create-pmos 0.38.0 → 0.38.2

package/bin/create-pmos.js

@@ -18,6 +18,7 @@
  * is unchanged. The workspace app itself is bundled in this package, not downloaded.
  */
 'use strict';
+const os = require('os');
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
@@ -193,13 +194,33 @@ function installedWorkspaceVersion() {
   const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
   const r = spawnSync(npmCmd, ['root', '-g'], { encoding: 'utf8', shell: process.platform === 'win32' });
   if (r.status !== 0 || !r.stdout) return null;
-  try { return require(path.join(r.stdout.trim(), 'pmos-workspace', 'package.json')).version || null; }
-  catch { return null; }
+  const dir = path.join(r.stdout.trim(), 'pmos-workspace');
+  try {
+    // A SYMLINK is not an install. `npm install -g <folder>` links to the folder and installs no
+    // dependencies, so the link reads as the bundled version (it IS the bundled folder, here the npx
+    // cache) while @xterm and node-pty are absent. Report it as unusable so it is replaced by a copy.
+    if (fs.lstatSync(dir).isSymbolicLink()) return null;
+    // A real copy must also carry its dependencies, or the terminal page cannot load.
+    if (!fs.existsSync(path.join(dir, 'node_modules', '@xterm', 'xterm', 'package.json'))) return null;
+    return require(path.join(dir, 'package.json')).version || null;
+  } catch { return null; }
 }
+// Install a COPY, never a link: pack the bundled app and install the tarball. A tarball install
+// unpacks into the global root and installs the app's own dependencies there (builds node-pty once).
 function installWorkspaceGlobal() {
   const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
-  return spawnSync(npmCmd, ['install', '-g', WORKSPACE, '--no-audit', '--no-fund'],
-    { stdio: 'inherit', shell: process.platform === 'win32' }).status;
+  const shell = process.platform === 'win32';
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pmos-ws-'));
+  try {
+    const pack = spawnSync(npmCmd, ['pack', WORKSPACE, '--pack-destination', tmp, '--silent'],
+      { encoding: 'utf8', shell });
+    const tgz = pack.status === 0 ? (pack.stdout || '').trim().split('\n').pop() : '';
+    if (!tgz) { console.error(`create-pmos: could not pack the workspace app${pack.stderr ? ' — ' + pack.stderr.trim() : ''}`); return 1; }
+    return spawnSync(npmCmd, ['install', '-g', path.join(tmp, tgz), '--no-audit', '--no-fund'],
+      { stdio: 'inherit', shell }).status;
+  } finally {
+    try { fs.rmSync(tmp, { recursive: true, force: true }); } catch {}
+  }
 }
 // A persistent server started by the OLD code keeps serving OLD assets after an upgrade — stop it so
 // the next launch brings the server up on the freshly installed code. Best-effort; ignore failures.
@@ -251,8 +272,8 @@ function workspace(targetArg, opts) {
   // Global install refused (common on system-owned npm prefixes) — don't fail, still open the GUI.
   console.log('\n⚠  Could not put `pmos` on your PATH automatically (your npm global prefix may be locked down).');
   console.log('   To get the bare `pmos` command for next time, run ONE of:');
-  console.log(`     npm install -g "${WORKSPACE}"                 # then: pmos`);
-  console.log(`     sudo npm install -g "${WORKSPACE}"            # if your node is system-owned`);
+  console.log(`     npm pack "${WORKSPACE}" && npm install -g ./pmos-workspace-*.tgz   # then: pmos`);
+  console.log(`     sudo npm install -g ./pmos-workspace-*.tgz              # if your node is system-owned`);
   console.log(`   Docs: npm prefix without sudo → https://docs.npmjs.com/resolving-eacces-permissions-errors`);
   console.log('   Opening the GUI now from the bundled copy…\n');
   process.exit(launchWorkspace(targetDir, false));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.38.0",
+  "version": "0.38.2",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@cb0de51
+kernel-source: pmos@6270efe
 assembled: 2026-10-02
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-02T01:05:10Z"}
+generated: {by: process:create-pmos, at: "2026-10-02T03:08:00Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-02T01:05:10Z"}
+generated: {by: process:create-pmos, at: "2026-10-02T03:08:00Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-02T01:05:10Z"}
+generated: {by: process:create-pmos, at: "2026-10-02T03:08:00Z"}
 status: stable
 ---
 

package/workspace/bin/pmos.js

@@ -43,6 +43,7 @@ const PINNED = process.env.PMOS_WS_PORT ? Number(process.env.PMOS_WS_PORT) : nul
 // this one's pid file — that is exactly how `pmos stop` was left unable to find the real server.
 const pidFile = (port) => path.join(STATE, D.pidFileName(port));
 const logFile = (port) => path.join(STATE, `server-${port}.log`);
+const APP_VERSION = (() => { try { return require('../package.json').version || null; } catch { return null; } })();
 const urlOf = (port) => `http://127.0.0.1:${port}`;
 const NO_OPEN = process.env.PMOS_NO_OPEN === '1';      // tests set this
 
@@ -85,7 +86,7 @@ async function discover() {
   const ports = D.candidatePorts({ stateDir: STATE, pinned: PINNED });
   const hits = await Promise.all(ports.map(async (port) => {
     const s = await probe(port);
-    return s ? { port, sessions: s.sessions } : null;
+    return s ? { port, sessions: s.sessions, version: s.version || null } : null;
   }));
   return hits.filter(Boolean);
 }
@@ -160,10 +161,19 @@ function fixSpawnHelperPerms() {
     try { const st = fs.statSync(f); if (!(st.mode & 0o111)) fs.chmodSync(f, st.mode | 0o755); } catch {}
   }
 }
+// Every runtime dependency must RESOLVE from this app's own directory — not just node-pty. A copy
+// with node-pty but no @xterm (or no node_modules at all) starts a server whose terminal page cannot
+// load, and says nothing until the PM clicks a session.
+function missingDeps() {
+  let deps = [];
+  try { deps = Object.keys(require('../package.json').dependencies || {}); } catch {}
+  return deps.filter((d) => !fs.existsSync(path.join(WS, 'node_modules', ...d.split('/'), 'package.json')));
+}
 function ensureInstalled() {
-  if (!fs.existsSync(path.join(WS, 'node_modules', 'node-pty'))) {
-    say('First run — installing the workspace (one-time, ~20s)…');
-    if (!npm(['install', '--no-audit', '--no-fund'])) {
+  const missing = missingDeps();
+  if (missing.length) {
+    say(`First run — installing the workspace (one-time, ~20s)… missing: ${missing.join(', ')}`);
+    if (!npm(['install', '--omit=dev', '--no-audit', '--no-fund']) || missingDeps().length) {
       say('✗ install failed. Run `pmos doctor` for the exact fix.');
       return false;
     }
@@ -213,6 +223,15 @@ async function choosePort() {
 async function up(dir) {
   // 1. Is a workspace already running — on ANY port it recorded, not just the one this shell guesses?
   let live = await discover();
+  // A server that predates this install is running OLD code under NEW files (or the reverse). Reusing
+  // it is the failure behind "not found is not valid JSON": the page asks for routes that process
+  // never learned. Sessions are tmux-backed, so replacing the server does not end them.
+  const stale = live.filter((l) => l.version !== APP_VERSION);
+  if (stale.length) {
+    say(`note: the running workspace is ${stale[0].version ? 'version ' + stale[0].version : 'an older version'}; this install is ${APP_VERSION}. Restarting it on the new code — sessions keep running in tmux.`);
+    for (const s of stale) await stopOne(s.port);
+    live = await discover();
+  }
   if (live.length) {
     const port = live[0].port;
     if (live.length > 1) {

package/workspace/lib/git-info.js

@@ -123,14 +123,30 @@ function worktreePath(root, branch) {
   return path.join(path.dirname(top), path.basename(top) + '-worktrees', branch.replace(/\//g, '-'));
 }
 
+// The start point of a NEW branch: an existing branch name or a commit id, nothing else. A name that
+// passes validBranchName cannot begin with `-`, so it cannot be read by git as an option; it must
+// also resolve to a commit, so a typo is refused here with a reason and not by git's own message.
+// No base means "where this tree is now" — git's default.
+function baseRef(root, from) {
+  if (from === null || from === undefined || from === '') return { ok: true, ref: null };
+  const ref = String(from);
+  if (!validBranchName(ref) && !/^[0-9a-f]{7,40}$/i.test(ref)) return { ok: false, error: 'invalid base' };
+  const r = git(root, ['rev-parse', '--verify', '--quiet', ref + '^{commit}']);
+  if (r.failed) return { ok: false, error: 'git not available' };
+  if (r.code !== 0) return { ok: false, error: `base '${ref}' does not exist` };
+  return { ok: true, ref };
+}
+
 // Check out an existing branch, or create one with -b. THIS MOVES THE WHOLE REPO — every session
 // in every workspace under it. Confined to `root` by cwd; the name is validated first so nothing
 // malformed reaches git. On any failure returns { ok:false, error } and leaves the caller to NOT
 // spawn a session on the wrong branch (a failed checkout must never spawn).
-function checkout(root, branch, { create = false } = {}) {
+function checkout(root, branch, { create = false, from = null } = {}) {
   if (!isRepo(root)) return { ok: false, error: 'not a git repository' };
   if (!validBranchName(branch)) return { ok: false, error: 'invalid branch name' };
-  const args = create ? ['checkout', '-b', branch, '--'] : ['checkout', branch, '--'];
+  const base = baseRef(root, from);
+  if (!base.ok) return base;
+  const args = create ? ['checkout', '-b', branch, ...(base.ref ? [base.ref] : []), '--'] : ['checkout', branch, '--'];
   const r = git(root, args);
   if (r.failed) return { ok: false, error: 'git not available' };
   if (r.code !== 0) return { ok: false, error: (r.err || r.out || 'checkout failed').split('\n')[0].slice(0, 200) };
@@ -142,10 +158,12 @@ function checkout(root, branch, { create = false } = {}) {
 // session stays untouched. `create` makes the branch (`-b`); otherwise the branch must exist and
 // must not already be checked out somewhere else (git refuses — we return that plainly).
 // Returns { ok, dir, branch, reused } or { ok:false, error }.
-function addWorktree(root, branch, { create = false } = {}) {
+function addWorktree(root, branch, { create = false, from = null } = {}) {
   const top = repoRoot(root);
   if (!top) return { ok: false, error: 'not a git repository' };
   if (!validBranchName(branch)) return { ok: false, error: 'invalid branch name' };
+  const base = baseRef(top, from);
+  if (!base.ok) return base;
 
   // Already checked out somewhere? Say where, rather than letting git's message be the first the
   // PM sees — and if it is exactly the worktree we would have made, reuse it instead of failing.
@@ -161,7 +179,7 @@ function addWorktree(root, branch, { create = false } = {}) {
   try { fs.mkdirSync(path.dirname(dir), { recursive: true }); }
   catch (e) { return { ok: false, error: `cannot create ${path.dirname(dir)}: ${e.code || e.message}` }; }
 
-  const args = create ? ['worktree', 'add', '-b', branch, dir] : ['worktree', 'add', dir, branch];
+  const args = create ? ['worktree', 'add', '-b', branch, dir, ...(base.ref ? [base.ref] : [])] : ['worktree', 'add', dir, branch];
   const r = git(top, args);
   if (r.failed) return { ok: false, error: 'git not available' };
   if (r.code !== 0) {

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.38.0",
+  "version": "0.38.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.38.0",
+  "version": "0.38.2",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",
@@ -15,7 +15,7 @@
     "test:parity": "node design-parity.js --states",
     "test:all": "npm test && npm run test:panels && npm run test:ui && npm run test:parity && npm run test:offline",
     "doctor": "node doctor.js",
-    "test:panels": "node pm-shell-test.js && node pm-repos-test.js && node pm-initiatives-test.js && node pm-detail-test.js && node pm-tabs-test.js && node pm-term-test.js && node pm-modes-test.js && node pm-r1-test.js && node pm-r2-test.js && node pm-r3-test.js && node pm-r4-test.js && node pm-r5-test.js && node pm-r6-test.js && node pm-r7-test.js && node pm-r8-test.js && node pm-r9-test.js && node pm-r10-test.js && node pm-r11-test.js && node pm-r12-test.js && node pm-r13-test.js",
+    "test:panels": "node pm-shell-test.js && node pm-repos-test.js && node pm-initiatives-test.js && node pm-detail-test.js && node pm-tabs-test.js && node pm-term-test.js && node pm-modes-test.js && node pm-r1-test.js && node pm-r2-test.js && node pm-r3-test.js && node pm-r4-test.js && node pm-r5-test.js && node pm-r6-test.js && node pm-r7-test.js && node pm-r8-test.js && node pm-r9-test.js && node pm-r10-test.js && node pm-r11-test.js && node pm-r12-test.js && node pm-r13-test.js && node pm-r14-test.js",
     "test:offline": "node offline-tarball.test.js"
   },
   "engines": {

package/workspace/public/pm/data.js

@@ -997,7 +997,7 @@ export function productTrees(name) {
   const key = p.root;
   return p.trees.map((t) => {
     const m = /^initiative\/(.+)$/.exec(t.branch || '');
-    return { ws: t.id, branch: t.branch || null, main: t.root === key, sessions: t.sessions || 0,
+    return { ws: t.id, dir: t.tree || t.root, branch: t.branch || null, main: t.root === key, sessions: t.sessions || 0,
       initiative: m ? m[1] : null, by: m ? 'branch' : null };
   }).sort((a, b) => (b.main - a.main));
 }
@@ -1202,6 +1202,36 @@ export async function preferProfile(agent, profile) {
   return postJson('/api/profiles/prefer', { agent, profile });
 }
 
+/** Re-read the registered trees only — no boards. A worktree created or removed anywhere (a spawn, the
+ * branch form, a terminal) reaches panel 1 through this, instead of waiting for a reload. */
+export async function refreshTrees() {
+  if (FIXTURE) return;
+  const out = await getJson('/api/workspaces');
+  if (!out || !Array.isArray(out.workspaces)) return;
+  const rows = foldWorkspaces(out.workspaces);
+  for (const r of rows) products.set(r.name, Object.assign(products.get(r.name) || {}, r));
+  publishBoards();
+}
+
+/** Create a branch with no session. `worktree` false = a checkout in the shared tree (the server
+ * refuses it while sessions run there). */
+export async function createBranch({ ws, name, from, worktree }) {
+  if (FIXTURE) return { ok: false, error: 'fixture mode creates no branch' };
+  return postJson('/api/git/branch', { ws, name, from: from || null, worktree: worktree !== false });
+}
+
+/** End a session and remove it, with an answer. */
+export async function removeSessionById(id) {
+  if (FIXTURE) return { ok: false, error: 'fixture mode has no sessions' };
+  return postJson('/api/session/remove', { id });
+}
+
+/** Remove a linked worktree folder. The server refuses a busy or unsaved one and says why. */
+export async function removeWorktree(ws, dir) {
+  if (FIXTURE) return { ok: false, error: 'fixture mode has no worktrees' };
+  return postJson('/api/git/worktrees/remove', { ws, dir });
+}
+
 /** Every working tree of this workspace's repo. The pre-flight reads it for ONE purpose: a branch
  * checked out elsewhere is a branch git will refuse, and the PM should read that in the picker
  * rather than as an error after the click. */

package/workspace/public/pm/modes-live.js

@@ -31,7 +31,7 @@ function read(key, url) {
   if (!hit || hit.state === 'ok') {
     const next = { state: hit ? hit.state : 'loading', data: hit ? hit.data : null, at: hit ? hit.at : 0 };
     cache.set(key, next);
-    fetch(url).then((r) => r.json()).then(
+    fetch(url).then(readJson).then(
       (data) => { cache.set(key, { state: data && data.ok === false ? 'error' : 'ok', data, error: data && data.error, at: Date.now() }); setState({}); },
       (e) => { cache.set(key, { state: 'error', error: (e && e.message) || String(e), at: Date.now() }); setState({}); },
     );
@@ -40,8 +40,20 @@ function read(key, url) {
   return hit;
 }
 const reload = (key) => cache.delete(key);
+/* A route this server does not have answers 404 with the plain text `not found`. Parsing that as JSON
+ * showed the PM "Unexpected token 'o', \"not found\" is not valid JSON" — true, and no help. The usual
+ * cause is a server still running code older than the page, so say that and the one command. */
+function readJson(r) {
+  return r.text().then((t) => {
+    try { return JSON.parse(t); } catch {
+      throw new Error(r.status === 404
+        ? 'this server does not have that route — it is probably running an older version than the page. Run `pmos` again to restart it'
+        : 'the server answered ' + r.status + ' with something that is not JSON');
+    }
+  });
+}
 const post = (url, body) => fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) })
-  .then((r) => r.json()).catch((e) => ({ ok: false, error: (e && e.message) || String(e) }));
+  .then(readJson).catch((e) => ({ ok: false, error: (e && e.message) || String(e) }));
 function status(r, what) {
   if (r.state === 'loading' && !r.data) return el('div', { style: NOTE }, iv('reading ' + what + ' …'));
   if (r.state === 'error') return el('div', { style: NOTE + ';color:var(--destructive)' }, iv(what + ' could not be read — ' + (r.error || 'error')));
@@ -321,19 +333,73 @@ function candidatesBlock(wsId) {
   }
   return kids;
 }
+/* Discovery is its own section at the TOP: it used to sit under the whole skill list, below the fold,
+ * so a PM who scrolled nothing saw no discovery at all. */
+function discoveryBlock(wsId) {
+  const sch = read('schedules', '/api/schedules?all=1');
+  const mine = ((sch.data && sch.data.schedules) || []).find((x) => x.skill === 'skill-discover' || x.task === 'skill-discover');
+  const kids = [el('div', { style: LABEL + ';color:var(--foreground)', 'data-r13': 'discovery-label' }, iv('skill discovery')),
+    el('div', { style: NOTE }, iv('Finds skills in your own repository and from sources you name. Nothing it finds runs until you read it and approve it.')),
+    el('div', { style: 'display:flex;gap:4px;flex-wrap:wrap;padding:0 14px 6px' },
+      mine ? el('button', { style: BTN, hover: 'color:var(--foreground)', 'data-r13': 'discover-now', onClick: async () => { await post('/api/schedules/run', { id: mine.id }); reload('schedules'); setState({}); } }, 'find skills now') : null,
+      mine ? el('span', { style: 'font-family:var(--mono);font-size:10.5px;color:var(--muted-foreground);align-self:center' }, iv('weekly · next ' + (mine.next ? String(mine.next).slice(0, 16).replace('T', ' ') : '—')))
+        : seedRow('skills', 'set up weekly skill discovery', 'schedules the skill-discover skill weekly (Wednesday 09:00) for the selected repository; it files candidates for you to read and never approves them'))];
+  return [...kids, ...candidatesBlock(wsId)];
+}
 export function skillsLive() {
   const wsId = dataMod && state.product ? dataMod.wsOf(state.product) : null;
   const r = read('skills:' + (wsId || ''), '/api/skills' + (wsId ? '?ws=' + encodeURIComponent(wsId) : ''));
   const st = status(r, 'the skills');
-  if (st) return [st];
+  const head = discoveryBlock(wsId);
+  if (st) return [el('div', { style: 'padding:6px 0' }, [...head, st])];
   const list = (r.data && r.data.skills) || [];
-  const kids = list.map((sk) => el('div', { style: ROW, 'data-r4': 'skill' },
+  const open = state.detail && state.detail.kind === 'skill' ? state.detail.id : null;
+  const kids = list.map((sk) => el('button', { style: ROW + (open === sk.id ? ';background:var(--accent)' : ''), hover: 'background:var(--accent)', 'data-r4': 'skill', 'data-id': sk.id,
+    onClick: () => setState({ detail: { kind: 'skill', id: sk.id } }) },
     el('span', { style: 'display:flex;gap:8px;align-items:baseline' },
       el('span', { style: 'font-family:var(--mono);font-size:12px' }, iv(sk.label || sk.skill || sk.id)),
       el('span', { style: 'margin-left:auto;font-family:var(--mono);font-size:10px;color:var(--muted-foreground)' }, iv(sk.source))),
     el('span', { style: 'display:block;font-size:11px;color:var(--muted-foreground)' }, iv(sk.description))));
   if (!list.length) kids.push(el('div', { style: NOTE }, iv('No skills — a successful read of nothing.')));
-  return [el('div', { style: 'padding:6px 0' }, [...kids, ...candidatesBlock(wsId)])];
+  return [el('div', { style: 'padding:6px 0' }, [...head, el('div', { style: LABEL + ';color:var(--foreground)' }, iv('skills · ' + list.length + ' · click one to read it')), ...kids])];
+}
+
+/* The detail of one skill (panel 3). The text is read from the server on open. Your own skills are
+ * editable and save in place; a builtin or an approved discovered skill is read-only, and "make my own
+ * copy" writes an editable one beside it, so the original is never changed under a review. */
+let skillDraft = { id: null, text: null }; let skillNote = null;
+export function skillDetailLive(det) {
+  const id = det && det.id;
+  const wsId = dataMod && state.product ? dataMod.wsOf(state.product) : null;
+  const r = read('skill:' + id, '/api/skills/read?id=' + encodeURIComponent(id || '') + (wsId ? '&ws=' + encodeURIComponent(wsId) : ''));
+  const st = status(r, 'this skill');
+  if (st) return [st];
+  const d = r.data;
+  if (skillDraft.id !== id) skillDraft = { id, text: null };
+  const text = skillDraft.text !== null ? skillDraft.text : d.text;
+  const dirty = skillDraft.text !== null && skillDraft.text !== d.text;
+  const out = [el('div', { style: 'padding:14px 14px 6px' },
+    el('div', { style: 'font-family:var(--mono);font-size:13px' }, iv(d.label)),
+    el('div', { style: 'font-size:11.5px;color:var(--muted-foreground);margin-top:2px' }, iv(d.source + (d.editable ? ' · yours — edit it below' : ' · read-only') + ' · ' + d.file)),
+    el('div', { style: 'font-size:12px;margin-top:6px' }, iv(d.description)),
+    (d.output || []).length ? el('div', { style: 'font-size:11px;color:var(--muted-foreground);margin-top:6px' }, iv('always produces: ' + d.output.join(' · '))) : null)];
+  out.push(el('div', { style: 'padding:6px 14px' }, el('textarea', { 'data-r13': 'skill-text', spellcheck: 'false', readonly: d.editable ? null : 'readonly',
+    style: 'width:100%;min-height:340px;font-family:var(--mono);font-size:11.5px;line-height:1.5;background:var(--secondary);border:1px solid var(--border);color:var(--foreground);padding:8px;resize:vertical',
+    onInput: (e) => { skillDraft = { id, text: e.target.value }; } }, text)));
+  out.push(el('div', { style: 'display:flex;gap:6px;align-items:center;padding:6px 14px 14px;flex-wrap:wrap' },
+    d.editable ? el('button', { style: BTN, hover: 'color:var(--foreground)', 'data-r13': 'skill-save', onClick: async () => {
+      const res = await post('/api/skills/save', { id, text: skillDraft.text !== null ? skillDraft.text : d.text });
+      skillNote = res && res.ok ? 'saved' : ((res && res.error) || 'not saved');
+      if (res && res.ok) { skillDraft = { id, text: null }; reload('skill:' + id); reload('skills:' + (wsId || '')); }
+      setState({});
+    } }, 'save') : el('button', { style: BTN, hover: 'color:var(--foreground)', 'data-r13': 'skill-copy', onClick: async () => {
+      const res = await post('/api/skills/copy', { id, ws: wsId });
+      if (res && res.ok) { skillNote = 'copied as ' + res.id + ' — it is yours to edit'; reload('skills:' + (wsId || '')); setState({ detail: { kind: 'skill', id: res.id } }); }
+      else { skillNote = (res && res.error) || 'not copied'; setState({}); }
+    } }, 'make my own copy to edit'),
+    dirty ? el('span', { style: 'font-size:11px;color:var(--muted-foreground)' }, 'unsaved changes') : null,
+    skillNote ? el('span', { 'data-r13': 'skill-note', style: 'font-size:11px;color:var(--muted-foreground)' }, iv(skillNote)) : null));
+  return out;
 }
 
 /* ── knowledge ──────────────────────────────────────────────────────────────────────────────── */

package/workspace/public/pm/modes.js

@@ -1052,7 +1052,7 @@ const LISTS = {
 const BODIES = {
   flow: flowBody,
   sched: schedBody,
-  skill: skillBody,
+  skill: (det) => (FIXTURE ? skillBody(det) : LIVE.skillDetailLive(det)),
   know: knowBody,
   agent: agentBody,
   mem: memBody,

package/workspace/public/pm/panel-newsess.js

@@ -33,6 +33,7 @@ import { el } from './dom.js';
 import { state, setState, FIXTURE } from './state.js';
 import * as FX from './fixture.js';
 import { openTerm as openTermTab } from './panel-initiatives.js';
+import { startHere } from './panel-trees.js';
 
 /* Both are another module's file, loaded lazily for the reason panel-tabs.js gives: a static import
  * of a file that fails to load takes this whole module down with it, and a panel that cannot draw
@@ -214,7 +215,7 @@ function branchSection() {
     return out;
   }
 
-  const current = info.branch || null;
+  const current = info.current || info.branch || null;
   const branches = Array.isArray(info.branches) ? info.branches : [];
   /* A branch checked out in ANOTHER working tree is a branch git will refuse to check out here.
    * Offering it and letting the server say no would be technically honest and practically rude:
@@ -237,11 +238,22 @@ function branchSection() {
   for (const b of branches) {
     if (b === current) continue;
     const taken = elsewhere.get(b);
+    /* A branch already open in another working tree cannot be checked out twice, but it CAN be worked
+     * in: the chip starts a session in that tree. It used to be a disabled chip, so the folder the PM
+     * already had was the one place they could not start. */
+    const treeOf = taken && dataMod && typeof dataMod.productTrees === 'function'
+      ? dataMod.productTrees(state.product).find((t) => t.branch === b && !t.main) : null;
     chips.push(taken
-      ? el('button', {
-          disabled: true, title: 'git will not check this out twice — it is already in ' + taken,
-          style: CHIP_DEAD,
-        }, iv(b + ' — in ' + shortPath(taken)))
+      ? (treeOf
+        ? el('button', {
+            onClick: () => { closeNewSession(); startHere(state.product, treeOf); },
+            title: 'this branch is already open in ' + taken + ' — start the session there',
+            style: CHIP, hover: HOVER, 'data-r14': 'open-worktree',
+          }, iv(b + ' — open that worktree'))
+        : el('button', {
+            disabled: true, title: 'git will not check this out twice — it is already in ' + taken,
+            style: CHIP_DEAD,
+          }, iv(b + ' — in ' + shortPath(taken))))
       : el('button', {
           onClick: () => pick(b),
           style: state.newSessBranch === b && !state.newSessBranchMode ? CHIP_ON : CHIP, hover: HOVER,
@@ -435,6 +447,7 @@ async function onStart() {
     name,
     agent: state.newSessAgent || 'shell',
     ws: state.wsId || null,
+    initiative: slug || undefined,
     branch: branch || null,
     createBranch,
     // Sent explicitly, ALWAYS, and only when a branch is in play — the server defaults an omitted

package/workspace/public/pm/panel-repos.js

@@ -25,6 +25,7 @@
 
 import { el, setChildren } from './dom.js';
 import { syncButton } from './lifecycle.js';
+import { treesBlock, branchForm, openBranchForm, treeNoteFor } from './panel-trees.js';
 import { state, setState, FIXTURE } from './state.js';
 import {
   productsList, repoRow, firstSlugOf, MODE_META, SETTINGS_GROUPS, ADDABLE_PRODUCTS,
@@ -282,17 +283,18 @@ function repoEntry(tuple, product) {
   if (FIXTURE || !dataMod) return row;
   const name = tuple[0];
   const trees = treesOf(name);
-  const linked = trees.filter((t) => !t.main);
-  const open = !!(state.treesOpen || {})[name];
+  /* The trees list is always available — the main tree is a line of work too, and a repository with
+   * one tree still has branches to create. The active repository opens it by default; others on a
+   * click of the chip. */
+  const stored = (state.treesOpen || {})[name];
+  const open = stored === undefined ? product === name : !!stored;
   const tools = [];
-  if (linked.length) {
-    tools.push(el('button', {
-      onClick: () => setState((s) => ({ treesOpen: { ...(s.treesOpen || {}), [name]: !open } })),
-      style: chipStyle, hover: 'color:var(--foreground)',
-      title: linked.length + ' linked worktree' + (linked.length === 1 ? '' : 's') + ' — show the lines of work',
-      'data-r1': 'trees-chip',
-    }, ip('⑂ ' + linked.length)));
-  }
+  tools.push(el('button', {
+    onClick: () => setState((s) => ({ treesOpen: { ...(s.treesOpen || {}), [name]: !open } })),
+    style: chipStyle, hover: 'color:var(--foreground)',
+    title: trees.length + ' working tree' + (trees.length === 1 ? '' : 's') + ' — show the lines of work, their sessions and branches',
+    'data-r1': 'trees-chip', 'data-repo': name,
+  }, ip('⑂ ' + trees.length)));
   if (product === name) {
     { const sb = syncButton(name); if (sb) tools.push(sb); }
     tools.push(el('button', { onClick: () => renameRepo(name), style: actStyle, hover: 'color:var(--foreground)', title: 'rename this repository', 'data-r1': 'rename' }, '✎'));
@@ -301,18 +303,9 @@ function repoEntry(tuple, product) {
   const kids = [el('div', { style: 'display:flex;align-items:center' },
     el('div', { style: 'flex:1;min-width:0' }, row),
     tools.length ? el('div', { style: 'display:flex;align-items:center;gap:2px;padding-right:8px' }, tools) : null)];
-  if (open && trees.length) {
-    kids.push(el('div', { style: 'padding:2px 14px 8px 39px', 'data-r1': 'trees' },
-      trees.map((t) => el('div', {
-        style: 'display:flex;gap:8px;font-family:var(--mono);font-size:10.5px;color:var(--muted-foreground);padding:2px 0',
-        title: t.initiative ? 'initiative read from the branch name (initiative/<id>) — not a recorded attribution' : '',
-      },
-        el('span', { style: 'color:var(--foreground)' }, ip((t.main ? '⎇ ' : '⑂ ') + (t.branch || '(detached)'))),
-        el('span', null, ip(t.sessions + ' session' + (t.sessions === 1 ? '' : 's'))),
-        t.initiative ? el('span', null, ip('#' + t.initiative)) : null,
-      )),
-    ));
-  }
+  { const bf = branchForm(name); if (bf) kids.push(bf); }
+  if (open && trees.length) kids.push(treesBlock(name, trees, product === name));
+  { const tn = treeNoteFor(name); if (tn) kids.push(tn); }
   const n = state.repoNotice;
   if (n && n.name === name) {
     kids.push(el('div', {

package/workspace/public/pm/panel-trees.js

@@ -0,0 +1,176 @@
+/* panel-trees.js — the working trees of a repository, as things you can use (workspace-branch-sessions).
+ *
+ * Panel 1 used to list a repository's trees as plain text behind a chip that existed only when a
+ * linked worktree did. A branch could not be clicked, its sessions could not be seen, a session
+ * could not be started in it, and a branch could not be made without starting a session. This module
+ * is that surface:
+ *
+ *   treesBlock(name)    every tree, main first. A row opens to show that tree's sessions and its
+ *                       actions: start a session HERE, remove the folder (linked trees only).
+ *   branchForm(name)    `＋ branch` — a name, a base and an own-folder toggle. Creates the branch and
+ *                       starts nothing; then offers a session on it.
+ *
+ * Every action states its outcome in the panel. A refusal says why and the repository is unchanged.
+ * Live mode only: the fixture has no server, and panel-repos.js never calls this there.
+ */
+import { el } from './dom.js';
+import { state, setState, subscribe } from './state.js';
+
+const ip = (v) => el('span', null, v);
+const MONO = 'font-family:var(--mono);font-size:10.5px';
+const BTN = MONO + ';padding:2px 8px;border:1px solid var(--border);color:var(--muted-foreground);min-height:24px';
+const MUTED = 'color:var(--muted-foreground)';
+
+let dataMod = null; let termMod = null; let iniMod = null;
+import('./data.js').then((m) => { dataMod = m; }).catch(() => { dataMod = null; });
+import('./tab-term.js').then((m) => { termMod = m; }).catch(() => { termMod = null; });
+import('./panel-initiatives.js').then((m) => { iniMod = m; }).catch(() => { iniMod = null; });
+
+const note = (name, text, tone) => setState({ treeNote: { name, text, tone: tone || null } });
+const refresh = () => (dataMod && dataMod.refreshTrees ? dataMod.refreshTrees() : Promise.resolve());
+
+/* A tree was registered, removed or renamed somewhere (the server's `workspaces` push, a branch
+ * change in a terminal): re-read the tree list. Guarded by the push stamp so the repaint this causes
+ * does not ask again. */
+let lastPush = 0;
+subscribe(() => {
+  if (state.treesPush && state.treesPush !== lastPush) { lastPush = state.treesPush; refresh(); }
+});
+
+/** The server's sessions that run in this tree, from the list the page already polls. */
+export function sessionsIn(ws) {
+  return (Array.isArray(state.sessions) ? state.sessions : []).filter((s) => s && s.ws === ws);
+}
+const isEnded = (s) => s.state === 'exited' || s.shown === 'exited';
+
+/** Open a session's terminal. The row carries the server's id, so the tab attaches to that exact PTY. */
+function openSession(s) {
+  if (!iniMod) return;
+  iniMod.openTerm(null, { id: s.id, name: s.name, st: isEnded(s) ? 'exited' : 'working', profile: s.profile_id || null });
+}
+
+/** Start a session in THIS tree: the workspace id is the tree's, so the server runs it in that folder. */
+export async function startHere(name, t) {
+  if (!termMod || !iniMod) { note(name, 'the terminal module has not loaded — nothing was started', 'bad'); return; }
+  const label = (t.branch || 'tree').replace(/^initiative\//, '');
+  const res = await termMod.requestSpawn({ name: 'shell · ' + label, agent: 'shell', ws: t.ws, branch: null, createBranch: false, isolate: null, profile: null });
+  if (!res || !res.ok) { note(name, (res && res.error) || 'the workspace server refused, without saying why', 'bad'); return; }
+  note(name, 'started in ' + (t.branch || 'this tree'));
+  openSession({ id: res.id, name: 'shell · ' + label, profile_id: null });
+}
+
+async function endSession(name, s) {
+  const out = dataMod ? await dataMod.removeSessionById(s.id) : null;
+  setState({ treeConfirm: null });
+  if (!out || out.ok === false) { note(name, (out && out.error) || 'the session could not be removed', 'bad'); return; }
+  note(name, out.removed === false ? (out.note || 'asked it to end') : 'session removed');
+}
+
+async function removeTree(name, t) {
+  const ok = typeof window === 'undefined' || !window.confirm ? true
+    : window.confirm('Remove the folder for “' + t.branch + '”?\n\n' + t.dir + '\n\nThe branch is kept. A folder with unsaved work or a running session is refused.');
+  if (!ok) return;
+  const out = dataMod ? await dataMod.removeWorktree(t.ws, t.dir) : null;
+  if (!out || out.ok === false) { note(name, (out && out.error) || 'the folder could not be removed', 'bad'); return; }
+  setState((s) => ({ treeSel: { ...(s.treeSel || {}), [name]: null } }));
+  note(name, 'removed the folder for ' + t.branch + ' — the branch is kept');
+  refresh();
+}
+
+function sessionRow(name, s) {
+  const armed = state.treeConfirm === s.id;
+  return el('div', { style: 'display:flex;align-items:center;gap:6px;padding:1px 0', 'data-r14': 'tree-session', 'data-id': s.id },
+    el('button', { onClick: () => openSession(s), style: MONO + ';flex:1;min-width:0;text-align:left;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;color:var(--foreground)', hover: 'text-decoration:underline', title: 'open this session' },
+      ip(s.name + ' · ' + (isEnded(s) ? 'ended' : (s.shown || s.state || 'running')))),
+    el('button', {
+      onClick: () => (armed ? endSession(name, s) : setState({ treeConfirm: s.id })),
+      style: BTN + (armed ? ';color:var(--destructive);border-color:var(--destructive)' : ''), hover: 'color:var(--destructive)',
+      title: isEnded(s) ? 'remove this ended session' : 'end this session and remove it', 'data-r14': 'tree-end',
+    }, armed ? 'sure?' : (isEnded(s) ? 'remove' : 'end')));
+}
+
+function treeRow(name, t) {
+  const sel = (state.treeSel || {})[name] === t.ws;
+  const sess = sessionsIn(t.ws);
+  const live = sess.filter((s) => !isEnded(s)).length;
+  const head = el('button', {
+    onClick: () => setState((s) => ({ treeSel: { ...(s.treeSel || {}), [name]: sel ? null : t.ws }, treeConfirm: null })),
+    style: MONO + ';display:flex;gap:8px;width:100%;text-align:left;padding:3px 0;min-height:26px;align-items:baseline', hover: 'background:var(--accent)',
+    title: t.initiative ? 'initiative read from the branch name (initiative/<id>) — not a recorded attribution' : 'show this tree’s sessions',
+    'data-r14': 'tree', 'data-ws': t.ws,
+  },
+    el('span', { style: MUTED }, ip(sel ? '▾' : '▸')),
+    el('span', { style: 'color:var(--foreground)' }, ip((t.main ? '⎇ ' : '⑂ ') + (t.branch || '(detached)'))),
+    el('span', { style: MUTED }, ip(live + ' live' + (sess.length > live ? ' · ' + (sess.length - live) + ' ended' : ''))),
+    t.initiative ? el('span', { style: MUTED }, ip('#' + t.initiative)) : null);
+  if (!sel) return head;
+  return el('div', null, head, el('div', { style: 'padding:2px 0 6px 14px', 'data-r14': 'tree-open' },
+    sess.length ? sess.map((s) => sessionRow(name, s)) : el('div', { style: MONO + ';' + MUTED + ';padding:2px 0' }, 'no sessions in this tree'),
+    el('div', { style: 'display:flex;gap:6px;padding-top:4px;flex-wrap:wrap' },
+      el('button', { onClick: () => startHere(name, t), style: BTN, hover: 'color:var(--foreground)', title: 'start a shell session in ' + (t.dir || 'this tree'), 'data-r14': 'tree-start' }, '＋ session here'),
+      t.main ? null : el('button', { onClick: () => removeTree(name, t), style: BTN, hover: 'color:var(--destructive)', title: 'remove this worktree folder (the branch is kept)', 'data-r14': 'tree-remove' }, 'remove folder'))));
+}
+
+/** The trees of one repository, main first. `name` is the repository's name in the data layer. */
+export function treesBlock(name, trees, addable) {
+  return el('div', { style: 'padding:2px 14px 8px 39px', 'data-r1': 'trees', 'data-repo': name }, trees.map((t) => treeRow(name, t)),
+    addable ? el('button', { onClick: () => openBranchForm(name, trees), style: BTN + ';margin-top:4px', hover: 'color:var(--foreground)',
+      title: 'create a branch — with or without its own folder — without starting a session', 'data-r14': 'branch-add' }, '＋ branch') : null);
+}
+
+/* ── ＋ branch ───────────────────────────────────────────────────────────────────────────────── */
+const INPUT = MONO + ';width:100%;padding:4px 6px;background:var(--secondary);border:1px solid var(--border);color:var(--foreground);min-height:26px';
+
+export function openBranchForm(name, trees) {
+  const main = (trees || []).find((t) => t.main) || (trees || [])[0];
+  setState({ branchForm: { repo: name, name: '', from: '', folder: true, busy: false, error: null, ws: main ? main.ws : null, current: main ? main.branch : null } });
+}
+
+async function submitBranch() {
+  const f = state.branchForm;
+  if (!f || f.busy || !dataMod) return;
+  const name = String(f.name || '').trim();
+  if (!name) { setState({ branchForm: { ...f, error: 'name the new branch' } }); return; }
+  setState({ branchForm: { ...f, busy: true, error: null } });
+  const out = await dataMod.createBranch({ ws: f.ws, name, from: String(f.from || '').trim() || null, worktree: f.folder });
+  if (!out || out.ok === false) { setState({ branchForm: { ...f, busy: false, error: (out && out.error) || 'the server refused, without saying why' } }); return; }
+  setState((s) => ({ branchForm: null, treesOpen: { ...(s.treesOpen || {}), [f.repo]: true }, treeSel: { ...(s.treeSel || {}), [f.repo]: out.ws }, treeNote: { name: f.repo, text: '“' + name + '” created' + (f.folder ? ' in its own folder — ' + out.dir : ' in the shared folder'), tone: null } }));
+  refresh();
+}
+
+/* The panel repaints on every state change, which replaces the input the PM is typing in. The value
+ * survives (it lives on the form record); the focus and caret are restored here so typing is not cut. */
+function keepFocus(f, which) {
+  return (n) => {
+    if ((f.focus || 'name') !== which) return;
+    setTimeout(() => { try { n.focus(); n.setSelectionRange(n.value.length, n.value.length); } catch { /* detached */ } }, 0);
+  };
+}
+
+/** The `＋ branch` form for the repository it was opened on, or null. */
+export function branchForm(name) {
+  const f = state.branchForm;
+  if (!f || f.repo !== name) return null;
+  const upd = (patch) => setState((s) => ({ branchForm: { ...s.branchForm, ...patch } }));
+  return el('div', { style: 'padding:6px 14px 10px 39px;display:grid;gap:5px', 'data-r14': 'branch-form' },
+    el('input', { value: f.name, placeholder: 'initiative/my-branch', style: INPUT, 'data-r14': 'branch-name',
+      ref: keepFocus(f, 'name'), onFocus: () => { f.focus = 'name'; },
+      onInput: (e) => { f.name = e.target.value; }, onKeydown: (e) => { if (e.key === 'Enter') submitBranch(); if (e.key === 'Escape') setState({ branchForm: null }); } }),
+    el('input', { value: f.from, placeholder: 'start from: ' + (f.current || 'the current branch') + ' (or another branch)', style: INPUT, 'data-r14': 'branch-from',
+      ref: keepFocus(f, 'from'), onFocus: () => { f.focus = 'from'; },
+      onInput: (e) => { f.from = e.target.value; }, onKeydown: (e) => { if (e.key === 'Enter') submitBranch(); } }),
+    el('button', { onClick: () => upd({ folder: !f.folder }), style: MONO + ';text-align:left;' + MUTED, hover: 'color:var(--foreground)', 'data-r14': 'branch-folder',
+      title: f.folder ? 'the branch gets its own folder; sessions already running are untouched' : 'the branch is checked out in the shared folder; refused while a session runs there' },
+    ip((f.folder ? '☑' : '☐') + ' its own folder (worktree)')),
+    f.error ? el('div', { style: 'font-size:11px;color:var(--destructive)', 'data-r14': 'branch-error' }, ip(f.error)) : null,
+    el('div', { style: 'display:flex;gap:6px' },
+      el('button', { onClick: submitBranch, disabled: f.busy ? 'disabled' : null, style: BTN, hover: 'color:var(--foreground)', 'data-r14': 'branch-create' }, f.busy ? 'creating…' : 'create branch'),
+      el('button', { onClick: () => setState({ branchForm: null }), style: BTN, hover: 'color:var(--foreground)' }, 'cancel')));
+}
+
+/** The outcome line of the last tree action for this repository. */
+export function treeNoteFor(name) {
+  const n = state.treeNote;
+  if (!n || n.name !== name) return null;
+  return el('div', { style: 'padding:4px 14px 8px 39px;font-size:11px;overflow-wrap:anywhere;color:' + (n.tone === 'bad' ? 'var(--destructive)' : 'var(--muted-foreground)'), 'data-r14': 'tree-note' }, ip(n.text));
+}

package/workspace/public/pm/tab-term.js

@@ -244,6 +244,9 @@ export function requestSpawn(opts) {
         name: o.name,
         agent: o.agent || 'shell',
         ws: o.ws,
+        // The initiative the session is FOR, when the caller knows it (workspace-branch-sessions R8):
+        // the `⋯ options` path used to drop it, so a session started with a branch carried none.
+        ...(o.initiative ? { initiative: o.initiative } : {}),
         /* Sent even when the PM chose nothing, and that is deliberate on two of them. `isolate` has
          * a server-side default (`server.js` liveSessionCount) whose own comment says the client
          * should state what the PM actually saw; `profile: null` is a DELIBERATE "no profile",
@@ -429,9 +432,12 @@ function handle(m) {
      * cache of the server's last word about a workspace, and a reader that is not open ignores it.
      * The `ws` is carried so a reader can tell whether the news is about the repository it is
      * asking about. */
-    setState({ branchInfo: { ...m, at: Date.now() } });
+    setState({ branchInfo: { ...m, at: Date.now() }, treesPush: Date.now() });
     return;
   }
+  /* A tree was registered, removed or renamed. Panel 1 re-reads the tree list on `treesPush`
+   * (panel-repos.js); without this the new folder appeared only after a reload. */
+  if (m.t === 'workspaces') { setState({ treesPush: Date.now() }); return; }
 }
 
 const recFor = (sessionId) => {

package/workspace/server.js

@@ -116,6 +116,7 @@ const HOME_ENABLED = EMBEDDED_SELF || (!!process.env.PMOS_SELF_ROOT && dirExists
 const PUB = path.join(__dirname, 'public');
 const PM_DIR = path.join(PUB, 'pm');   // the four-panel front end — served as a directory, guarded below
 const XROOT = path.join(__dirname, 'node_modules', '@xterm');
+const APP_VERSION = (() => { try { return require('./package.json').version || null; } catch { return null; } })();
 // ── WHERE THE PM'S RUNTIME STATE LIVES (see lib/state-root.js for the whole argument). ─────────
 // It is NOT `workspace/state/` any more. That directory is inside the application directory the
 // test suite runs from, which put the PM's live sessions, workspace registry and authored skills
@@ -1983,14 +1984,17 @@ function filingContract(w) {
 // D76 — `root` adds the repository's APPROVED discovered skills, loaded FIRST so the PM's own skill of the same id
 // overrides one and a built-in overrides both. Only an approved candidate whose file still hashes to what was approved
 // is ever offered; its harness is forced to an agent skill running claude.
-function loadTasks(root) {
+// The loaded skill records, each with the `file` it came from. loadTasks maps these to the task shape
+// and drops the file; the skill detail routes below need the file, so both read through here.
+function loadSkillRecords(root) {
   const discovered = root ? skillsReg.loadApproved(root, SKILL_APPROVALS, skillStore.parseSkill).skills : [];
   return skillStore.loadSkills([
     ...(discovered.length ? [{ skills: discovered }] : []),
     { dir: userSkillsDir(), source: 'user' },
     { dir: BUILTIN_SKILLS_DIR, source: 'builtin' },
-  ]).map(toTask);
+  ]);
 }
+function loadTasks(root) { return loadSkillRecords(root).map(toTask); }
 // Map a loaded skill to the internal task shape fireSchedule/the picker use. `kind` is derived from the
 // file's `run` and stays INTERNAL — it is never a field the PM selects.
 function toTask(s) {
@@ -3040,6 +3044,40 @@ function spawnWithBranch({ name, agent, cwd, ws, branch, createBranch, isolate,
   return { ok: true, session: s, notice: treeShare.joinNotices(notice, shared) };
 }
 
+// Create a branch WITHOUT starting a session (workspace-branch-sessions R5). Two shapes, as in the
+// spawn path: its own folder (a worktree, registered as a workspace so the page can start sessions in
+// it) or a checkout in the shared tree. The shared checkout moves every session in that tree, so it is
+// refused while any are running — the spawn path may do that on a PM's explicit choice, but a control
+// that only creates a branch must not move other people's work as a side effect.
+function createBranchOnly({ ws, name, from, worktree }) {
+  const w = ws ? workspaces.get(ws) : null;
+  if (!w) return { ok: false, error: 'no such workspace' };
+  if (!gitInfo.isRepo(w.root)) return { ok: false, error: `“${w.name}” is not a git repository` };
+  const branch = String(name == null ? '' : name).trim();
+  if (!branch) return { ok: false, error: 'name the new branch' };
+  if (worktree) {
+    const r = gitInfo.addWorktree(w.root, branch, { create: true, from });
+    if (!r.ok) return { ok: false, error: r.error };
+    const info = gitInfo.branchInfo(w.root);
+    const mirrored = info.ok && info.subdir ? path.join(r.dir, info.subdir) : r.dir;
+    const dir = isDir(mirrored) ? mirrored : r.dir;
+    const nw = registerWorkspace(dir, `${w.name} ⑂ ${branch}`);
+    if (!nw) return { ok: false, error: `worktree created at ${r.dir} but could not be registered as a workspace` };
+    broadcast({ t: 'branch', ws: nw.id, ...gitInfo.branchInfo(nw.root) });
+    pushWorkspaces();
+    return { ok: true, ws: nw.id, dir: r.dir, branch };
+  }
+  const live = treeTenants(treeForWs(w.id), null).length;
+  if (live > 0) {
+    return { ok: false, error: `${live} session${live === 1 ? ' is' : 's are'} running in this folder, and a checkout would move ${live === 1 ? 'it' : 'them'} — create the branch in its own folder instead` };
+  }
+  const r = gitInfo.checkout(w.root, branch, { create: true, from });
+  if (!r.ok) return { ok: false, error: r.error };
+  broadcast({ t: 'branch', ws: w.id, ...gitInfo.branchInfo(w.root) });
+  pushWorkspaces();
+  return { ok: true, ws: w.id, dir: w.root, branch };
+}
+
 /* ── workspace-repo-first · start work in one click (PRD R1 · R3) ───────────────────────────────
  * The composer asked six questions to open a terminal, and the one question the PM actually has —
  * "which initiative am I working on?" — was not among them. It asked for a BRANCH instead, plus an
@@ -4286,6 +4324,27 @@ async function handleRequest(req, res) {
     w.label = name; saveWorkspaces(); pushWorkspaces();
     return json(res, { ok: true, workspace: { id: w.id, name, label: name } });
   }
+  if (p === '/api/git/branch' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const out = createBranchOnly({ ws: body.ws, name: body.name, from: body.from || null, worktree: body.worktree !== false });
+    return json(res, out, out.ok ? 200 : 400);
+  }
+  // End a session and remove it, with an answer. The WebSocket kill/remove messages return nothing,
+  // so a refusal or a slow exit left the PM clicking a control that seemed to do nothing.
+  if (p === '/api/session/remove' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    const sess = sessions.get(String(body.id || ''));
+    if (!sess) return json(res, { ok: false, error: 'no such session' }, 404);
+    if (sess.pty) {
+      if (sess.tmux) tmuxKillSession(sess.tmux);
+      try { sess.pty.kill(); } catch {}
+      for (let i = 0; i < 30 && sess.pty; i++) await new Promise((r) => setTimeout(r, 100));
+      if (sess.pty) return json(res, { ok: true, removed: false, note: 'asked it to end; it has not exited yet — press again to remove it' });
+    }
+    return json(res, { ok: removeSession(sess.id), removed: true });
+  }
   if (p === '/api/git/worktrees/remove' && req.method === 'POST') {
     // Reclaim a worktree's folder. `dir` comes from a client, so it is checked against git's own
     // list of THIS repo's linked worktrees before anything is removed — the main tree is
@@ -4590,6 +4649,44 @@ async function handleRequest(req, res) {
   }
   if (p === '/api/tasks') return json(res, { tasks: loadTasks().map((t) => ({ id: t.id, label: t.label, skill: t.skill, kind: t.kind })) });
   // ── skills (workspace-skill-authoring): the ONE-concept surface + the New Skill flow ──
+  // One skill's full text, for the detail panel. Only the PM's own skills (source `user`) are
+  // editable: a builtin ships with the app and a discovered one is pinned to the text the PM approved,
+  // so editing either in place would change what was reviewed. Both can be copied to an editable one.
+  if (p === '/api/skills/read' && req.method === 'GET') {
+    const sw = getWs(url.searchParams.get('ws'));
+    const rec = loadSkillRecords(sw ? sw.root : null).find((x) => x.id === url.searchParams.get('id'));
+    if (!rec) return json(res, { ok: false, error: 'no skill with that name' }, 404);
+    let text; try { text = fs.readFileSync(rec.file, 'utf8'); } catch { return json(res, { ok: false, error: 'the skill file could not be read' }, 500); }
+    return json(res, { ok: true, id: rec.id, label: rec.label || rec.id, source: rec.source, editable: rec.source === 'user',
+      file: path.basename(rec.file), description: rec.description || '', output: rec.output || [], text });
+  }
+  if (p === '/api/skills/save' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON' }, 400); }
+    const rec = loadSkillRecords(null).find((x) => x.id === body.id && x.source === 'user');
+    if (!rec) return json(res, { ok: false, error: 'only your own skills can be edited here' }, 403);
+    const text = typeof body.text === 'string' ? body.text : '';
+    if (!text.trim() || text.length > 200000) return json(res, { ok: false, error: 'the skill text is empty or too long' }, 400);
+    const parsed = skillStore.parseSkill(text);
+    if (parsed.name !== rec.id) return json(res, { ok: false, error: `the name: line must stay "${rec.id}" — rename by copying instead` }, 400);
+    if (!String(parsed.description || '').trim()) return json(res, { ok: false, error: 'the skill needs a description: line' }, 400);
+    try { const tmp = rec.file + '.tmp'; fs.writeFileSync(tmp, text.endsWith('\n') ? text : text + '\n'); fs.renameSync(tmp, rec.file); }
+    catch { return json(res, { ok: false, error: 'the skill file could not be written' }, 500); }
+    return json(res, { ok: true, id: rec.id });
+  }
+  if (p === '/api/skills/copy' && req.method === 'POST') {
+    let body = {}; try { body = JSON.parse((await readBody(req)) || '{}'); } catch { return json(res, { ok: false, error: 'invalid JSON' }, 400); }
+    const sw = getWs(body.ws);
+    const all = loadSkillRecords(sw ? sw.root : null);
+    const rec = all.find((x) => x.id === body.id);
+    if (!rec) return json(res, { ok: false, error: 'no skill with that name' }, 404);
+    let id = rec.id + '-copy';
+    for (let n = 2; all.some((x) => x.id === id); n++) id = rec.id + '-copy-' + n;
+    let text; try { text = fs.readFileSync(rec.file, 'utf8'); } catch { return json(res, { ok: false, error: 'the skill file could not be read' }, 500); }
+    text = text.replace(/^name:.*$/m, 'name: ' + id).replace(/^label:\s*"?(.*?)"?\s*$/m, (_, l) => 'label: "' + l.replace(/"/g, "'") + ' (my copy)"');
+    try { const d = userSkillsDir(); fs.mkdirSync(d, { recursive: true }); fs.writeFileSync(path.join(d, id + '.skill'), text, { flag: 'wx' }); }
+    catch { return json(res, { ok: false, error: 'the copy could not be written' }, 500); }
+    return json(res, { ok: true, id });
+  }
   // GET lists every skill with NO kind field — from the user's view there is just a skill.
   if (p === '/api/skills' && req.method === 'GET') {
     const sw = getWs(url.searchParams.get('ws'));
@@ -4810,7 +4907,9 @@ async function handleRequest(req, res) {
     if (mc.ok) mc.core.logDecision(s.root, { kind: 'switch', session: s.id, agent: s.agent, tier: r.tier, model: r.model, by: 'human:wawan' });
     return json(res, { ok: true, model: r.model, tier: r.tier, note: 'typed /model into the pane; effort is unchanged' });
   }
-  if (p === '/api/sessions') return json(res, { sessions: sessionList() });
+  // `version` lets the launcher notice a server still running OLD code after an upgrade: files on disk
+  // advance under a live process, so the UI would otherwise call routes that process never learned.
+  if (p === '/api/sessions') return json(res, { sessions: sessionList(), version: APP_VERSION });
   if (p === '/api/git/branches') {
     // Read-only branch awareness for a workspace. A non-repo returns {ok:false} (never a fake
     // branch). Fixed git args, no caller input in the read path (R1).