create-pmos 0.37.0 → 0.38.0

package/workspace/public/pm/tab-doc.js

@@ -56,6 +56,12 @@ import('./data.js').then((m) => { dataMod = m; }).catch(() => { dataMod = null;
 
 /** The workspace id the doc endpoints key on. The data layer names it; these are its aliases. */
 const wsId = () => state.wsId || state.ws || state.product || '';
+/* overhaul-r1 R1.3 — a doc tab opened from a search hit on a linked worktree carries that tree's
+ * `ws`, and is read from and saved to THAT tree. Two trees can hold the same path with different
+ * content, so every per-document cache keys on tree + path; a main-tree tab keys on path alone,
+ * exactly as before. */
+const docKey = (tab) => (tab && tab.ws ? tab.ws + '\u241f' : '') + (tab ? tab.path : '');
+const wsOf = (tab) => (tab && tab.ws) || wsId();
 
 /* A REFERENCE is not a file. Panel 3's links section files `jira://ATL-501`, `confluence://PM/x`,
  * `gdoc://x-brief` — URIs naming a record in someone else's system, deliberately kept out of the
@@ -87,13 +93,13 @@ const stub = (tab, body) =>
 
 /** Read a document from the local server, once, then repaint. */
 function requestDoc(tab) {
-  const path = tab.path;
+  const path = docKey(tab);
   if (pending.has(path)) return;
   pending.add(path);
   const done = (text) => { pending.delete(path); disk.set(path, text); setState({}); };
   const load = (dataMod && typeof dataMod.readDoc === 'function')
-    ? dataMod.readDoc(path)
-    : fetch('/api/doc?ws=' + encodeURIComponent(wsId()) + '&path=' + encodeURIComponent(path))
+    ? dataMod.readDoc(tab.path, tab.ws)
+    : fetch('/api/doc?ws=' + encodeURIComponent(wsOf(tab)) + '&path=' + encodeURIComponent(tab.path))
       .then((r) => (r.ok ? r.text() : Promise.reject(new Error('HTTP ' + r.status))));
   Promise.resolve(load).then(
     (text) => { unread.delete(path); done(typeof text === 'string' ? text : String(text == null ? '' : text)); },
@@ -111,11 +117,11 @@ function requestDoc(tab) {
  */
 export function docText(tab) {
   if (!tab || !tab.path) return '';
-  const saved = state.savedDocs[tab.path];
+  const saved = state.savedDocs[docKey(tab)];
   if (saved != null) return saved;
   if (FIXTURE) return FX.rawFor(tab, state.savedDocs);
   if (isReference(tab.path)) return referenceStub(tab);
-  if (disk.has(tab.path)) return disk.get(tab.path);
+  if (disk.has(docKey(tab))) return disk.get(docKey(tab));
   requestDoc(tab);
   return stub(tab, 'reading ' + tab.path + ' …');
 }
@@ -129,26 +135,29 @@ export function docText(tab) {
  * than silently overwritten; the refusal is shown where the PM is looking and the buffer is kept.
  */
 function save(tab, text) {
-  const path = tab.path;
-  const commit = () => setState((s) => {
+  const path = docKey(tab);
+  // R11 — the server may stamp `generated:` with the PM as author, so what is on disk is not exactly what was sent.
+  // The saved text it returns becomes the new base; keeping the old one would make the NEXT save a 409.
+  const commit = (final) => setState((s) => {
     const de = { ...s.docEdits }; delete de[path];
-    return { savedDocs: { ...s.savedDocs, [path]: text }, docEdits: de };
+    return { savedDocs: { ...s.savedDocs, [path]: typeof final === 'string' ? final : text }, docEdits: de };
   });
   saveErr.delete(path);
   if (FIXTURE) { commit(); return; }
 
   const base = disk.has(path) ? disk.get(path) : (state.savedDocs[path] ?? '');
   const write = (dataMod && typeof dataMod.saveDoc === 'function')
-    ? dataMod.saveDoc({ ws: wsId(), path, base, text })
+    ? dataMod.saveDoc({ ws: wsOf(tab), path: tab.path, base, text })
     : fetch('/api/doc/save', {
       method: 'POST', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ ws: wsId(), path, base, text }),
+      body: JSON.stringify({ ws: wsOf(tab), path: tab.path, base, text }),
     }).then((r) => r.json());
   Promise.resolve(write).then(
     (out) => {
       if (out && out.ok === false) { saveErr.set(path, out.error || 'refused'); setState({}); return; }
-      disk.set(path, text);
-      commit();
+      const final = out && typeof out.text === 'string' ? out.text : text;
+      disk.set(path, final);
+      commit(final);
     },
     (e) => { saveErr.set(path, (e && e.message) || 'could not reach the workspace server'); setState({}); },
   );
@@ -156,8 +165,8 @@ function save(tab, text) {
 
 /** Revert (line 2043): drop the buffer, keep the file. */
 function revert(tab) {
-  saveErr.delete(tab.path);
-  setState((s) => { const de = { ...s.docEdits }; delete de[tab.path]; return { docEdits: de }; });
+  saveErr.delete(docKey(tab));
+  setState((s) => { const de = { ...s.docEdits }; delete de[docKey(tab)]; return { docEdits: de }; });
 }
 
 /* ── the four bodies ───────────────────────────────────────────────────────────────────────── */
@@ -204,16 +213,28 @@ function scrollPane(tab, mode, key, style, build) {
 /** What links and images in this document resolve against. `onDoc` opens a .md link as a doc tab. */
 const linkCtx = (tab) => ({
   dir: String(tab.path || '').split('/').slice(0, -1),
-  ws: wsId(),
+  ws: wsOf(tab),
   onDoc: (p) => openDoc(tab.slug, p, 'FILE'),
+  // overhaul-r5 (D69) — ⧉ beside a remote link opens it as a web tab, on the PM's click only
+  onWeb: FIXTURE ? undefined : (u) => import('./tab-web.js').then((m) => m.openWeb(u)),
 });
 
+/* overhaul-r1 R5 — the reading measure is the PM's choice per tab: full width, or 72ch. With no
+ * choice made it is full on a desktop and 72ch on a phone (≤760px), where 72ch IS the screen. */
+const narrowOf = (tab) => {
+  const v = (state.docNarrow || {})[tab.id];
+  if (typeof v === 'boolean') return v;
+  if (FIXTURE) return true;            // the prototype's recorded rendering, which the comparator reads
+  return typeof window !== 'undefined' && window.matchMedia ? window.matchMedia('(max-width: 760px)').matches : false;
+};
+
 function viewBody(tab, text) {
-  return scrollPane(tab, 'view', text, VIEW_ST, () => {
+  const narrow = narrowOf(tab);
+  return scrollPane(tab, 'view', (narrow ? 'n\u0000' : 'f\u0000') + text, VIEW_ST, () => {
     const doc = mdRender(text, linkCtx(tab));
     const fm = [];
     doc.fm.forEach((fp) => { fm.push(el('span', { style: FM_K }, iv(fp.k)), el('span', { style: FM_V }, iv(fp.v))); });
-    return [el('div', { style: 'max-width:72ch' },
+    return [el('div', { style: narrow ? 'max-width:72ch' : 'max-width:none', 'data-measure': narrow ? '72ch' : 'full' },
       el('div', {
         style: 'border:1px solid var(--border);background:var(--card);padding:10px 12px;margin-bottom:18px;display:grid;grid-template-columns:auto 1fr;gap:4px 14px;font-size:12.5px',
       }, fm),
@@ -257,10 +278,11 @@ const isHtmlDoc = (p) => {
  * nothing was read from it to render. */
 function rendersAsPage(tab) {
   const p = tab.path;
+  const k = docKey(tab);
   if (!isHtmlDoc(p) || isReference(p)) return false;
-  if (state.savedDocs[p] != null) return true;
+  if (state.savedDocs[k] != null) return true;
   if (FIXTURE) return true;
-  return disk.has(p) && !unread.has(p);
+  return disk.has(k) && !unread.has(k);
 }
 
 /* Rendering an HTML document adds no privilege over showing it. The frame is fully sandboxed —
@@ -325,8 +347,8 @@ function editBox(tab) {
     style: 'flex:1;min-height:0;background:var(--background);color:var(--foreground);padding:14px 16px;font-family:var(--mono);font-size:12px;line-height:1.7',
     onInput: (e) => {
       const v = e.target.value;
-      saveErr.delete(tab.path);
-      setState((s) => ({ docEdits: { ...s.docEdits, [tab.path]: v } }));
+      saveErr.delete(docKey(tab));
+      setState((s) => ({ docEdits: { ...s.docEdits, [docKey(tab)]: v } }));
     },
   });
   ta.spellcheck = false;      // a property, not an attribute — the prototype renders no attribute
@@ -348,12 +370,117 @@ export function disposeDoc(id) {
  * Render the doc pane for `tab` into `host` — the pane element panel 4 keeps for this tab.
  * Everything but the edit box is rebuilt on each paint; the box is kept so typing survives it.
  */
+/* overhaul-r2 D1 — a PDF is never read as text. It is embedded from /api/asset (the workspace's own
+ * guarded route) in the browser's built-in viewer, with a plain link as the fallback for a browser
+ * that will not render it inline. Nothing leaves the machine. */
+const extOfPath = (p) => { const b = String(p || '').split('/').pop().toLowerCase(); const i = b.lastIndexOf('.'); return i > 0 ? b.slice(i + 1) : ''; };
+function pdfBody(tab) {
+  const src = '/api/asset?ws=' + encodeURIComponent(wsOf(tab)) + '&path=' + encodeURIComponent(tab.path);
+  return el('div', { style: 'flex:1;display:flex;flex-direction:column;min-height:0', 'data-r2': 'pdf' },
+    el('div', { style: 'flex:none;padding:6px 10px;border-bottom:1px solid var(--border);font-family:var(--mono);font-size:10.5px;color:var(--muted-foreground)' },
+      iv('PDF · read-only · '),
+      el('a', { href: src, target: '_blank', rel: 'noopener', 'data-r2': 'pdf-open' }, 'open in a browser tab')),
+    el('embed', { src, type: 'application/pdf', style: 'flex:1;width:100%;min-height:0;border:0;background:var(--card)' }),
+  );
+}
+
+/* overhaul-r2 D2 — a CSV/TSV reads as a grid: every cell is text (escaped by construction, never
+ * markup), the first row is the header, and a cap is STATED rather than silently applied. */
+const GRID_CAP = 2000;
+function parseDelimited(text, sep) {
+  const rows = [];
+  let row = [], cell = '', q = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (q) {
+      if (ch === '"' && text[i + 1] === '"') { cell += '"'; i++; }
+      else if (ch === '"') q = false;
+      else cell += ch;
+    } else if (ch === '"' && cell === '') q = true;
+    else if (ch === sep) { row.push(cell); cell = ''; }
+    else if (ch === '\n' || ch === '\r') {
+      if (ch === '\r' && text[i + 1] === '\n') i++;
+      row.push(cell); rows.push(row); row = []; cell = '';
+      if (rows.length > GRID_CAP + 1) break;      // header + cap + one more, to KNOW there is more
+    } else cell += ch;
+  }
+  if (cell !== '' || row.length) { row.push(cell); rows.push(row); }
+  return rows;
+}
+function gridBody(tab, text) {
+  // Until the file has really been read, `text` is the reader's placeholder stub — never parse that
+  // as data (it rendered as an 8-row, 1-column "CSV" while the read was in flight).
+  const k = docKey(tab);
+  const loaded = state.savedDocs[k] != null || (disk.has(k) && !unread.has(k));
+  if (!loaded) return el('div', { style: VIEW_ST }, iv(unread.has(k) ? 'this file could not be read' : 'reading ' + tab.path + ' …'));
+  return scrollPane(tab, 'grid', text, VIEW_ST, () => {
+    const rows = parseDelimited(text, extOfPath(tab.path) === 'tsv' ? '\t' : ',');
+    const head = rows[0] || [];
+    const body = rows.slice(1, GRID_CAP + 1);
+    const capped = rows.length > GRID_CAP + 1;
+    const cellSt = 'border:1px solid var(--border);padding:3px 7px;font-family:var(--mono);font-size:11.5px;text-align:left;white-space:nowrap';
+    return [
+      el('div', { 'data-r2': 'grid-meta', style: 'font-family:var(--mono);font-size:10.5px;color:var(--muted-foreground);margin-bottom:8px' },
+        iv(body.length + ' row' + (body.length === 1 ? '' : 's') + ' · ' + head.length + ' column' + (head.length === 1 ? '' : 's')
+          + (capped ? ' · showing the first ' + GRID_CAP + ' rows — the rest are in raw' : ''))),
+      el('div', { style: 'overflow:auto' },
+        el('table', { 'data-r2': 'grid', style: 'border-collapse:collapse' },
+          el('thead', null, el('tr', null, head.map((h) => el('th', { style: cellSt + ';background:var(--secondary)' }, iv(h))))),
+          el('tbody', null, body.map((r) => el('tr', null, r.map((c) => el('td', { style: cellSt }, iv(c)))))))),
+    ];
+  });
+}
+
+/* overhaul-r3 P10 — a workbook, read in the browser by xlsx-read.js (no dependency, no network).
+ * Loaded once per document and cached; a sheet bar switches sheets; every cell is text. */
+const books = new Map();       // docKey -> { state: 'loading' | 'ok' | 'error', book?, error? }
+const bookSheet = new Map();   // tab.id -> sheet index
+function sheetBody(tab) {
+  const k = docKey(tab);
+  let b = books.get(k);
+  if (!b) {
+    b = { state: 'loading' };
+    books.set(k, b);
+    const src = '/api/asset?ws=' + encodeURIComponent(wsOf(tab)) + '&path=' + encodeURIComponent(tab.path);
+    Promise.all([fetch(src).then((r) => (r.ok ? r.arrayBuffer() : Promise.reject(new Error('HTTP ' + r.status)))), import('./xlsx-read.js')])
+      .then(([buf, mod]) => mod.readXlsx(buf, GRID_CAP))
+      .then((book) => { books.set(k, { state: 'ok', book }); setState({}); },
+        (e) => { books.set(k, { state: 'error', error: (e && e.message) || String(e) }); setState({}); });
+  }
+  const wrap = (kids) => el('div', { style: VIEW_ST, 'data-r3': 'sheet' }, kids);
+  if (b.state === 'loading') return wrap([iv('reading ' + tab.path + ' …')]);
+  if (b.state === 'error') return wrap([el('div', { style: 'color:var(--destructive)' }, iv('this workbook could not be read — ' + b.error))]);
+  const sheets = b.book.sheets;
+  const cur = Math.min(bookSheet.get(tab.id) || 0, Math.max(0, sheets.length - 1));
+  const sh = sheets[cur] || { name: '—', rows: [] };
+  const head = sh.rows[0] || [];
+  const width = sh.rows.reduce((n, r) => Math.max(n, r.length), 0);
+  const cellSt = 'border:1px solid var(--border);padding:3px 7px;font-family:var(--mono);font-size:11.5px;text-align:left;white-space:nowrap';
+  const pad = (r) => Array.from({ length: width }, (_, i) => r[i] ?? '');
+  return wrap([
+    el('div', { 'data-r3': 'sheet-bar', style: 'display:flex;gap:4px;flex-wrap:wrap;margin-bottom:8px' },
+      sheets.map((x, i) => el('button', {
+        onClick: () => { bookSheet.set(tab.id, i); setState({}); },
+        style: 'font-family:var(--mono);font-size:10.5px;padding:3px 9px;border:1px solid var(--border);background:' + (i === cur ? 'var(--accent)' : 'transparent'),
+      }, iv(x.name)))),
+    el('div', { 'data-r2': 'grid-meta', style: 'font-family:var(--mono);font-size:10.5px;color:var(--muted-foreground);margin-bottom:8px' },
+      iv(Math.max(0, sh.rows.length - 1) + ' rows · ' + width + ' columns · values only (formulas show their cached value; dates are serial numbers)'
+        + (sh.truncated ? ' · showing the first ' + GRID_CAP + ' rows' : '') + (sh.error ? ' · ' + sh.error : ''))),
+    el('div', { style: 'overflow:auto' },
+      el('table', { 'data-r2': 'grid', style: 'border-collapse:collapse' },
+        el('thead', null, el('tr', null, pad(head).map((h) => el('th', { style: cellSt + ';background:var(--secondary)' }, iv(h))))),
+        el('tbody', null, sh.rows.slice(1).map((r) => el('tr', null, pad(r).map((c) => el('td', { style: cellSt }, iv(c)))))))),
+  ]);
+}
+
 export function mountDoc(host, tab) {
+  if (!FIXTURE && extOfPath(tab.path) === 'pdf') { setChildren(host, [pdfBody(tab)]); return; }
+  if (!FIXTURE && extOfPath(tab.path) === 'xlsx') { setChildren(host, [sheetBody(tab)]); return; }
   const raw = docText(tab);
-  const text = state.docEdits[tab.path] ?? raw;
+  const text = state.docEdits[docKey(tab)] ?? raw;
   const dm = state.docModes[tab.id] ?? 'view';
   const dirty = text !== raw;
-  const err = saveErr.get(tab.path);
+  const err = saveErr.get(docKey(tab));
 
   const modeBtns = ['view', 'raw', 'edit', 'diff'].map((mm) => el('button', {
     onClick: () => setState((s) => ({ docModes: { ...s.docModes, [tab.id]: mm } })),
@@ -385,7 +512,7 @@ export function mountDoc(host, tab) {
    * clean file dirty for nothing is how a tool teaches you to ignore its dirty flag. */
   const norm = typeof window !== 'undefined' ? window.MdNormalize : null;
   const canNormalize = !!(norm && typeof norm.normalize === 'function')
-    && !isHtmlDoc(tab.path) && !isReference(tab.path) && !unread.has(tab.path);
+    && !isHtmlDoc(tab.path) && !isReference(tab.path) && !unread.has(docKey(tab));
   const normBtn = canNormalize ? el('button', {
     onClick: () => {
       const r = norm.normalize(text);
@@ -393,7 +520,7 @@ export function mountDoc(host, tab) {
         ? r.joins + ' line(s) joined' + (r.blanks ? ', ' + r.blanks + ' blank inserted' : '')
         : 'already normalized — every paragraph is one line');
       if (!r.changed) { setState({}); return; }
-      setState((s) => ({ docEdits: { ...s.docEdits, [tab.path]: r.text } }));
+      setState((s) => ({ docEdits: { ...s.docEdits, [docKey(tab)]: r.text } }));
     },
     style: 'margin-left:8px;font-family:var(--mono);font-size:10.5px;padding:4px 10px;min-height:26px;background:var(--secondary);border:1px solid var(--border);color:var(--muted-foreground)',
     hover: 'border-color:var(--ring)',
@@ -413,6 +540,12 @@ export function mountDoc(host, tab) {
     style: 'flex:none;display:flex;gap:2px;align-items:center;padding:6px 10px;border-bottom:1px solid var(--border);background:var(--background)',
   },
     modeBtns, normBtn, saveBtn, revertBtn,
+    FIXTURE || dm !== 'view' ? null : el('button', {
+      onClick: () => setState((s) => ({ docNarrow: { ...(s.docNarrow || {}), [tab.id]: !narrowOf(tab) } })),
+      style: 'margin-left:8px;font-family:var(--mono);font-size:10.5px;padding:4px 10px;min-height:26px;background:var(--secondary);border:1px solid var(--border);color:var(--muted-foreground)',
+      hover: 'color:var(--foreground)', 'data-r1': 'measure',
+      title: narrowOf(tab) ? 'use the full width of the tab' : 'limit lines to a 72-character reading measure',
+    }, iv(narrowOf(tab) ? '↔ full width' : '⇥ 72ch')),
     el('span', { style: 'margin-left:auto;font-family:var(--mono);font-size:10px;color:' + dirtyColor }, iv(dirtyLabel)),
   );
 
@@ -427,7 +560,8 @@ export function mountDoc(host, tab) {
      * genuinely differs, which is what keeps the caret still mid-sentence. */
     if (body.defaultValue !== text) body.defaultValue = text;
     if (body.value !== text) body.value = text;
-  } else body = rendersAsPage(tab) ? htmlFrame(tab, text) : viewBody(tab, text);
+  } else if (!FIXTURE && (extOfPath(tab.path) === 'csv' || extOfPath(tab.path) === 'tsv')) body = gridBody(tab, text);
+  else body = rendersAsPage(tab) ? htmlFrame(tab, text) : viewBody(tab, text);
 
   setChildren(host, [modeBar, body]);
   return host;

package/workspace/public/pm/tab-term.js

@@ -252,6 +252,8 @@ export function requestSpawn(opts) {
         createBranch: !!o.createBranch,
         isolate: o.isolate === undefined ? null : o.isolate,
         profile: o.profile === undefined ? null : o.profile,
+        // D75 — a tier the PM picked (fast | balanced | deep). Absent = "auto": the server routes by policy, or asks for nothing.
+        ...(o.tier ? { tier: o.tier } : {}),
       },
     };
     SOCK.spawnQueue.push(req);

package/workspace/public/pm/tab-web.js

@@ -0,0 +1,89 @@
+/* tab-web.js — the `web` tab kind (overhaul-r5, decision D69).
+ *
+ * A web page in a tab, opened ONLY by the PM: typed into the 🌐 control, or chosen with the ⧉ beside a
+ * document's link. It never loads by itself — a tab restored after a reload shows its address and
+ * waits for "load this page". The page is loaded by the browser, directly from its origin, in a
+ * sandboxed frame; the PMOS server never fetches, proxies or stores it. Only http: and https:.
+ */
+import { el, setChildren } from './dom.js';
+import { state, setState } from './state.js';
+
+const iv = (v) => el('span', null, v === null || v === undefined ? '' : String(v));
+const BTN = 'font-family:var(--mono);font-size:10.5px;padding:3px 9px;border:1px solid var(--border);color:var(--muted-foreground);min-height:26px';
+const SANDBOX = 'allow-scripts allow-forms allow-popups allow-same-origin';
+
+/* Tabs whose page the PM loaded IN THIS PAGE'S LIFETIME. Deliberately not persisted: after a reload
+ * the set is empty, so every restored web tab waits for a press (D69 rule 2). */
+const loaded = new Set();
+
+/** `{ ok, url }` for a full http(s) URL, else `{ ok:false, error }`. No scheme is guessed: an
+ * address without one (or a protocol-relative one) is refused with the reason, never completed. */
+export function checkUrl(raw) {
+  const s = String(raw == null ? '' : raw).trim();
+  if (!s) return { ok: false, error: 'no address given' };
+  if (!/^[a-z][a-z0-9+.-]*:/i.test(s)) return { ok: false, error: `"${s}" has no scheme — type the full address, starting with http or https (D69)` };
+  let u;
+  try { u = new URL(s); } catch { return { ok: false, error: `"${raw}" is not a web address` }; }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+    return { ok: false, error: `only http and https pages open in a tab — "${u.protocol}" is refused (D69)` };
+  }
+  return { ok: true, url: u.href };
+}
+
+/** Open (or focus) a web tab for `raw` — the PM's own action, so it loads immediately. */
+export async function openWeb(raw, opts) {
+  const c = checkUrl(raw);
+  if (!c.ok) { setState({ webNotice: c.error }); return c; }
+  const ini = await import('./panel-initiatives.js');
+  const id = 'web:' + c.url;
+  loaded.add(id);
+  let host = c.url;
+  try { host = new URL(c.url).host; } catch { /* keep the href */ }
+  ini.openTab({ id, kind: 'web', title: host, url: c.url, role: 'WEB', slug: (opts && opts.slug) || null,
+    repo: (opts && opts.repo) || state.product || null });
+  setState({ webNotice: null });
+  return c;
+}
+
+/** The 🌐 control's action: ask for an address, then open it. */
+export function promptWeb() {
+  const raw = typeof window !== 'undefined' && window.prompt ? window.prompt('Open a web page in a tab — the full address, starting with http or https:', '') : null;
+  if (raw === null || !String(raw).trim()) return;
+  openWeb(raw);
+}
+
+export function mountWeb(host, tab) {
+  const c = checkUrl(tab.url);
+  if (!c.ok) {
+    setChildren(host, [el('div', { style: 'padding:20px 24px;color:var(--destructive);font-size:13px', 'data-r5': 'refused' },
+      iv('This web tab was not loaded — ' + c.error))]);
+    return;
+  }
+  const bar = el('div', { style: 'flex:none;display:flex;gap:6px;align-items:center;padding:6px 10px;border-bottom:1px solid var(--border);background:var(--background)' },
+    el('span', { style: 'font-family:var(--mono);font-size:11px;color:var(--muted-foreground);overflow:hidden;text-overflow:ellipsis;white-space:nowrap;min-width:0;flex:1', 'data-r5': 'address', title: c.url }, iv(c.url)),
+    el('button', { onClick: () => { loaded.add(tab.id); frames.delete(tab.id); setState({}); }, style: BTN, hover: 'color:var(--foreground)', title: 'reload the page' }, '↻'),
+    el('a', { href: c.url, target: '_blank', rel: 'noopener noreferrer', style: BTN + ';text-decoration:none', 'data-r5': 'open-browser' }, 'open in your browser'));
+  if (!loaded.has(tab.id)) {
+    setChildren(host, [bar, el('div', { style: 'flex:1;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:10px;color:var(--muted-foreground);font-size:13px', 'data-r5': 'waiting' },
+      iv('This page is not loaded. PMOS never opens a web page by itself (D69).'),
+      el('button', { onClick: () => { loaded.add(tab.id); setState({}); }, style: BTN + ';font-size:12px;padding:6px 14px', hover: 'color:var(--foreground)', 'data-r5': 'load' }, 'load this page'))]);
+    return;
+  }
+  setChildren(host, [bar, frameFor(tab.id, c.url)]);
+}
+
+/* One frame per tab for the tab's life, so switching tabs does not reload the page. */
+const frames = new Map();
+function frameFor(id, url) {
+  let f = frames.get(id);
+  if (!f || f.getAttribute('src') !== url) {
+    // A page on the workspace's OWN origin must not get allow-same-origin: with allow-scripts it
+    // could reach into the workspace itself. External origins keep it so real sites work.
+    let same = false;
+    try { same = typeof location !== 'undefined' && new URL(url).origin === location.origin; } catch { /* external */ }
+    f = el('iframe', { src: url, sandbox: same ? 'allow-scripts allow-forms allow-popups' : SANDBOX, referrerpolicy: 'no-referrer', 'data-r5': 'frame',
+      style: 'flex:1;width:100%;min-height:0;border:0;background:#fff', title: url });
+    frames.set(id, f);
+  }
+  return f;
+}

package/workspace/public/pm/tokens.css

@@ -71,3 +71,7 @@ body{margin:0;background:oklch(0.148 0.004 228.8);-webkit-font-smoothing:antiali
 a{color:oklch(0.623 0.214 259.815)}a:hover{color:oklch(0.72 0.19 259.8)}
 button{font:inherit;color:inherit;background:none;border:0;cursor:pointer;text-align:left;padding:0}
 input,textarea{font:inherit;color:inherit;background:none;border:0;outline:none;padding:0;resize:none}
+/* overhaul-r1 R4: a collapsed-rail glyph draws its initials and kind badge from data attributes, so
+   the rail's text stays `repositories ⟩` and the glyph names itself through aria-label */
+[data-r1="rail-glyph"]::before{content:attr(data-ini)}
+[data-r1="rail-glyph"]::after{content:attr(data-kind);position:absolute;right:-2px;bottom:-3px;font-size:8px;line-height:1;color:var(--muted-foreground)}

package/workspace/public/pm/xlsx-read.js

@@ -0,0 +1,117 @@
+/* xlsx-read.js — a minimal, READ-ONLY .xlsx reader for the doc tab (overhaul-r3 P10).
+ *
+ * An .xlsx is a zip of XML parts. The browser already has both halves of a reader: the zip's
+ * entries are raw-deflate streams, which `DecompressionStream('deflate-raw')` inflates, and the
+ * parts are XML, which `DOMParser` parses. So this file adds no dependency (the npm `xlsx` build
+ * carries open advisories and the fixed builds are not published to npm), fetches nothing, and
+ * executes nothing from the file: cell values are read as text and rendered as text.
+ *
+ * Scope, stated: values only — shared strings, inline strings, numbers, booleans and error codes.
+ * Formulas show their cached value. Dates are serial numbers (formatting is not interpreted). A
+ * part that is missing or malformed throws with the part's name, and the tab says so.
+ */
+
+const td = new TextDecoder();
+
+async function inflateRaw(bytes) {
+  const ds = new DecompressionStream('deflate-raw');
+  const out = new Response(new Blob([bytes]).stream().pipeThrough(ds));
+  return new Uint8Array(await out.arrayBuffer());
+}
+
+/** name → Uint8Array, for the entries we ask for, from the zip's central directory. */
+async function unzip(buf, want) {
+  const u8 = new Uint8Array(buf);
+  const dv = new DataView(buf);
+  let eocd = -1;
+  for (let i = u8.length - 22; i >= Math.max(0, u8.length - 65557); i--) {
+    if (dv.getUint32(i, true) === 0x06054b50) { eocd = i; break; }
+  }
+  if (eocd < 0) throw new Error('not a zip file (no end-of-central-directory record)');
+  const count = dv.getUint16(eocd + 10, true);
+  let p = dv.getUint32(eocd + 16, true);
+  const out = {};
+  for (let n = 0; n < count; n++) {
+    if (dv.getUint32(p, true) !== 0x02014b50) throw new Error('corrupt zip central directory');
+    const method = dv.getUint16(p + 10, true);
+    const csize = dv.getUint32(p + 20, true);
+    const nlen = dv.getUint16(p + 28, true);
+    const xlen = dv.getUint16(p + 30, true);
+    const clen = dv.getUint16(p + 32, true);
+    const local = dv.getUint32(p + 42, true);
+    const name = td.decode(u8.subarray(p + 46, p + 46 + nlen));
+    p += 46 + nlen + xlen + clen;
+    if (!want(name)) continue;
+    const lnlen = dv.getUint16(local + 26, true);
+    const lxlen = dv.getUint16(local + 28, true);
+    const start = local + 30 + lnlen + lxlen;
+    const data = u8.subarray(start, start + csize);
+    if (method === 0) out[name] = data;
+    else if (method === 8) out[name] = await inflateRaw(data);
+    else throw new Error(`${name}: unsupported zip compression method ${method}`);
+  }
+  return out;
+}
+
+const xml = (bytes, part) => {
+  const doc = new DOMParser().parseFromString(td.decode(bytes), 'application/xml');
+  if (doc.getElementsByTagName('parsererror').length) throw new Error(`${part}: malformed XML`);
+  return doc;
+};
+const byTag = (node, tag) => Array.from(node.getElementsByTagNameNS('*', tag));
+const colIndex = (ref) => {
+  let n = 0;
+  for (const ch of String(ref).replace(/\d+$/, '')) n = n * 26 + (ch.charCodeAt(0) - 64);
+  return n - 1;
+};
+
+/**
+ * Read a workbook. Returns `{ sheets: [{ name, rows: string[][], truncated }] }`, at most `cap` rows
+ * per sheet (the cap is reported, never applied silently).
+ */
+export async function readXlsx(buf, cap = 2000) {
+  const parts = await unzip(buf, (n) => n === 'xl/workbook.xml' || n === 'xl/sharedStrings.xml'
+    || n === 'xl/_rels/workbook.xml.rels' || /^xl\/worksheets\/[^/]+\.xml$/.test(n));
+  if (!parts['xl/workbook.xml']) throw new Error('xl/workbook.xml missing — not a spreadsheet');
+  const shared = parts['xl/sharedStrings.xml']
+    ? byTag(xml(parts['xl/sharedStrings.xml'], 'sharedStrings.xml'), 'si').map((si) => byTag(si, 't').map((t) => t.textContent).join(''))
+    : [];
+  const rels = {};
+  if (parts['xl/_rels/workbook.xml.rels']) {
+    for (const r of byTag(xml(parts['xl/_rels/workbook.xml.rels'], 'workbook.xml.rels'), 'Relationship')) {
+      rels[r.getAttribute('Id')] = r.getAttribute('Target');
+    }
+  }
+  const sheets = [];
+  const wb = xml(parts['xl/workbook.xml'], 'workbook.xml');
+  byTag(wb, 'sheet').forEach((s, i) => {
+    // the relationship id is `r:id`; matched by local name so no namespace URI is needed here
+    const rid = s.getAttribute('r:id') || (Array.from(s.attributes).find((at) => at.localName === 'id' && at.prefix) || {}).value;
+    let target = rels[rid] || `worksheets/sheet${i + 1}.xml`;
+    target = 'xl/' + target.replace(/^\/?xl\//, '').replace(/^\//, '');
+    const bytes = parts[target];
+    if (!bytes) { sheets.push({ name: s.getAttribute('name') || `Sheet${i + 1}`, rows: [], truncated: false, error: `${target} missing` }); return; }
+    const doc = xml(bytes, target);
+    const rows = [];
+    let truncated = false;
+    for (const row of byTag(doc, 'row')) {
+      if (rows.length >= cap) { truncated = true; break; }
+      const cells = [];
+      for (const c of byTag(row, 'c')) {
+        const idx = c.getAttribute('r') ? colIndex(c.getAttribute('r')) : cells.length;
+        const t = c.getAttribute('t');
+        const v = byTag(c, 'v')[0];
+        let val = '';
+        if (t === 's') val = shared[parseInt(v && v.textContent, 10)] ?? '';
+        else if (t === 'inlineStr') val = byTag(c, 't').map((x) => x.textContent).join('');
+        else if (t === 'b') val = v && v.textContent === '1' ? 'TRUE' : 'FALSE';
+        else val = v ? v.textContent : '';
+        while (cells.length < idx) cells.push('');
+        cells[idx] = val;
+      }
+      rows.push(cells);
+    }
+    sheets.push({ name: s.getAttribute('name') || `Sheet${i + 1}`, rows, truncated });
+  });
+  return { sheets };
+}