create-pmos 0.69.0 → 0.69.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.69.0",
+  "version": "0.69.1",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@b38c47a
+kernel-source: pmos@bbb66c2
 assembled: 2026-10-07
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-07T02:59:01Z"}
+generated: {by: process:create-pmos, at: "2026-10-07T03:27:10Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-07T02:59:01Z"}
+generated: {by: process:create-pmos, at: "2026-10-07T03:27:10Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-07T02:59:01Z"}
+generated: {by: process:create-pmos, at: "2026-10-07T03:27:10Z"}
 status: stable
 ---
 

package/workspace/guide/layout.md

@@ -36,7 +36,7 @@ Settings holds settings only, in eight sections:
 - **Theme**: Dark or Light.
 - **Updates**: the version of the workspace app and the version of the kit in the current repository. Press **Check for updates** to compare them with the latest published version of PMOS. This is the only time the workspace asks the internet for a version, and it asks only when you press. When a newer version is available, one button shows: **Update to** and the version. It updates every part that is older, in this order:
   - **The kit** in the current repository, when it is older. This does what `npx create-pmos@latest --update` does in a terminal. It changes only the kit's own files under `pmos/` (skills, scripts, templates and guides). Your records in `state/`, `planning/` and `okf/product/` do not change. The last lines of the output show under the button. The changed files are under `pmos/`, which Sync treats as records, so Sync (or automatic sync) sends them with your other records. To read them first, look at `git diff pmos/` before you sync.
-  - **The workspace app**, when it is older. This does what `pmos upgrade` does in a terminal. The button asks you first. The workspace stops, installs the new version and starts again, and the page reloads when the new version starts. You do not need a terminal. Sessions keep running in tmux. It works on the computer that runs the workspace and at its Online address, because the page comes back there after the restart. It also works on a phone or public address that signs in with a token set in `PMOS_TOKEN`, which the workspace keeps. When the workspace made its own token at start, the token changes on the restart, so the page refuses and says where to press it. When the workspace runs from a PMOS checkout, update it with `git pull` instead.
+  - **The workspace app**, when it is older. This does what `pmos upgrade` does in a terminal. The button asks you first. The workspace stops, installs the new version and starts again, and the page reloads when the new version starts. The reloaded page runs the new version's code: each start gives the page files a new address, so neither the browser nor the Online address's tunnel can keep the old ones. You do not need a terminal or a hard refresh. Sessions keep running in tmux. It works on the computer that runs the workspace and at its Online address, because the page comes back there after the restart. It also works on a phone or public address that signs in with a token set in `PMOS_TOKEN`, which the workspace keeps. When the workspace made its own token at start, the token changes on the restart, so the page refuses and says where to press it. When the workspace runs from a PMOS checkout, update it with `git pull` instead.
 
   A new screen or a renamed menu comes with the workspace app, not with the kit.
 

package/workspace/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.69.0",
+  "version": "0.69.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.69.0",
+  "version": "0.69.1",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/primitives.js

@@ -61,12 +61,13 @@ export const SEL = Object.freeze({
 
 /* ── stylesheet and layer ─────────────────────────────────────────────────────────────────────────────────────────── */
 
-/** Link /pm/components.css once. index.html is not edited: the sheet arrives with the first Breakdown. */
+/** Link components.css once, from this module's own folder, so it comes from the same build as the code. index.html is
+ * not edited: the sheet arrives with the first Breakdown. */
 export function ensureComponentsCss() {
   if (typeof document === 'undefined' || document.querySelector('link[data-pmc]')) return;
   const l = document.createElement('link');
   l.rel = 'stylesheet';
-  l.href = '/pm/components.css';
+  l.href = new URL('./components.css', import.meta.url).href;
   l.setAttribute('data-pmc', '');
   document.head.appendChild(l);
 }

package/workspace/public/pm/report-view.js

@@ -140,11 +140,11 @@ export async function copyMarkdown(md) {
   return done;
 }
 
-/** Link /pm/print.css once, for print only. */
+/** Link print.css once, for print only, from this module's own folder (the same build as the code). */
 export function ensurePrintCss() {
   if (typeof document === 'undefined' || document.querySelector('link[data-rp-print]')) return;
   const l = document.createElement('link');
-  l.rel = 'stylesheet'; l.href = '/pm/print.css'; l.media = 'print';
+  l.rel = 'stylesheet'; l.href = new URL('./print.css', import.meta.url).href; l.media = 'print';
   l.setAttribute('data-rp-print', '');
   document.head.appendChild(l);
 }

package/workspace/server.js

@@ -187,6 +187,17 @@ const PUB = path.join(__dirname, 'public');
 const PM_DIR = path.join(PUB, 'pm');   // the four-panel front end — served as a directory, guarded below
 const XROOT = path.join(__dirname, 'node_modules', '@xterm');
 const APP_VERSION = (() => { try { return require('./package.json').version || null; } catch { return null; } })();
+// THE BUILD PREFIX. index.html loads the page code from /b/<BUILD>/pm/ and /b/<BUILD>/lib/, and the route below strips the
+// prefix. Each launch has a new BUILD, so after an update or a restart every page file has a new address. `no-cache`
+// alone was not enough: a page opened through the Online address (a Cloudflare tunnel) kept running the previous
+// version's modules after Update, because a cache between the browser and this server answered the old address.
+const BUILD = String(APP_VERSION || 'dev').replace(/[^0-9A-Za-z.-]/g, '') + '-' + Date.now().toString(36);
+const BUILD_RE = /^\/b\/[0-9A-Za-z.-]{1,64}(\/(?:pm|lib)\/.*)$/;
+/** index.html with its /pm/ and /lib/ references moved under this launch's build prefix, and an import map that sends an
+ * absolute import('/pm/…') to the same address, so it gets the module instance the page already holds, not a second one. */
+const withBuild = (html) => html
+  .replace(/(["'])\/(pm|lib)\//g, (m, q, dir) => q + '/b/' + BUILD + '/' + dir + '/')
+  .replace('<meta charset="utf-8" />', '<meta charset="utf-8" />\n<script type="importmap">' + JSON.stringify({ imports: { '/pm/': '/b/' + BUILD + '/pm/' } }) + '</script>');
 // ── WHERE THE PM'S RUNTIME STATE LIVES (see lib/state-root.js for the whole argument). ─────────
 // It is NOT `workspace/state/` any more. That directory is inside the application directory the
 // test suite runs from, which put the PM's live sessions, workspace registry and authored skills
@@ -5293,17 +5304,20 @@ function json(res, obj, code = 200) {
 
 async function handleRequest(req, res) {
   const url = new URL(req.url, 'http://localhost');
-  const p = url.pathname;
+  // A page file under this or an earlier launch's build prefix is the same file without it (see BUILD above).
+  const built = BUILD_RE.exec(url.pathname);
+  const p = built ? built[1] : url.pathname;
 
   if (p === '/' || p === '/index.html') {
     // pm-os-absorb Run 2 (R25, X11): the per-launch nonce goes into the base meta line, nowhere else. no-store, so a
-    // restarted server never answers a press from a page that holds the previous launch's value.
+    // restarted server never answers a press from a page that holds the previous launch's value. The page code is
+    // referenced under this launch's build prefix.
     const n = pmGuard.launchNonce();
-    if (!n) return serveFile(res, path.join(PUB, 'index.html'), null, true);
     return fs.readFile(path.join(PUB, 'index.html'), 'utf8', (err, html) => {
       if (err) { res.writeHead(404); res.end('not found'); return; }
-      const out = html.replace('<meta name="' + pmGuard.NONCE_META + '" content="" />', '<meta name="' + pmGuard.NONCE_META + '" content="' + n + '" />');
-      res.writeHead(200, { 'Content-Type': TYPES['.html'], 'Cache-Control': 'no-store' });
+      let out = withBuild(html);
+      if (n) out = out.replace('<meta name="' + pmGuard.NONCE_META + '" content="" />', '<meta name="' + pmGuard.NONCE_META + '" content="' + n + '" />');
+      res.writeHead(200, { 'Content-Type': TYPES['.html'], 'Cache-Control': 'no-cache, no-store' });
       res.end(out);
     });
   }