honestweek 0.2.0 → 0.3.0

package/lib/view/problems-route.mjs

@@ -310,7 +310,7 @@ export function createProblemsRoute({ now = () => Date.now(), run = runProblems,
       const s = ctx.sessionByKey.get(f.session);
       const label = labelOf?.(ctx, f.session) ?? null;
       // The repository is the configured label, already redacted with the rest of the history.
-      out[f.session] = { title: s?.title ?? null, ...(label ? { label } : {}), thread: s?.thread ?? null, tool: s?.tool ?? null, repo: typeof s?.repo === 'string' ? s.repo : null };
+      out[f.session] = { title: s?.title ?? null, ...(label ? { label } : {}), thread: s?.thread ?? null, tool: s?.tool ?? null, repo: typeof s?.repo === 'string' ? s.repo : null, ...(s?.saved ? { saved: s.saved } : {}) };
     }
     return out;
   };
@@ -358,6 +358,26 @@ export function createProblemsRoute({ now = () => Date.now(), run = runProblems,
       return { window: base.window, finding: redactAnswer(findingOut(ctx, hit.f, goalsOf), ctx.redact), pattern: { id: p.id, name: p.name, group: p.group, status: p.status, strength: p.strength, priority: p.priority, fix: p.draft?.title ?? p.mitigation?.[0]?.action ?? null }, catalogIds: base.patterns.map((x) => x.id), evidenceKey };
     }
 
+    // One pattern, whole: its catalog side and every finding in the window (not just the page's
+    // newest), in time order, each with the steps its check recorded described as this build
+    // shows them. `honestweek problems --pattern` reads it.
+    const one = params.get('pattern');
+    if (one !== null) {
+      const src = result.patterns.find((x) => x.id === one);
+      if (!src) return { status: 404, body: { error: 'No pattern in the catalog has that id.' } };
+      const p = base.patterns.find((x) => x.id === one);
+      const all = [...src.findings].sort((a, b) => String(a.at ?? '').localeCompare(String(b.at ?? '')));
+      const findings = all.map((f) => findingOut(ctx, f, goalsOf));
+      const steps = {};
+      for (const f of findings) {
+        for (const id of f.zoom?.events ?? []) {
+          const e = ctx.b.eventsById?.get(id);
+          if (e && !steps[id]) steps[id] = { at: e.at ?? null, session: e.session ?? null, kind: e.kind ?? null, evidence: e.evidence ?? null, text: describe(e) };
+        }
+      }
+      return { window: base.window, pattern: { ...p, findings: redactAnswer(findings, ctx.redact), findingsListed: all.length }, steps: redactAnswer(steps, ctx.redact), sessions: redactAnswer(sessionsOf(ctx, all, labelOf), ctx.redact), rules: base.rules, evidenceKey };
+    }
+
     // The trend: each pattern's findings worth a look in this window against the window just
     // before it, of the same length. The earlier window is read only for these counts, once. A
     // list, like the rules: a pattern id such as secret-exposure reads as a credential's field
@@ -367,7 +387,7 @@ export function createProblemsRoute({ now = () => Date.now(), run = runProblems,
       const now = trendCounts(result);
       return Promise.resolve(earlier()).then((before) => ({
         window: base.window,
-        ...redactAnswer({ earlier: before?.window ? { from: before.window.from, to: before.window.to, days: before.window.days, sessions: before.error ? null : before.sessions, ...(before.skipped ? { skipped: before.skipped, note: before.note } : {}), ...(before.partial ? { partial: before.partial, note: before.note } : {}), ...(before.loaded && !before.skipped ? { loaded: before.loaded, note: before.note } : {}) } : null, trend: Object.entries(trendOf(now, before)).map(([id, t]) => ({ id, ...t })) }, ctx.redact),
+        ...redactAnswer({ earlier: before?.window ? { from: before.window.from, to: before.window.to, days: before.window.days, sessions: before.error ? null : before.sessions, ...(before.skipped ? { skipped: before.skipped, note: before.note } : {}), ...(before.partial ? { partial: before.partial, note: before.note } : {}), ...(before.loaded && !before.skipped ? { loaded: before.loaded, note: before.note } : {}), ...(before.saved ? { saved: true } : {}) } : null, trend: Object.entries(trendOf(now, before)).map(([id, t]) => ({ id, ...t })) }, ctx.redact),
         evidenceKey,
       }));
     }
@@ -411,7 +431,7 @@ export function createProblemsRoute({ now = () => Date.now(), run = runProblems,
       const s = ctx.sessionByKey.get(session);
       const all = result.patterns.flatMap((p) => p.findings.filter((f) => f.session === session));
       const label = labelOf?.(ctx, session) ?? null;
-      focus = { session, title: s?.title ?? null, ...(label ? { label } : {}), thread: s?.thread ?? null, known: !!s, findings: all.length, look: all.filter((f) => f.severity === 'look').length, patterns: new Set(all.map((f) => f.pattern)).size };
+      focus = { session, title: s?.title ?? null, ...(label ? { label } : {}), thread: s?.thread ?? null, known: !!s, findings: all.length, look: all.filter((f) => f.severity === 'look').length, patterns: new Set(all.map((f) => f.pattern)).size, ...(s?.saved ? { saved: s.saved } : {}) };
       pick = (p) => newest(p.findings.filter((f) => f.session === session));
     }
     const shown = new Map(result.patterns.map((p) => [p.id, pick(p)]));
@@ -421,5 +441,11 @@ export function createProblemsRoute({ now = () => Date.now(), run = runProblems,
     return { ...base, patterns, focus: focus ? redactAnswer(focus, ctx.redact) : null, sessions: redactAnswer(sessionsOf(ctx, all, labelOf), ctx.redact), examples: PROBLEM_EXAMPLES, evidenceKey };
   }
   problems.lookBySession = lookBySession;
+  /** The checks' result for `h` and each finding's key, run once and shared with every answer;
+   *  null when the checks couldn't run. */
+  problems.checked = (h, builtT) => {
+    const c = resultFor(h, builtT);
+    return c.result ? { result: c.result, keys: c.keys } : null;
+  };
   return problems;
 }

package/lib/view/replay-export.mjs

@@ -241,7 +241,7 @@ export function exportThread(h, threadId, { focus = null, extraRules = {}, redac
       related: th.related,
     },
     session: { key: first?.key ?? null, title: first?.title ?? th.title ?? null, turns },
-    sessions: th.sessions.map((s) => ({ key: s.key, tool: s.tool, repo: s.repo ?? null, group: sessionGroup(sessionByKey.get(s.key)), title: s.title ?? null, firstAt: s.firstAt ?? null, lastAt: s.lastAt ?? null, endState: s.endState ?? null, missing: s.missing ?? [] })),
+    sessions: th.sessions.map((s) => ({ key: s.key, tool: s.tool, repo: s.repo ?? null, group: sessionGroup(sessionByKey.get(s.key)), title: s.title ?? null, firstAt: s.firstAt ?? null, lastAt: s.lastAt ?? null, endState: s.endState ?? null, missing: s.missing ?? [], ...(sessionByKey.get(s.key)?.saved ? { saved: sessionByKey.get(s.key).saved } : {}) })),
     agents,
     events: events.map((e) => eventRow(h, e, agentsByKey, redact)),
     frames,

package/lib/view/selftest/clickthrough.js

@@ -2423,12 +2423,16 @@
       if (!d.querySelectorAll('#repos .reporow select').length) throw new Error('no repository with a role menu');
       if (!/@/.test($('emails').value)) throw new Error('the emails are not shown');
       if (d.getElementById('wordsFold').open) throw new Error('the private words are not folded away');
-      // Save works from the start; with nothing changed it writes nothing, says so and stays here.
+      // Save works from the start. With nothing changed it writes no config, says so and stays here.
+      // It still adds the config's .gitignore line when that's missing, so it's clicked only on the
+      // config this run wrote (setup's Save already ignored it): someone's own folder stays untouched.
       if ($('saveBtn').disabled) throw new Error('Save is off before Review changes; it should work from the start');
-      click($('saveBtn'));
-      await waitFor(() => !$('problem').hidden, { what: 'the answer to a Save with nothing changed' });
-      if (!onPage(doc(), 'settings.html') || text($('problem')) !== 'Nothing changed.') throw new Error(`Save with nothing changed read "${text($('problem')).slice(0, 160)}"`);
-      if ($('saveBtn').disabled) throw new Error('Save stays off after "Nothing changed."');
+      if (env.setupDone) {
+        click($('saveBtn'));
+        await waitFor(() => !$('problem').hidden, { what: 'the answer to a Save with nothing changed' });
+        if (!onPage(doc(), 'settings.html') || text($('problem')) !== 'Nothing changed.') throw new Error(`Save with nothing changed read "${text($('problem')).slice(0, 160)}"`);
+        if ($('saveBtn').disabled) throw new Error('Save stays off after "Nothing changed."');
+      }
       choose($('histKind'), 'days');
       typeInto($('histDays'), '14');
       // The chosen window says which days it loads, and whether that's partial; the logs line how far back they go.

package/lib/view/server.mjs

@@ -320,7 +320,9 @@ export function startViewServer({ data, setup = null, settings = null, planner =
         url,
         port: boundPort,
         issueCode,
-        address: (purpose = 'address', page = '', opts) => `${url}${page}#c=${issueCode(purpose, opts)}`,
+        // A page can carry its own part after # (replay's thread and step); key.js reads the
+        // code from among the &-separated parts there and puts the rest back.
+        address: (purpose = 'address', page = '', opts) => `${url}${page}${page.includes('#') ? '&' : '#'}c=${issueCode(purpose, opts)}`,
         pendingCodes: () => codes.size,
         setData: (d) => {
           current = d;

package/lib/view/settings.mjs

@@ -1,13 +1,14 @@
 // lib/view/settings.mjs: the Settings page's side of `honestweek view`. It changes the config
 // view started with, later, without the terminal: how far back to look, the repositories and
 // their roles, the author emails, the private words, the goal list, whether the Problems page
-// includes /insights, and the long-session limit it checks against.
+// includes /insights, the long-session limit it checks against, and whether results are saved
+// between runs and for how long (lib/saved/).
 //
 // It edits the file as it stands on disk, field by field: everything the page doesn't show,
 // and everything it shows but wasn't changed, stays exactly as it was (a repository's other
 // fields, the order of the redaction lists, curation, privacy, output). The checks are
-// Setup's own. A save names what changes first (preview), writes only the config in the
-// folder view started in, and only if the file is still the one the page was shown: a file
+// Setup's own. A save names what changes first (preview), writes only the config view read,
+// wherever it sits, and only if the file is still the one the page was shown: a file
 // changed meanwhile is never overwritten. Nothing is written when any check fails.
 
 import { createHash } from 'node:crypto';
@@ -16,12 +17,13 @@ import { join, resolve } from 'node:path';
 
 import { atomicWriteText } from '../atomic-json.mjs';
 import { gitExec } from '../git.mjs';
-import { HISTORY_LIMIT_MB, LONG_SESSION_MAX, LONG_SESSION_MIN, normalizeConfig, normalizeHistoryLimit, resolveRepoPath, ROLES } from '../config.mjs';
-import { authorHasCommits, checkNestedRoles, displayTest, existingDisplayRepos, findRepos, repoLastCommitAt } from '../init.mjs';
+import { HISTORY_LIMIT_MB, LONG_SESSION_MAX, LONG_SESSION_MIN, normalizeConfig, normalizeHistoryLimit, resolveRepoPath, ROLES, SAVE_KEEP_DAYS } from '../config.mjs';
+import { authorHasCommits, checkNestedRoles, ensureGitignore, checkoutOf, displayTest, existingDisplayRepos, findRepos, keptFromOldConfig, lookedUpConfig, nestsDisplay, reachesDisplay, repoLastCommitAt } from '../init.mjs';
 import { privateWordCount } from '../private-words.mjs';
+import { SAVED_GITIGNORE } from '../saved/store.mjs';
 import { checkEmails, checkGoalsPath, checkHistory, checkRepo, checkWords, checkSameRepos, CONFIG_FILE, json, parseBody, plural, privateWordsText, refuse, roleMeanings } from './setup.mjs';
 
-const FIELDS = new Set(['version', 'history', 'historyLimitMB', 'repos', 'authorEmails', 'names', 'terms', 'goalsFile', 'insights', 'longSessionTokens']);
+const FIELDS = new Set(['version', 'history', 'historyLimitMB', 'repos', 'authorEmails', 'names', 'terms', 'goalsFile', 'insights', 'longSessionTokens', 'saveResults']);
 const MAX_REPOS = 200;
 
 const same = (a, b) => JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
@@ -106,39 +108,59 @@ function ignoreConfig(folder) {
   return true;
 }
 
-/** True when git tracks the config in `folder`. A folder that is, or sits inside, a display-only
- *  repository is never asked (AGENTS.md invariant 4); no git, or no repository, reads as not tracked. */
-export function configTracked(folder) {
-  if (displayTest(existingDisplayRepos(folder))(folder, { walk: true })) return false;
+/** Whether git tracks the config in `folder`: 'tracked', 'untracked', or 'unchecked' when git
+ *  isn't asked because it would reach a display-only folder (reachesDisplay; AGENTS.md invariant
+ *  4). Outside any checkout there's nothing for git to track, so git isn't run and it reads as
+ *  untracked, as it does with no git. */
+export function configTrackState(folder) {
+  if (checkoutOf(folder) === null) return 'untracked';
+  if (reachesDisplay(existingDisplayRepos(folder))(folder)) return 'unchecked';
   try {
     gitExec(['ls-files', '--error-unmatch', '--', CONFIG_FILE], { repo: folder, stdio: 'ignore' });
-    return true;
+    return 'tracked';
   } catch {
-    return false;
+    return 'untracked';
   }
 }
 
+/** True when git tracks the config in `folder` (configTrackState). */
+export function configTracked(folder) {
+  return configTrackState(folder) === 'tracked';
+}
+
+/** Settings' note when it can't ask git whether the config is committed (issue 161). */
+export const CANT_CHECK_CONFIG = `Check that ${CONFIG_FILE} was never committed to git. It holds your private words, and listing it in .gitignore doesn't remove it from git if it was committed before. honestweek can't check for you here because of your display-only setting. Run git ls-files ${CONFIG_FILE}. If it prints the file name, run git rm --cached ${CONFIG_FILE}.`;
+
 /**
- * createSettings({ cwd, editable, checkGoals, history, windowFor, onSaved }) -> { info, preview, save }
+ * createSettings({ cwd, configDir, editable, checkGoals, history, windowFor, onSaved }) -> { info, preview, save }
+ * `configDir()` answers the folder of the config this run reads (the folder view started in,
+ * `cwd`, unless the config came from --config, HONESTWEEK_CONFIG or the user-level file); the
+ * file, its .gitignore and its relative paths are that folder's. Repositories to add are still
+ * looked for next to `cwd`.
  * `windowFor(history, limitMB)` answers which days that would load and an estimate of the cost.
  * `editable()` answers null when this run's config can be changed here, or why it can't.
  * `onSaved()` reloads the week from the new file; it throws with a plain message when it can't.
+ * `saved()` answers what the saved-results folder holds (lib/saved/saver.mjs), or null.
  */
-export function createSettings({ cwd, editable = () => null, checkGoals = () => {}, history = () => null, windowFor = () => null, onSaved = async () => ({}), lastCommitAt = repoLastCommitAt, hasCommits = authorHasCommits }) {
-  const folder = resolve(cwd);
-  const path = join(folder, CONFIG_FILE);
+export function createSettings({ cwd, configDir = () => cwd, editable = () => null, checkGoals = () => {}, history = () => null, windowFor = () => null, onSaved = async () => ({}), saved = () => null, lastCommitAt = repoLastCommitAt, hasCommits = authorHasCommits }) {
+  const here = resolve(cwd);
+  const where = () => {
+    const folder = resolve(configDir() ?? cwd);
+    return { folder, path: join(folder, CONFIG_FILE) };
+  };
   const read = () => {
-    const text = readFileSync(path, 'utf8');
+    const text = readFileSync(where().path, 'utf8');
     return { text, raw: JSON.parse(text), version: versionOf(text) };
   };
   const closed = () => {
     const why = editable();
     if (why) return why;
-    if (!existsSync(path)) return `There's no ${CONFIG_FILE} in this folder yet.`;
+    if (!existsSync(where().path)) return `There's no ${CONFIG_FILE} in ${where().folder === here ? 'this folder' : where().folder} yet.`;
     return null;
   };
 
   function info() {
+    const { folder } = where();
     const why = closed();
     if (why) return { editable: false, note: why };
     let cur;
@@ -164,6 +186,8 @@ export function createSettings({ cwd, editable = () => null, checkGoals = () =>
       goalsFile: typeof r.goalsFile === 'string' ? r.goalsFile : '',
       insights: r.insights === true,
       longSessionTokens: Number.isInteger(r.longSessionTokens) ? r.longSessionTokens : null,
+      saveResults: { on: r.saveResults?.on === true, keepDays: Number.isInteger(r.saveResults?.keepDays) ? r.saveResults.keepDays : null, history: r.saveResults?.history !== false, otherSessions: r.saveResults?.otherSessions === true, defaultDays: SAVE_KEEP_DAYS.default, min: SAVE_KEEP_DAYS.min, max: SAVE_KEEP_DAYS.max },
+      saved: saved(),
       privateWords: privateWordsText(),
     };
   }
@@ -174,6 +198,7 @@ export function createSettings({ cwd, editable = () => null, checkGoals = () =>
    * the role Setup would suggest. A folder the config marks display-only is never passed to git.
    */
   function found() {
+    const { folder } = where();
     const why = closed();
     if (why) return { editable: false, note: why };
     let raw;
@@ -184,17 +209,27 @@ export function createSettings({ cwd, editable = () => null, checkGoals = () =>
     }
     const listed = displayTest((Array.isArray(raw.repos) ? raw.repos : []).filter((x) => typeof x?.path === 'string').map((x) => resolveRepoPath(x.path, folder)));
     const email = Array.isArray(raw.identity?.authorEmails) ? raw.identity.authorEmails[0] ?? null : null;
-    const display = existingDisplayRepos(folder);
-    // A repository holding a display-only folder, or inside one, isn't asked either: git reading
-    // it would read that folder's history too (checkNestedRoles), and Save would refuse it.
-    const clear = (p) => !checkNestedRoles([{ path: p, role: 'reference' }, ...display.map((d) => ({ path: d, role: 'display' }))]);
-    const { repos } = findRepos(folder, email, { displayPaths: display, lastCommitAt: (p) => (clear(p) ? lastCommitAt(p) : null), hasCommits: (p, e) => clear(p) && hasCommits(p, e) });
-    const fresh = repos.filter((x) => x.role !== 'display' && !listed(x.path) && clear(x.path));
+    // Repositories are looked for next to the folder view started in, so the display-only
+    // folders of a config there (or the one the lookup finds from there) are kept from git too,
+    // not only those of the config this run edits.
+    // One of those that can't be read can't say which folders it marks, so git runs nowhere.
+    const startKept = keptFromOldConfig(here);
+    const around = lookedUpConfig(here);
+    const blocked = startKept.unreadable ? join(here, CONFIG_FILE) : around?.unreadable ? around.path : null;
+    if (blocked) return { editable: false, note: `${blocked} can't be read, so Settings can't tell which folders it marks display-only, and doesn't look for repositories until it can.` };
+    const display = [...new Set([...existingDisplayRepos(folder), ...startKept.display.map((d) => resolveRepoPath(d.path, here)), ...(around?.display ?? [])])];
+    // findRepos never asks git about a repository holding a display-only folder, or inside one,
+    // since git reading it would read that folder's history too (nestsDisplay). It isn't
+    // offered either, since Save would refuse it.
+    const nested = nestsDisplay(display);
+    const { repos } = findRepos(here, email, { displayPaths: display, lastCommitAt, hasCommits });
+    const fresh = repos.filter((x) => x.role !== 'display' && !listed(x.path) && !nested(x.path));
     return { editable: true, repos: fresh.map((x) => ({ path: x.path, label: x.label, role: x.role, lastAt: x.lastAt ?? null })) };
   }
 
   /** The new file from the answers, and the changes in plain words, or a refusal. */
   function check(body) {
+    const { folder } = where();
     const why = closed();
     if (why) return { refusal: json(409, { error: 'not-editable', message: why }) };
     const b = parseBody(body, FIELDS, folder);
@@ -332,17 +367,42 @@ export function createSettings({ cwd, editable = () => null, checkGoals = () =>
       changes.push(v === null ? 'Long-session limit: off.' : `Long-session limit: ${v.toLocaleString('en-US')} tokens.`);
     }
 
+    // Saved results: { on, keepDays, history } where keepDays null is the default and history is on
+    // unless it's false. Off removes the field, so a file that never had it gets back the same
+    // bytes; on keeps a chosen keepDays, and history only when it's turned off.
+    if (a.saveResults !== undefined) {
+      const v = a.saveResults;
+      if (!v || typeof v !== 'object' || Array.isArray(v) || typeof v.on !== 'boolean' || Object.keys(v).some((k) => !['on', 'keepDays', 'history', 'otherSessions'].includes(k)) || ['history', 'otherSessions'].some((k) => v[k] !== undefined && typeof v[k] !== 'boolean')) return { refusal: refuse('Save results must be on or off.', 'saveResults') };
+      const keep = v.keepDays ?? null;
+      if (keep !== null && !(Number.isInteger(keep) && keep >= SAVE_KEEP_DAYS.min && keep <= SAVE_KEEP_DAYS.max)) return { refusal: refuse(`Keep saved days for a whole number of days from ${SAVE_KEEP_DAYS.min} to ${SAVE_KEEP_DAYS.max.toLocaleString('en-US')}, or leave it empty for ${SAVE_KEEP_DAYS.default}.`, 'saveResults.keepDays') };
+      const wasOn = was.saveResults?.on === true;
+      const wasKeep = Number.isInteger(was.saveResults?.keepDays) ? was.saveResults.keepDays : null;
+      const history = v.history !== false;
+      const wasHistory = was.saveResults?.history !== false;
+      const others = v.otherSessions === true;
+      const wasOthers = was.saveResults?.otherSessions === true;
+      if (v.on !== wasOn || (v.on && (keep !== wasKeep || history !== wasHistory || others !== wasOthers))) {
+        if (v.on) next.saveResults = { on: true, ...(keep !== null ? { keepDays: keep } : {}), ...(history ? {} : { history: false }), ...(others ? { otherSessions: true } : {}) };
+        else delete next.saveResults;
+        changes.push(v.on ? `Save results between runs: on, ${history ? `with each day's history${others ? ', all sessions' : ''}` : 'check results only'}, kept ${(keep ?? SAVE_KEEP_DAYS.default).toLocaleString('en-US')} days.` : 'Save results between runs: off. What was saved stays until you press Forget saved results.');
+        if (v.on && !gitignoreIgnores(folder, SAVED_GITIGNORE[0])) notes.push(`Saving also adds ${SAVED_GITIGNORE[0]} to .gitignore.`);
+      }
+    }
+
     try {
       normalizeConfig(next, { configDir: folder });
     } catch (err) {
       return { refusal: refuse(String(err?.message ?? err)) };
     }
-    if (privateWordCount(next) > 0) {
-      if (configTracked(folder)) notes.push(`${CONFIG_FILE} is tracked by git, so .gitignore won't hide it. It lists private words: run git rm --cached ${CONFIG_FILE} if it shouldn't be committed.`);
-      // The same check save() makes before it adds the line, so the note matches what Save does.
-      else if (!gitignoreIgnores(folder, CONFIG_FILE)) notes.push(`Saving also adds ${CONFIG_FILE} to .gitignore, since it lists private words.`);
-    }
-    return { next, changes, notes, cur };
+    // A tracked config is worth a warning once it lists private words, and where git can't be
+    // asked, so is checking by hand. Save adds the .gitignore line either way, and this makes the
+    // same check it does, so the note matches what Save does.
+    // Save repeats the warning (`warning`), since it can be pressed without Review.
+    const trackState = privateWordCount(next) > 0 ? configTrackState(folder) : null;
+    const warning = trackState === 'tracked' ? `${CONFIG_FILE} is tracked by git, so .gitignore won't hide it. It lists private words: run git rm --cached ${CONFIG_FILE} if it shouldn't be committed.` : trackState === 'unchecked' ? CANT_CHECK_CONFIG : null;
+    if (warning) notes.push(warning);
+    if (trackState !== 'tracked' && !gitignoreIgnores(folder, CONFIG_FILE)) notes.push(`Saving also adds ${CONFIG_FILE} to .gitignore, since it holds your email, folder paths and any private words.`);
+    return { next, changes, notes, cur, warning };
   }
 
   function preview(body) {
@@ -352,16 +412,24 @@ export function createSettings({ cwd, editable = () => null, checkGoals = () =>
   }
 
   async function save(body) {
+    const { folder, path } = where();
     const r = check(body);
     if (r.refusal) return r.refusal;
-    if (!r.changes.length) return json(200, { saved: false, changes: [], message: 'Nothing changed.' });
+    if (!r.changes.length) {
+      // Save always adds the .gitignore line (Preview's note says so), so a save with nothing else to change still does.
+      const ignored = ignoreConfig(folder);
+      const message = ignored ? `Nothing in the config changed. ${CONFIG_FILE} is now in .gitignore.` : 'Nothing changed.';
+      return json(200, { saved: false, changes: [], message: r.warning ? `${message} ${r.warning}` : message });
+    }
     atomicWriteText(path, serializeLike(r.next, r.cur.text));
-    if (privateWordCount(r.next) > 0) ignoreConfig(folder);
+    ignoreConfig(folder);
+    if (r.next.saveResults?.on === true) ensureGitignore(folder, SAVED_GITIGNORE[0]);
+    const warning = r.warning ? { warning: r.warning } : {};
     try {
       await onSaved();
-      return json(200, { saved: true, changes: r.changes, next: 'problems.html' });
+      return json(200, { saved: true, changes: r.changes, next: 'problems.html', ...warning });
     } catch (err) {
-      return json(200, { saved: true, changes: r.changes, restart: `${String(err?.message ?? err).replace(/^view: /, '')} Your settings are saved; stop honestweek view with Ctrl+C and start it again.` });
+      return json(200, { saved: true, changes: r.changes, ...warning, restart: `${String(err?.message ?? err).replace(/^view: /, '')} Your settings are saved; stop honestweek view with Ctrl+C and start it again.` });
     }
   }
 

package/lib/view/setup.mjs

@@ -7,16 +7,18 @@
 // page sends its answers to this program only, in a POST body; nothing here logs them, puts
 // them in an address, or writes them anywhere but the config file.
 //
-// Every write lands in the folder the command was started in, which no request can change.
-// A config already there, or one that appears before saving, means nothing is written. A
+// Every write lands in the folder the command was started in, or, when the person picks it, in
+// the user-level folder (~/.honestweek), which a command run from any folder finds. No request
+// can name another folder. A config already there, or one that appears before saving, means
+// nothing is written. A
 // repository marked display is never passed to git: discovery skips any the folder's config
 // already lists that way, and a repository added by path is only looked at on disk.
 
-import { existsSync, statSync } from 'node:fs';
-import { basename, join, resolve } from 'node:path';
+import { existsSync, mkdirSync, statSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
 
 import { hostTimezone, isEmailShaped, normalizeConfig, normalizeHistory, resolveRepoPath, ROLES } from '../config.mjs';
-import { buildConfig, checkNestedRoles, displayTest, findRepos, foundLine, inferIdentity, isGitRepo, repoIdentity, NAMES_QUESTION, parseWordList, PRIVATE_WORDS_INTRO, ROLE_MEANINGS, TERMS_QUESTION, writeInitFiles } from '../init.mjs';
+import { buildConfig, checkNestedRoles, displayTest, findRepos, foundLine, gitignoreHas, inferIdentity, isGitRepo, repoIdentity, NAMES_QUESTION, parseWordList, PRIVATE_WORDS_INTRO, ROLE_MEANINGS, TERMS_QUESTION, writeInitFiles } from '../init.mjs';
 import { privateWordCount } from '../private-words.mjs';
 
 export const CONFIG_FILE = 'honestweek.config.json';
@@ -24,7 +26,7 @@ export const CONFIG_FILE = 'honestweek.config.json';
 export const SETUP_MAX_BODY = 64 * 1024;
 /** The history choice Setup starts on: the last week, as view has always read. */
 export const DEFAULT_HISTORY = Object.freeze({ days: 7 });
-const FIELDS = new Set(['authorEmails', 'timezone', 'repos', 'names', 'terms', 'goalsFile', 'history']);
+const FIELDS = new Set(['authorEmails', 'timezone', 'repos', 'names', 'terms', 'goalsFile', 'history', 'saveTo']);
 const REPO_FIELDS = new Set(['path', 'label', 'role']);
 const MAX_REPOS = 200;
 const MAX_EMAILS = 20;
@@ -171,14 +173,18 @@ export function checkHistory(v) {
 }
 
 /**
- * createSetup({ cwd, command, inferEmail, checkGoals, history, onSaved }) -> { info, preview, save, pending }
+ * createSetup({ cwd, command, inferEmail, checkGoals, history, onSaved, userConfig, configFound }) -> { info, preview, save, pending }
+ * `userConfig` is the user-level config file the page may save to instead of this folder (null
+ * when this run wouldn't look there). `configFound()` answers whether a config this run would read
+ * is there now, from Setup or from init in another terminal (this folder's, by default).
  * `checkGoals(path)` throws with a plain message when a goal list can't be read.
  * `history()` describes the logs on this machine for the "how far back" choice.
  * `onSaved()` loads the new config and starts the week; it answers { next } or throws.
  */
-export function createSetup({ cwd, command = 'honestweek', inferEmail, checkGoals = () => {}, history = () => null, onSaved = async () => ({}) }) {
+export function createSetup({ cwd, command = 'honestweek', inferEmail, checkGoals = () => {}, history = () => null, onSaved = async () => ({}), userConfig = null, configFound }) {
   const folder = resolve(cwd);
   const configPath = join(folder, CONFIG_FILE);
+  const userDir = userConfig ? dirname(resolve(userConfig)) : null;
   let found = null;
   let saved = false;
 
@@ -191,7 +197,7 @@ export function createSetup({ cwd, command = 'honestweek', inferEmail, checkGoal
     return found;
   }
 
-  const pending = () => !saved && !existsSync(configPath);
+  const pending = () => !saved && !(configFound ? configFound() : existsSync(configPath));
 
   function info() {
     if (!pending()) return { configured: true, folder, configFile: CONFIG_FILE, note: `${CONFIG_FILE} is already in this folder.` };
@@ -200,6 +206,7 @@ export function createSetup({ cwd, command = 'honestweek', inferEmail, checkGoal
       configured: false,
       folder,
       configFile: CONFIG_FILE,
+      ...(userConfig ? { userConfig: resolve(userConfig) } : {}),
       command,
       found: p.repos.length ? foundLine(p.repos, p.folded) : 'No git repositories found nearby. Add one by its folder path.',
       repos: p.repos,
@@ -218,6 +225,8 @@ export function createSetup({ cwd, command = 'honestweek', inferEmail, checkGoal
     const b = parseBody(body, FIELDS, folder);
     if (b.refusal) return b;
     const raw = b.value;
+    if (raw.saveTo !== undefined && raw.saveTo !== 'folder' && !(raw.saveTo === 'user' && userDir)) return { refusal: refuse(userDir ? 'Save it in this folder or for every folder.' : 'This run saves in this folder only.', 'saveTo') };
+    const target = raw.saveTo === 'user' ? userDir : folder;
     const emails = checkEmails(raw.authorEmails);
     if (emails.refusal) return emails;
     if (typeof raw.timezone !== 'string' || raw.timezone.length > 64 || !validTimezone(raw.timezone)) return { refusal: refuse(`${JSON.stringify(String(raw.timezone ?? '').slice(0, 64))} isn't a timezone this machine knows. Use an IANA name such as Europe/Paris or UTC.`, 'timezone') };
@@ -251,8 +260,10 @@ export function createSetup({ cwd, command = 'honestweek', inferEmail, checkGoal
     } catch (err) {
       return { refusal: refuse(String(err?.message ?? err)) };
     }
-    if (privateWordCount(config) > 0) notes.push(`Saving also adds ${CONFIG_FILE} to .gitignore, since it lists private words.`);
-    return { config, notes };
+    // Save adds the line unless .gitignore already has it (init's ensureGitignore makes the same check).
+    if (!gitignoreHas(target, CONFIG_FILE)) notes.push(`Saving also adds ${CONFIG_FILE} to .gitignore, since it holds your email, folder paths and any private words.`);
+    if (target !== folder) notes.push(`It's saved as ${join(target, CONFIG_FILE)}, which honestweek reads from any folder without its own config.`);
+    return { config, notes, target };
   }
 
   function preview(body) {
@@ -268,12 +279,14 @@ export function createSetup({ cwd, command = 'honestweek', inferEmail, checkGoal
     propose();
     const r = check(body);
     if (r.refusal) return r.refusal;
-    const result = writeInitFiles(folder, r.config, { onlyNew: true });
-    if (!result.wrote.includes(CONFIG_FILE)) return json(409, { error: 'exists', message: `${CONFIG_FILE} appeared in this folder while saving, so nothing was written or changed. Reload the page to see your week.` });
+    // The user-level folder is made owner-only on POSIX, like the config in it.
+    if (r.target !== folder) mkdirSync(r.target, { recursive: true, mode: 0o700 });
+    const result = writeInitFiles(r.target, r.config, { onlyNew: true, example: r.target === folder });
+    if (!result.wrote.includes(CONFIG_FILE)) return json(409, { error: 'exists', message: `${CONFIG_FILE} appeared in ${r.target === folder ? 'this folder' : r.target} while saving, so nothing was written or changed. Reload the page to see your week.` });
     saved = true;
     const wrote = result.wrote.filter((w) => !w.startsWith('.gitignore ('));
     const ignored = result.wrote.length - wrote.length;
-    const written = `Wrote ${wrote.join(' and ')}${ignored ? ` and ${plural(ignored, '.gitignore line')}` : ''}.`;
+    const written = `Wrote ${wrote.join(' and ')}${ignored ? ` and ${plural(ignored, '.gitignore line')}` : ''}${r.target !== folder ? ` in ${r.target}` : ''}.`;
     try {
       const next = await onSaved();
       return json(200, { saved: true, written, next: next?.next ?? 'problems.html' });

package/lib/view/suggest-words.mjs

@@ -0,0 +1,67 @@
+// lib/view/suggest-words.mjs: words in my own prompts and session titles that look like names,
+// for Settings to offer as private words (issue 165).
+//
+// It reads the redacted build, so a word honestweek already hides never shows, and only the
+// sessions in my configured repositories, the ones every lookup and goal uses. It writes nothing:
+// the page shows the words, and nothing changes until I add some and press Save.
+
+import { isNameShaped } from '../harvest.mjs';
+
+/** Words common in coding sessions that look like names but aren't private. */
+const TOOL_WORDS = new Set(
+  (
+    'claude codex github gitlab bitbucket readme changelog license api cli sdk mcp npm pnpm npx yarn node deno bun ' +
+    'json yaml toml html css url urls http https ssh tls jwt oauth sql csv pdf png svg ui ux ci cd pr prs ' +
+    'windows linux macos ubuntu debian chrome firefox safari vscode cursor typescript javascript python rust golang java ' +
+    'markdown docker kubernetes aws gcp azure honestweek ok todo fixme'
+  ).split(/\s+/)
+);
+
+/** At most this many suggestions, so the list stays short. */
+export const MAX_SUGGESTIONS = 20;
+
+/** A capitalized word that only ever starts a sentence is usually just that, so it counts only
+ *  where it doesn't: mid-sentence. A sentence also starts a line, a list item ("- Check",
+ *  "2. Update"), and a quote or bracket opening one. CamelCase and all-capitals words count
+ *  anywhere. */
+const startsSentence = (text, at) =>
+  /(?:^|[.!?:;]["'”’)\]]*\s+|\n)\s*(?:(?:[-*+>#]+|\d+[.)])\s+)?["'“‘([]*$/u.test(text.slice(Math.max(0, at - 16), at));
+
+/**
+ * suggestWords({ sessions, events, include, exclude }) -> [{ word, count }]
+ * Name-shaped words in any alphabet (a capitalized word mid-sentence, CamelCase starting with a
+ * capital, or all capitals), outside code, in the titles and prompts of the sessions `include`
+ * keeps, seen at least twice, most frequent first, at most MAX_SUGGESTIONS. `exclude` holds
+ * whole words to leave out, any case: listed private words and the parts of repository labels.
+ * A listed name of two words leaves its parts in, since the redactor hides only the whole name
+ * and a first name alone still shows.
+ */
+export function suggestWords({ sessions, events, include, exclude = [], promptText = (e) => e.facts?.text }) {
+  const skip = new Set([...TOOL_WORDS, ...exclude.map((w) => String(w).trim().toLowerCase()).filter(Boolean)]);
+  const counts = new Map();
+  const add = (raw) => {
+    // Code isn't a name: leave out code blocks and `code`, an identifier with an underscore
+    // (GITHUB_TOKEN), and a name starting lowercase (filterSince).
+    const text = String(raw).replace(/```[\s\S]*?```/g, ' ').replace(/`[^`\n]*`/g, ' ');
+    for (const m of text.matchAll(/\p{L}[\p{L}\p{N}_]+/gu)) {
+      const w = m[0];
+      if (w.includes('_') || /^\p{Ll}/u.test(w)) continue;
+      if (!isNameShaped(w) || skip.has(w.toLowerCase())) continue;
+      if (/^\p{Lu}\p{Ll}+$/u.test(w) && startsSentence(text, m.index)) continue;
+      counts.set(w, (counts.get(w) ?? 0) + 1);
+    }
+  };
+  const kept = sessions.filter(include);
+  const keys = new Set(kept.map((s) => s.key));
+  for (const s of kept) if (typeof s.title === 'string') add(s.title);
+  for (const e of events) {
+    if (e.kind !== 'prompt' || !keys.has(e.session)) continue;
+    const text = promptText(e);
+    if (typeof text === 'string') add(text);
+  }
+  return [...counts]
+    .filter(([, n]) => n >= 2)
+    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    .slice(0, MAX_SUGGESTIONS)
+    .map(([word, count]) => ({ word, count }));
+}