k0-board 0.4.0 → 0.5.0

package/server/prices.js

@@ -0,0 +1,59 @@
+/**
+ * What a request would have cost at the public API price list.
+ *
+ * With a subscription nobody pays per message, so this is not a bill: it is the one yardstick that
+ * puts a Fable hour and a Haiku hour on the same scale. The Usage page says so wherever it shows a
+ * dollar sign.
+ *
+ * Anthropic's first-party rates, dollars per million tokens, as published on 2026-06-24. Cache
+ * writes are 1.25× input for the five-minute lifetime and 2× for the hour; cache reads 0.1× input,
+ * except on Fable 5.1, whose reads are a flat $0.25. Fast mode on Opus 5 is $10/$50, twice the
+ * standard rate, and the multiplier is applied to the whole request.
+ *
+ * A model that is not in this table costs `null`, never zero: a page that added up an unknown
+ * model as free would be telling you the wrong thing with complete confidence.
+ */
+export const LIST_DATE = '2026-06-24'
+
+const RATES = {
+  'claude-fable-5-1': { input: 10, output: 50, read: 0.25 },
+  'claude-fable-5': { input: 10, output: 50, read: 1 },
+  'claude-mythos-5-1': { input: 10, output: 50, read: 0.25 },
+  'claude-mythos-5': { input: 10, output: 50, read: 1 },
+  'claude-opus-5': { input: 5, output: 25, fast: 2 },
+  'claude-opus-4-8': { input: 5, output: 25, fast: 2 },
+  'claude-opus-4-7': { input: 5, output: 25 },
+  'claude-opus-4-6': { input: 5, output: 25 },
+  'claude-sonnet-5': { input: 2, output: 10 },
+  'claude-sonnet-4-6': { input: 3, output: 15 },
+  'claude-haiku-4-5': { input: 1, output: 5 },
+}
+
+/** `claude-haiku-4-5-20251001` is `claude-haiku-4-5`: the snapshot date changes nothing here. */
+export function modelId(raw) {
+  const m = String(raw || '').trim()
+  return m.replace(/-\d{8}$/, '')
+}
+
+export const known = (model) => Object.hasOwn(RATES, modelId(model))
+
+/**
+ * Dollars for one request's `usage`, or null for a model not on the list.
+ *
+ * `tokens` is the shape k0 keeps, not the API's: `input`, `output`, `cacheRead`, `write5m`,
+ * `write1h`. Thinking tokens are already inside `output` — the API bills them as output — so they
+ * are not added a second time.
+ */
+export function cost(model, tokens, speed = 'standard') {
+  const r = RATES[modelId(model)]
+  if (!r) return null
+  const read = r.read ?? r.input * 0.1
+  const perMillion =
+    (tokens.input || 0) * r.input +
+    (tokens.output || 0) * r.output +
+    (tokens.cacheRead || 0) * read +
+    (tokens.write5m || 0) * r.input * 1.25 +
+    (tokens.write1h || 0) * r.input * 2
+  const fast = speed === 'fast' ? r.fast ?? 1 : 1
+  return (perMillion * fast) / 1e6
+}

package/server/projects.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
-import { projectRecency } from './db.js'
+import { projectRecency, listStories } from './db.js'
 import { hasDocs } from './files.js'
 import { shell } from '../platform/index.js'
 
@@ -94,13 +94,36 @@ function scan(fromClaude) {
 
 /**
  * The repositories, most used at the top. Recency is the fresher of two histories: Claude
- * Code's, which knows where you have worked even outside k0, and k0's own cards, which are the
+ * Code's, which knows where you have worked even outside k0, and k0's own stories, which are the
  * only thing that notices a session still open right now.
  */
+// How long a reading of the home directory is worth. The list it produces changes when you make a
+// repository, which is a thing that happens on a Tuesday, and working it out means listing your
+// home, asking the disk about every directory in it, and walking the ones no other sign has
+// already claimed. The board asked for it once a second, per open tab, for ever.
+//
+// Half a minute is not a compromise: a repository that turns up in the last column thirty seconds
+// late is a repository you have not finished making yet. And a repository with a story in it is
+// not affected at all — those come from the stories, which are not cached.
+const TTL = 30000
+let seen = { at: 0, list: null }
+
+/** Forgets the reading. For the tests, which make and unmake directories faster than a Tuesday. */
+export function forget() {
+  seen = { at: 0, list: null }
+}
+
 export function listProjects() {
+  if (seen.list && Date.now() - seen.at < TTL) return seen.list
+  const list = readProjects()
+  seen = { at: Date.now(), list }
+  return list
+}
+
+function readProjects() {
   const fromClaude = lastUsed()
   const mine = new Map(projectRecency().map((r) => [r.project_path, Number(r.at) || 0]))
-  // A repository with a card is always selectable, even if it lives outside your home — but
+  // A repository with a story is always selectable, even if it lives outside your home — but
   // only while its directory exists: the old name of a renamed one does not come back.
   const paths = new Set([...scan(fromClaude.keys()), ...[...mine.keys()].filter(exists)])
   // Your home is not a project: it is the directory that contains them all. It ends up here
@@ -113,7 +136,7 @@ export function listProjects() {
     path: dir,
     last_used: Math.max(fromClaude.get(dir) || 0, mine.get(dir) || 0),
     // Your stuff, or installed stuff? One sign is enough: a `.git`, a history in Claude Code, a
-    // card, a document in there, or the opposite of all of them — that there is nothing in it
+    // story, a document in there, or the opposite of all of them — that there is nothing in it
     // yet. Under your home there are also directories that are only ever programs, and those
     // stay out precisely because they are full of things nobody reads.
     // The empty question is asked last: it touches the disk, and by then only the few
@@ -130,23 +153,45 @@ export function listProjects() {
 }
 
 /**
- * The cards still standing: the ones whose directory exists. It is the same rule as the
- * repository list above — "a card is kept alive by its directory" — carried over to the board
- * too, which used to work its columns out from the cards alone. Without it, a deleted or
+ * The stories still standing: the ones whose directory exists. It is the same rule as the
+ * repository list above — "a story is kept alive by its directory" — carried over to the board
+ * too, which used to work its columns out from the stories alone. Without it, a deleted or
  * renamed directory leaves a column behind forever.
  *
- * Hide, do not delete: the cards stay in the database, and if the directory comes back one day
+ * Hide, do not delete: the stories stay in the database, and if the directory comes back one day
  * — an external disk remounted, a directory put back — so do they.
  *
- * The disk is asked once per repository and not once per card: there are a couple of dozen
- * columns and a few hundred cards, and this round runs every second.
+ * The disk is asked once per repository and not once per story: there are a couple of dozen
+ * columns and a few hundred stories, and this round runs every second.
  */
-export function onDisk(cards) {
+export function onDisk(stories) {
   const alive = new Map()
-  return cards.filter((c) => {
+  return stories.filter((c) => {
     if (!alive.has(c.project_path)) alive.set(c.project_path, exists(c.project_path))
     return alive.get(c.project_path)
   })
 }
 
 export const projectName = (p) => path.basename(p)
+
+/**
+ * The directories anything is allowed to open: the repositories k0 already knows, plus the ones
+ * sessions are really working in — which with a worktree are not the same thing. A path arriving
+ * from the address bar is not enough on its own: either it is in this list, or nothing is read.
+ *
+ * It lives here rather than beside the one endpoint that started it because three different parts
+ * of k0 now ask the same question — the file viewer, the backlog, the dev servers — and a second
+ * copy of "which directories are ours" is a second answer waiting to be the laxer one.
+ */
+export function rootOf(repo) {
+  if (!repo) return null
+  const roots = new Set(listProjects().map((p) => p.path))
+  // Both paths, and from the flattened row: `work_path` belongs to the session now, and a
+  // worktree that fell out of this list would make the viewer refuse exactly the sessions that
+  // most need it.
+  for (const story of listStories()) {
+    if (story.project_path) roots.add(story.project_path)
+    if (story.work_path) roots.add(story.work_path)
+  }
+  return roots.has(repo) ? repo : null
+}

package/server/servers.js

@@ -151,7 +151,7 @@ export function logPathFor(repo) {
  * repository, and the globe would then govern somebody else's server.
  *
  * Both separators count, rather than whichever one this machine happens to use. The paths on
- * either side come from different places — one from the operating system, one from a card or from
+ * either side come from different places — one from the operating system, one from a story or from
  * Claude Code's own files — and on Windows those two do not reliably agree on which slash they
  * write. Asking `path.sep` would make the answer depend on the machine reading it, which is how a
  * comparison starts being right in the tests and wrong in the field.
@@ -335,6 +335,27 @@ async function read() {
   }
 }
 
+/**
+ * Throws away the rows whose process is long gone, once, on the way up.
+ *
+ * A dev server is started detached and on purpose outlives k0 — see the note at the top of this
+ * file — so a row surviving a restart is normal and wanted. What is not wanted is a row surviving
+ * the *process*: the board had four of them, three pointing at pids that had died days earlier
+ * while the dev servers themselves were still running under new ones. k0 had lost them, and the
+ * only thing that kept finding them was the sighting on the port, which happens only while
+ * somebody is looking at the board.
+ *
+ * A pid is also a number the operating system hands out again. A row left pointing at a dead one
+ * is a row that will eventually point at somebody else's process, and `stop` acts on what the row
+ * says: this is what keeps that from being k0's problem.
+ */
+export function reconcile() {
+  for (const row of db.listDevServers()) {
+    if (row.pid && alive(row.pid)) continue
+    db.clearDevServer(row.project_path)
+  }
+}
+
 /** A reading, but only while somebody is looking. See machine.js, which lives by the same rule. */
 async function cycle() {
   if (Date.now() - watching > ATTENTION) return

package/server/sessions.js

@@ -5,7 +5,7 @@ import { StringDecoder } from 'node:string_decoder'
 import { PROJECTS_DIR } from './watcher.js'
 
 /**
- * Claude Code sessions that have already happened, ready to become cards.
+ * Claude Code sessions that have already happened, ready to become stories.
  *
  * Nothing is written here: it only reads ~/.claude/projects, where Claude Code keeps the
  * transcript of every session in a JSONL file.
@@ -109,7 +109,7 @@ function resolveRoot(cwd) {
   return cwd
 }
 
-function repoOf(cwd, cache) {
+export function repoOf(cwd, cache) {
   if (cache.has(cwd)) return cache.get(cwd)
   const r = resolveRoot(cwd)
   const ok =
@@ -238,13 +238,13 @@ function digest(file) {
 }
 
 /**
- * The sessions worth offering as cards, most recent first.
+ * The sessions worth offering as stories, most recent first.
  *
  * Two passes, because the second one is expensive: first the head of every transcript in the
  * window is checked, to keep only the real sessions and work out which repository they belong
  * to; then only the ones that actually fit under the per-repository cap are read in full.
  *
- * `exclude` are the session ids already on a card: re-importing must not make duplicates.
+ * `exclude` are the session ids already on a story: re-importing must not make duplicates.
  * `live` are the sessions still running, which can be attached too.
  * `root` only changes in the tests, to look at a directory of fake transcripts.
  */
@@ -316,7 +316,7 @@ export function scanSessions({
     for (const c of list) {
       if (taken >= perRepo) break
       const d = digest(c.file)
-      // Not one word of yours in the transcript: there is nothing for a card to say.
+      // Not one word of yours in the transcript: there is nothing for a story to say.
       if (!d.turns) continue
       taken++
       out.push({

package/server/settings.js

@@ -29,6 +29,8 @@ export const PATH = process.env.K0_CONFIG || path.join(HOME, 'config.json')
  */
 export const DEFAULTS = {
   closeIdleTerminalsAfterHours: 12,
+  backlog: true,
+  updateCheck: true,
 }
 
 /**
@@ -43,7 +45,9 @@ export const MIN_HOURS = 1
 /** The line k0 leaves at the top of the file, since JSON has nowhere else to put a word. */
 const NOTE =
   'k0 wrote this file and reads it again by itself whenever it changes — nothing to restart. ' +
-  'Delete a line to go back to its default. Hours at 0 switch that closing off entirely. ' +
+  'Delete a line to go back to its default. Hours at 0 switch that closing off entirely, and ' +
+  '"backlog": false puts the board back to what it was before epics and stories existed, and ' +
+  '"updateCheck": false stops the one question k0 asks npm. ' +
   'See Settings in the README.'
 
 /**
@@ -63,7 +67,26 @@ export function idleHours(raw) {
 /** A file's worth of anything, turned into settings that can be trusted. Pure: the tests live here. */
 export function normalise(raw) {
   const o = raw && typeof raw === 'object' ? raw : {}
-  return { closeIdleTerminalsAfterHours: idleHours(o.closeIdleTerminalsAfterHours) }
+  return {
+    closeIdleTerminalsAfterHours: idleHours(o.closeIdleTerminalsAfterHours),
+    backlog: onOff(o.backlog, DEFAULTS.backlog),
+    updateCheck: onOff(o.updateCheck, DEFAULTS.updateCheck),
+  }
+}
+
+/**
+ * Whether the backlog is there at all. It lives here rather than in the database because this is
+ * the file a person can actually open: a switch nobody can reach is not a switch, and `false`
+ * has to put the board back exactly as it was before any of this existed.
+ *
+ * Anything that is not plainly a no is a yes. `false`, `0`, `"off"` and `"no"` switch it off;
+ * a missing line, a typo, or a value nobody anticipated leaves the feature on, because losing
+ * your backlog to a mistyped setting is much worse than keeping a feature you meant to drop.
+ */
+export function onOff(raw, fallback = true) {
+  if (raw === undefined || raw === null || raw === '') return fallback
+  const v = String(raw).trim().toLowerCase()
+  return !(v === 'false' || v === '0' || v === 'off' || v === 'no')
 }
 
 let cached = null

package/server/update.js

@@ -0,0 +1,324 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { getPref, setPref } from './db.js'
+import { ROOT } from './paths.js'
+import * as settings from './settings.js'
+
+// ── The one request k0 makes ─────────────────────────────────────────────────
+// Everywhere else in k0 the answer to "shall we ask the internet" is no: no fonts fetched, no
+// telemetry, no `git fetch`. This file is the single exception, and what it does is written out
+// here rather than left in a commit message, because it is a promise a sceptical reader should
+// be able to check by reading one screen.
+//
+// WHAT LEAVES THIS MACHINE. One GET to https://registry.npmjs.org/k0-board/latest, at most once
+// a day, asking a public registry what the newest version of a public package is. The package
+// name is in the address and nothing else is in the request: not the version you are running,
+// not your repositories, not your commits, not your board, not an identifier of any kind. There
+// is no query string, no body and no cookie. The `user-agent` is the fixed string `k0-board`
+// with no version in it, so two people asking look the same. npm learns that an address asked
+// about a package — the same thing it learns when anybody types `npm view k0-board`.
+//
+// WHAT COMES BACK is one JSON document about that package, of which k0 keeps two things: the
+// version string and the time it was told. Nothing is downloaded and nothing is run. k0 cannot
+// update itself; the most it can do is say that a newer version exists.
+//
+// HOW TO SWITCH IT OFF. `"updateCheck": false` in `~/.k0/config.json`, and no socket is opened,
+// ever — not on start, not on a restart, not when somebody presses the button on the What's New
+// page. `force` skips the day's cache, never the switch, and with the switch off the board also
+// stops mentioning whatever the last answer was.
+//
+// AND IT NEVER GETS IN THE WAY. Every failure is silent: no network, DNS gone, npm down, a 500,
+// an answer that is not JSON — the board simply does not mention an update. A version check is
+// not worth a red box on somebody's screen, and it is not worth a second of startup either, so
+// nothing here is awaited on the way up and nothing here throws where it would take the server
+// down with it.
+
+const REGISTRY = 'https://registry.npmjs.org/k0-board/latest'
+const TIMEOUT = 5000
+const DAY = 24 * 60 * 60 * 1000
+
+// ── Which version is running ─────────────────────────────────────────────────
+
+let running
+
+/**
+ * The version in `package.json`, read once. A copy of k0 with no readable `package.json` should
+ * not be told it has jumped from nowhere to nowhere, so an unreadable one is `null` and every
+ * question below answers "nothing to say" rather than inventing a version.
+ */
+export function version() {
+  if (running !== undefined) return running
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'))
+    running = typeof pkg.version === 'string' ? pkg.version : null
+  } catch {
+    running = null
+  }
+  return running
+}
+
+/**
+ * Enough of semver to order two k0 versions, which is all that is ever compared here. A version
+ * neither side can read orders as equal: a mark saying "newer version available" that came out
+ * of a string nobody could parse would be worse than no mark.
+ */
+export function compareVersions(a, b) {
+  const x = parts(a)
+  const y = parts(b)
+  if (!x || !y) return 0
+  for (let i = 0; i < 3; i++) if (x.core[i] !== y.core[i]) return x.core[i] < y.core[i] ? -1 : 1
+  if (x.pre === y.pre) return 0
+  // A prerelease comes before the release it leads to: 0.5.0-rc.1 is older than 0.5.0.
+  if (!x.pre) return 1
+  if (!y.pre) return -1
+  return x.pre < y.pre ? -1 : 1
+}
+
+const parts = (v) => {
+  const m = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(String(v ?? '').trim())
+  return m ? { core: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] || '' } : null
+}
+
+// ── The version jump ─────────────────────────────────────────────────────────
+// k0 writes down the version it last ran under `update.last_seen`. When what is running differs
+// from what is written down, the board shows a discreet mark leading to the What's New page.
+
+/**
+ * What changed under the user, or `null` if nothing did. A board that has never recorded a
+ * version has just been installed: that is a first run, not a jump, and the only thing to do is
+ * write the version down so the next upgrade is one. The mark stays until `seen()` clears it —
+ * closing the tab is not the same as having read it.
+ */
+export function jump() {
+  const to = version()
+  if (!to) return null
+  const from = getPref('update.last_seen', null)
+  if (!from) {
+    setPref('update.last_seen', to)
+    return null
+  }
+  return from === to ? null : { from, to }
+}
+
+/** The user has seen what changed. Clears the mark by agreeing with what is running. */
+export function seen() {
+  const to = version()
+  if (to) setPref('update.last_seen', to)
+  return to
+}
+
+// ── What npm says ────────────────────────────────────────────────────────────
+
+/**
+ * The switch, in `~/.k0/config.json` next to the others. It is the one setting in k0 that a person
+ * has a real reason to look for — it is the only thing here that opens a socket — so it lives in
+ * the file they can open and not in the database, where reaching it would mean `sqlite3`.
+ */
+export function enabled() {
+  return settings.read().updateCheck
+}
+
+/**
+ * The last answer npm gave, or `null` when there is none to give — including when the check is
+ * switched off, because switching it off should take the mark off the board too, not merely
+ * stop the asking. The row itself is kept, so switching it back on shows what k0 already knew
+ * without waiting for another day to pass.
+ */
+export function latest() {
+  if (!enabled()) return null
+  const saved = read()
+  if (!saved.version) return null
+  const now = version()
+  return { version: saved.version, at: saved.at, newer: !!now && compareVersions(saved.version, now) > 0 }
+}
+
+let asking = null
+
+/**
+ * Ask npm, at most once a day. Returns what `latest()` would return, and never rejects.
+ *
+ * `fetch` is here so a test can answer without a socket — the same seam `K0_CLAUDE` gives
+ * `writer.js`, for the same reason: the one part of k0 that reaches outside must be provable
+ * without ever actually going there.
+ */
+export async function check({ force = false, fetch = globalThis.fetch } = {}) {
+  try {
+    if (!enabled()) return null
+    if (!force && Date.now() - read().asked < DAY) return latest()
+    // Two windows opening at once are one question, not two.
+    if (!asking) {
+      asking = ask(fetch).finally(() => {
+        asking = null
+      })
+    }
+    return await asking
+  } catch {
+    return null
+  }
+}
+
+async function ask(fetch) {
+  const saved = read()
+  const answer = await request(fetch)
+  // The attempt is recorded whether or not it worked, which is what "at most once a day" has to
+  // mean: a laptop with no network must not ask again on every poll. A failure leaves the last
+  // good answer in place rather than throwing it away — it is still the truest thing k0 knows.
+  remember({
+    version: answer || saved.version,
+    at: answer ? Date.now() : saved.at,
+    asked: Date.now(),
+  })
+  return latest()
+}
+
+async function request(fetch) {
+  try {
+    const res = await fetch(REGISTRY, {
+      // We asked npm, so we take an answer from npm and from nowhere else. A redirect somewhere
+      // is not an answer to this question.
+      redirect: 'error',
+      // `AbortSignal.timeout` does not hold the event loop open, so a slow registry cannot keep
+      // the server alive after somebody has stopped it.
+      signal: AbortSignal.timeout(TIMEOUT),
+      headers: { accept: 'application/json', 'user-agent': 'k0-board' },
+    })
+    if (!res.ok) return null
+    const body = await res.json()
+    const v = body?.version
+    return typeof v === 'string' && parts(v) ? v : null
+  } catch {
+    return null
+  }
+}
+
+/** `update.latest` holds one object: what npm said, when it said it, and when k0 last asked. */
+function read() {
+  try {
+    const saved = JSON.parse(getPref('update.latest', '') || '{}')
+    return {
+      version: typeof saved.version === 'string' ? saved.version : null,
+      at: Number(saved.at) || 0,
+      asked: Number(saved.asked) || 0,
+    }
+  } catch {
+    // A hand-edited preference is not a reason to stop working: it is a reason to ask again.
+    return { version: null, at: 0, asked: 0 }
+  }
+}
+
+const remember = (entry) => setPref('update.latest', JSON.stringify(entry))
+
+// ── The changelog, as data ───────────────────────────────────────────────────
+// What's New hands the model the entries between two versions. It is the model's job to say what
+// they mean in the user's own language, and this file's job to hand over exactly the right ones:
+// the range is arithmetic and must not be left to a model that would guess it.
+
+const HEADING = /^##\s+\[?([^\]]+?)\]?\s*(?:[-–—]\s*(\d{4}-\d{2}-\d{2}))?\s*$/
+const SECTION = /^###\s+(.+?)\s*$/
+const LINK = /^\[[^\]]+\]:\s/
+const BULLET = /^[-*]\s+(.*)$/
+
+/**
+ * `CHANGELOG.md` as `[{ version, date, intro, sections: { Added: [...], Fixed: [...] } }]`,
+ * newest first.
+ *
+ * One line of a section is one changelog entry, not one line of the file: the entries are wrapped
+ * by hand at a hundred columns and a model handed the halves separately would summarise the
+ * wrapping. `text` is there so a test can parse a changelog of its own.
+ *
+ * `sections` is an object keyed by the heading and not a list of `{ name, lines }` pairs, because
+ * both things that read it — the What's New page and the skill that writes the page — ask for a
+ * heading by name. Insertion order is the file's order, which is the order they are shown in.
+ */
+export function parseChangelog(text = null) {
+  const source = typeof text === 'string' ? text : readChangelog()
+  const entries = []
+  let entry = null
+  let section = null
+  let open = null // the section whose last entry is still collecting its wrapped lines
+
+  for (const raw of source.split('\n')) {
+    const line = raw.trimEnd()
+
+    const head = HEADING.exec(line)
+    if (head) {
+      entry = { version: head[1].trim(), date: head[2] || null, intro: [], sections: {} }
+      entries.push(entry)
+      section = null
+      open = null
+      continue
+    }
+    if (!entry) continue
+
+    const sub = SECTION.exec(line)
+    if (sub) {
+      // Keep a Changelog does not forbid the same heading twice under one version, and 0.2.0
+      // has `### Changed` twice. The second block joins the first rather than replacing it.
+      if (!entry.sections[sub[1]]) entry.sections[sub[1]] = []
+      section = entry.sections[sub[1]]
+      open = null
+      continue
+    }
+
+    // The reference links at the foot of the file belong to no version and must not be read as
+    // the last one's final entry.
+    if (LINK.test(line)) {
+      open = null
+      continue
+    }
+
+    const item = BULLET.exec(line)
+    if (item && section) {
+      section.push(item[1])
+      open = section
+      continue
+    }
+
+    if (!line.trim()) {
+      open = null
+      if (!section && entry.intro.length) entry.intro.push('')
+      continue
+    }
+
+    if (open && /^\s/.test(raw)) {
+      open[open.length - 1] += ` ${line.trim()}`
+      continue
+    }
+
+    // The paragraph a version opens with, before the first heading: it is the one place the
+    // changelog says what the release was about rather than what is in it.
+    if (!section) entry.intro.push(line.trim())
+  }
+
+  for (const e of entries) e.intro = e.intro.join('\n').trim()
+  return entries
+}
+
+/**
+ * The entries that separate two versions: everything after `from`, up to and including `to`.
+ * `from` is left out because the user already had it, and `to` is put in because it is what they
+ * have now. A missing end is an open one, so `entriesBetween('0.3.0')` is everything since.
+ *
+ * `[Unreleased]` never comes back: it has no version, so it sits in no range. A pair the wrong
+ * way round — somebody who went back a version — is read as the stretch between the two rather
+ * than as an empty answer, because the question is still "what is different".
+ */
+export function entriesBetween(fromVersion = null, toVersion = null, text = null) {
+  const entries = parseChangelog(text).filter((e) => parts(e.version))
+  let low = parts(fromVersion) ? fromVersion : null
+  let high = parts(toVersion) ? toVersion : null
+  if (low && high && compareVersions(low, high) > 0) [low, high] = [high, low]
+  const after = (e) => !low || compareVersions(e.version, low) > 0
+  const upTo = (e) => !high || compareVersions(e.version, high) <= 0
+  return entries.filter((e) => after(e) && upTo(e))
+}
+
+function readChangelog() {
+  try {
+    return fs.readFileSync(path.join(ROOT, 'CHANGELOG.md'), 'utf8')
+  } catch {
+    // The package ships its changelog, but a checkout mid-rename should show an empty What's New
+    // rather than fail the request that asked for it.
+    return ''
+  }
+}