create-pmos 0.56.0 → 0.57.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@b024452
+kernel-source: pmos@d3d97f5
 assembled: 2026-10-06
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-06T10:33:25Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T11:08:49Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-06T10:33:25Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T11:08:49Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-06T10:33:25Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T11:08:49Z"}
 status: stable
 ---
 

package/workspace/REMOTE.md

@@ -64,7 +64,7 @@ The steps below do the same thing by hand, from a PMOS checkout.
 
    Under those lines it prints the phone URL as a **QR code**, and the same URL as text (`http://100.x.y.z:7433/?token=<token>`). The token is shown only at startup and never logged again. A token you supply with `PMOS_TOKEN` is never printed, so that mode prints no QR code.
 
-3. **Open it from your phone.** Point the phone camera at the QR code and open the link. Or type the URL into the phone's browser. The server sets a sign-in cookie (7 days) and redirects to `http://100.x.y.z:7433/`, so the token does not stay in the address bar or the history.
+3. **Open it from your phone.** Point the phone camera at the QR code and open the link. Or type the URL into the phone's browser. The server sets a sign-in cookie (30 days) and redirects to `http://100.x.y.z:7433/`, so the token does not stay in the address bar or the history.
 
    If the phone has no valid cookie, it shows a **sign-in page**. Paste the token there. The field is a password field, so the phone's password manager can save it. This is also what you see after the cookie expires, or after a restart that generated a new token.
 
@@ -123,7 +123,40 @@ Two locks protect the workspace, and each one is enforced by the server:
 
 The Access check in the server is a **presence check**: it confirms that Access is in front, and it fails closed when you forget the Access application. It does not verify the assertion's signature, because that needs Cloudflare's signing keys fetched over the network, and the workspace makes no outbound requests (D79). The origin listens on loopback only, so the tunnel is the only way to reach it with the public hostname.
 
-### Setup
+### The Online switch (recommended)
+
+With the Online switch, the workspace runs the tunnel itself, and Cloudflare Access is the only login. You do not need a start line, a second terminal or the workspace token on your phone (D89).
+
+How the switch protects the workspace:
+
+- On the public hostname, the server checks the `Cf-Access-Jwt-Assertion` header on every request and on every terminal connection. The assertion must be signed by your Cloudflare team's key, be for your Access application's audience tag, be in date, and be for the one email you allow. If any check fails, the server returns `403`.
+- To check the signature, the server gets your team's public keys from `https://<team>.cloudflareaccess.com/cdn-cgi/access/certs`. It does this only while Online is on, at most once an hour, plus once a minute at most for a new key. This is the only outbound request it makes for Online. It sends nothing of yours.
+- Only the computer that runs the workspace can change the switch or its settings. A phone can see the state but cannot change it.
+
+Do these steps one time:
+
+1. **Create the tunnel and its DNS record** on the computer that runs the workspace:
+
+   ```sh
+   brew install cloudflared            # or your platform's package
+   cloudflared tunnel login
+   cloudflared tunnel create pmos
+   cloudflared tunnel route dns pmos pmos.example.com
+   ```
+
+   Write `~/.cloudflared/config.yml` as in step 4 of the manual setup below, with your hostname.
+
+2. **Create the Access application.** In Cloudflare Zero Trust, go to **Access › Applications › Add an application › Self-hosted**. Set the subdomain and domain to your hostname. Add one policy: **Allow**, **Emails**, your email address. On the application's **Overview**, copy the **Application Audience (AUD) Tag**.
+
+3. **Optional: sign in with Google.** Go to **Settings › Authentication › Login methods › Add new › Google**, and follow the steps there to create a Google OAuth client. In the Access application's **Login methods**, select Google and turn on **Instant Auth**, so the login goes directly to Google.
+
+4. **Fill in the Online section.** In the workspace on that computer, open **Settings › Online**. Enter the public address, the tunnel name (`pmos`), your team domain (`<team>.cloudflareaccess.com`, shown under **Settings › Custom Pages** in Zero Trust), the AUD tag and your email. Then select **Turn on**.
+
+The status line shows when the tunnel runs. Open your hostname on the phone and sign in with Google or the email code. The workspace remembers the switch: if it restarts while Online is on, it goes online again. Select **Turn off** to stop the tunnel. The hostname then gets `403` at once. The tunnel's output is in `online-tunnel.log` in the workspace state folder.
+
+If `PMOS_PUBLIC_HOST` is set when the workspace starts, the switch is not available, and the manual setup below applies.
+
+### Setup by hand (`PMOS_PUBLIC_HOST`, with the token)
 
 1. **Pick the machine.** Use a machine that stays on: your desktop, or a small Linux VPS. Install the workspace there as usual, and sign in to your agent CLI in a workspace terminal.
 
@@ -162,7 +195,7 @@ The Access check in the server is a **presence check**: it confirms that Access
 
 6. **Start the tunnel:** `cloudflared tunnel run pmos`. To keep it running after a reboot, install it as a service (`sudo cloudflared service install`).
 
-7. **Open `https://pm-os.app/`.** Cloudflare asks for your login. The workspace then shows its sign-in page. Paste the token. The workspace sets a `Secure` session cookie for 7 days.
+7. **Open `https://pm-os.app/`.** Cloudflare asks for your login. The workspace then shows its sign-in page. Paste the token. The workspace sets a `Secure` session cookie for 30 days. Set the Access application's session duration to 1 month as well, so each device signs in about once a month.
 
 ### Check that it is closed
 
@@ -184,6 +217,8 @@ Run these from a machine that is **not** signed in to Access:
 - **`403` "the public host is only reachable through Cloudflare Access"** — the request reached the workspace without passing Access. Create the Access application for the hostname (Setup step 3).
 - **`403` "forbidden origin/host" on the public hostname** — `PMOS_PUBLIC_HOST` is not set, or it names another hostname, or the tunnel rewrites the `Host` header. Remove `httpHostHeader` from the tunnel's ingress rule.
 - **A local reverse proxy now gets `401`** — it adds a forwarding header, so its requests need the token. This is intended.
+- **`403` "your Cloudflare sign-in could not be verified for this workspace"** (Online switch) — check the AUD tag, the team domain and the email in **Settings › Online**. The email must be the one you sign in with. If the Online section says the keys did not load, check the team domain.
+- **Cloudflare error 1033** — the tunnel is not running. In **Settings › Online**, check the status line, and read `online-tunnel.log` in the workspace state folder. Another `cloudflared` for the same tunnel (for example a service you installed) also serves the hostname.
 
 - **"refusing to bind … only loopback or a Tailscale tailnet address (100.64.0.0/10) is permitted"** — you passed `PMOS_BIND_ADDR` (or `PMOS_TAILNET_IP`) that isn't loopback or tailnet. Use your real `tailscale ip -4` value.
 - **"no Tailscale tailnet address … was found"** — Tailscale isn't up on this machine. Run `tailscale up`, or set `PMOS_TAILNET_IP`.

package/workspace/guide/layout.md

@@ -25,12 +25,13 @@ Each place is drawn when its run is built. Until then the place says which run b
 
 ## Settings
 
-Settings holds settings only, in five sections:
+Settings holds settings only, in six sections:
 
 - **Repositories**: every registered repository. Press a repository to make it the current one. Press its ⋯ for **Rename** or **Remove from PMOS**. Each asks in a sheet, and a remove asks you to confirm. **Add repository** shows the scan of a folder before you add it.
 - **Profiles**: the Claude profiles a session can start with. They open in the detail.
 - **New sessions**: the default CLI and the default model for a new session in the dock.
 - **Validate consent**: the consent of the current repository. Turn it on or off here. **Open Validate** opens the Validate page as a tab.
+- **Online**: puts this workspace at your own address, such as `pmos.pm-os.app`, through a Cloudflare tunnel. Enter the public address, the tunnel name, your Cloudflare team domain, the Access audience (AUD) tag and your email, then press **Turn on**. The workspace runs the tunnel and remembers the switch when it restarts. On your phone, open the address and sign in with Cloudflare Access (Google or an email code). The workspace does not ask for its token there. Only the computer that runs the workspace can change this section. A phone sees whether it is on. [REMOTE.md](../REMOTE.md) has the one-time Cloudflare steps.
 - **Theme**: Dark or Light.
 
 Your work is never in Settings. It is in Today, Initiatives, Board and Reports.

package/workspace/lib/access-jwt.js

@@ -0,0 +1,66 @@
+'use strict';
+/* access-jwt.js — checks a Cloudflare Access assertion (workspace-online-mode, D89).
+ *
+ * Cloudflare Access adds `Cf-Access-Jwt-Assertion` to every request it lets through to the origin: a JSON Web
+ * Token signed RS256 with one of the team's keys. While Online is on, a request to the public hostname passes
+ * on this token instead of the workspace token, so every check below must hold or the request is refused:
+ *
+ *   - three base64url parts, a JSON header and payload;
+ *   - header.alg is RS256 (never `none`, never HMAC) and header.kid names a key the caller holds;
+ *   - the RSA-SHA256 signature over `<header>.<payload>` verifies with that key;
+ *   - iss is `https://<team domain>`;
+ *   - aud (a string or a list) includes the configured audience tag;
+ *   - exp is in the future and nbf (when present) is not, with 60 seconds of clock skew;
+ *   - email is the one allowed address (compared without case).
+ *
+ * Pure: no I/O and no clock of its own (`now` is passed in, in seconds). The keys come from lib/access-keys.js.
+ * Nothing here logs the token, a claim or a key (D08); a refusal carries a short reason for tests and the
+ * status line, never the token.
+ */
+const crypto = require('crypto');
+
+const SKEW = 60;   // seconds
+
+function b64urlJson(part) {
+  try { return JSON.parse(Buffer.from(String(part), 'base64url').toString('utf8')); } catch { return null; }
+}
+
+/** Split a compact JWT. Returns null for anything that is not three non-empty base64url parts with JSON in the first two. */
+function parse(token) {
+  if (typeof token !== 'string' || token.length > 16384) return null;
+  const parts = token.split('.');
+  if (parts.length !== 3 || parts.some((p) => !p || !/^[A-Za-z0-9_-]+$/.test(p))) return null;
+  const header = b64urlJson(parts[0]);
+  const payload = b64urlJson(parts[1]);
+  if (!header || typeof header !== 'object' || !payload || typeof payload !== 'object') return null;
+  return { header, payload, signingInput: parts[0] + '.' + parts[1], signature: Buffer.from(parts[2], 'base64url') };
+}
+
+/**
+ * verify(token, { keyFor, teamDomain, audience, email, now }) → { ok: true, email } | { ok: false, reason, kid? }
+ *   keyFor(kid) → a crypto KeyObject or null. A refusal for an unknown key carries `kid`, so the caller can
+ *   refetch the key set once and try again.
+ */
+function verify(token, { keyFor, teamDomain, audience, email, now } = {}) {
+  const t = parse(token);
+  if (!t) return { ok: false, reason: 'malformed' };
+  if (t.header.alg !== 'RS256') return { ok: false, reason: 'algorithm' };
+  const kid = typeof t.header.kid === 'string' ? t.header.kid : '';
+  const key = kid && typeof keyFor === 'function' ? keyFor(kid) : null;
+  if (!key) return { ok: false, reason: 'unknown key', kid };
+  let good = false;
+  try { good = crypto.verify('RSA-SHA256', Buffer.from(t.signingInput), key, t.signature); } catch { good = false; }
+  if (!good) return { ok: false, reason: 'signature' };
+  const p = t.payload;
+  if (!teamDomain || p.iss !== 'https://' + teamDomain) return { ok: false, reason: 'issuer' };
+  const auds = Array.isArray(p.aud) ? p.aud : [p.aud];
+  if (!audience || !auds.includes(audience)) return { ok: false, reason: 'audience' };
+  const n = Number(now);
+  if (typeof p.exp !== 'number' || !(p.exp + SKEW > n)) return { ok: false, reason: 'expired' };
+  if (p.nbf != null && (typeof p.nbf !== 'number' || p.nbf - SKEW > n)) return { ok: false, reason: 'not yet valid' };
+  const who = typeof p.email === 'string' ? p.email.trim().toLowerCase() : '';
+  if (!email || !who || who !== String(email).trim().toLowerCase()) return { ok: false, reason: 'email' };
+  return { ok: true, email: who };
+}
+
+module.exports = { verify, parse, SKEW };

package/workspace/lib/access-keys.js

@@ -0,0 +1,104 @@
+'use strict';
+/* access-keys.js — the team's public signing keys for Cloudflare Access (workspace-online-mode, D89).
+ *
+ * THE ONE NETWORK CALL OF D89. This module, and no other file, may GET
+ *   https://<team>.cloudflareaccess.com/cdn-cgi/access/certs
+ * where <team>.cloudflareaccess.com is the PM's configured team domain. The request carries no body, no
+ * cookie and no credential, and the answer is Cloudflare's PUBLIC key set. no-network.test.js names this
+ * file as the second exception beside D79's lib/typesafe.js.
+ *
+ * When it fetches (createStore):
+ *   - only when asked: the server asks only while Online is on (D89 rule 1);
+ *   - a key set older than an hour is refreshed on the next request that needs a key;
+ *   - a key id the store does not hold triggers one refetch, at most once a minute;
+ *   - a failed fetch keeps the keys already held. With none held, every lookup returns null and the guard
+ *     refuses (fail closed).
+ * Keys are held in memory only. Nothing here logs a key, a response or a header (D08).
+ */
+const crypto = require('crypto');
+const https = require('https');
+
+const TEAM_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.cloudflareaccess\.com$/;
+const REFRESH_MS = 60 * 60 * 1000;
+const MISS_MS = 60 * 1000;
+const TIMEOUT_MS = 5000;
+const MAX_BYTES = 64 * 1024;
+
+function validTeamDomain(d) { return typeof d === 'string' && TEAM_RE.test(d); }
+function certsUrl(teamDomain) { return 'https://' + teamDomain + '/cdn-cgi/access/certs'; }
+
+/** GET the key set. Resolves with the parsed JSON, rejects on any failure. Refuses any host but a team domain. */
+function fetchCerts(teamDomain) {
+  return new Promise((resolve, reject) => {
+    if (!validTeamDomain(teamDomain)) return reject(new Error('not a cloudflareaccess.com team domain'));
+    const req = https.get(certsUrl(teamDomain), { headers: { accept: 'application/json' }, timeout: TIMEOUT_MS }, (res) => {
+      if (res.statusCode !== 200) { res.resume(); return reject(new Error('status ' + res.statusCode)); }
+      let size = 0; const chunks = [];
+      res.on('data', (c) => { size += c.length; if (size > MAX_BYTES) { req.destroy(); reject(new Error('too large')); } else chunks.push(c); });
+      res.on('end', () => { try { resolve(JSON.parse(Buffer.concat(chunks).toString('utf8'))); } catch { reject(new Error('not JSON')); } });
+    });
+    req.on('timeout', () => req.destroy(new Error('timeout')));
+    req.on('error', reject);
+  });
+}
+
+/** A JWKS object → Map(kid → KeyObject). RSA keys only; anything unreadable is skipped. */
+function keysFromJwks(jwks) {
+  const out = new Map();
+  for (const k of (jwks && Array.isArray(jwks.keys) ? jwks.keys : [])) {
+    if (!k || k.kty !== 'RSA' || typeof k.kid !== 'string' || !k.n || !k.e) continue;
+    try { out.set(k.kid, crypto.createPublicKey({ key: { kty: 'RSA', n: k.n, e: k.e }, format: 'jwk' })); } catch { /* skip */ }
+  }
+  return out;
+}
+
+/**
+ * createStore({ teamDomain, fetch = fetchCerts, clock = Date.now }) → {
+ *   keyFor(kid)       the KeyObject held for kid, or null (sync; what access-jwt.verify calls)
+ *   ensure()          Promise: refresh when the set is missing or older than an hour
+ *   refetchFor(kid)   Promise<boolean>: one refetch for an unknown kid, at most once a minute; true when kid is now held
+ *   status()          { keys, fetchedAt, lastError } — counts and times only, never a key
+ * }
+ */
+function createStore({ teamDomain, fetch = fetchCerts, clock = Date.now } = {}) {
+  let keys = new Map();
+  let fetchedAt = 0;
+  let lastTry = 0;
+  let lastError = null;
+  let inflight = null;
+
+  function load() {
+    if (inflight) return inflight;
+    lastTry = clock();
+    inflight = Promise.resolve()
+      .then(() => fetch(teamDomain))
+      .then((jwks) => {
+        const next = keysFromJwks(jwks);
+        if (!next.size) throw new Error('no usable keys');
+        keys = next; fetchedAt = clock(); lastError = null;
+      })
+      .catch((e) => { lastError = String((e && e.message) || 'fetch failed'); })
+      .finally(() => { inflight = null; });
+    return inflight;
+  }
+  return {
+    keyFor: (kid) => keys.get(kid) || null,
+    ensure() {
+      if (inflight) return inflight;     // a request that arrives during the first fetch waits for it
+      const now = clock();
+      if (keys.size && now - fetchedAt < REFRESH_MS) return Promise.resolve();
+      if (lastTry && now - lastTry < MISS_MS) return Promise.resolve();   // a failing fetch is retried at most once a minute
+      return load();
+    },
+    async refetchFor(kid) {
+      if (inflight) await inflight;
+      if (keys.has(kid)) return true;
+      if (clock() - lastTry < MISS_MS) return false;
+      await load();
+      return keys.has(kid);
+    },
+    status: () => ({ keys: keys.size, fetchedAt: fetchedAt || null, lastError }),
+  };
+}
+
+module.exports = { createStore, fetchCerts, keysFromJwks, validTeamDomain, certsUrl, REFRESH_MS, MISS_MS };

package/workspace/lib/online-mode.js

@@ -0,0 +1,158 @@
+'use strict';
+/* online-mode.js — the Online switch: its settings record and the tunnel it runs (workspace-online-mode, PRD O1, O2).
+ *
+ * THE RECORD. `<runtime state>/online.json`, in the per-user runtime directory lib/state-root.js keeps outside every
+ * repository, written with mode 0600 through a temporary file and a rename (the typesafe-settings.js pattern):
+ *   { on, host, tunnel, team, audience, email }
+ *   host      the public hostname, validated by remote-access.parsePublicHost (pmos.pm-os.app)
+ *   tunnel    the Cloudflare tunnel name or id that `cloudflared tunnel run` takes (pmos)
+ *   team      the Cloudflare team domain, <team>.cloudflareaccess.com
+ *   audience  the Access application's audience tag, 64 hex characters
+ *   email     the one address allowed in
+ * A field that fails its check is refused with the reason, and nothing is written.
+ *
+ * THE TUNNEL. createTunnel() runs `cloudflared tunnel --no-autoupdate run <tunnel>` as a child of the server, with its
+ * output appended to `<runtime state>/online-tunnel.log`. stop() ends it. If it exits while Online is on, it is started
+ * again after 5 seconds. cloudflared is the PM's own installed program; it is found on PATH or in the two Homebrew
+ * folders, because a workspace started at login has a short PATH.
+ */
+const fs = require('fs');
+const path = require('path');
+const childProcess = require('child_process');
+const remoteAccess = require('./remote-access');
+const accessKeys = require('./access-keys');
+
+const FILE = 'online.json';
+const LOG = 'online-tunnel.log';
+const FIELDS = ['host', 'tunnel', 'team', 'audience', 'email'];
+const RESTART_MS = 5000;
+
+function file(stateDir) { return path.join(stateDir, FILE); }
+
+const CHECKS = {
+  host: (v) => {
+    if (!v) return 'give the public hostname, such as pmos.pm-os.app';
+    const r = remoteAccess.parsePublicHost(v);
+    return r.refused ? 'the hostname must be a bare DNS name, such as pmos.pm-os.app (no https://, port or path)' : null;
+  },
+  tunnel: (v) => (/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(v) ? null : 'give the tunnel name you created with cloudflared, such as pmos'),
+  team: (v) => (accessKeys.validTeamDomain(v) ? null : 'give your Cloudflare team domain, such as myteam.cloudflareaccess.com'),
+  audience: (v) => (/^[a-f0-9]{64}$/.test(v) ? null : "give the Access application's Audience (AUD) tag: 64 letters and digits from the application's Overview"),
+  email: (v) => (/^[^\s@]{1,64}@[^\s@]+\.[^\s@]{2,}$/.test(v) && v.length <= 254 ? null : 'give the email address you sign in with'),
+};
+function norm(field, v) {
+  const s = String(v == null ? '' : v).trim();
+  return field === 'tunnel' ? s : s.toLowerCase();
+}
+
+function read(stateDir) {
+  const out = { on: false, host: '', tunnel: '', team: '', audience: '', email: '' };
+  try {
+    const st = fs.lstatSync(file(stateDir));
+    if (!st.isFile()) return out;
+    const o = JSON.parse(fs.readFileSync(file(stateDir), 'utf8')) || {};
+    for (const f of FIELDS) if (typeof o[f] === 'string' && !CHECKS[f](o[f])) out[f] = o[f];
+    out.on = o.on === true && complete(out);
+  } catch { /* none yet */ }
+  return out;
+}
+
+function complete(s) { return FIELDS.every((f) => s[f] && !CHECKS[f](s[f])); }
+
+/** The first field that is missing or invalid, as { field, error }, or null when all five are good. */
+function firstProblem(s) {
+  for (const f of FIELDS) { const e = CHECKS[f](s[f] || ''); if (e) return { field: f, error: e }; }
+  return null;
+}
+
+function write(stateDir, data) {
+  const target = file(stateDir);
+  try { if (fs.lstatSync(target).isSymbolicLink()) return { ok: false, error: 'the settings file is a symlink and was not written' }; }
+  catch { /* not there yet */ }
+  const tmp = target + '.' + process.pid + '.tmp';
+  try {
+    fs.mkdirSync(stateDir, { recursive: true });
+    fs.writeFileSync(tmp, JSON.stringify(data), { mode: 0o600 });
+    fs.chmodSync(tmp, 0o600);
+    fs.renameSync(tmp, target);
+    return { ok: true };
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch { /* nothing to clean */ }
+    return { ok: false, error: 'the online settings could not be saved (' + String((e && e.code) || 'write failed') + ')' };
+  }
+}
+
+/**
+ * save(stateDir, patch) → { ok, settings } | { ok: false, field?, error }
+ * patch may carry any of the five fields and `on`. Fields are validated first; `on: true` then needs all five.
+ * Whether cloudflared is installed is the caller's check, because it is not a property of the record.
+ */
+function save(stateDir, patch = {}) {
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)) return { ok: false, error: 'the body must be an object' };
+  const next = read(stateDir);
+  for (const f of FIELDS) {
+    if (!(f in patch)) continue;
+    const v = norm(f, patch[f]);
+    const e = CHECKS[f](v);
+    if (e) return { ok: false, field: f, error: e };
+    next[f] = v;
+  }
+  if ('on' in patch) {
+    if (typeof patch.on !== 'boolean') return { ok: false, field: 'on', error: 'on must be true or false' };
+    if (patch.on) { const p = firstProblem(next); if (p) return { ok: false, ...p }; }
+    next.on = patch.on;
+  }
+  const w = write(stateDir, next);
+  return w.ok ? { ok: true, settings: next } : { ok: false, error: w.error };
+}
+
+/** The cloudflared binary: PATH first, then the two Homebrew folders. null when absent. */
+function findCloudflared({ env = process.env, exists = (p) => { try { fs.accessSync(p, fs.constants.X_OK); return fs.statSync(p).isFile(); } catch { return false; } } } = {}) {
+  const dirs = String(env.PATH || '').split(path.delimiter).filter(Boolean).concat(['/opt/homebrew/bin', '/usr/local/bin']);
+  const name = process.platform === 'win32' ? 'cloudflared.exe' : 'cloudflared';
+  for (const d of dirs) { const p = path.join(d, name); if (exists(p)) return p; }
+  return null;
+}
+
+/**
+ * createTunnel({ stateDir, spawn, find, setTimer }) → { start(name), stop(), status() }
+ * status() → { running, pid, since, lastExit } — lastExit is { code, at } of the last exit, or null.
+ */
+function createTunnel({ stateDir, spawn = childProcess.spawn, find = findCloudflared, setTimer = setTimeout } = {}) {
+  let child = null; let want = null; let since = null; let lastExit = null; let timer = null;
+  function launch() {
+    timer = null;
+    if (!want || child) return;
+    const bin = find();
+    if (!bin) { lastExit = { code: null, at: new Date().toISOString(), error: 'cloudflared is not installed' }; return; }
+    let fd = 'ignore';
+    try { fs.mkdirSync(stateDir, { recursive: true }); fd = fs.openSync(path.join(stateDir, LOG), 'a', 0o600); } catch { fd = 'ignore'; }
+    try {
+      child = spawn(bin, ['tunnel', '--no-autoupdate', 'run', want], { stdio: ['ignore', fd, fd], detached: false });
+    } catch (e) {
+      child = null; lastExit = { code: null, at: new Date().toISOString(), error: 'cloudflared could not start' };
+    }
+    if (typeof fd === 'number') { try { fs.closeSync(fd); } catch { /* ignore */ } }
+    if (!child) return;
+    since = new Date().toISOString();
+    const mine = child;
+    mine.on('error', () => {});
+    mine.on('exit', (code) => {
+      if (child !== mine) return;
+      child = null; since = null; lastExit = { code, at: new Date().toISOString() };
+      if (want && !timer) timer = setTimer(launch, RESTART_MS);
+    });
+  }
+  return {
+    start(name) { want = name; if (!child && !timer) launch(); },
+    stop() {
+      want = null;
+      if (timer) { clearTimeout(timer); timer = null; }
+      const c = child; child = null; since = null;
+      if (c) { try { c.kill('SIGTERM'); } catch { /* already gone */ } }
+    },
+    status: () => ({ running: !!child, pid: child ? child.pid : null, since, lastExit }),
+  };
+}
+
+module.exports = { read, save, complete, firstProblem, findCloudflared, createTunnel, FIELDS, FILE, LOG };

package/workspace/lib/remote-access.js

@@ -373,9 +373,11 @@ function stripTokenParam(url) {
 // The cookie a valid token seeds. HttpOnly (no script needs it) + SameSite=Strict + the Origin/Host
 // allowlist keep a foreign site from riding it. No Secure flag on the tailnet: it speaks plain HTTP
 // inside WireGuard. On the public host the browser is on HTTPS (TLS ends at the edge), so the cookie
-// is Secure there and is never sent over plain HTTP. 7 days, unchanged from workspace-mobile-remote-access.
+// is Secure there and is never sent over plain HTTP. 30 days (workspace-remember-device; was 7), so a
+// device signs in about once a month: the PM's own phone, behind Cloudflare Access or the tailnet.
+const SESSION_MAX_AGE = 30 * 24 * 60 * 60;
 function sessionCookie(token, { secure = false } = {}) {
-  return `${COOKIE_NAME}=${encodeURIComponent(token)}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Strict; Path=/; Max-Age=604800`;
+  return `${COOKIE_NAME}=${encodeURIComponent(token)}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Strict; Path=/; Max-Age=${SESSION_MAX_AGE}`;
 }
 
 // The sign-in form posts application/x-www-form-urlencoded `token=<t>` to /auth.
@@ -425,7 +427,7 @@ module.exports = {
   LOOPBACK, isLoopbackAddr, isTailnetIp, detectTailnetIp, remoteRequested,
   resolveBinds, extractHttpToken, extractWsToken, tokenMatches, authorize, startupLines,
   checkHostOrigin, isAllowedOrigin, hostnameAllowed,
-  parsePublicHost, PROXY_HEADERS, ACCESS_HEADER, isProxied, edgeAllowed,
+  parsePublicHost, PROXY_HEADERS, ACCESS_HEADER, isProxied, edgeAllowed, hostnameOf,
   COOKIE_NAME, extractCookieToken, presentedToken,
   phoneUrl, isPageNavigation, stripTokenParam, sessionCookie, AUTH_PATH, parseAuthForm, signInPage,
 };

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/dest-settings.js

@@ -1,11 +1,12 @@
 /* pm/dest-settings.js — the Settings destination, the frame's ⚙ (pm-os-absorb Run 3, slice 3A; PRD R9).
  *
- * Settings holds settings only, in five sections and in this order:
+ * Settings holds settings only, in six sections and in this order:
  *   Repositories       every registered repository as a row (open it to make it current; ⋯ for more), and Add repository,
  *                      which draws the existing add-repository flow (view-addrepo.js) in place
  *   Profiles           one row that opens the Claude profiles in the detail
  *   New sessions       the default CLI and the default model the dock's ＋ Session applies (dock.js)
  *   Validate consent   the current repository's consent switch (GET and POST /api/validate/repo)
+ *   Online             the Online switch and its five settings (GET and POST /api/online; workspace-online-mode, D89)
  *   Theme              Dark or Light
  * The work itself (what needs you, initiatives, items, reports) is never here.
  *
@@ -26,6 +27,7 @@ import { COPY } from './frame-copy.js';
 const P = COPY.page;
 const roots = new WeakMap();      // host -> { root, sig }
 const consentByWs = new Map();    // ws -> { on: boolean | null, error, at, pending }
+const online = { data: null, error: null, note: null, at: 0, pending: false };   // GET /api/online, and the last refusal
 let addOpen = false;
 let addMod = null;
 
@@ -52,11 +54,29 @@ async function setConsent(ws, on) {
   setState({});
 }
 
+function readOnline(force) {
+  if (FIXTURE || online.pending) return;
+  if (!force && Date.now() - online.at < 10000) return;
+  online.pending = true;
+  pmGet('/api/online').then((j) => {
+    online.pending = false; online.at = Date.now();
+    if (j && j.ok !== false) { online.data = j; online.error = null; } else online.error = P.onlineUnread;
+    setState({});
+  });
+}
+
+async function setOnline(patch) {
+  const j = await pmPost('/api/online', patch);
+  if (j && j.ok !== false) { online.data = j; online.note = null; } else online.note = (j && j.error) || P.onlineUnread;
+  online.at = Date.now();
+  setState({});
+}
+
 const section = (id, title, kids, action) => el('section', { class: 'fr-set__section', 'data-fr-section': id },
   el('div', { class: 'fr-set__head' }, el('h2', { class: 'fr-set__title' }, title), action || null),
   kids);
 
-/* ── the five sections ──────────────────────────────────────────────────────────────────────────────────────────── */
+/* ── the six sections ───────────────────────────────────────────────────────────────────────────────────────────── */
 
 function reposSection(scope) {
   const tuples = repoTuples();
@@ -166,6 +186,38 @@ function validateSection(scope) {
     el('span', { 'data-fr': 'consent-state', 'data-on': known ? String(c.on) : 'unread' }, line), toggle, open)]);
 }
 
+function onlineSection() {
+  readOnline(false);
+  const d = online.data;
+  if (!d) return section('online', P.online, [el('p', { class: 'fr-set__note' }, online.error || '')]);
+  if (d.envHost) return section('online', P.online, [el('p', { class: 'fr-set__note', 'data-fr': 'online-state', 'data-on': 'env' }, P.onlineEnv(d.envHost))]);
+  const lines = [el('p', { class: 'fr-set__note', 'data-fr': 'online-state', 'data-on': String(!!d.on) }, d.on ? P.onlineOn(d.host) : P.onlineOff)];
+  if (d.on) {
+    const r = d.running || {};
+    lines.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-tunnel' },
+      r.running ? P.onlineRunning : r.lastExit ? P.onlineExited(r.lastExit.code) : P.onlineStarting));
+    if (d.keys && !d.keys.keys) lines.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-keys' }, d.keys.lastError ? P.onlineKeysError(d.keys.lastError) : P.onlineKeysWait));
+  }
+  if (!d.canChange) return section('online', P.online, [...lines, el('p', { class: 'fr-set__note' }, P.onlineRemote)]);
+  const f = (key, label, placeholder) => field({
+    label, value: d[key] || '', placeholder,
+    onCommit: (v) => setOnline({ [key]: v }),
+    attrs: { 'data-fr': 'online-' + key, disabled: d.on ? true : undefined },
+  });
+  const fields = el('div', { class: 'fr-set__fields' },
+    f('host', P.onlineHost, 'pmos.example.com'), f('tunnel', P.onlineTunnel, 'pmos'), f('team', P.onlineTeam, 'myteam.cloudflareaccess.com'),
+    f('audience', P.onlineAudience, ''), f('email', P.onlineEmail, 'you@example.com'));
+  const blocked = !d.on && (!d.complete ? P.onlineNeedFields : !d.cloudflared ? P.onlineNoCloudflared : null);
+  const toggle = button({
+    label: d.on ? P.turnOff : P.turnOn, variant: 'outline', size: 'sm', disabled: !!blocked,
+    attrs: { 'data-fr': 'online-toggle' }, onClick: () => setOnline({ on: !d.on }),
+  });
+  const kids = [el('p', { class: 'fr-set__note' }, P.onlineIntro), fields, el('div', { class: 'fr-set__line' }, ...lines, toggle)];
+  if (blocked) kids.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-blocked' }, blocked));
+  if (online.note) kids.push(el('p', { class: 'fr-set__note', 'data-fr': 'online-error', role: 'alert' }, online.note));
+  return section('online', P.online, kids);
+}
+
 function themeSection() {
   return section('theme', P.theme, [tabs({
     variant: 'segmented', role: 'radiogroup', ariaLabel: P.theme, value: state.theme,
@@ -182,7 +234,7 @@ function signature(scope) {
   const addKeys = addOpen ? Object.keys(state).filter((k) => /^add[A-Z]/.test(k)).sort().map((k) => [k, state[k]]) : null;
   let add = '';
   try { add = JSON.stringify(addKeys); } catch { add = String(Date.now()); }
-  return JSON.stringify([repoTuples(), activeProduct(), scope, state.theme, sessionDefaults(), ws, consentByWs.get(ws) || null, addOpen, !!addMod]) + add;
+  return JSON.stringify([repoTuples(), activeProduct(), scope, state.theme, sessionDefaults(), ws, consentByWs.get(ws) || null, addOpen, !!addMod, online.data, online.error, online.note]) + add;
 }
 
 /** True while the PM is typing in the page or a menu of it is open: a rebuild then would take the focus away. */
@@ -208,6 +260,7 @@ export function mountDestination(host, ctx) {
     profilesSection(),
     sessionsSection(),
     validateSection(scope),
+    onlineSection(),
     themeSection(),
   ]);
 }

package/workspace/public/pm/frame-copy.js

@@ -150,6 +150,25 @@ export const COPY = {
     theme: 'Theme',
     dark: 'Dark',
     light: 'Light',
+    online: 'Online',
+    onlineIntro: 'Reach this workspace from your phone at your own address. The workspace runs the Cloudflare tunnel, and you sign in with Cloudflare Access (Google or an email code). Only this computer can change it.',
+    onlineHost: 'Public address',
+    onlineTunnel: 'Tunnel name',
+    onlineTeam: 'Cloudflare team domain',
+    onlineAudience: 'Access audience (AUD) tag',
+    onlineEmail: 'Email allowed in',
+    onlineOn: (host) => `Online at https://${host}/`,
+    onlineOff: 'Offline. Only this computer can reach the workspace.',
+    onlineRunning: 'The tunnel is running.',
+    onlineStarting: 'The tunnel is starting.',
+    onlineExited: (code) => `The tunnel stopped${code == null ? '' : ` (exit code ${code})`}. It starts again in a few seconds. Its log is online-tunnel.log in the workspace state folder.`,
+    onlineKeysWait: 'Cloudflare\'s sign-in keys are not loaded yet. Sign-ins are refused until they are.',
+    onlineKeysError: (e) => `Cloudflare\'s sign-in keys did not load (${e}). Check the team domain. Sign-ins are refused until they load.`,
+    onlineNeedFields: 'Fill in all five fields to turn Online on.',
+    onlineNoCloudflared: 'cloudflared is not installed. Install it (brew install cloudflared), then turn Online on.',
+    onlineEnv: (host) => `Online at https://${host}/, set by PMOS_PUBLIC_HOST when the workspace started. It signs in with the token. Restart the workspace without PMOS_PUBLIC_HOST to use this switch.`,
+    onlineRemote: 'Only the computer that runs the workspace can change this.',
+    onlineUnread: 'The Online settings did not load.',
   },
 };
 

package/workspace/replaced-tests.json

@@ -69,6 +69,17 @@
       "names": [
         "(a) calibration: the audit on specimen A gives exactly Today 17, Initiatives 24, Board 33, Reports 14 outside the dock"
       ]
+    },
+    {
+      "id": "SOM-D89",
+      "file": "workspace/no-network.test.js",
+      "run": "workspace-online-mode",
+      "ref": "D89 (ratified by PM wawan on a decision card, 2026-10-06) and planning/prd/workspace-online-mode-prd.md O5",
+      "reason": "D89 adds a second named HTTP client, lib/access-keys.js (a GET of the PM's Cloudflare Access team's public key set while Online is on). The two assertions that named lib/typesafe.js as the only client now name both sanctioned modules; three new assertions pin the new module to cloudflareaccess.com, GET only, and its two requirers. The D79 assertions are unchanged.",
+      "names": [
+        "no-network: the server process opens no HTTP client outside the one TypeSafe module (D79)",
+        "no-network: lib/typesafe.js is the ONLY file that opens an HTTP client"
+      ]
     }
   ],
   "entries": [

package/workspace/server.js

@@ -288,6 +288,64 @@ const layoutModel = require('./lib/layout');           // the arrangement model
 // REFUSED (BIND.refused) so the server exits — there is no code path to a public interface.
 const BIND = remoteAccess.resolveBinds({ env: process.env });
 const TOKEN = BIND.token || null;                     // non-loopback peers must present it; never logged (D08)
+// workspace-online-mode (D89): the Online switch. Its record lives in the per-user state folder; while it is on, the
+// workspace runs the tunnel itself and admits the public hostname, and a request to that hostname passes on a verified
+// Cloudflare Access assertion for the PM's email instead of the token. An environment-set PMOS_PUBLIC_HOST wins and keeps
+// the token (PRD O7). ONLINE.keys is the team's public key set (lib/access-keys.js, the one D89 fetch), only while on.
+const onlineMode = require('./lib/online-mode');
+const accessJwt = require('./lib/access-jwt');
+const accessKeys = require('./lib/access-keys');
+const ONLINE = { settings: onlineMode.read(STATE), keys: null, keysTeam: null, fetchKeys: accessKeys.fetchCerts, find: onlineMode.findCloudflared };
+const tunnel = onlineMode.createTunnel({ stateDir: STATE, find: () => ONLINE.find() });
+/** The public hostname the guards admit right now: the environment's, else the Online switch's while it is on. */
+function publicHost() { return BIND.publicHost || (ONLINE.settings.on ? ONLINE.settings.host : null); }
+/** True when this request is addressed to the Online switch's hostname, so the Access assertion decides it (D89). */
+function viaOnlineHost(headers) {
+  return !BIND.publicHost && ONLINE.settings.on && remoteAccess.hostnameOf((headers || {}).host) === ONLINE.settings.host;
+}
+/** Bring the tunnel and the key store in line with the record. Called at start, and after every change of the record. */
+function applyOnline() {
+  const s = ONLINE.settings;
+  if (s.on && !BIND.publicHost) {
+    if (!ONLINE.keys || ONLINE.keysTeam !== s.team) {
+      ONLINE.keys = accessKeys.createStore({ teamDomain: s.team, fetch: (d) => ONLINE.fetchKeys(d) });
+      ONLINE.keysTeam = s.team;
+      ONLINE.keys.ensure().catch(() => {});
+    }
+    if (ONLINE.tunnelName && ONLINE.tunnelName !== s.tunnel) tunnel.stop();
+    ONLINE.tunnelName = s.tunnel;
+    tunnel.start(s.tunnel);
+  } else {
+    tunnel.stop();
+    ONLINE.tunnelName = null;
+    ONLINE.keys = null; ONLINE.keysTeam = null;
+  }
+}
+/** The D89 decision for one request: { ok: true } or { ok: false, reason }. The assertion is never logged (D08). */
+async function accessVerdict(headers) {
+  const s = ONLINE.settings; const store = ONLINE.keys;
+  if (!store) return { ok: false, reason: 'no keys' };
+  try { await store.ensure(); } catch { /* the store records its own error */ }
+  const token = (headers || {})['cf-access-jwt-assertion'];
+  const opts = { keyFor: store.keyFor, teamDomain: s.team, audience: s.audience, email: s.email, now: Math.floor(Date.now() / 1000) };
+  let v = accessJwt.verify(token, opts);
+  if (!v.ok && v.reason === 'unknown key' && v.kid && await store.refetchFor(v.kid)) v = accessJwt.verify(token, opts);
+  return v;
+}
+/** The Online record and state, as GET /api/online returns it. Nothing secret is in it: the fields are not credentials. */
+function onlineView(req) {
+  const s = ONLINE.settings;
+  return {
+    ok: true, on: s.on, host: s.host, tunnel: s.tunnel, team: s.team, audience: s.audience, email: s.email,
+    complete: onlineMode.complete(s), envHost: BIND.publicHost || null, cloudflared: !!ONLINE.find(),
+    running: tunnel.status(), keys: ONLINE.keys ? ONLINE.keys.status() : null,
+    canChange: onlineChangeAllowed(req),
+  };
+}
+/** PRD O3: only the desktop changes the switch — a loopback peer that came through no proxy. */
+function onlineChangeAllowed(req) {
+  return remoteAccess.isLoopbackAddr(req.socket && req.socket.remoteAddress) && !remoteAccess.isProxied(req.headers || {}, publicHost());
+}
 // Per-OS default shell. On Windows there is no `bash` — use ComSpec/PowerShell.
 function defaultShell() {
   if (process.platform === 'win32') return process.env.COMSPEC || 'powershell.exe';
@@ -7132,6 +7190,23 @@ async function handleRequest(req, res) {
   if (p === '/api/typesafe' && req.method === 'GET') {
     return json(res, { ok: true, key: tsSettings.status(STATE), host: tsClient.HOST });
   }
+  /* ── workspace-online-mode (D89): the Online switch. Any signed-in device may read it; only the desktop changes it (O3). ── */
+  if (p === '/api/online' && req.method === 'GET') return json(res, onlineView(req));
+  if (p === '/api/online' && req.method === 'POST') {
+    let body = {};
+    try { body = JSON.parse((await readBody(req)) || '{}'); }
+    catch { return json(res, { ok: false, error: 'invalid JSON body' }, 400); }
+    if (!onlineChangeAllowed(req)) return json(res, { ok: false, error: 'Online can only be changed on the computer that runs the workspace' }, 403);
+    const press = pmGuard.requirePagePress(req, body);
+    if (!press.ok) return json(res, { ok: false, error: press.error }, press.status || 403);
+    if (BIND.publicHost && body.on === true) return json(res, { ok: false, error: `PMOS_PUBLIC_HOST=${BIND.publicHost} was set when the workspace started, so it is already online that way. Restart it without PMOS_PUBLIC_HOST to use the switch.` }, 409);
+    if (body.on === true && !ONLINE.find()) return json(res, { ok: false, field: 'on', error: 'cloudflared is not installed. Install it (brew install cloudflared), then switch Online on again.' }, 409);
+    const out = onlineMode.save(STATE, body);
+    if (!out.ok) return json(res, { ok: false, field: out.field || null, error: out.error }, out.field ? 400 : 500);
+    ONLINE.settings = out.settings;
+    applyOnline();
+    return json(res, onlineView(req));
+  }
   if (p === '/api/typesafe/key' && (req.method === 'PUT' || req.method === 'DELETE')) {
     let body = {};
     if (req.method === 'PUT') {
@@ -7950,20 +8025,33 @@ function writeChangeContext(dir) {
 function httpGuard(req, res) {
   // Origin/Host allowlist FIRST (D64 A1): reject a cross-site / DNS-rebinding request before the
   // token exemption for loopback can be reached. Header values are never logged (D08).
-  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds, publicHost: BIND.publicHost })) {
+  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds, publicHost: publicHost() })) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ok: false, error: 'forbidden origin/host' }));
     return;
   }
   // workspace-public-host: a request to the public hostname must have passed Cloudflare Access. A tunnel
   // with no Access application in front fails here, before even the sign-in form can be reached.
-  if (!remoteAccess.edgeAllowed({ headers: req.headers, publicHost: BIND.publicHost })) {
+  if (!remoteAccess.edgeAllowed({ headers: req.headers, publicHost: publicHost() })) {
     res.writeHead(403, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ok: false, error: 'the public host is only reachable through Cloudflare Access' }));
     return;
   }
+  // workspace-online-mode (D89): on the Online switch's hostname the verified Access assertion is the whole check.
+  // It replaces the token, so neither the sign-in form nor the token cookie is reachable there.
+  if (viaOnlineHost(req.headers)) {
+    accessVerdict(req.headers).then((v) => {
+      if (v.ok) return handleRequest(req, res);
+      res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ ok: false, error: 'your Cloudflare sign-in could not be verified for this workspace' }));
+    }, () => {
+      res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ ok: false, error: 'your Cloudflare sign-in could not be verified for this workspace' }));
+    });
+    return;
+  }
   // The cookie is Secure when the browser reached us on the public host (HTTPS at the edge).
-  const secureCookie = !!BIND.publicHost && remoteAccess.isProxied(req.headers, BIND.publicHost);
+  const secureCookie = !!publicHost() && remoteAccess.isProxied(req.headers, publicHost());
   // Token may arrive as an Authorization header, a ?token= query param, or the seeded cookie. A
   // browser only carries the token on the FIRST navigation URL — it cannot attach a header/query to
   // sub-resource loads (CSS/JS) or the WS upgrade — so the documented "open http://…/?token=<t>"
@@ -7986,7 +8074,7 @@ function httpGuard(req, res) {
     });
     return;
   }
-  if (!remoteAccess.authorize({ remoteAddress: req.socket.remoteAddress, headers: req.headers, publicHost: BIND.publicHost,
+  if (!remoteAccess.authorize({ remoteAddress: req.socket.remoteAddress, headers: req.headers, publicHost: publicHost(),
       presentedToken: remoteAccess.presentedToken(req), expectedToken: TOKEN })) {
     // A phone's browser gets a page it can act on, not JSON. API calls, scripts and anything else
     // that is not a page load keep the JSON 401 they had.
@@ -8002,7 +8090,7 @@ function httpGuard(req, res) {
   // navigation, so the browser's subsequent sub-resource + WS-upgrade requests authenticate without it
   // in the URL. HttpOnly (JS never needs it) + SameSite=Strict + the D64 Origin/Host allowlist keep a
   // foreign site from riding it; no Secure flag because the tailnet speaks plain HTTP (WireGuard-encrypted).
-  if (!remoteAccess.isLoopbackAddr(req.socket.remoteAddress) || remoteAccess.isProxied(req.headers, BIND.publicHost)) {
+  if (!remoteAccess.isLoopbackAddr(req.socket.remoteAddress) || remoteAccess.isProxied(req.headers, publicHost())) {
     let qTok = null;
     try { qTok = new URL(req.url || '', 'http://localhost').searchParams.get('token'); } catch { /* ignore */ }
     if (qTok && remoteAccess.tokenMatches(qTok.trim(), TOKEN)) {
@@ -8028,20 +8116,31 @@ function handleUpgrade(req, socket, head) {
   // Same origin/host allowlist on the WS upgrade handshake (D64 A1): a cross-origin page must not be
   // able to open ws://127.0.0.1:<port> and spawn/type into a shell. Rejected BEFORE the socket is
   // accepted, and before loopback's token exemption applies. Header values never logged (D08).
-  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds, publicHost: BIND.publicHost })
-      || !remoteAccess.edgeAllowed({ headers: req.headers, publicHost: BIND.publicHost })) {
+  if (!remoteAccess.checkHostOrigin({ origin: req.headers.origin, host: req.headers.host, binds: BIND.binds, publicHost: publicHost() })
+      || !remoteAccess.edgeAllowed({ headers: req.headers, publicHost: publicHost() })) {
     socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
     socket.destroy();
     return;
   }
+  // workspace-online-mode (D89): the same verified-assertion rule as the HTTP guard, before the socket is accepted.
+  if (viaOnlineHost(req.headers)) {
+    accessVerdict(req.headers).then((v) => {
+      if (!v.ok) { socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); socket.destroy(); return; }
+      acceptUpgrade(req, socket, head);
+    }, () => { socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); socket.destroy(); });
+    return;
+  }
   // A browser WebSocket cannot set a header or a ?token= — it authenticates via the same-origin cookie
   // seeded on the page load. presentedToken() resolves header → query → subprotocol → cookie.
-  if (!remoteAccess.authorize({ remoteAddress: socket.remoteAddress, headers: req.headers, publicHost: BIND.publicHost,
+  if (!remoteAccess.authorize({ remoteAddress: socket.remoteAddress, headers: req.headers, publicHost: publicHost(),
       presentedToken: remoteAccess.presentedToken(req), expectedToken: TOKEN })) {
     socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
     socket.destroy();     // reject the upgrade; nothing about the request is logged (D08)
     return;
   }
+  acceptUpgrade(req, socket, head);
+}
+function acceptUpgrade(req, socket, head) {
   // R25 (bind): a session started with an initiative is bound to it, a PM-only act. Only a socket the page opened with
   // this launch's nonce (`?pmos-nonce=`) may bind; any other socket still spawns, unbound, and is told why.
   const bind = pmGuard.requirePmUpgrade(req, { act: 'bind' });
@@ -8184,6 +8283,7 @@ if (require.main === module) {
     if (shuttingDown) return; shuttingDown = true;
     for (const s of sessions.values()) if (s.pty) { try { persist(s); } catch {} }
     for (const l of listeners) { try { l.close(); } catch {} }
+    try { tunnel.stop(); } catch {}   // workspace-online-mode: the tunnel is this server's child and ends with it
     try { fs.unlinkSync(PID_FILE); } catch {}   // stop being discoverable the moment we stop serving
     process.exit(0);
   };
@@ -8216,12 +8316,15 @@ if (require.main === module) {
       // one started by `pmos` — otherwise the next `pmos` cannot see it and starts a second server.
       try { fs.mkdirSync(STATE, { recursive: true }); fs.writeFileSync(PID_FILE, String(process.pid)); } catch {}
       for (const line of remoteAccess.startupLines(BIND, PORT, { ansi: !!process.stdout.isTTY && !process.env.NO_COLOR })) console.log(line);
+      // workspace-online-mode: a workspace that stopped while Online was on comes back online (PRD O2)
+      applyOnline();
+      if (ONLINE.settings.on && !BIND.publicHost) console.log(`  online: https://${ONLINE.settings.host}/ (Cloudflare Access sign-in, tunnel ${ONLINE.settings.tunnel})`);
       // bring in what another machine pushed while this one was off (D70 as amended); never on the request path
       { const t = setTimeout(() => { autoSync.startup().catch(() => {}); }, 3000); if (t.unref) t.unref(); }
     });
   });
 }
-module.exports = { server, spawnSession, removeSession, renameSession, sessions, libraryTree, readTextDoc,
+module.exports = { server, online: { ONLINE, applyOnline, tunnel, publicHost }, spawnSession, removeSession, renameSession, sessions, libraryTree, readTextDoc,
   registerWorkspace, forgetWorkspace, workspaces, library, initiativeIndex, fsList,
   // R1 — exported so the suite can assert the CARRY-THROUGH: branchInfo separates an ordinary
   // non-repo folder from a real git fault, and the whole legibility defect was that distinction

package/workspace/test-lists/workspace-online-mode.json

@@ -0,0 +1,5 @@
+{
+  "_comment": "workspace-online-mode (D89): the Cloudflare Access assertion check, the key store's fetch rules, the Online record and tunnel process, and the guards and /api/online driven on server.js as a library. No request leaves the process.",
+  "modules": ["online-mode.test.js"],
+  "seconds": { "online-mode.test.js": 4 }
+}