create-pmos 0.60.0 → 0.60.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.60.0",
+  "version": "0.60.2",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@45d7d1e
+kernel-source: pmos@d57effd
 assembled: 2026-10-06
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-06T15:12:25Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T15:52:39Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-06T15:12:25Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T15:52:39Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-06T15:12:25Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T15:52:39Z"}
 status: stable
 ---
 

package/workspace/guide/layout.md

@@ -33,9 +33,11 @@ Settings holds settings only, in seven sections:
 - **Validate consent**: the consent of the current repository. Turn it on or off here. **Open Validate** opens the Validate page as a tab.
 - **Online**: puts this workspace at your own address, such as `pmos.pm-os.app`, through a Cloudflare tunnel. Enter the public address, the tunnel name, your Cloudflare team domain, the Access audience (AUD) tag and your email, then press **Turn on**. The workspace runs the tunnel and remembers the switch when it restarts. On your phone, open the address and sign in with Cloudflare Access (Google or an email code). The workspace does not ask for its token there. Only the computer that runs the workspace can change this section. A phone sees whether it is on. When a sign-in at the address is refused, this section names the check that failed, such as the email or the AUD tag. [REMOTE.md](../REMOTE.md) has the one-time Cloudflare steps.
 - **Theme**: Dark or Light.
-- **Updates**: the version of the workspace app and the version of the kit in the current repository. Press **Check for updates** to compare them with the latest published version of PMOS. This is the only time the workspace asks the internet for a version, and it asks only when you press. When a newer version is available, a button shows for each part that is older:
-  - **Update the kit** does what `npx create-pmos@latest --update` does in a terminal. It changes only the kit's own files under `pmos/` (skills, scripts, templates and guides). Your records in `state/`, `planning/` and `okf/product/` do not change. The last lines of the output show under the button. The changed files are under `pmos/`, which Sync treats as records, so Sync (or automatic sync) sends them with your other records. To read them first, look at `git diff pmos/` before you sync.
-  - **Update the workspace** does what `pmos upgrade` does in a terminal. It asks you first. The workspace stops, installs the new version and starts again, and the page reloads when the new version starts. Sessions keep running in tmux. Press it on the computer that runs the workspace. From a phone it is refused, because the phone cannot see the restart through. When the workspace runs from a PMOS checkout, update it with `git pull` instead.
+- **Updates**: the version of the workspace app and the version of the kit in the current repository. Press **Check for updates** to compare them with the latest published version of PMOS. This is the only time the workspace asks the internet for a version, and it asks only when you press. When a newer version is available, one button shows: **Update to** and the version. It updates every part that is older, in this order:
+  - **The kit** in the current repository, when it is older. This does what `npx create-pmos@latest --update` does in a terminal. It changes only the kit's own files under `pmos/` (skills, scripts, templates and guides). Your records in `state/`, `planning/` and `okf/product/` do not change. The last lines of the output show under the button. The changed files are under `pmos/`, which Sync treats as records, so Sync (or automatic sync) sends them with your other records. To read them first, look at `git diff pmos/` before you sync.
+  - **The workspace app**, when it is older. This does what `pmos upgrade` does in a terminal. The button asks you first. The workspace stops, installs the new version and starts again, and the page reloads when the new version starts. You do not need a terminal. Sessions keep running in tmux. It works on the computer that runs the workspace and at its Online address, because the page comes back there after the restart. It also works on a phone or public address that signs in with a token set in `PMOS_TOKEN`, which the workspace keeps. When the workspace made its own token at start, the token changes on the restart, so the page refuses and says where to press it. When the workspace runs from a PMOS checkout, update it with `git pull` instead.
+
+  A new screen or a renamed menu comes with the workspace app, not with the kit.
 
 Your work is never in Settings. It is in Agenda, Initiatives, Board and Reports.
 

package/workspace/lib/kit-update.js

@@ -6,7 +6,9 @@
  *   latest({ exec })                        → Promise<{ ok, version } | { ok:false, error }>   npm view create-pmos version
  *   compare(st, latestVersion)              → { appBehind, kitBehind }
  *   updateKit(root, { version, exec })      → Promise<{ ok, output, kit } | { ok:false, error, output }>
- *   upgradeApp(root, { version, logFile, spawn }) → { ok, log } | { ok:false, error }
+ *   upgradeApp(root, { version, logFile, spawn, env }) → { ok, log } | { ok:false, error }
+ *   updateEnv(env, nodePath)                → env with the folder of this node on PATH (added last when absent)
+ *   whereFrom({ desktop, onlineHost, tokenKept })  → { ok } | { ok:false, error }   may this page start the app update?
  *
  * The page does what the terminal does, and nothing more. Each action runs the command the README tells the PM to type:
  *   check        npm view create-pmos version
@@ -133,11 +135,36 @@ async function updateKit(root, { version, exec = cp.execFile } = {}) {
   return { ok: true, output, kit: readKit(root) };
 }
 
+/**
+ * May the page that pressed Update the workspace start it? The update stops this server and starts a new one with the
+ * same environment (create-pmos and the pmos launcher pass it on), so the page can come back when its way in survives:
+ *   desktop     a direct loopback request on the computer that runs the workspace
+ *   onlineHost  the Online address (D89): the switch is kept in the state folder and the Access sign-in is the edge's
+ *   tokenKept   a phone or public address signed in with a token set in PMOS_TOKEN: the new server keeps that token
+ * A token the server generated at start is new after the restart, so a page signed in with it cannot come back.
+ */
+function whereFrom({ desktop = false, onlineHost = false, tokenKept = false } = {}) {
+  if (desktop || onlineHost || tokenKept) return { ok: true };
+  return { ok: false, error: 'This page signed in with a token that changes when the workspace restarts, so it could not come back. Update the workspace on the computer it runs on, or at its Online address' };
+}
+
 /**
  * Start the app reinstall and return at once. The child is detached from this server, because create-pmos stops this
  * server before it reinstalls, and it starts the new one after. Its output goes to `logFile`.
  */
-function upgradeApp(root, { version, logFile, spawn = cp.spawn } = {}) {
+/**
+ * The environment of the app update. A server started by a login item or a desktop shortcut can have a PATH without
+ * the node that runs it, and then neither npx nor the pmos launcher is found. The folder of this node is added at the
+ * end, so a PATH that already finds them is not changed.
+ */
+function updateEnv(env = process.env, nodePath = process.execPath) {
+  const key = Object.keys(env).find((k) => k.toUpperCase() === 'PATH') || 'PATH';
+  const dir = path.dirname(String(nodePath));
+  const parts = String(env[key] || '').split(path.delimiter).filter(Boolean);
+  return parts.includes(dir) ? { ...env } : { ...env, [key]: [...parts, dir].join(path.delimiter) };
+}
+
+function upgradeApp(root, { version, logFile, spawn = cp.spawn, env = updateEnv() } = {}) {
   if (!validVersion(version)) return { ok: false, error: 'Check for updates first' };
   let fd;
   try {
@@ -147,8 +174,11 @@ function upgradeApp(root, { version, logFile, spawn = cp.spawn } = {}) {
   } catch (e) { return { ok: false, error: `Could not write the log file: ${e.message}` }; }
   try {
     const child = spawn(NPX, ['-y', `${PKG_NAME}@${version}`, 'workspace', '--reinstall', String(root)],
-      { cwd: String(root), detached: true, stdio: ['ignore', fd, fd], windowsHide: true, shell: IS_WIN });
-    if (child && typeof child.on === 'function') child.on('error', () => { /* reported in the log by npx, or the page times out */ });
+      { cwd: String(root), env, detached: true, stdio: ['ignore', fd, fd], windowsHide: true, shell: IS_WIN });
+    // A child that could not start writes nothing itself: say why in the log, which the page names when it gives up.
+    if (child && typeof child.on === 'function') {
+      child.on('error', (e) => { try { fs.appendFileSync(logFile, `The update could not start: ${e.message}\n`); } catch { /* the page times out */ } });
+    }
     if (child && typeof child.unref === 'function') child.unref();
     return { ok: true, log: logFile };
   } catch (e) {
@@ -158,4 +188,4 @@ function upgradeApp(root, { version, logFile, spawn = cp.spawn } = {}) {
   }
 }
 
-module.exports = { PKG_NAME, cmpVer, validVersion, readKit, fromCheckout, status, compare, latest, updateKit, upgradeApp };
+module.exports = { PKG_NAME, cmpVer, validVersion, readKit, fromCheckout, status, compare, latest, updateKit, updateEnv, upgradeApp, whereFrom };

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.60.0",
+  "version": "0.60.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.60.0",
+  "version": "0.60.2",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/dest-settings.js

@@ -9,9 +9,10 @@
  *   Online             the Online switch and its five settings (GET and POST /api/online; workspace-online-mode, D89)
  *   Theme              Dark or Light
  *   Updates            the workspace app's version and the current repository's kit version; Check for updates asks the
- *                      npm registry for the latest create-pmos (POST /api/kit/check, the PM's press only), and Update the
- *                      kit / Update the workspace run what `npx create-pmos@latest --update` and `pmos upgrade` run
- *                      (workspace-kit-update). The workspace update restarts the server, so the page waits and reloads.
+ *                      npm registry for the latest create-pmos (POST /api/kit/check, the PM's press only). One Update
+ *                      button runs what `npx create-pmos@latest --update` runs when the kit is behind, then what
+ *                      `pmos upgrade` runs when the app is behind (workspace-kit-update). The app update restarts the
+ *                      server, so the page waits and reloads on the new version.
  * The work itself (what needs you, initiatives, items, reports) is never here.
  *
  * The mount contract (registry.js): mountDestination(host, ctx) is called on every render with the same host. The page
@@ -259,13 +260,17 @@ async function checkUpdates(ws) {
   } else say({ phase: null, error: (j && j.error) || P.updateFailed });
 }
 
+/** Update the kit in this repository. Returns true when it finished. */
 async function updateKit(ws) {
   say({ phase: 'kit', message: '', error: '', output: '' });
   const j = await pmPost('/api/kit/update', { ws, version: upd.latest });
   if (j && j.ok !== false) {
     kitByWs.set(ws, { st: j, at: Date.now() });
     say({ phase: null, compare: { ...(upd.compare || {}), kitBehind: false }, message: P.updateKitDone((j.kit && j.kit.version) || upd.latest), output: j.output || '' });
-  } else say({ phase: null, error: (j && j.error) || P.updateFailed, output: (j && j.output) || '' });
+    return true;
+  }
+  say({ phase: null, error: (j && j.error) || P.updateFailed, output: (j && j.output) || '' });
+  return false;
 }
 
 const pause = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -284,9 +289,21 @@ async function waitForRestart(from, log) {
   say({ phase: null, error: P.updateAppLost(log) });
 }
 
+/**
+ * The one Update button: the kit first when it is behind, then the app when it is behind. The app update stops this
+ * server, installs the new version, starts it again, and this page reloads on it. A kit update alone changes no page.
+ */
+async function updateAll(ws, app, cmp) {
+  const appToo = !!cmp.appBehind && !app.fromCheckout;
+  if (appToo) {
+    const yes = await askConfirm({ title: P.updateAppTitle, body: P.updateAppBody(app.version || '?', upd.latest), confirmLabel: P.updateAll });
+    if (!yes) return;
+  }
+  if (cmp.kitBehind && !(await updateKit(ws))) return;
+  if (appToo) await updateApp(ws, app.version);
+}
+
 async function updateApp(ws, from) {
-  const yes = await askConfirm({ title: P.updateAppTitle, body: P.updateAppBody(from || '?', upd.latest), confirmLabel: P.updateApp });
-  if (!yes) return;
   say({ phase: 'app', message: P.updateAppBusy, error: '', output: '' });
   const j = await pmPost('/api/kit/upgrade-app', { ws, version: upd.latest });
   if (!j || j.ok === false) { say({ phase: null, message: '', error: (j && j.error) || P.updateFailed }); return; }
@@ -303,19 +320,18 @@ function updatesSection(scope) {
   const busy = !!upd.phase;
   const cmp = upd.compare || {};
   const kids = [];
-  const appLine = el('div', { class: 'fr-set__line' }, el('span', { 'data-fr': 'app-version' }, P.updatesApp(app.version)),
-    cmp.appBehind && !app.fromCheckout ? button({
-      label: P.updateApp, variant: 'primary', size: 'sm', disabled: busy, attrs: { 'data-fr': 'update-app' },
-      onClick: () => updateApp(ws, app.version),
-    }) : null);
-  kids.push(appLine);
+  const kitPresent = !!(kit && kit.present);
+  const canUpdate = (cmp.appBehind && !app.fromCheckout) || (cmp.kitBehind && kitPresent);
+  kids.push(el('div', { class: 'fr-set__line' }, el('span', { 'data-fr': 'app-version' }, P.updatesApp(app.version))));
   if (cmp.appBehind && app.fromCheckout) kids.push(el('p', { class: 'fr-set__note', 'data-fr': 'app-checkout' }, P.updatesCheckout));
   const kitText = scope === 'all' || !ws ? P.updatesNoRepo : !kit ? '' : kit.present ? P.updatesKit(kit.version) : P.updatesNoKit;
-  kids.push(el('div', { class: 'fr-set__line' }, el('span', { 'data-fr': 'kit-version' }, kitText),
-    cmp.kitBehind && kit && kit.present ? button({
-      label: P.updateKit, variant: 'primary', size: 'sm', disabled: busy, attrs: { 'data-fr': 'update-kit' },
-      onClick: () => updateKit(ws),
-    }) : null));
+  kids.push(el('div', { class: 'fr-set__line' }, el('span', { 'data-fr': 'kit-version' }, kitText)));
+  if (canUpdate) {
+    kids.push(el('div', { class: 'fr-set__line' }, button({
+      label: P.updateAllTo(upd.latest), variant: 'primary', size: 'sm', disabled: busy, attrs: { 'data-fr': 'update-all' },
+      onClick: () => updateAll(ws, app, { appBehind: !!cmp.appBehind, kitBehind: !!cmp.kitBehind && kitPresent }),
+    })));
+  }
   const line = upd.phase === 'check' ? P.updatesChecking : upd.phase === 'kit' ? P.updateKitBusy
     : upd.message ? upd.message : upd.latest ? (cmp.appBehind || cmp.kitBehind ? P.updatesLatest(upd.latest) : P.updatesCurrent(upd.latest)) : P.updatesNever;
   kids.push(el('p', { class: 'fr-set__note', role: 'status', 'aria-live': 'polite', 'data-fr': 'update-state' }, line));

package/workspace/public/pm/frame-copy.js

@@ -194,12 +194,12 @@ export const COPY = {
     updatesCurrent: (v) => 'Up to date. The latest published version is ' + v + '.',
     updatesCheckout: 'This workspace runs from a PMOS checkout. Update it with git pull.',
     updatesNote: 'Updating the kit changes only its own files (skills, scripts, templates and guides). Your records in state/, planning/ and okf/product/ do not change.',
-    updateKit: 'Update the kit',
     updateKitBusy: 'Updating the kit…',
     updateKitDone: (v) => 'The kit is now ' + v + '. The changed files are under pmos/, and Sync sends them with your other records.',
-    updateApp: 'Update the workspace',
+    updateAll: 'Update',
+    updateAllTo: (v) => 'Update to ' + v,
     updateAppTitle: 'Update the workspace?',
-    updateAppBody: (from, to) => 'The workspace stops, installs ' + to + ' in place of ' + from + ', and starts again. This takes about a minute. Sessions keep running in tmux.\n\nThis page reloads when the new version starts.',
+    updateAppBody: (from, to) => 'The workspace updates the kit in this repository when it is behind, then stops, installs ' + to + ' in place of ' + from + ', and starts again. This takes about a minute. Sessions keep running in tmux.\n\nThis page reloads when the new version starts. You do not need a terminal.',
     updateAppBusy: 'Updating the workspace. This page reloads when the new version starts.',
     updateAppSame: (v, log) => 'The workspace started again on ' + v + ', so the update did not finish. The update log is ' + log + '.',
     updateAppLost: (log) => 'The workspace did not come back on this address. Type pmos in a terminal to open it. The update log is ' + log + '.',

package/workspace/server.js

@@ -7017,11 +7017,14 @@ async function handleRequest(req, res) {
         return json(res, { ws: w.id, ...r, ...st() }, r.ok ? 200 : 502);
       } finally { kitBusy = null; }
     }
-    // The app update stops this server and starts a new one. It is refused from a phone: the new server starts on
-    // loopback only, so the phone that asked would lose the page. It is refused from a checkout, which git updates.
-    if (!remoteAccess.isLoopbackAddr(req.socket.remoteAddress) || remoteAccess.isProxied(req.headers, BIND.publicHost)) {
-      return json(res, { ok: false, error: 'Update the workspace from the computer it runs on' }, 403);
-    }
+    // The app update stops this server and starts a new one, so the page must be able to come back (kitUpdate.whereFrom).
+    // It is refused from a checkout, which git updates.
+    const where = kitUpdate.whereFrom({
+      desktop: remoteAccess.isLoopbackAddr(req.socket.remoteAddress) && !remoteAccess.isProxied(req.headers, publicHost()),
+      onlineHost: viaOnlineHost(req.headers),
+      tokenKept: !!TOKEN && !BIND.generated,
+    });
+    if (!where.ok) return json(res, { ok: false, error: where.error }, 403);
     if (st().app.fromCheckout) return json(res, { ok: false, error: 'This workspace runs from a PMOS checkout. Update it with git pull' }, 409);
     const r = kitUpdate.upgradeApp(w.root, { version: body.version, logFile: path.join(STATE, 'app-update.log') });
     if (!r.ok) return json(res, { ok: false, error: r.error }, 400);

package/workspace/test-files.json

@@ -87,6 +87,7 @@
     "pm-r26-test.js",
     "pm-doc-category-test.js",
     "pm-r27-test.js",
+    "pm-updates-test.js",
     "pm-r28-test.js",
     "pm-r29-today-test.js",
     "pm-r29-portfolio-test.js",
@@ -180,6 +181,7 @@
     "pm-r26-test.js": 9,
     "pm-doc-category-test.js": 4,
     "pm-r27-test.js": 26,
+    "pm-updates-test.js": 12,
     "pm-r28-test.js": 9,
     "pm-r29-today-test.js": 4,
     "pm-r29-portfolio-test.js": 3,