create-pmos 0.99.0 → 0.101.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.99.0",
+  "version": "0.101.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@206cc37
+kernel-source: pmos@14f4c98
 assembled: 2026-10-08
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-08T00:18:17Z"}
+generated: {by: process:create-pmos, at: "2026-10-08T00:30:09Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-08T00:18:17Z"}
+generated: {by: process:create-pmos, at: "2026-10-08T00:30:09Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-08T00:18:17Z"}
+generated: {by: process:create-pmos, at: "2026-10-08T00:30:09Z"}
 status: stable
 ---
 

package/workspace/guide/layout.md

@@ -30,7 +30,7 @@ Each place is drawn when its run is built. Until then the place says which run b
 Settings holds settings only, in eight sections. On a wide screen they are cards in two columns, like Agenda: Repositories, New sessions, Profiles and Theme on the left, and Validate consent, People, Online and Updates on the right. On a narrow screen the cards stack in one column. Each switch (Validate consent, People, Online) turns on when you press it. **Check for updates** is at the top right of the page.
 
 - **Repositories**: every registered repository. Press a repository to make it the current one. Press its ⋯ for **Rename** or **Remove from PMOS**. Each asks in a sheet, and a remove asks you to confirm. **Add repository** shows the scan of a folder before you add it.
-- **Profiles**: the Claude profiles a session can start with. Press **New profile** to make one. This writes `~/.claude/profiles/<id>.json`. Account secrets are never shown in the browser.
+- **Profiles**: the Claude profiles a session can start with. These are the descriptors in `~/.claude/profiles`, and also the profiles you already run: a shell command that sets `CLAUDE_CONFIG_DIR` (for example `alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'`), a launcher script named `claude-*`, or a config folder such as `~/.claude-work`. A profile found this way says where it was found, and a session under it sets only `CLAUDE_CONFIG_DIR`. Press **New profile** to make one. This writes `~/.claude/profiles/<id>.json`. Account secrets are never shown in the browser.
 - **New sessions**: the default CLI, the default model, the default Claude profile and the default launch flags for a new session. The flags come from `claude --help`, for example `--chrome`. A flag that needs a value lists the values it accepts.
 - **Validate consent**: the consent of the current repository. Use its switch to turn it on or off. **Open Validate** opens the Validate page as a tab.
 - **People**: whether the morning brief keeps attendee names from the calendar for the current repository. It is off until you turn it on. Turning it off also hides the names recorded before.
@@ -39,7 +39,7 @@ Settings holds settings only, in eight sections. On a wide screen they are cards
 - **Updates**: the version of the workspace app and the version of the kit in the current repository. Press **Check for updates** at the top of the page to compare them with the latest published version of PMOS. This is the only time the workspace asks the internet for a version, and it asks only when you press. When a newer version is available, one button shows: **Update to** and the version. It updates every part that is older, in this order:
   - **The kit** in the current repository, when it is older. This does what `npx create-pmos@latest --update` does in a terminal. It changes only the kit's own files under `pmos/` (skills, scripts, templates and guides). Your records in `state/`, `planning/` and `okf/product/` do not change. The last lines of the output show under the button. The changed files are under `pmos/`, which Sync treats as records, so Sync (or automatic sync) sends them with your other records. To read them first, look at `git diff pmos/` before you sync.
   - **The workspace app**, when it is older. This does what `pmos upgrade` does in a terminal. The button asks you first. The workspace stops, installs the new version and starts again, and the page reloads when the new version starts. The reloaded page runs the new version's code: each start gives the page files a new address, so neither the browser nor the Online address's tunnel can keep the old ones. You do not need a terminal or a hard refresh. Sessions keep running in tmux. It works on the computer that runs the workspace and at its Online address, because the page comes back there after the restart. It also works on a phone or public address that signs in with a token set in `PMOS_TOKEN`, which the workspace keeps. When the workspace made its own token at start, the token changes on the restart, so the page refuses and says where to press it. When the workspace runs from a PMOS checkout, update it with `git pull` instead.
-  - **Testing an update before it is published.** Set `PMOS_UPDATE_SOURCE` to a built create-pmos package on the same computer: its folder, or the `.tgz` that `npm pack` makes. Then **Check for updates** reads that package's version and does not ask npm, and both updates install that package. The Updates card names the package it checks. A checkout may update the app this way. When the path is wrong, the card says why and does not fall back to npm. Unset the variable, or set it to `npm`, to use the registry again.
+  - **Testing an update before it is published.** In a PMOS checkout, run `bash scripts/build-local-package.sh`. It builds the package that a publish would build, in `~/.pmos-local-package`, with a version newer than the published one, and prints the command that starts the workspace on it. That command sets `PMOS_UPDATE_SOURCE` to the package on the same computer: its folder, or the `.tgz` that `npm pack` makes. Then **Check for updates** reads that package's version and does not ask npm, and both updates install that package. The Updates card names the package it checks. A checkout may update the app this way. When the path is wrong, the card says why and does not fall back to npm. Unset the variable, or set it to `npm`, to use the registry again.
 
   A new screen or a renamed menu comes with the workspace app, not with the kit.
 

package/workspace/guide/today.md

@@ -100,6 +100,8 @@ When the job is a reply or a review, you can finish it in the card. Write your a
 
 A meeting that needs prep is a row of **Needs you**, with the verb **Prepare**. Its detail shows the prep, how many steps are ready, the free time before the meeting, and the steps before it. A step that reads a source shows what the source says under it. A step that asks for your view, such as **Write your recommendation**, has a box for your note. The note is saved when you leave the box. It stays with the meeting on this computer and is not sent. A step that the brief already marked done stays checked.
 
+When a meeting ends, its detail stays as it was. A line at the top says **ended** and the time it ended. The prep and the steps stay, in a quieter box, so you can still read what you prepared. The meeting leaves **Needs you**, and its notes show under it.
+
 When you finish or put off a job or a meeting, mark it:
 
 | Press | What it does |

package/workspace/lib/kit-update.js

@@ -17,7 +17,7 @@
  *   app          npx -y create-pmos@<version> workspace --reinstall <repo> (what `pmos upgrade` runs)
  * LOCAL SOURCE. PMOS_UPDATE_SOURCE names a built create-pmos package on this computer: its folder (with package.json, bin/
  * and payload/ or workspace/) or its .tgz from `npm pack`. The check then reads that package's version instead of asking
- * the registry, and the update runs `npx -y <that path> ...` in place of `npx -y create-pmos@<version> ...`. Nothing
+ * the registry, and the update runs `npx -y --package=<that path> -- create-pmos ...` in place of `npx -y create-pmos@<version> ...`. Nothing
  * reaches the network, so an update can be tried before it is published. Unset means npm (the default).
  * The version is the one the check found, so what is installed is what the PM was shown, not whatever `latest` is a
  * minute later. The app upgrade stops this server (create-pmos runs `pmos stop`), so it runs DETACHED, writes its output
@@ -108,8 +108,13 @@ function source(env = process.env) {
   return { kind: 'local', path: p, version: m[1] };
 }
 
-/** What npx installs: the registry package at a version, or the local path. */
-const specOf = (src, version) => (src && src.kind === 'local' ? src.path : `${PKG_NAME}@${version}`);
+/**
+ * The npx arguments that run create-pmos: the registry package at a version, or the local path. A bare path is not
+ * enough: npx would try to run it as a command, so a local package goes in with --package.
+ */
+const npxArgs = (src, version, rest) => (src && src.kind === 'local'
+  ? ['-y', `--package=${src.path}`, '--', PKG_NAME, ...rest]
+  : ['-y', `${PKG_NAME}@${version}`, ...rest]);
 
 function status({ root, appVersion, appDir, env }) {
   const src = source(env);
@@ -175,7 +180,7 @@ async function updateKit(root, { version, exec = cp.execFile, source: src = sour
   if (!validVersion(version)) return { ok: false, error: 'Check for updates first' };
   if (src.kind === 'local' && src.error) return { ok: false, error: src.error };
   if (!readKit(root).present) return { ok: false, error: 'This repository has no PMOS kit folder (pmos/KIT-VERSION)' };
-  const r = await run(exec, NPX, ['-y', specOf(src, version), '--update', String(root)], { timeout: UPDATE_TIMEOUT_MS, cwd: String(root) });
+  const r = await run(exec, NPX, npxArgs(src, version, ['--update', String(root)]), { timeout: UPDATE_TIMEOUT_MS, cwd: String(root) });
   const output = tail(r.stdout + (r.stderr ? '\n' + r.stderr : ''));
   if (r.err && notServedYet(r.stdout + r.stderr, version)) return { ok: false, error: notServedYetError(version), output };
   const bad = why(r, 'The kit update');
@@ -221,7 +226,7 @@ function upgradeApp(root, { version, logFile, spawn = cp.spawn, env = updateEnv(
     fd = fs.openSync(logFile, 'w');
     fs.writeSync(fd, `${new Date().toISOString()} clearing npm cache…\n`);
     fs.writeSync(fd, `${new Date().toISOString()} ${NPM} cache clean --force\n`);
-    fs.writeSync(fd, `${new Date().toISOString()} ${NPX} -y ${specOf(src, version)} workspace --reinstall ${root}\n`);
+    fs.writeSync(fd, `${new Date().toISOString()} ${NPX} ${npxArgs(src, version, ['workspace', '--reinstall', String(root)]).join(' ')}\n`);
   } catch (e) { return { ok: false, error: `Could not write the log file: ${e.message}` }; }
   try {
     // Clear npm cache synchronously before spawning the update, so npx downloads the fresh version
@@ -230,7 +235,7 @@ function upgradeApp(root, { version, logFile, spawn = cp.spawn, env = updateEnv(
     try { fs.appendFileSync(logFile, `Note: cache clear had an issue, but continuing: ${e.message}\n`); } catch { /* silent */ }
   }
   try {
-    const child = spawn(NPX, ['-y', specOf(src, version), 'workspace', '--reinstall', String(root)],
+    const child = spawn(NPX, npxArgs(src, version, ['workspace', '--reinstall', String(root)]),
       { cwd: String(root), env, detached: true, stdio: ['ignore', fd, fd], windowsHide: true, shell: IS_WIN });
     // A child that could not start writes nothing itself: say why in the log, which the page names when it gives up.
     if (child && typeof child.on === 'function') {
@@ -245,4 +250,4 @@ function upgradeApp(root, { version, logFile, spawn = cp.spawn, env = updateEnv(
   }
 }
 
-module.exports = { PKG_NAME, cmpVer, notServedYet, validVersion, source, specOf, readKit, fromCheckout, status, compare, latest, updateKit, updateEnv, upgradeApp, whereFrom };
+module.exports = { PKG_NAME, cmpVer, notServedYet, validVersion, source, npxArgs, readKit, fromCheckout, status, compare, latest, updateKit, updateEnv, upgradeApp, whereFrom };

package/workspace/lib/profile-discovery.js

@@ -0,0 +1,194 @@
+'use strict';
+/*
+ * Detected Claude profiles — a PURE reader (initiative `workspace-profile-detection`).
+ *
+ * Most people who run Claude Code under more than one account do not keep a PMOS descriptor. They keep a second
+ * CONFIG DIRECTORY and a command that points Claude at it:
+ *
+ *     alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'
+ *
+ * `CLAUDE_CONFIG_DIR` is how Claude Code picks where its settings, credentials and history live, so one directory is
+ * one profile. PMOS can start a session under such a profile with the same environment overlay a descriptor gives:
+ * the one variable `CLAUDE_CONFIG_DIR`. This module finds them. It reads three places under the home directory and
+ * writes nothing, runs nothing and never opens a credential file:
+ *
+ *   1. shell start-up files and fish functions — an `alias`, a function or a one-line command that sets
+ *      `CLAUDE_CONFIG_DIR` and runs `claude`. The alias name is the profile id.
+ *   2. launcher scripts named `claude-*` in the usual bin directories that set `CLAUDE_CONFIG_DIR`.
+ *   3. config directories that look like Claude's own — `~/.claude-<name>`, `~/.claude_<name>`,
+ *      `~/.config/claude-<name>` — recognised by a file or folder only Claude writes there. The id is
+ *      `claude-<name>`.
+ *
+ * Every result names WHERE it was found (`source`), because a detected profile is a guess from files PMOS did not
+ * write, and the surface must say so. The overlay is exactly `{ CLAUDE_CONFIG_DIR: <absolute path> }`: any other
+ * variable an alias sets (a key, a proxy) is left alone, and the surface says only one variable is applied.
+ *
+ * A descriptor under `~/.claude/profiles` always wins over a detected profile of the same id (see profiles.js).
+ */
+const fs = require('fs');
+const path = require('path');
+
+const ID_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+/** Something only Claude Code writes into its config directory. A folder with none of these is not offered. */
+const CONFIG_MARKERS = ['settings.json', '.claude.json', '.credentials.json', 'projects', 'CLAUDE.md', 'commands', 'agents', 'todos', 'statsig', 'shell-snapshots'];
+const RC_FILES = ['.zshrc', '.zprofile', '.zshenv', '.zlogin', '.bashrc', '.bash_profile', '.bash_login', '.profile', '.aliases', '.bash_aliases', '.config/fish/config.fish'];
+const FISH_FUNCTIONS = '.config/fish/functions';
+const BIN_DIRS = ['.local/bin', 'bin', '.bin', '.config/claude/bin'];
+const MAX_TEXT = 256 * 1024;       // a start-up file larger than this is not read
+const MAX_SCRIPT = 16 * 1024;      // a launcher script larger than this is a binary or something else
+
+const safeRead = (file, max) => {
+  try {
+    const st = fs.statSync(file);
+    if (!st.isFile() || st.size > max) return null;
+    return fs.readFileSync(file, 'utf8');
+  } catch { return null; }
+};
+const isDir = (p) => { try { return fs.statSync(p).isDirectory(); } catch { return false; } };
+
+/** `~`, `$HOME` and `${HOME}` at the start of a path, resolved against `home`; quotes removed. null when the value is
+ *  not a plain path (it holds another variable, a command substitution or a glob). */
+function resolveDir(raw, home) {
+  let v = String(raw || '').trim().replace(/^["']|["']$/g, '');
+  if (!v) return null;
+  v = v.replace(/^\$\{?HOME\}?(?=\/|$)/, home).replace(/^~(?=\/|$)/, home);
+  if (/[$`*?]|\$\(/.test(v)) return null;
+  if (!path.isAbsolute(v)) return null;
+  return path.normalize(v).replace(/\/+$/, '') || null;
+}
+
+/** The value after `CLAUDE_CONFIG_DIR=` in one line of shell: quoted or bare. */
+function configDirOf(line, home) {
+  const m = /CLAUDE_CONFIG_DIR=(?:"([^"]*)"|'([^']*)'|([^\s;'"`)}]+))/.exec(line);
+  if (!m) return null;
+  return resolveDir(m[1] != null ? m[1] : m[2] != null ? m[2] : m[3], home);
+}
+
+/** `claude` run as a command: after the assignment, as a word of its own (not part of the alias name `claude-work`). */
+const runsClaude = (s) => /(^|[\s;&|(])(?:command\s+|exec\s+|env\s+)?(?:\S*\/)?claude(?=[\s;&|)'"}]|$)/.test(s);
+
+/** Names defined on one line of a shell start-up file: `alias n=…`, `n() { … }`, `function n …`, fish `alias n '…'`. */
+function definedNames(line) {
+  let m = /^\s*alias\s+(?:-\w+\s+)?([A-Za-z0-9._-]+)(?:=|\s)/.exec(line);
+  if (m) return m[1];
+  m = /^\s*(?:function\s+)?([A-Za-z0-9._-]+)\s*\(\s*\)\s*\{/.exec(line);
+  if (m) return m[1];
+  m = /^\s*function\s+([A-Za-z0-9._-]+)/.exec(line);
+  return m ? m[1] : null;
+}
+
+/** Profiles named in the text of one start-up file. `file` and the line number are kept as provenance. */
+function fromShellText(text, file, home) {
+  const out = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line.includes('CLAUDE_CONFIG_DIR') || /^\s*#/.test(line)) continue;
+    if (/^\s*(?:export|set\s+-\w*x|declare|typeset)\b/.test(line)) continue;   // a plain export names no command
+    let name = definedNames(line);
+    let tail = [line];
+    // a function written over several lines: the name is on an earlier line, the command on this one or the next two
+    if (!name) {
+      for (let j = i - 1; j >= 0 && j >= i - 4 && !name; j--) {
+        if (/^\s*(?:\}|end\b)/.test(lines[j])) break;
+        if ((/\{\s*$/.test(lines[j]) || /^\s*function\s/.test(lines[j])) && definedNames(lines[j])) name = definedNames(lines[j]);
+      }
+      tail = lines.slice(i, i + 3).filter((l) => !/^\s*#/.test(l));
+    }
+    const dir = configDirOf(line, home);
+    const assign = line.indexOf('CLAUDE_CONFIG_DIR=');
+    const first = (assign < 0 ? line : line.slice(assign + 'CLAUDE_CONFIG_DIR='.length)).replace(/^(?:"[^"]*"|'[^']*'|[^\s;'"`)}]+)/, '');
+    const after = [first, ...tail.slice(1)].join('\n');
+    if (!name || !dir || !runsClaude(after)) continue;
+    out.push({ id: name, dir, source: 'shell', from: file, line: i + 1 });
+  }
+  return out;
+}
+
+/** Launcher scripts: `claude-work` on PATH whose text sets CLAUDE_CONFIG_DIR. */
+function fromLauncher(file, home) {
+  const text = safeRead(file, MAX_SCRIPT);
+  if (!text || text.includes('\0') || !text.includes('CLAUDE_CONFIG_DIR')) return null;
+  for (const line of text.split(/\r?\n/)) {
+    if (/^\s*#/.test(line)) continue;
+    const dir = configDirOf(line, home);
+    if (dir) return { id: path.basename(file), dir, source: 'launcher', from: file, line: null };
+  }
+  return null;
+}
+
+function looksLikeConfigDir(dir) {
+  return CONFIG_MARKERS.some((m) => { try { fs.accessSync(path.join(dir, m)); return true; } catch { return false; } });
+}
+
+/** `~/.claude-work`, `~/.claude_work`, `~/.config/claude-work` → `claude-work`. */
+function fromConfigDirs(home) {
+  const out = [];
+  const scan = (parent, re) => {
+    let names = [];
+    try { names = fs.readdirSync(parent); } catch { return; }
+    for (const n of names.slice().sort()) {
+      const m = re.exec(n);
+      if (!m) continue;
+      const dir = path.join(parent, n);
+      if (!isDir(dir) || !looksLikeConfigDir(dir)) continue;
+      out.push({ id: ('claude-' + m[1]).toLowerCase(), dir, source: 'config-dir', from: dir, line: null });
+    }
+  };
+  scan(home, /^\.claude[-_.]([A-Za-z0-9][A-Za-z0-9._-]*)$/);
+  scan(path.join(home, '.config'), /^claude[-_]([A-Za-z0-9][A-Za-z0-9._-]*)$/);
+  return out;
+}
+
+/**
+ * detectProfiles(homeDir) → [{ id, label, account:null, mcp:[], env:{CLAUDE_CONFIG_DIR}, path, detected:{source, from, line} }]
+ * Sorted by id. When one id turns up in several places the shell definition wins over a launcher, a launcher over a bare
+ * directory: the command is what the PM types, so its directory is the one that is meant. A profile whose directory does
+ * not exist is dropped (the command would start Claude on an empty home, which is a new login, not a profile).
+ */
+function detectProfiles(homeDir) {
+  if (typeof homeDir !== 'string' || !homeDir) return [];
+  const found = [];
+
+  for (const rel of RC_FILES) {
+    const file = path.join(homeDir, rel);
+    const text = safeRead(file, MAX_TEXT);
+    if (text) found.push(...fromShellText(text, file, homeDir));
+  }
+  const fishDir = path.join(homeDir, FISH_FUNCTIONS);
+  try {
+    for (const n of fs.readdirSync(fishDir).sort()) {
+      if (!n.endsWith('.fish')) continue;
+      const file = path.join(fishDir, n);
+      const text = safeRead(file, MAX_SCRIPT);
+      if (!text || !text.includes('CLAUDE_CONFIG_DIR')) continue;
+      const dir = configDirOf(text, homeDir);
+      if (dir) found.push({ id: n.slice(0, -5), dir, source: 'shell', from: file, line: null });
+    }
+  } catch { /* no fish functions */ }
+  for (const rel of BIN_DIRS) {
+    const bin = path.join(homeDir, rel);
+    let names = [];
+    try { names = fs.readdirSync(bin); } catch { continue; }
+    for (const n of names.slice().sort()) {
+      if (!/^claude[-_.]/.test(n)) continue;
+      const hit = fromLauncher(path.join(bin, n), homeDir);
+      if (hit) found.push(hit);
+    }
+  }
+  found.push(...fromConfigDirs(homeDir));
+
+  const rank = { shell: 0, launcher: 1, 'config-dir': 2 };
+  const byId = new Map();
+  for (const f of found) {
+    if (!ID_RE.test(f.id) || f.id === 'claude' || !isDir(f.dir)) continue;
+    const cur = byId.get(f.id);
+    if (!cur || rank[f.source] < rank[cur.source]) byId.set(f.id, f);
+  }
+  return [...byId.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0)).map((f) => ({
+    id: f.id, label: f.id, account: null, mcp: [], env: { CLAUDE_CONFIG_DIR: f.dir },
+    path: f.from, detected: { source: f.source, from: f.from, line: f.line },
+  }));
+}
+
+module.exports = { detectProfiles, resolveDir, configDirOf, fromShellText, ID_RE };

package/workspace/lib/profiles.js

@@ -151,7 +151,7 @@ function validate(raw, stem) {
  * with no home directory gets a stated failure; guessing one would be the same class of invention
  * this whole module refuses.
  */
-function readProfiles(homeDir) {
+function readDescriptors(homeDir) {
   if (typeof homeDir !== 'string' || !homeDir) {
     return {
       ok: false, absent: false, dir: null, profiles: [], broken: [],
@@ -212,6 +212,23 @@ function readProfiles(homeDir) {
   return { ok: true, absent: false, dir, profiles, broken, error: null };
 }
 
+/*
+ * readProfiles(homeDir, { detect }) — the descriptors above, and with `detect: true` also the profiles PMOS can SEE but
+ * the PM never wrote down: a config directory plus the command that points Claude at it (lib/profile-discovery.js).
+ * A detected profile carries `detected: { source, from, line }` so every surface can say where it came from. A descriptor
+ * of the same id always wins, and the four-way discrimination above is about the descriptor directory only: `absent`
+ * stays true when that directory is missing even though detected profiles are listed.
+ */
+function readProfiles(homeDir, opts) {
+  const read = readDescriptors(homeDir);
+  if (!opts || !opts.detect || typeof homeDir !== 'string' || !homeDir) return read;
+  let found = [];
+  try { found = require('./profile-discovery').detectProfiles(homeDir); } catch { found = []; }
+  const taken = new Set([...read.profiles.map((p) => p.id), ...read.broken.map((b) => b.file.replace(/\.json$/, ''))]);
+  const extra = found.filter((p) => !taken.has(p.id));
+  return extra.length ? { ...read, profiles: [...read.profiles, ...extra] } : read;
+}
+
 /*
  * The one line naming what a pane is running under — PRD R6, verbatim sentences.
  *

package/workspace/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pmos-workspace",
-  "version": "0.99.0",
+  "version": "0.101.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pmos-workspace",
-      "version": "0.99.0",
+      "version": "0.101.0",
       "license": "MIT",
       "dependencies": {
         "@xterm/addon-fit": "^0.11.0",

package/workspace/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmos-workspace",
-  "version": "0.99.0",
+  "version": "0.101.0",
   "private": true,
   "description": "PMOS Terminal Workspace — local companion hosting real PTYs beside the library and gates (D62)",
   "license": "MIT",

package/workspace/public/pm/components.css

@@ -3583,6 +3583,9 @@
 .td-day__mark[data-day-mark-state="done"] { border-color: var(--foreground); }
 .td-day__ready { display: flex; flex-wrap: wrap; align-items: center; gap: 6px 12px; font-size: 12px; }
 .td-day__prep { display: grid; gap: 8px; padding: 10px 12px; border: 1px solid var(--border); background: var(--background); }
+.td-day__ended { margin: 0; padding: 8px 12px; border-left: 2px solid var(--foreground); background: var(--muted); font-size: 14px; }
+/* an ended meeting keeps its prep, quieter: the steps stay readable, the past is not a call to act */
+.td-day__detail:has(.td-day__ended) .td-day__prep { background: var(--muted); }
 .td-day__fold { border-top: 1px solid var(--border); padding-top: 6px; }
 .td-day__fold > summary { cursor: pointer; font-size: 12px; color: var(--muted-foreground); }
 .td-day__fold[open] > summary { margin-bottom: 6px; }

package/workspace/public/pm/dest-settings.js

@@ -189,7 +189,7 @@ function profilesSection() {
   if (sess.msg) kids.push(el('p', { class: 'fr-set__note', role: 'status', 'data-fr': 'profiles-msg' }, sess.msg));
   kids.push(el('p', { class: 'fr-set__note', 'data-fr': 'profiles-found' }, !sess.profiles ? P.profilesReading
     : sess.profiles.ok === false ? P.profilesUnread(sess.profiles.error)
-      : found.length ? P.profilesFound(found.map((x) => x.id)) : P.profilesNone(sess.profiles.dir)));
+      : found.length ? P.profilesFound(found.map((x) => x.id), found.filter((x) => x.detected).map((x) => x.id)) : P.profilesNone(sess.profiles.dir)));
   const add = button({ label: P.profileNew, variant: 'outline', size: 'sm', icon: 'plus', attrs: { 'data-fr': 'profile-new', 'aria-expanded': sess.formOpen ? 'true' : 'false' },
     onClick: () => { sess.formOpen = !sess.formOpen; sess.msg = ''; setState({}); } });
   return section('profiles', P.profiles, kids, add, 'bot');

package/workspace/public/pm/frame-copy.js

@@ -176,7 +176,7 @@ export const COPY = {
     profileNew: 'New profile',
     profilesReading: 'Reading ~/.claude/profiles…',
     profilesUnread: (e) => 'The profiles could not be read — ' + (e || 'no reason given'),
-    profilesFound: (ids) => 'Found ' + ids.length + ': ' + ids.join(', ') + '.',
+    profilesFound: (ids, seen) => 'Found ' + ids.length + ': ' + ids.join(', ') + '.' + (seen && seen.length ? ' ' + seen.join(', ') + (seen.length === 1 ? ' was' : ' were') + ' detected from your shell commands or config folders; a session under ' + (seen.length === 1 ? 'it' : 'one') + ' sets only CLAUDE_CONFIG_DIR.' : ''),
     profilesNone: (dir) => 'No profile in ' + (dir || '~/.claude/profiles') + ' yet.',
     pfId: 'Id (the file name)', pfLabel: 'Label', pfAccount: 'Account, shown as written and not checked', pfMcp: 'MCP server names, declared only',
     pfEnvHead: 'Environment variables applied to the session',

package/workspace/public/pm/panel-newsess.js

@@ -503,12 +503,18 @@ function profileSection() {
         : 'no default is set — new ' + agent + ' sessions start with no profile'))));
   }
 
-  if (p.absent) {
+  if (p.absent && !good.length) {
     out.push(el('div', { style: SUB }, iv('no profile directory at ' + (p.dir || '?')
       + ' — nothing was read, so nothing is offered but “no profile”')));
   } else if (!good.length && !broken.length) {
     out.push(el('div', { style: SUB }, iv((p.dir || 'the profile directory') + ' was read and holds no descriptors')));
   }
+  const seen = good.filter((x) => x && x.detected);
+  if (seen.length) {
+    out.push(el('div', { class: 'fr-fp-sub', 'data-profile': 'detected' }, iv(seen.map((x) => x.id).join(', ')
+      + (seen.length === 1 ? ' was' : ' were') + ' found from your shell commands or config folders — a session under '
+      + (seen.length === 1 ? 'it' : 'one') + ' sets only CLAUDE_CONFIG_DIR')));
+  }
   if (broken.length) {
     out.push(el('div', { style: WARN },
       iv(broken.length + ' descriptor' + (broken.length === 1 ? '' : 's') + ' could not be parsed and '

package/workspace/public/pm/today-copy.js

@@ -366,6 +366,7 @@ export const COPY = {
     from: (who, where) => (who && where ? `${who} in ${where}` : who || where || ''),
     howTitle: (d, n) => `How to do it · ${d} of ${n}`,
     beforeTitle: (at) => `Before ${at}`,
+    endedAt: (at) => `This meeting ended at ${at}. Its prep and steps stay below.`,
     more: 'More context',
     moreMeeting: (during, after) => `In the meeting (${during}) · After (${after})`,
     readOnly: 'Read only. Nothing is sent before you press a button that says so.',

package/workspace/public/pm/today-day.js

@@ -176,10 +176,12 @@ function model(d, view) {
     const ended = Number.isFinite(f) && f <= now;
     // a meeting needs prep when the brief gave a prep line or Before steps (the explainer's contradiction: Before steps
     // with no prep line read "Nothing to prepare" while the Agenda counted them as prep left)
-    const needsPrep = !ended && (!!e.prep || before.length > 0);
+    // the prep stays with the meeting once it ends (the PM, 2026-10-07): hadPrep keeps the detail, needsPrep drives the lists
+    const hadPrep = !!e.prep || before.length > 0;
+    const needsPrep = !ended && hadPrep;
     const st = mark && mark.state;
     const group = !needsPrep ? null : st === 'done' || st === 'dismissed' ? 'done' : st === 'snoozed' ? 'later' : 'needs';
-    return { ...e, id: e.id || 'ev-' + i, s, f, time: hhmm(e.start), ended, mark, before, needsPrep, group };
+    return { ...e, id: e.id || 'ev-' + i, s, f, time: hhmm(e.start), ended, mark, before, hadPrep, needsPrep, group };
   }).sort((a, b) => a.s - b.s);
   const settings = (d && d.settings) || null;
   const scopes = (settings && settings.scopes) || {};
@@ -845,17 +847,17 @@ function prepBlock(ctx, e) {
   const d = steps.filter((x) => x.done).length; const total = steps.length;
   const left = total - d;
   const free = freeBefore(m, e);
-  const fit = !total ? null : !left ? A.fit.ok : free >= left * 15 ? A.fit.time(left, free) : A.fit.short(left, free);
+  const fit = !total || e.ended ? null : !left ? A.fit.ok : free >= left * 15 ? A.fit.time(left, free) : A.fit.short(left, free);
   const open = !e.mark || !e.mark.state;
   const link = Array.isArray(e.links) ? e.links.find((l) => isUrl(l.url)) : null;
   return el('div', { class: 'td-day__prep', 'data-day': 'prep' },
-    el('div', { class: 'td-day__jobtop' }, verbChip('prepare'), dueChip(m, e.mark, e.s, true)),
+    el('div', { class: 'td-day__jobtop' }, verbChip('prepare'), e.ended ? null : dueChip(m, e.mark, e.s, true)),
     e.prep ? el('p', { class: 'td-day__todo', 'data-day': 'todo' }, e.prep) : null,
     markBanner(ctx, e.id, e.mark, true),
     total ? el('div', { class: 'td-day__ready', 'data-day': 'readiness' }, meter({ done: d, total, label: A.readiness(d, total) }), fit ? el('span', { class: 'td-day__dim' }, fit) : null) : null,
     total ? el('div', { class: 'td-day__phase' }, el('h4', null, A.beforeTitle(e.time)), stepChecks(ctx, e.id, steps, { refs, mark: e.mark })) : null,
     refsBlock(refs, steps),
-    open && link && left ? el('div', { class: 'td-day__acts', 'data-day': 'cta' }, primaryLink((link.label || link.url) + ' ↗', link.url, { 'data-day-link': 'prep' })) : null,
+    open && link && left && !e.ended ? el('div', { class: 'td-day__acts', 'data-day': 'cta' }, primaryLink((link.label || link.url) + ' ↗', link.url, { 'data-day-link': 'prep' })) : null,
     marksBar(ctx, { id: e.id, title: e.title, kind: 'event', start: e.s, strong: total > 0 && !left }));
 }
 
@@ -896,10 +898,11 @@ function eventDetail(ctx, e) {
       onClick: async () => { if (await addGoal(ctx, e.title, ini ? ini.id : null)) toast({ text: D.goalAdded }); } })) : null];
   return [
     dhead(D.kind.meeting, e.title),
-    el('p', { class: 'td-day__dim td-day__mono' }, `${e.time}${e.end ? '–' + hhmm(e.end) : ''}${e.with ? ' · ' + e.with : ''}${e.ended ? ' · ' + D.ended : ''}`),
+    e.ended ? el('p', { class: 'td-day__ended', 'data-day': 'ended', role: 'status' }, pill(D.pill.ended, ''), ' ', A.endedAt(hhmm(e.end || e.f))) : null,
+    el('p', { class: 'td-day__dim td-day__mono' }, `${e.time}${e.end ? '–' + hhmm(e.end) : ''}${e.with ? ' · ' + e.with : ''}`),
     e.with ? peopleLinks(ctx.ws, e.with, { 'data-day': 'people' }) : null,
     e.purpose ? el('p', null, el('b', null, D.purpose + ': '), e.purpose) : null,
-    e.needsPrep ? prepBlock(ctx, e) : null,
+    e.hadPrep ? prepBlock(ctx, e) : null,
     ini ? el('div', { class: 'td-day__ini', 'data-day': 'initiative' }, el('span', null, D.initiative + ': ', el('b', { class: 'td-day__mono' }, ini.id), ini.why ? el('span', { class: 'td-day__dim' }, ' (' + D.suggested(ini.why) + ')') : null),
       ctx.openIni ? button({ label: D.openInitiative, size: 'sm', variant: 'ghost', attrs: { 'data-day-act': 'open-initiative' }, onClick: () => ctx.openIni(ini.id) }) : null) : null,
     tie,
@@ -907,10 +910,11 @@ function eventDetail(ctx, e) {
     after,
     notesBlock(e, { ws: ctx.ws, initiative: ini }),
     // with prep, the Before steps are the checklist above; During, After and the mail fold away (PRD D2)
-    !e.ended && e.needsPrep && ((steps.during || []).length || (steps.after || []).length || mailBlock)
+    // once it ends, the plan stays where it was; the mail moves up into the notes above, so it is not shown twice
+    e.hadPrep && ((steps.during || []).length || (steps.after || []).length || (!e.ended && mailBlock))
       ? el('details', { class: 'td-day__fold', 'data-day': 'more' }, el('summary', null, A.moreMeeting((steps.during || []).length, (steps.after || []).length)),
-        list(D.phases.during, (steps.during || []).map(stepItem)), list(D.phases.after, (steps.after || []).map(stepItem)), mailBlock) : null,
-    !e.ended && !e.needsPrep ? [list(D.phases.during, (steps.during || []).map(stepItem)), list(D.phases.after, (steps.after || []).map(stepItem)), mailBlock] : null,
+        list(D.phases.during, (steps.during || []).map(stepItem)), list(D.phases.after, (steps.after || []).map(stepItem)), e.ended ? null : mailBlock) : null,
+    !e.hadPrep ? [list(D.phases.during, (steps.during || []).map(stepItem)), list(D.phases.after, (steps.after || []).map(stepItem)), e.ended ? null : mailBlock] : null,
     Array.isArray(e.links) && e.links.length ? el('div', { class: 'td-day__acts', 'data-day': 'links' }, ...e.links.map((l) => extLink((l.label || l.url) + ' ↗', l.url))) : null,
   ];
 }

package/workspace/server.js

@@ -424,7 +424,7 @@ function sessionEnv() {
 //
 // The read is not cached. A descriptor added while the workspace is open must appear on the next
 // look, and a stale copy of a file whose whole purpose is provenance is worse than a re-read.
-function readProfilesNow() { return profilesLib.readProfiles(os.homedir()); }
+function readProfilesNow() { return profilesLib.readProfiles(os.homedir(), { detect: true }); }
 /** One descriptor by id, or null. Returns the READ too, because profileLine(null, read) needs it
  *  to tell "no profiles on this machine" from "the read failed and we cannot say". */
 function profileById(id) {
@@ -442,6 +442,8 @@ function profileWire(p, read) {
   return {
     id: p.id, label: p.label == null ? null : p.label, account: p.account == null ? null : p.account,
     mcp: Array.isArray(p.mcp) ? p.mcp.slice() : [],
+    // where a profile PMOS found (rather than was given) came from: a shell file, a launcher script or a config folder
+    detected: p.detected ? { source: p.detected.source, from: p.detected.from, line: p.detected.line } : null,
     env_count: keys.length, env_keys: keys,
     // Computed HERE, once, so no surface can re-word R6's five sentences.
     line: profilesLib.profileLine(p, read),
@@ -3752,7 +3754,7 @@ function prepareNextStep(body) {
   const preview = startPreview({ initiative: id, ws: w.id });
   if (!preview.ok) return { ...head, refused: { code: 'no-plan', why: preview.error || 'no branch and tree could be chosen' }, plan: null, prompt: null, prompt_sha: null, sources: [], judgment: { on: judgmentOn } };
   let mcp = [];
-  if (body.profile) { try { const rp = require('./lib/profiles').readProfiles(os.homedir()); const pr = rp.ok && (rp.profiles || []).find((x) => x.id === body.profile); if (pr && Array.isArray(pr.mcp)) mcp = pr.mcp; } catch { mcp = []; } }
+  if (body.profile) { try { const rp = readProfilesNow(); const pr = rp.ok && (rp.profiles || []).find((x) => x.id === body.profile); if (pr && Array.isArray(pr.mcp)) mcp = pr.mcp; } catch { mcp = []; } }
   const sources = nextStepActions.sourcesFor(item, mcp);
   const prompt = nextStepActions.buildPrompt({ initiative: id, title: got.title, item, branch: preview.branch || null, sources, judgment: judgmentLib.fragment(judgmentOn) });
   const sha = nextStepActions.planHash({ prompt, branch: preview.branch, wsId: preview.wsId, plan: preview.plan, judgment: judgmentOn });

package/workspace/test-lists/workspace-profile-detection.json

@@ -0,0 +1,9 @@
+{
+  "_comment": "workspace-profile-detection: lib/profile-discovery.js and the profiles it adds to /api/profiles.",
+  "modules": [
+    "profile-detection.test.js"
+  ],
+  "seconds": {
+    "profile-detection.test.js": 8
+  }
+}