create-pmos 0.38.0 → 0.38.1

package/bin/create-pmos.js

@@ -18,6 +18,7 @@
  * is unchanged. The workspace app itself is bundled in this package, not downloaded.
  */
 'use strict';
+const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
@@ -193,13 +194,33 @@ function installedWorkspaceVersion() {
   const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
   const r = spawnSync(npmCmd, ['root', '-g'], { encoding: 'utf8', shell: process.platform === 'win32' });
   if (r.status !== 0 || !r.stdout) return null;
-  try { return require(path.join(r.stdout.trim(), 'pmos-workspace', 'package.json')).version || null; }
-  catch { return null; }
+  const dir = path.join(r.stdout.trim(), 'pmos-workspace');
+  try {
+    // A SYMLINK is not an install. `npm install -g <folder>` links to the folder and installs no
+    // dependencies, so the link reads as the bundled version (it IS the bundled folder, here the npx
+    // cache) while @xterm and node-pty are absent. Report it as unusable so it is replaced by a copy.
+    if (fs.lstatSync(dir).isSymbolicLink()) return null;
+    // A real copy must also carry its dependencies, or the terminal page cannot load.
+    if (!fs.existsSync(path.join(dir, 'node_modules', '@xterm', 'xterm', 'package.json'))) return null;
+    return require(path.join(dir, 'package.json')).version || null;
+  } catch { return null; }
 }
+// Install a COPY, never a link: pack the bundled app and install the tarball. A tarball install
+// unpacks into the global root and installs the app's own dependencies there (builds node-pty once).
 function installWorkspaceGlobal() {
   const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-  return spawnSync(npmCmd, ['install', '-g', WORKSPACE, '--no-audit', '--no-fund'],
-    { stdio: 'inherit', shell: process.platform === 'win32' }).status;
+  const shell = process.platform === 'win32';
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pmos-ws-'));
+  try {
+    const pack = spawnSync(npmCmd, ['pack', WORKSPACE, '--pack-destination', tmp, '--silent'],
+      { encoding: 'utf8', shell });
+    const tgz = pack.status === 0 ? (pack.stdout || '').trim().split('\n').pop() : '';
+    if (!tgz) { console.error(`create-pmos: could not pack the workspace app${pack.stderr ? ' — ' + pack.stderr.trim() : ''}`); return 1; }
+    return spawnSync(npmCmd, ['install', '-g', path.join(tmp, tgz), '--no-audit', '--no-fund'],
+      { stdio: 'inherit', shell }).status;
+  } finally {
+    try { fs.rmSync(tmp, { recursive: true, force: true }); } catch {}
+  }
 }
 // A persistent server started by the OLD code keeps serving OLD assets after an upgrade — stop it so
 // the next launch brings the server up on the freshly installed code. Best-effort; ignore failures.
@@ -251,8 +272,8 @@ function workspace(targetArg, opts) {
   // Global install refused (common on system-owned npm prefixes) — don't fail, still open the GUI.
   console.log('\n⚠  Could not put `pmos` on your PATH automatically (your npm global prefix may be locked down).');
   console.log('   To get the bare `pmos` command for next time, run ONE of:');
-  console.log(`     npm install -g "${WORKSPACE}"                 # then: pmos`);
-  console.log(`     sudo npm install -g "${WORKSPACE}"            # if your node is system-owned`);
+  console.log(`     npm pack "${WORKSPACE}" && npm install -g ./pmos-workspace-*.tgz   # then: pmos`);
+  console.log(`     sudo npm install -g ./pmos-workspace-*.tgz              # if your node is system-owned`);
   console.log(`   Docs: npm prefix without sudo → https://docs.npmjs.com/resolving-eacces-permissions-errors`);
   console.log('   Opening the GUI now from the bundled copy…\n');
   process.exit(launchWorkspace(targetDir, false));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@cb0de51
+kernel-source: pmos@d1d47bf
 assembled: 2026-10-02
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-02T01:05:10Z"}
+generated: {by: process:create-pmos, at: "2026-10-02T01:57:56Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-02T01:05:10Z"}
+generated: {by: process:create-pmos, at: "2026-10-02T01:57:56Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-02T01:05:10Z"}
+generated: {by: process:create-pmos, at: "2026-10-02T01:57:56Z"}
 status: stable
 ---
 

package/workspace/bin/pmos.js

@@ -43,6 +43,7 @@ const PINNED = process.env.PMOS_WS_PORT ? Number(process.env.PMOS_WS_PORT) : nul
 // this one's pid file — that is exactly how `pmos stop` was left unable to find the real server.
 const pidFile = (port) => path.join(STATE, D.pidFileName(port));
 const logFile = (port) => path.join(STATE, `server-${port}.log`);
+const APP_VERSION = (() => { try { return require('../package.json').version || null; } catch { return null; } })();
 const urlOf = (port) => `http://127.0.0.1:${port}`;
 const NO_OPEN = process.env.PMOS_NO_OPEN === '1';      // tests set this
 
@@ -85,7 +86,7 @@ async function discover() {
   const ports = D.candidatePorts({ stateDir: STATE, pinned: PINNED });
   const hits = await Promise.all(ports.map(async (port) => {
     const s = await probe(port);
-    return s ? { port, sessions: s.sessions } : null;
+    return s ? { port, sessions: s.sessions, version: s.version || null } : null;
   }));
   return hits.filter(Boolean);
 }
@@ -160,10 +161,19 @@ function fixSpawnHelperPerms() {
     try { const st = fs.statSync(f); if (!(st.mode & 0o111)) fs.chmodSync(f, st.mode | 0o755); } catch {}
   }
 }
+// Every runtime dependency must RESOLVE from this app's own directory — not just node-pty. A copy
+// with node-pty but no @xterm (or no node_modules at all) starts a server whose terminal page cannot
+// load, and says nothing until the PM clicks a session.
+function missingDeps() {
+  let deps = [];
+  try { deps = Object.keys(require('../package.json').dependencies || {}); } catch {}
+  return deps.filter((d) => !fs.existsSync(path.join(WS, 'node_modules', ...d.split('/'), 'package.json')));
+}
 function ensureInstalled() {
-  if (!fs.existsSync(path.join(WS, 'node_modules', 'node-pty'))) {
-    say('First run — installing the workspace (one-time, ~20s)…');
-    if (!npm(['install', '--no-audit', '--no-fund'])) {
+  const missing = missingDeps();
+  if (missing.length) {
+    say(`First run — installing the workspace (one-time, ~20s)… missing: ${missing.join(', ')}`);
+    if (!npm(['install', '--omit=dev', '--no-audit', '--no-fund']) || missingDeps().length) {
       say('✗ install failed. Run `pmos doctor` for the exact fix.');
       return false;
     }
@@ -213,6 +223,15 @@ async function choosePort() {
 async function up(dir) {
   // 1. Is a workspace already running — on ANY port it recorded, not just the one this shell guesses?
   let live = await discover();
+  // A server that predates this install is running OLD code under NEW files (or the reverse). Reusing
+  // it is the failure behind "not found is not valid JSON": the page asks for routes that process
+  // never learned. Sessions are tmux-backed, so replacing the server does not end them.
+  const stale = live.filter((l) => l.version !== APP_VERSION);
+  if (stale.length) {
+    say(`note: the running workspace is ${stale[0].version ? 'version ' + stale[0].version : 'an older version'}; this install is ${APP_VERSION}. Restarting it on the new code — sessions keep running in tmux.`);
+    for (const s of stale) await stopOne(s.port);
+    live = await discover();
+  }
   if (live.length) {
     const port = live[0].port;
     if (live.length > 1) {

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/modes-live.js

@@ -31,7 +31,7 @@ function read(key, url) {
   if (!hit || hit.state === 'ok') {
     const next = { state: hit ? hit.state : 'loading', data: hit ? hit.data : null, at: hit ? hit.at : 0 };
     cache.set(key, next);
-    fetch(url).then((r) => r.json()).then(
+    fetch(url).then(readJson).then(
       (data) => { cache.set(key, { state: data && data.ok === false ? 'error' : 'ok', data, error: data && data.error, at: Date.now() }); setState({}); },
       (e) => { cache.set(key, { state: 'error', error: (e && e.message) || String(e), at: Date.now() }); setState({}); },
     );
@@ -40,8 +40,20 @@ function read(key, url) {
   return hit;
 }
 const reload = (key) => cache.delete(key);
+/* A route this server does not have answers 404 with the plain text `not found`. Parsing that as JSON
+ * showed the PM "Unexpected token 'o', \"not found\" is not valid JSON" — true, and no help. The usual
+ * cause is a server still running code older than the page, so say that and the one command. */
+function readJson(r) {
+  return r.text().then((t) => {
+    try { return JSON.parse(t); } catch {
+      throw new Error(r.status === 404
+        ? 'this server does not have that route — it is probably running an older version than the page. Run `pmos` again to restart it'
+        : 'the server answered ' + r.status + ' with something that is not JSON');
+    }
+  });
+}
 const post = (url, body) => fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) })
-  .then((r) => r.json()).catch((e) => ({ ok: false, error: (e && e.message) || String(e) }));
+  .then(readJson).catch((e) => ({ ok: false, error: (e && e.message) || String(e) }));
 function status(r, what) {
   if (r.state === 'loading' && !r.data) return el('div', { style: NOTE }, iv('reading ' + what + ' …'));
   if (r.state === 'error') return el('div', { style: NOTE + ';color:var(--destructive)' }, iv(what + ' could not be read — ' + (r.error || 'error')));
@@ -321,19 +333,73 @@ function candidatesBlock(wsId) {
   }
   return kids;
 }
+/* Discovery is its own section at the TOP: it used to sit under the whole skill list, below the fold,
+ * so a PM who scrolled nothing saw no discovery at all. */
+function discoveryBlock(wsId) {
+  const sch = read('schedules', '/api/schedules?all=1');
+  const mine = ((sch.data && sch.data.schedules) || []).find((x) => x.skill === 'skill-discover' || x.task === 'skill-discover');
+  const kids = [el('div', { style: LABEL + ';color:var(--foreground)', 'data-r13': 'discovery-label' }, iv('skill discovery')),
+    el('div', { style: NOTE }, iv('Finds skills in your own repository and from sources you name. Nothing it finds runs until you read it and approve it.')),
+    el('div', { style: 'display:flex;gap:4px;flex-wrap:wrap;padding:0 14px 6px' },
+      mine ? el('button', { style: BTN, hover: 'color:var(--foreground)', 'data-r13': 'discover-now', onClick: async () => { await post('/api/schedules/run', { id: mine.id }); reload('schedules'); setState({}); } }, 'find skills now') : null,
+      mine ? el('span', { style: 'font-family:var(--mono);font-size:10.5px;color:var(--muted-foreground);align-self:center' }, iv('weekly · next ' + (mine.next ? String(mine.next).slice(0, 16).replace('T', ' ') : '—')))
+        : seedRow('skills', 'set up weekly skill discovery', 'schedules the skill-discover skill weekly (Wednesday 09:00) for the selected repository; it files candidates for you to read and never approves them'))];
+  return [...kids, ...candidatesBlock(wsId)];
+}
 export function skillsLive() {
   const wsId = dataMod && state.product ? dataMod.wsOf(state.product) : null;
   const r = read('skills:' + (wsId || ''), '/api/skills' + (wsId ? '?ws=' + encodeURIComponent(wsId) : ''));
   const st = status(r, 'the skills');
-  if (st) return [st];
+  const head = discoveryBlock(wsId);
+  if (st) return [el('div', { style: 'padding:6px 0' }, [...head, st])];
   const list = (r.data && r.data.skills) || [];
-  const kids = list.map((sk) => el('div', { style: ROW, 'data-r4': 'skill' },
+  const open = state.detail && state.detail.kind === 'skill' ? state.detail.id : null;
+  const kids = list.map((sk) => el('button', { style: ROW + (open === sk.id ? ';background:var(--accent)' : ''), hover: 'background:var(--accent)', 'data-r4': 'skill', 'data-id': sk.id,
+    onClick: () => setState({ detail: { kind: 'skill', id: sk.id } }) },
     el('span', { style: 'display:flex;gap:8px;align-items:baseline' },
       el('span', { style: 'font-family:var(--mono);font-size:12px' }, iv(sk.label || sk.skill || sk.id)),
       el('span', { style: 'margin-left:auto;font-family:var(--mono);font-size:10px;color:var(--muted-foreground)' }, iv(sk.source))),
     el('span', { style: 'display:block;font-size:11px;color:var(--muted-foreground)' }, iv(sk.description))));
   if (!list.length) kids.push(el('div', { style: NOTE }, iv('No skills — a successful read of nothing.')));
-  return [el('div', { style: 'padding:6px 0' }, [...kids, ...candidatesBlock(wsId)])];
+  return [el('div', { style: 'padding:6px 0' }, [...head, el('div', { style: LABEL + ';color:var(--foreground)' }, iv('skills · ' + list.length + ' · click one to read it')), ...kids])];
+}
+
+/* The detail of one skill (panel 3). The text is read from the server on open. Your own skills are
+ * editable and save in place; a builtin or an approved discovered skill is read-only, and "make my own
+ * copy" writes an editable one beside it, so the original is never changed under a review. */
+let skillDraft = { id: null, text: null }; let skillNote = null;
+export function skillDetailLive(det) {
+  const id = det && det.id;
+  const wsId = dataMod && state.product ? dataMod.wsOf(state.product) : null;
+  const r = read('skill:' + id, '/api/skills/read?id=' + encodeURIComponent(id || '') + (wsId ? '&ws=' + encodeURIComponent(wsId) : ''));
+  const st = status(r, 'this skill');
+  if (st) return [st];
+  const d = r.data;
+  if (skillDraft.id !== id) skillDraft = { id, text: null };
+  const text = skillDraft.text !== null ? skillDraft.text : d.text;
+  const dirty = skillDraft.text !== null && skillDraft.text !== d.text;
+  const out = [el('div', { style: 'padding:14px 14px 6px' },
+    el('div', { style: 'font-family:var(--mono);font-size:13px' }, iv(d.label)),
+    el('div', { style: 'font-size:11.5px;color:var(--muted-foreground);margin-top:2px' }, iv(d.source + (d.editable ? ' · yours — edit it below' : ' · read-only') + ' · ' + d.file)),
+    el('div', { style: 'font-size:12px;margin-top:6px' }, iv(d.description)),
+    (d.output || []).length ? el('div', { style: 'font-size:11px;color:var(--muted-foreground);margin-top:6px' }, iv('always produces: ' + d.output.join(' · '))) : null)];
+  out.push(el('div', { style: 'padding:6px 14px' }, el('textarea', { 'data-r13': 'skill-text', spellcheck: 'false', readonly: d.editable ? null : 'readonly',
+    style: 'width:100%;min-height:340px;font-family:var(--mono);font-size:11.5px;line-height:1.5;background:var(--secondary);border:1px solid var(--border);color:var(--foreground);padding:8px;resize:vertical',
+    onInput: (e) => { skillDraft = { id, text: e.target.value }; } }, text)));
+  out.push(el('div', { style: 'display:flex;gap:6px;align-items:center;padding:6px 14px 14px;flex-wrap:wrap' },
+    d.editable ? el('button', { style: BTN, hover: 'color:var(--foreground)', 'data-r13': 'skill-save', onClick: async () => {
+      const res = await post('/api/skills/save', { id, text: skillDraft.text !== null ? skillDraft.text : d.text });
+      skillNote = res && res.ok ? 'saved' : ((res && res.error) || 'not saved');
+      if (res && res.ok) { skillDraft = { id, text: null }; reload('skill:' + id); reload('skills:' + (wsId || '')); }
+      setState({});
+    } }, 'save') : el('button', { style: BTN, hover: 'color:var(--foreground)', 'data-r13': 'skill-copy', onClick: async () => {
+      const res = await post('/api/skills/copy', { id, ws: wsId });
+      if (res && res.ok) { skillNote = 'copied as ' + res.id + ' — it is yours to edit'; reload('skills:' + (wsId || '')); setState({ detail: { kind: 'skill', id: res.id } }); }
+      else { skillNote = (res && res.error) || 'not copied'; setState({}); }
+    } }, 'make my own copy to edit'),
+    dirty ? el('span', { style: 'font-size:11px;color:var(--muted-foreground)' }, 'unsaved changes') : null,
+    skillNote ? el('span', { 'data-r13': 'skill-note', style: 'font-size:11px;color:var(--muted-foreground)' }, iv(skillNote)) : null));
+  return out;
 }
 
 /* ── knowledge ──────────────────────────────────────────────────────────────────────────────── */

package/workspace/public/pm/modes.js

@@ -1052,7 +1052,7 @@ const LISTS = {
 const BODIES = {
   flow: flowBody,
   sched: schedBody,
-  skill: skillBody,
+  skill: (det) => (FIXTURE ? skillBody(det) : LIVE.skillDetailLive(det)),
   know: knowBody,
   agent: agentBody,
   mem: memBody,

package/workspace/server.js

@@ -116,6 +116,7 @@ const HOME_ENABLED = EMBEDDED_SELF || (!!process.env.PMOS_SELF_ROOT && dirExists
 const PUB = path.join(__dirname, 'public');
 const PM_DIR = path.join(PUB, 'pm');   // the four-panel front end — served as a directory, guarded below
 const XROOT = path.join(__dirname, 'node_modules', '@xterm');
+const APP_VERSION = (() => { try { return require('./package.json').version || null; } catch { return null; } })();
 // ── WHERE THE PM'S RUNTIME STATE LIVES (see lib/state-root.js for the whole argument). ─────────
 // It is NOT `workspace/state/` any more. That directory is inside the application directory the
 // test suite runs from, which put the PM's live sessions, workspace registry and authored skills
@@ -1983,14 +1984,17 @@ function filingContract(w) {
 // D76 — `root` adds the repository's APPROVED discovered skills, loaded FIRST so the PM's own skill of the same id
 // overrides one and a built-in overrides both. Only an approved candidate whose file still hashes to what was approved
 // is ever offered; its harness is forced to an agent skill running claude.
-function loadTasks(root) {
+// The loaded skill records, each with the `file` it came from. loadTasks maps these to the task shape
+// and drops the file; the skill detail routes below need the file, so both read through here.
+function loadSkillRecords(root) {
   const discovered = root ? skillsReg.loadApproved(root, SKILL_APPROVALS, skillStore.parseSkill).skills : [];
   return skillStore.loadSkills([
     ...(discovered.length ? [{ skills: discovered }] : []),
     { dir: userSkillsDir(), source: 'user' },
     { dir: BUILTIN_SKILLS_DIR, source: 'builtin' },
-  ]).map(toTask);
+  ]);
 }
+function loadTasks(root) { return loadSkillRecords(root).map(toTask); }
 // Map a loaded skill to the internal task shape fireSchedule/the picker use. `kind` is derived from the
 // file's `run` and stays INTERNAL — it is never a field the PM selects.
 function toTask(s) {
@@ -4590,6 +4594,44 @@ async function handleRequest(req, res) {
   }
   if (p === '/api/tasks') return json(res, { tasks: loadTasks().map((t) => ({ id: t.id, label: t.label, skill: t.skill, kind: t.kind })) });
   // ── skills (workspace-skill-authoring): the ONE-concept surface + the New Skill flow ──
+  // One skill's full text, for the detail panel. Only the PM's own skills (source `user`) are
+  // editable: a builtin ships with the app and a discovered one is pinned to the text the PM approved,
+  // so editing either in place would change what was reviewed. Both can be copied to an editable one.
+  if (p === '/api/skills/read' && req.method === 'GET') {
+    const sw = getWs(url.searchParams.get('ws'));
+    const rec = loadSkillRecords(sw ? sw.root : null).find((x) => x.id === url.searchParams.get('id'));
+    if (!rec) return json(res, { ok: false, error: 'no skill with that name' }, 404);
+    let text; try { text = fs.readFileSync(rec.file, 'utf8'); } catch { return json(res, { ok: false, error: 'the skill file could not be read' }, 500); }
+    return json(res, { ok: true, id: rec.id, label: rec.label || rec.id, source: rec.source, editable: rec.source === 'user',
+      file: path.basename(rec.file), description: rec.description || '', output: rec.output || [], text });
+  }
+  if (p === '/api/skills/save' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON' }, 400); }
+    const rec = loadSkillRecords(null).find((x) => x.id === body.id && x.source === 'user');
+    if (!rec) return json(res, { ok: false, error: 'only your own skills can be edited here' }, 403);
+    const text = typeof body.text === 'string' ? body.text : '';
+    if (!text.trim() || text.length > 200000) return json(res, { ok: false, error: 'the skill text is empty or too long' }, 400);
+    const parsed = skillStore.parseSkill(text);
+    if (parsed.name !== rec.id) return json(res, { ok: false, error: `the name: line must stay "${rec.id}" — rename by copying instead` }, 400);
+    if (!String(parsed.description || '').trim()) return json(res, { ok: false, error: 'the skill needs a description: line' }, 400);
+    try { const tmp = rec.file + '.tmp'; fs.writeFileSync(tmp, text.endsWith('\n') ? text : text + '\n'); fs.renameSync(tmp, rec.file); }
+    catch { return json(res, { ok: false, error: 'the skill file could not be written' }, 500); }
+    return json(res, { ok: true, id: rec.id });
+  }
+  if (p === '/api/skills/copy' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON' }, 400); }
+    const sw = getWs(body.ws);
+    const all = loadSkillRecords(sw ? sw.root : null);
+    const rec = all.find((x) => x.id === body.id);
+    if (!rec) return json(res, { ok: false, error: 'no skill with that name' }, 404);
+    let id = rec.id + '-copy';
+    for (let n = 2; all.some((x) => x.id === id); n++) id = rec.id + '-copy-' + n;
+    let text; try { text = fs.readFileSync(rec.file, 'utf8'); } catch { return json(res, { ok: false, error: 'the skill file could not be read' }, 500); }
+    text = text.replace(/^name:.*$/m, 'name: ' + id).replace(/^label:\s*"?(.*?)"?\s*$/m, (_, l) => 'label: "' + l.replace(/"/g, "'") + ' (my copy)"');
+    try { const d = userSkillsDir(); fs.mkdirSync(d, { recursive: true }); fs.writeFileSync(path.join(d, id + '.skill'), text, { flag: 'wx' }); }
+    catch { return json(res, { ok: false, error: 'the copy could not be written' }, 500); }
+    return json(res, { ok: true, id });
+  }
   // GET lists every skill with NO kind field — from the user's view there is just a skill.
   if (p === '/api/skills' && req.method === 'GET') {
     const sw = getWs(url.searchParams.get('ws'));
@@ -4810,7 +4852,9 @@ async function handleRequest(req, res) {
     if (mc.ok) mc.core.logDecision(s.root, { kind: 'switch', session: s.id, agent: s.agent, tier: r.tier, model: r.model, by: 'human:wawan' });
     return json(res, { ok: true, model: r.model, tier: r.tier, note: 'typed /model into the pane; effort is unchanged' });
   }
-  if (p === '/api/sessions') return json(res, { sessions: sessionList() });
+  // `version` lets the launcher notice a server still running OLD code after an upgrade: files on disk
+  // advance under a live process, so the UI would otherwise call routes that process never learned.
+  if (p === '/api/sessions') return json(res, { sessions: sessionList(), version: APP_VERSION });
   if (p === '/api/git/branches') {
     // Read-only branch awareness for a workspace. A non-repo returns {ok:false} (never a fake
     // branch). Fixed git args, no caller input in the read path (R1).