create-pmos 0.245.0 → 0.246.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.245.0",
+  "version": "0.246.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@df74e9d
+kernel-source: pmos@0e2738a
 assembled: 2026-10-15
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-15T03:51:47Z"}
+generated: {by: process:create-pmos, at: "2026-10-15T05:12:16Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-15T03:51:47Z"}
+generated: {by: process:create-pmos, at: "2026-10-15T05:12:16Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-15T03:51:47Z"}
+generated: {by: process:create-pmos, at: "2026-10-15T05:12:16Z"}
 status: stable
 ---
 

package/workspace/guide/layout.md

@@ -34,7 +34,7 @@ Settings holds settings only, in eight sections. On a wide screen they are cards
 - **Repositories**: every registered repository. Press a repository to make it the current one. Press its ⋯ for **Rename** or **Remove from PMOS**. Each asks in a sheet, and a remove asks you to confirm. **Add repository** shows the scan of a folder before you add it.
 - **Profiles**: the Claude profiles a session can start with. These are the descriptors in `~/.claude/profiles`, and also the profiles you already run: a shell command that sets `CLAUDE_CONFIG_DIR` (for example `alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'`), a launcher script named `claude-*`, or a config folder such as `~/.claude-work`. Each profile is a row with a **Detected** badge when PMOS found it rather than wrote it, and a **Default** badge when it is the default. Its ⋯ menu has **Use as default**. A profile found this way says where it was found, and a session under it sets only `CLAUDE_CONFIG_DIR`. The list reads again every few seconds while Settings is open, and **Look again** in the Claude profiles menu reads it at once. When nothing is found, the note names the start-up files and folders PMOS looked at. Press **New profile** to make one. This writes `~/.claude/profiles/<id>.json`. Account secrets are never shown in the browser.
 - **PMOS's own Claude login** (Claude sessions): a Claude login that only PMOS uses. A `/login` typed in a terminal replaces the account in `~/.claude`, and PMOS's background runs then fail with "OAuth session expired". Press **Set up**. PMOS makes the profile `pmos` (the folder `~/.claude-pmos`) and opens a Claude session under it. Type `/login` there and sign in once. Then press **Use for PMOS**. The row shows **In use**. Terminals keep working as before: sign in or switch there whenever you like, and PMOS's login is not touched. **Sign in again** opens the session again. PMOS never makes this the default by itself, and it holds no password.
-- **New sessions**: the default CLI, the default model, the default Claude profile and the default launch flags for a new session. The flags come from `claude --help`, for example `--chrome`. A flag that needs a value lists the values it accepts. The default profile is one setting for the whole workspace. PMOS keeps it on the server, so every browser, port and device starts a Claude session with the same profile. Choose it here or with "make … the default" in the New session form. Both change the same setting.
+- **New sessions**: the default CLI, the default model, the default Claude profile and the default launch flags for a new session. The flags come from `claude --help`, for example `--chrome`. A flag that needs a value lists the values it accepts. **Flags for automatic sessions** is a second list for the sessions PMOS starts for you, such as a scheduled brief. Such a session cannot answer a permission question, so it waits. Until you save a choice it starts with `--permission-mode=acceptEdits`, which ends the file-edit questions. A tool from a connector can still ask; allow it in your Claude settings or choose a looser mode here. The default profile is one setting for the whole workspace. PMOS keeps it on the server, so every browser, port and device starts a Claude session with the same profile. Choose it here or with "make … the default" in the New session form. Both change the same setting.
 - **Validate consent**: the consent of the current repository. Use its switch to turn it on or off. **Open Validate** opens the Validate page as a tab.
 - **People**: whether the morning brief keeps attendee names from the calendar for the current repository. It is off until you turn it on. Turning it off also hides the names recorded before.
 - **Online**: puts this workspace at your own address, such as `pmos.pm-os.app`, through a Cloudflare tunnel. Enter the public address, the tunnel name, your Cloudflare team domain, the Access audience (AUD) tag and your email, then turn on the **Online** switch. The workspace runs the tunnel and remembers the switch when it restarts. On your phone, open the address and sign in with Cloudflare Access (Google or an email code). The workspace does not ask for its token there. Only the computer that runs the workspace can change this section. A phone sees whether it is on. When a sign-in at the address is refused, this section names the check that failed, such as the email or the AUD tag. [REMOTE.md](../REMOTE.md) has the one-time Cloudflare steps.

package/workspace/guide/settings.md

@@ -32,7 +32,7 @@ Settings is not a tab. While it is open, no tab is selected. Press a tab to go b
 | Day and time | The time zone, the first day of the week, your working hours, the free time before a meeting with prep, the buffer between meetings, and the time-of-day tint and daylight strip. |
 | Sharing | How a report is shared: off, a link, or sent by the sender. The audiences of the workspace. Schedules are not here. Each report has its own schedule, in Reports, under Set up. |
 | Access and devices | Use from a phone or another computer: the host, the tunnel and the people who may open it. |
-| Claude sessions | What a new session starts with: the CLI, the model, the Claude profile and the launch flags. The session limits. Validate consent for this workspace. |
+| Claude sessions | What a new session starts with: the CLI, the model, the Claude profile and the launch flags for sessions you start, and the flags for automatic sessions. The session limits. Validate consent for this workspace. |
 | Privacy and data | A list of what leaves this computer and when. Whether a TypeSafe key is saved, the local model that answers when there is no key (Off, Winnow or Laya), and the data folder. |
 | Appearance | The theme (Same as system, Light or Dark) and the page that opens first. |
 | Updates | The version of the app and of each workspace's kit. Check for updates, and how updates are found and applied. |

package/workspace/lib/driver-run.js

@@ -24,6 +24,12 @@ const D = require('./driver.js');
 const facts = require('./driver-facts.js');
 const proactive = require('./proactive.js');
 
+// A run that fails because the Claude login has expired fails again for every other target. Holding the next runs for this long (their
+// wakes stay queued) stops one expired login from filing hundreds of failed runs; the first run after the wait is the probe.
+const LOGIN_HOLD_MS = 30 * 60 * 1000;
+const LOGIN_RE = /failed to authenticate|oauth (session|token)|session expired|could not be refreshed|not logged in|invalid api key|authentication_error|\b401\b/i;
+const loginFailure = (r) => LOGIN_RE.test([r && r.note, r && r.result && r.result.text, r && r.result && r.result.error].filter(Boolean).join(' '));
+
 const off = (env) => /^(off|0|false|no)$/i.test(String((env || process.env).PMOS_DRIVER || '').trim());
 const hhmm = (ms) => { const d = new Date(ms); return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`; };
 const dayCheckOpen = (settings, now, inQuiet) => {
@@ -44,6 +50,7 @@ function readJsonl(f) {
 function create(deps) {
   const active = new Map();     // run id → { target, ledger, session }
   const lastSweep = new Map();  // ledger file → ms
+  let loginFailedAt = 0;        // ms of the last run that failed on the Claude login; new runs wait LOGIN_HOLD_MS after it
   const warn = deps.warn || (() => {});
   const gather = deps.gather || facts.gather;   // tests pass their own facts
 
@@ -122,6 +129,8 @@ function create(deps) {
     const res = (r && r.result) || {};
     const ok = !!(r && !r.timedOut && !r.stopped && r.code === 0 && res.ok && !res.isError);
     const reason = ok ? null : (r && r.note) || 'the run failed';
+    if (ok) loginFailedAt = 0;
+    else if (loginFailure(r)) loginFailedAt = Date.now();
     try {
       D.append(file, { ev: 'run-end', run: runId, ok, ...(reason ? { reason } : {}), ...(res.denied && res.denied.length ? { denied: res.denied } : {}),
         agent_run: agentRun(runId, target, ok) });
@@ -170,6 +179,7 @@ function create(deps) {
         }
         // Start what the rules allow.
         if (deps.headlessOff()) continue;   // a driver never runs in a pane
+        if (loginFailedAt && now - loginFailedAt < LOGIN_HOLD_MS) { summary.held = 'login'; continue; }   // wakes stay queued
         const running = [...active.values()];
         const p = D.plan(state, { now, running: active.size, activeTargets: running.map((r) => D.targetKey(r.target)) });
         for (const r of p.refused) { D.append(file, { ev: 'refused', target: r.target, wakes: r.wakes, reason: r.reason }, { now }); summary.refused++; }
@@ -191,4 +201,4 @@ function create(deps) {
   return { tick, active: () => [...active.keys()] };
 }
 
-module.exports = { create, off, dayCheckOpen };
+module.exports = { create, off, dayCheckOpen, loginFailure, LOGIN_HOLD_MS };

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.245.0",
+  "version": "0.246.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.245.0",
+      "version": "0.246.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.245.0",
+  "version": "0.246.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/c3-settings.js

@@ -25,6 +25,7 @@ import { button, SEL } from './primitives.js';
 import { pmGet, pmPost } from './http.js';
 import { c3ic } from './pm-work-view.js';
 import { sessionDefaults, setSessionDefaults } from './dock.js';
+import { flagPicker, flagsLine, flagsMissingValue } from './flag-picker.js';
 import { toast } from './c3-toast.js';
 import { dayPartOf } from './c3-daypart.js';
 import { finderBlock } from './c3-report-store.js';
@@ -147,7 +148,7 @@ export function mountSettings(host, ctx = {}) {
   ensureCss();
   const M = {
     sec: SECTIONS.some((s) => s[0] === ctx.section) ? ctx.section : 'about', q: '', ws: ctx.ws || '', data: null, err: {},
-    engine: null, people: null, consent: null, online: null, profiles: null, typesafe: null, kits: {}, kitBusy: null, app: { phase: null, error: '' }, about: null, running: null,
+    engine: null, flagList: null, autoFlags: null, flagFilter: '', flagsOpen: { mine: false, auto: false }, people: null, consent: null, online: null, profiles: null, typesafe: null, kits: {}, kitBusy: null, app: { phase: null, error: '' }, about: null, running: null,
     tplEdit: null, wsEdit: null, wsDrop: null, addPath: '',
     rf: null, rfLog: null, rfSig: '', rfFilter: 'all', rfEdit: null, rfAsk: null, rfErr: {}, rfAllBusy: false, rfLoading: false, logSource: '', logResult: '',
   };
@@ -191,6 +192,8 @@ export function mountSettings(host, ctx = {}) {
   function loadOnce() {
     pmGet('/api/online').then((r) => { M.online = r && r.ok !== false ? r : { error: (r && r.error) || 'not read' }; draw(); });
     pmGet('/api/profiles').then((r) => { M.profiles = r && r.ok !== false ? r : { error: (r && r.error) || 'not read', profiles: [] }; draw(); });
+    pmGet('/api/claude-flags').then((r) => { M.flagList = r || { ok: false, error: 'no answer', flags: [] }; draw(); });
+    pmGet('/api/auto-session-flags').then((r) => { M.autoFlags = r && r.ok !== false ? r : { error: (r && r.error) || 'not read', flags: [] }; draw(); });
     pmGet('/api/typesafe').then((r) => { M.typesafe = r && r.ok ? r.key : null; draw(); });
     pmGet('/api/proactive/settings').then((r) => { const s = r && r.ok && r.settings; M.about = s ? { name: s.name || '', role: (s.about || {}).role || '', work: (s.about || {}).work || '', duties: (s.about || {}).duties || '' } : { error: (r && r.error) || 'not read' }; draw(); });
     pmGet('/api/sessions').then((r) => { M.running = r && Array.isArray(r.sessions) ? r.sessions : null; draw(); });
@@ -541,6 +544,36 @@ export function mountSettings(host, ctx = {}) {
     ...later];
   }
 
+  /* Launch flags. 'mine': what a session you start begins with (kept in this browser, as the other defaults are).
+   * 'auto': what a session PMOS starts for you begins with (a schedule, a day run); kept on this computer, because no
+   * browser is open to answer a permission question when one fires. */
+  function flagsRow(which) {
+    const auto = which === 'auto';
+    const chosen = auto ? ((M.autoFlags && M.autoFlags.flags) || []) : sessionDefaults().flags;
+    const open = M.flagsOpen[which];
+    const save = async (next) => {
+      if (auto) {
+        const r = await pmPost('/api/auto-session-flags', { flags: next });
+        if (r && r.ok !== false) { M.autoFlags = r; delete M.err['sess.flags.auto']; toast('Saved: flags for automatic sessions'); }
+        else M.err['sess.flags.auto'] = (r && r.error) || 'Not saved.';
+      } else { setSessionDefaults({ flags: next }); toast('Saved: launch flags'); }
+      draw();
+    };
+    const missing = M.flagList ? flagsMissingValue(M.flagList, chosen) : [];
+    const control = el('div', { class: 'c3set-flags', 'data-c3set-flags': which },
+      el('p', { class: 'dim mono' }, chosen.length ? 'claude ' + flagsLine(chosen) : 'No flags.'),
+      missing.length ? el('p', { class: 'dim', role: 'alert' }, missing[0] + ' needs a value before it can be saved.') : null,
+      flagPicker({ list: M.flagList, chosen, filter: M.flagFilter, compact: !open, onFilter: (q) => { M.flagFilter = q; draw(); },
+        onChange: (next) => { if (auto && flagsMissingValue(M.flagList, next).length) { M.autoFlags = { ...M.autoFlags, flags: next }; draw(); } else save(next); } }),
+      btn(open ? 'Hide the full list' : 'Show every flag', { variant: 'ghost', onclick: () => { M.flagsOpen[which] = !open; draw(); }, attrs: { 'data-c3set-flags-all': which } }));
+    return frame(auto
+      ? { key: 'sess.flags.auto', label: 'Flags for automatic sessions', scope: 'computer', wide: true, control, err: M.err['sess.flags.auto'],
+        help: 'Sessions PMOS starts for you, such as a scheduled brief, cannot answer a permission question, so they wait. Set a permission mode here. Until you save a choice they start with --permission-mode=acceptEdits.',
+        note: M.autoFlags && M.autoFlags.saved === false ? 'Using the default. Change a flag to save your own.' : null }
+      : { key: 'sess.flags', label: 'Launch flags', scope: 'computer', wide: true, control,
+        help: 'Flags for the claude command when you start a session, such as a permission mode. You can change them for one session in the New session form.', note: 'Kept in this browser, as the dock keeps it.' });
+  }
+
   function sessionsSec() {
     const d = sessionDefaults(); const p = M.profiles;
     const profs = (p && p.profiles) || [];
@@ -559,7 +592,7 @@ export function mountSettings(host, ctx = {}) {
       extRow('sess.cli', seg('Start with', [['claude', 'Claude Code'], ['shell', 'A shell']], d.cli, (v) => setDef({ cli: v }, 'sess.cli', { cli: d.cli })), { scope: 'computer', note: 'Kept in this browser, as the dock keeps it.' }),
       extRow('sess.tier', seg('Model', [['auto', 'Auto'], ['fast', 'Fast'], ['balanced', 'Balanced'], ['deep', 'Deep']], d.tier, (v) => setDef({ tier: v }, 'sess.tier', { tier: d.tier })), { scope: 'computer' }),
       extRow('sess.profile', profileSelect('c3set-sess-profile'), { scope: 'computer', forId: 'c3set-sess-profile', note: profs.length ? null : p ? 'No profile was found. Make one in the classic app\'s Settings, Profiles (/classic.html).' : 'Reading profiles.' }),
-      lockedRow('sess.flags', 'Launch flags', 'Flags for the claude command, such as a permission mode.', 'Set when you start a session', 'computer')], 'term'),
+      flagsRow('mine'), flagsRow('auto')], 'term'),
     ownLoginSec(profs, def),
     profs.length ? sect('Profiles', [list(profRows), help('A new profile is made in the classic app\'s Settings, Profiles (/classic.html).')], { ic: 'user', count: profs.length }) : null,
     groupOf('sessions', 'Housekeeping', 'term'),

package/workspace/server.js

@@ -473,6 +473,22 @@ function writePrefs(prefs) {
   try { fs.writeFileSync(PREFS_FILE, JSON.stringify(prefs)); return null; }
   catch (e) { warnWriteFail('prefs.json (profile preselection)', e); return `the preference could not be saved — ${String((e && e.code) || 'write failed')}`; }
 }
+// Launch flags for AUTOMATIC Claude panes (a schedule, a day run, a refresh): the ones the PM did not press. They cannot answer a
+// permission question, so a pane that asks stays "Starting" for ever. The PM sets the flags here (Settings, New sessions);
+// until then a pane starts in acceptEdits, which ends the file-edit prompts. Headless runs have their own fixed tool lists.
+const AUTO_FLAGS_FILE = path.join(STATE, 'auto-session-flags.json');
+const AUTO_FLAGS_DEFAULT = Object.freeze([{ flag: '--permission-mode', value: 'acceptEdits' }]);
+function readAutoFlags() {
+  try {
+    const o = JSON.parse(fs.readFileSync(AUTO_FLAGS_FILE, 'utf8'));
+    if (o && Array.isArray(o.flags) && claudeFlags.resolve(o.flags, 'claude').ok) return { flags: o.flags.map((x) => ({ flag: x.flag, value: x.value || '' })), saved: true };
+  } catch { /* none saved, or unreadable: the default stands */ }
+  return { flags: AUTO_FLAGS_DEFAULT.map((x) => ({ ...x })), saved: false };
+}
+function writeAutoFlags(flags) {
+  try { fs.writeFileSync(AUTO_FLAGS_FILE, JSON.stringify({ flags })); return null; }
+  catch (e) { warnWriteFail('auto-session-flags.json', e); return `the flags could not be saved — ${String((e && e.code) || 'write failed')}`; }
+}
 // The default profile for an agent, for a start the PM pressed that named no profile at all (`undefined`). An explicit
 // null means "no profile" and is never replaced. A remembered id that no longer reads yields undefined: the start then
 // runs with no profile and says nothing it did not do, rather than failing on a preference the PM did not just choose.
@@ -3826,6 +3842,10 @@ function spawnSessionInner({ name, agent, cwd, ws, origin, initialInput, profile
   /* LAUNCH FLAGS (workspace-launch-flags). Checked against the generated claude flag list, and refused like a model
    * choice: a flag that cannot be honoured starts nothing. The tokens go AFTER the model's, and a flag the model
    * chips already own is refused by the list itself, so the two never both speak. */
+  // An automatic PANE (not a headless run) that was handed no flags takes the PM's automatic-session flags, so it never waits on a prompt nobody sees.
+  if (launchFlags === undefined && agent === 'claude' && sessionOrigin.isAutomatic(tag) && !(initialInput && headlessLib.kindFor({ agent, origin: tag, skill: modelAsk && modelAsk.skill }))) {
+    launchFlags = readAutoFlags().flags;
+  }
   const fres = claudeFlags.resolve(launchFlags, agent);
   if (!fres.ok) return exitedSession(base, workdir, `launch flag refused — ${fres.error}`);
   if (launchFlags !== undefined) base.launchFlags = fres.applied;
@@ -6660,6 +6680,19 @@ async function handleRequest(req, res) {
   }
   // Every flag `claude --help` lists, with whether the form may offer it (workspace-launch-flags). A static file.
   if (p === '/api/claude-flags' && req.method === 'GET') return json(res, claudeFlags.list());
+  // The flags automatic Claude panes start with (a schedule, a day run). Checked against the same list as every other launch.
+  if (p === '/api/auto-session-flags' && req.method === 'GET') { const a = readAutoFlags(); return json(res, { ok: true, flags: a.flags, saved: a.saved }); }
+  if (p === '/api/auto-session-flags' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const flags = Array.isArray(body.flags) ? body.flags.map((x) => ({ flag: x && x.flag, value: x && x.value ? String(x.value) : '' })) : null;
+    if (!flags) return json(res, { ok: false, error: 'flags must be a list' }, 400);
+    const chk = claudeFlags.resolve(flags, 'claude');
+    if (!chk.ok) return json(res, { ok: false, error: chk.error }, 400);
+    const err = writeAutoFlags(flags);
+    return err ? json(res, { ok: false, error: err }, 500) : json(res, { ok: true, flags, saved: true });
+  }
   /* Create one descriptor from the Settings form (workspace-launch-flags). It writes ONE file, ~/.claude/profiles/<id>.json,
    * and only when none by that name exists: PMOS never overwrites a descriptor the PM keeps. The file is read back through
    * the same reader every other surface uses, so a descriptor this route wrote that the reader would refuse is removed