create-pmos 0.52.0 → 0.53.1

package/workspace/test-run.js

@@ -83,6 +83,11 @@ function configure({ name = 'run', port = null } = {}) {
   delete process.env.PMOS_STATE_DIR;
   delete process.env.PMOS_WS_PORT;
   delete process.env.PMOS_TMUX_SOCK;
+  // Likewise PMOS_SESSION and PMOS_BIN: a suite run from inside an agent session holds that session's token, and every
+  // `pmos item` the suite runs (and every server it boots) would otherwise be attributed to it. A suite that needs a
+  // token sets one explicitly.
+  delete process.env.PMOS_SESSION;
+  delete process.env.PMOS_BIN;
   const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), `pmos-state-${name}-`));
   // Remove the scratch tree when the suite exits, green or red — nothing did, and every run left
   // a pmos-state-* directory (scrollback, registry JSON) in tmpdir. Registered beside the mkdtemp
@@ -112,6 +117,9 @@ function configure({ name = 'run', port = null } = {}) {
     port: claimEphemeralPort,
     /** Poll a spawned server until it answers — see waitForServer above. */
     waitForServer,
+    /** The per-launch nonce and the press headers (below); `T.nonce(T.BASE)`, `T.pressHeaders(T.BASE)`. */
+    nonce: (b) => nonce(b),
+    pressHeaders: (b) => pressHeaders(b),
     /** Kill the tmux daemon this run minted, with every pane on it. Safe by construction: the
      *  socket is private and per-pid, so this can never reach the PM's own ('pmos'). Every suite
      *  that spawns the server must call this on its way out — SIGKILLing the server child leaves
@@ -123,4 +131,22 @@ function configure({ name = 'run', port = null } = {}) {
   return state;
 }
 
-module.exports = { configure, claimEphemeralPort, waitForServer, HOST };
+/**
+ * The per-launch nonce of a running server (pm-os-absorb R25; lib/pm-guard.js has the wire contract). Read from the
+ * `<meta name="pmos-nonce" content="…">` of GET /. Answers '' when the server mints none (the base, before Run 2's 2A).
+ */
+async function nonce(base) {
+  try {
+    const html = await (await fetch(base + '/')).text();
+    const m = /<meta name="pmos-nonce" content="([^"]*)"/.exec(html);
+    return m ? m[1] : '';
+  } catch { return ''; }
+}
+
+/** The headers a page press carries. Every D86 route test POSTs with these, never with a bare Origin. */
+async function pressHeaders(base) {
+  const n = await nonce(base);
+  return { 'Content-Type': 'application/json', Origin: base, ...(n ? { 'x-pmos-nonce': n } : {}) };
+}
+
+module.exports = { configure, claimEphemeralPort, waitForServer, HOST, nonce, pressHeaders };

package/workspace/third-party/README.md

@@ -0,0 +1,44 @@
+---
+type: Reference
+title: "Third-party files in the workspace"
+description: "The two browser files the workspace vendors under D86 (SortableJS and a lucide icon sprite): where each came from, its licence, the tarball hash and how to regenerate it."
+timestamp: 2026-10-05
+---
+
+# Third-party files in the workspace
+
+The workspace runs with no network (D62). Two third-party browser files are committed into `public/vendor/` under D86, points 1 and 6 (the ADR is `okf/products/pmos/adr/d86-planning-layer.md`). They are not fetched from a CDN, the server makes no request for them at run time, and `package.json` has no dependency entry for them. The server serves each one from disk, and `no-network.test.js` names each one in its vendored inventory.
+
+| Package | Version | Licence | Tarball | Tarball sha256 | Shipped file |
+|---|---|---|---|---|---|
+| sortablejs | 1.15.7 | MIT | https://registry.npmjs.org/sortablejs/-/sortablejs-1.15.7.tgz | `66cbfc8fa18860783584fe0c346baf6cbf3399da72d23d21053425ba232abed4` | `public/vendor/Sortable.min.js`: an unmodified copy of `package/Sortable.min.js` (45 478 bytes, sha256 `bf4241bc73fef7f11c59a283a69fe8051cdd31c6d8ff5a2b9ba219e7831fcf76`; npm integrity `sha512-Kk8wLQPlS+yi1ZEf48a4+fzHa4yxjC30M/Sr2AnQu+f/MPwvvX9XjZ6OWejiz8crBsLwSq8GHqaxaET7u6ux0A==`) |
+| lucide-static | 1.52.0 | ISC, plus the Feather MIT notice | https://registry.npmjs.org/lucide-static/-/lucide-static-1.52.0.tgz | `4d2aa079171e4eba4c704844b8b0c9edb6e4cfb2fb8bd86f7b14353994f04a87` | `public/vendor/lucide-sprite.js`: generated by `build-lucide-sprite.js` (11 930 bytes, sha256 `692b332b79456b0fa8a47ef813a2ce54d6f5f47d00e41e85277d6ecd39e6a38b`). It holds 29 icons: grip-vertical, plus, check, square, square-check-big, x, undo-2, flag, bot, chevron-right, chevron-down, ellipsis, circle-alert, history, arrow-up, arrow-down, diamond, then the eight the frame's chrome draws (Run 3): settings, search, refresh-cw, chevron-left, sun, moon, arrow-left, arrow-right, then globe, columns-2, arrow-up-down and arrow-left-right for the dock strip's web, split and orientation chips (Run 3, C6) |
+
+The licences are in this folder: [sortablejs-1.15.7.LICENSE](sortablejs-1.15.7.LICENSE) and [lucide-static-1.52.0.LICENSE](lucide-static-1.52.0.LICENSE). The sprite also carries the lucide licence text as its first comment.
+
+## Why these builds
+
+- SortableJS: `Sortable.min.js` is the UMD build. It sets `window.Sortable` when the page loads it as a classic script, which `pm/bd-drag.js` does on first use. The ES module build (`modular/sortable.esm.js`) is not used: its comments name three `https://` addresses, and `no-network.test.js` fails any front-end file that names a remote origin. The minified build's only address is its `git://` header.
+- lucide: the package holds about 1 900 icons. The sprite holds only the icons the workspace uses, as one `<symbol>` each, so the page loads one small module and no icon font.
+
+## Regenerate
+
+Run the first block in a scratch folder outside the repository (`$SRC` below), then run the second block from the repository root.
+
+```sh
+cd "$SRC"
+npm pack sortablejs@1.15.7
+npm pack lucide-static@1.52.0
+sha256sum sortablejs-1.15.7.tgz lucide-static-1.52.0.tgz
+mkdir -p sortable lucide
+tar -xzf sortablejs-1.15.7.tgz -C sortable
+tar -xzf lucide-static-1.52.0.tgz -C lucide
+```
+
+```sh
+cp "$SRC/sortable/package/Sortable.min.js" workspace/public/vendor/Sortable.min.js
+node workspace/third-party/build-lucide-sprite.js "$SRC/lucide/package/icons" > workspace/public/vendor/lucide-sprite.js
+sha256sum workspace/public/vendor/Sortable.min.js workspace/public/vendor/lucide-sprite.js
+```
+
+Compare each tarball hash with the table before you copy a file. When a hash changes, update the table in the same commit. To add an icon, add its name to `ICONS` in `build-lucide-sprite.js`, regenerate the sprite and record its new hash.

package/workspace/third-party/lucide-static-1.52.0.LICENSE

@@ -0,0 +1,43 @@
+ISC License
+
+Copyright (c) 2026 Lucide Icons and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+---
+
+The following Lucide icons are derived from the Feather project:
+
+airplay, alert-circle, alert-octagon, alert-triangle, aperture, arrow-down-circle, arrow-down-left, arrow-down-right, arrow-down, arrow-left-circle, arrow-left, arrow-right-circle, arrow-right, arrow-up-circle, arrow-up-left, arrow-up-right, arrow-up, at-sign, calendar, cast, check, chevron-down, chevron-left, chevron-right, chevron-up, chevrons-down, chevrons-left, chevrons-right, chevrons-up, circle, clipboard, clock, code, columns, command, compass, corner-down-left, corner-down-right, corner-left-down, corner-left-up, corner-right-down, corner-right-up, corner-up-left, corner-up-right, crosshair, database, divide-circle, divide-square, dollar-sign, download, external-link, feather, frown, hash, headphones, help-circle, info, italic, key, layout, life-buoy, link-2, link, loader, lock, log-in, log-out, maximize, meh, minimize, minimize-2, minus-circle, minus-square, minus, monitor, moon, more-horizontal, more-vertical, move, music, navigation-2, navigation, octagon, pause-circle, percent, plus-circle, plus-square, plus, power, radio, rss, search, server, share, shopping-bag, sidebar, smartphone, smile, square, table-2, tablet, target, terminal, trash-2, trash, triangle, tv, type, upload, x-circle, x-octagon, x-square, x, zoom-in, zoom-out
+
+The MIT License (MIT) (for the icons listed above)
+
+Copyright (c) 2013-present Cole Bemis
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/workspace/third-party/sortablejs-1.15.7.LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 All contributors to Sortable
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.