create-pmos 0.36.0 → 0.38.0

package/workspace/lib/memory.js

@@ -0,0 +1,54 @@
+'use strict';
+/* memory.js — the workspace's door to curated repository memory (D72).
+ *
+ * The ledger code is ONE file, scripts/pmos-memory.js, shared with the CLI agents run. It is loaded the
+ * way the workflow engine is: from the checkout two directories up, or from the copy the packaging step
+ * vendors into lib/engine/. No server code appends to memory.jsonl except through it.
+ */
+const fs = require('fs');
+const path = require('path');
+
+const PATHS = [
+  path.join(__dirname, '..', '..', 'scripts', 'pmos-memory.js'),
+  path.join(__dirname, 'engine', 'pmos-memory.js'),
+];
+function core() {
+  for (const p of PATHS) {
+    if (!fs.existsSync(p)) continue;
+    try { return { ok: true, core: require(p) }; }
+    catch (e) { return { ok: false, error: `the memory tool at ${p} failed to load — ${String((e && e.message) || e).slice(0, 160)}` }; }
+  }
+  return { ok: false, error: 'the memory tool is not present in this install' };
+}
+
+const MARK = '<!-- pmos:memory -->';
+const END = '<!-- /pmos:memory -->';
+function rel(root, p) { return path.relative(root, p).split(path.sep).join('/'); }
+function toolPath(root) { return fs.existsSync(path.join(root, 'pmos', 'scripts', 'pmos-memory.js')) ? 'pmos/scripts/pmos-memory.js' : 'scripts/pmos-memory.js'; }
+function wired(root) {
+  try { return fs.readFileSync(path.join(root, 'CLAUDE.md'), 'utf8').includes(MARK); } catch { return false; }
+}
+/* Wire the repository's CLAUDE.md to import the two snapshot views. Idempotent; appends one marked
+ * block and never touches anything else in the file. Only ever called on the PM's press. */
+function wire(root) {
+  const c = core(); if (!c.ok) return c;
+  const dir = c.core.memDir(root, true);
+  c.core.render(root);
+  if (wired(root)) return { ok: true, changed: false };
+  const file = path.join(root, 'CLAUDE.md');
+  let cur = ''; try { cur = fs.readFileSync(file, 'utf8'); } catch { /* new file */ }
+  const block = [MARK, `@${rel(root, path.join(dir, 'MEMORY.md'))}`, `@${rel(root, path.join(dir, 'USER.md'))}`, '',
+    'The two files above are this repository\'s curated memory, read once at session start (D72). Save a new durable fact with:',
+    `\`node ${toolPath(root)} add --text "…" --source "kind:ref"\` (add \`--target user\` for a preference of the PM). Do not edit the files by hand: they are generated.`,
+    'An entry is unconfirmed until the PM confirms it; say so when you rely on one.', END, ''].join('\n');
+  fs.writeFileSync(file, `${cur}${cur && !cur.endsWith('\n') ? '\n' : ''}${cur ? '\n' : ''}${block}`);
+  return { ok: true, changed: true };
+}
+/* Rebuild the views for a session about to start. Local file writes only. */
+function renderFor(root) {
+  const c = core(); if (!c.ok) return;
+  const dir = c.core.memDir(root, false);
+  if (dir && fs.existsSync(path.join(dir, 'memory.jsonl'))) c.core.render(root);
+}
+
+module.exports = { core, wire, wired, renderFor, MARK, END };

package/workspace/lib/models.js

@@ -0,0 +1,50 @@
+'use strict';
+/* models.js — the workspace's door to model routing (D75).
+ *
+ * The routing code is ONE file, scripts/pmos-model.js, shared with the CLI an agent runs. It is loaded the
+ * way the workflow engine and the memory tool are: from the checkout two directories up, or from the copy the
+ * packaging step vendors into lib/engine/.
+ */
+const fs = require('fs');
+const path = require('path');
+
+const PATHS = [
+  path.join(__dirname, '..', '..', 'scripts', 'pmos-model.js'),
+  path.join(__dirname, 'engine', 'pmos-model.js'),
+];
+function core() {
+  for (const p of PATHS) {
+    if (!fs.existsSync(p)) continue;
+    try { return { ok: true, core: require(p) }; }
+    catch (e) { return { ok: false, error: `the model router at ${p} failed to load — ${String((e && e.message) || e).slice(0, 160)}` }; }
+  }
+  return { ok: false, error: 'the model router is not present in this install' };
+}
+
+/* Resolve what to launch for a session. Never throws. `ask` = { explicit:{tier,model,effort}, scheduleTier,
+ * skillTier, skill, text }. Returns { ok, state, tier, model, effort, decidedBy, why, args, error? } where state is
+ * 'not-asked' | 'applied' | 'no-model-control'. */
+function resolveForSpawn(root, agent, ask) {
+  const a = ask || {};
+  const nothingAsked = !(a.explicit && (a.explicit.tier || a.explicit.model)) && !a.scheduleTier && !a.skillTier && !a.skill && !a.text;
+  const c = core();
+  if (!c.ok) return nothingAsked ? { ok: true, state: 'not-asked', tier: null, args: [] } : { ok: false, error: c.error };
+  const clean = (v) => (v == null || v === '' ? undefined : String(v));
+  const explicit = { tier: clean(a.explicit && a.explicit.tier), model: clean(a.explicit && a.explicit.model), effort: clean(a.explicit && a.explicit.effort) };
+  const r = c.core.resolve(root, { skill: a.skill, text: a.text, scheduleTier: clean(a.scheduleTier), skillTier: clean(a.skillTier), explicit, agent });
+  if (!r.ok) return { ok: false, error: r.error };
+  return r;
+}
+
+/* The sentence a pane or a list row shows. Three states kept apart, and a session recorded before routing existed
+ * says "not recorded" — never "not asked". */
+function line(model) {
+  if (!model) return 'model: not recorded (this session started before model routing existed)';
+  if (model.state === 'refused') return `model: choice refused — ${model.why}`;
+  if (model.switched) return `model: ${model.switched.model} — switched by the PM at ${String(model.switched.at).slice(11, 16)}; effort unchanged`;
+  if (model.state === 'applied') return `model: ${model.model}${model.effort ? ` · effort ${model.effort}` : ''} (${model.tier}, ${model.decidedBy})`;
+  if (model.state === 'no-model-control') return 'model: asked for, but this binary has no model control in PMOS — it runs its own default';
+  return 'model: not asked — the harness default';
+}
+
+module.exports = { core, resolveForSpawn, line };

package/workspace/lib/preview-kind.js

@@ -68,6 +68,10 @@
     // an image extension wins over its text twin (.svg) only when there is a real extension;
     // opening an .svg as a DOC still shows source (TEXT_EXT), inline ![]() treats it as an image.
     if (Object.prototype.hasOwnProperty.call(IMAGE_MIME, ext)) return 'image';
+    // overhaul-r2 D1 — a PDF opens in the browser's own viewer through /api/asset (never as text)
+    if (ext === 'pdf') return 'pdf';
+    // overhaul-r3 P10 — a workbook is read in the browser (public/pm/xlsx-read.js), never as text
+    if (ext === 'xlsx') return 'sheet';
     if (TEXT_EXT.has(ext)) return 'text';
     if (!ext && TEXT_BASENAMES.has(base)) return 'text';
     return 'inert';
@@ -78,6 +82,13 @@
     return IMAGE_MIME[extOf(name)] || null;
   }
 
+  /** MIME for /api/asset: an allowlisted image, or a PDF (overhaul-r2 D1); null otherwise. */
+  function assetMime(name) {
+    if (extOf(name) === 'pdf') return 'application/pdf';
+    if (extOf(name) === 'xlsx') return 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet';
+    return imageMime(name);
+  }
+
   /** a markdown-body kind served as escaped source (vs. rendered markdown). */
   function isTextSource(kind) { return kind === 'text'; }
 
@@ -93,6 +104,6 @@
     return true;                                  // a plain relative / root-relative repo path
   }
 
-  return { previewKind, imageMime, isTextSource, isRepoRelativeSrc, extOf,
+  return { previewKind, imageMime, assetMime, isTextSource, isRepoRelativeSrc, extOf,
     MARKDOWN_EXT, TEXT_EXT, HTML_EXT, IMAGE_MIME };
 });

package/workspace/lib/schedule-logic.js

@@ -11,7 +11,8 @@
  */
 
 const DAYS = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];   // JS getDay() index
-const CADENCES = ['daily', 'weekly', 'bi-weekly', 'monthly'];
+const CADENCES = ['daily', 'weekly', 'bi-weekly', 'monthly', 'once'];   // R11: `once` — one date and time, then it stays off
+const ONCE_GRACE_MS = 15 * 60 * 1000;   // a one-off whose moment passed while nothing was running is MISSED, not caught up
 
 function parseTime(t) {
   const m = /^(\d{1,2}):(\d{2})$/.exec(String(t || '09:00'));
@@ -27,8 +28,15 @@ function atTime(d, time) {
 function dayIndex(day) { const i = DAYS.indexOf(String(day)); return i < 0 ? 1 : i; }   // default Mon
 
 // The most recent scheduled slot at or before `now` (Date), or null if none exists yet.
+function onceSlot(schedule) {
+  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(String(schedule.date || ''));
+  if (!m) return null;
+  const { h, mi } = (() => { const t = parseTime(schedule.time); return { h: t.h, mi: t.m }; })();
+  return new Date(+m[1], +m[2] - 1, +m[3], h, mi, 0, 0);
+}
 function lastSlot(schedule, now) {
   const cad = schedule.cadence;
+  if (cad === 'once') { const o = onceSlot(schedule); return o && o <= now ? o : null; }
   if (cad === 'daily') {
     const today = atTime(now, schedule.time);
     return today <= now ? today : addDays(today, -1);
@@ -54,6 +62,7 @@ function lastSlot(schedule, now) {
 // The next scheduled slot strictly after `now`.
 function nextSlot(schedule, now) {
   const cad = schedule.cadence;
+  if (cad === 'once') { const o = onceSlot(schedule); return o && o > now ? o : null; }
   if (cad === 'daily') {
     const today = atTime(now, schedule.time);
     return today > now ? today : addDays(today, 1);
@@ -85,11 +94,19 @@ function isDue(schedule, now = new Date()) {
   if (!slot) return false;
   const last = schedule.lastRun ? new Date(schedule.lastRun) : null;
   if (last && last >= slot) return false;
+  // A one-off fires inside its grace window, once; after that it is missed (see isMissed), never caught up.
+  if (schedule.cadence === 'once') return !last && (now - slot) <= ONCE_GRACE_MS;
   if (schedule.cadence === 'bi-weekly' && last) {
     if ((now - last) / 86400000 < 13) return false;
   }
   return true;
 }
+// A one-off whose moment passed beyond the grace window without firing. The tick marks it off and says so.
+function isMissed(schedule, now = new Date()) {
+  if (!schedule || schedule.cadence !== 'once' || !schedule.enabled || schedule.lastRun) return false;
+  const o = onceSlot(schedule);
+  return !!o && (now - o) > ONCE_GRACE_MS;
+}
 // The next fire time as an ISO string (or null).
 function nextRun(schedule, now = new Date()) {
   const s = nextSlot(schedule, now);
@@ -103,6 +120,7 @@ function humanCadence(schedule) {
     case 'weekly': return `every ${schedule.day || 'Mon'} at ${t}`;
     case 'bi-weekly': return `every other ${schedule.day || 'Mon'} at ${t}`;
     case 'monthly': return `monthly on day ${schedule.dayOfMonth || 1} at ${t}`;
+    case 'once': return `once, ${schedule.date || '?'} at ${t}`;
     default: return schedule.cadence || '';
   }
 }
@@ -112,6 +130,12 @@ function normalizeSchedule(input) {
   if (!s.name || !String(s.name).trim()) return { ok: false, error: 'name is required' };
   if (!CADENCES.includes(s.cadence)) return { ok: false, error: 'invalid cadence' };
   if (!s.skill || !String(s.skill).trim()) return { ok: false, error: 'a skill-backed task is required' };
+  if (s.cadence === 'once') {
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(String(s.date || ''))) return { ok: false, error: 'a one-off needs a date (YYYY-MM-DD)' };
+    const slot = onceSlot({ date: s.date, time: s.time });
+    if (!slot || Number.isNaN(slot.getTime())) return { ok: false, error: 'that date is not a real date' };
+    if (slot <= new Date()) return { ok: false, error: 'a one-off must be in the future — a past moment would never fire' };
+  }
   return {
     ok: true,
     schedule: {
@@ -119,6 +143,11 @@ function normalizeSchedule(input) {
       cadence: s.cadence,
       day: s.day || 'Mon',
       dayOfMonth: Math.min(28, Math.max(1, +s.dayOfMonth || 1)),
+      ...(s.cadence === 'once' ? { date: String(s.date) } : {}),
+      // R11 — the PM's request for this run, added to the skill prompt so an unattended run need not ask.
+      ...(s.args ? { args: String(s.args).trim().slice(0, 2000) } : {}),
+      // D75 — the PM's tier for this schedule (fast | balanced | deep); anything else is dropped, never guessed.
+      ...(/^(fast|balanced|deep)$/.test(String(s.tier || '')) ? { tier: String(s.tier) } : {}),
       time: parseTimeStr(s.time),
       tz: s.tz || 'local',
       task: s.task || s.skill,
@@ -129,4 +158,4 @@ function normalizeSchedule(input) {
 }
 function parseTimeStr(t) { const { h, m } = parseTime(t); return `${String(h).padStart(2, '0')}:${String(m).padStart(2, '0')}`; }
 
-module.exports = { CADENCES, isDue, nextRun, humanCadence, normalizeSchedule, lastSlot, nextSlot };
+module.exports = { CADENCES, isMissed, ONCE_GRACE_MS, isDue, nextRun, humanCadence, normalizeSchedule, lastSlot, nextSlot };

package/workspace/lib/skill-store.js

@@ -67,6 +67,8 @@ function parseSkill(text) {
     run,
     surface: fm.surface || null,
     agent: fm.agent || 'claude',
+    // D75 — the skill's own preferred tier; anything but a known tier is ignored here and the policy's route decides.
+    tier: /^(fast|balanced|deep)$/.test(fm.tier || '') ? fm.tier : null,
     output: (lists.output || []).filter(Boolean).slice(0, MAX_OUTPUT),
     body,
   };
@@ -92,7 +94,9 @@ function loadDir(dir, source) {
 // built-ins last, so a built-in's load-bearing fast-path can never be shadowed by a user file.
 function loadSkills(dirs) {
   const byId = new Map();
-  for (const { dir, source } of dirs) for (const s of loadDir(dir, source)) byId.set(s.id, s);
+  // An entry is a directory to read, or `skills` already loaded and vetted by the caller (D76: discovered skills,
+  // which only the registry's approved-and-matching rows may supply).
+  for (const e of dirs) for (const s of (e.skills || loadDir(e.dir, e.source))) byId.set(s.id, s);
   return [...byId.values()].sort((a, b) => a.id.localeCompare(b.id));
 }
 

package/workspace/lib/skills-registry.js

@@ -0,0 +1,74 @@
+'use strict';
+/* skills-registry.js — the workspace's door to discovered and generated skills (D76).
+ *
+ * The registry code is ONE file, scripts/pmos-skills.js (shared with the CLI an agent runs): checkout two
+ * directories up, or the copy the packaging step vendors into lib/engine/.
+ *
+ * APPROVAL LIVES HERE, NOT IN THE REPOSITORY. A skill is approved by a PM press, and the record of it is a line in
+ * the workspace's runtime state on THIS machine (`skill-approvals.jsonl`), keyed by the repository's real path. The
+ * repository's registry can say what exists and what was rejected, but it can never make anything run — so a commit,
+ * a teammate's push or an agent's hand-edit cannot approve a skill on the PM's behalf. The cost is honest: a skill
+ * approved on one machine is quarantined on another until the PM approves it there, after reading it there.
+ */
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+const PATHS = [
+  path.join(__dirname, '..', '..', 'scripts', 'pmos-skills.js'),
+  path.join(__dirname, 'engine', 'pmos-skills.js'),
+];
+function core() {
+  for (const p of PATHS) {
+    if (!fs.existsSync(p)) continue;
+    try { return { ok: true, core: require(p) }; }
+    catch (e) { return { ok: false, error: `the skills registry at ${p} failed to load — ${String((e && e.message) || e).slice(0, 160)}` }; }
+  }
+  return { ok: false, error: 'the skills registry is not present in this install' };
+}
+
+const rootKey = (root) => {
+  let real = root; try { real = fs.realpathSync(root); } catch { /* use as given */ }
+  return crypto.createHash('sha256').update(real).digest('hex').slice(0, 16);
+};
+
+function readApprovals(file) {
+  let text = ''; try { text = fs.readFileSync(file, 'utf8'); } catch { return []; }
+  const out = [];
+  for (const line of text.split('\n')) { if (!line.trim()) continue; try { const e = JSON.parse(line); if (e && e.op && e.id && e.sha && e.root) out.push(e); } catch { /* torn */ } }
+  return out;
+}
+function appendApproval(file, ev) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_APPEND | fs.constants.O_CREAT | (fs.constants.O_NOFOLLOW || 0), 0o600);
+  try {
+    const st = fs.fstatSync(fd); if (!st.isFile() || st.nlink !== 1) throw new Error('skill-approvals.jsonl is not a plain single-link file');
+    const before = st.size; const buf = Buffer.from(JSON.stringify(ev) + '\n');
+    if (fs.writeSync(fd, buf) !== buf.length) { try { fs.ftruncateSync(fd, before); } catch { /* best effort */ } throw new Error('short write — rolled back'); }
+  } finally { fs.closeSync(fd); }
+}
+// The local approvals for ONE repository, as the core's resolve() wants them: [{id, sha, at}]
+function approvedFor(file, root) {
+  const k = rootKey(root);
+  return readApprovals(file).filter((e) => e.root === k && e.op === 'approve' && e.by === 'human:wawan');
+}
+function readsFor(file, root) {
+  const k = rootKey(root); const set = new Set();
+  for (const e of readApprovals(file)) if (e.root === k && e.op === 'read' && e.by === 'human:wawan') set.add(`${e.id}@${e.sha}`);
+  return set;
+}
+
+/* The skill objects the loader will offer for a repository: only approved + still-matching candidates. Each is the
+ * parsed skill with the harness FORCED — an agent skill running claude, whatever the file's own keys say. */
+function loadApproved(root, approvalsFile, parseSkill) {
+  const c = core(); if (!c.ok) return { skills: [], blocked: [], error: c.error };
+  const res = c.core.resolve(root, approvedFor(approvalsFile, root));
+  const skills = res.skills.map((r) => {
+    const s = parseSkill(r.text);
+    return { ...s, name: r.id, id: r.id, skill: r.id, label: s.label || r.id, run: 'agent', agent: 'claude', surface: null,
+      source: 'discovered', file: r.file, sha12: r.sha12, license: r.row.license, origin: r.row.origin };
+  });
+  return { skills, blocked: res.blocked };
+}
+
+module.exports = { core, rootKey, readApprovals, appendApproval, approvedFor, readsFor, loadApproved };

package/workspace/lib/sync.js

@@ -0,0 +1,132 @@
+'use strict';
+/* sync — fetch, bring in the other machine's work, commit THIS machine's records, push (D70).
+ *
+ * Reached ONLY by the PM's press on `Sync` (POST /api/sync). Nothing else in the workspace calls
+ * `fetch`, `rebase`, `commit` or `push`. Every step either proves itself safe or stops and says why;
+ * a stop leaves the working tree exactly as it was. Never `--force`, never a merge commit, never a
+ * `reset --hard`, never a `clean`, never `stash drop`.
+ *
+ * What it commits is RECORD PATHS only — the PM's own session wrote them. A PM's other dirty files
+ * are left alone and reported. A diverged branch is brought together by rebasing THIS machine's own
+ * unpushed commits onto the remote; any conflict aborts the rebase entirely.
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFile } = require('child_process');
+
+const RECORD_PATHS = ['planning', 'pmos', '.pmos-profile', '.gitattributes'];
+const NET_TIMEOUT_MS = 60000;
+const LOCAL_TIMEOUT_MS = 10000;
+
+function run(root, args, { net = false, raw = false } = {}) {
+  return new Promise((resolve) => {
+    execFile('git', ['-C', root, ...args], {
+      encoding: 'utf8', timeout: net ? NET_TIMEOUT_MS : LOCAL_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND || 'ssh -o BatchMode=yes' },
+    }, (err, stdout, stderr) => resolve({ ok: !err, out: raw ? String(stdout || '') : String(stdout || '').trim(), err: String((stderr || (err && err.message)) || '').trim() }));
+  });
+}
+
+const isRecord = (rel) => RECORD_PATHS.some((p) => rel === p || rel.startsWith(`${p}/`));
+
+// PM repositories append ledgers from several machines; `merge=union` keeps both sides' lines instead
+// of conflicting (D70). Added once, committed with the records. Never touches a product-code repository.
+const UNION_LINE = '*.jsonl merge=union';
+function ensureUnionAttribute(root) {
+  try {
+    const prof = fs.readFileSync(path.join(root, '.pmos-profile'), 'utf8').split('\n').map((l) => l.replace(/#.*$/, '').trim()).find(Boolean);
+    if (prof !== 'pm-artifacts') return false;
+    const f = path.join(root, '.gitattributes');
+    const cur = fs.existsSync(f) ? fs.readFileSync(f, 'utf8') : '';
+    if (cur.split('\n').some((l) => l.trim() === UNION_LINE)) return false;
+    fs.writeFileSync(f, `${cur}${cur && !cur.endsWith('\n') ? '\n' : ''}${UNION_LINE}\n`);
+    return true;
+  } catch { return false; }
+}
+
+// Everything here is local — no network. Safe to call on every render.
+async function status(root) {
+  const inside = await run(root, ['rev-parse', '--is-inside-work-tree']);
+  if (!inside.ok) return { ok: false, error: 'not a git repository' };
+  const br = await run(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+  const branch = br.ok ? br.out : null;
+  if (!branch || branch === 'HEAD') return { ok: true, branch: null, state: 'detached', message: 'a detached HEAD cannot sync' };
+  const up = await run(root, ['rev-parse', '--abbrev-ref', `${branch}@{upstream}`]);
+  const porcelain = await run(root, ['status', '--porcelain', '--untracked-files=all'], { raw: true });
+  const files = porcelain.out ? porcelain.out.split('\n').filter(Boolean).map((l) => l.slice(3).replace(/^"|"$/g, '').replace(/.* -> /, '')) : [];
+  const dirtyRecords = files.filter(isRecord);
+  const dirtyOther = files.filter((f) => !isRecord(f));
+  let ahead = null; let behind = null;
+  if (up.ok) {
+    const c = await run(root, ['rev-list', '--left-right', '--count', `HEAD...${up.out}`]);
+    if (c.ok) { const [a, b] = c.out.split(/\s+/).map(Number); ahead = a; behind = b; }
+  }
+  const mid = ['MERGE_HEAD', 'rebase-merge', 'rebase-apply', 'CHERRY_PICK_HEAD']
+    .some((f) => fs.existsSync(path.join(root, '.git', f)));
+  const state = mid ? 'mid-operation' : !up.ok ? 'no-upstream'
+    : ahead && behind ? 'diverged' : behind ? 'behind' : ahead ? 'ahead'
+      : dirtyRecords.length ? 'dirty' : 'in-sync';
+  return { ok: true, branch, upstream: up.ok ? up.out : null, ahead, behind,
+    dirty_records: dirtyRecords.length, dirty_other: dirtyOther.length, state,
+    network_used: false };
+}
+
+// The press. Returns { ok, steps:[{step, ok, note}], stopped_at?, message }.
+async function sync(root, { label } = {}) {
+  const steps = [];
+  const stop = (step, message) => { steps.push({ step, ok: false, note: message }); return { ok: false, steps, stopped_at: step, message }; };
+  const done = (step, note) => steps.push({ step, ok: true, note });
+
+  const s0 = await status(root);
+  if (!s0.ok) return stop('check', s0.error);
+  if (s0.state === 'detached') return stop('check', s0.message);
+  if (s0.state === 'mid-operation') return stop('check', 'a merge, rebase or cherry-pick is already in progress here; finish or abort it, then sync');
+  if (s0.state === 'no-upstream') return stop('check', `branch '${s0.branch}' has no upstream; set one once with: git push -u origin ${s0.branch}`);
+  done('check', `${s0.branch} → ${s0.upstream}`);
+
+  const f = await run(root, ['fetch', '--prune', s0.upstream.split('/')[0]], { net: true });
+  if (!f.ok) return stop('fetch', `fetch failed — ${f.err || 'no output'}`);
+  done('fetch', 'fetched');
+
+  // Commit THIS machine's records first, so nothing the PM wrote can be lost by what follows.
+  const addedAttr = ensureUnionAttribute(root);
+  const s1 = await status(root);
+  if (s1.dirty_records || addedAttr) {
+    const present = RECORD_PATHS.filter((p) => fs.existsSync(path.join(root, p)));
+    const add = await run(root, ['add', '--', ...present]);
+    if (!add.ok) return stop('commit', `could not stage records — ${add.err}`);
+    const staged = await run(root, ['diff', '--cached', '--name-only']);
+    if (staged.out) {
+      const msg = `chore(pmos): sync records from ${label || os.hostname()}`;
+      const c = await run(root, ['commit', '-m', msg, '--no-verify']);
+      if (!c.ok) return stop('commit', /identity unknown|empty ident/i.test(c.err)
+        ? 'git has no author name or email on this machine, so the records cannot be committed — set them once: git config --global user.name "Your Name" && git config --global user.email you@example.com'
+        : `could not commit records — ${c.err}`);
+      done('commit', `${staged.out.split('\n').length} record file(s)`);
+    }
+  } else done('commit', 'no uncommitted records');
+
+  const s2 = await status(root);
+  if (s2.behind) {
+    // Fast-forward when we have nothing of our own; otherwise replay OUR unpushed commits on top.
+    const verb = s2.ahead ? ['rebase', '--autostash', s2.upstream] : ['merge', '--ff-only', s2.upstream];
+    const r = await run(root, verb);
+    if (!r.ok) {
+      if (s2.ahead) await run(root, ['rebase', '--abort']);
+      return stop('integrate', `${s2.ahead ? 'the two machines changed the same lines — rebase aborted, nothing changed' : 'cannot fast-forward'} — ${r.err.split('\n')[0] || 'see git'}`);
+    }
+    done('integrate', s2.ahead ? `replayed ${s2.ahead} local commit(s) on the remote` : `fast-forwarded ${s2.behind} commit(s)`);
+  } else done('integrate', 'nothing to bring in');
+
+  const s3 = await status(root);
+  if (s3.ahead) {
+    const p = await run(root, ['push', s3.upstream.split('/')[0], `HEAD:${s3.upstream.split('/').slice(1).join('/')}`], { net: true });
+    if (!p.ok) return stop('push', `push failed — ${p.err.split('\n')[0] || 'no output'}`);
+    done('push', `pushed ${s3.ahead} commit(s)`);
+  } else done('push', 'nothing to push');
+
+  return { ok: true, steps, message: 'in sync', after: await status(root) };
+}
+
+module.exports = { status, sync, ensureUnionAttribute, RECORD_PATHS, isRecord };

package/workspace/lib/tree-share.js

@@ -187,6 +187,8 @@ function describeTenant(row, writerId) {
     shown,
     label: s.label || shown,
     doing: s.doing || s.lastWords || null,
+    // D75 — the sentence that says which model this session was started with (or that it was not asked / has no model control).
+    modelLine: s.model_line || null,
     branch: s.branch || null,
     writer: !!(writerId && s.id === writerId),
     risk: endRisk(shown, s.quietMs),

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.36.0",
+      "version": "0.37.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",
@@ -10,12 +10,12 @@
   "scripts": {
     "start": "node server.js",
     "test": "node test.js && npm run test:modules",
-    "test:modules": "node focus.test.js && node handoff.test.js && node repo-scan.test.js && node profiles.test.js && node external-linking.test.js && node story-artifacts.test.js && node no-network.test.js && node fixture-parity.test.mjs && node markdown.test.mjs && node start-policy.test.js && node state-isolation.test.js",
+    "test:modules": "node focus.test.js && node handoff.test.js && node repo-scan.test.js && node profiles.test.js && node external-linking.test.js && node story-artifacts.test.js && node no-network.test.js && node fixture-parity.test.mjs && node markdown.test.mjs && node start-policy.test.js && node state-isolation.test.js && node sync.test.js",
     "test:ui": "node ui-test.js",
     "test:parity": "node design-parity.js --states",
     "test:all": "npm test && npm run test:panels && npm run test:ui && npm run test:parity && npm run test:offline",
     "doctor": "node doctor.js",
-    "test:panels": "node pm-shell-test.js && node pm-repos-test.js && node pm-initiatives-test.js && node pm-detail-test.js && node pm-tabs-test.js && node pm-term-test.js && node pm-modes-test.js",
+    "test:panels": "node pm-shell-test.js && node pm-repos-test.js && node pm-initiatives-test.js && node pm-detail-test.js && node pm-tabs-test.js && node pm-term-test.js && node pm-modes-test.js && node pm-r1-test.js && node pm-r2-test.js && node pm-r3-test.js && node pm-r4-test.js && node pm-r5-test.js && node pm-r6-test.js && node pm-r7-test.js && node pm-r8-test.js && node pm-r9-test.js && node pm-r10-test.js && node pm-r11-test.js && node pm-r12-test.js && node pm-r13-test.js",
     "test:offline": "node offline-tarball.test.js"
   },
   "engines": {

package/workspace/public/pm/app.js

@@ -33,6 +33,7 @@ import { isMobile, mountMobile, applyMobile } from './mobile.js';
 const MODE_TITLE = {
   product: 'initiatives', scheduled: 'scheduled tasks', workflow: 'workflows', skills: 'skills',
   knowledge: 'knowledge', agent: 'agents', memory: 'memory', connect: 'connections', focus: 'focus',
+  portfolio: 'portfolio',
 };
 const DETAIL_TITLE = {
   init: 'initiative', flow: 'workflow', sched: 'scheduled task', skill: 'skill', know: 'decision',
@@ -163,6 +164,16 @@ const rail0 = makeRail('col0');
 const rail1 = makeRail('col1');
 const rail2 = makeRail('col2');
 rail0.label.textContent = 'repositories ⟩';
+/* overhaul-r1 R4: in live mode the collapsed repositories rail also carries one glyph per repository
+ * (panel-repos.js#railGlyphs), so a repository is selectable without expanding the panel. The
+ * toggle keeps its label and stays the rest of the strip. */
+const rail0Host = el('div', {
+  role: 'button', tabindex: '0', title: 'show the repositories panel',
+  onClick: () => setState((s) => ({ col0: !s.col0 })),
+  onKeydown: (e) => { if (e.key === 'Enter' || e.key === ' ') { e.preventDefault(); setState((s) => ({ col0: !s.col0 })); } },
+  style: 'background:var(--sidebar);border-right:1px solid var(--border);display:flex;flex-direction:column;align-items:center;min-height:0;overflow-y:auto;cursor:pointer',
+  hover: 'background:var(--accent)',
+});
 
 /* `min-height:0` on all four: a grid item's automatic minimum is its content, so a panel taller
  * than the viewport would otherwise stretch the row it sits in rather than scroll inside it. The
@@ -199,10 +210,29 @@ function paint(mod, name, host) {
 
 /* ── render ────────────────────────────────────────────────────────────────────────────────── */
 
+/* The rail is still ONE control that re-opens the panel, its first child is still the rotated
+ * label, and its text is still exactly `repositories ⟩` — the glyphs draw their initials from a data
+ * attribute (tokens.css) and name themselves through aria-label, and CSS `order` lifts them above
+ * the label. A glyph click stops at the glyph: it selects, it does not expand. */
+function railRepos() {
+  const glyphs = mods.repos && typeof mods.repos.railGlyphs === 'function' ? mods.repos.railGlyphs() : [];
+  if (!glyphs.length) {
+    if (rail0.label.parentNode !== rail0.btn) rail0.btn.appendChild(rail0.label);
+    return rail0.btn;
+  }
+  rail0.label.style.order = '2';
+  rail0.label.style.paddingTop = '10px';
+  setChildren(rail0Host, [rail0.label, el('div', { style: 'order:1;padding-top:8px;flex:none' }, glyphs)]);
+  return rail0Host;
+}
+
 function render() {
   root.setAttribute('data-pm-theme', state.theme);
   themeBtn.textContent = state.theme === 'dark' ? 'theme · dark' : 'theme · light';
-  statusLeft.textContent = 'local · persistent server · ' + runningCount() + ' sessions running';
+  // overhaul-r1 R2.3: the active tab's line of work, when it is not the main tree
+  const actTab = (state.tabs || []).find((t) => t.id === state.active);
+  const br = actTab && mods.tabs && typeof mods.tabs.tabBranch === 'function' ? mods.tabs.tabBranch(actTab, true) : null;
+  statusLeft.textContent = 'local · persistent server · ' + runningCount() + ' sessions running' + (br ? ' · ⎇ ' + br : '');
 
   // Panel 1's rail is a constant; panels 2 and 3 name whatever is behind them, so a PM who folded
   // a panel away can still see what they folded.
@@ -218,7 +248,7 @@ function render() {
   // the document, and panel 4's xterm does not survive that.
   const phone = isMobile();
   setChildren(bodyGrid, phone ? [hostRepos, hostInits, hostDetail, hostTabs] : [
-    state.col0 ? hostRepos : rail0.btn,
+    state.col0 ? hostRepos : railRepos(),
     state.col1 ? hostInits : rail1.btn,
     state.col2 ? hostDetail : rail2.btn,
     hostTabs,