@hanzlaa/rcode 4.3.2 → 4.3.3

package/rcode/skills/core/rcode-lazy/SKILL.md

@@ -0,0 +1,149 @@
+---
+name: rcode-lazy
+description: >
+  Always-on "lazy senior dev" lens that forces the simplest solution that
+  actually works — shortest, most minimal — before any code is written.
+  Question whether the task needs to exist (YAGNI), reach for stdlib before
+  custom code, native platform features before dependencies, one line before
+  fifty. Supports intensity levels: lite, full (default), ultra. Activates when
+  the user says "lazy mode", "be lazy", "simplest solution", "minimal
+  solution", "yagni", "do less", "shortest path", "kam code likho", or
+  complains about over-engineering, bloat, boilerplate, or unnecessary
+  dependencies. Do NOT use for: simplifying code that already exists (use
+  rcode-trim), shipping in small atomic steps (use rcode-incremental).
+  rcode-lazy is the generative reflex that prevents bloat; rcode-trim removes
+  it after the fact.
+argument-hint: "[lite|full|ultra]"
+triggers:
+  - "lazy mode"
+  - "be lazy"
+  - "simplest solution"
+  - "yagni"
+  - "do less"
+  - "kam code likho"
+user-invocable: true
+---
+@.rcode/references/karpathy-guidelines.md
+
+
+# Lazy
+
+A lazy senior developer writes less because they have maintained more. Lazy
+means efficient, not careless. The best code is the code never written.
+
+
+## What this actually is (read this first)
+
+The floor of this skill is one sentence: **"Follow YAGNI, prefer one-liners
+where they stay correct."** A model already understands that. Benchmarks have
+shown a one-line prompt matches a full lazy-mode skill on toy tasks — so this
+skill does not claim to teach the model anything new, and ships no LOC numbers
+it cannot reproduce on real work.
+
+What it adds over that one line is only three things, and that is the whole
+value:
+
+1. **Persistence** — the reflex stays on without you retyping it each turn.
+2. **Intensity** — `lite | full | ultra` dials how hard it pushes back.
+3. **Guardrails** — an explicit list of what must *never* be simplified away.
+
+This is the generative arm of Karpathy **P2 (Simplicity)** and **P3
+(Surgical)**, which rcode already injects into every skill. rcode-lazy makes
+those two principles loud and adjustable instead of background defaults.
+
+
+## Persistence
+
+ACTIVE EVERY RESPONSE once invoked, until "stop lazy" / "normal mode" or
+session end. Still active when unsure. Default level **full**; switch with
+`/rcode-lazy lite|full|ultra`.
+
+
+## The ladder
+
+Stop at the first rung that holds — take the highest rung that works, don't
+keep climbing:
+
+1. **Does this need to exist at all?** Speculative need = skip it, say so in one line. (YAGNI / Karpathy P1)
+2. **Stdlib does it?** Use it.
+3. **Native platform feature covers it?** `<input type="date">` over a picker lib, CSS over JS, a DB constraint over app code.
+4. **Already-installed dependency solves it?** Use it. Never add a new one for what a few lines can do.
+5. **Can it be one line?** One line.
+6. **Only then:** the minimum code that works.
+
+
+## Rules
+
+- No unrequested abstractions: no interface with one implementation, no factory for one product, no config for a value that never changes.
+- No scaffolding "for later" — later can scaffold for itself.
+- Deletion over addition. Fewest files, shortest working diff.
+- Two stdlib options the same size? Take the one that is correct on edge cases. Lazy means less code, not a flimsier algorithm.
+- Mark deliberate shortcuts with an `rcode-lazy:` comment naming the ceiling and the upgrade path: `// rcode-lazy: global lock, per-account locks if throughput matters`.
+- Complex request you can't fully default? Ship the lazy version and flag it in the same response: "Did X; Y covers it. Need full X? Say so." Don't stall.
+
+
+## When NOT to be lazy (guardrails)
+
+Never simplify away: input validation at trust boundaries, error handling that
+prevents data loss, security measures, accessibility basics, anything the user
+explicitly requested. User insists on the full version → build it, no
+re-arguing.
+
+Non-trivial logic (a branch, a loop, a parser, a money/security path) leaves
+ONE runnable check behind — the smallest thing that fails if the logic breaks
+(Karpathy P4: a verifiable success criterion). Trivial one-liners need no test.
+
+
+## Intensity
+
+| Level | What changes |
+|-------|--------------|
+| **lite** | Build what's asked, but name the lazier alternative in one line. User picks. |
+| **full** | The ladder enforced. Stdlib and native first. Shortest diff, shortest explanation. Default. |
+| **ultra** | YAGNI extremist. Deletion before addition. Ship the one-liner and challenge the rest of the requirement in the same breath. |
+
+
+## Output Format
+
+Code first. Then at most three short lines: what was skipped, when to add it.
+If the explanation is longer than the code, delete the explanation. Prose the
+user explicitly asked for (a report, a walkthrough) is not debt — give it in
+full; the rule is only against unrequested prose.
+
+Pattern:
+
+```
+[code]
+→ skipped: [X], add when [Y].
+```
+
+
+## Workflow
+
+1. Read the request; note the intensity level (default **full**).
+2. Walk the ladder top-down; stop at the first rung that holds.
+3. Write the minimum code that works; mark deliberate shortcuts with `rcode-lazy:`.
+4. Add ONE runnable check if the logic is non-trivial.
+5. Output code first, then the `→ skipped:` line.
+
+
+## Examples
+
+### Happy path
+**User:** "Add a cache for these API responses." (full)
+**Result:** `@lru_cache(maxsize=1000)` on the fetch function.
+`→ skipped: custom cache class, add when lru_cache measurably falls short.`
+
+### Edge case (ultra challenges the requirement)
+**User:** "Add a cache for these API responses." (ultra)
+**Result:** "No cache until a profiler says so. When it does: `@lru_cache`. A hand-rolled TTL cache class is a bug farm with a hit rate."
+
+### Negative boundary (route elsewhere)
+**User:** "This 300-line file is bloated, clean it up."
+**Result:** Existing code → not rcode-lazy. Route to `rcode-trim`.
+
+
+## Memory Bank Hooks
+
+- **Reads:** the active request; current intensity level if set this session.
+- **Writes:** nothing — it is a generative lens, not a document producer.

package/rcode/templates/settings-hooks.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "pre-edit hook is currently advisory (logs warning, does not block). Full session-read tracking requires PostToolUse Read hook to write state file. Implemented in follow-up.",
+  "_comment": "pre-edit hook is currently advisory (logs warning, does not block). Full session-read tracking requires PostToolUse Read hook to write state file. Implemented in follow-up. prompt-router (UserPromptSubmit) is advisory — emits additionalContext to nudge toward the right rcode command; never blocks.",
   "hooks": {
     "PreToolUse": [
       {
@@ -70,6 +70,17 @@
           }
         ]
       }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node .rcode/bin/rcode-hooks.cjs prompt-router"
+          }
+        ]
+      }
     ]
   }
 }

package/rcode/workflows/do.md

@@ -290,6 +290,7 @@ Evaluate `$QUESTION` against these routing rules. Apply the **first matching** r
 | Validate an idea, "working backwards", "press release", "PRFAQ", "is this worth building" | `/rcode-prfaq` | Stress-test concept before committing sprint capacity |
 | Brainstorm, generate ideas, "explore options", "what could we do" | `/rcode-brainstorm` | Structured ideation before planning |
 | Audit code quality, "review changes", "karpathy", "check my diff", "too complex" | `/rcode-review --karpathy` | 4-principle code audit against recent diff |
+| Make it simpler, "be lazy", "lazy mode", "simplest solution", "yagni", "over-engineered", "kam code likho" | `/rcode-lazy` | Generative simplicity lens — YAGNI before code is written (rcode-trim removes bloat after the fact) |
 | Walk through a change, "checkpoint", "explain this diff", "human review" | `/rcode-checkpoint-preview` | Human-in-the-loop diff walkthrough |
 | Exploring, researching, comparing, or "how does X work" | `/rcode-research-phase` | Domain research before planning |
 | Scope unclear, conflicting UIs/options, "which one", "better UX", "still have confusion", "how should X look", brainstorming vision | `/rcode-discuss-phase` | Decisions not yet locked — gather before planning |

package/rcode/workflows/enable-hooks.md

@@ -1,7 +1,7 @@
 # Workflow: rcode-enable-hooks
 
 <purpose>
-Merge rcode opt-in hooks from settings-hooks.json into .claude/settings.json. Creates settings.json if missing. Enables all 8 guardrails: pre-edit (read-before-edit check), pre-workflow (command hint), post-commit (format validation), bash-guard (blocks dangerous commands), pre-compact (refreshes HANDOFF.json before context compaction), stop-verify (syntax-checks files changed during the response), cost-track (logs measured token usage to .rcode/telemetry/cost.jsonl), and compact-nudge (advises /rcode-trim or /clear after many edits).
+Merge rcode opt-in hooks from settings-hooks.json into .claude/settings.json. Creates settings.json if missing. Enables all 9 guardrails: pre-edit (read-before-edit check), pre-workflow (command hint), post-commit (format validation), bash-guard (blocks dangerous commands), pre-compact (refreshes HANDOFF.json before context compaction), stop-verify (syntax-checks files changed during the response), cost-track (logs measured token usage to .rcode/telemetry/cost.jsonl), compact-nudge (advises /rcode-trim or /clear after many edits), and prompt-router (proactive nudge toward the right rcode command for long-term memory consistency).
 </purpose>
 
 
@@ -44,7 +44,7 @@ If `.claude/` directory does not exist, create it first.
 
 ## Step 3 — Merge hooks
 
-For each hook type (`PreToolUse`, `PostToolUse`):
+For each hook type (`PreToolUse`, `PostToolUse`, `PreCompact`, `Stop`, `UserPromptSubmit`):
 
 - If the hook type does not exist in the current settings.json, add it.
 - If it exists, append the new matchers and hook commands (avoid duplicates by checking for exact command matches).
@@ -86,6 +86,7 @@ Enabled guardrails:
   • stop-verify: Syntax-checks files changed during the response
   • cost-track: Logs measured token usage to .rcode/telemetry/cost.jsonl
   • compact-nudge: Advises /rcode-trim or /clear after many edits
+  • prompt-router: Nudges toward the matching /rcode-* command and /rcode-memory-update so work lands in .rcode/state.json (toggle via prompt_nudge in .rcode/config.yaml: every|once-per-intent|when-stale|off)
 
 To disable, remove the hooks section from .claude/settings.json or edit .rcode/templates/settings-hooks.json and re-run.
 ```

package/rcode/workflows/lens-audit.md

@@ -1,7 +1,7 @@
 # Workflow: rcode-lens-audit
 
 <purpose>
-Run a structured 15-lens code audit against the current project. Each lens
+Run a structured 16-lens code audit against the current project. Each lens
 delegates to its mapped primary skill via Task() subagent dispatch — the skill
 provides domain expertise; this workflow handles orchestration, aggregation,
 and GH issue body generation. Never fixes anything; audit-first, fix-second.
@@ -26,6 +26,7 @@ and GH issue body generation. Never fixes anything; audit-first, fix-second.
 | 13 | Observability | `rcode-observability-auditor` | — |
 | 14 | Naming | `rcode-codebase-mapper` | `rcode-reviewer` |
 | 15 | Coverage | `rcode-nyquist-auditor` | `rcode-fatima` |
+| 16 | YAGNI / Over-engineering | `rcode-reviewer` | `rcode-lazy` |
 
 ## Step 0 — Usage check
 
@@ -33,8 +34,8 @@ If `$ARGUMENTS` is `--help` or `-h`:
 
 ```
 /rcode-lens-audit                # interactive — asks which lens
-/rcode-lens-audit all            # run all 15 lenses sequentially
-/rcode-lens-audit <N>            # run lens N (1-15) only
+/rcode-lens-audit all            # run all 16 lenses sequentially
+/rcode-lens-audit <N>            # run lens N (1-16) only
 /rcode-lens-audit <name>         # run by name, e.g. "security", "performance"
 
 Lenses and their primary skills:
@@ -53,6 +54,7 @@ Lenses and their primary skills:
   13. observability    — rcode-observability-auditor
   14. naming           — rcode-codebase-mapper + rcode-reviewer
   15. coverage         — rcode-nyquist-auditor + rcode-fatima
+  16. yagni            — rcode-reviewer + rcode-lazy (speculative abstractions, unused config, deps stdlib covers)
 ```
 
 STOP after printing help.
@@ -83,15 +85,15 @@ rcode-tools not found. Run: npx @hanzlaa/rcode install .
 ```
 
 Parse `$ARGUMENTS`:
-- `all` → `LENSES=(1 2 3 4 5 6 7 8 9 10 11 12 13 14 15)`
-- digit 1–15 → `LENSES=(<N>)`
+- `all` → `LENSES=(1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16)`
+- digit 1–16 → `LENSES=(<N>)`
 - known lens name → map to number → `LENSES=(<N>)`
 - empty → continue to Step 2 (interactive picker)
 
 Name → number mapping:
 `security=1, performance=2, testability=3, extensibility=4, dep-health=5,`
 `error-recovery=6, state-machine=7, i18n=8, documentation=9, cross-platform=10,`
-`karpathy=11, sxo=12, observability=13, naming=14, coverage=15`
+`karpathy=11, sxo=12, observability=13, naming=14, coverage=15, yagni=16`
 
 ## Step 2 — Interactive picker (when no argument given)
 
@@ -117,7 +119,8 @@ Options:
   13. observability    — rcode-observability-auditor (unguarded calls, silent fails)
   14. naming           — rcode-codebase-mapper (naming drift, PLAN.md vs SPRINT.md)
   15. coverage         — rcode-nyquist-auditor (parity gaps, untested commands)
-  16. all              — run all 15 lenses
+  16. yagni            — rcode-reviewer (speculative abstractions, single-impl interfaces, deps stdlib covers)
+  17. all              — run all 16 lenses
   0.  cancel
 ```
 
@@ -612,6 +615,44 @@ FINDINGS[coverage] = merge(PRIMARY, SECONDARY)
 
 ---
 
+### Lens 16 — YAGNI / Over-engineering
+
+```
+PRIMARY = Task(
+  subagent_type="rcode-code-reviewer",
+  model="{lens_model}",
+  prompt="YAGNI / over-engineering audit — do NOT fix code. {CONTEXT}
+
+  Run Lens 16 (YAGNI) audit against recent changes (HEAD~20..HEAD), using the
+  rcode-lazy ladder as the rubric (@.rcode/skills/core/rcode-lazy/SKILL.md).
+  This lens is narrower than Lens 11 (Karpathy): hunt ONLY for code that exists
+  but should not, or is bigger than the job needs. Flag:
+
+  - Speculative features / config / params for needs that do not exist yet
+  - Abstractions with a single implementation: an interface, factory, or
+    strategy with exactly one concrete user — inline it
+  - Wrapper layers that add a hop for one caller
+  - 'For later' scaffolding: extension points, plugin registries, generic
+    handlers with one case
+  - A new dependency for what stdlib or a native platform feature already does
+    (e.g. a date-picker lib vs <input type=\"date\">, a deep-clone lib vs
+    structuredClone)
+  - Config for a value that never changes (hardcode it)
+  - Hand-rolled code reproducing an already-installed dependency
+
+  Do NOT flag: validation at trust boundaries, error handling that prevents
+  data loss, security, accessibility, or anything explicitly requested — those
+  are never YAGNI violations even when verbose.
+
+  Return: file:line — YAGNI smell — what to delete/inline + the simpler form [critical|warn|info]
+  If clean: PASS"
+)
+
+FINDINGS[yagni] = PRIMARY
+```
+
+---
+
 ## Step 5 — Compile findings per lens
 
 For each lens that was run, print:
@@ -689,7 +730,7 @@ Next: file the GH issues above, then run /rcode-audit fix to address them.
 ## On Error
 
 - **rcode-tools not found**: print `Run: npx @hanzlaa/rcode install .` and STOP.
-- **Lens N out of range (not 1–15)**: print valid range and STOP.
+- **Lens N out of range (not 1–16)**: print valid range and STOP.
 - **Subagent skill not installed**: note `(skill not available — skipping)`, continue.
 - **Scope dirs empty**: note `(no source files in scope)` per lens, still run dispatch.
 - **Karpathy dispatch fails** (Lens 11): note failure, continue with remaining lenses.

package/server/dashboard.js

@@ -38,6 +38,10 @@ const { renderHtml } = require('./lib/html/shell');
 const PORT = parseInt(process.env.PORT || '7717', 10);
 const RCODE_DIR = process.env.RCODE_DIR || path.join(process.cwd(), '.rcode');
 const PROJECT_ROOT = path.dirname(RCODE_DIR);
+// Fallback root for agent prompts when rcode is installed as a package (not run
+// from inside the rcode source repo). server/dashboard.js lives at <pkg>/server/,
+// so <pkg> is one level up.
+const PACKAGE_ROOT = path.join(__dirname, '..');
 
 // Shared orchestrator token — passed to the orchestrator via env and embedded
 // in the HTML. Persisted to ~/.rcode/orch-token so it stays STABLE across
@@ -93,12 +97,12 @@ function handleRequest(req, res) {
   }
 
   if (url === '/api/agents') {
-    handleApiAgents(req, res, PROJECT_ROOT);
+    handleApiAgents(req, res, PROJECT_ROOT, PACKAGE_ROOT);
     return;
   }
 
   if (url.startsWith('/api/file')) {
-    handleApiFile(req, res, PROJECT_ROOT);
+    handleApiFile(req, res, PROJECT_ROOT, PACKAGE_ROOT);
     return;
   }
 

package/server/lib/api.js

@@ -120,7 +120,7 @@ function handleApiFiles(req, res, projectRoot) {
   res.end(JSON.stringify(groups));
 }
 
-function handleApiFile(req, res, projectRoot) {
+function handleApiFile(req, res, projectRoot, packageRoot) {
   const url = req.url || '';
   const params = new URLSearchParams(url.split('?')[1] || '');
   const relPath = params.get('path') || '';
@@ -128,24 +128,33 @@ function handleApiFile(req, res, projectRoot) {
     res.writeHead(400); res.end('Missing path parameter'); return;
   }
   // Fix #321: decode URL-encoded characters before resolving
-  const decoded = decodeURIComponent(relPath);
-  const resolved = path.resolve(projectRoot, decoded.replace(/^\//, ''));
-  if (!resolved.startsWith(projectRoot + path.sep) && resolved !== projectRoot) {
-    res.writeHead(403); res.end('Forbidden'); return;
+  const decoded = decodeURIComponent(relPath).replace(/^\//, '');
+
+  if (!decoded.endsWith('.md')) {
+    res.writeHead(403); res.end('Forbidden: only .md files'); return;
   }
-  // Dereference symlinks so a symlink outside projectRoot cannot bypass the guard
-  let realResolved;
-  try { realResolved = fs.realpathSync(resolved); }
-  catch { res.writeHead(404); res.end('File not found'); return; }
-  if (!realResolved.startsWith(projectRoot + path.sep) && realResolved !== projectRoot) {
-    res.writeHead(403); res.end('Forbidden'); return;
+
+  // Helper: try to read `decoded` relative to `root`; returns content string or null.
+  function tryRead(root) {
+    const resolved = path.resolve(root, decoded);
+    if (!resolved.startsWith(root + path.sep) && resolved !== root) return null;
+    let real;
+    try { real = fs.realpathSync(resolved); } catch { return null; }
+    if (!real.startsWith(root + path.sep) && real !== root) return null;
+    try { return fs.readFileSync(resolved, 'utf8'); } catch { return null; }
   }
-  if (!resolved.endsWith('.md')) {
-    res.writeHead(403); res.end('Forbidden: only .md files'); return;
+
+  // For rcode/agents/ paths fall back to the package install dir when the file
+  // doesn't exist under the project root (rcode installed as a dependency).
+  const isAgentPath = decoded.startsWith('rcode/agents/');
+  let content = tryRead(projectRoot);
+  if (content === null && isAgentPath && packageRoot && packageRoot !== projectRoot) {
+    content = tryRead(packageRoot);
+  }
+
+  if (content === null) {
+    res.writeHead(404); res.end('File not found'); return;
   }
-  let content;
-  try { content = fs.readFileSync(resolved, 'utf8'); }
-  catch { res.writeHead(404); res.end('File not found'); return; }
   res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
   res.end(content);
 }
@@ -242,11 +251,17 @@ function parseAgentFrontmatter(raw) {
 // returns one small frontmatter summary per agent .md file. Full prompt
 // bodies are NOT included; the client fetches those lazily per agent via the
 // existing /api/file handler when a card is opened.
-function handleApiAgents(req, res, projectRoot) {
-  const agentsDir = path.join(projectRoot, 'rcode', 'agents');
+function handleApiAgents(req, res, projectRoot, packageRoot) {
+  // Prefer the project's own rcode/agents/ dir; fall back to the package install
+  // dir so the drawer works in any project where rcode is an npm dependency.
+  let agentsDir = path.join(projectRoot, 'rcode', 'agents');
   let entries = [];
-  try { entries = fs.readdirSync(agentsDir, { withFileTypes: true }); }
-  catch { /* no agents dir — return an empty roster */ }
+  try { entries = fs.readdirSync(agentsDir, { withFileTypes: true }); } catch { /* ignore */ }
+  const mdEntries = entries.filter(e => e.isFile() && e.name.endsWith('.md'));
+  if (mdEntries.length === 0 && packageRoot && packageRoot !== projectRoot) {
+    agentsDir = path.join(packageRoot, 'rcode', 'agents');
+    try { entries = fs.readdirSync(agentsDir, { withFileTypes: true }); } catch { entries = []; }
+  }
   const agents = [];
   for (const e of entries) {
     if (!e.isFile() || !e.name.endsWith('.md')) continue;

package/server/lib/html/client/components/OrchPanel.js

@@ -50,6 +50,9 @@ function closeStream(storyId) {
 
 // ── Component ─────────────────────────────────────────────────────────────────
 
+const STORAGE_KEY = 'rcode-orch-panel-w';
+const MIN_W = 360;
+
 export function OrchPanel() {
   const { orchPanel, activeSessions } = useStore();
   const open     = !!(orchPanel && orchPanel.open);
@@ -60,7 +63,15 @@ export function OrchPanel() {
   // sessionsMap: { [storyId]: { title, lines, fileOps, status } }
   const [sessionsMap, setSessionsMap] = useState({});
   const [activeTab,   setActiveTab  ] = useState(null);
-  const bodyRef = useRef(null);
+  const bodyRef  = useRef(null);
+  const panelRef = useRef(null);
+
+  // Restore saved width on open
+  useEffect(() => {
+    if (!open || !panelRef.current) return;
+    const saved = localStorage.getItem(STORAGE_KEY);
+    if (saved) panelRef.current.style.setProperty('--orch-w', saved + 'px');
+  }, [open]);
 
   // Scroll to bottom whenever lines change for the active tab
   useEffect(() => {
@@ -167,6 +178,35 @@ export function OrchPanel() {
     setState({ orchPanel: null });
   }, []);
 
+  // Horizontal resize via the left-edge drag handle
+  function handleResizeDown(e) {
+    e.preventDefault();
+    const startX = e.clientX;
+    const el = panelRef.current;
+    if (!el) return;
+    const startW = el.getBoundingClientRect().width;
+    const handle = e.currentTarget;
+    handle.classList.add('dragging');
+
+    function onMove(ev) {
+      const delta = startX - ev.clientX;
+      const maxW = Math.floor(window.innerWidth * 0.7);
+      const w = Math.min(maxW, Math.max(MIN_W, startW + delta));
+      el.style.setProperty('--orch-w', w + 'px');
+    }
+
+    function onUp(ev) {
+      document.removeEventListener('mousemove', onMove);
+      document.removeEventListener('mouseup', onUp);
+      handle.classList.remove('dragging');
+      const w = Math.round(el.getBoundingClientRect().width);
+      localStorage.setItem(STORAGE_KEY, w);
+    }
+
+    document.addEventListener('mousemove', onMove);
+    document.addEventListener('mouseup', onUp);
+  }
+
   // Open (or focus) a session tab and attach its live stream. Used both for
   // locally-opened tabs and for sessions discovered via the orchestrator API.
   function handleTabClick(storyId) {
@@ -221,7 +261,8 @@ export function OrchPanel() {
   const panelCls = 'orch-panel' + (open ? ' open' : '');
 
   return html`
-    <div class=${panelCls}>
+    <div class=${panelCls} ref=${panelRef}>
+      <div class="orch-panel-resize" onMouseDown=${handleResizeDown}></div>
       <div class="orch-panel-header">
         <div class="orch-panel-title">
           <span class=${'orch-status-dot' + (runningCount > 0 ? ' up' : '')}></span>

package/server/lib/html/client/components/dashboard/InProgress.js

@@ -7,7 +7,8 @@
  *   1. Live orchestrator sessions (store.activeSessions, status==='running') —
  *      pulsing dot, title from storyId (or the command for cmd-* runs),
  *      elapsed time since startTime; clicking opens the session's orchestrator
- *      panel (existing openOrchPanel mechanism).
+ *      panel — opens the interactive xterm terminal (openTermPanel) since
+ *      these rows are always live sessions you may want to talk to.
  *   2. Scanned tasks from `tasks.inProgress[{ title, pct }]` (pct null → the
  *      percent pill is omitted).
  *
@@ -19,7 +20,7 @@
 import { html } from '../../preact.js';
 import { useStore } from '../../store.js';
 import { orchElapsed, rowLink } from '../../util.js';
-import { openOrchPanel } from '../../orchestrator.js';
+import { openTermPanel } from '../../orchestrator.js';
 import { pressable } from '../shared.js';
 import { TaskPipeline } from '../TaskPipeline.js';
 
@@ -31,8 +32,8 @@ function sessionTitle(s) {
 
 function LiveRow({ session: s }) {
   return html`
-    <li class="ip-row ip-live-row" title=${'Open session ' + s.storyId}
-      ...${pressable(() => openOrchPanel(s.storyId))}>
+    <li class="ip-row ip-live-row" title=${'Open terminal for ' + s.storyId}
+      ...${pressable(() => openTermPanel(s.storyId, sessionTitle(s)))}>
       <span class="live-dot"></span>
       <span class="ip-title ip-live-title">${sessionTitle(s)}</span>
       <span class="ip-live-elapsed">${orchElapsed(s.startTime)}</span>

package/server/lib/html/client/components/shared.js

@@ -354,6 +354,20 @@ export function TaskCard({ task: t }) {
           ` : null}
           ${t.acceptance ? html`<div class="task-detail-row"><strong>Acceptance:</strong> ${t.acceptance}</div>` : null}
           ${t.assignee ? html`<div class="task-detail-row"><strong>Assignee:</strong> ${t.assignee}</div>` : null}
+          ${(t.actions && t.actions.length) ? html`
+            <div class="task-actions">
+              <div class="task-actions-title">Actions performed</div>
+              <ol class="task-actions-list">
+                ${t.actions.map((step, i) => html`<li key=${i} class="task-action-step">${step}</li>`)}
+              </ol>
+            </div>
+          ` : null}
+          ${t.outcome ? html`
+            <div class="task-outcome">
+              <span class="task-outcome-label">Result</span>
+              <span class="task-outcome-text">${t.outcome}</span>
+            </div>
+          ` : null}
           ${taskCmds.length ? html`
             <div class="task-detail-cmds">
               ${taskCmds.map(([cmd, desc]) => html`<${CmdHint} key=${cmd} cmd=${cmd} desc=${desc}/>`)}

package/server/lib/html/client/orchestrator.js

@@ -178,6 +178,19 @@ export function fetchRejections() {
     .catch(() => []);
 }
 
+/**
+ * POST /api/task-status — persist a kanban column move for storyId.
+ * status is the target column id (todo | in_progress | blocked | done).
+ */
+export function setTaskStatus(storyId, status) {
+  const tok = orchToken();
+  return fetch(ORCH_HTTP + '/api/task-status', {
+    method: 'POST',
+    headers: { 'Authorization': 'Bearer ' + tok, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ storyId, status }),
+  }).then(r => r.json()).catch(() => ({}));
+}
+
 /**
  * POST /api/clean-sessions — remove ended sessions.
  * olderThanDays = 0 removes all ended sessions; > 0 keeps recent ones.

package/server/lib/html/client/views/KanbanView.js

@@ -10,7 +10,7 @@
 import { html, useState, useCallback } from '../preact.js';
 import { useStore, refresh } from '../store.js';
 import { allTasks, currentPhaseName } from '../util.js';
-import { stopStory, openOrchPanel } from '../orchestrator.js';
+import { stopStory, openOrchPanel, openTermPanel, setTaskStatus } from '../orchestrator.js';
 import { openRunnerPicker } from '../components/RunnerPicker.js';
 import { showToast } from '../components/shared.js';
 
@@ -56,6 +56,12 @@ function KanbanCard({ task, col, live, orchDown, onDragStart, onDragEnd }) {
     e.stopPropagation();
     stopStory(sid);
   }
+  // Live session → full interactive xterm terminal (you can type to the agent).
+  function handleTerm(e) {
+    e.stopPropagation();
+    openTermPanel(sid, sid);
+  }
+  // Ended session → lightweight read-only log view (no live TUI to mangle).
   function handleView(e) {
     e.stopPropagation();
     openOrchPanel(sid);
@@ -92,7 +98,7 @@ function KanbanCard({ task, col, live, orchDown, onDragStart, onDragEnd }) {
               onClick=${handleRun}>▶ Run</button>
           ` : isRunning ? html`
             <button class="kanban-stop-btn" onClick=${handleStop}>■ Stop</button>
-            <button class="kanban-view-btn" onClick=${handleView}>↗ View</button>
+            <button class="kanban-view-btn" onClick=${handleTerm}>↗ Terminal</button>
           ` : html`
             <button class="kanban-view-btn" onClick=${handleView}>↗ Logs</button>
           `}
@@ -188,9 +194,32 @@ export function KanbanView() {
 
   function handleDrop(e, colId) {
     if (!dragging || !dragging.id) return;
-    setVisualMoves(prev => ({ ...prev, [dragging.id]: colId }));
+    const taskId = dragging.id;
+    const prevCol = effCol(dragging, runningByStory);
+    const isRunning = !!(runningByStory && runningByStory[taskId]);
+
+    // Optimistic visual move
+    setVisualMoves(prev => ({ ...prev, [taskId]: colId }));
+
+    const anchor = document.querySelector('[data-story-id="' + taskId + '"]') || e.currentTarget;
+
+    if (colId === 'in_progress' && (prevCol === 'todo' || prevCol === 'blocked') && !isRunning) {
+      openRunnerPicker(anchor, {
+        kind: 'session', storyId: taskId, cmd: '/rcode-dev-story ' + taskId, title: taskId,
+      });
+      setTaskStatus(taskId, 'in_progress').then(() => {
+        refresh();
+        setVisualMoves(prev => { const n = { ...prev }; delete n[taskId]; return n; });
+      });
+    } else {
+      setTaskStatus(taskId, colId).then(() => {
+        refresh();
+        setVisualMoves(prev => { const n = { ...prev }; delete n[taskId]; return n; });
+      });
+      showToast('Moved to ' + (COLS.find(c => c.id === colId)?.label || colId));
+    }
+
     setDragging(null);
-    showToast('Moved (visual only — not persisted)'); // visual only — not persisted
   }
 
   // ---- Manual refresh ----