k0-board 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -6,6 +6,45 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.1.2]
+
+Two things that were in the way every day: a field nobody needed, and a notification that opened
+the wrong application.
+
+### Fixed
+
+- **Clicking a notification opens that session's terminal**, on all three platforms. On macOS it
+  used to open **Script Editor** with a file dialog: when the Mac would not deliver k0's own
+  notifications, k0 fell back to posting one through `osascript`, and a banner posted that way
+  belongs to Script Editor rather than to k0 — no card, no click, wrong application. The fallback
+  is gone. When macOS refuses the permission, k0 now says so in the menu bar and takes you to the
+  Notifications pane — and switch it on there and the menu says so on the next pass, a couple of
+  seconds later, instead of leaving you looking at a message that reads as stuck. It writes what
+  the answer was in its log, and asks again rather than giving up on the first refusal. On Linux
+  the notification carries an action, on Windows the balloon finally has a click.
+
+### Changed
+
+- **A new card asks for three things**: the repository, a title, and what Claude should do when it
+  starts — which can be left empty and typed straight into Claude Code. The *Description* field is
+  gone: it never went anywhere except onto the note. Imported sessions keep theirs, which is the
+  one place it says something, and `/k0-import` still writes it.
+- **A note is never taller than it is wide.** Long text used to push a card down the column until
+  it stopped looking like a note. The repository, the title, the age and the buttons always show;
+  the text in the middle is what gets clipped.
+
+## [0.1.1]
+
+Documentation, and how a release is made. Nothing about k0 itself changed.
+
+### Changed
+
+- The README says what the npm package is, how to keep it up to date, and what each command
+  does.
+- Releases are published by GitHub Actions through npm's **trusted publishing**, with a signed
+  provenance statement and no publishing token kept anywhere — not in the repository secrets,
+  not on a laptop. A token that can publish is a token that can be stolen.
+
 ## [0.1.0]
 
 The first public release. k0 existed for a while as one person's tool before this; what changed
@@ -53,5 +92,7 @@ here is everything that had to change for it to be somebody else's tool as well.
 - The personal fixtures k0 grew up on. `test/clean.test.mjs` now fails the build if any of them
   come back.
 
-[Unreleased]: https://github.com/alessio-ragni/k0-board/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/alessio-ragni/k0-board/compare/v0.1.2...HEAD
+[0.1.2]: https://github.com/alessio-ragni/k0-board/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/alessio-ragni/k0-board/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/alessio-ragni/k0-board/releases/tag/v0.1.0

package/README.md

@@ -19,6 +19,7 @@ doing, and it goes on saying so while you are looking somewhere else.
 ![Four columns of paper sticky notes — yellow, blue, amber and green — pinned on a dark wall, each note tilted at its own angle, with a row of small coloured status pills along the top bar.](https://raw.githubusercontent.com/alessio-ragni/k0-board/main/docs/board.jpg)
 
 [![Tests](https://github.com/alessio-ragni/k0-board/actions/workflows/ci.yml/badge.svg)](https://github.com/alessio-ragni/k0-board/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/k0-board)](https://www.npmjs.com/package/k0-board)
 [![License: MIT](https://img.shields.io/badge/License-MIT-informational)](LICENSE)
 
 **Contents** · [Install](#install) · [How it is used](#how-it-is-used) ·
@@ -41,6 +42,36 @@ npx k0-board
 That is the whole thing. It tells you everything it is about to change, asks, and only then does
 it. `k0-board uninstall` undoes all of it.
 
+k0 is published on npm as [`k0-board`](https://www.npmjs.com/package/k0-board): one package, no
+dependencies, nothing to compile. `npx` fetches it, runs the installer once and leaves nothing
+behind — what stays on the machine is the copy the installer puts in `~/.k0/app`, not an npx
+cache that could be swept away under a running service. Installing it globally with
+`npm install -g k0-board` works too, if you would rather have the command on your PATH.
+
+**To update it**, run the installer again with `npx k0-board@latest`: it replaces the copy and
+restarts the service. Your board is never in the way — it lives in `~/.k0/k0.db`, outside
+everything the installer touches, and `uninstall` leaves it there as well.
+
+Every release is published by GitHub Actions with a signed **provenance statement**: proof, which
+`npm audit signatures` will check for you, that the tarball was built from a particular commit of
+this repository rather than uploaded by somebody who happened to have a password. (0.1.0 predates
+that and went out from a laptop.)
+
+### The commands
+
+| | |
+|---|---|
+| `k0-board install` | install and start it — this is what `npx k0-board` runs |
+| `k0-board uninstall` | undo everything install did; your board stays |
+| `k0-board start` | run the server in the foreground, installing nothing |
+| `k0-board restart` | restart the service |
+| `k0-board status` | is it running? exits 0 if it is, 1 if it is not |
+| `k0-board doctor` | what this machine can and cannot do, and why |
+
+`--yes` does not ask. `--from-source` points the service at the directory you are in instead of
+copying it, which is what you want while working on k0 itself. `--no-<name>` skips one optional
+change — `--no-lid-sleep`, `--no-shift-enter`. `K0_PORT` moves the board off 4319.
+
 From a clone, if you would rather look first:
 
 ```bash
@@ -77,6 +108,7 @@ The board lives at <http://k0.localhost:4319>.
 | Keep the machine awake | ✅ | ✅ | ✅ |
 | Keep working with the lid closed | ✅ | ❌ system setting | ❌ system setting |
 | Tray icon and notifications | ✅ | ✅ GNOME/KDE | ✅ |
+| Clicking a notification takes you to that terminal | ✅ needs the permission | ✅ if the desktop honours actions | ✅ |
 
 **macOS is the only platform the author has.** Linux and Windows are written from the
 documentation and reviewed carefully, and the logic they share with macOS is tested on all three
@@ -115,8 +147,9 @@ k0 makes **no network requests**. Not one, not even for a font.
 ### The board
 
 - **+** — at the left, next to k0, and next to every repository name on the board: that one opens
-  a card with the repository already chosen. First the repository, then a title, then what Claude
-  should do when it starts. The prompt can be left empty.
+  a card with the repository already chosen. Three fields and no more: the repository, a title,
+  and what Claude should do when it starts. The prompt can be left empty — nothing stops you from
+  starting the session and typing straight into Claude Code.
 
   The repository has to be **picked from the list** (searchable, most used at the top; arrow keys
   to move, Enter takes the highlighted row): a name typed by hand does not count. On leaving the
@@ -349,7 +382,9 @@ numbers.
 
 The difference between the two is the writing. The installer uses the name the session already
 had, or the first few words of the first prompt. `/k0-import` has Claude read the conversation and
-write a title and a description in the language it was held in.
+write a title and a description in the language it was held in. That description is the line in
+italics under the title on the note, and importing is the only thing that writes one: a card you
+write yourself has a title and a prompt, which is all it needs.
 
 Imported cards are born yellow — *Your turn*: **Resume** reopens the conversation where it was,
 **Done** clears it away. Being dead sessions they do not light the tray icon. Running it again
@@ -557,6 +592,7 @@ platform/
   contract.js    the line between k0 and the operating system, and what an adapter must fill in
   index.js       picks the adapter, and reports what this machine can and cannot do
   darwin/        AppleScript and Terminal.app, pmset and caffeinate, launchd, the Swift icon
+                 (menubar/, which is also what posts the notifications and reads the permission)
   linux/         tmux and any emulator, systemd-inhibit, systemd user units, a GTK tray
   win32/         PowerShell and Windows Terminal, execution state, Task Scheduler, a WinForms tray
   shared/        what more than one of them needs: tmux, running commands, reading a process table
@@ -574,7 +610,9 @@ server/
   machine.js     the only one that looks at processes and memory: what it all costs, and who is costing it
   pdf.js         the document on paper, printed by a headless browser
 web/             the two pages (html, css, js served exactly as they are)
-  index.html     the board — board.js, board.css, view.js
+  index.html     the board — board.js, board.css, view.js. A note is never taller than it is
+                 wide: the title, the age and the buttons always show, the text in the middle is
+                 what gets clipped
   files.html     the file viewer — files.js, files.css
   base.css       colours, fonts and scale: the house variables, shared by both pages
   md.js          markdown laid out, written by hand because nothing here is compiled
@@ -603,6 +641,12 @@ certain), `-n` for the name, `--resume` to pick one up, and `--permission-mode p
 
 Field notes the code takes for granted.
 
+- **A notification posted by `osascript` belongs to Script Editor.** `display notification` is the
+  one-line way to put a banner on screen from a script, and it works — but the banner is not
+  yours: it carries nothing, it has no delegate, and clicking it opens Script Editor with its file
+  dialog. It was in here as a fallback for when macOS would not deliver k0's own notifications,
+  and every click on it went to the wrong application. There is now one way to notify, and where
+  macOS refuses it the menu says so and takes you to the Notifications pane instead of pretending.
 - **`--dangerously-skip-permissions` switches off plan mode.** No error, no warning, and the order
   of the two flags changes nothing — the session starts in `bypassPermissions` and there is no
   trace of a plan. It looks like it works, which is what makes it a trap. The only way to really

package/menubar/K0MenuBar.swift

@@ -173,27 +173,93 @@ final class K0: NSObject, NSApplicationDelegate, UNUserNotificationCenterDelegat
     let item = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
     var seen: [Int: String] = [:]      // the last known status of every card
     var firstPass = true               // no notifications on the first pass: that would be noise at startup
-    var notificationsAllowed = false
+    /// What macOS currently thinks of this app's notifications. **Asked again and again, never
+    /// remembered from the one answer at launch**: `requestAuthorization` replies asynchronously,
+    /// this app starts at login — before the notification service is necessarily up — and a
+    /// boolean captured in that callback would then say "no" for the rest of the day, with
+    /// nothing anywhere to say why.
+    var notificationStatus: UNAuthorizationStatus = .notDetermined
+    private var loggedStatus: UNAuthorizationStatus?
+    private var ticksBeforeAsking = 0
     let images = ImagePaste()
 
     func applicationDidFinishLaunching(_ n: Notification) {
         item.button?.image = icon(nil)
         item.menu = NSMenu()
 
-        let centre = UNUserNotificationCenter.current()
-        centre.delegate = self
-        centre.requestAuthorization(options: [.alert, .sound]) { ok, _ in
-            self.notificationsAllowed = ok
-        }
+        UNUserNotificationCenter.current().delegate = self
 
         images.start()
         watchScreens()
         watchTerminal()
 
-        Timer.scheduledTimer(withTimeInterval: 2, repeats: true) { _ in self.refresh() }
+        Timer.scheduledTimer(withTimeInterval: 2, repeats: true) { _ in
+            self.refresh()
+            self.readNotificationPermission()
+        }
         refresh()
+        readNotificationPermission()
+    }
+
+    /// Reads the permission on **every** pass, two seconds apart, along with everything else.
+    ///
+    /// It rides the same beat as the rest on purpose. Somebody who has just switched k0 on in
+    /// System Settings comes straight back to this menu to see it change, and a menu that still
+    /// says "blocked" reads as broken — they switch it off again, or give up. Half a minute is
+    /// long enough for that; two seconds is not. The read is one call to a service already
+    /// listening, next to an HTTP request that happens anyway.
+    ///
+    /// Asking is the part that is kept slow: the request is fired only where the permission has
+    /// never been asked for, and at most once every half minute, because a request that fails
+    /// leaves the status exactly as it was and would otherwise be retried on every pass.
+    ///
+    /// The log line is the point of the rest. A permission that was refused and one that was
+    /// never asked for are both perfectly silent, and until this was written down the only visible
+    /// symptom was a notification that did nothing. `launchd` sends it to
+    /// `~/.k0/logs/com.k0.menubar.err.log`.
+    func readNotificationPermission() {
+        let centre = UNUserNotificationCenter.current()
+        centre.getNotificationSettings { settings in
+            DispatchQueue.main.async {
+                self.record(settings.authorizationStatus)
+                guard settings.authorizationStatus == .notDetermined else { return }
+                guard self.ticksBeforeAsking <= 0 else {
+                    self.ticksBeforeAsking -= 1
+                    return
+                }
+                self.ticksBeforeAsking = 15   // half a minute, at one read every two seconds
+                centre.requestAuthorization(options: [.alert, .sound]) { granted, error in
+                    if let error {
+                        NSLog("k0: macOS refused the notification permission: \(error.localizedDescription)")
+                    } else if !granted {
+                        NSLog("k0: the notification permission was declined")
+                    }
+                    // Whatever the answer, the next read is two seconds away and will report it.
+                }
+            }
+        }
     }
 
+    private func record(_ status: UNAuthorizationStatus) {
+        notificationStatus = status
+        guard loggedStatus != status else { return }
+        loggedStatus = status
+        NSLog("k0: notifications are \(Self.name(status))")
+    }
+
+    private static func name(_ status: UNAuthorizationStatus) -> String {
+        switch status {
+        case .authorized: return "allowed"
+        case .provisional: return "allowed quietly"
+        case .denied: return "denied"
+        case .notDetermined: return "not granted — macOS has not registered this app"
+        default: return "in an unknown state (\(status.rawValue))"
+        }
+    }
+
+    /// True only when a notification posted now would actually be delivered.
+    var canNotify: Bool { notificationStatus == .authorized || notificationStatus == .provisional }
+
     // MARK: The screen changing under the windows
 
     /// You plug a monitor in or out, or change resolution, and the session windows stay where
@@ -381,10 +447,21 @@ final class K0: NSObject, NSApplicationDelegate, UNUserNotificationCenterDelegat
         let restart = NSMenuItem(title: "Restart", action: #selector(restartServer), keyEquivalent: "")
         restart.target = self
         menu.addItem(restart)
-        let notifications = NSMenuItem(title: "Notifications", action: #selector(toggleNotifications), keyEquivalent: "")
-        notifications.target = self
-        notifications.state = Notifications.enabled ? .on : .off
-        menu.addItem(notifications)
+        // macOS has the last word here, and when it is saying no the switch below would be a lie:
+        // ticked, and nothing ever arrives. So the item stops pretending and takes you to the one
+        // place where that can be undone.
+        if canNotify {
+            let notifications = NSMenuItem(title: "Notifications", action: #selector(toggleNotifications), keyEquivalent: "")
+            notifications.target = self
+            notifications.state = Notifications.enabled ? .on : .off
+            menu.addItem(notifications)
+        } else {
+            let blocked = NSMenuItem(title: "Notifications blocked by macOS…",
+                                     action: #selector(openNotificationSettings),
+                                     keyEquivalent: "")
+            blocked.target = self
+            menu.addItem(blocked)
+        }
         // The four modes sit next to these because they are the same kind of gesture — something
         // you leave as it is — but the tick comes from the server rather than from here: over
         // there the board changes them too, and the menu is rebuilt every two seconds anyway.
@@ -442,6 +519,14 @@ final class K0: NSObject, NSApplicationDelegate, UNUserNotificationCenterDelegat
         sender.state = Notifications.enabled ? .on : .off
     }
 
+    /// Straight to the Notifications pane. The colour of the dot in the menu bar still tells you
+    /// what is waiting — what is missing without this permission is only being told without
+    /// looking.
+    @objc func openNotificationSettings() {
+        guard let url = URL(string: "x-apple.systempreferences:com.apple.Notifications-Settings.extension") else { return }
+        NSWorkspace.shared.open(url)
+    }
+
     /// The server holds the mode, so here we only ask. The tick moves straight away so the menu
     /// is not left mute under your finger; the real one arrives with the next round, which is at
     /// most two seconds later.
@@ -516,7 +601,15 @@ final class K0: NSObject, NSApplicationDelegate, UNUserNotificationCenterDelegat
         return Int(text.trimmingCharacters(in: .whitespacesAndNewlines)) == expected
     }
 
+    /// There is one way to notify and no other. There used to be a second one — `osascript -e
+    /// 'display notification'` — for when the Mac would not deliver this bundle's own. It is gone:
+    /// a banner posted by `osascript` **belongs to Script Editor**, so it carries no card, has no
+    /// delegate, and clicking it opened Script Editor's file dialog instead of the terminal. A
+    /// notification you cannot click is worse than none, because you go and click it.
+    ///
+    /// When macOS will not deliver ours, the menu says so — see `buildMenu`.
     func notify(_ w: Waiting) {
+        guard canNotify else { return }
         let c = UNMutableNotificationContent()
         c.title = "k0"
         c.body = "\(w.title) · \(label[w.status] ?? w.status)"
@@ -524,20 +617,10 @@ final class K0: NSObject, NSApplicationDelegate, UNUserNotificationCenterDelegat
         c.sound = .default
         let r = UNNotificationRequest(identifier: "k0-\(w.id)-\(w.status)", content: c, trigger: nil)
         UNUserNotificationCenter.current().add(r) { error in
-            // If the Mac will not deliver this bundle's notifications, fall back to the system
-            // banner: it looks the same, but it is not clickable.
-            if error != nil || !self.notificationsAllowed { self.fallbackNotify(w) }
+            if let error { NSLog("k0: the notification was not delivered: \(error.localizedDescription)") }
         }
     }
 
-    func fallbackNotify(_ w: Waiting) {
-        let text = "\(w.title) · \(label[w.status] ?? w.status)"
-        let p = Process()
-        p.executableURL = URL(fileURLWithPath: "/usr/bin/osascript")
-        p.arguments = ["-e", "display notification \"\(text)\" with title \"k0\""]
-        try? p.run()
-    }
-
     // Clicking the notification goes straight to that terminal.
     func userNotificationCenter(_ center: UNUserNotificationCenter,
                                 didReceive response: UNNotificationResponse,

package/menubar/build.sh

@@ -22,7 +22,13 @@ swiftc -O -swift-version 5 -o "$BIN" K0MenuBar.swift
 
 # Ad-hoc signature: without one, macOS does not deliver the bundle's notifications.
 codesign --force --sign - --identifier com.k0.menubar "$APP" >/dev/null 2>&1 || {
-  echo "⚠️  signing failed: notifications will use the fallback banner"
+  echo "⚠️  signing failed: macOS will not deliver this app's notifications"
 }
 
+# And a signature is not enough on its own: macOS only grants the notification permission to an
+# app it knows about. The bundle never passes through Finder — launchd starts it — so nothing
+# else would ever register it, and the permission would be refused with no explanation.
+LSREGISTER=/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
+if [ -x "$LSREGISTER" ]; then "$LSREGISTER" -f "$APP" >/dev/null 2>&1 || true; fi
+
 echo "✅ $(pwd)/$APP"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "k0-board",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "A board of sticky notes that drives your Claude Code sessions",
   "keywords": [
     "claude-code",

package/platform/linux/tray.py

@@ -41,6 +41,18 @@ except (ImportError, ValueError) as err:  # pragma: no cover - depends on the de
     print(f"k0: no tray support on this desktop ({err}); the board still works", file=sys.stderr)
     raise SystemExit(0)
 
+# libnotify is what makes a notification clickable: `notify-send` can only shout, and a
+# notification you cannot click is one that tells you a session is waiting and then leaves you to
+# find its terminal yourself. Where it is missing we still shout — see `notify`.
+try:  # pragma: no cover - depends on the desktop
+    gi.require_version("Notify", "0.7")
+    from gi.repository import Notify
+
+    if not Notify.init("k0"):
+        Notify = None
+except (ImportError, ValueError, GLib.Error):
+    Notify = None
+
 
 PORT = os.environ.get("K0_PORT", "4319")
 BASE = f"http://127.0.0.1:{PORT}"
@@ -130,7 +142,35 @@ def api(path, payload=None):
         return None
 
 
-def notify(title, body):
+# Notifications still waiting to be clicked. They are held here for one reason: a Notify object
+# that Python garbage-collects takes its action callback with it, and the click then does nothing.
+_shown = []
+
+
+def _forget(notification):
+    if notification in _shown:
+        _shown.remove(notification)
+
+
+def notify(card_id, title, body):
+    """Say that a session is waiting, and let the click take you to it.
+
+    The action is named `default`, which is what a notification daemon calls the click on the
+    banner itself rather than on a button. Not every daemon honours actions; where it does not,
+    or where libnotify is missing altogether, this falls back to `notify-send`, which still says
+    what happened — the terminal is then one click away in the menu instead of none.
+    """
+    if Notify is not None:
+        try:
+            note = Notify.Notification.new(title, body, None)
+            note.add_action("default", "Open", lambda *_: api(f"/api/card/{card_id}/focus", {}))
+            note.connect("closed", _forget)
+            _shown.append(note)
+            if note.show():
+                return
+            _forget(note)
+        except (GLib.Error, TypeError):
+            pass
     try:
         subprocess.Popen(["notify-send", "-a", "k0", title, body])
     except OSError:
@@ -177,7 +217,7 @@ class Tray:
         if not self.first_pass:
             for card in waiting:
                 if (card["id"], card["status"]) not in self.seen:
-                    notify(LABELS.get(card["status"], "k0"), card.get("title", ""))
+                    notify(card["id"], LABELS.get(card["status"], "k0"), card.get("title", ""))
         self.seen = now
         self.first_pass = False
 

package/platform/win32/tray.ps1

@@ -74,6 +74,16 @@ $notify.Visible = $true
 $menu = New-Object System.Windows.Forms.ContextMenuStrip
 $notify.ContextMenuStrip = $menu
 
+# Clicking the balloon brings that session's terminal up front, which is the whole point of being
+# told. Windows shows one balloon at a time and replaces it rather than queueing, so the card the
+# click belongs to is always the last one announced — there is nothing else it could be.
+$script:LastNotified = $null
+$notify.Add_BalloonTipClicked({
+    if ($null -ne $script:LastNotified) {
+      Invoke-K0 "/api/card/$($script:LastNotified)/focus" @{} | Out-Null
+    }
+  }) | Out-Null
+
 function Add-K0Item($Text, $Action, [bool]$Enabled = $true) {
   $item = New-Object System.Windows.Forms.ToolStripMenuItem
   $item.Text = $Text
@@ -124,6 +134,7 @@ function Show-K0Notifications($Waiting) {
     foreach ($card in $Waiting) {
       $key = "$($card.id):$($card.status)"
       if (-not $script:Seen.ContainsKey($key)) {
+        $script:LastNotified = $card.id
         $notify.BalloonTipTitle = $Labels[$card.status]
         $notify.BalloonTipText = $card.title
         $notify.ShowBalloonTip(4000)

package/web/board.css

@@ -180,7 +180,10 @@ body {
   transform-origin: 0 0;
   will-change: transform;
 }
-.column { flex: 0 0 268px; }
+/* A column is exactly one card wide. The number lives in a variable because the card reads it
+   too: a post-it is never taller than it is wide. */
+:root { --card-w: 268px; }
+.column { flex: 0 0 var(--card-w); }
 .column > h2 {
   margin: 0 0 14px 4px;
   font: 600 1.5rem/1 var(--hand);
@@ -278,6 +281,10 @@ body {
 }
 
 /* ── Cards ───────────────────────────────────────────────────────────── */
+/* A square, at most. Text that keeps coming does not push the card taller — a post-it that grows
+   with what is written on it stops being a post-it and becomes a page. Everything but the body is
+   `flex: none`, so the repository, the title, the age and the buttons are always there to read;
+   the body is what gives way. */
 .postit {
   background: var(--BACKLOG);
   border-radius: 2px;
@@ -287,6 +294,16 @@ body {
   cursor: default;
   transition: transform .12s ease, box-shadow .12s ease;
   position: relative;
+  display: flex;
+  flex-direction: column;
+  max-height: var(--card-w);
+  overflow: hidden;
+}
+.postit > * { flex: none; }
+.postit .body {
+  flex: 1 1 auto;
+  min-height: 0;
+  overflow: hidden;
 }
 .postit:hover { box-shadow: 3px 6px 14px rgba(0, 0, 0, .24); z-index: 2; }
 .postit.ASK { background: var(--ASK); }
@@ -321,6 +338,12 @@ body {
   font-size: .94rem;
   letter-spacing: 0;
   word-break: break-word;
+  /* Two lines and an ellipsis. A session name is a name: if it does not fit in two lines of
+     monospace it was never going to be read at a glance anyway. */
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
 }
 /* What the card is about. On imported sessions it is the only thing that says what happened in
    there, so it sits right under the title — and in italics, so it is not mistaken for the prompt,
@@ -331,7 +354,7 @@ body {
   color: rgba(0, 0, 0, .56);
   margin-top: 6px;
   display: -webkit-box;
-  -webkit-line-clamp: 4;
+  -webkit-line-clamp: 2;
   -webkit-box-orient: vertical;
   overflow: hidden;
 }
@@ -342,7 +365,7 @@ body {
   /* The prompt's line breaks stay line breaks: a list has to read like a list. */
   white-space: pre-wrap;
   display: -webkit-box;
-  -webkit-line-clamp: 4;
+  -webkit-line-clamp: 3;
   -webkit-box-orient: vertical;
   overflow: hidden;
 }
@@ -557,5 +580,6 @@ html[data-driving] .postit .corner svg { width: 20px; height: 20px; }
 html[data-driving] .zoom button { width: 40px; height: 40px; }
 html[data-driving] .zoom button svg { width: 22px; height: 22px; }
 
-/* The column is in pixels too: with the text at 22 the cards would choke inside it. */
-html[data-driving] .column { flex: 0 0 340px; }
+/* The card is in pixels too: with the text at 22 it would choke inside 268. And since the card is
+   never taller than it is wide, raising this raises the ceiling with it. */
+html[data-driving] { --card-w: 340px; }

package/web/board.js

@@ -84,8 +84,17 @@ function postit(card, now) {
       card.id
     )}${loadChip(card)}</div>
     <div class="title">${esc(card.title)}</div>
-    ${card.description ? `<div class="desc">${esc(card.description)}</div>` : ''}
-    ${card.prompt ? `<div class="prompt">${esc(card.prompt)}</div>` : ''}
+    ${
+      // Description and prompt travel together in one box, and that box is the only part of the
+      // card allowed to shrink: whatever the text does, the repository, the title, the age and
+      // the buttons stay where they are.
+      card.description || card.prompt
+        ? `<div class="body">
+             ${card.description ? `<div class="desc">${esc(card.description)}</div>` : ''}
+             ${card.prompt ? `<div class="prompt">${esc(card.prompt)}</div>` : ''}
+           </div>`
+        : ''
+    }
     <div class="foot">
       ${dead ? '<span class="dead">session closed</span>' : ''}
       <span class="since" title="${LABEL[card.status]} for ${since(card.status_since, now)}">${since(card.status_since, now)}</span>
@@ -419,7 +428,6 @@ function openEditor(card, presetPath = null) {
   $('#f-project').disabled = !!card?.session_id
   $('#f-project').classList.remove('bad')
   $('#f-title').value = card?.title ?? ''
-  $('#f-desc').value = card?.description ?? ''
   $('#f-prompt').value = card?.prompt ?? ''
   $('#f-delete').style.display = card ? '' : 'none'
   // A live session is not restarted: there is only saving to do there.
@@ -513,9 +521,12 @@ async function save() {
     toast('A title is required')
     return null
   }
+  // No description here on purpose: a card written by hand does not need one. The field only
+  // ever mattered for an imported session, where it is the one line saying what happened in
+  // there — and that one is written by the import. Leaving the key out of the payload is what
+  // keeps it: `patchCard` writes only the keys it is given.
   const payload = {
     title,
-    description: $('#f-desc').value.trim(),
     project_path: chosenProject,
     prompt: $('#f-prompt').value,
   }

package/web/index.html

@@ -80,12 +80,8 @@
         <small>this is also the session name</small>
       </label>
 
-      <label>Description
-        <textarea id="f-desc" rows="2" placeholder="a line or two about this session"></textarea>
-      </label>
-
       <label>What Claude should do when it starts
-        <textarea id="f-prompt" rows="6" placeholder="you can leave this empty"></textarea>
+        <textarea id="f-prompt" rows="6" placeholder="you can leave this empty and type straight into Claude Code"></textarea>
       </label>
 
       <footer>