kaizen-agent 1.33.0 → 1.34.0

package/README.md

@@ -2,11 +2,41 @@
 <img src="https://raw.githubusercontent.com/hfadhlullah/kaizen/main/assets/banner.png" alt="kaizen" width="760">
 </div>
 
-<p align="center"><b>See the plan before your AI starts. Get a second opinion when it is done.</b></p>
+<p align="center"><b>One tool to build and maintain your product with AI agents.</b><br>Requests in, a plan you approve, the work, an independent review, done.</p>
 
-**The problem:** an AI agent starts writing before you agree on what it should do, then grades its own work.
+<p align="center"><img src="assets/hero.gif" alt="Animated walkthrough of the real kaizen board with sample data. 1: a request gathered from a support sheet waits in the Icebox and is promoted. 2: it is an idea on the board, and Run opens Claude Code. 3: the agent works in the card's own terminal and writes a plan. 4: the plan panel shows what done and wrong mean, and it is approved. 5: it builds, then a reviewer that never saw the work reports a high finding, a double charge. 6: only that finding is ticked and fixed. 7: the reviewer re-checks it. 8: the run lands in Done, with the low finding left in the backlog." width="760"></p>
 
-**Kaizen:** it plans first and waits for your approval, then an agent that never saw the work reviews it.
+## The problem
+
+You ask an AI coding agent to retry a payment webhook when the bank times out. It starts editing at once, then says *"Done, tests pass."* The tests do pass. They were written by the same agent, from the same assumption: that a timeout means the charge failed. Sometimes the bank said yes and the reply got lost. Now a retry charges the customer twice, and nothing in the agent's report would make you look.
+
+None of this is a lack of intelligence. It is a missing workflow:
+
+| What goes wrong | What kaizen does |
+| :--- | :--- |
+| The agent decides what "done" means on its own, and you find out from the diff | It writes a plan first, including what *wrong* would look like, and waits for your approve or change |
+| The author grades its own work, so its blind spot is in the code *and* in the check | A second agent that never saw the work reviews it, from the request, the plan and the diff only |
+| Findings get fixed in an endless loop, or silently dropped | Serious findings are fixed and re-checked, at most twice; the rest come to you, and what is left goes to a backlog |
+| Requests live in sheets, docs and social posts; the plan in one chat, the review in another, the commit somewhere else | One board, from an icebox that gathers those requests to an idea, a plan, the build, the review, the fix loop and the commit, every step on file |
+
+Many assistants now ask for approval before they act, and some run a checker on their own draft. The difference here is *who* checks: a reviewer that shares the author's context shares its blind spots. Kaizen's reviewer starts cold, on purpose.
+
+Every stage is a file in `.kaizen/runs/<id>/`, so a run can be resumed later, by another session or another tool (Claude Code, Codex, Antigravity), and read back when someone asks why the code is the way it is.
+
+## Who it is for
+
+**Good fit if you:**
+
+- Build and maintain a product, and want one place for it: requests gathered from where they live, then plan, build, review and commit, without switching tools.
+- Already use an AI coding agent, and have caught it confidently wrong more than once.
+- Change things where a mistake is expensive: money, data, migrations, anything a customer sees.
+- Want to see and steer the plan before code is written, not reverse-engineer it from a diff.
+
+**Not for you if:**
+
+- Your changes are typos and one-liners. A run costs several times one prompt; kaizen takes a short path for small work, but it is not free.
+- You want the agent to ship without you. Kaizen is built to stop and ask.
+- You do not use an AI coding agent. Kaizen runs inside one; it is not one.
 
 ## Install
 

package/cli/browser.test.ts

@@ -31,6 +31,7 @@ test("an Instagram caption splits into author, date and the post's own words; no
   expect(authorOf("https://x.com/ana/status/1")).toBe("@ana");
   expect(authorOf("https://www.instagram.com/p/AAA")).toBe("");
   expect(noteOf({ text: "t", author: "@ana", link: "https://x.com/ana/status/1", date: "" })).toBe("@ana · https://x.com/ana/status/1");
+  expect(noteOf({ text: "t", author: "@ana", link: "https://x.com/ana/status/1", date: "", images: ["https://pbs.example/a.jpg"] })).toBe("@ana · https://x.com/ana/status/1 img https://pbs.example/a.jpg");
 });
 
 test("no browser, or a link that is not social, is a note and not a crash; no profile is made", async () => {

package/cli/browser.ts

@@ -9,7 +9,7 @@ import { join } from "node:path";
 import { home } from "./state.ts";
 import { socialOf, PLATFORMS } from "./sources.ts";
 
-export type Post = { text: string; author: string; link: string; date: string };
+export type Post = { text: string; author: string; link: string; date: string; images?: string[] };
 export type Read = { ok: true; posts: Post[] } | { ok: false; note: string };
 
 export const profileDir = () => join(home, ".kaizen", "browser");
@@ -131,7 +131,10 @@ const COLLECT = (re: RegExp) => `(() => {
     if (time) names.add(time.innerText.trim());
     const lines = (box.innerText || "").split("\\n").map((l) => l.trim()).filter(Boolean);
     const text = own ? own.innerText : lines.filter((l) => !names.has(l) && !junk.test(l) && !when.test(l)).join("\\n");
-    posts.set(k, { link: location.origin + k, text, date: time ? (time.getAttribute("datetime") || time.innerText) : (lines.find((l) => when.test(l)) || "") });
+    // A post's own pictures, not avatars or icons: 100px across or more, https only.
+    const images = [...box.querySelectorAll("img")].filter((i) => Math.max(i.naturalWidth, i.width) >= 100)
+      .map((i) => i.currentSrc || i.src).filter((u) => u.startsWith("https://")).slice(0, 4);
+    posts.set(k, { link: location.origin + k, text, images, date: time ? (time.getAttribute("datetime") || time.innerText) : (lines.find((l) => when.test(l)) || "") });
   }
   return [...posts.values()];
 })()`;
@@ -140,7 +143,7 @@ const COLLECT = (re: RegExp) => `(() => {
 const CAPTION = `(() => {
   const m = (p) => document.querySelector('meta[property="' + p + '"]')?.getAttribute("content") || "";
   const time = document.querySelector("time");
-  return { text: m("og:description") || m("og:title"), date: time ? (time.getAttribute("datetime") || time.innerText) : "" };
+  return { text: m("og:description") || m("og:title"), image: m("og:image"), date: time ? (time.getAttribute("datetime") || time.innerText) : "" };
 })()`;
 
 // A sign-in page. OFFERS also counts a page that offers to sign in, which tells only
@@ -158,7 +161,8 @@ export function caption(raw: string): { text: string; author: string; date: stri
 }
 
 // A post's notes, as the icebox shows them: `@author · link · date`.
-export const noteOf = (p: Post) => [p.author, p.link, p.date].filter(Boolean).join(" · ");
+// Its images follow as `img <url>` tokens, which ingest takes out of the notes.
+export const noteOf = (p: Post) => [p.author, p.link, p.date].filter(Boolean).join(" · ") + (p.images ?? []).map((u) => ` img ${u}`).join("");
 
 export const authorOf = (link: string) => { try { const p = new URL(link).pathname.split("/").filter(Boolean); return p[0]!.startsWith("@") ? p[0]! : p.length > 2 ? "@" + p[0] : ""; } catch { return ""; } };
 
@@ -217,7 +221,7 @@ export async function readPage(page: Page, url: string, platform: string, max =
   await page.go(url);
   if (!onPlatform(await page.js<string>("location.href")) || (await page.js<boolean>(WALL))) return { ok: false, note: signInNote(platform) };
   if (await page.js<boolean>(CHECK)) return { ok: false, note: checkNote(platform) };
-  const seen = new Map<string, { link: string; text: string; date: string; author?: string }>();
+  const seen = new Map<string, { link: string; text: string; date: string; author?: string; images?: string[] }>();
   for (let i = 0, still = 0; i < 12 && seen.size < max && still < 3; i++) {
     const before = seen.size;
     for (const p of await page.js<any[]>(COLLECT(re)) ?? []) if (!seen.has(p.link) && onPlatform(p.link)) seen.set(p.link, p);
@@ -233,13 +237,13 @@ export async function readPage(page: Page, url: string, platform: string, max =
       if (!onPlatform(p.link)) continue;
       await page.go(p.link);
       if (!onPlatform(await page.js<string>("location.href"))) continue;
-      const c = await page.js<{ text: string; date: string }>(CAPTION);
+      const c = await page.js<{ text: string; date: string; image: string }>(CAPTION);
       const cap = caption(c?.text ?? "");
-      read.push({ link: p.link, text: cap.text || p.text, date: c?.date || cap.date || p.date, author: cap.author });
+      read.push({ link: p.link, text: cap.text || p.text, date: c?.date || cap.date || p.date, author: cap.author, images: c?.image?.startsWith("https://") ? [c.image] : p.images });
     }
     found = read;
   }
-  const posts = found.map((p) => ({ link: p.link, author: p.author || authorOf(p.link), date: p.date, text: p.text.trim() })).filter((p) => p.text);
+  const posts = found.map((p) => ({ link: p.link, author: p.author || authorOf(p.link), date: p.date, text: p.text.trim(), ...(p.images?.length ? { images: p.images } : {}) })).filter((p) => p.text);
   if (!posts.length && (await page.js<boolean>(CHECK))) return { ok: false, note: checkNote(platform) };
   if (!posts.length && (await page.js<boolean>(OFFERS))) return { ok: false, note: signInNote(platform) };
   return { ok: true, posts };

package/cli/sources.test.ts

@@ -7,7 +7,7 @@ import { tmpdir } from "node:os";
 import { readInbox, writeInbox, replaceIdea, parseItem } from "./state.ts";
 import {
   readSources, addSource, removeSource, ingest, checkUrl, resolvesPublic, exportUrl, fetchText, split, sift,
-  gatherSource, gatherAll, due, SIGN_IN, UNREADABLE, CAP, moveSource, gatherDirs, writeSources,
+  gatherSource, gatherAll, due, takeImages, sheetImages, docImages, imagesUrl, SIGN_IN, UNREADABLE, CAP, moveSource, gatherDirs, writeSources,
   readIcebox, writeIcebox, promote, dismiss, markReplied, setCategory, socialUrl, socialOf, AGENT_ONLY, PLATFORMS,
 } from "./sources.ts";
 
@@ -101,6 +101,9 @@ test("a sheet row whose status is Done or Finish is skipped, not marked seen, an
   expect(split("sheet", "no\tdetail\tnotes\n1\tDark mode\tDone\n2\tExport\tfinish\n").map((i) => i.text)).toEqual(["Dark mode", "Export"]);
   // The whole cell names the column, not a word inside it.
   expect(split("sheet", "detail\tstatus notes\nDark mode\tDone\n")).toEqual([{ text: "Dark mode", notes: "Done" }]);
+  // A named column of page names loses to the column holding the requests.
+  expect(split("sheet", "NO\tPAGE\tDETAIL\tSTATUS\tNOTES\n1\tDash\tList\tDone\tAdd a chart to the list\n2\tPlan\tTimeline\t\tDropdown closes before an item can be picked\n3\tPlan\t\t\tRename the statuses to proposal and tender\n").map((i) => i.text))
+    .toEqual(["Dropdown closes before an item can be picked", "Rename the statuses to proposal and tender"]);
 
   addSource(state, SHEET);
   expect(await gatherSource(state, SHEET, text(sheet17(statuses)), pub)).toMatchObject({ ok: true, added: 5, note: "5 new, 4 done skipped" });
@@ -227,7 +230,7 @@ test("promote: one or several items become one open idea with where they came fr
   expect(readIcebox(state).map((s) => [s.status, s.idea])).toEqual([
     ["promoted", idea.text], ["promoted", idea.text], ["new", undefined],
   ]);
-  expect(promote(state, [a!.id])).toBe("already promoted or dismissed");
+  expect(promote(state, [a!.id])).toBe("already promoted");
   expect(promote(state, [c!.id], "  ")).toBeNull();   // blank text: the item's own
   expect(readInbox(state).at(-1)!.text).toBe("Tambah personel");
   expect(dismiss(state, ["nope0000"])).toBe("no such item");
@@ -631,10 +634,14 @@ test("the board refuses to add a source without a project, and moves one between
     expect(await ice({ op: "promote", dir: a, ids: ["nope0000"] })).toMatchObject({ status: 404 });
     expect(await ice({ op: "explode", dir: a, ids: [x!.id] })).toMatchObject({ status: 400 });
     expect(await ice({ op: "promote", dir: a, ids: [x!.id] })).toMatchObject({ status: 200 });
-    expect(await ice({ op: "promote", dir: a, ids: [x!.id] })).toMatchObject({ status: 409, error: "already promoted or dismissed" });
+    expect(await ice({ op: "promote", dir: a, ids: [x!.id] })).toMatchObject({ status: 409, error: "already promoted" });
     expect(await ice({ op: "dismiss", dir: a, ids: [y!.id] })).toMatchObject({ status: 200 });
     expect(readInbox(a).map((l) => l.text)).toEqual(["Dark mode"]);
     expect(readIcebox(a).map((s) => s.status)).toEqual(["promoted", "dismissed"]);
+    // A dismissed item can be restored, then dismissed or promoted again.
+    expect(await ice({ op: "restore", dir: a, ids: [y!.id] })).toMatchObject({ status: 200 });
+    expect(readIcebox(a).map((s) => s.status)).toEqual(["promoted", "new"]);
+    expect(await ice({ op: "dismiss", dir: a, ids: [y!.id] })).toMatchObject({ status: 200 });
     const listedIce = ((await (await fetch(at + "/sources")).json()) as any).icebox;
     expect(listedIce).toEqual([]);
   } finally { proc.kill(); await proc.exited; }
@@ -707,3 +714,53 @@ test("a GitHub issues link is read through the API: open issues, no pull request
   // JSON only when asked: a plain source answering JSON is still refused.
   expect(await fetchText(api, json, pub)).toEqual({ ok: false, note: UNREADABLE });
 });
+
+test("images ride beside a request, never in its key", () => {
+  addSource(state, SHEET);
+  expect(ingest(state, SHEET, [{ text: "Broken chart", notes: "@ana · https://x.com/ana/status/1 img https://pbs.example/a.jpg ", images: ["https://cdn.example/c.png", "http://plain/b.jpg"] }])).toEqual({ added: 1, held: 0 });
+  const [it] = readIcebox(state);
+  expect(it!.notes).toBe("@ana · https://x.com/ana/status/1");
+  expect(it!.images).toEqual(["https://cdn.example/c.png", "https://pbs.example/a.jpg"]);
+  // The same post read again with fresh CDN links is not new.
+  expect(ingest(state, SHEET, [{ text: "Broken chart", notes: "@ana · https://x.com/ana/status/1 img https://pbs.example/z.jpg" }])).toEqual({ added: 0, held: 0 });
+  expect(takeImages("a · b").images).toEqual([]);
+  expect(takeImages("img broken on page")).toEqual({ notes: "img broken on page", images: [] });
+});
+
+test("sheet and doc images land on their row and line", async () => {
+  const sheetHtml = `<table><tr><th></th><th>A</th></tr><tr><th id="0R0"><div class="row-header-wrapper">1</div></th><td>Request</td></tr>
+<tr><th id="0R1"><div>2</div></th><td>Fix login</td><td><div><img src="https://lh3.googleusercontent.com/x?a=1&amp;b=2"></div></td></tr>
+<tr><th id="0R2"><div>3</div></th><td>Dark mode</td></tr></table>`;
+  expect(sheetImages(sheetHtml)).toEqual(new Map([[2, ["https://lh3.googleusercontent.com/x?a=1&b=2"]]]));
+  expect(sift("sheet", "Request\nFix login\nDark mode\n", sheetImages(sheetHtml) as any).items).toEqual([
+    { text: "Fix login", images: ["https://lh3.googleusercontent.com/x?a=1&b=2"] }, { text: "Dark mode" }]);
+  const docHtml = `<html><body><p><span>Export is slow</span></p><p><img src="https://lh7.example/p.png"></p><li>Add &amp; remove tags</li></body></html>`;
+  expect(sift("doc", "Export is slow\n\n* Add & remove tags\n", docImages(docHtml) as any).items).toEqual([
+    { text: "Export is slow", images: ["https://lh7.example/p.png"] }, { text: "* Add & remove tags" }]);
+  expect(imagesUrl(SHEET)).toBe("https://docs.google.com/spreadsheets/d/abc123/htmlview/sheet?headers=true&gid=7");
+  expect(imagesUrl("https://docs.google.com/document/d/D0c_1/edit")).toBe("https://docs.google.com/document/d/D0c_1/export?format=html");
+  expect(imagesUrl("https://notes.example.com/raw/1")).toBeNull();
+  // A gather whose image page fails still gathers.
+  addSource(state, SHEET);
+  expect(await gatherSource(state, SHEET, text("Request\nFix login\n"), pub)).toMatchObject({ ok: true, added: 1 });
+});
+
+test("a waiting item takes fresh image links when gathered again", () => {
+  addSource(state, SHEET);
+  ingest(state, SHEET, [{ text: "Old request" }]);
+  ingest(state, SHEET, [{ text: "Old request", images: ["https://cdn.example/new.jpg"] }]);
+  expect(readIcebox(state)[0]!.images).toEqual(["https://cdn.example/new.jpg"]);
+  // No images read this time: the ones it has stay.
+  ingest(state, SHEET, [{ text: "Old request" }]);
+  expect(readIcebox(state)[0]!.images).toEqual(["https://cdn.example/new.jpg"]);
+  expect(sheetImages(`<tr><th id="0R4" class="row-headers-background"></th><td><img src="https://x.example/i.png"></td></tr>`)).toEqual(new Map([[5, ["https://x.example/i.png"]]]));
+});
+
+test("sheet images placed over the grid land on their anchored row", () => {
+  // The shape of a real htmlview/sheet page: rows in the table, floating images after it.
+  const html = `<table><tbody><tr><th id="0R0"><div>1</div></th><td>Request</td></tr><tr><th id="0R1"><div>2</div></th><td>Fix login</td></tr></tbody></table>`
+    + `<div id='embed_11' class='waffle-embedded-object-overlay'><img src='https://docs.google.com/sheets-images-rt/A=s2048' style='display: block;'></div>`
+    + `<div id='embed_22' class='waffle-embedded-object-overlay'><img src='https://docs.google.com/sheets-images-rt/B=s2048'></div>`
+    + `<script>posObj('0', 'embed_11', 1, 7, 14, 9);posObj('0', 'embed_22', 1, 7, 7, 316);</script>`;
+  expect(sheetImages(html)).toEqual(new Map([[2, ["https://docs.google.com/sheets-images-rt/A=s2048", "https://docs.google.com/sheets-images-rt/B=s2048"]]]));
+});

package/cli/sources.ts

@@ -134,7 +134,7 @@ function clean(raw: string, extra = ""): { text: string; lines: string[] } | nul
 // The icebox: everything gathered, held per project until a person or an agent
 // promotes it to an idea or dismisses it. Promoted and dismissed items stay, so the
 // same request never comes back.
-export type Signal = { id: string; text: string; notes?: string; source: string; category?: string; at: string; status: "new" | "promoted" | "dismissed"; idea?: string; replied?: string };
+export type Signal = { id: string; text: string; notes?: string; source: string; category?: string; at: string; status: "new" | "promoted" | "dismissed"; idea?: string; replied?: string; images?: string[] };
 
 const iceFile = (state: string) => join(state, "icebox.json");
 
@@ -168,9 +168,21 @@ function ideaKey(l: { text: string; notes?: string }): string | null {
   return normalise(l.text);
 }
 
+// Image links a source showed beside a request: https only, at most four. Kept apart
+// from the text and notes and out of the row's key, since Google and social CDN
+// addresses change between reads and would make every row new again.
+export const pics = (urls: string[] = []) => [...new Set(urls.filter((u) => /^https:\/\/\S+$/.test(u) && u.length <= 2000))].slice(0, 4);
+
+// `img <url>` tokens in an agent's notes (the --stdin path) are images, not notes.
+export function takeImages(notes = ""): { notes: string; images: string[] } {
+  const images: string[] = [];
+  notes = notes.replace(/(^|\s)img\s+(https:\/\/\S+)/g, (_, sp, u) => { images.push(u); return sp; }).replace(/[ \t]*·[ \t]*$/gm, "").trim();
+  return { notes, images: pics(images) };
+}
+
 // The single place outside text enters kaizen, and it enters the icebox, never Ideas.
 // Synchronous on purpose: nothing may run between reading the files and writing them.
-export function ingest(state: string, url: string, items: { text: string; notes?: string }[]): { added: number; held: number } {
+export function ingest(state: string, url: string, items: Item[]): { added: number; held: number } {
   const sources = readSources(state);
   const src = sources.find((s) => s.url === url);
   if (!src) throw new Error("not a listed source");
@@ -178,19 +190,28 @@ export function ingest(state: string, url: string, items: { text: string; notes?
   const known = new Set([...src.seen, ...readInbox(state).map(ideaKey).filter((k) => k !== null), ...ice.map((s) => rowKey(s.text, s.notes))]);
   const fresh: Signal[] = [];
   const seen: string[] = [];
-  let held = 0;
+  let held = 0, refreshed = false;
   for (const it of items) {
-    const c = clean(it.text, it.notes);
+    const got = takeImages(it.notes);
+    const images = pics([...(it.images ?? []), ...got.images]);
+    const c = clean(it.text, got.notes);
     if (!c) continue;
     const notes = c.lines.join("\n").slice(0, 2000);
     const key = rowKey(c.text, notes);
-    if (known.has(key)) { seen.push(key); continue; }
+    if (known.has(key)) {
+      seen.push(key);
+      // Image links expire (social CDNs) or arrive late (items gathered before images
+      // were read): an item still waiting takes the ones read now.
+      const old = images.length && ice.find((s) => s.status === "new" && s.source === url && rowKey(s.text, s.notes) === key);
+      if (old && String(old.images) !== String(images)) { old.images = images; refreshed = true; }
+      continue;
+    }
     if (fresh.length >= CAP) { held++; continue; }   // not marked seen: the next gather takes it
     known.add(key);
     seen.push(key);
-    fresh.push({ id: idOf(key), text: c.text, ...(notes ? { notes } : {}), source: url, ...(src.category ? { category: src.category } : {}), at: new Date().toISOString(), status: "new" });
+    fresh.push({ id: idOf(key), text: c.text, ...(notes ? { notes } : {}), source: url, ...(src.category ? { category: src.category } : {}), at: new Date().toISOString(), status: "new", ...(images.length ? { images } : {}) });
   }
-  if (fresh.length) writeIcebox(state, [...ice, ...fresh]);
+  if (fresh.length || refreshed) writeIcebox(state, [...ice, ...fresh]);
   // ponytail: seen only grows; trim to the newest few thousand if a source ever gets that long.
   src.seen = [...new Set([...src.seen, ...seen])];
   writeSources(state, sources);
@@ -207,7 +228,7 @@ export function promote(state: string, ids: string[], text?: string, details?: s
   const picked = ids.map((id) => ice.find((s) => s.id === id));
   if (!ids.length) return "no items named";
   if (picked.some((s) => !s)) return "no such item";
-  if (picked.some((s) => s!.status !== "new")) return "already promoted or dismissed";
+  if (picked.some((s) => s!.status === "promoted")) return "already promoted";
   const own = !!text?.trim();
   const c = clean(own ? text! : picked[0]!.text);
   if (!c) return "the idea text is too short";
@@ -227,6 +248,17 @@ export function promote(state: string, ids: string[], text?: string, details?: s
   return null;
 }
 
+// A dismissed item back to waiting.
+export function restore(state: string, ids: string[]): string | null {
+  const ice = readIcebox(state);
+  const picked = ids.map((id) => ice.find((s) => s.id === id));
+  if (!ids.length) return "no items named";
+  if (picked.some((s) => !s)) return "no such item";
+  for (const s of picked) if (s!.status === "dismissed") s!.status = "new";
+  writeIcebox(state, ice);
+  return null;
+}
+
 export function dismiss(state: string, ids: string[]): string | null {
   const ice = readIcebox(state);
   const picked = ids.map((id) => ice.find((s) => s.id === id));
@@ -308,6 +340,59 @@ export function exportUrl(raw: string): { url: string; kind: Kind } {
   return { url: raw, kind: "text" };
 }
 
+// Where a Google sheet or doc shows its images, which its text export drops. A
+// published sheet is left out.
+// ponytail: /d/e/ published sheets get no images; add pubhtml when one asks.
+export function imagesUrl(raw: string): string | null {
+  const u = new URL(raw);
+  if (u.hostname !== "docs.google.com") return null;
+  const t = exportUrl(raw);
+  if (t.kind === "sheet" && t.url.includes("/export?")) return t.url.replace("/export?format=tsv&", "/htmlview/sheet?headers=true&");
+  if (t.kind === "doc") return t.url.replace("format=txt", "format=html");
+  return null;
+}
+
+const srcs = (html: string) => [...html.matchAll(/<img\b[^>]*?\ssrc=(?:"([^"]+)"|'([^']+)')/gi)].map((m) => (m[1] ?? m[2])!.replace(/&amp;/g, "&"));
+const plain = (html: string) => html.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+const lineKey = (t: string) => normalise(t.replace(/^\s*[-*•●○■]\s*/, ""));
+
+// A sheet's htmlview: the images in each row, by the row number in its header cell.
+export function sheetImages(html: string): Map<number, string[]> {
+  const out = new Map<number, string[]>();
+  for (const tr of html.split(/<\/table>/i)[0]!.split(/<tr\b/i).slice(1)) {
+    // The header cell shows the row number; its id (`0R4`) counts from zero.
+    const shown = /<th\b[^>]*>(?:\s*<[^>]+>)*\s*(\d+)\s*</i.exec(tr)?.[1];
+    const id = /<th\b[^>]*\bid="\d+R(\d+)"/i.exec(tr)?.[1];
+    const row = shown ? Number(shown) : id ? Number(id) + 1 : 0;
+    const got = row ? srcs(tr) : [];
+    if (got.length) out.set(row, got);
+  }
+  // Images placed over the grid sit after the table, each in its own embed box, and
+  // the page anchors each box to a row with `posObj(sheet, 'embed_<id>', row, col, …)`,
+  // the row counted from zero.
+  const anchor = new Map([...html.matchAll(/posObj\(\s*'[^']*'\s*,\s*'(embed_\d+)'\s*,\s*(\d+)/g)].map((m) => [m[1]!, Number(m[2]) + 1]));
+  for (const box of html.split(/(?=<div\b[^>]*\bid=['"]embed_\d+['"])/i).slice(1)) {
+    const row = anchor.get(/id=['"](embed_\d+)['"]/.exec(box)![1]!);
+    const got = row ? srcs(box.split(/<div\b[^>]*\bid=['"](?!embed_)/i)[0]!) : [];
+    if (got.length) out.set(row!, [...(out.get(row!) ?? []), ...got]);
+  }
+  return out;
+}
+
+// A doc's html export: each paragraph's images, keyed by its text. An image on a line
+// of its own belongs to the paragraph above it.
+export function docImages(html: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  let last = "";
+  for (const part of html.split(/<\/(?:p|h\d|li)>/i)) {
+    const text = lineKey(plain(part.replace(/[\s\S]*<body[^>]*>/i, "")));
+    if (text) last = text;
+    const got = srcs(part);
+    if (got.length && last) out.set(last, [...(out.get(last) ?? []), ...got]);
+  }
+  return out;
+}
+
 export const SIGN_IN = 'Needs sign-in. Share it as "anyone with the link can view", or run /kaizen gather in your agent.';
 export const UNREADABLE = "Kaizen cannot read this page on its own. Run /kaizen gather in your agent.";
 const MAX_BYTES = 1_000_000;
@@ -316,7 +401,7 @@ type Fetch = (url: string, init: RequestInit) => Promise<Response>;
 
 // No cookie, no authorization, no redirect followed unchecked: every hop goes
 // through the same guard as the first address.
-export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Lookup = dnsLookup, json = false): Promise<{ ok: true; body: string } | { ok: false; note: string }> {
+export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Lookup = dnsLookup, json: boolean | "html" = false): Promise<{ ok: true; body: string } | { ok: false; note: string }> {
   const signal = AbortSignal.timeout(15000);
   for (let hop = 0; hop <= 5; hop++) {
     const why = checkUrl(url);
@@ -326,7 +411,7 @@ export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Loo
     const pub = await resolvesPublic(host, lookup);
     if (pub === null) return { ok: false, note: hop ? "The link redirected to an address that could not be found." : "The link's address could not be found. Check it for a typo." };
     if (!pub) return { ok: false, note: "Refused: not a public address." };
-    const res = await doFetch(url, { redirect: "manual", credentials: "omit", signal, headers: { accept: json ? "application/json" : "text/plain, text/*" } });
+    const res = await doFetch(url, { redirect: "manual", credentials: "omit", signal, headers: { accept: json === "html" ? "text/html" : json ? "application/json" : "text/plain, text/*" } });
     if (res.status >= 300 && res.status < 400) {
       const to = res.headers.get("location");
       if (!to) return { ok: false, note: `Redirect with nowhere to go (HTTP ${res.status}).` };
@@ -336,7 +421,7 @@ export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Loo
     if (res.status === 401 || res.status === 403) return { ok: false, note: SIGN_IN };
     if (!res.ok) return { ok: false, note: `The link answered HTTP ${res.status}.` };
     const type = (res.headers.get("content-type") ?? "").toLowerCase();
-    if (json ? !type.startsWith("application/json") : !type.startsWith("text/") || type.startsWith("text/html")) return { ok: false, note: UNREADABLE };
+    if (json === "html" ? !type.startsWith("text/html") : json ? !type.startsWith("application/json") : !type.startsWith("text/") || type.startsWith("text/html")) return { ok: false, note: UNREADABLE };
     // Read no further than the cap; a cut-off last line is dropped, not gathered half.
     const chunks: Uint8Array[] = [];
     let size = 0;
@@ -360,19 +445,22 @@ const wordy = (c: string) => c.length >= 3 && !datum(c);
 const STATUS = /^status$/i;
 const DONE = /^(done|finish|finished)$/i;
 
-type Item = { text: string; notes?: string };
+type Item = { text: string; notes?: string; images?: string[] };
 
 export const split = (kind: Kind, body: string): Item[] => sift(kind, body).items;
 
 // The requests, and how many rows were left out for their status. A row left out is
 // never handed to ingest, so it is not marked seen: reopened, it is gathered then.
-export function sift(kind: Kind, body: string): { items: Item[]; done: number } {
+// `pics`, when given, are the images found beside the rows: by sheet row number for a
+// sheet, by line text for a doc.
+export function sift(kind: Kind, body: string, pics?: Map<number | string, string[]>): { items: Item[]; done: number } {
+  const with_ = (it: Item, at: number | string): Item => { const p = pics?.get(at); return p?.length ? { ...it, images: p } : it; };
   // Pull requests come back from the issues API too; they are not requests. The notes
   // are the number and link only, so an edited body does not make the issue new.
   if (kind === "github") return { items: (JSON.parse(body) as any[]).filter((i) => !i.pull_request && typeof i.title === "string")
     .map((i) => ({ text: i.title, notes: `#${i.number} · ${i.html_url}` })), done: 0 };
   const rows = body.split(/\r?\n/);
-  if (kind !== "sheet") return { items: rows.filter((r) => r.trim()).map((text) => ({ text })), done: 0 };
+  if (kind !== "sheet") return { items: rows.filter((r) => r.trim()).map((text) => with_({ text }, lineKey(text))), done: 0 };
   const cells = rows.map((r) => r.split("\t").map((c) => c.trim()));
   const filled = cells.filter((row) => row.some(Boolean));
   // Sheets often open with blank rows or a title: the header is looked for in the
@@ -385,21 +473,27 @@ export function sift(kind: Kind, body: string): { items: Item[]; done: number }
   const head = filled.slice(0, 5).find((row) => !/^\d{1,3}[.)]?$/.test(row.find(Boolean) ?? "") && (named(row, HEADER) >= 0 || named(row, STATUS) >= 0));
   const data = head ? filled.slice(filled.indexOf(head) + 1) : filled;
   const status = head ? named(head, STATUS) : -1;
-  const known = head ? named(head, HEADER) : -1;
-  // No request column named: one column for the whole sheet, the one holding the most
-  // text that reads like a request. Never a cell per row, which takes `Open` or a name.
-  let col = known;
-  if (col < 0) for (let i = 0, most = 0; i < Math.max(0, ...data.map((row) => row.length)); i++) {
-    const n = i === status ? 0 : data.reduce((sum, row) => sum + (wordy(row[i] ?? "") ? row[i]!.length : 0), 0);
-    if (n > most) { most = n; col = i; }
-  }
+  // One column for the whole sheet, the one holding the most text that reads like a
+  // request. Never a cell per row, which takes `Open` or a name.
+  // Finished rows do not vote: their replies outweigh the requests still open.
+  const open = data.filter((row) => status < 0 || !DONE.test(row[status] ?? ""));
+  const text = (i: number) => i === status ? 0 : open.reduce((sum, row) => sum + (wordy(row[i] ?? "") ? row[i]!.length : 0), 0);
+  let wordiest = -1;
+  for (let i = 0, most = 0; i < Math.max(0, ...data.map((row) => row.length)); i++) if (text(i) > most) { most = text(i); wordiest = i; }
+  // A named column loses to one holding far more text: `DETAIL` naming the page while
+  // `NOTES` holds the request.
+  let known = head ? named(head, HEADER) : -1;
+  // ponytail: a named column with no wordy text at all keeps it (one-cell title rows, pinned by test).
+  if (known >= 0 && wordiest >= 0 && text(known) > 0 && text(wordiest) > 3 * text(known)) known = -1;
+  const col = known >= 0 ? known : wordiest;
   let done = 0;
   const items = data.flatMap((row) => {
     const text = row[col] ?? "";
     if (!text || (known < 0 && !wordy(text))) return [];
     if (status >= 0 && DONE.test(row[status] ?? "")) { done++; return []; }
     const rest = row.filter((c, i) => c && i !== col).join(" · ");
-    return [{ text, ...(rest ? { notes: rest } : {}) }];
+    // The export keeps every row from the top, so a row's index is its number less one.
+    return [with_({ text, ...(rest ? { notes: rest } : {}) }, cells.indexOf(row) + 1)];
   });
   return { items, done };
 }
@@ -433,9 +527,14 @@ export async function gatherSource(state: string, url: string, doFetch?: Fetch,
   }
   try {
     const target = exportUrl(url);
-    const got = await fetchText(target.url, doFetch, lookup, target.kind === "github");
+    // Images are extra, read alongside the text: a page that cannot be read for them
+    // leaves the gather as it was, and costs no time beyond the text's own.
+    const at = imagesUrl(url);
+    const [got, page] = await Promise.all([fetchText(target.url, doFetch, lookup, target.kind === "github"),
+      at ? fetchText(at, doFetch, lookup, "html").catch(() => null) : null]);
     if (got.ok) {
-      const { items, done } = sift(target.kind, got.body);
+      const found = page?.ok ? (target.kind === "sheet" ? sheetImages(page.body) : docImages(page.body)) : undefined;
+      const { items, done } = sift(target.kind, got.body, found as Map<number | string, string[]> | undefined);
       return record(state, url, ingest(state, url, items), target.kind === "github" ? undefined : got.body.split("\n").filter((r) => r.trim()).length, done);
     }
     const last = { at: new Date().toISOString(), ok: false, added: 0, note: got.note };

package/cli/state.test.ts

@@ -687,6 +687,16 @@ test("ownerOf: an idea's session belongs to the first run created after it, not
   expect(ownerOf(st, { ...rec, run: "2026-10-01-x" })).toBe("2026-10-01-x");
 });
 
+test("ownerOf: a run that recorded the launch's session id owns it, however its request is worded", () => {
+  const p = sessionProject(), st = join(p, ".kaizen");
+  newRun(p, "2026-10-02-reworded", "/kaizen something else entirely");
+  const f = join(st, "runs", "2026-10-02-reworded", "state.json");
+  writeFileSync(f, JSON.stringify({ ...JSON.parse(readFileSync(f, "utf8")), session: "abc" }));
+  const rec = { key: "k", run: null, text: "open it on my phone", cmd: "claude", sessionId: "abc", started: Date.now() };
+  expect(ownerOf(st, rec)).toBe("2026-10-02-reworded");
+  expect(ownerOf(st, { ...rec, sessionId: "other" })).toBe(null);
+});
+
 test("findTerminal records the agent's PID: a POSIX wrapper that execs it, a PowerShell prefix on Windows", () => {
   const keys = ["PATH", "HERDR_ENV", "TMUX", "TERMINAL", "SystemRoot", "windir", "ComSpec"];
   const saved = keys.map((k) => process.env[k]);
@@ -998,3 +1008,24 @@ test("the board refuses an upgrade from another origin", async () => {
     expect(r.status).toBe(403);
   } finally { proc.kill(); await proc.exited; rmSync(homeDir, { recursive: true, force: true }); }
 });
+
+// KAIZEN_WEB_HOSTS (tailscale serve): the listed host gets in, any other is still refused.
+test("the board answers only the hosts listed in KAIZEN_WEB_HOSTS", async () => {
+  const homeDir = mkdtempSync(join(tmpdir(), "kaizen-hosts-"));
+  for (const d of [join(homeDir, ".kaizen"), join(homeDir, ".claude")]) mkdirSync(d, { recursive: true });
+  const port = 20000 + Math.floor(Math.random() * 20000), repo = join(import.meta.dir, "..");
+  const proc = Bun.spawn([process.execPath, join(repo, "cli", "install.ts"), "web", "--port", String(port), "--no-open", "--foreground"], {
+    cwd: homeDir, env: { ...process.env, HOME: homeDir, USERPROFILE: homeDir, KAIZEN_HOME: repo, KAIZEN_WEB_HOSTS: " PC.tail1234.ts.net:443 , " }, stdout: "ignore", stderr: "ignore",
+  });
+  try {
+    const at = `http://127.0.0.1:${port}`;
+    for (let i = 0; ; i++) { try { await fetch(at + "/state"); break; } catch { if (i > 100) throw new Error("board did not start"); await Bun.sleep(50); } }
+    expect((await fetch(at + "/state", { headers: { host: "pc.tail1234.ts.net" } })).status).toBe(200);
+    expect((await fetch(at + "/state", { headers: { host: "evil.example" } })).status).toBe(403);
+    expect((await fetch(at + "/state", { headers: { host: "other.tail1234.ts.net" } })).status).toBe(403);
+    expect((await fetch(at + "/upgrade", { method: "POST", headers: { origin: "https://evil.example" } })).status).toBe(403);
+    const m = await fetch(at + "/manifest.webmanifest");
+    expect(m.status).toBe(200);
+    expect((await m.json()).display).toBe("standalone");
+  } finally { proc.kill(); await proc.exited; rmSync(homeDir, { recursive: true, force: true }); }
+});

package/cli/state.ts

@@ -1121,6 +1121,16 @@ export function readSessions(st: string): Session[] {
 // request holds the idea's text: one run per record, never every run that mentions it.
 export function ownerOf(st: string, s: Session): string | null {
   if (s.run) return s.run;
+  // The launch's own conversation id, recorded by the run at intake: holds however the
+  // request was worded. Text matching below is for tools that expose no id.
+  if (s.sessionId) {
+    try {
+      const mine = readdirSync(join(st, "runs")).filter((id) => {
+        try { return JSON.parse(readText(join(st, "runs", id, "state.json"))).session === s.sessionId; } catch { return false; }
+      }).sort();
+      if (mine.length) return mine[0]!;
+    } catch { /* no runs dir */ }
+  }
   const t = normalise(s.text);
   let best: string | null = null, at = Infinity;
   try {