kaizen-agent 1.33.1 → 1.34.0

package/cli/browser.test.ts

@@ -31,6 +31,7 @@ test("an Instagram caption splits into author, date and the post's own words; no
   expect(authorOf("https://x.com/ana/status/1")).toBe("@ana");
   expect(authorOf("https://www.instagram.com/p/AAA")).toBe("");
   expect(noteOf({ text: "t", author: "@ana", link: "https://x.com/ana/status/1", date: "" })).toBe("@ana · https://x.com/ana/status/1");
+  expect(noteOf({ text: "t", author: "@ana", link: "https://x.com/ana/status/1", date: "", images: ["https://pbs.example/a.jpg"] })).toBe("@ana · https://x.com/ana/status/1 img https://pbs.example/a.jpg");
 });
 
 test("no browser, or a link that is not social, is a note and not a crash; no profile is made", async () => {

package/cli/browser.ts

@@ -9,7 +9,7 @@ import { join } from "node:path";
 import { home } from "./state.ts";
 import { socialOf, PLATFORMS } from "./sources.ts";
 
-export type Post = { text: string; author: string; link: string; date: string };
+export type Post = { text: string; author: string; link: string; date: string; images?: string[] };
 export type Read = { ok: true; posts: Post[] } | { ok: false; note: string };
 
 export const profileDir = () => join(home, ".kaizen", "browser");
@@ -131,7 +131,10 @@ const COLLECT = (re: RegExp) => `(() => {
     if (time) names.add(time.innerText.trim());
     const lines = (box.innerText || "").split("\\n").map((l) => l.trim()).filter(Boolean);
     const text = own ? own.innerText : lines.filter((l) => !names.has(l) && !junk.test(l) && !when.test(l)).join("\\n");
-    posts.set(k, { link: location.origin + k, text, date: time ? (time.getAttribute("datetime") || time.innerText) : (lines.find((l) => when.test(l)) || "") });
+    // A post's own pictures, not avatars or icons: 100px across or more, https only.
+    const images = [...box.querySelectorAll("img")].filter((i) => Math.max(i.naturalWidth, i.width) >= 100)
+      .map((i) => i.currentSrc || i.src).filter((u) => u.startsWith("https://")).slice(0, 4);
+    posts.set(k, { link: location.origin + k, text, images, date: time ? (time.getAttribute("datetime") || time.innerText) : (lines.find((l) => when.test(l)) || "") });
   }
   return [...posts.values()];
 })()`;
@@ -140,7 +143,7 @@ const COLLECT = (re: RegExp) => `(() => {
 const CAPTION = `(() => {
   const m = (p) => document.querySelector('meta[property="' + p + '"]')?.getAttribute("content") || "";
   const time = document.querySelector("time");
-  return { text: m("og:description") || m("og:title"), date: time ? (time.getAttribute("datetime") || time.innerText) : "" };
+  return { text: m("og:description") || m("og:title"), image: m("og:image"), date: time ? (time.getAttribute("datetime") || time.innerText) : "" };
 })()`;
 
 // A sign-in page. OFFERS also counts a page that offers to sign in, which tells only
@@ -158,7 +161,8 @@ export function caption(raw: string): { text: string; author: string; date: stri
 }
 
 // A post's notes, as the icebox shows them: `@author · link · date`.
-export const noteOf = (p: Post) => [p.author, p.link, p.date].filter(Boolean).join(" · ");
+// Its images follow as `img <url>` tokens, which ingest takes out of the notes.
+export const noteOf = (p: Post) => [p.author, p.link, p.date].filter(Boolean).join(" · ") + (p.images ?? []).map((u) => ` img ${u}`).join("");
 
 export const authorOf = (link: string) => { try { const p = new URL(link).pathname.split("/").filter(Boolean); return p[0]!.startsWith("@") ? p[0]! : p.length > 2 ? "@" + p[0] : ""; } catch { return ""; } };
 
@@ -217,7 +221,7 @@ export async function readPage(page: Page, url: string, platform: string, max =
   await page.go(url);
   if (!onPlatform(await page.js<string>("location.href")) || (await page.js<boolean>(WALL))) return { ok: false, note: signInNote(platform) };
   if (await page.js<boolean>(CHECK)) return { ok: false, note: checkNote(platform) };
-  const seen = new Map<string, { link: string; text: string; date: string; author?: string }>();
+  const seen = new Map<string, { link: string; text: string; date: string; author?: string; images?: string[] }>();
   for (let i = 0, still = 0; i < 12 && seen.size < max && still < 3; i++) {
     const before = seen.size;
     for (const p of await page.js<any[]>(COLLECT(re)) ?? []) if (!seen.has(p.link) && onPlatform(p.link)) seen.set(p.link, p);
@@ -233,13 +237,13 @@ export async function readPage(page: Page, url: string, platform: string, max =
       if (!onPlatform(p.link)) continue;
       await page.go(p.link);
       if (!onPlatform(await page.js<string>("location.href"))) continue;
-      const c = await page.js<{ text: string; date: string }>(CAPTION);
+      const c = await page.js<{ text: string; date: string; image: string }>(CAPTION);
       const cap = caption(c?.text ?? "");
-      read.push({ link: p.link, text: cap.text || p.text, date: c?.date || cap.date || p.date, author: cap.author });
+      read.push({ link: p.link, text: cap.text || p.text, date: c?.date || cap.date || p.date, author: cap.author, images: c?.image?.startsWith("https://") ? [c.image] : p.images });
     }
     found = read;
   }
-  const posts = found.map((p) => ({ link: p.link, author: p.author || authorOf(p.link), date: p.date, text: p.text.trim() })).filter((p) => p.text);
+  const posts = found.map((p) => ({ link: p.link, author: p.author || authorOf(p.link), date: p.date, text: p.text.trim(), ...(p.images?.length ? { images: p.images } : {}) })).filter((p) => p.text);
   if (!posts.length && (await page.js<boolean>(CHECK))) return { ok: false, note: checkNote(platform) };
   if (!posts.length && (await page.js<boolean>(OFFERS))) return { ok: false, note: signInNote(platform) };
   return { ok: true, posts };

package/cli/sources.test.ts

@@ -7,7 +7,7 @@ import { tmpdir } from "node:os";
 import { readInbox, writeInbox, replaceIdea, parseItem } from "./state.ts";
 import {
   readSources, addSource, removeSource, ingest, checkUrl, resolvesPublic, exportUrl, fetchText, split, sift,
-  gatherSource, gatherAll, due, SIGN_IN, UNREADABLE, CAP, moveSource, gatherDirs, writeSources,
+  gatherSource, gatherAll, due, takeImages, sheetImages, docImages, imagesUrl, SIGN_IN, UNREADABLE, CAP, moveSource, gatherDirs, writeSources,
   readIcebox, writeIcebox, promote, dismiss, markReplied, setCategory, socialUrl, socialOf, AGENT_ONLY, PLATFORMS,
 } from "./sources.ts";
 
@@ -230,7 +230,7 @@ test("promote: one or several items become one open idea with where they came fr
   expect(readIcebox(state).map((s) => [s.status, s.idea])).toEqual([
     ["promoted", idea.text], ["promoted", idea.text], ["new", undefined],
   ]);
-  expect(promote(state, [a!.id])).toBe("already promoted or dismissed");
+  expect(promote(state, [a!.id])).toBe("already promoted");
   expect(promote(state, [c!.id], "  ")).toBeNull();   // blank text: the item's own
   expect(readInbox(state).at(-1)!.text).toBe("Tambah personel");
   expect(dismiss(state, ["nope0000"])).toBe("no such item");
@@ -634,10 +634,14 @@ test("the board refuses to add a source without a project, and moves one between
     expect(await ice({ op: "promote", dir: a, ids: ["nope0000"] })).toMatchObject({ status: 404 });
     expect(await ice({ op: "explode", dir: a, ids: [x!.id] })).toMatchObject({ status: 400 });
     expect(await ice({ op: "promote", dir: a, ids: [x!.id] })).toMatchObject({ status: 200 });
-    expect(await ice({ op: "promote", dir: a, ids: [x!.id] })).toMatchObject({ status: 409, error: "already promoted or dismissed" });
+    expect(await ice({ op: "promote", dir: a, ids: [x!.id] })).toMatchObject({ status: 409, error: "already promoted" });
     expect(await ice({ op: "dismiss", dir: a, ids: [y!.id] })).toMatchObject({ status: 200 });
     expect(readInbox(a).map((l) => l.text)).toEqual(["Dark mode"]);
     expect(readIcebox(a).map((s) => s.status)).toEqual(["promoted", "dismissed"]);
+    // A dismissed item can be restored, then dismissed or promoted again.
+    expect(await ice({ op: "restore", dir: a, ids: [y!.id] })).toMatchObject({ status: 200 });
+    expect(readIcebox(a).map((s) => s.status)).toEqual(["promoted", "new"]);
+    expect(await ice({ op: "dismiss", dir: a, ids: [y!.id] })).toMatchObject({ status: 200 });
     const listedIce = ((await (await fetch(at + "/sources")).json()) as any).icebox;
     expect(listedIce).toEqual([]);
   } finally { proc.kill(); await proc.exited; }
@@ -710,3 +714,53 @@ test("a GitHub issues link is read through the API: open issues, no pull request
   // JSON only when asked: a plain source answering JSON is still refused.
   expect(await fetchText(api, json, pub)).toEqual({ ok: false, note: UNREADABLE });
 });
+
+test("images ride beside a request, never in its key", () => {
+  addSource(state, SHEET);
+  expect(ingest(state, SHEET, [{ text: "Broken chart", notes: "@ana · https://x.com/ana/status/1 img https://pbs.example/a.jpg ", images: ["https://cdn.example/c.png", "http://plain/b.jpg"] }])).toEqual({ added: 1, held: 0 });
+  const [it] = readIcebox(state);
+  expect(it!.notes).toBe("@ana · https://x.com/ana/status/1");
+  expect(it!.images).toEqual(["https://cdn.example/c.png", "https://pbs.example/a.jpg"]);
+  // The same post read again with fresh CDN links is not new.
+  expect(ingest(state, SHEET, [{ text: "Broken chart", notes: "@ana · https://x.com/ana/status/1 img https://pbs.example/z.jpg" }])).toEqual({ added: 0, held: 0 });
+  expect(takeImages("a · b").images).toEqual([]);
+  expect(takeImages("img broken on page")).toEqual({ notes: "img broken on page", images: [] });
+});
+
+test("sheet and doc images land on their row and line", async () => {
+  const sheetHtml = `<table><tr><th></th><th>A</th></tr><tr><th id="0R0"><div class="row-header-wrapper">1</div></th><td>Request</td></tr>
+<tr><th id="0R1"><div>2</div></th><td>Fix login</td><td><div><img src="https://lh3.googleusercontent.com/x?a=1&amp;b=2"></div></td></tr>
+<tr><th id="0R2"><div>3</div></th><td>Dark mode</td></tr></table>`;
+  expect(sheetImages(sheetHtml)).toEqual(new Map([[2, ["https://lh3.googleusercontent.com/x?a=1&b=2"]]]));
+  expect(sift("sheet", "Request\nFix login\nDark mode\n", sheetImages(sheetHtml) as any).items).toEqual([
+    { text: "Fix login", images: ["https://lh3.googleusercontent.com/x?a=1&b=2"] }, { text: "Dark mode" }]);
+  const docHtml = `<html><body><p><span>Export is slow</span></p><p><img src="https://lh7.example/p.png"></p><li>Add &amp; remove tags</li></body></html>`;
+  expect(sift("doc", "Export is slow\n\n* Add & remove tags\n", docImages(docHtml) as any).items).toEqual([
+    { text: "Export is slow", images: ["https://lh7.example/p.png"] }, { text: "* Add & remove tags" }]);
+  expect(imagesUrl(SHEET)).toBe("https://docs.google.com/spreadsheets/d/abc123/htmlview/sheet?headers=true&gid=7");
+  expect(imagesUrl("https://docs.google.com/document/d/D0c_1/edit")).toBe("https://docs.google.com/document/d/D0c_1/export?format=html");
+  expect(imagesUrl("https://notes.example.com/raw/1")).toBeNull();
+  // A gather whose image page fails still gathers.
+  addSource(state, SHEET);
+  expect(await gatherSource(state, SHEET, text("Request\nFix login\n"), pub)).toMatchObject({ ok: true, added: 1 });
+});
+
+test("a waiting item takes fresh image links when gathered again", () => {
+  addSource(state, SHEET);
+  ingest(state, SHEET, [{ text: "Old request" }]);
+  ingest(state, SHEET, [{ text: "Old request", images: ["https://cdn.example/new.jpg"] }]);
+  expect(readIcebox(state)[0]!.images).toEqual(["https://cdn.example/new.jpg"]);
+  // No images read this time: the ones it has stay.
+  ingest(state, SHEET, [{ text: "Old request" }]);
+  expect(readIcebox(state)[0]!.images).toEqual(["https://cdn.example/new.jpg"]);
+  expect(sheetImages(`<tr><th id="0R4" class="row-headers-background"></th><td><img src="https://x.example/i.png"></td></tr>`)).toEqual(new Map([[5, ["https://x.example/i.png"]]]));
+});
+
+test("sheet images placed over the grid land on their anchored row", () => {
+  // The shape of a real htmlview/sheet page: rows in the table, floating images after it.
+  const html = `<table><tbody><tr><th id="0R0"><div>1</div></th><td>Request</td></tr><tr><th id="0R1"><div>2</div></th><td>Fix login</td></tr></tbody></table>`
+    + `<div id='embed_11' class='waffle-embedded-object-overlay'><img src='https://docs.google.com/sheets-images-rt/A=s2048' style='display: block;'></div>`
+    + `<div id='embed_22' class='waffle-embedded-object-overlay'><img src='https://docs.google.com/sheets-images-rt/B=s2048'></div>`
+    + `<script>posObj('0', 'embed_11', 1, 7, 14, 9);posObj('0', 'embed_22', 1, 7, 7, 316);</script>`;
+  expect(sheetImages(html)).toEqual(new Map([[2, ["https://docs.google.com/sheets-images-rt/A=s2048", "https://docs.google.com/sheets-images-rt/B=s2048"]]]));
+});

package/cli/sources.ts

@@ -134,7 +134,7 @@ function clean(raw: string, extra = ""): { text: string; lines: string[] } | nul
 // The icebox: everything gathered, held per project until a person or an agent
 // promotes it to an idea or dismisses it. Promoted and dismissed items stay, so the
 // same request never comes back.
-export type Signal = { id: string; text: string; notes?: string; source: string; category?: string; at: string; status: "new" | "promoted" | "dismissed"; idea?: string; replied?: string };
+export type Signal = { id: string; text: string; notes?: string; source: string; category?: string; at: string; status: "new" | "promoted" | "dismissed"; idea?: string; replied?: string; images?: string[] };
 
 const iceFile = (state: string) => join(state, "icebox.json");
 
@@ -168,9 +168,21 @@ function ideaKey(l: { text: string; notes?: string }): string | null {
   return normalise(l.text);
 }
 
+// Image links a source showed beside a request: https only, at most four. Kept apart
+// from the text and notes and out of the row's key, since Google and social CDN
+// addresses change between reads and would make every row new again.
+export const pics = (urls: string[] = []) => [...new Set(urls.filter((u) => /^https:\/\/\S+$/.test(u) && u.length <= 2000))].slice(0, 4);
+
+// `img <url>` tokens in an agent's notes (the --stdin path) are images, not notes.
+export function takeImages(notes = ""): { notes: string; images: string[] } {
+  const images: string[] = [];
+  notes = notes.replace(/(^|\s)img\s+(https:\/\/\S+)/g, (_, sp, u) => { images.push(u); return sp; }).replace(/[ \t]*·[ \t]*$/gm, "").trim();
+  return { notes, images: pics(images) };
+}
+
 // The single place outside text enters kaizen, and it enters the icebox, never Ideas.
 // Synchronous on purpose: nothing may run between reading the files and writing them.
-export function ingest(state: string, url: string, items: { text: string; notes?: string }[]): { added: number; held: number } {
+export function ingest(state: string, url: string, items: Item[]): { added: number; held: number } {
   const sources = readSources(state);
   const src = sources.find((s) => s.url === url);
   if (!src) throw new Error("not a listed source");
@@ -178,19 +190,28 @@ export function ingest(state: string, url: string, items: { text: string; notes?
   const known = new Set([...src.seen, ...readInbox(state).map(ideaKey).filter((k) => k !== null), ...ice.map((s) => rowKey(s.text, s.notes))]);
   const fresh: Signal[] = [];
   const seen: string[] = [];
-  let held = 0;
+  let held = 0, refreshed = false;
   for (const it of items) {
-    const c = clean(it.text, it.notes);
+    const got = takeImages(it.notes);
+    const images = pics([...(it.images ?? []), ...got.images]);
+    const c = clean(it.text, got.notes);
     if (!c) continue;
     const notes = c.lines.join("\n").slice(0, 2000);
     const key = rowKey(c.text, notes);
-    if (known.has(key)) { seen.push(key); continue; }
+    if (known.has(key)) {
+      seen.push(key);
+      // Image links expire (social CDNs) or arrive late (items gathered before images
+      // were read): an item still waiting takes the ones read now.
+      const old = images.length && ice.find((s) => s.status === "new" && s.source === url && rowKey(s.text, s.notes) === key);
+      if (old && String(old.images) !== String(images)) { old.images = images; refreshed = true; }
+      continue;
+    }
     if (fresh.length >= CAP) { held++; continue; }   // not marked seen: the next gather takes it
     known.add(key);
     seen.push(key);
-    fresh.push({ id: idOf(key), text: c.text, ...(notes ? { notes } : {}), source: url, ...(src.category ? { category: src.category } : {}), at: new Date().toISOString(), status: "new" });
+    fresh.push({ id: idOf(key), text: c.text, ...(notes ? { notes } : {}), source: url, ...(src.category ? { category: src.category } : {}), at: new Date().toISOString(), status: "new", ...(images.length ? { images } : {}) });
   }
-  if (fresh.length) writeIcebox(state, [...ice, ...fresh]);
+  if (fresh.length || refreshed) writeIcebox(state, [...ice, ...fresh]);
   // ponytail: seen only grows; trim to the newest few thousand if a source ever gets that long.
   src.seen = [...new Set([...src.seen, ...seen])];
   writeSources(state, sources);
@@ -207,7 +228,7 @@ export function promote(state: string, ids: string[], text?: string, details?: s
   const picked = ids.map((id) => ice.find((s) => s.id === id));
   if (!ids.length) return "no items named";
   if (picked.some((s) => !s)) return "no such item";
-  if (picked.some((s) => s!.status !== "new")) return "already promoted or dismissed";
+  if (picked.some((s) => s!.status === "promoted")) return "already promoted";
   const own = !!text?.trim();
   const c = clean(own ? text! : picked[0]!.text);
   if (!c) return "the idea text is too short";
@@ -227,6 +248,17 @@ export function promote(state: string, ids: string[], text?: string, details?: s
   return null;
 }
 
+// A dismissed item back to waiting.
+export function restore(state: string, ids: string[]): string | null {
+  const ice = readIcebox(state);
+  const picked = ids.map((id) => ice.find((s) => s.id === id));
+  if (!ids.length) return "no items named";
+  if (picked.some((s) => !s)) return "no such item";
+  for (const s of picked) if (s!.status === "dismissed") s!.status = "new";
+  writeIcebox(state, ice);
+  return null;
+}
+
 export function dismiss(state: string, ids: string[]): string | null {
   const ice = readIcebox(state);
   const picked = ids.map((id) => ice.find((s) => s.id === id));
@@ -308,6 +340,59 @@ export function exportUrl(raw: string): { url: string; kind: Kind } {
   return { url: raw, kind: "text" };
 }
 
+// Where a Google sheet or doc shows its images, which its text export drops. A
+// published sheet is left out.
+// ponytail: /d/e/ published sheets get no images; add pubhtml when one asks.
+export function imagesUrl(raw: string): string | null {
+  const u = new URL(raw);
+  if (u.hostname !== "docs.google.com") return null;
+  const t = exportUrl(raw);
+  if (t.kind === "sheet" && t.url.includes("/export?")) return t.url.replace("/export?format=tsv&", "/htmlview/sheet?headers=true&");
+  if (t.kind === "doc") return t.url.replace("format=txt", "format=html");
+  return null;
+}
+
+const srcs = (html: string) => [...html.matchAll(/<img\b[^>]*?\ssrc=(?:"([^"]+)"|'([^']+)')/gi)].map((m) => (m[1] ?? m[2])!.replace(/&amp;/g, "&"));
+const plain = (html: string) => html.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+const lineKey = (t: string) => normalise(t.replace(/^\s*[-*•●○■]\s*/, ""));
+
+// A sheet's htmlview: the images in each row, by the row number in its header cell.
+export function sheetImages(html: string): Map<number, string[]> {
+  const out = new Map<number, string[]>();
+  for (const tr of html.split(/<\/table>/i)[0]!.split(/<tr\b/i).slice(1)) {
+    // The header cell shows the row number; its id (`0R4`) counts from zero.
+    const shown = /<th\b[^>]*>(?:\s*<[^>]+>)*\s*(\d+)\s*</i.exec(tr)?.[1];
+    const id = /<th\b[^>]*\bid="\d+R(\d+)"/i.exec(tr)?.[1];
+    const row = shown ? Number(shown) : id ? Number(id) + 1 : 0;
+    const got = row ? srcs(tr) : [];
+    if (got.length) out.set(row, got);
+  }
+  // Images placed over the grid sit after the table, each in its own embed box, and
+  // the page anchors each box to a row with `posObj(sheet, 'embed_<id>', row, col, …)`,
+  // the row counted from zero.
+  const anchor = new Map([...html.matchAll(/posObj\(\s*'[^']*'\s*,\s*'(embed_\d+)'\s*,\s*(\d+)/g)].map((m) => [m[1]!, Number(m[2]) + 1]));
+  for (const box of html.split(/(?=<div\b[^>]*\bid=['"]embed_\d+['"])/i).slice(1)) {
+    const row = anchor.get(/id=['"](embed_\d+)['"]/.exec(box)![1]!);
+    const got = row ? srcs(box.split(/<div\b[^>]*\bid=['"](?!embed_)/i)[0]!) : [];
+    if (got.length) out.set(row!, [...(out.get(row!) ?? []), ...got]);
+  }
+  return out;
+}
+
+// A doc's html export: each paragraph's images, keyed by its text. An image on a line
+// of its own belongs to the paragraph above it.
+export function docImages(html: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  let last = "";
+  for (const part of html.split(/<\/(?:p|h\d|li)>/i)) {
+    const text = lineKey(plain(part.replace(/[\s\S]*<body[^>]*>/i, "")));
+    if (text) last = text;
+    const got = srcs(part);
+    if (got.length && last) out.set(last, [...(out.get(last) ?? []), ...got]);
+  }
+  return out;
+}
+
 export const SIGN_IN = 'Needs sign-in. Share it as "anyone with the link can view", or run /kaizen gather in your agent.';
 export const UNREADABLE = "Kaizen cannot read this page on its own. Run /kaizen gather in your agent.";
 const MAX_BYTES = 1_000_000;
@@ -316,7 +401,7 @@ type Fetch = (url: string, init: RequestInit) => Promise<Response>;
 
 // No cookie, no authorization, no redirect followed unchecked: every hop goes
 // through the same guard as the first address.
-export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Lookup = dnsLookup, json = false): Promise<{ ok: true; body: string } | { ok: false; note: string }> {
+export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Lookup = dnsLookup, json: boolean | "html" = false): Promise<{ ok: true; body: string } | { ok: false; note: string }> {
   const signal = AbortSignal.timeout(15000);
   for (let hop = 0; hop <= 5; hop++) {
     const why = checkUrl(url);
@@ -326,7 +411,7 @@ export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Loo
     const pub = await resolvesPublic(host, lookup);
     if (pub === null) return { ok: false, note: hop ? "The link redirected to an address that could not be found." : "The link's address could not be found. Check it for a typo." };
     if (!pub) return { ok: false, note: "Refused: not a public address." };
-    const res = await doFetch(url, { redirect: "manual", credentials: "omit", signal, headers: { accept: json ? "application/json" : "text/plain, text/*" } });
+    const res = await doFetch(url, { redirect: "manual", credentials: "omit", signal, headers: { accept: json === "html" ? "text/html" : json ? "application/json" : "text/plain, text/*" } });
     if (res.status >= 300 && res.status < 400) {
       const to = res.headers.get("location");
       if (!to) return { ok: false, note: `Redirect with nowhere to go (HTTP ${res.status}).` };
@@ -336,7 +421,7 @@ export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Loo
     if (res.status === 401 || res.status === 403) return { ok: false, note: SIGN_IN };
     if (!res.ok) return { ok: false, note: `The link answered HTTP ${res.status}.` };
     const type = (res.headers.get("content-type") ?? "").toLowerCase();
-    if (json ? !type.startsWith("application/json") : !type.startsWith("text/") || type.startsWith("text/html")) return { ok: false, note: UNREADABLE };
+    if (json === "html" ? !type.startsWith("text/html") : json ? !type.startsWith("application/json") : !type.startsWith("text/") || type.startsWith("text/html")) return { ok: false, note: UNREADABLE };
     // Read no further than the cap; a cut-off last line is dropped, not gathered half.
     const chunks: Uint8Array[] = [];
     let size = 0;
@@ -360,19 +445,22 @@ const wordy = (c: string) => c.length >= 3 && !datum(c);
 const STATUS = /^status$/i;
 const DONE = /^(done|finish|finished)$/i;
 
-type Item = { text: string; notes?: string };
+type Item = { text: string; notes?: string; images?: string[] };
 
 export const split = (kind: Kind, body: string): Item[] => sift(kind, body).items;
 
 // The requests, and how many rows were left out for their status. A row left out is
 // never handed to ingest, so it is not marked seen: reopened, it is gathered then.
-export function sift(kind: Kind, body: string): { items: Item[]; done: number } {
+// `pics`, when given, are the images found beside the rows: by sheet row number for a
+// sheet, by line text for a doc.
+export function sift(kind: Kind, body: string, pics?: Map<number | string, string[]>): { items: Item[]; done: number } {
+  const with_ = (it: Item, at: number | string): Item => { const p = pics?.get(at); return p?.length ? { ...it, images: p } : it; };
   // Pull requests come back from the issues API too; they are not requests. The notes
   // are the number and link only, so an edited body does not make the issue new.
   if (kind === "github") return { items: (JSON.parse(body) as any[]).filter((i) => !i.pull_request && typeof i.title === "string")
     .map((i) => ({ text: i.title, notes: `#${i.number} · ${i.html_url}` })), done: 0 };
   const rows = body.split(/\r?\n/);
-  if (kind !== "sheet") return { items: rows.filter((r) => r.trim()).map((text) => ({ text })), done: 0 };
+  if (kind !== "sheet") return { items: rows.filter((r) => r.trim()).map((text) => with_({ text }, lineKey(text))), done: 0 };
   const cells = rows.map((r) => r.split("\t").map((c) => c.trim()));
   const filled = cells.filter((row) => row.some(Boolean));
   // Sheets often open with blank rows or a title: the header is looked for in the
@@ -404,7 +492,8 @@ export function sift(kind: Kind, body: string): { items: Item[]; done: number }
     if (!text || (known < 0 && !wordy(text))) return [];
     if (status >= 0 && DONE.test(row[status] ?? "")) { done++; return []; }
     const rest = row.filter((c, i) => c && i !== col).join(" · ");
-    return [{ text, ...(rest ? { notes: rest } : {}) }];
+    // The export keeps every row from the top, so a row's index is its number less one.
+    return [with_({ text, ...(rest ? { notes: rest } : {}) }, cells.indexOf(row) + 1)];
   });
   return { items, done };
 }
@@ -438,9 +527,14 @@ export async function gatherSource(state: string, url: string, doFetch?: Fetch,
   }
   try {
     const target = exportUrl(url);
-    const got = await fetchText(target.url, doFetch, lookup, target.kind === "github");
+    // Images are extra, read alongside the text: a page that cannot be read for them
+    // leaves the gather as it was, and costs no time beyond the text's own.
+    const at = imagesUrl(url);
+    const [got, page] = await Promise.all([fetchText(target.url, doFetch, lookup, target.kind === "github"),
+      at ? fetchText(at, doFetch, lookup, "html").catch(() => null) : null]);
     if (got.ok) {
-      const { items, done } = sift(target.kind, got.body);
+      const found = page?.ok ? (target.kind === "sheet" ? sheetImages(page.body) : docImages(page.body)) : undefined;
+      const { items, done } = sift(target.kind, got.body, found as Map<number | string, string[]> | undefined);
       return record(state, url, ingest(state, url, items), target.kind === "github" ? undefined : got.body.split("\n").filter((r) => r.trim()).length, done);
     }
     const last = { at: new Date().toISOString(), ok: false, added: 0, note: got.note };

package/cli/state.test.ts

@@ -687,6 +687,16 @@ test("ownerOf: an idea's session belongs to the first run created after it, not
   expect(ownerOf(st, { ...rec, run: "2026-10-01-x" })).toBe("2026-10-01-x");
 });
 
+test("ownerOf: a run that recorded the launch's session id owns it, however its request is worded", () => {
+  const p = sessionProject(), st = join(p, ".kaizen");
+  newRun(p, "2026-10-02-reworded", "/kaizen something else entirely");
+  const f = join(st, "runs", "2026-10-02-reworded", "state.json");
+  writeFileSync(f, JSON.stringify({ ...JSON.parse(readFileSync(f, "utf8")), session: "abc" }));
+  const rec = { key: "k", run: null, text: "open it on my phone", cmd: "claude", sessionId: "abc", started: Date.now() };
+  expect(ownerOf(st, rec)).toBe("2026-10-02-reworded");
+  expect(ownerOf(st, { ...rec, sessionId: "other" })).toBe(null);
+});
+
 test("findTerminal records the agent's PID: a POSIX wrapper that execs it, a PowerShell prefix on Windows", () => {
   const keys = ["PATH", "HERDR_ENV", "TMUX", "TERMINAL", "SystemRoot", "windir", "ComSpec"];
   const saved = keys.map((k) => process.env[k]);
@@ -998,3 +1008,24 @@ test("the board refuses an upgrade from another origin", async () => {
     expect(r.status).toBe(403);
   } finally { proc.kill(); await proc.exited; rmSync(homeDir, { recursive: true, force: true }); }
 });
+
+// KAIZEN_WEB_HOSTS (tailscale serve): the listed host gets in, any other is still refused.
+test("the board answers only the hosts listed in KAIZEN_WEB_HOSTS", async () => {
+  const homeDir = mkdtempSync(join(tmpdir(), "kaizen-hosts-"));
+  for (const d of [join(homeDir, ".kaizen"), join(homeDir, ".claude")]) mkdirSync(d, { recursive: true });
+  const port = 20000 + Math.floor(Math.random() * 20000), repo = join(import.meta.dir, "..");
+  const proc = Bun.spawn([process.execPath, join(repo, "cli", "install.ts"), "web", "--port", String(port), "--no-open", "--foreground"], {
+    cwd: homeDir, env: { ...process.env, HOME: homeDir, USERPROFILE: homeDir, KAIZEN_HOME: repo, KAIZEN_WEB_HOSTS: " PC.tail1234.ts.net:443 , " }, stdout: "ignore", stderr: "ignore",
+  });
+  try {
+    const at = `http://127.0.0.1:${port}`;
+    for (let i = 0; ; i++) { try { await fetch(at + "/state"); break; } catch { if (i > 100) throw new Error("board did not start"); await Bun.sleep(50); } }
+    expect((await fetch(at + "/state", { headers: { host: "pc.tail1234.ts.net" } })).status).toBe(200);
+    expect((await fetch(at + "/state", { headers: { host: "evil.example" } })).status).toBe(403);
+    expect((await fetch(at + "/state", { headers: { host: "other.tail1234.ts.net" } })).status).toBe(403);
+    expect((await fetch(at + "/upgrade", { method: "POST", headers: { origin: "https://evil.example" } })).status).toBe(403);
+    const m = await fetch(at + "/manifest.webmanifest");
+    expect(m.status).toBe(200);
+    expect((await m.json()).display).toBe("standalone");
+  } finally { proc.kill(); await proc.exited; rmSync(homeDir, { recursive: true, force: true }); }
+});

package/cli/state.ts

@@ -1121,6 +1121,16 @@ export function readSessions(st: string): Session[] {
 // request holds the idea's text: one run per record, never every run that mentions it.
 export function ownerOf(st: string, s: Session): string | null {
   if (s.run) return s.run;
+  // The launch's own conversation id, recorded by the run at intake: holds however the
+  // request was worded. Text matching below is for tools that expose no id.
+  if (s.sessionId) {
+    try {
+      const mine = readdirSync(join(st, "runs")).filter((id) => {
+        try { return JSON.parse(readText(join(st, "runs", id, "state.json"))).session === s.sessionId; } catch { return false; }
+      }).sort();
+      if (mine.length) return mine[0]!;
+    } catch { /* no runs dir */ }
+  }
   const t = normalise(s.text);
   let best: string | null = null, at = Infinity;
   try {

package/cli/web.ts

@@ -10,7 +10,7 @@ import {
   launchMode, readSessions, ownerOf, resumePrompt, runAgent, firstSession,
 } from "./state.ts";
 import { attachPty, writePty, resizePty, ptyState, ptyKeys, adoptLoginEnv } from "./pty.ts";
-import { readSources, addSource, removeSource, moveSource, setCategory, readIcebox, promote, dismiss, markReplied, gatherSource, gatherAll, gatherDirs, due, socialUrl, socialOf } from "./sources.ts";
+import { readSources, addSource, removeSource, moveSource, setCategory, readIcebox, promote, dismiss, restore, markReplied, gatherSource, gatherAll, gatherDirs, due, socialUrl, socialOf } from "./sources.ts";
 import * as chatgpt from "./chatgpt.ts";
 import { postLink, sendReply } from "./browser.ts";
 import { listNotes, saveNote, renameNote, deleteNote, boardIndex, linksTo } from "./notes.ts";
@@ -130,6 +130,11 @@ export async function web(repoDir: string, opts: Opts = {}) {
     : [state]
   ).filter((d, i, arr) => arr.indexOf(d) === i && existsSync(d));
 
+  // Hostnames the user put in KAIZEN_WEB_HOSTS (e.g. a `tailscale serve` name):
+  // their explicit opt-in, matched exactly, empty when unset.
+  const extraHosts = new Set((process.env.KAIZEN_WEB_HOSTS ?? "").split(",")
+    .map((s) => s.trim().toLowerCase().replace(/:\d+$/, "")).filter(Boolean));
+
   // Any tab on this machine can reach loopback. GET only reads the user's own
   // files, but a POST from a page on the wider web must not write them.
   const local = (req: Request) => {
@@ -137,7 +142,7 @@ export async function web(repoDir: string, opts: Opts = {}) {
     if (!origin) return true;                      // curl, same-origin fetch on old browsers
     try {
       const h = new URL(origin).hostname;
-      return h === "127.0.0.1" || h === "localhost" || h === "[::1]" || h === "::1";
+      return h === "127.0.0.1" || h === "localhost" || h === "[::1]" || h === "::1" || extraHosts.has(h);
     } catch { return false; }
   };
   const json = (body: unknown, status = 200) =>
@@ -281,8 +286,8 @@ export async function web(repoDir: string, opts: Opts = {}) {
     async fetch(req, srv) {
       // Host first: a hostname rebound to 127.0.0.1 by an attacker's DNS still
       // arrives with that hostname in Host, and gets nothing.
-      const hostname = (req.headers.get("host") ?? "").replace(/:\d+$/, "");
-      if (hostname !== "127.0.0.1" && hostname !== "localhost") return new Response("forbidden", { status: 403 });
+      const hostname = (req.headers.get("host") ?? "").toLowerCase().replace(/:\d+$/, "");
+      if (hostname !== "127.0.0.1" && hostname !== "localhost" && !extraHosts.has(hostname)) return new Response("forbidden", { status: 403 });
       const url = new URL(req.url);
       const path = url.pathname;
 
@@ -355,6 +360,15 @@ export async function web(repoDir: string, opts: Opts = {}) {
         return new Response(Bun.file(LOGO), { headers: { "content-type": "image/png", "cache-control": "max-age=86400" } });
       }
 
+      // Lets a phone add the board to its home screen as a standalone app.
+      if (req.method === "GET" && path === "/manifest.webmanifest") {
+        return new Response(JSON.stringify({
+          name: "kaizen", short_name: "kaizen", start_url: "/", scope: "/", display: "standalone",
+          background_color: "#0c162f", theme_color: "#0c162f",
+          icons: [{ src: "/logo.png", sizes: "1024x1024", type: "image/png", purpose: "any" }],
+        }), { headers: { "content-type": "application/manifest+json" } });
+      }
+
       if (req.method === "GET" && path === "/state") {
         const all = url.searchParams.get("all") === "1";
         // Before the project list: it registers folders that turn out to be set up.
@@ -417,16 +431,21 @@ export async function web(repoDir: string, opts: Opts = {}) {
         // says which project it belongs to. Nothing is assumed from where the board started.
         const dir = url.searchParams.get("dir");
         if (dir && !states(true).includes(dir)) return bad("unknown state dir", 404);
-        const sources = [], icebox = [], failed = [];
+        const sources = [], icebox = [], dismissed = [], failed = [];
         for (const d of dir ? [dir] : states(true)) {
           // The seen list is bookkeeping, not something the page shows.
           try { sources.push(...readSources(d).map(({ seen, ...s }) => ({ ...s, social: socialOf(s.url), dir: d, project: label(d) }))); }
           catch { failed.push(label(d)); }
           // Only what still waits for a decision; promoted and dismissed items are record.
-          try { icebox.push(...readIcebox(d).filter((s) => s.status === "new").map((s) => ({ ...s, post: postLink(s.notes), dir: d, project: label(d) }))); }
+          // Dismissed ones come apart, for the Dismissed category, where they can be restored.
+          try {
+            const all = readIcebox(d).map((s) => ({ ...s, post: postLink(s.notes), dir: d, project: label(d) }));
+            icebox.push(...all.filter((s) => s.status === "new"));
+            dismissed.push(...all.filter((s) => s.status === "dismissed"));
+          }
           catch { failed.push(label(d) + " (icebox)"); }
         }
-        return json({ sources, icebox, failed, every: await every(), gatherer: { use: await setting("sources.agent"), ...chatgpt.status() } });
+        return json({ sources, icebox, dismissed, failed, every: await every(), gatherer: { use: await setting("sources.agent"), ...chatgpt.status() } });
       }
 
       // The Run form's choices for one project: installed tools and their models.
@@ -690,7 +709,7 @@ export async function web(repoDir: string, opts: Opts = {}) {
           const ids = Array.isArray(body.ids) ? body.ids.filter((i: unknown) => typeof i === "string") : [];
           try {
             const why = body.op === "promote" ? promote(body.dir, ids, typeof body.text === "string" ? body.text : undefined, typeof body.details === "string" ? body.details : undefined)
-              : body.op === "dismiss" ? dismiss(body.dir, ids) : "unknown op";
+              : body.op === "dismiss" ? dismiss(body.dir, ids) : body.op === "restore" ? restore(body.dir, ids) : "unknown op";
             if (why) return bad(why, why === "no such item" ? 404 : why === "unknown op" ? 400 : 409);
           } catch (e) { return bad((e as Error).message, 500); }
           changed();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kaizen-agent",
-  "version": "1.33.1",
+  "version": "1.34.0",
   "description": "Staged workflow for AI agents — code, writing, research, operations: plan, human approval, build, independent review, bounded fix loop.",
   "type": "module",
   "bin": {

package/skills/kaizen/gather.md

@@ -31,7 +31,10 @@ cannot judge on its own.
    account or a key the user has not set up for this.
 3. Hand what you read to kaizen. With your file-writing tool, not the shell, write the
    requests to a new temporary file outside the project, under a name you choose: one
-   request per line, optionally a tab and then notes for that request. Leave out any
+   request per line, optionally a tab and then notes for that request. A picture the source
+   shows beside a request goes in its notes as `img https://its-address`, one token per
+   image; kaizen keeps those as the item's images. Lines from `kaizen gather --posts`
+   already carry theirs: copy them unchanged. Leave out any
    request the source marks Done or Finish. Then run:
 
    ```

package/skills/kaizen/spec.md

@@ -86,7 +86,9 @@ Record the track in `state.json` as `track`, with the three answers written into
 
 Create the run id as `YYYY-MM-DD-<short-kebab-slug>`. Write the request verbatim —
 do not summarize it, since later stages read this instead of the conversation and a
-summary is where requirements quietly disappear.
+summary is where requirements quietly disappear. The board also finds a run's card by
+this text: a request that does not contain the user's words leaves their idea as a
+second card. Context you add goes below the verbatim text, never in place of it.
 
 Verbatim includes the mess. Requests arrive as thinking out loud: half-formed,
 out of order, self-correcting, with the decisive constraint tucked into an aside near
@@ -110,6 +112,8 @@ Write into `00-request.md`: the verbatim request, the deliverable, what done mea
 and what wrong means. Record in `state.json`: `id`, `mode`, `runner`, `agent`, `track`,
 `stage: "plan"`, `awaiting: null`, `iteration: 0`, and `updated` — the time of this
 write, refreshed on every later one.
+Where the environment has `CLAUDE_CODE_SESSION_ID`, also record it as `session`: the
+board keeps the run on the card it was launched from by that id.
 
 `stage` takes exactly one of five words, and boards key their columns on them:
 `plan`, `build`, `review`, `done`, `abandoned`. Set it when the stage starts —