kaizen-agent 1.33.1 → 1.34.1

package/cli/browser.test.ts

@@ -31,6 +31,7 @@ test("an Instagram caption splits into author, date and the post's own words; no
   expect(authorOf("https://x.com/ana/status/1")).toBe("@ana");
   expect(authorOf("https://www.instagram.com/p/AAA")).toBe("");
   expect(noteOf({ text: "t", author: "@ana", link: "https://x.com/ana/status/1", date: "" })).toBe("@ana · https://x.com/ana/status/1");
+  expect(noteOf({ text: "t", author: "@ana", link: "https://x.com/ana/status/1", date: "", images: ["https://pbs.example/a.jpg"] })).toBe("@ana · https://x.com/ana/status/1 img https://pbs.example/a.jpg");
 });
 
 test("no browser, or a link that is not social, is a note and not a crash; no profile is made", async () => {

package/cli/browser.ts

@@ -9,7 +9,7 @@ import { join } from "node:path";
 import { home } from "./state.ts";
 import { socialOf, PLATFORMS } from "./sources.ts";
 
-export type Post = { text: string; author: string; link: string; date: string };
+export type Post = { text: string; author: string; link: string; date: string; images?: string[] };
 export type Read = { ok: true; posts: Post[] } | { ok: false; note: string };
 
 export const profileDir = () => join(home, ".kaizen", "browser");
@@ -131,7 +131,10 @@ const COLLECT = (re: RegExp) => `(() => {
     if (time) names.add(time.innerText.trim());
     const lines = (box.innerText || "").split("\\n").map((l) => l.trim()).filter(Boolean);
     const text = own ? own.innerText : lines.filter((l) => !names.has(l) && !junk.test(l) && !when.test(l)).join("\\n");
-    posts.set(k, { link: location.origin + k, text, date: time ? (time.getAttribute("datetime") || time.innerText) : (lines.find((l) => when.test(l)) || "") });
+    // A post's own pictures, not avatars or icons: 100px across or more, https only.
+    const images = [...box.querySelectorAll("img")].filter((i) => Math.max(i.naturalWidth, i.width) >= 100)
+      .map((i) => i.currentSrc || i.src).filter((u) => u.startsWith("https://")).slice(0, 4);
+    posts.set(k, { link: location.origin + k, text, images, date: time ? (time.getAttribute("datetime") || time.innerText) : (lines.find((l) => when.test(l)) || "") });
   }
   return [...posts.values()];
 })()`;
@@ -140,7 +143,7 @@ const COLLECT = (re: RegExp) => `(() => {
 const CAPTION = `(() => {
   const m = (p) => document.querySelector('meta[property="' + p + '"]')?.getAttribute("content") || "";
   const time = document.querySelector("time");
-  return { text: m("og:description") || m("og:title"), date: time ? (time.getAttribute("datetime") || time.innerText) : "" };
+  return { text: m("og:description") || m("og:title"), image: m("og:image"), date: time ? (time.getAttribute("datetime") || time.innerText) : "" };
 })()`;
 
 // A sign-in page. OFFERS also counts a page that offers to sign in, which tells only
@@ -158,7 +161,8 @@ export function caption(raw: string): { text: string; author: string; date: stri
 }
 
 // A post's notes, as the icebox shows them: `@author · link · date`.
-export const noteOf = (p: Post) => [p.author, p.link, p.date].filter(Boolean).join(" · ");
+// Its images follow as `img <url>` tokens, which ingest takes out of the notes.
+export const noteOf = (p: Post) => [p.author, p.link, p.date].filter(Boolean).join(" · ") + (p.images ?? []).map((u) => ` img ${u}`).join("");
 
 export const authorOf = (link: string) => { try { const p = new URL(link).pathname.split("/").filter(Boolean); return p[0]!.startsWith("@") ? p[0]! : p.length > 2 ? "@" + p[0] : ""; } catch { return ""; } };
 
@@ -217,7 +221,7 @@ export async function readPage(page: Page, url: string, platform: string, max =
   await page.go(url);
   if (!onPlatform(await page.js<string>("location.href")) || (await page.js<boolean>(WALL))) return { ok: false, note: signInNote(platform) };
   if (await page.js<boolean>(CHECK)) return { ok: false, note: checkNote(platform) };
-  const seen = new Map<string, { link: string; text: string; date: string; author?: string }>();
+  const seen = new Map<string, { link: string; text: string; date: string; author?: string; images?: string[] }>();
   for (let i = 0, still = 0; i < 12 && seen.size < max && still < 3; i++) {
     const before = seen.size;
     for (const p of await page.js<any[]>(COLLECT(re)) ?? []) if (!seen.has(p.link) && onPlatform(p.link)) seen.set(p.link, p);
@@ -233,13 +237,13 @@ export async function readPage(page: Page, url: string, platform: string, max =
       if (!onPlatform(p.link)) continue;
       await page.go(p.link);
       if (!onPlatform(await page.js<string>("location.href"))) continue;
-      const c = await page.js<{ text: string; date: string }>(CAPTION);
+      const c = await page.js<{ text: string; date: string; image: string }>(CAPTION);
       const cap = caption(c?.text ?? "");
-      read.push({ link: p.link, text: cap.text || p.text, date: c?.date || cap.date || p.date, author: cap.author });
+      read.push({ link: p.link, text: cap.text || p.text, date: c?.date || cap.date || p.date, author: cap.author, images: c?.image?.startsWith("https://") ? [c.image] : p.images });
     }
     found = read;
   }
-  const posts = found.map((p) => ({ link: p.link, author: p.author || authorOf(p.link), date: p.date, text: p.text.trim() })).filter((p) => p.text);
+  const posts = found.map((p) => ({ link: p.link, author: p.author || authorOf(p.link), date: p.date, text: p.text.trim(), ...(p.images?.length ? { images: p.images } : {}) })).filter((p) => p.text);
   if (!posts.length && (await page.js<boolean>(CHECK))) return { ok: false, note: checkNote(platform) };
   if (!posts.length && (await page.js<boolean>(OFFERS))) return { ok: false, note: signInNote(platform) };
   return { ok: true, posts };

package/cli/sources.test.ts

@@ -7,7 +7,7 @@ import { tmpdir } from "node:os";
 import { readInbox, writeInbox, replaceIdea, parseItem } from "./state.ts";
 import {
   readSources, addSource, removeSource, ingest, checkUrl, resolvesPublic, exportUrl, fetchText, split, sift,
-  gatherSource, gatherAll, due, SIGN_IN, UNREADABLE, CAP, moveSource, gatherDirs, writeSources,
+  gatherSource, freshImages, gatherAll, due, takeImages, sheetImages, docImages, imagesUrl, SIGN_IN, UNREADABLE, CAP, moveSource, gatherDirs, writeSources,
   readIcebox, writeIcebox, promote, dismiss, markReplied, setCategory, socialUrl, socialOf, AGENT_ONLY, PLATFORMS,
 } from "./sources.ts";
 
@@ -230,7 +230,7 @@ test("promote: one or several items become one open idea with where they came fr
   expect(readIcebox(state).map((s) => [s.status, s.idea])).toEqual([
     ["promoted", idea.text], ["promoted", idea.text], ["new", undefined],
   ]);
-  expect(promote(state, [a!.id])).toBe("already promoted or dismissed");
+  expect(promote(state, [a!.id])).toBe("already promoted");
   expect(promote(state, [c!.id], "  ")).toBeNull();   // blank text: the item's own
   expect(readInbox(state).at(-1)!.text).toBe("Tambah personel");
   expect(dismiss(state, ["nope0000"])).toBe("no such item");
@@ -634,10 +634,14 @@ test("the board refuses to add a source without a project, and moves one between
     expect(await ice({ op: "promote", dir: a, ids: ["nope0000"] })).toMatchObject({ status: 404 });
     expect(await ice({ op: "explode", dir: a, ids: [x!.id] })).toMatchObject({ status: 400 });
     expect(await ice({ op: "promote", dir: a, ids: [x!.id] })).toMatchObject({ status: 200 });
-    expect(await ice({ op: "promote", dir: a, ids: [x!.id] })).toMatchObject({ status: 409, error: "already promoted or dismissed" });
+    expect(await ice({ op: "promote", dir: a, ids: [x!.id] })).toMatchObject({ status: 409, error: "already promoted" });
     expect(await ice({ op: "dismiss", dir: a, ids: [y!.id] })).toMatchObject({ status: 200 });
     expect(readInbox(a).map((l) => l.text)).toEqual(["Dark mode"]);
     expect(readIcebox(a).map((s) => s.status)).toEqual(["promoted", "dismissed"]);
+    // A dismissed item can be restored, then dismissed or promoted again.
+    expect(await ice({ op: "restore", dir: a, ids: [y!.id] })).toMatchObject({ status: 200 });
+    expect(readIcebox(a).map((s) => s.status)).toEqual(["promoted", "new"]);
+    expect(await ice({ op: "dismiss", dir: a, ids: [y!.id] })).toMatchObject({ status: 200 });
     const listedIce = ((await (await fetch(at + "/sources")).json()) as any).icebox;
     expect(listedIce).toEqual([]);
   } finally { proc.kill(); await proc.exited; }
@@ -710,3 +714,78 @@ test("a GitHub issues link is read through the API: open issues, no pull request
   // JSON only when asked: a plain source answering JSON is still refused.
   expect(await fetchText(api, json, pub)).toEqual({ ok: false, note: UNREADABLE });
 });
+
+test("images ride beside a request, never in its key", () => {
+  addSource(state, SHEET);
+  expect(ingest(state, SHEET, [{ text: "Broken chart", notes: "@ana · https://x.com/ana/status/1 img https://pbs.example/a.jpg ", images: ["https://cdn.example/c.png", "http://plain/b.jpg"] }])).toEqual({ added: 1, held: 0 });
+  const [it] = readIcebox(state);
+  expect(it!.notes).toBe("@ana · https://x.com/ana/status/1");
+  expect(it!.images).toEqual(["https://cdn.example/c.png", "https://pbs.example/a.jpg"]);
+  // The same post read again with fresh CDN links is not new.
+  expect(ingest(state, SHEET, [{ text: "Broken chart", notes: "@ana · https://x.com/ana/status/1 img https://pbs.example/z.jpg" }])).toEqual({ added: 0, held: 0 });
+  expect(takeImages("a · b").images).toEqual([]);
+  expect(takeImages("img broken on page")).toEqual({ notes: "img broken on page", images: [] });
+});
+
+test("sheet and doc images land on their row and line", async () => {
+  const sheetHtml = `<table><tr><th></th><th>A</th></tr><tr><th id="0R0"><div class="row-header-wrapper">1</div></th><td>Request</td></tr>
+<tr><th id="0R1"><div>2</div></th><td>Fix login</td><td><div><img src="https://lh3.googleusercontent.com/x?a=1&amp;b=2"></div></td></tr>
+<tr><th id="0R2"><div>3</div></th><td>Dark mode</td></tr></table>`;
+  expect(sheetImages(sheetHtml)).toEqual(new Map([[2, ["https://lh3.googleusercontent.com/x?a=1&b=2"]]]));
+  expect(sift("sheet", "Request\nFix login\nDark mode\n", sheetImages(sheetHtml) as any).items).toEqual([
+    { text: "Fix login", images: ["https://lh3.googleusercontent.com/x?a=1&b=2"] }, { text: "Dark mode" }]);
+  const docHtml = `<html><body><p><span>Export is slow</span></p><p><img src="https://lh7.example/p.png"></p><li>Add &amp; remove tags</li></body></html>`;
+  expect(sift("doc", "Export is slow\n\n* Add & remove tags\n", docImages(docHtml) as any).items).toEqual([
+    { text: "Export is slow", images: ["https://lh7.example/p.png"] }, { text: "* Add & remove tags" }]);
+  expect(imagesUrl(SHEET)).toBe("https://docs.google.com/spreadsheets/d/abc123/htmlview/sheet?headers=true&gid=7");
+  expect(imagesUrl("https://docs.google.com/document/d/D0c_1/edit")).toBe("https://docs.google.com/document/d/D0c_1/export?format=html");
+  expect(imagesUrl("https://notes.example.com/raw/1")).toBeNull();
+  // A gather whose image page fails still gathers.
+  addSource(state, SHEET);
+  expect(await gatherSource(state, SHEET, text("Request\nFix login\n"), pub)).toMatchObject({ ok: true, added: 1 });
+});
+
+test("a waiting item takes fresh image links when gathered again", () => {
+  addSource(state, SHEET);
+  ingest(state, SHEET, [{ text: "Old request" }]);
+  ingest(state, SHEET, [{ text: "Old request", images: ["https://cdn.example/new.jpg"] }]);
+  expect(readIcebox(state)[0]!.images).toEqual(["https://cdn.example/new.jpg"]);
+  // No images read this time: the ones it has stay.
+  ingest(state, SHEET, [{ text: "Old request" }]);
+  expect(readIcebox(state)[0]!.images).toEqual(["https://cdn.example/new.jpg"]);
+  expect(sheetImages(`<tr><th id="0R4" class="row-headers-background"></th><td><img src="https://x.example/i.png"></td></tr>`)).toEqual(new Map([[5, ["https://x.example/i.png"]]]));
+});
+
+test("sheet images placed over the grid land on their anchored row", () => {
+  // The shape of a real htmlview/sheet page: rows in the table, floating images after it.
+  const html = `<table><tbody><tr><th id="0R0"><div>1</div></th><td>Request</td></tr><tr><th id="0R1"><div>2</div></th><td>Fix login</td></tr></tbody></table>`
+    + `<div id='embed_11' class='waffle-embedded-object-overlay'><img src='https://docs.google.com/sheets-images-rt/A=s2048' style='display: block;'></div>`
+    + `<div id='embed_22' class='waffle-embedded-object-overlay'><img src='https://docs.google.com/sheets-images-rt/B=s2048'></div>`
+    + `<script>posObj('0', 'embed_11', 1, 7, 14, 9);posObj('0', 'embed_22', 1, 7, 7, 316);</script>`;
+  expect(sheetImages(html)).toEqual(new Map([[2, ["https://docs.google.com/sheets-images-rt/A=s2048", "https://docs.google.com/sheets-images-rt/B=s2048"]]]));
+});
+
+test("an item's images are read again from its source, since Google's links expire", async () => {
+  addSource(state, SHEET);
+  ingest(state, SHEET, [{ text: "Fix login", images: ["https://docs.google.com/sheets-images-rt/OLD=s2048"] }]);
+  const id = readIcebox(state)[0]!.id;
+  const html = `<table><tr><th id="0R0"><div>1</div></th><td>Request</td></tr><tr><th id="0R1"><div>2</div></th><td>Fix login</td><td><img src="https://docs.google.com/sheets-images-rt/NEW=s2048"></td></tr></table>`;
+  const page: any = async (u: string) => u.includes("htmlview")
+    ? new Response(html, { headers: { "content-type": "text/html" } })
+    : new Response("Request\nFix login\n", { headers: { "content-type": "text/plain" } });
+  expect(await freshImages(state, id, page, pub)).toEqual(["https://docs.google.com/sheets-images-rt/NEW=s2048"]);
+  // The source cannot be read: the kept links come back.
+  expect(await freshImages(state, id, (async () => new Response("", { status: 500 })) as any, pub)).toEqual(["https://docs.google.com/sheets-images-rt/OLD=s2048"]);
+  expect(await freshImages(state, "nope", page, pub)).toEqual([]);
+});
+
+test("a fresh image link on a host the item never used is not taken", async () => {
+  addSource(state, SHEET);
+  ingest(state, SHEET, [{ text: "Fix login", images: ["https://docs.google.com/sheets-images-rt/OLD=s2048"] }]);
+  const id = readIcebox(state)[0]!.id;
+  const html = `<table><tr><th id="0R1"><div>2</div></th><td>Fix login</td><td><img src="https://evil.example/x.png"></td></tr></table>`;
+  const page: any = async (u: string) => u.includes("htmlview")
+    ? new Response(html, { headers: { "content-type": "text/html" } })
+    : new Response("Request\nFix login\n", { headers: { "content-type": "text/plain" } });
+  expect(await freshImages(state, id, page, pub)).toEqual(["https://docs.google.com/sheets-images-rt/OLD=s2048"]);
+});

package/cli/sources.ts

@@ -134,7 +134,7 @@ function clean(raw: string, extra = ""): { text: string; lines: string[] } | nul
 // The icebox: everything gathered, held per project until a person or an agent
 // promotes it to an idea or dismisses it. Promoted and dismissed items stay, so the
 // same request never comes back.
-export type Signal = { id: string; text: string; notes?: string; source: string; category?: string; at: string; status: "new" | "promoted" | "dismissed"; idea?: string; replied?: string };
+export type Signal = { id: string; text: string; notes?: string; source: string; category?: string; at: string; status: "new" | "promoted" | "dismissed"; idea?: string; replied?: string; images?: string[] };
 
 const iceFile = (state: string) => join(state, "icebox.json");
 
@@ -168,9 +168,30 @@ function ideaKey(l: { text: string; notes?: string }): string | null {
   return normalise(l.text);
 }
 
+// Image links a source showed beside a request: https only, at most four. Kept apart
+// from the text and notes and out of the row's key, since Google and social CDN
+// addresses change between reads and would make every row new again.
+export const pics = (urls: string[] = []) => [...new Set(urls.filter((u) => /^https:\/\/\S+$/.test(u) && u.length <= 2000))].slice(0, 4);
+
+// `img <url>` tokens in an agent's notes (the --stdin path) are images, not notes.
+export function takeImages(notes = ""): { notes: string; images: string[] } {
+  const images: string[] = [];
+  notes = notes.replace(/(^|\s)img\s+(https:\/\/\S+)/g, (_, sp, u) => { images.push(u); return sp; }).replace(/[ \t]*·[ \t]*$/gm, "").trim();
+  return { notes, images: pics(images) };
+}
+
 // The single place outside text enters kaizen, and it enters the icebox, never Ideas.
 // Synchronous on purpose: nothing may run between reading the files and writing them.
-export function ingest(state: string, url: string, items: { text: string; notes?: string }[]): { added: number; held: number } {
+// A gathered item as the icebox keeps it, keyed the way dedup sees it.
+function shape(it: Item) {
+  const got = takeImages(it.notes);
+  const c = clean(it.text, got.notes);
+  if (!c) return null;
+  const notes = c.lines.join("\n").slice(0, 2000);
+  return { c, notes, images: pics([...(it.images ?? []), ...got.images]), key: rowKey(c.text, notes) };
+}
+
+export function ingest(state: string, url: string, items: Item[]): { added: number; held: number } {
   const sources = readSources(state);
   const src = sources.find((s) => s.url === url);
   if (!src) throw new Error("not a listed source");
@@ -178,19 +199,25 @@ export function ingest(state: string, url: string, items: { text: string; notes?
   const known = new Set([...src.seen, ...readInbox(state).map(ideaKey).filter((k) => k !== null), ...ice.map((s) => rowKey(s.text, s.notes))]);
   const fresh: Signal[] = [];
   const seen: string[] = [];
-  let held = 0;
+  let held = 0, refreshed = false;
   for (const it of items) {
-    const c = clean(it.text, it.notes);
-    if (!c) continue;
-    const notes = c.lines.join("\n").slice(0, 2000);
-    const key = rowKey(c.text, notes);
-    if (known.has(key)) { seen.push(key); continue; }
+    const s = shape(it);
+    if (!s) continue;
+    const { c, notes, images, key } = s;
+    if (known.has(key)) {
+      seen.push(key);
+      // Image links expire (social CDNs) or arrive late (items gathered before images
+      // were read): an item still waiting takes the ones read now.
+      const old = images.length && ice.find((s) => s.status === "new" && s.source === url && rowKey(s.text, s.notes) === key);
+      if (old && String(old.images) !== String(images)) { old.images = images; refreshed = true; }
+      continue;
+    }
     if (fresh.length >= CAP) { held++; continue; }   // not marked seen: the next gather takes it
     known.add(key);
     seen.push(key);
-    fresh.push({ id: idOf(key), text: c.text, ...(notes ? { notes } : {}), source: url, ...(src.category ? { category: src.category } : {}), at: new Date().toISOString(), status: "new" });
+    fresh.push({ id: idOf(key), text: c.text, ...(notes ? { notes } : {}), source: url, ...(src.category ? { category: src.category } : {}), at: new Date().toISOString(), status: "new", ...(images.length ? { images } : {}) });
   }
-  if (fresh.length) writeIcebox(state, [...ice, ...fresh]);
+  if (fresh.length || refreshed) writeIcebox(state, [...ice, ...fresh]);
   // ponytail: seen only grows; trim to the newest few thousand if a source ever gets that long.
   src.seen = [...new Set([...src.seen, ...seen])];
   writeSources(state, sources);
@@ -207,7 +234,7 @@ export function promote(state: string, ids: string[], text?: string, details?: s
   const picked = ids.map((id) => ice.find((s) => s.id === id));
   if (!ids.length) return "no items named";
   if (picked.some((s) => !s)) return "no such item";
-  if (picked.some((s) => s!.status !== "new")) return "already promoted or dismissed";
+  if (picked.some((s) => s!.status === "promoted")) return "already promoted";
   const own = !!text?.trim();
   const c = clean(own ? text! : picked[0]!.text);
   if (!c) return "the idea text is too short";
@@ -227,6 +254,17 @@ export function promote(state: string, ids: string[], text?: string, details?: s
   return null;
 }
 
+// A dismissed item back to waiting.
+export function restore(state: string, ids: string[]): string | null {
+  const ice = readIcebox(state);
+  const picked = ids.map((id) => ice.find((s) => s.id === id));
+  if (!ids.length) return "no items named";
+  if (picked.some((s) => !s)) return "no such item";
+  for (const s of picked) if (s!.status === "dismissed") s!.status = "new";
+  writeIcebox(state, ice);
+  return null;
+}
+
 export function dismiss(state: string, ids: string[]): string | null {
   const ice = readIcebox(state);
   const picked = ids.map((id) => ice.find((s) => s.id === id));
@@ -308,6 +346,59 @@ export function exportUrl(raw: string): { url: string; kind: Kind } {
   return { url: raw, kind: "text" };
 }
 
+// Where a Google sheet or doc shows its images, which its text export drops. A
+// published sheet is left out.
+// ponytail: /d/e/ published sheets get no images; add pubhtml when one asks.
+export function imagesUrl(raw: string): string | null {
+  const u = new URL(raw);
+  if (u.hostname !== "docs.google.com") return null;
+  const t = exportUrl(raw);
+  if (t.kind === "sheet" && t.url.includes("/export?")) return t.url.replace("/export?format=tsv&", "/htmlview/sheet?headers=true&");
+  if (t.kind === "doc") return t.url.replace("format=txt", "format=html");
+  return null;
+}
+
+const srcs = (html: string) => [...html.matchAll(/<img\b[^>]*?\ssrc=(?:"([^"]+)"|'([^']+)')/gi)].map((m) => (m[1] ?? m[2])!.replace(/&amp;/g, "&"));
+const plain = (html: string) => html.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+const lineKey = (t: string) => normalise(t.replace(/^\s*[-*•●○■]\s*/, ""));
+
+// A sheet's htmlview: the images in each row, by the row number in its header cell.
+export function sheetImages(html: string): Map<number, string[]> {
+  const out = new Map<number, string[]>();
+  for (const tr of html.split(/<\/table>/i)[0]!.split(/<tr\b/i).slice(1)) {
+    // The header cell shows the row number; its id (`0R4`) counts from zero.
+    const shown = /<th\b[^>]*>(?:\s*<[^>]+>)*\s*(\d+)\s*</i.exec(tr)?.[1];
+    const id = /<th\b[^>]*\bid="\d+R(\d+)"/i.exec(tr)?.[1];
+    const row = shown ? Number(shown) : id ? Number(id) + 1 : 0;
+    const got = row ? srcs(tr) : [];
+    if (got.length) out.set(row, got);
+  }
+  // Images placed over the grid sit after the table, each in its own embed box, and
+  // the page anchors each box to a row with `posObj(sheet, 'embed_<id>', row, col, …)`,
+  // the row counted from zero.
+  const anchor = new Map([...html.matchAll(/posObj\(\s*'[^']*'\s*,\s*'(embed_\d+)'\s*,\s*(\d+)/g)].map((m) => [m[1]!, Number(m[2]) + 1]));
+  for (const box of html.split(/(?=<div\b[^>]*\bid=['"]embed_\d+['"])/i).slice(1)) {
+    const row = anchor.get(/id=['"](embed_\d+)['"]/.exec(box)![1]!);
+    const got = row ? srcs(box.split(/<div\b[^>]*\bid=['"](?!embed_)/i)[0]!) : [];
+    if (got.length) out.set(row!, [...(out.get(row!) ?? []), ...got]);
+  }
+  return out;
+}
+
+// A doc's html export: each paragraph's images, keyed by its text. An image on a line
+// of its own belongs to the paragraph above it.
+export function docImages(html: string): Map<string, string[]> {
+  const out = new Map<string, string[]>();
+  let last = "";
+  for (const part of html.split(/<\/(?:p|h\d|li)>/i)) {
+    const text = lineKey(plain(part.replace(/[\s\S]*<body[^>]*>/i, "")));
+    if (text) last = text;
+    const got = srcs(part);
+    if (got.length && last) out.set(last, [...(out.get(last) ?? []), ...got]);
+  }
+  return out;
+}
+
 export const SIGN_IN = 'Needs sign-in. Share it as "anyone with the link can view", or run /kaizen gather in your agent.';
 export const UNREADABLE = "Kaizen cannot read this page on its own. Run /kaizen gather in your agent.";
 const MAX_BYTES = 1_000_000;
@@ -316,7 +407,7 @@ type Fetch = (url: string, init: RequestInit) => Promise<Response>;
 
 // No cookie, no authorization, no redirect followed unchecked: every hop goes
 // through the same guard as the first address.
-export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Lookup = dnsLookup, json = false): Promise<{ ok: true; body: string } | { ok: false; note: string }> {
+export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Lookup = dnsLookup, json: boolean | "html" = false): Promise<{ ok: true; body: string } | { ok: false; note: string }> {
   const signal = AbortSignal.timeout(15000);
   for (let hop = 0; hop <= 5; hop++) {
     const why = checkUrl(url);
@@ -326,7 +417,7 @@ export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Loo
     const pub = await resolvesPublic(host, lookup);
     if (pub === null) return { ok: false, note: hop ? "The link redirected to an address that could not be found." : "The link's address could not be found. Check it for a typo." };
     if (!pub) return { ok: false, note: "Refused: not a public address." };
-    const res = await doFetch(url, { redirect: "manual", credentials: "omit", signal, headers: { accept: json ? "application/json" : "text/plain, text/*" } });
+    const res = await doFetch(url, { redirect: "manual", credentials: "omit", signal, headers: { accept: json === "html" ? "text/html" : json ? "application/json" : "text/plain, text/*" } });
     if (res.status >= 300 && res.status < 400) {
       const to = res.headers.get("location");
       if (!to) return { ok: false, note: `Redirect with nowhere to go (HTTP ${res.status}).` };
@@ -336,7 +427,7 @@ export async function fetchText(url: string, doFetch: Fetch = fetch, lookup: Loo
     if (res.status === 401 || res.status === 403) return { ok: false, note: SIGN_IN };
     if (!res.ok) return { ok: false, note: `The link answered HTTP ${res.status}.` };
     const type = (res.headers.get("content-type") ?? "").toLowerCase();
-    if (json ? !type.startsWith("application/json") : !type.startsWith("text/") || type.startsWith("text/html")) return { ok: false, note: UNREADABLE };
+    if (json === "html" ? !type.startsWith("text/html") : json ? !type.startsWith("application/json") : !type.startsWith("text/") || type.startsWith("text/html")) return { ok: false, note: UNREADABLE };
     // Read no further than the cap; a cut-off last line is dropped, not gathered half.
     const chunks: Uint8Array[] = [];
     let size = 0;
@@ -360,19 +451,22 @@ const wordy = (c: string) => c.length >= 3 && !datum(c);
 const STATUS = /^status$/i;
 const DONE = /^(done|finish|finished)$/i;
 
-type Item = { text: string; notes?: string };
+type Item = { text: string; notes?: string; images?: string[] };
 
 export const split = (kind: Kind, body: string): Item[] => sift(kind, body).items;
 
 // The requests, and how many rows were left out for their status. A row left out is
 // never handed to ingest, so it is not marked seen: reopened, it is gathered then.
-export function sift(kind: Kind, body: string): { items: Item[]; done: number } {
+// `pics`, when given, are the images found beside the rows: by sheet row number for a
+// sheet, by line text for a doc.
+export function sift(kind: Kind, body: string, pics?: Map<number | string, string[]>): { items: Item[]; done: number } {
+  const with_ = (it: Item, at: number | string): Item => { const p = pics?.get(at); return p?.length ? { ...it, images: p } : it; };
   // Pull requests come back from the issues API too; they are not requests. The notes
   // are the number and link only, so an edited body does not make the issue new.
   if (kind === "github") return { items: (JSON.parse(body) as any[]).filter((i) => !i.pull_request && typeof i.title === "string")
     .map((i) => ({ text: i.title, notes: `#${i.number} · ${i.html_url}` })), done: 0 };
   const rows = body.split(/\r?\n/);
-  if (kind !== "sheet") return { items: rows.filter((r) => r.trim()).map((text) => ({ text })), done: 0 };
+  if (kind !== "sheet") return { items: rows.filter((r) => r.trim()).map((text) => with_({ text }, lineKey(text))), done: 0 };
   const cells = rows.map((r) => r.split("\t").map((c) => c.trim()));
   const filled = cells.filter((row) => row.some(Boolean));
   // Sheets often open with blank rows or a title: the header is looked for in the
@@ -404,7 +498,8 @@ export function sift(kind: Kind, body: string): { items: Item[]; done: number }
     if (!text || (known < 0 && !wordy(text))) return [];
     if (status >= 0 && DONE.test(row[status] ?? "")) { done++; return []; }
     const rest = row.filter((c, i) => c && i !== col).join(" · ");
-    return [{ text, ...(rest ? { notes: rest } : {}) }];
+    // The export keeps every row from the top, so a row's index is its number less one.
+    return [with_({ text, ...(rest ? { notes: rest } : {}) }, cells.indexOf(row) + 1)];
   });
   return { items, done };
 }
@@ -429,6 +524,39 @@ export function record(state: string, url: string, r: { added: number; held: num
   return { url, ...last };
 }
 
+// An item's images read again from its source now. Google signs sheet and doc image
+// links with a token that expires, so a link kept since the gather answers 403; this
+// reads the page again and returns the same row's links. Falls back to the kept ones.
+// A source's page is read once a minute however many items and images ask, and a
+// fresh link is only taken on a host the kept links already used.
+const pages = new Map<string, { at: number; p: Promise<Map<string, string[]> | null> }>();
+async function readPage(source: string, doFetch?: Fetch, lookup?: Lookup) {
+  const target = exportUrl(source), at = imagesUrl(source)!;
+  const [got, page] = await Promise.all([fetchText(target.url, doFetch, lookup), fetchText(at, doFetch, lookup, "html")]);
+  if (!got.ok || !page.ok) return null;
+  const found = target.kind === "sheet" ? sheetImages(page.body) : docImages(page.body);
+  const byKey = new Map<string, string[]>();
+  for (const x of sift(target.kind, got.body, found as Map<number | string, string[]>).items) {
+    const s = shape(x);
+    if (s?.images.length) byKey.set(s.key, s.images);
+  }
+  return byKey;
+}
+export async function freshImages(state: string, id: string, doFetch?: Fetch, lookup?: Lookup): Promise<string[]> {
+  const it = readIcebox(state).find((s) => s.id === id);
+  if (!it) return [];
+  const kept = it.images ?? [];
+  if (!imagesUrl(it.source)) return kept;
+  const now = Date.now();
+  for (const [k, v] of pages) if (now - v.at >= 60_000) pages.delete(k);
+  const hit = doFetch ? undefined : pages.get(it.source);   // a test's own fetch is never cached
+  const p = hit?.p ?? readPage(it.source, doFetch, lookup).catch(() => null);
+  if (!hit && !doFetch) pages.set(it.source, { at: now, p });
+  const hosts = new Set(kept.map((u) => new URL(u).hostname));
+  const fresh = ((await p)?.get(rowKey(it.text, it.notes)) ?? []).filter((u) => hosts.has(new URL(u).hostname));
+  return fresh.length ? fresh : kept;
+}
+
 // Never throws. A failure is recorded on the source and marks nothing seen.
 export async function gatherSource(state: string, url: string, doFetch?: Fetch, lookup?: Lookup): Promise<Result> {
   if (socialOf(url)) {
@@ -438,9 +566,14 @@ export async function gatherSource(state: string, url: string, doFetch?: Fetch,
   }
   try {
     const target = exportUrl(url);
-    const got = await fetchText(target.url, doFetch, lookup, target.kind === "github");
+    // Images are extra, read alongside the text: a page that cannot be read for them
+    // leaves the gather as it was, and costs no time beyond the text's own.
+    const at = imagesUrl(url);
+    const [got, page] = await Promise.all([fetchText(target.url, doFetch, lookup, target.kind === "github"),
+      at ? fetchText(at, doFetch, lookup, "html").catch(() => null) : null]);
     if (got.ok) {
-      const { items, done } = sift(target.kind, got.body);
+      const found = page?.ok ? (target.kind === "sheet" ? sheetImages(page.body) : docImages(page.body)) : undefined;
+      const { items, done } = sift(target.kind, got.body, found as Map<number | string, string[]> | undefined);
       return record(state, url, ingest(state, url, items), target.kind === "github" ? undefined : got.body.split("\n").filter((r) => r.trim()).length, done);
     }
     const last = { at: new Date().toISOString(), ok: false, added: 0, note: got.note };

package/cli/state.test.ts

@@ -687,6 +687,16 @@ test("ownerOf: an idea's session belongs to the first run created after it, not
   expect(ownerOf(st, { ...rec, run: "2026-10-01-x" })).toBe("2026-10-01-x");
 });
 
+test("ownerOf: a run that recorded the launch's session id owns it, however its request is worded", () => {
+  const p = sessionProject(), st = join(p, ".kaizen");
+  newRun(p, "2026-10-02-reworded", "/kaizen something else entirely");
+  const f = join(st, "runs", "2026-10-02-reworded", "state.json");
+  writeFileSync(f, JSON.stringify({ ...JSON.parse(readFileSync(f, "utf8")), session: "abc" }));
+  const rec = { key: "k", run: null, text: "open it on my phone", cmd: "claude", sessionId: "abc", started: Date.now() };
+  expect(ownerOf(st, rec)).toBe("2026-10-02-reworded");
+  expect(ownerOf(st, { ...rec, sessionId: "other" })).toBe(null);
+});
+
 test("findTerminal records the agent's PID: a POSIX wrapper that execs it, a PowerShell prefix on Windows", () => {
   const keys = ["PATH", "HERDR_ENV", "TMUX", "TERMINAL", "SystemRoot", "windir", "ComSpec"];
   const saved = keys.map((k) => process.env[k]);
@@ -998,3 +1008,24 @@ test("the board refuses an upgrade from another origin", async () => {
     expect(r.status).toBe(403);
   } finally { proc.kill(); await proc.exited; rmSync(homeDir, { recursive: true, force: true }); }
 });
+
+// KAIZEN_WEB_HOSTS (tailscale serve): the listed host gets in, any other is still refused.
+test("the board answers only the hosts listed in KAIZEN_WEB_HOSTS", async () => {
+  const homeDir = mkdtempSync(join(tmpdir(), "kaizen-hosts-"));
+  for (const d of [join(homeDir, ".kaizen"), join(homeDir, ".claude")]) mkdirSync(d, { recursive: true });
+  const port = 20000 + Math.floor(Math.random() * 20000), repo = join(import.meta.dir, "..");
+  const proc = Bun.spawn([process.execPath, join(repo, "cli", "install.ts"), "web", "--port", String(port), "--no-open", "--foreground"], {
+    cwd: homeDir, env: { ...process.env, HOME: homeDir, USERPROFILE: homeDir, KAIZEN_HOME: repo, KAIZEN_WEB_HOSTS: " PC.tail1234.ts.net:443 , " }, stdout: "ignore", stderr: "ignore",
+  });
+  try {
+    const at = `http://127.0.0.1:${port}`;
+    for (let i = 0; ; i++) { try { await fetch(at + "/state"); break; } catch { if (i > 100) throw new Error("board did not start"); await Bun.sleep(50); } }
+    expect((await fetch(at + "/state", { headers: { host: "pc.tail1234.ts.net" } })).status).toBe(200);
+    expect((await fetch(at + "/state", { headers: { host: "evil.example" } })).status).toBe(403);
+    expect((await fetch(at + "/state", { headers: { host: "other.tail1234.ts.net" } })).status).toBe(403);
+    expect((await fetch(at + "/upgrade", { method: "POST", headers: { origin: "https://evil.example" } })).status).toBe(403);
+    const m = await fetch(at + "/manifest.webmanifest");
+    expect(m.status).toBe(200);
+    expect((await m.json()).display).toBe("standalone");
+  } finally { proc.kill(); await proc.exited; rmSync(homeDir, { recursive: true, force: true }); }
+});

package/cli/state.ts

@@ -1121,6 +1121,16 @@ export function readSessions(st: string): Session[] {
 // request holds the idea's text: one run per record, never every run that mentions it.
 export function ownerOf(st: string, s: Session): string | null {
   if (s.run) return s.run;
+  // The launch's own conversation id, recorded by the run at intake: holds however the
+  // request was worded. Text matching below is for tools that expose no id.
+  if (s.sessionId) {
+    try {
+      const mine = readdirSync(join(st, "runs")).filter((id) => {
+        try { return JSON.parse(readText(join(st, "runs", id, "state.json"))).session === s.sessionId; } catch { return false; }
+      }).sort();
+      if (mine.length) return mine[0]!;
+    } catch { /* no runs dir */ }
+  }
   const t = normalise(s.text);
   let best: string | null = null, at = Infinity;
   try {