create-pmos 0.243.0 → 0.245.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.243.0",
+  "version": "0.245.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@ad62a21
+kernel-source: pmos@df74e9d
 assembled: 2026-10-15
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-15T01:32:11Z"}
+generated: {by: process:create-pmos, at: "2026-10-15T03:51:47Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-15T01:32:11Z"}
+generated: {by: process:create-pmos, at: "2026-10-15T03:51:47Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-15T01:32:11Z"}
+generated: {by: process:create-pmos, at: "2026-10-15T03:51:47Z"}
 status: stable
 ---
 

package/workspace/c3-settings-test.js

@@ -73,6 +73,9 @@ async function waitFor(page, fn, arg, ms = 8000) {
     ok(`B2 section ${id} draws`, drew);
   }
 
+  await page.click('[data-c3set-nav] [data-c3set-sec="sessions"]');
+  ok('B3 Claude sessions has the PMOS own-login row with Set up', await waitFor(page, () => { const r = document.querySelector('[data-c3set-section="sessions"] [data-c3set-own]'); const b = r && r.querySelector('[data-c3set-own-signin]'); return !!b && /Set up/.test(b.textContent) && !r.querySelector('[data-c3set-own-use]'); }, null, 4000));
+
   /* ── C: search ── */
   await page.fill('[data-c3set-search]', 'language');
   ok('C1 search finds the recording language', await waitFor(page, () => !!document.querySelector('[data-c3set-body] [data-c3set-row="notes.language"]')));

package/workspace/guide/layout.md

@@ -33,6 +33,7 @@ Settings holds settings only, in eight sections. On a wide screen they are cards
 
 - **Repositories**: every registered repository. Press a repository to make it the current one. Press its ⋯ for **Rename** or **Remove from PMOS**. Each asks in a sheet, and a remove asks you to confirm. **Add repository** shows the scan of a folder before you add it.
 - **Profiles**: the Claude profiles a session can start with. These are the descriptors in `~/.claude/profiles`, and also the profiles you already run: a shell command that sets `CLAUDE_CONFIG_DIR` (for example `alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'`), a launcher script named `claude-*`, or a config folder such as `~/.claude-work`. Each profile is a row with a **Detected** badge when PMOS found it rather than wrote it, and a **Default** badge when it is the default. Its ⋯ menu has **Use as default**. A profile found this way says where it was found, and a session under it sets only `CLAUDE_CONFIG_DIR`. The list reads again every few seconds while Settings is open, and **Look again** in the Claude profiles menu reads it at once. When nothing is found, the note names the start-up files and folders PMOS looked at. Press **New profile** to make one. This writes `~/.claude/profiles/<id>.json`. Account secrets are never shown in the browser.
+- **PMOS's own Claude login** (Claude sessions): a Claude login that only PMOS uses. A `/login` typed in a terminal replaces the account in `~/.claude`, and PMOS's background runs then fail with "OAuth session expired". Press **Set up**. PMOS makes the profile `pmos` (the folder `~/.claude-pmos`) and opens a Claude session under it. Type `/login` there and sign in once. Then press **Use for PMOS**. The row shows **In use**. Terminals keep working as before: sign in or switch there whenever you like, and PMOS's login is not touched. **Sign in again** opens the session again. PMOS never makes this the default by itself, and it holds no password.
 - **New sessions**: the default CLI, the default model, the default Claude profile and the default launch flags for a new session. The flags come from `claude --help`, for example `--chrome`. A flag that needs a value lists the values it accepts. The default profile is one setting for the whole workspace. PMOS keeps it on the server, so every browser, port and device starts a Claude session with the same profile. Choose it here or with "make … the default" in the New session form. Both change the same setting.
 - **Validate consent**: the consent of the current repository. Use its switch to turn it on or off. **Open Validate** opens the Validate page as a tab.
 - **People**: whether the morning brief keeps attendee names from the calendar for the current repository. It is off until you turn it on. Turning it off also hides the names recorded before.

package/workspace/lib/headless.js

@@ -217,6 +217,11 @@ function parseResult(stdout) {
   };
 }
 
+/** Did the run fail because Claude is signed out on this computer? The CLI prints "Failed to authenticate: OAuth session expired…" and exits 1. */
+const SIGNED_OUT_RE = /failed to authenticate|oauth (?:session|token) (?:has )?expired|could not be refreshed|please run \/login|not logged in|invalid (?:api key|bearer token)|authentication_error/i;
+const signedOut = (text) => SIGNED_OUT_RE.test(String(text || ''));
+const SIGNED_OUT_WHY = 'Claude is signed out on this computer. Open Terminal, run `claude`, type /login and sign in. PMOS carries on by itself afterwards.';
+
 const oneLine = (v, max) => { const t = String(v == null ? '' : v).replace(/\s+/g, ' ').trim(); return t.length > max ? t.slice(0, max - 1) + '…' : t; };
 // The one argument that says what a tool call does: the command, the file, the pattern, the address.
 function toolWhat(input) {
@@ -260,17 +265,19 @@ function outcomeOf(r, { code = null, signal = null, timedOut = false, stopped =
   const first = String(res.text || '').split('\n').map((x) => x.replace(/^[#>*\-\s]+/, '').trim()).find(Boolean) || '';
   const denied = Array.isArray(res.denied) ? res.denied : [];
   const base = { turns: res.turns == null ? null : res.turns, durationMs: res.durationMs == null ? null : res.durationMs, denied };
+  const auth = !timedOut && !stopped && signedOut(res.text);
   const ok = !timedOut && !stopped && !signal && code === 0 && res.ok && !res.isError;
   if (ok) return { ok: true, headline: oneLine(first || 'Finished. It wrote no summary.', 160), why: null, ...base };
   let why;
   if (stopped) why = 'Stopped by you.';
   else if (timedOut) why = `Stopped: still running after ${timeoutMin || Math.round(DEFAULT_TIMEOUT_MS / 60000)} minutes.`;
   else if (signal) why = `The process was ended (${signal}).`;
+  else if (signedOut(res.text)) why = SIGNED_OUT_WHY;
   else if (!res.ok) why = `It exited with code ${code} and printed no result${res.text ? ': ' + oneLine(res.text.split('\n').filter(Boolean).pop(), 200) : '.'}`;
   else if (res.isError) why = `The run reported an error${first ? ': ' + oneLine(first, 200) : '.'}`;
   else why = `It exited with code ${code}.`;
   if (denied.length) why += ` Not allowed in a background run: ${denied.join(', ')}.`;
-  return { ok: false, headline: null, why, ...base };
+  return { ok: false, headline: null, why, ...(auth ? { auth: true } : {}), ...base };
 }
 
 function logLines(r, exitCode) {
@@ -284,4 +291,4 @@ function logLines(r, exitCode) {
   return out;
 }
 
-module.exports = { HEADLESS_SKILLS, HEADLESS_ORIGINS, ASK_ORIGINS, DRIVE_ORIGINS, SCAN_WEB_ORIGINS, SCAN_REPO_ORIGINS, SCAN_RESEARCH_WEB_ORIGINS, SCAN_RESEARCH_REPO_ORIGINS, WEB_KINDS, REPORT_SETUP_ORIGINS, REPORT_FIND_ORIGINS, CORE_DOC_ORIGINS, REPORT_DESIGN_ORIGINS, REPORT_SAMPLE_FETCH_ORIGINS, REPORT_STRUCTURE_ORIGINS, REPORT_STRUCTURE_DRY_ORIGINS, TOOLS, DEFAULT_TIMEOUT_MS, kindFor, argsFor, timeoutMs, parseResult, streamLines, outcomeOf, logLines, switchedOff };
+module.exports = { HEADLESS_SKILLS, HEADLESS_ORIGINS, ASK_ORIGINS, DRIVE_ORIGINS, SCAN_WEB_ORIGINS, SCAN_REPO_ORIGINS, SCAN_RESEARCH_WEB_ORIGINS, SCAN_RESEARCH_REPO_ORIGINS, WEB_KINDS, REPORT_SETUP_ORIGINS, REPORT_FIND_ORIGINS, CORE_DOC_ORIGINS, REPORT_DESIGN_ORIGINS, REPORT_SAMPLE_FETCH_ORIGINS, REPORT_STRUCTURE_ORIGINS, REPORT_STRUCTURE_DRY_ORIGINS, TOOLS, DEFAULT_TIMEOUT_MS, kindFor, argsFor, timeoutMs, parseResult, streamLines, outcomeOf, signedOut, SIGNED_OUT_WHY, logLines, switchedOff };

package/workspace/lib/meeting-focus.js

@@ -24,6 +24,7 @@
 const CATS = Object.freeze(['Answer', 'Fact check', 'Decision', 'Time', 'Topics', 'Context', 'Prep', 'Follow-up']);
 const REF_TYPES = Object.freeze(['initiative', 'plan-item', 'release', 'item', 'jira', 'ask', 'report', 'note', 'decision', 'portfolio', 'event']);
 const MIN_GAP_MS = 40000;          // the companion runs at most this often per note
+const AUTH_WAIT_MS = 120000;       // after a run found Claude signed out, wait this long before the next try
 const TAIL_MINUTES = 5;            // how much of the talk the companion reads
 const TAIL_MAX = 40;               // and at most this many lines
 const TOPICS_MAX = 8;
@@ -231,7 +232,7 @@ function foldState(lines, { topics = [], startMs = null, nowMs = Date.now() } =
     return byKey.get(k);
   };
   for (const t of topics) addTopic(t.text || t, t.src || 'steps');
-  let current = null; const runs = []; let gist = ''; let chips = []; const notes = []; let seen = 0; let lastRunAt = 0; let pending = false; let error = null;
+  let current = null; const runs = []; let gist = ''; let chips = []; const notes = []; let seen = 0; let lastRunAt = 0; let pending = false; let error = null; let authAt = 0;
   const asks = new Map();
   const close = (at) => { const r = runs[runs.length - 1]; if (r && r.to == null) r.to = at; };
   const switchTo = (row, at) => { if (!row || (current && current.id === row.id && runs.length && runs[runs.length - 1].to == null)) return; close(at); row.parked = false; current = row; runs.push({ topic: row.id, from: at, to: null }); };
@@ -240,9 +241,9 @@ function foldState(lines, { topics = [], startMs = null, nowMs = Date.now() } =
     if (!l || typeof l !== 'object') continue;
     const at = Number.isFinite(l.at) ? l.at : 0;
     if (l.k === 'run') { lastRunAt = at; seen = Number.isFinite(l.lines) ? l.lines : seen; pending = true; }
-    else if (l.k === 'fail') { if (!l.id) { pending = false; error = str(l.error, 200) || 'The companion did not answer.'; } else if (asks.has(l.id)) asks.get(l.id).state = 'failed', asks.get(l.id).error = str(l.error, 200); }
+    else if (l.k === 'fail') { if (!l.id) { pending = false; error = str(l.error, 200) || 'The companion did not answer.'; authAt = l.auth ? at : 0; } else if (asks.has(l.id)) asks.get(l.id).state = 'failed', asks.get(l.id).error = str(l.error, 200); }
     else if (l.k === 'out') {
-      pending = false; error = null;
+      pending = false; error = null; authAt = 0;
       if (l.gist) gist = l.gist;
       if (Array.isArray(l.chips)) chips = l.chips;
       const tp = l.topic || {};
@@ -271,7 +272,7 @@ function foldState(lines, { topics = [], startMs = null, nowMs = Date.now() } =
     const state = current && current.id === r.id ? 'now' : r.parked ? 'parked' : spent(r.id) > 0 ? 'discussed' : 'notyet';
     return { id: r.id, text: r.text, src: r.src, state, minutes, ...(r.at ? { at: r.at } : {}), ...(r.by ? { by: r.by } : {}) };
   });
-  return { gist, chips, current: current ? current.id : null, topics: outTopics, runs: outRuns, notes, seen, last_run_at: lastRunAt, pending, asks: [...asks.values()], error };
+  return { gist, chips, current: current ? current.id : null, topics: outTopics, runs: outRuns, notes, seen, last_run_at: lastRunAt, pending, asks: [...asks.values()], error, auth_at: authAt };
 }
 
 /* ── when the companion runs ────────────────────────────────────────────────────────────────────────────────────── */
@@ -283,6 +284,7 @@ const off = (env) => /^(off|0|false|no)$/i.test(String((env || process.env).PMOS
 function shouldRun(now, state, note, opts = {}) {
   const st = state || {};
   if (off(opts.env)) return { run: false, reason: 'off' };
+  if (st.auth_at && now - st.auth_at < AUTH_WAIT_MS) return { run: false, reason: 'signed out' };
   if (!note || note.state !== 'recording') return { run: false, reason: 'not recording' };
   if (st.pending && st.last_run_at && now - st.last_run_at < (opts.timeoutMs || 20 * 60000)) return { run: false, reason: 'busy' };
   if (!(note.lines > (st.seen || 0))) return { run: false, reason: 'no new lines' };

package/workspace/lib/own-profile.js

@@ -0,0 +1,37 @@
+'use strict';
+/*
+ * lib/own-profile.js — PMOS's own Claude profile (initiative claude-own-login).
+ *
+ * By default a background run and a terminal session both use Claude Code's own folder, ~/.claude. A /login typed in a
+ * terminal then replaces the account PMOS's background runs use, and they fail with "OAuth session expired". PMOS holds no
+ * credential and cannot copy a login, so it can only keep the two apart: a profile of its own, `pmos`, whose
+ * CLAUDE_CONFIG_DIR is ~/.claude-pmos. The PM signs in to it once; terminal sessions (which take no profile) never touch it.
+ *
+ *   ensure(homeDir, profilesDir) → { ok, id, dir, created } | { ok:false, error }
+ *       makes ~/.claude-pmos (mode 0700) and ~/.claude/profiles/pmos.json when they are missing. It never overwrites a
+ *       descriptor that exists, and it never sets the default: that is a separate press, after the PM has signed in.
+ */
+const fs = require('fs');
+const path = require('path');
+
+const ID = 'pmos';
+const dirOf = (home) => path.join(home, '.claude-pmos');
+
+function ensure(home, profilesDir) {
+  const dir = dirOf(home);
+  const file = path.join(profilesDir, ID + '.json');
+  try {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.mkdirSync(profilesDir, { recursive: true, mode: 0o700 });
+  } catch (e) { return { ok: false, error: 'the folders could not be made — ' + String((e && e.code) || (e && e.message) || 'write failed').slice(0, 120) }; }
+  const desc = { id: ID, label: 'PMOS', env: { CLAUDE_CONFIG_DIR: dir } };
+  try {
+    fs.writeFileSync(file, JSON.stringify(desc, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+    return { ok: true, id: ID, dir, created: true };
+  } catch (e) {
+    if (e && e.code === 'EEXIST') return { ok: true, id: ID, dir, created: false };
+    return { ok: false, error: 'the profile could not be written — ' + String((e && e.code) || (e && e.message) || 'write failed').slice(0, 120) };
+  }
+}
+
+module.exports = { ID, dirOf, ensure };

package/workspace/lib/routes-meeting-focus.js

@@ -129,6 +129,7 @@ function settleRun(ctx, key, done, now) {
   const res = done && done.result;
   if (done && done.stopped) return append(ctx.runtimeDir, key + '.jsonl', { k: 'fail', at, error: 'The run was stopped before it answered.' });
   if (done && done.timedOut) return append(ctx.runtimeDir, key + '.jsonl', { k: 'fail', at, error: 'The companion took too long and was stopped.' });
+  if (res && headless.signedOut(res.text)) return append(ctx.runtimeDir, key + '.jsonl', { k: 'fail', at, auth: true, error: headless.SIGNED_OUT_WHY });
   if (!res || !res.ok || res.isError) return append(ctx.runtimeDir, key + '.jsonl', { k: 'fail', at, error: 'The companion did not answer (' + ((done && done.note) || 'no result') + ').' });
   const parsed = F.parseCompanion(res.text);
   // a malformed answer is dropped, not shown

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.243.0",
+  "version": "0.245.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.243.0",
+      "version": "0.245.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.243.0",
+  "version": "0.245.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/c3-settings.js

@@ -560,6 +560,7 @@ export function mountSettings(host, ctx = {}) {
       extRow('sess.tier', seg('Model', [['auto', 'Auto'], ['fast', 'Fast'], ['balanced', 'Balanced'], ['deep', 'Deep']], d.tier, (v) => setDef({ tier: v }, 'sess.tier', { tier: d.tier })), { scope: 'computer' }),
       extRow('sess.profile', profileSelect('c3set-sess-profile'), { scope: 'computer', forId: 'c3set-sess-profile', note: profs.length ? null : p ? 'No profile was found. Make one in the classic app\'s Settings, Profiles (/classic.html).' : 'Reading profiles.' }),
       lockedRow('sess.flags', 'Launch flags', 'Flags for the claude command, such as a permission mode.', 'Set when you start a session', 'computer')], 'term'),
+    ownLoginSec(profs, def),
     profs.length ? sect('Profiles', [list(profRows), help('A new profile is made in the classic app\'s Settings, Profiles (/classic.html).')], { ic: 'user', count: profs.length }) : null,
     groupOf('sessions', 'Housekeeping', 'term'),
     sect('Running now' + (M.running ? ' · ' + run.length + (max ? ' of ' + max : '') : ''), [M.running ? (run.length ? list(runRows) : fold(null, 'No sessions running.')) : fold(null, 'Reading the sessions.'),
@@ -567,6 +568,31 @@ export function mountSettings(host, ctx = {}) {
     M.ws ? group('Workspace', [extRow('validate.consent', M.consent && !M.consent.error ? swBtn(M.consent.on, EXT['validate.consent'][2], async () => { const r = await pmPost('/api/validate/repo', { ws: M.ws, consent: !M.consent.on }); if (r && r.ok !== false) { M.consent.on = !!r.consent; toast('Saved: validate consent'); } else M.err['validate.consent'] = (r && r.error) || 'Not saved.'; draw(); }) : el('span', { class: 'dim' }, M.consent ? M.consent.error : 'Reading'), { scope: 'ws' })], 'term') : null];
   }
 
+  /* PMOS's own Claude login (claude-own-login): a profile of its own, so a /login typed in a terminal never signs PMOS out. */
+  async function ownSignIn() {
+    delete M.err['sess.own'];
+    const made = await pmPost('/api/profiles/own', {});
+    if (!made || !made.ok) { M.err['sess.own'] = (made && made.error) || 'The profile was not made.'; draw(); return; }
+    const term = await import('./tab-term.js').catch(() => null);
+    const res = term ? await term.requestSpawn({ name: 'Sign in · PMOS Claude', agent: 'claude', profile: made.id, ws: M.ws, start: true, workType: 'general' }) : null;
+    pmGet('/api/profiles').then((r) => { M.profiles = r && r.ok !== false ? r : M.profiles; draw(); });
+    if (!res || !res.ok) { M.err['sess.own'] = (res && res.error) || 'The session did not start.'; draw(); return; }
+    const m = await import('./c3-session-term.js');
+    m.openSessionTerm({ id: res.id, name: 'Sign in · PMOS Claude' });
+    toast('Type /login in the terminal and sign in. Then press Use for PMOS.');
+  }
+  function ownLoginSec(profs, def) {
+    const own = profs.find((x) => x.id === 'pmos');
+    const using = !!own && def === 'pmos';
+    return sect('PMOS\'s own Claude login', [
+      help('A /login typed in a terminal replaces the account PMOS uses in the background. Give PMOS its own login and a terminal can never sign it out. Terminal sessions keep working as they do now: sign in or switch there whenever you like.'),
+      el('div', { class: 'iacts', 'data-c3set-own': '' },
+        using ? tag('In use', 'ok') : null,
+        btn(own ? 'Sign in again' : 'Set up', { variant: own && !using ? 'outline' : using ? 'ghost' : 'primary', attrs: { 'data-c3set-own-signin': '' }, disabled: !M.ws, onclick: ownSignIn }),
+        own && !using ? btn('Use for PMOS', { variant: 'primary', attrs: { 'data-c3set-own-use': '' }, onclick: () => chooseProfile('pmos') }) : null),
+      M.err['sess.own'] ? fold('alert', M.err['sess.own'], 'w') : null], { ic: 'user' });
+  }
+
   function privacySec() {
     const w = M.engine && M.engine.whisper; const j = M.engine && M.engine.jev; const o = M.online;
     const jevOn = !!(j && (j.jev || j.check));

package/workspace/server.js

@@ -6707,6 +6707,15 @@ async function handleRequest(req, res) {
     }
     return json(res, { ok: true, profile: profileWire(made, read), path: file });
   }
+  /* PMOS's own Claude profile (lib/own-profile.js): makes ~/.claude-pmos and the descriptor `pmos`, once. It does not make it the
+   * default and holds no login: the PM signs in to it in a session, then presses Make default. */
+  if (p === '/api/profiles/own' && req.method === 'POST') {
+    const made = require('./lib/own-profile.js').ensure(os.homedir(), profilesLib.profilesDir(os.homedir()));
+    if (!made.ok) return json(res, { ok: false, error: made.error }, 500);
+    const read = readProfilesNow();
+    if (!(read.profiles || []).some((x) => x.id === made.id)) return json(res, { ok: false, error: 'the PMOS profile was written but could not be read back' }, 500);
+    return json(res, { ok: true, id: made.id, created: made.created });
+  }
   if (p === '/api/profiles/prefer' && req.method === 'POST') {
     let body = {};
     try { body = JSON.parse((await readBody(req)) || '{}'); }

package/workspace/test-files.json

@@ -8,6 +8,7 @@
     "test.js"
   ],
   "modules": [
+    "own-profile.test.js",
     "stage-tools.test.js",
     "report-template-cadence.test.js",
     "proactive.test.js",