@ -333,6 +333,38 @@ Refreshes the skills, concepts, and scripts only. Your records — `state/`, `pl
 `okf/product/` — are yours, and an update never touches them. `pmos/KIT-VERSION` always says
 exactly what you're running.
 
+## What's new in 0.21.0
+
+**The workspace terminal's lines are no longer double-spaced.** Run
+`npx create-pmos@latest workspace`; the version bump means an existing install auto-upgrades.
+
+- **A terminal row is 20px instead of 26px.** Agent output in the terminal panel was rendering with
+  13.5px of empty space around a 12.5px character — and because agent CLIs print blank lines
+  between blocks, and those were 26px too, the whole transcript read as nearly double-spaced. It
+  now matches the spacing the workspace was designed with.
+- **Your agent gets more terminal.** This was never only cosmetic: the workspace divides the
+  panel's height by the row height to decide how many lines to tell the shell it has. The same
+  panel that reported 21 lines now reports 28, so full-screen agent interfaces have a third more
+  room to draw into.
+- *(If you are curious: the number `1.65` appeared twice in one file and meant two different things.
+  As a CSS rule it multiplies the font size — 12.5 × 1.65 = 20.6px, which is the design. Handed to
+  the terminal engine, the same number multiplies the font's own already-leaded box, which is 16px
+  — giving 26px. A comment in the file asserted the two agreed, which is how it survived.)*
+
+## What's new in 0.20.1
+
+**An HTML document opens rendered, not as its own source.** Opening an `.html` file in the
+workspace's document viewer showed you the markup instead of the page.
+
+## What's new in 0.20.0
+
+**External links name a real record instead of inventing one.** The Jira/Confluence/Docs link
+controls used to fabricate every identifier they recorded. A `＋` button now opens a form and
+records nothing until you supply the reference or a session resolves it — and `resolved` cannot be
+asserted, only evidenced: a row claiming it without naming the profile that resolved it is refused.
+PMOS still holds no credential and makes no outbound request; the lookup runs in an agent session
+carrying your own MCP.
+
 ## What's new in 0.19.0
 
 **A long document scrolls its own panel, and starting a session asks what is already running.** Run

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@ec75724
+kernel-source: pmos@ccaf639
 assembled: 2026-07-31
 mode: vendor

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.20.0",
+      "version": "0.21.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "private": true,
   "description": "PMOS Terminal Workspace \u2014 local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/index.html

@@ -40,6 +40,12 @@
      rather than only in a browser. pm/mobile.js reads it from the global; the module graph does not
      import it, because a second copy of the reducer is exactly the drift it was extracted to stop. -->
 <script src="/lib/mobile-nav.js"></script>
+<!-- ONE classifier, both sides (workspace-reader-preview). What the reader may do with a file —
+     markdown, escaped text, an HTML page, an image — is decided by this module, which server.js
+     requires for its read endpoints and the doc tab reads here as window.PreviewKind. A second
+     opinion about what an .html file is would mean the endpoint and the pane disagreeing about the
+     same document. Classic script (a UMD), like the three above. -->
+<script src="/lib/preview-kind.js"></script>
 <link rel="preload" href="/vendor/ibm-plex-mono-500.woff2" as="font" type="font/woff2" crossorigin />
 </head>
 <body>

package/workspace/public/pm/tab-doc.js

@@ -1,8 +1,13 @@
 /* pm/tab-doc.js — the document tab body: view · raw · edit · diff, with save, revert and a dirty flag.
  *
  * A port of the prototype's doc pane (template lines 869–927, derivation 2020–2045). The four modes
- * are the whole design: `view` renders the markdown, `raw` shows the file tinted by line kind,
+ * are the whole design: `view` renders the document, `raw` shows the file tinted by line kind,
  * `edit` is the buffer, and `diff` is a real LCS line diff of the buffer against what is on disk.
+ *
+ * `view` renders the markdown — EXCEPT for an HTML file, which is a page, not prose. Handing one to
+ * the markdown parser prints its own markup back at the PM: the document read as its source code.
+ * So an `.html` document renders, in `view`, as the page it is; `raw` is the one click that still
+ * shows the code. See `htmlFrame` for why rendering it is not a new privilege.
  * The diff is COMPUTED, never narrated — a "2 sections differ" that nothing read is the watermelon
  * this repo has a word for, and the same rule that governs artifact sync governs this pane.
  *
@@ -31,6 +36,7 @@ const iv = (v) => el('span', null, v === null || v === undefined ? '' : String(v
 const disk = new Map();        // path -> text read from this machine
 const pending = new Set();     // paths whose read is in flight
 const saveErr = new Map();     // path -> why the last save was refused
+const unread = new Set();      // paths whose read FAILED — what `disk` holds for them is a stub
 
 let dataMod = null;
 import('./data.js').then((m) => { dataMod = m; }).catch(() => { dataMod = null; });
@@ -77,9 +83,12 @@ function requestDoc(tab) {
     : fetch('/api/doc?ws=' + encodeURIComponent(wsId()) + '&path=' + encodeURIComponent(path))
       .then((r) => (r.ok ? r.text() : Promise.reject(new Error('HTTP ' + r.status))));
   Promise.resolve(load).then(
-    (text) => done(typeof text === 'string' ? text : String(text == null ? '' : text)),
-    (e) => done(stub(tab, 'This file could not be read: ' + (e && e.message ? e.message : e)
-      + '\n\nNothing was rendered from it. That is the failure being stated rather than an empty page shown.')),
+    (text) => { unread.delete(path); done(typeof text === 'string' ? text : String(text == null ? '' : text)); },
+    (e) => {
+      unread.add(path);
+      done(stub(tab, 'This file could not be read: ' + (e && e.message ? e.message : e)
+        + '\n\nNothing was rendered from it. That is the failure being stated rather than an empty page shown.'));
+    },
   );
 }
 
@@ -180,6 +189,71 @@ function rawBody(text) {
   }));
 }
 
+/* ── the HTML page body ────────────────────────────────────────────────────────────────────────
+ *
+ * `previewKind` is the single classifier both sides of this app already trust (server.js requires
+ * it; index.html loads it as a classic script), so "what counts as HTML" is decided in exactly one
+ * place and cannot drift from the read endpoints. If it somehow did not load, `isHtmlDoc` answers
+ * false and the pane behaves exactly as it did before — a missing classifier degrades to the old
+ * view, never to an unclassified render.
+ */
+const isHtmlDoc = (p) => {
+  const PK = typeof window !== 'undefined' ? window.PreviewKind : null;
+  if (!PK || typeof PK.previewKind !== 'function') return false;
+  return PK.previewKind(String(p || '')) === 'html';
+};
+
+/* A STUB IS NOT THE DOCUMENT, AND MUST NOT BE RENDERED AS ONE. When a read is in flight or has
+ * failed, `docText` hands back this pane's own prose — "reading …", or the failure with its reason.
+ * Rendering that inside a frame would bury the one sentence the PM needs behind an iframe boundary,
+ * and an .html file that could not be read would look like an empty page: the exact "never a blank
+ * page" rule this pane already keeps for every other kind. So a page is drawn only from text that
+ * genuinely came from disk (or from an edit saved in this window). A reference URI never renders —
+ * nothing was read from it to render. */
+function rendersAsPage(tab) {
+  const p = tab.path;
+  if (!isHtmlDoc(p) || isReference(p)) return false;
+  if (state.savedDocs[p] != null) return true;
+  if (FIXTURE) return true;
+  return disk.has(p) && !unread.has(p);
+}
+
+/* Rendering an HTML document adds no privilege over showing it. The frame is fully sandboxed —
+ * `sandbox=""` grants nothing, so scripts and same-origin access are both denied — and the injected
+ * CSP is `default-src 'none'`, which blocks every network fetch the page could attempt. A poisoned
+ * explainer therefore can neither execute nor beacon out, which is the same no-remote-fetch-on-view
+ * invariant the markdown image rule holds (R4). Only inline styles, data: images and data: fonts
+ * resolve — enough for a page to look like itself, not enough to reach anything. */
+const HTML_CSP = '<meta http-equiv="Content-Security-Policy" content="'
+  + "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:" + '">';
+
+const frames = new Map();     // tab id -> { text, node } — the frame currently showing that text
+
+/* THE FRAME IS NEVER RE-POINTED, IT IS REPLACED. Writing a new `srcdoc` onto a frame that is
+ * already in the document does navigate it — but the replacement document does NOT get the meta
+ * CSP applied to its subresource loads, so the remote <link>s in the new page are fetched. That
+ * is not a theory: the panel-4 suite opens `web/index.html`, whose remote font stylesheet went out
+ * exactly this way, and the containment assertion caught it. Setting `srcdoc` BEFORE the frame is
+ * inserted is enforced correctly, so a text change builds a new frame and the old one is dropped.
+ *
+ * The cache is therefore keyed on the TEXT, not just the tab: a repaint that changed nothing hands
+ * back the identical node — which is what `setChildren` needs to leave a live frame alone — while a
+ * changed document gets a frame built from scratch. The cost is that saving an open HTML file
+ * returns it to the top; the alternative is a page that renders contained only until it is edited. */
+function htmlFrame(tab, text) {
+  const cur = frames.get(tab.id);
+  if (cur && cur.text === text) return cur.node;
+  const node = el('iframe', {
+    style: 'flex:1;min-height:0;width:100%;border:0;background:var(--background)',
+    sandbox: '',                        // no allow-scripts, no allow-same-origin
+    referrerpolicy: 'no-referrer',
+    title: String(tab.path || 'document'),
+    srcdoc: HTML_CSP + text,            // set HERE, on a node not yet in the document — see above
+  });
+  frames.set(tab.id, { text, node });
+  return node;
+}
+
 function diffBody(raw, text, dirty) {
   const rows = dirty ? FX.diffLines(raw, text) : [FX.NO_DIFF_ROW];
   return el('div', {
@@ -212,6 +286,7 @@ function editBox(tab) {
 /** Release what a closed doc tab held. Called by panel-tabs.js when the tab goes away. */
 export function disposeDoc(id) {
   boxes.delete(id);
+  frames.delete(id);
 }
 
 /* ── mount ─────────────────────────────────────────────────────────────────────────────────── */
@@ -270,7 +345,7 @@ export function mountDoc(host, tab) {
      * genuinely differs, which is what keeps the caret still mid-sentence. */
     if (body.defaultValue !== text) body.defaultValue = text;
     if (body.value !== text) body.value = text;
-  } else body = viewBody(text);
+  } else body = rendersAsPage(tab) ? htmlFrame(tab, text) : viewBody(text);
 
   setChildren(host, [modeBar, body]);
   return host;

package/workspace/public/pm/tab-term.js

@@ -37,7 +37,9 @@
  *      so the first real metrics arrive after the woff2 lands).
  *
  * The xterm palette is the DESIGN's: `--term-bg` for the background — dark in both themes, D41 —
- * and IBM Plex Mono at the design's 12.5px / 1.65. xterm's colour parser does not understand
+ * and IBM Plex Mono at the design's 12.5px. Its LINE HEIGHT is not the design's 1.65: that number
+ * is a CSS line-height and xterm's option of the same name is not one, so it is converted rather
+ * than copied — see TERM_LINE_HEIGHT. xterm's colour parser does not understand
  * `oklch()`, so the token is resolved to a concrete sRGB value at runtime (canvas round-trip, with
  * the pre-computed hex as the fallback) rather than handed to xterm as written.
  */
@@ -446,6 +448,31 @@ if (typeof window !== 'undefined') {
 
 /* ── fixture pane ──────────────────────────────────────────────────────────────────────────── */
 
+/* ── one terminal row ────────────────────────────────────────────────────────────────────────
+ * TWO pane kinds, TWO different meanings for the same number, and that is the whole of the defect
+ * this constant exists to keep fixed.
+ *
+ *   FAUX SHELL (fixture) — SCROLL_STYLE below. `line-height:1.65` is CSS: a unitless multiplier on
+ *   the FONT SIZE. One line box is 12.5 × 1.65 = 20.625px. That is the PM's prototype, ported
+ *   character for character (planning/design/four-panel/prototype-original.html:929), and it is
+ *   also the value design-parity.js compares. It was never wrong; leave it alone.
+ *
+ *   LIVE TERMINAL (real) — the xterm options. `lineHeight` there is xterm's OWN option, and its
+ *   renderer computes `cell.height = floor(char.height × lineHeight)` where `char.height` is the
+ *   font's MEASURED glyph box — 16px for IBM Plex Mono at 12.5px, already carrying the leading the
+ *   typeface ships with. So xterm's number adds leading ON TOP OF leading where CSS's replaces it.
+ *
+ * Passing the design's CSS 1.65 straight into xterm therefore rendered floor(1.65 × 16) = 26px
+ * rows against a 20.625px reference — 26% looser than the design, 13.5px of empty space around a
+ * 12.5px glyph — and the header comment at the top of this file recorded the belief that the two
+ * agreed. Measured in Chromium against the served woff2: 1.0 → 16px, 1.2 → 19px, 1.3 → 20px,
+ * 1.65 → 26px. 1.3 is the ratio that reproduces the design's line box through xterm's formula.
+ *
+ * It is not paint-only: addon-fit divides the pane height by the cell height to pick `rows`, and
+ * syncSize() sends that to the PTY. At 26px a 565px pane told the shell it had 21 rows; at 20px it
+ * tells it 28. The row height IS how much terminal the agent CLI gets to draw into.
+ */
+const TERM_LINE_HEIGHT = 1.3;
 const SCROLL_STYLE = 'flex:1;min-height:0;overflow-y:auto;padding:14px 16px;font-family:var(--mono);font-size:12.5px;line-height:1.65;color:#c4ccce';
 const LINE_STYLE = (c) => 'color:' + c + ';white-space:pre-wrap;overflow-wrap:anywhere';
 const PROMPT_ROW_STYLE = 'display:flex;gap:8px;align-items:baseline';
@@ -542,7 +569,10 @@ function buildReal(tab) {
   const term = new Terminal({
     fontFamily: '"IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, Consolas, monospace',
     fontSize: 12.5,
-    lineHeight: 1.65,
+    // NOT the design's 1.65 — and that is the whole point. See TERM_LINE_HEIGHT above: xterm's
+    // `lineHeight` multiplies the font's MEASURED box, where the design's CSS number multiplies the
+    // font size. Handing the CSS number to xterm is what made a row 26px instead of 20.6px.
+    lineHeight: TERM_LINE_HEIGHT,
     theme: xtheme(),
     cursorBlink: true,
     scrollback: 5000,