create-pmos 0.245.0 → 0.247.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.245.0",
+  "version": "0.247.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@df74e9d
+kernel-source: pmos@47bc3dc
 assembled: 2026-10-15
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-15T03:51:47Z"}
+generated: {by: process:create-pmos, at: "2026-10-15T07:42:51Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-15T03:51:47Z"}
+generated: {by: process:create-pmos, at: "2026-10-15T07:42:51Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-15T03:51:47Z"}
+generated: {by: process:create-pmos, at: "2026-10-15T07:42:51Z"}
 status: stable
 ---
 

package/workspace/guide/layout.md

@@ -34,7 +34,7 @@ Settings holds settings only, in eight sections. On a wide screen they are cards
 - **Repositories**: every registered repository. Press a repository to make it the current one. Press its ⋯ for **Rename** or **Remove from PMOS**. Each asks in a sheet, and a remove asks you to confirm. **Add repository** shows the scan of a folder before you add it.
 - **Profiles**: the Claude profiles a session can start with. These are the descriptors in `~/.claude/profiles`, and also the profiles you already run: a shell command that sets `CLAUDE_CONFIG_DIR` (for example `alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'`), a launcher script named `claude-*`, or a config folder such as `~/.claude-work`. Each profile is a row with a **Detected** badge when PMOS found it rather than wrote it, and a **Default** badge when it is the default. Its ⋯ menu has **Use as default**. A profile found this way says where it was found, and a session under it sets only `CLAUDE_CONFIG_DIR`. The list reads again every few seconds while Settings is open, and **Look again** in the Claude profiles menu reads it at once. When nothing is found, the note names the start-up files and folders PMOS looked at. Press **New profile** to make one. This writes `~/.claude/profiles/<id>.json`. Account secrets are never shown in the browser.
 - **PMOS's own Claude login** (Claude sessions): a Claude login that only PMOS uses. A `/login` typed in a terminal replaces the account in `~/.claude`, and PMOS's background runs then fail with "OAuth session expired". Press **Set up**. PMOS makes the profile `pmos` (the folder `~/.claude-pmos`) and opens a Claude session under it. Type `/login` there and sign in once. Then press **Use for PMOS**. The row shows **In use**. Terminals keep working as before: sign in or switch there whenever you like, and PMOS's login is not touched. **Sign in again** opens the session again. PMOS never makes this the default by itself, and it holds no password.
-- **New sessions**: the default CLI, the default model, the default Claude profile and the default launch flags for a new session. The flags come from `claude --help`, for example `--chrome`. A flag that needs a value lists the values it accepts. The default profile is one setting for the whole workspace. PMOS keeps it on the server, so every browser, port and device starts a Claude session with the same profile. Choose it here or with "make … the default" in the New session form. Both change the same setting.
+- **New sessions**: the default CLI, the default model, the default Claude profile and the default launch flags for a new session. The flags come from `claude --help`, for example `--chrome`. A flag that needs a value lists the values it accepts. **Flags for automatic sessions** is a second list for the sessions PMOS starts for you, such as a scheduled brief. Such a session cannot answer a permission question, so it waits. Until you save a choice it starts with `--permission-mode=acceptEdits`, which ends the file-edit questions. A tool from a connector can still ask; allow it in your Claude settings or choose a looser mode here. The default profile is one setting for the whole workspace. PMOS keeps it on the server, so every browser, port and device starts a Claude session with the same profile. Choose it here or with "make … the default" in the New session form. Both change the same setting.
 - **Validate consent**: the consent of the current repository. Use its switch to turn it on or off. **Open Validate** opens the Validate page as a tab.
 - **People**: whether the morning brief keeps attendee names from the calendar for the current repository. It is off until you turn it on. Turning it off also hides the names recorded before.
 - **Online**: puts this workspace at your own address, such as `pmos.pm-os.app`, through a Cloudflare tunnel. Enter the public address, the tunnel name, your Cloudflare team domain, the Access audience (AUD) tag and your email, then turn on the **Online** switch. The workspace runs the tunnel and remembers the switch when it restarts. On your phone, open the address and sign in with Cloudflare Access (Google or an email code). The workspace does not ask for its token there. Only the computer that runs the workspace can change this section. A phone sees whether it is on. When a sign-in at the address is refused, this section names the check that failed, such as the email or the AUD tag. [REMOTE.md](../REMOTE.md) has the one-time Cloudflare steps.

package/workspace/guide/settings.md

@@ -32,7 +32,7 @@ Settings is not a tab. While it is open, no tab is selected. Press a tab to go b
 | Day and time | The time zone, the first day of the week, your working hours, the free time before a meeting with prep, the buffer between meetings, and the time-of-day tint and daylight strip. |
 | Sharing | How a report is shared: off, a link, or sent by the sender. The audiences of the workspace. Schedules are not here. Each report has its own schedule, in Reports, under Set up. |
 | Access and devices | Use from a phone or another computer: the host, the tunnel and the people who may open it. |
-| Claude sessions | What a new session starts with: the CLI, the model, the Claude profile and the launch flags. The session limits. Validate consent for this workspace. |
+| Claude sessions | What a new session starts with: the CLI, the model, the Claude profile and the launch flags for sessions you start, and the flags for automatic sessions. The session limits. Validate consent for this workspace. |
 | Privacy and data | A list of what leaves this computer and when. Whether a TypeSafe key is saved, the local model that answers when there is no key (Off, Winnow or Laya), and the data folder. |
 | Appearance | The theme (Same as system, Light or Dark) and the page that opens first. |
 | Updates | The version of the app and of each workspace's kit. Check for updates, and how updates are found and applied. |

package/workspace/lib/calendar-cli.js

@@ -1,7 +1,7 @@
 'use strict';
 /* calendar-cli.js — `pmos calendar …`: the calendar events an agent session read, saved for Briefing and Calendar
  * (workspace-data-freshness R8).
- *   pmos calendar import --from <file|-> --sensitivity public|internal|confidential|private [--dry-run] [--json]
+ *   pmos calendar import --from <file|-> --sensitivity public|internal|confidential|private [--window <from>..<to>] [--dry-run] [--json]
  *   pmos calendar status [--json]
  * This command never talks to a calendar. The calendar-sync skill reads it in an agent session, with the PM's own
  * connection, and hands the events to `import`. The import goes through scripts/calendar-import.js unchanged: hidden text
@@ -18,13 +18,14 @@ const L = require(repoScript('trust/ledger.js'));
 const COMMANDS = { calendar: ['import', 'status'] };
 const USAGE = [
   'usage: pmos calendar import|status — the calendar events an agent session read for Briefing and Calendar',
-  '  pmos calendar import --from <file|-> --sensitivity <label> [--dry-run]   save the events (the calendar-sync skill runs this)',
+  '  pmos calendar import --from <file|-> --sensitivity <label> [--window YYYY-MM-DD..YYYY-MM-DD] [--dry-run]   save the events (the calendar-sync skill runs this)',
+  '    --window: the days the events cover. Saved events in those days that are not in the file are removed (moved, declined, cancelled).',
   '  pmos calendar status                                   how many events are saved, and when they were read',
   '  every command: [--json]',
   'This command never calls a calendar. Your agent reads it with your own connection.',
 ];
 const BOOL = new Set(['json', 'dry-run', 'help']);
-const VALUE = new Set(['from', 'sensitivity']);
+const VALUE = new Set(['from', 'sensitivity', 'window']);
 
 function parseArgs(argv) {
   const out = { _: [] };
@@ -69,16 +70,25 @@ async function run(argv, { say = console.log, env = process.env, stateDir, stdin
   try { raw = JSON.parse(readInput(a.from, stdin)); } catch (e) { say(`✗ the events file is not JSON: ${String(e.message).slice(0, 160)}`); return 1; }
   const list = Array.isArray(raw) ? raw : raw && Array.isArray(raw.events) ? raw.events : null;
   if (!list) { say('✗ the file must hold a list of events, or { "events": [ … ] }'); return 1; }
+  let window;
+  if (a.window) {
+    const m = /^(\d{4}-\d{2}-\d{2})\.\.(\d{4}-\d{2}-\d{2})$/.exec(a.window);
+    if (!m) { say('✗ --window must look like 2026-10-15..2026-10-29'); return 2; }
+    window = { from: m[1], to: m[2] };
+    try { CI.checkWindow(window); } catch (e) { say(`✗ ${e.message}`); return 2; }
+  }
   const at = now().toISOString();
   let evs;
   try { evs = CI.importEvents(list, { fetchedAt: at, sensitivity: a.sensitivity }); }
   catch (e) { say(`✗ ${e.message}`); return 1; }
   if (a['dry-run']) { out({ ok: true, dryRun: true, count: evs.length }, `would save ${evs.length} events (dry run, nothing written)`); return 0; }
   const actor = L.actorFrom({ env, isTTY: isTTY == null ? !!(process.stdin.isTTY && process.stdout.isTTY) : isTTY });
-  try { CI.appendImport(file, evs, actor, at); }
+  let lines;
+  try { lines = CI.appendImport(file, evs, actor, at, { window }); }
   catch (e) { say(`✗ the events could not be saved: ${String(e.message).slice(0, 160)}`); return 1; }
+  const removed = lines.length - evs.length;
   const flagged = evs.filter((e) => e.findings && e.findings.length).length;
-  out({ ok: true, count: evs.length, flagged, read_at: at }, `✓ saved ${evs.length} calendar events${flagged ? ` (${flagged} carried hidden or suspicious text, marked)` : ''}`);
+  out({ ok: true, count: evs.length, removed, flagged, read_at: at }, `✓ saved ${evs.length} calendar events${removed ? `, removed ${removed} that the calendar no longer holds in those days` : ''}${flagged ? ` (${flagged} carried hidden or suspicious text, marked)` : ''}`);
   return 0;
 }
 

package/workspace/lib/driver-run.js

@@ -24,6 +24,12 @@ const D = require('./driver.js');
 const facts = require('./driver-facts.js');
 const proactive = require('./proactive.js');
 
+// A run that fails because the Claude login has expired fails again for every other target. Holding the next runs for this long (their
+// wakes stay queued) stops one expired login from filing hundreds of failed runs; the first run after the wait is the probe.
+const LOGIN_HOLD_MS = 30 * 60 * 1000;
+const LOGIN_RE = /failed to authenticate|oauth (session|token)|session expired|could not be refreshed|not logged in|invalid api key|authentication_error|\b401\b/i;
+const loginFailure = (r) => LOGIN_RE.test([r && r.note, r && r.result && r.result.text, r && r.result && r.result.error].filter(Boolean).join(' '));
+
 const off = (env) => /^(off|0|false|no)$/i.test(String((env || process.env).PMOS_DRIVER || '').trim());
 const hhmm = (ms) => { const d = new Date(ms); return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`; };
 const dayCheckOpen = (settings, now, inQuiet) => {
@@ -44,6 +50,7 @@ function readJsonl(f) {
 function create(deps) {
   const active = new Map();     // run id → { target, ledger, session }
   const lastSweep = new Map();  // ledger file → ms
+  let loginFailedAt = 0;        // ms of the last run that failed on the Claude login; new runs wait LOGIN_HOLD_MS after it
   const warn = deps.warn || (() => {});
   const gather = deps.gather || facts.gather;   // tests pass their own facts
 
@@ -122,6 +129,8 @@ function create(deps) {
     const res = (r && r.result) || {};
     const ok = !!(r && !r.timedOut && !r.stopped && r.code === 0 && res.ok && !res.isError);
     const reason = ok ? null : (r && r.note) || 'the run failed';
+    if (ok) loginFailedAt = 0;
+    else if (loginFailure(r)) loginFailedAt = Date.now();
     try {
       D.append(file, { ev: 'run-end', run: runId, ok, ...(reason ? { reason } : {}), ...(res.denied && res.denied.length ? { denied: res.denied } : {}),
         agent_run: agentRun(runId, target, ok) });
@@ -170,6 +179,7 @@ function create(deps) {
         }
         // Start what the rules allow.
         if (deps.headlessOff()) continue;   // a driver never runs in a pane
+        if (loginFailedAt && now - loginFailedAt < LOGIN_HOLD_MS) { summary.held = 'login'; continue; }   // wakes stay queued
         const running = [...active.values()];
         const p = D.plan(state, { now, running: active.size, activeTargets: running.map((r) => D.targetKey(r.target)) });
         for (const r of p.refused) { D.append(file, { ev: 'refused', target: r.target, wakes: r.wakes, reason: r.reason }, { now }); summary.refused++; }
@@ -191,4 +201,4 @@ function create(deps) {
   return { tick, active: () => [...active.keys()] };
 }
 
-module.exports = { create, off, dayCheckOpen };
+module.exports = { create, off, dayCheckOpen, loginFailure, LOGIN_HOLD_MS };

package/workspace/lib/engine/calendar-import.js

@@ -7,7 +7,7 @@
  *
  *   importEvents(rawEvents, { fetchedAt, sensitivity }) → [event]   pure; a missing or unknown sensitivity is refused
  *   foldEvents(lines)                                   → [event]   current events; the PM's notes survive a refresh
- *   appendImport(file, events, actor, now)              → lines     ledger append (scripts/trust/ledger.js)
+ *   appendImport(file, events, actor, now, {window})    → lines     ledger append (scripts/trust/ledger.js); a window removes the saved events of its days the import no longer holds
  *   appendNote(file, eventId, text, actor, now)         → line      a PM note on one event
  *   readLines(file) · cacheMarkdown(events, dir, now)   the Markdown cache is the PM's trust/import-calendar.js, unchanged
  */
@@ -52,6 +52,7 @@ function foldEvents(lines) {
   const by = new Map();
   for (const l of lines || []) {
     if (!l) continue;
+    if (l.kind === 'calendar_event_removed') { by.delete(l.event_id); continue; }
     if (l.kind === 'calendar_event' && l.event && l.event.id) {
       const prev = by.get(l.event.id);
       by.set(l.event.id, { ...l.event, agent_prep_notes: prev ? prev.agent_prep_notes : l.event.agent_prep_notes || '', pm_notes: prev ? prev.pm_notes : [] });
@@ -64,9 +65,33 @@ function foldEvents(lines) {
 
 const readLines = (file) => L.read(file);
 
-function appendImport(file, events, actor, now) {
+const DAY = /^\d{4}-\d{2}-\d{2}$/;
+/** A window is { from, to }, local days YYYY-MM-DD, from <= to. Throws on anything else. */
+function checkWindow(w) {
+  if (!w || !DAY.test(String(w.from)) || !DAY.test(String(w.to)) || String(w.from) > String(w.to)) throw new Error('window needs from and to as YYYY-MM-DD, from not after to');
+  return { from: String(w.from), to: String(w.to) };
+}
+/** The saved events a windowed import replaces: those that start inside the window (the day written in their `at`) and are not in the import. Pure. */
+function supersededIds(saved, imported, window) {
+  const w = checkWindow(window);
+  const keep = new Set((imported || []).map((e) => e.id));
+  return (saved || []).filter((e) => { const d = String(e.at || '').slice(0, 10); return d >= w.from && d <= w.to && !keep.has(e.id); }).map((e) => e.id);
+}
+
+// opts.window: the days this import covers. Saved events in those days that the import does not hold are removed (calendar_event_removed),
+// so a rescheduled, declined or cancelled meeting leaves the ledger. The ledger itself stays append only.
+function appendImport(file, events, actor, now, opts = {}) {
+  let gone = [];
+  if (opts.window) {
+    const w = checkWindow(opts.window);
+    if (!events.length) throw new Error('a window import needs at least one event: an empty read is not a calendar with no meetings');
+    gone = supersededIds(foldEvents(readLines(file)), events, w);
+  }
   fs.mkdirSync(path.dirname(file), { recursive: true });
-  return events.map((event) => L.append(file, { id: L.newId(), kind: 'calendar_event', why: 'calendar import (reported, untrusted)', at: now || new Date().toISOString(), event }, actor));
+  const at = now || new Date().toISOString();
+  const lines = events.map((event) => L.append(file, { id: L.newId(), kind: 'calendar_event', why: 'calendar import (reported, untrusted)', at, event }, actor));
+  for (const event_id of gone) lines.push(L.append(file, { id: L.newId(), kind: 'calendar_event_removed', why: 'not in the import for its days (rescheduled, declined or cancelled)', at, event_id }, actor));
+  return lines;
 }
 
 function appendNote(file, eventId, text, actor, now) {
@@ -81,4 +106,4 @@ function cacheMarkdown(events, dir, now) {
   return sampleCache.importEvents(events.map((e) => ({ id: e.id, title: e.title, start: e.at, end: e.end || e.at, attendees: e.attendees, initiative: e.initiative })), dir, now);
 }
 
-module.exports = { SENSITIVITY, importEvents, foldEvents, appendImport, appendNote, readLines, cacheMarkdown };
+module.exports = { SENSITIVITY, importEvents, foldEvents, appendImport, supersededIds, checkWindow, appendNote, readLines, cacheMarkdown };

package/workspace/lib/routes-calendar-import.js

@@ -2,7 +2,8 @@
 /* routes-calendar-import.js — cached calendar events, supplied by a session (console3 wave E2a).
  *
  *   GET  /api/calendar-import/events → { ok, events }           the folded cache
- *   POST /api/calendar-import/events { events, sensitivity }    → { ok, count }   page press; sensitivity is required
+ *   POST /api/calendar-import/events { events, sensitivity, window? } → { ok, count, removed }   page press; sensitivity is required;
+ *                                      window { from, to } (local days) removes the saved events of those days the import does not hold
  *   POST /api/calendar-import/note   { event_id, text }         → { ok }          the PM's note on an event
  *
  * Nothing here fetches a calendar: PMOS holds no credentials. Events come in the body. Imports are untrusted data
@@ -28,9 +29,11 @@ function importRoute(req, body, runtimeDir, now = new Date()) {
   let evs;
   try { evs = CI.importEvents(body.events, { fetchedAt: now.toISOString(), sensitivity: body.sensitivity }); }
   catch (e) { return fail(400, e.message); }
-  try { CI.appendImport(fileOf(runtimeDir), evs, L.actorFrom({ ui: true }), now.toISOString()); }
+  let removed = 0;
+  if (body.window) { try { CI.checkWindow(body.window); } catch (e) { return fail(400, e.message); } if (!evs.length) return fail(400, 'a window import needs at least one event'); }
+  try { removed = CI.appendImport(fileOf(runtimeDir), evs, L.actorFrom({ ui: true }), now.toISOString(), { window: body.window }).length - evs.length; }
   catch (e) { return fail(500, e.message); }
-  return { status: 200, body: { ok: true, count: evs.length } };
+  return { status: 200, body: { ok: true, count: evs.length, removed } };
 }
 
 function noteRoute(req, body, runtimeDir, now = new Date()) {

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.245.0",
+  "version": "0.247.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.245.0",
+      "version": "0.247.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.245.0",
+  "version": "0.247.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/c3-settings.js

@@ -25,6 +25,7 @@ import { button, SEL } from './primitives.js';
 import { pmGet, pmPost } from './http.js';
 import { c3ic } from './pm-work-view.js';
 import { sessionDefaults, setSessionDefaults } from './dock.js';
+import { flagPicker, flagsLine, flagsMissingValue } from './flag-picker.js';
 import { toast } from './c3-toast.js';
 import { dayPartOf } from './c3-daypart.js';
 import { finderBlock } from './c3-report-store.js';
@@ -147,7 +148,7 @@ export function mountSettings(host, ctx = {}) {
   ensureCss();
   const M = {
     sec: SECTIONS.some((s) => s[0] === ctx.section) ? ctx.section : 'about', q: '', ws: ctx.ws || '', data: null, err: {},
-    engine: null, people: null, consent: null, online: null, profiles: null, typesafe: null, kits: {}, kitBusy: null, app: { phase: null, error: '' }, about: null, running: null,
+    engine: null, flagList: null, autoFlags: null, flagFilter: '', flagsOpen: { mine: false, auto: false }, people: null, consent: null, online: null, profiles: null, typesafe: null, kits: {}, kitBusy: null, app: { phase: null, error: '' }, about: null, running: null,
     tplEdit: null, wsEdit: null, wsDrop: null, addPath: '',
     rf: null, rfLog: null, rfSig: '', rfFilter: 'all', rfEdit: null, rfAsk: null, rfErr: {}, rfAllBusy: false, rfLoading: false, logSource: '', logResult: '',
   };
@@ -191,6 +192,8 @@ export function mountSettings(host, ctx = {}) {
   function loadOnce() {
     pmGet('/api/online').then((r) => { M.online = r && r.ok !== false ? r : { error: (r && r.error) || 'not read' }; draw(); });
     pmGet('/api/profiles').then((r) => { M.profiles = r && r.ok !== false ? r : { error: (r && r.error) || 'not read', profiles: [] }; draw(); });
+    pmGet('/api/claude-flags').then((r) => { M.flagList = r || { ok: false, error: 'no answer', flags: [] }; draw(); });
+    pmGet('/api/auto-session-flags').then((r) => { M.autoFlags = r && r.ok !== false ? r : { error: (r && r.error) || 'not read', flags: [] }; draw(); });
     pmGet('/api/typesafe').then((r) => { M.typesafe = r && r.ok ? r.key : null; draw(); });
     pmGet('/api/proactive/settings').then((r) => { const s = r && r.ok && r.settings; M.about = s ? { name: s.name || '', role: (s.about || {}).role || '', work: (s.about || {}).work || '', duties: (s.about || {}).duties || '' } : { error: (r && r.error) || 'not read' }; draw(); });
     pmGet('/api/sessions').then((r) => { M.running = r && Array.isArray(r.sessions) ? r.sessions : null; draw(); });
@@ -541,6 +544,36 @@ export function mountSettings(host, ctx = {}) {
     ...later];
   }
 
+  /* Launch flags. 'mine': what a session you start begins with (kept in this browser, as the other defaults are).
+   * 'auto': what a session PMOS starts for you begins with (a schedule, a day run); kept on this computer, because no
+   * browser is open to answer a permission question when one fires. */
+  function flagsRow(which) {
+    const auto = which === 'auto';
+    const chosen = auto ? ((M.autoFlags && M.autoFlags.flags) || []) : sessionDefaults().flags;
+    const open = M.flagsOpen[which];
+    const save = async (next) => {
+      if (auto) {
+        const r = await pmPost('/api/auto-session-flags', { flags: next });
+        if (r && r.ok !== false) { M.autoFlags = r; delete M.err['sess.flags.auto']; toast('Saved: flags for automatic sessions'); }
+        else M.err['sess.flags.auto'] = (r && r.error) || 'Not saved.';
+      } else { setSessionDefaults({ flags: next }); toast('Saved: launch flags'); }
+      draw();
+    };
+    const missing = M.flagList ? flagsMissingValue(M.flagList, chosen) : [];
+    const control = el('div', { class: 'c3set-flags', 'data-c3set-flags': which },
+      el('p', { class: 'dim mono' }, chosen.length ? 'claude ' + flagsLine(chosen) : 'No flags.'),
+      missing.length ? el('p', { class: 'dim', role: 'alert' }, missing[0] + ' needs a value before it can be saved.') : null,
+      flagPicker({ list: M.flagList, chosen, filter: M.flagFilter, compact: !open, onFilter: (q) => { M.flagFilter = q; draw(); },
+        onChange: (next) => { if (auto && flagsMissingValue(M.flagList, next).length) { M.autoFlags = { ...M.autoFlags, flags: next }; draw(); } else save(next); } }),
+      btn(open ? 'Hide the full list' : 'Show every flag', { variant: 'ghost', onclick: () => { M.flagsOpen[which] = !open; draw(); }, attrs: { 'data-c3set-flags-all': which } }));
+    return frame(auto
+      ? { key: 'sess.flags.auto', label: 'Flags for automatic sessions', scope: 'computer', wide: true, control, err: M.err['sess.flags.auto'],
+        help: 'Sessions PMOS starts for you, such as a scheduled brief, cannot answer a permission question, so they wait. Set a permission mode here. Until you save a choice they start with --permission-mode=acceptEdits.',
+        note: M.autoFlags && M.autoFlags.saved === false ? 'Using the default. Change a flag to save your own.' : null }
+      : { key: 'sess.flags', label: 'Launch flags', scope: 'computer', wide: true, control,
+        help: 'Flags for the claude command when you start a session, such as a permission mode. You can change them for one session in the New session form.', note: 'Kept in this browser, as the dock keeps it.' });
+  }
+
   function sessionsSec() {
     const d = sessionDefaults(); const p = M.profiles;
     const profs = (p && p.profiles) || [];
@@ -559,7 +592,7 @@ export function mountSettings(host, ctx = {}) {
       extRow('sess.cli', seg('Start with', [['claude', 'Claude Code'], ['shell', 'A shell']], d.cli, (v) => setDef({ cli: v }, 'sess.cli', { cli: d.cli })), { scope: 'computer', note: 'Kept in this browser, as the dock keeps it.' }),
       extRow('sess.tier', seg('Model', [['auto', 'Auto'], ['fast', 'Fast'], ['balanced', 'Balanced'], ['deep', 'Deep']], d.tier, (v) => setDef({ tier: v }, 'sess.tier', { tier: d.tier })), { scope: 'computer' }),
       extRow('sess.profile', profileSelect('c3set-sess-profile'), { scope: 'computer', forId: 'c3set-sess-profile', note: profs.length ? null : p ? 'No profile was found. Make one in the classic app\'s Settings, Profiles (/classic.html).' : 'Reading profiles.' }),
-      lockedRow('sess.flags', 'Launch flags', 'Flags for the claude command, such as a permission mode.', 'Set when you start a session', 'computer')], 'term'),
+      flagsRow('mine'), flagsRow('auto')], 'term'),
     ownLoginSec(profs, def),
     profs.length ? sect('Profiles', [list(profRows), help('A new profile is made in the classic app\'s Settings, Profiles (/classic.html).')], { ic: 'user', count: profs.length }) : null,
     groupOf('sessions', 'Housekeeping', 'term'),

package/workspace/server.js

@@ -473,6 +473,22 @@ function writePrefs(prefs) {
   try { fs.writeFileSync(PREFS_FILE, JSON.stringify(prefs)); return null; }
   catch (e) { warnWriteFail('prefs.json (profile preselection)', e); return `the preference could not be saved — ${String((e && e.code) || 'write failed')}`; }
 }
+// Launch flags for AUTOMATIC Claude panes (a schedule, a day run, a refresh): the ones the PM did not press. They cannot answer a
+// permission question, so a pane that asks stays "Starting" for ever. The PM sets the flags here (Settings, New sessions);
+// until then a pane starts in acceptEdits, which ends the file-edit prompts. Headless runs have their own fixed tool lists.
+const AUTO_FLAGS_FILE = path.join(STATE, 'auto-session-flags.json');
+const AUTO_FLAGS_DEFAULT = Object.freeze([{ flag: '--permission-mode', value: 'acceptEdits' }]);
+function readAutoFlags() {
+  try {
+    const o = JSON.parse(fs.readFileSync(AUTO_FLAGS_FILE, 'utf8'));
+    if (o && Array.isArray(o.flags) && claudeFlags.resolve(o.flags, 'claude').ok) return { flags: o.flags.map((x) => ({ flag: x.flag, value: x.value || '' })), saved: true };
+  } catch { /* none saved, or unreadable: the default stands */ }
+  return { flags: AUTO_FLAGS_DEFAULT.map((x) => ({ ...x })), saved: false };
+}
+function writeAutoFlags(flags) {
+  try { fs.writeFileSync(AUTO_FLAGS_FILE, JSON.stringify({ flags })); return null; }
+  catch (e) { warnWriteFail('auto-session-flags.json', e); return `the flags could not be saved — ${String((e && e.code) || 'write failed')}`; }
+}
 // The default profile for an agent, for a start the PM pressed that named no profile at all (`undefined`). An explicit
 // null means "no profile" and is never replaced. A remembered id that no longer reads yields undefined: the start then
 // runs with no profile and says nothing it did not do, rather than failing on a preference the PM did not just choose.
@@ -3826,6 +3842,10 @@ function spawnSessionInner({ name, agent, cwd, ws, origin, initialInput, profile
   /* LAUNCH FLAGS (workspace-launch-flags). Checked against the generated claude flag list, and refused like a model
    * choice: a flag that cannot be honoured starts nothing. The tokens go AFTER the model's, and a flag the model
    * chips already own is refused by the list itself, so the two never both speak. */
+  // An automatic PANE (not a headless run) that was handed no flags takes the PM's automatic-session flags, so it never waits on a prompt nobody sees.
+  if (launchFlags === undefined && agent === 'claude' && sessionOrigin.isAutomatic(tag) && !(initialInput && headlessLib.kindFor({ agent, origin: tag, skill: modelAsk && modelAsk.skill }))) {
+    launchFlags = readAutoFlags().flags;
+  }
   const fres = claudeFlags.resolve(launchFlags, agent);
   if (!fres.ok) return exitedSession(base, workdir, `launch flag refused — ${fres.error}`);
   if (launchFlags !== undefined) base.launchFlags = fres.applied;
@@ -6660,6 +6680,19 @@ async function handleRequest(req, res) {
   }
   // Every flag `claude --help` lists, with whether the form may offer it (workspace-launch-flags). A static file.
   if (p === '/api/claude-flags' && req.method === 'GET') return json(res, claudeFlags.list());
+  // The flags automatic Claude panes start with (a schedule, a day run). Checked against the same list as every other launch.
+  if (p === '/api/auto-session-flags' && req.method === 'GET') { const a = readAutoFlags(); return json(res, { ok: true, flags: a.flags, saved: a.saved }); }
+  if (p === '/api/auto-session-flags' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const flags = Array.isArray(body.flags) ? body.flags.map((x) => ({ flag: x && x.flag, value: x && x.value ? String(x.value) : '' })) : null;
+    if (!flags) return json(res, { ok: false, error: 'flags must be a list' }, 400);
+    const chk = claudeFlags.resolve(flags, 'claude');
+    if (!chk.ok) return json(res, { ok: false, error: chk.error }, 400);
+    const err = writeAutoFlags(flags);
+    return err ? json(res, { ok: false, error: err }, 500) : json(res, { ok: true, flags, saved: true });
+  }
   /* Create one descriptor from the Settings form (workspace-launch-flags). It writes ONE file, ~/.claude/profiles/<id>.json,
    * and only when none by that name exists: PMOS never overwrites a descriptor the PM keeps. The file is read back through
    * the same reader every other surface uses, so a descriptor this route wrote that the reader would refuse is removed

package/workspace/skills/calendar-sync.skill

@@ -24,8 +24,8 @@ Procedure:
 1. List the PM's events from the start of today to the end of the 14th day after today, from the primary calendar. Fetch every page. Skip an event the PM declined.
 2. Write the events as JSON in the scratch folder, for example `<scratch>/calendar.json`, as a list with one object per event:
    `{"id", "title", "start", "end", "attendees": ["Display Name", …], "initiative": "<initiative id or null>"}`
-   `id` is the calendar's own id for that event (for a repeating meeting, the id of that one occurrence). Use the same id on every run, never a made-up one: PMOS keeps one copy per id.
+   `id` is the calendar's own id for that event (for a repeating meeting, the id of that one occurrence). Use the same id on every run, never a made-up one: PMOS keeps one copy per id. If an id changes anyway, the window import removes the old copy.
    `start` and `end` are ISO times with the offset, for example `2026-10-12T09:00:00+07:00`. An all-day event has the date only.
-3. Run `pmos calendar import --from <scratch>/calendar.json --sensitivity internal`. If it refuses the file, fix what it names and run it once more.
+3. Run `pmos calendar import --from <scratch>/calendar.json --sensitivity internal --window <today>..<day 14>`, with both days as `YYYY-MM-DD`. The window makes PMOS drop a saved event in those days that is not in the file, so a meeting that moved, was declined or was cancelled leaves its old slot. If it refuses the file, fix what it names and run it once more.
 4. Delete the scratch file.
 5. Report in four short lists: Imported (the count, and the first and last day), Left out (the count of private events), Not reached, and Needs you (only when something blocked the pull).

package/workspace/test-files.json

@@ -35,6 +35,7 @@
     "work-assigned.test.js",
     "briefing-real-data.test.js",
     "calendar-events.test.js",
+    "calendar-supersede.test.js",
     "tracker-read.test.js",
     "item-steps.test.js",
     "status-facts-panel.test.js",
@@ -186,6 +187,7 @@
     "work-assigned.test.js": 1,
     "briefing-real-data.test.js": 1,
     "calendar-events.test.js": 1,
+    "calendar-supersede.test.js": 1,
     "tracker-read.test.js": 1,
     "pm-brief-page-test.js": 30,
     "item-steps.test.js": 1,