create-pmos 0.55.0 → 0.55.2

package/bin/create-pmos.js

@@ -292,9 +292,11 @@ function workspace(targetArg, opts) {
     console.log(forceReinstall
       ? 'Reinstalling the Terminal Workspace app (--reinstall)…'
       : `Upgrading the Terminal Workspace app (installed ${installed || 'unknown'} → bundled ${bundled})…`);
+    // Stop the running server FIRST. `npm install -g` deletes and rewrites the folder that server runs from; a server
+    // still running there afterwards keeps its old code and starts every new session in a deleted folder.
+    stopWorkspaceServer();
     const status = installWorkspaceGlobal();
     if (status === 0) {
-      stopWorkspaceServer();   // restart the persistent server on the new code
       console.log(`\n✅ pmos-workspace is now ${bundled}. Launching — if the UI still looks unchanged, hard-refresh the browser (Cmd/Ctrl+Shift+R) to drop the cached stylesheet.`);
     } else {
       console.log('\n⚠  Reinstall did not complete cleanly — launching the previously installed copy.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.55.0",
+  "version": "0.55.2",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@058e723
+kernel-source: pmos@b7dc0a6
 assembled: 2026-10-06
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-06T06:04:22Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T07:31:23Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-06T06:04:22Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T07:31:23Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-06T06:04:22Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T07:31:23Z"}
 status: stable
 ---
 

package/workspace/REMOTE.md

@@ -19,6 +19,25 @@ PMOS's locked decision **D62** rejects, permanently:
 
 A public server that owns a PTY running your Claude subscription is severe exposure. The tailnet path sidesteps that entirely: the phone attaches to the *same local server* across your own private network. Accordingly, this feature will **only ever** bind loopback plus your machine's own tailnet address. If you ask it to bind anything else (`0.0.0.0`, a LAN or public IP), it **refuses to start**.
 
+## Quickest: `pmos phone`
+
+With the workspace installed (`npx create-pmos@latest workspace`, or `pmos upgrade` to update it) and Tailscale signed in on the computer and on the phone, run this in your repo folder:
+
+```sh
+pmos phone
+```
+
+It prints a QR code. Scan it with the phone camera, and the workspace opens signed in. You do not need a PMOS checkout, `npm install` or `PMOS_REMOTE`.
+
+- If no workspace is running, `pmos phone` starts one in tailnet mode.
+- If a workspace is running without phone access, `pmos phone` restarts it in tailnet mode. Sessions keep running in tmux and re-attach.
+- If phone access is already on, `pmos phone` starts nothing and shows the same QR code again, so a phone that is signed in stays signed in.
+- If Tailscale is not running, it says so. Open the Tailscale app, sign in, and run `pmos phone` again.
+
+The QR code is the link from the server's own startup banner, which the server writes to `server-<port>.log` in the state folder. `pmos phone` reads that banner back. It does not make or store a new token. Every restart makes a new token, so after a restart or an upgrade, run `pmos phone` again and scan the new code. A workspace that had phone access keeps it when an upgrade restarts it. With `PMOS_TOKEN` set, no token is printed, so `pmos phone` shows the tailnet address and you paste your token into the sign-in page.
+
+The steps below do the same thing by hand, from a PMOS checkout.
+
 ## Setup
 
 1. **Install Tailscale** on the machine running the workspace and on your phone:

package/workspace/bin/pmos.js

@@ -7,6 +7,7 @@
  *   pmos ls         list the registered workspaces
  *   pmos stop       stop the server (running sessions end — it says so first)
  *   pmos doctor     diagnose the environment (node-pty arch, PTY spawn, …)
+ *   pmos phone      turn on phone access (tailnet mode) and print the phone link as a QR code
  *
  * The directory you type `pmos` in IS the workspace: it is resolved to its git root and
  * registered with the server, and the browser opens focused on it. One server hosts many
@@ -187,18 +188,18 @@ function ensureInstalled() {
 // Register the target directory and open the browser ON IT. The `focus` broadcast matters:
 // the OS may refocus an already-open tab instead of opening our URL, and without it the PM
 // would be looking at the previously-opened repo — the defect this replaces.
-async function openWorkspace(dir, port) {
+async function openWorkspace(dir, port, { open = true } = {}) {
   const root = repoRootOf(dir);
   const reg = await api(port, 'POST', '/api/workspaces', { root, name: path.basename(root) });
   if (!reg || !reg.ok) {
     say(`✗ could not open ${root}${reg && reg.error ? ` — ${reg.error}` : ''}`);
-    openBrowser(urlOf(port));
+    if (open) openBrowser(urlOf(port));
     return 1;
   }
   const w = reg.workspace;
   say(`✓ workspace “${w.name}” — ${urlOf(port)}?ws=${w.id}`);
   say(`  ${root}`);
-  openBrowser(`${urlOf(port)}?ws=${w.id}`);
+  if (open) openBrowser(`${urlOf(port)}?ws=${w.id}`);
   return 0;
 }
 
@@ -222,7 +223,30 @@ async function choosePort() {
   return port ? { port, movedFrom: want, owner: portOwner(want) } : { port: null, blocked: want, owner: portOwner(want) };
 }
 
-async function up(dir) {
+// Would a tailnet start succeed here? The server's own bind rule (lib/remote-access.js resolveBinds), asked BEFORE any
+// running server is stopped, so a missing Tailscale never leaves the PM with no workspace at all.
+function tailnetRefusal() {
+  return require('../lib/remote-access').resolveBinds({ env: { ...process.env, PMOS_REMOTE: 'tailnet' } }).refused || null;
+}
+function tcpOpen(host, port) {
+  return new Promise((res) => {
+    const s = net.connect({ host, port, timeout: 1500 }, () => { s.destroy(); res(true); });
+    s.on('error', () => res(false));
+    s.on('timeout', () => { s.destroy(); res(false); });
+  });
+}
+// Is the server on this port serving the tailnet NOW? Its log's last banner says what mode it started in, and a
+// connection to the tailnet address it named confirms the banner belongs to the live server, not to an older start.
+async function servesTailnet(port) {
+  const P = require('../lib/phone-cli');
+  const b = P.lastBanner(P.readLogTail(logFile(port)));
+  if (!b || !b.remote || !b.tailnetUrl) return false;
+  try { const u = new URL(b.tailnetUrl); return await tcpOpen(u.hostname, Number(u.port)); } catch { return false; }
+}
+
+// `remote` starts a NEW server in tailnet mode (pmos phone); a server that is already running is reused as it is.
+// `open: false` registers the repo without opening the desktop browser.
+async function up(dir, { remote = false, open = true } = {}) {
   // 1. Is a workspace already running — on ANY port it recorded, not just the one this shell guesses?
   let live = await discover();
   // A server that predates this install is running OLD code under NEW files (or the reverse). Reusing
@@ -231,8 +255,15 @@ async function up(dir) {
   const stale = live.filter((l) => l.version !== APP_VERSION);
   if (stale.length) {
     say(`note: the running workspace is ${stale[0].version ? 'version ' + stale[0].version : 'an older version'}; this install is ${APP_VERSION}. Restarting it on the new code — sessions keep running in tmux.`);
+    // A server that had phone access keeps it: without this, an upgrade restart came back loopback-only with no word.
+    // Only when a tailnet start can succeed; otherwise it restarts loopback-only and says so.
+    const hadPhone = (await Promise.all(stale.map((s) => servesTailnet(s.port)))).some(Boolean);
     for (const s of stale) await stopOne(s.port);
     live = await discover();
+    if (hadPhone && !remote) {
+      if (tailnetRefusal()) say('note: phone access is off after this restart, because Tailscale is not running. Start it, then run `pmos phone`.');
+      else remote = true;
+    }
   }
   if (live.length) {
     const port = live[0].port;
@@ -245,7 +276,7 @@ async function up(dir) {
       say(`note: ${live.length} workspace servers are running (${live.map((l) => l.port).join(', ')}) — using ${port}.`);
       say('      They share this install\'s state but not each other\'s live terminals. `pmos stop` shuts them all down.');
     }
-    return openWorkspace(dir, port);
+    return openWorkspace(dir, port, { open });
   }
   if (!ensureInstalled()) return 1;
   fs.mkdirSync(STATE, { recursive: true });
@@ -283,18 +314,22 @@ async function up(dir) {
     ...process.env,
     PMOS_SELF_ROOT: process.env.PMOS_SELF_ROOT || repoRootOf(dir),
     PMOS_WS_PORT: String(port),
+    ...(remote ? { PMOS_REMOTE: 'tailnet' } : {}),
   };
   const child = spawn(process.execPath, [path.join(WS, 'server.js')], {
     cwd: WS, detached: true, stdio: ['ignore', log, log], env,
   });
+  // A server that exits at once (a refused tailnet bind, a port lost to a race) ends the wait below early.
+  let exited = false;
+  child.on('exit', () => { exited = true; });
   child.unref();
   try { fs.writeFileSync(pidFile(port), String(child.pid)); } catch {}
   process.stdout.write('starting the workspace ');
-  for (let i = 0; i < 40; i++) {                        // up to ~10s
+  for (let i = 0; i < 40 && !exited; i++) {             // up to ~10s
     if (await probe(port)) {
       say('');
       say('  sessions keep running after you close this terminal · `pmos stop` shuts it down');
-      return openWorkspace(dir, port);
+      return openWorkspace(dir, port, { open });
     }
     process.stdout.write('.');
     await sleep(250);
@@ -302,7 +337,7 @@ async function up(dir) {
   // Last chance before reporting failure: another launcher may have won the race and be serving
   // this repo already, on a port it recorded while we were waiting.
   live = await discover();
-  if (live.length) { say(''); return openWorkspace(dir, live[0].port); }
+  if (live.length) { say(''); return openWorkspace(dir, live[0].port, { open }); }
 
   say(`\n✗ the server did not come up. Its log says:`);
   try {
@@ -376,6 +411,50 @@ async function stop() {
   return code;
 }
 
+/**
+ * `pmos phone`: phone access in one command (initiative workspace-phone-command). The phone link is the one the
+ * server printed in its startup banner; lib/phone-cli.js reads it back from the server's log. So:
+ *   - a current server already in tailnet mode is reused, and the phone keeps its sign-in;
+ *   - otherwise every running server is stopped (sessions keep running in tmux) and one starts in tailnet mode.
+ */
+async function phone(dir) {
+  const P = require('../lib/phone-cli');
+  const live = await discover();
+  let reuse = null;
+  for (const l of live) if (l.version === APP_VERSION && await servesTailnet(l.port)) { reuse = l; break; }
+  let banner;
+  if (reuse) {
+    if (await openWorkspace(dir, reuse.port, { open: false })) return 1;
+    banner = P.lastBanner(P.readLogTail(logFile(reuse.port)));
+  } else {
+    const refused = tailnetRefusal();
+    if (refused) {
+      say('✗ ' + refused);
+      say(P.startFailureHint(refused) || '  Fix the above, then run `pmos phone` again.');
+      if (live.length) say('  The running workspace was left as it is.');
+      return 1;
+    }
+    if (live.length) {
+      say('turning on phone access: restarting the workspace in tailnet mode. Sessions keep running in tmux and re-attach.');
+      for (const s of live) await stopOne(s.port);
+    }
+    // Only THIS start's banner counts: the log is append-only, and an older banner may be from another mode.
+    const sizes = new Map(D.candidatePorts({ stateDir: STATE, pinned: PINNED }).map((p) => [p, (() => { try { return fs.statSync(logFile(p)).size; } catch { return 0; } })()]));
+    const fresh = (p) => { try { return P.readLogTail(logFile(p), Math.min(P.TAIL_BYTES, Math.max(0, fs.statSync(logFile(p)).size - (sizes.get(p) || 0)))); } catch { return ''; } };
+    const code = await up(dir, { remote: true, open: false });
+    const now = await discover();
+    if (code || !now.length) {
+      const hint = P.startFailureHint([...sizes.keys()].map(fresh).join('\n'));
+      if (hint) say(hint);
+      return 1;
+    }
+    banner = P.lastBanner(fresh(now[0].port));
+  }
+  const out = P.phoneLines(banner, { ansi: !!process.stdout.isTTY && !process.env.NO_COLOR });
+  for (const l of out.lines) say(l);
+  return out.ok ? 0 : 1;
+}
+
 function doctor() {
   const r = spawnSync(process.execPath, [path.join(WS, 'doctor.js')], { stdio: 'inherit' });
   // A child that never ran (or died to a signal) has status null — `null || 0` reported success.
@@ -391,6 +470,7 @@ function doctor() {
   else if (cmd === 'ls' || cmd === 'list') code = await ls();
   else if (cmd === 'stop') code = await stop();
   else if (cmd === 'doctor') code = doctor();
+  else if (cmd === 'phone') code = await phone(process.argv[3] && !process.argv[3].startsWith('-') ? path.resolve(process.argv[3]) : process.cwd());
   else if (cmd === 'schedule' || cmd === 'skill') {
     // Thin client of the running server's own routes (lib/schedule-cli.js): one store, one validator.
     const live = await discover();
@@ -431,9 +511,10 @@ function doctor() {
     if (r.error) { say('✗ could not run ' + npx + ' — ' + r.error.message); code = 1; }
     else code = r.status === null ? 1 : r.status;
   } else if (cmd === 'help' || cmd === '--help' || cmd === '-h') {
-    say('usage: pmos [<path>|status|ls|stop|doctor|upgrade|schedule|skill|proactive|kg|item|' + require('../lib/pmos-verbs.js').names().join('|') + ']');
+    say('usage: pmos [<path>|status|ls|stop|doctor|phone|upgrade|schedule|skill|proactive|kg|item|' + require('../lib/pmos-verbs.js').names().join('|') + ']');
     say('  pmos          open the current repo as a workspace (starts the server if needed)');
     say('  pmos <path>   open another repo as a workspace');
+    say('  pmos phone    turn on phone access over Tailscale and show the QR code to scan');
     say('  pmos schedule …  create, edit and run scheduled tasks (pmos schedule --help)');
     say('  pmos skill …     list, read, create and edit skills');
     say('  pmos proactive … what is waiting for you, feedback, settings (pmos proactive --help)');

package/workspace/guide/index.md

@@ -23,7 +23,7 @@ On a desktop the workspace is one frame. [Layout](layout.md) explains each part.
 |---|---|
 | What is waiting for you now | Today |
 | The initiatives of a repository, or of every repository | Initiatives. Choose **All repositories** in Repository ▾ for every repository. |
-| The branches of a repository and the sessions running in each | Repository ▾ → **Branches and sessions**. |
+| The sessions of a repository, by initiative | The agent dock. ⌘K → **Branches and sessions** lists the branches. |
 | The items of an initiative | Board, or Breakdown in the initiative detail |
 | Run reports | Reports |
 | Repositories, Profiles, New sessions (the default CLI and model), Validate consent, Theme | Settings |

package/workspace/guide/layout.md

@@ -2,7 +2,7 @@
 type: Guide
 title: "Guide: layout"
 description: "The frame: one top bar, the place on screen, the detail and the agent dock; the phone tabs; the keys; and the older layout."
-timestamp: 2026-10-05
+timestamp: 2026-10-06
 ---
 
 # Guide: layout
@@ -14,7 +14,7 @@ On a desktop screen the workspace is one frame. It has one top bar, the place on
 The top bar has these parts, from left to right:
 
 - **Repository ▾** names the current repository. Press it to choose another repository, or **All repositories** to see the work of every repository at once. All repositories replaces the old Portfolio mode.
-- **Branches and sessions**, at the end of Repository ▾ (or in ⌘K), opens a sheet with every branch of the repository (main first) and how many sessions run in each. Press a branch to see its sessions, open one, end one, or start a session there. **＋ branch** makes a branch, and **＋ session** starts one with a branch, an agent and a profile. With All repositories, the sheet lists every repository.
+- **Branches and sessions** is in ⌘K. It opens a sheet with every branch of the repository (main first) and how many sessions run in each. Press a branch to see its sessions, open one, end one, or start a session there. **＋ branch** makes a branch, and **＋ session** starts one with a branch, an agent and a profile. With All repositories, the sheet lists every repository.
 - **Today, Initiatives, Board and Reports** are the four places. Press one to show it. The Today count shows how many items need you.
 - **Search or capture ⌘K** opens the command palette. Type to find an initiative, a repository, an open tab or a command.
 - **Sync** shows only when the current repository is not in sync with its remote. Press it to fetch, bring in the work of the other machine, record your changes and push. If the repository has not fetched in the last 10 minutes, Sync also shows, because a push from another machine is not visible until a fetch. When the repository fetched recently and is in sync, Sync is not shown. If Sync stops, the message names the step that stopped.
@@ -41,10 +41,14 @@ The dock holds your terminals, documents, conversations, skills and web pages. I
 
 - Press ⌘J (Ctrl-J), or the button on the rail, to open the dock. Press ⌘J again, or the fold button in the dock, to fold it to the rail.
 - The dock never opens by itself. A tab that opens while the dock is a rail waits in the dock until you open it.
-- **＋ Session** in the dock starts a new session. Its menu also has **Session with options** and one item for each skill of the repository. A skill opens in its own tab in the dock.
-- The Web button in the dock opens a web page in a tab.
+- The dock lists the sessions of the repository by initiative. A session is in the group of the initiative it is recorded on, or of its `initiative/<id>` branch. Then come **Not linked** (no initiative) and **Scheduled** (started by a schedule). Then **Open** lists the tabs that are not sessions, for example documents and skills.
+- Each session row shows the name, the type of work, and the branch when it is not main and not the initiative's own branch. Press the row to bring the session to the front.
+- Press **⋯** on a row to change the name, the initiative or the type of work.
+- Press **✕** on a row to end the session. The row asks "End “name”?". Press **End** or **Cancel**. When you end the last running session on its own working copy, the message offers **Remove working copy**. This removes the folder only. The branch stays. If the folder has unsaved work, the workspace keeps it and tells you why.
+- **＋ Session** at the top of the dock, or **＋** on an initiative, opens one sheet. Type a name, or leave it empty to name the session after the skill and the initiative. **For** is the initiative. **On** is where the session runs. **Automatic** uses the initiative's own working copy on `initiative/<id>` (made the first time), or the main tree when there is no initiative. You can also choose a branch that has a working copy, or **New branch…**. Then press **Blank session** (the CLI and model from Settings) or a skill. The session starts at once.
+- The icons at the bottom of the dock show the sessions as a strip on top, give the dock the whole window (Focus), and fold the dock. On top, a select chooses the group, and each session of the group is a button. **＋** starts a session, and **✕** ends the session in front.
 - To make the dock wider or narrower, drag its left edge. With the edge focused, the left and right arrow keys change the width in steps. Double-click the edge to go back to the default width. The width is kept in this browser.
-- **Focus** in the dock gives the dock the whole window. The place and the detail are hidden, and the dock stays full width on every place. Press **Exit focus**, or ⌘⇧J (Ctrl-Shift-J), to show the place again. Folding the dock also ends Focus.
+- **Focus** in the dock gives the dock the whole window. The place and the detail are hidden, and the dock stays full width on every place. Press Focus again, or ⌘⇧J (Ctrl-Shift-J), to show the place again. Folding the dock also ends Focus.
 - **▲ scratchpad** in the bar under the tabs opens the scratchpad. The pad keeps one note for each terminal session, and one for the repository when no terminal is in front. **Send to terminal** types the note into the session in front.
 
 Folding the dock, or going to another place, does not touch your terminals.

package/workspace/guide/proactive-engine.md

@@ -32,6 +32,7 @@ The top of Today is the morning brief: a greeting, the day's calendar, the prior
 - Press **schedule the morning brief** in Today to make a daily schedule at 06:45. The schedule is an ordinary scheduled task, so it runs only while the workspace server runs. A sleeping computer gets no brief. A schedule that is made after its time of day for the first time runs within a minute, so pressing the button at 10:00 starts one brief session straight away.
 - Each source is a setting: calendar, wispr, mail, slack, jira, confluence, github, drive, figma and website. Calendar, wispr, slack, jira and confluence are on by default. Mail, github, drive, figma and website are off by default. The skill reads only subjects and senders of mail, never bodies. A source that is off cannot be reported as read.
 - **Scopes.** For Slack, Jira and Confluence you give each channel, project or space one scope. At most 50 names are kept for each service, and a name has at most 120 characters. **watch** means the session reads every message since the last read and writes a digest: the decisions, the open questions, and what touches a goal. **search** means the session reads nothing there and looks only for mentions of you and the words of your goals. **ignore** means the session does not read, search or report the place.
+- **Places.** The morning brief lists every Slack channel you are a member of, every Jira project you work in and every Confluence space you are in. It reads only their names and links, not their messages. Sources shows these places, so you can give each one a scope. Before the first brief that reads a service, Sources says that its places are listed after that read. At most 200 places are kept in a brief.
 - **Websites.** Under the website source you list at most 10 addresses. The session reads each one for changes that matter to a goal or a meeting.
 - **Mentions.** In every place that is not ignored, the skill finds the mentions of you: where, who, the link to the conversation, and a short paraphrase. It never copies a message.
 - **Meetings.** Each calendar event can carry a purpose and a prep note (at most 240 characters each), up to 6 steps before, during and after the meeting (each step says whether you or an agent does it), a suggested initiative with the reason, and up to 5 links.

package/workspace/guide/today.md

@@ -16,6 +16,8 @@ Above the cards, Today shows the day in two columns.
 
 Press **Prepare my day** to start the day. It runs from the brief to the delivery of each agent job, and you do not press anything else until a draft is ready for you. The page [Guide: Today and the proactive engine](proactive-engine.md) describes each step.
 
+If the morning-brief session stops before it submits a brief, the Read step says so and gives the reason. **Prepare my day** is then ready again, so press it to try once more. If the session says that its folder is not there, open the repository again from its current folder first.
+
 Each job has one of three kinds.
 
 | Kind | Who does it | What you do |

package/workspace/lib/brief.js

@@ -45,6 +45,7 @@ const WORTH_ASKING = 0.5;
 const MAX_ITEMS = 30;
 const MAX_EVENTS = 20;
 const MAX_DIGESTS = 30;
+const MAX_PLACES = 200;   // the Slack channels, Jira projects and Confluence spaces the PM is in: names only, so Sources can list them
 const MAX_RESOLVED = 200;
 const INI_RE = /^[a-z0-9][a-z0-9._-]*$/i;
 const GOAL_RE = /^g-[0-9a-f]{8}$/;
@@ -289,6 +290,24 @@ function validateBrief(raw, ctx = {}) {
     digests.push({ source: d.source, name, link: d.link || null, decisions: lines(d.decisions, 140), open: lines(d.open, 140), goals: lines(d.goals, 140) });
   }
 
+  // `places`: every channel, project and space the PM is in, by name, so the PM can set a level for each (G20). Names
+  // and links only: nothing of what is said there.
+  const pl = raw.places === undefined || raw.places === null ? [] : raw.places;
+  if (!Array.isArray(pl)) return { ok: false, error: 'places must be a list' };
+  if (pl.length > MAX_PLACES) return { ok: false, error: `places has ${pl.length} entries — at most ${MAX_PLACES}` };
+  const places = [];
+  for (const [i, x] of pl.entries()) {
+    const at = `place ${i + 1}`;
+    if (!x || typeof x !== 'object' || Array.isArray(x)) return { ok: false, error: `${at} is not an object` };
+    if (!DIGEST_SOURCES.includes(x.source)) return { ok: false, error: `${at}: source must be one of ${DIGEST_SOURCES.join(', ')}` };
+    if (sources[x.source] !== 'read') return { ok: false, error: `${at}: source "${x.source}" is not reported as read, so it cannot list places` };
+    if (typeof x.name !== 'string' || !x.name.trim()) return { ok: false, error: `${at} needs a name (the channel, project or space)` };
+    const err = optText(x.name, 120, `${at}: name`) || optLink(x.link, `${at}: link`);
+    if (err) return { ok: false, error: err };
+    const name = clip(x.name, 120);
+    if (!places.some((y) => y.source === x.source && y.name === name)) places.push({ source: x.source, name, link: x.link || null });
+  }
+
   // `resolved` is read by a merge only: the ids of stored items a check found done or answered.
   const rs = raw.resolved === undefined || raw.resolved === null ? [] : raw.resolved;
   if (!Array.isArray(rs) || rs.length > MAX_RESOLVED || rs.some((x) => typeof x !== 'string' || !ITEM_ID_RE.test(x))) return { ok: false, error: `resolved must be a list of at most ${MAX_RESOLVED} item ids` };
@@ -300,7 +319,7 @@ function validateBrief(raw, ctx = {}) {
     judgment = { used: raw.judgment.used };
   }
   return { ok: true, brief: { date, generated_at: new Date(now).toISOString(), sources, calendar, priorities: items.filter((x) => !x.worth_asking), worth_asking: items.filter((x) => x.worth_asking), judgment,
-    digests, resolved: [...new Set(rs)] } };
+    digests, places, resolved: [...new Set(rs)] } };
 }
 
 /**
@@ -310,12 +329,13 @@ function validateBrief(raw, ctx = {}) {
  *            An incoming item with a stored id replaces it and keeps its first_seen and new. More than 30 is refused.
  *   events   by id: the fields given overwrite, notes merge by kind (wispr, mail), new events are added.
  *   digests  replaced by (source, name).   sources  'read' wins, otherwise the stored state is kept.
+ *   places   a service's list is replaced when the incoming brief lists that service.
  * @returns {{ok:true, brief:object, added:number, removed:number}|{ok:false, error:string}}
  */
 function mergeBrief(stored, incoming, { now = Date.now() } = {}) {
   if (!incoming || typeof incoming !== 'object') return { ok: false, error: 'nothing to merge' };
   const inItems = [...(incoming.priorities || []), ...(incoming.worth_asking || [])];
-  if (!stored || typeof stored !== 'object') return { ok: true, brief: { ...incoming, digests: incoming.digests || [], resolved: [] }, added: inItems.length, removed: 0 };
+  if (!stored || typeof stored !== 'object') return { ok: true, brief: { ...incoming, digests: incoming.digests || [], places: incoming.places || [], resolved: [] }, added: inItems.length, removed: 0 };
   if (stored.date !== incoming.date) return { ok: false, error: `a merge is for the stored brief of the same day — the stored brief is for ${stored.date}` };
   const at = new Date(now).toISOString();
   const gone = new Set(incoming.resolved || []);
@@ -348,6 +368,10 @@ function mergeBrief(stored, incoming, { now = Date.now() } = {}) {
   for (const d of incoming.digests || []) dg.set(d.source + '|' + d.name, d);
   if (dg.size > MAX_DIGESTS) return { ok: false, error: `the brief would hold ${dg.size} digests — at most ${MAX_DIGESTS}` };
 
+  // places: a merge that lists places for a service replaces that service's list; a service it does not list keeps its own.
+  const listed = new Set((incoming.places || []).map((x) => x.source));
+  const places = [...(stored.places || []).filter((x) => !listed.has(x.source)), ...(incoming.places || [])];
+
   const sources = {};
   for (const k of SOURCES) {
     const a = (stored.sources || {})[k]; const b = (incoming.sources || {})[k];
@@ -359,9 +383,9 @@ function mergeBrief(stored, incoming, { now = Date.now() } = {}) {
     date: stored.date, generated_at: stored.generated_at || at, updated_at: at, sources, calendar,
     priorities: items.filter((x) => !x.worth_asking), worth_asking: items.filter((x) => x.worth_asking),
     judgment: { used: !!((stored.judgment && stored.judgment.used) || (incoming.judgment && incoming.judgment.used)) },
-    digests: [...dg.values()], resolved: [...new Set([...(stored.resolved || []), ...taken])].slice(-MAX_RESOLVED),
+    digests: [...dg.values()], places, resolved: [...new Set([...(stored.resolved || []), ...taken])].slice(-MAX_RESOLVED),
   } };
 }
 
-module.exports = { SOURCES, ITEM_SOURCES, SOURCE_STATES, OWNERS, EFFORTS, KINDS, DIGEST_SOURCES, WORTH_ASKING, MAX_ITEMS, MAX_EVENTS, MAX_DIGESTS,
+module.exports = { SOURCES, ITEM_SOURCES, SOURCE_STATES, OWNERS, EFFORTS, KINDS, DIGEST_SOURCES, WORTH_ASKING, MAX_ITEMS, MAX_EVENTS, MAX_DIGESTS, MAX_PLACES,
   isUrl, validateBrief, mergeBrief, greeting, localDate };

package/workspace/lib/phone-cli.js

@@ -0,0 +1,94 @@
+'use strict';
+/* phone-cli.js — the pure half of `pmos phone` (initiative workspace-phone-command).
+ *
+ *   pmos phone [<path>]   turn on phone access for this repo and print the phone link as a QR code
+ *
+ * The launcher starts the server DETACHED, so the server's startup banner (lib/remote-access.js startupLines) goes to
+ * server-<port>.log and never reaches the PM's terminal. That banner is where the phone link lives: the server
+ * generates the token and prints it there once. `pmos phone` reads the LAST banner in that log back and prints the
+ * link in the terminal, so nothing new is generated, stored or served, and a phone that is signed in stays signed in.
+ *
+ * Who can read it: the person at this machine, who already has token-free loopback access to every route (D62), and
+ * who can already open the log. A PMOS_TOKEN token is never in the banner, so it is never printed here either.
+ *
+ * Every function here is pure or reads one file; bin/pmos.js owns starting and stopping the server.
+ */
+const fs = require('fs');
+const qr = require('./qr');
+
+const BANNER = 'pmos workspace server — ';
+const TAIL_BYTES = 256 * 1024;   // the banner is near the end: it is written once per start, and the log is append-only
+
+/** The last `TAIL_BYTES` of a log file, or '' when it does not exist. */
+function readLogTail(file, bytes = TAIL_BYTES) {
+  try {
+    const size = fs.statSync(file).size;
+    const len = Math.min(size, bytes);
+    const buf = Buffer.alloc(len);
+    const fd = fs.openSync(file, 'r');
+    try { fs.readSync(fd, buf, 0, len, size - len); } finally { fs.closeSync(fd); }
+    return buf.toString('utf8');
+  } catch { return ''; }
+}
+
+/**
+ * What the most recent startup banner in a log says. null when the log holds no banner.
+ *   remote      the server bound the tailnet (REMOTE mode)
+ *   tailnetUrl  http://100.x.y.z:<port>   — present in REMOTE mode
+ *   phoneUrl    the signed-in link        — present only for a GENERATED token
+ *   ownToken    the server uses PMOS_TOKEN, so no link was printed
+ */
+function lastBanner(text) {
+  const lines = String(text || '').split(/\r?\n/);
+  let at = -1;
+  for (let i = lines.length - 1; i >= 0; i--) if (lines[i].startsWith(BANNER)) { at = i; break; }
+  if (at < 0) return null;
+  const head = lines[at];
+  const out = { remote: /REMOTE \(tailnet\) mode/.test(head), tailnetUrl: null, phoneUrl: null, ownToken: false };
+  if (!out.remote) return out;
+  // The REMOTE banner is a few lines plus a QR code (about 30 lines at version 4). Read no further than its end, so
+  // a later log line that happens to look like one of these cannot be mistaken for it.
+  for (const l of lines.slice(at + 1, at + 80)) {
+    if (/^\S/.test(l)) break;                                 // the banner's lines are all indented
+    let m;
+    if (!out.tailnetUrl && (m = /^\s+tailnet:\s+(http:\/\/\S+)/.exec(l))) out.tailnetUrl = m[1];
+    if (!out.phoneUrl && (m = /^\s+or open:\s+(http:\/\/\S+\?token=\S+)/.exec(l))) out.phoneUrl = m[1];
+    if (/paste your PMOS_TOKEN/.test(l)) out.ownToken = true;
+  }
+  return out;
+}
+
+/** The lines `pmos phone` prints for a banner, and whether that is a success. */
+function phoneLines(banner, { ansi = false } = {}) {
+  if (!banner || !banner.remote) {
+    return { ok: false, lines: [
+      '✗ phone access is not on: the workspace server did not start in tailnet mode.',
+      '  Run `pmos stop`, then `pmos phone` again. `pmos doctor` diagnoses the rest.',
+    ] };
+  }
+  if (banner.phoneUrl) {
+    const lines = ['', '  Scan this with your phone camera. The phone must be signed in to the same Tailscale tailnet.', ''];
+    try {
+      for (const l of qr.toTerminal(qr.encode(banner.phoneUrl), { ansi })) lines.push('  ' + l);
+    } catch { lines.push('  (this link is too long for a QR code; type it instead)'); }
+    lines.push('', `  or open: ${banner.phoneUrl}`, '');
+    lines.push('  The link signs the phone in. It changes when the workspace restarts; run `pmos phone` again then.');
+    return { ok: true, lines };
+  }
+  if (banner.ownToken && banner.tailnetUrl) {
+    return { ok: true, lines: [
+      `  phone: open ${banner.tailnetUrl}/ on your phone and paste your PMOS_TOKEN into the sign-in field.`,
+      '  (A token you set yourself is never printed, so there is no QR code.)',
+    ] };
+  }
+  return { ok: false, lines: ['✗ phone access is on, but the server log has no phone link. Run `pmos stop`, then `pmos phone`.'] };
+}
+
+/** The extra line to print when starting in tailnet mode failed because no tailnet address was found. */
+function startFailureHint(logText) {
+  return /no Tailscale tailnet address|Is Tailscale up\?/.test(String(logText || ''))
+    ? '  Tailscale is not running on this computer. Open the Tailscale app and sign in (or run `tailscale up`), then run `pmos phone` again.'
+    : null;
+}
+
+module.exports = { readLogTail, lastBanner, phoneLines, startFailureHint, BANNER, TAIL_BYTES };

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.55.0",
+  "version": "0.55.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.55.0",
+  "version": "0.55.2",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/app.js

@@ -483,7 +483,7 @@ function repoMenu(anchor) {
   const items = tuples.map((t) => ({ label: t[0], icon: t[0] === cur ? 'check' : null, onSelect: () => chooseRepo(t[0]) }));
   if (items.length) items.push({ sep: true });
   items.push({ label: FC.repo.all, icon: fr.scope === 'all' ? 'check' : null, onSelect: chooseAll });
-  if (tuples.length) items.push({ sep: true }, { label: FC.repo.branches, onSelect: openBranchesSheet });
+  // 0.55.1: Branches and sessions left this menu; the dock lists the sessions, and ⌘K still opens the sheet
   menu({ anchor, items, ariaLabel: FC.repo.menu });
 }