kaizen-agent 1.41.3 → 1.42.1

package/cli/conpty.ts

@@ -95,5 +95,5 @@ export const resizeSeq = (cols: number, rows: number) => `\x1b]kzr;${cols};${row
 export function innerCommand(shell: string, cmd: string[]): string {
   const q = (a: string) => `'${a.replace(/'/g, "''")}'`;
   const enc = Buffer.from(`& ${cmd.map(q).join(" ")}`, "utf16le").toString("base64");
-  return `"${shell}" -NoProfile -EncodedCommand ${enc}`;
+  return `"${shell}" -NoProfile -ExecutionPolicy Bypass -EncodedCommand ${enc}`;
 }

package/cli/install.ts

@@ -540,6 +540,15 @@ if (interactive && !upgrade && Bun.argv.length === 2) {
   }
 }
 
+// A board on Windows hands its Update here and exits: Windows will not rename
+// ~/kaizen while that board holds files in it. Wait for it to go, and bring a board
+// back on its port however the upgrade ends (finish()).
+const argAt = (flag: string) => { const i = Bun.argv.indexOf(flag); return i === -1 ? NaN : Number(Bun.argv[i + 1]); };
+if (upgrade && argAt("--wait") > 0) {
+  for (let i = 0; i < 100; i++) {
+    try { process.kill(argAt("--wait"), 0); await Bun.sleep(200); } catch { break; }
+  }
+}
 if (upgrade) await clearBunxCache();
 
 // Upgrade means the newest release on npm, whatever the install on disk is: a clone
@@ -551,16 +560,16 @@ if (upgrade) {
   const why = await devCheckout(dest);
   if (why) {
     console.log(`\n  ${c.bold("Not upgraded")}  ${c.dim(`${tilde(dest)} is ${why}; update it with git`)}\n`);
-    process.exit(1);
+    finish(1);
   }
   const latest = await npmLatest();
   if (!latest) {
     console.log(`\n  ${c.bold("Not upgraded")}  ${c.dim(`could not reach npm (kaizen ${now})`)}\n`);
-    process.exit(1);
+    finish(1);
   }
   if (latest === now) {
     console.log(`\n  ${c.bold("Up to date")}${c.dim(`  —  kaizen ${now}`)}\n`);
-    process.exit(0);
+    finish(0);
   }
   step(`fetching kaizen ${latest} from npm`);
   // --force so a stale package manifest cannot resolve the version away, and the
@@ -578,10 +587,10 @@ if (upgrade) {
     console.log(`\n  ${c.bold(`could not install kaizen ${latest}`)}`);
     // npm names a new version before it serves it (its review takes minutes).
     console.log(`  ${c.dim("npm may still be publishing it: try again in a few minutes, or run")} ${c.cyan(`bunx kaizen-agent@${latest}`)}\n`);
-    process.exit(1);
+    finish(1);
   }
   console.log(`\n  ${c.bold("Upgraded")}  ${c.dim(now)} → ${c.green(after)}\n  ${c.dim("Restart Claude Code to pick up any new slash commands.")}\n`);
-  process.exit(0);
+  finish(0);
 }
 if (!check && !upgrade) await welcome();
 
@@ -1065,6 +1074,16 @@ if (blocked) process.exit(1);
 
 // ---------------------------------------------------------------- helpers
 
+function finish(code: number): never {
+  const port = argAt("--restart");
+  if (port > 0) {
+    Bun.spawn([process.execPath, join(installDir(), "cli", "install.ts"), "web", "--port", String(port), "--no-open", "--foreground"], {
+      cwd: home, detached: true, stdio: ["ignore", "ignore", "ignore"], windowsHide: true,
+    }).unref();
+  }
+  process.exit(code);
+}
+
 function step(msg: string) { console.log(`  ${c.green("+")} ${msg}`); }
 
 // Runs the upgrade and reports what it actually did, version to version, so the

package/cli/pty.test.ts

@@ -200,7 +200,7 @@ test("Windows ConPTY host: resize travels in-band, the agent command survives qu
   expect(resizeSeq(100, 40)).toBe("\x1b]kzr;100;40\x07");
   const line = innerCommand("C:\\ps.exe", ["claude", "it's\nhere"]);
   const enc = line.split(" ").pop()!;
-  expect(line.startsWith('"C:\\ps.exe" -NoProfile -EncodedCommand ')).toBe(true);
+  expect(line.startsWith('"C:\\ps.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand ')).toBe(true);
   expect(Buffer.from(enc, "base64").toString("utf16le")).toBe("& 'claude' 'it''s\nhere'");
   // The host script decodes to PowerShell carrying the C# whole.
   expect(Buffer.from(conptyHost(), "base64").toString("utf16le")).toContain("CreatePseudoConsole");

package/cli/state.test.ts

@@ -796,7 +796,7 @@ test("findTerminal records the agent's PID: a POSIX wrapper that execs it, a Pow
     process.env.SystemRoot = "D:\\Win";
     const w = findTerminal("C:\\p", ["claude", "/kaizen x"], "C:\\p\\.kaizen\\sessions\\k.pid")!;
     const ps = Buffer.from(w.cmd.at(-1)!, "base64").toString("utf16le");
-    expect(ps).toBe("$PID | Set-Content -LiteralPath 'C:\\p\\.kaizen\\sessions\\k.pid'; Set-Location 'C:\\p'; & 'claude' '/kaizen x'");
+    expect(ps).toBe("$PID | Set-Content -LiteralPath 'C:\\p\\.kaizen\\sessions\\k.pid'; Set-Location 'C:\\p'; & 'claude' '/kaizen x'; if (-not (Test-Path -LiteralPath 'C:\\p\\.kaizen\\sessions\\k.pid')) { exit 0 }");
   } finally {
     Object.defineProperty(process, "platform", platform);
     keys.forEach((k, i) => (saved[i] === undefined ? delete process.env[k] : (process.env[k] = saved[i])));
@@ -1148,3 +1148,11 @@ test("parent/child: a Parent line links a run and an idea to the run that filed
   expect(boardCards([st], Date.now()).find((k) => k.text === "next thing")!.parent).toBe("2026-01-02-b");
   rmSync(dirname(st), { recursive: true, force: true });
 });
+
+test("winShim swaps an npm .cmd shim for the .ps1 beside it, so a multi-line prompt survives", () => {
+  const { winShim } = stateModule;
+  const has = (p: string) => p === "C:\\npm\\claude.ps1";
+  expect(winShim("C:\\npm\\claude.cmd", has)).toBe("C:\\npm\\claude.ps1");
+  expect(winShim("C:\\npm\\codex.CMD", () => false)).toBe("C:\\npm\\codex.CMD");
+  expect(winShim("C:\\bin\\claude.exe", () => true)).toBe("C:\\bin\\claude.exe");
+});

package/cli/state.ts

@@ -130,6 +130,14 @@ export const readText = (file: string) => readFileSync(file, "utf8").replace(/^\
 
 const onPath = (bin: string) => Bun.which(bin, { PATH: process.env.PATH });
 
+// npm installs a Windows tool as x.cmd with x.ps1 beside it. PowerShell hands a .cmd to
+// cmd.exe, which ends the command line at the first newline -- a prompt with notes lost
+// everything after its first line. The .ps1 runs in PowerShell itself, argument intact.
+export const winShim = (bin: string, exists = existsSync) => {
+  const ps1 = bin.replace(/\.cmd$/i, ".ps1");
+  return ps1 !== bin && exists(ps1) ? ps1 : bin;
+};
+
 // Windows' own programs by full path: a board started from the shortcut or a
 // stripped-down environment can have a PATH without System32, and a bare "cmd.exe"
 // then fails with "Executable not found in $PATH".
@@ -164,7 +172,10 @@ export function findTerminal(cwd: string, fullCmd: string[], pidFile?: string):
     const q = (a: string) => `'${a.replace(/'/g, "''")}'`;
     const shell = powershellExe();
     // This PowerShell's PID: ending its tree closes the -NoExit tab or window.
-    const ps = `${pidFile ? `$PID | Set-Content -LiteralPath ${q(pidFile)}; ` : ""}Set-Location ${q(cwd)}; & ${fullCmd.map(q).join(" ")}`;
+    // The pid file gone after the agent means closeSessions ended it: exit 0, which closes
+    // the tab (Windows Terminal keeps one open after a non-zero exit). An agent that ends
+    // by itself leaves the window open, -NoExit, so what it printed can still be read.
+    const ps = `${pidFile ? `$PID | Set-Content -LiteralPath ${q(pidFile)}; ` : ""}Set-Location ${q(cwd)}; & ${fullCmd.map(q).join(" ")}${pidFile ? `; if (-not (Test-Path -LiteralPath ${q(pidFile)})) { exit 0 }` : ""}`;
     const enc = Buffer.from(ps, "utf16le").toString("base64");
     // herdr (beta on Windows) first, as elsewhere: a new tab, and the run typed into
     // its PowerShell. Typed text ends at a newline, so what is typed is one line, the
@@ -173,19 +184,19 @@ export function findTerminal(cwd: string, fullCmd: string[], pidFile?: string):
     // closes the tab once the run's PowerShell ends.
     const herdr = onPath("herdr");
     if (herdr && answers([herdr, "workspace", "list"])) {
-      const typed = `& ${q(shell)} -NoProfile -EncodedCommand ${enc}; exit`;
+      const typed = `& ${q(shell)} -NoProfile -ExecutionPolicy Bypass -EncodedCommand ${enc}; exit`;
       const launch = `$o = & ${q(herdr)} tab create --cwd ${q(cwd)} --label kaizen --focus | Out-String
 if ($o -match '"pane_id":"([^"]*)"') { & ${q(herdr)} pane run $Matches[1] ${q(typed)} } else { exit 1 }`;
       return { cmd: [shell, "-NoProfile", "-EncodedCommand", Buffer.from(launch, "utf16le").toString("base64")], detached: false };
     }
     const wt = onPath("wt.exe");
     if (wt) {
-      return { cmd: [wt, "-d", cwd, shell, "-NoExit", "-EncodedCommand", enc], detached: true };
+      return { cmd: [wt, "-d", cwd, shell, "-NoExit", "-ExecutionPolicy", "Bypass", "-EncodedCommand", enc], detached: true };
     }
     // `start` reads a title only when quoted; an unquoted word is the command, so
     // "kaizen" here ran kaizen's own launcher. The empty title is what Bun quotes.
     return {
-      cmd: [cmdExe(), "/c", "start", "", "/D", cwd, shell, "-NoExit", "-EncodedCommand", enc],
+      cmd: [cmdExe(), "/c", "start", "", "/D", cwd, shell, "-NoExit", "-ExecutionPolicy", "Bypass", "-EncodedCommand", enc],
       detached: true,
     };
   }
@@ -1297,8 +1308,14 @@ function closeOne(st: string, s: Session): boolean {
   try {
     const pid = parseInt(readText(pidFile));
     if (pid > 0 && isSession(pid, s)) {
-      if (process.platform === "win32") Bun.spawnSync([sysExe("taskkill.exe"), "/T", "/F", "/PID", String(pid)], { stdin: "ignore", stdout: "ignore", stderr: "ignore", timeout: 5000, windowsHide: true });
-      else process.kill(pid, "SIGTERM");
+      if (process.platform === "win32") {
+        // The pid file first, then only the PowerShell's children: the PowerShell sees the
+        // file gone and exits 0 by itself, closing its tab. Killed, it exits 1 and the tab stays.
+        rmSync(pidFile, { force: true });
+        const kids = Bun.spawnSync([powershellExe(), "-NoProfile", "-NonInteractive", "-Command", `(Get-CimInstance Win32_Process -Filter 'ParentProcessId=${pid}').ProcessId`], { stdin: "ignore", stderr: "ignore", timeout: 10000, windowsHide: true }).stdout.toString().match(/\d+/g) ?? [];
+        // No children (a launch from before this): the PowerShell itself, as before.
+        for (const k of kids.length ? kids : [String(pid)]) Bun.spawnSync([sysExe("taskkill.exe"), "/T", "/F", "/PID", k], { stdin: "ignore", stdout: "ignore", stderr: "ignore", timeout: 5000, windowsHide: true });
+      } else process.kill(pid, "SIGTERM");
       closed = true;
     }
   } catch { /* already gone */ }
@@ -1444,7 +1461,7 @@ export function launchRun(it: Item, from: string, run?: string, pick: { agent?:
   // agent inheriting it runs as its child and keeps no transcript, so nothing to resume.
   for (const k of Object.keys(process.env)) if (CHILD_ENV.test(k)) delete process.env[k];
   // onPath, not Bun.which: the board may have taken a login shell's PATH after it started.
-  const agentBin = onPath(agent.cmd) ?? agent.cmd;
+  const agentBin = winShim(onPath(agent.cmd) ?? agent.cmd);
   // No text: a run's conversation reopened as it was, with nothing sent to it.
   const prompt = !it.text ? "" : requestOf(it.where ? `/kaizen ${it.text} (${it.where})` : `/kaizen ${it.text}`, it.notes, from);
   const wanted = pick.model ?? (own?.cmd === agent.cmd ? own.model : null) ?? undefined;

package/cli/web.ts

@@ -1,7 +1,7 @@
 // `kaizen web`: the board in a browser. A loopback HTTP server over state.ts and
 // one HTML page; the page never sees the filesystem, only JSON.
-import { existsSync, readdirSync, statSync, watch, appendFileSync, mkdirSync, type FSWatcher } from "node:fs";
-import { join, dirname, resolve, sep } from "node:path";
+import { existsSync, readdirSync, statSync, watch, appendFileSync, mkdirSync, cpSync, rmSync, type FSWatcher } from "node:fs";
+import { join, dirname, resolve, sep, basename } from "node:path";
 import {
   home, type Item, type Card, boardCards, knownProjects, remember, locate, label, tilde, searchRoots, findProjects,
   readInbox, writeInbox, replaceIdea, moveIdea, abandonRun, launchRun, parseItem, agentChoices, projectOf, KNOWN_AGENTS, plainModel, short, setArchived, writeNotes,
@@ -127,6 +127,13 @@ export async function web(repoDir: string, opts: Opts = {}) {
   // .kaizen is not a sign of one: a group folder that was chosen once has it, and
   // must keep showing what is inside.
   const isProject = (d: string) => [".git", "package.json"].some((m) => existsSync(join(d, m)));
+  // A group holds projects: no project marker of its own, and folders inside. An empty
+  // folder is a project not started yet (New project… makes one), never a group.
+  const isGroup = (d: string) => {
+    if (isProject(d)) return false;
+    try { return readdirSync(d, { withFileTypes: true }).some((e) => e.isDirectory() && !e.name.startsWith(".") && e.name !== "node_modules"); }
+    catch { return false; }
+  };
   // Folders under the "Projects folder" setting that have no .kaizen yet, offered in
   // the project list so one can be chosen without a terminal. A folder that does not
   // look like a project itself (no .git, no package.json) is taken for a group of
@@ -141,7 +148,7 @@ export async function web(repoDir: string, opts: Opts = {}) {
       } catch { return []; }
     };
     // One already set up but never opened joins the known projects instead.
-    return dirs(root).flatMap((d) => isProject(d) ? [d] : dirs(d))
+    return dirs(root).flatMap((d) => isGroup(d) ? dirs(d) : [d])
       .filter((d) => existsSync(join(d, ".kaizen")) ? (remember(d), false) : true).sort();
   };
 
@@ -425,7 +432,7 @@ export async function web(repoDir: string, opts: Opts = {}) {
         const root = await projectsRoot();
         // Windows paths compare without case: c:\users\me\projects holds C:\Users\me\Projects\app.
         // A group folder is what fresh() takes for one, a folder right inside the projects
-        // folder with no .git or package.json; with an empty .kaizen it was chosen once and
+        // folder with no .git or package.json and folders inside; with an empty .kaizen it was chosen once and
         // is hidden. Anything else is a project, a writing one included, even before its
         // first run. A drive or filesystem root already ends in a separator.
         const fold = (p: string) => process.platform === "win32" ? p.toLowerCase() : p;
@@ -434,7 +441,7 @@ export async function web(repoDir: string, opts: Opts = {}) {
         const picker = states(true).filter((d) => {
           const p = dirname(d);
           return !root || d === state || (fold(p).startsWith(inside)
-            && (isProject(p) || filled(d) || fold(dirname(p)) !== fold(root)));
+            && (!isGroup(p) || filled(d) || fold(dirname(p)) !== fold(root)));
         });
         const cards = boardCards(dirs, Date.now());
         // The git mark, for the cards whose panel offers commit and push: one status per project.
@@ -550,7 +557,7 @@ export async function web(repoDir: string, opts: Opts = {}) {
         const v = await npmLatest(url.searchParams.has("fresh"));
         const update = !!v && newer(v, VERSION);
         const notes = update ? await releaseNotes(VERSION, url.searchParams.has("fresh")) : [];
-        return json({ version: VERSION, latest: v, update, notes });
+        return json({ version: VERSION, latest: v, update, notes, failed: upgradeFailed });
       }
 
       // `kaizen upgrade`, run here with no window, then a new board on this port: it
@@ -560,6 +567,21 @@ export async function web(repoDir: string, opts: Opts = {}) {
       if (req.method === "POST" && path === "/upgrade") {
         if (!local(req)) return bad("cross-origin write refused", 403);
         if (upgrading) return bad("an upgrade is already running", 409);
+        // Windows will not rename ~/kaizen while this board holds files in it, so the
+        // upgrade waits in its own process for this one to exit, then starts the board
+        // again; ~/.kaizen/upgrade.log keeps what it said. It runs from a copy of cli/,
+        // so nothing runs out of ~/kaizen while it is renamed.
+        if (process.platform === "win32") {
+          const helper = join(home, ".kaizen", "upgrader");
+          rmSync(helper, { recursive: true, force: true });
+          cpSync(join(repoDir, "cli"), join(helper, "cli"), { recursive: true });
+          const log = Bun.file(UPGRADE_LOG);
+          Bun.spawn([process.execPath, join(helper, "cli", "install.ts"), "upgrade", "--wait", String(process.pid), "--restart", String(srv.port)], {
+            cwd: home, detached: true, stdio: ["ignore", log, log], windowsHide: true,
+          }).unref();
+          setTimeout(() => process.exit(0), 300);
+          return json({ ok: true });
+        }
         upgrading = true;
         try {
           const p = Bun.spawn([process.execPath, join(repoDir, "cli", "install.ts"), "upgrade"], { stdin: "ignore", stdout: "pipe", stderr: "pipe", windowsHide: true });
@@ -688,6 +710,33 @@ export async function web(repoDir: string, opts: Opts = {}) {
           return json({ ok: true, added: knownProjects().length - before });
         }
 
+        // A new, empty project: a folder in the projects folder (else ~/Projects), or
+        // where the page names, set up at once. /find only sees folders that already
+        // have a .kaizen, so a folder made by hand never shows there.
+        if (path === "/new-project") {
+          const name = typeof body.name === "string" ? body.name.trim() : "";
+          // Windows' rules on every platform, so a project made here also opens there:
+          // no reserved device names (CON, NUL, COM1…), no trailing dot or space.
+          const winBad = (n: string) => !n || /[\\/:*?"<>|\x00-\x1f]/.test(n) || /[. ]$/.test(n)
+            || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i.test(n);
+          const t = typeof body.to === "string" ? body.to.trim() : "";
+          const to = t ? resolve(home, nativePath(t.startsWith("~") ? home + t.slice(1) : t))
+            : join((await projectsRoot()) || join(home, "Projects"), name);
+          // The page asks while the name is typed: "con" on the way to "config" is no error yet.
+          if (body.check) return json({ ok: true, to });
+          if (winBad(name)) return bad("name the project: a folder name, without / \\ : * ? \" < > |, not ending in a dot or space, and not CON, NUL, COM1 or the like");
+          if (winBad(basename(to))) return bad(`${basename(to)} cannot be a folder name on Windows`);
+          let used = false;
+          try { used = readdirSync(to).length > 0; } catch (e) { used = existsSync(to); }
+          if (used) return bad(`${to} already exists and is not empty`, 409);
+          // A drive that is not there, a read-only folder, a path too long: said in a toast, not a crash.
+          try { mkdirSync(join(to, ".kaizen"), { recursive: true }); }
+          catch (e) { return bad(`could not create ${to}: ${(e as Error).message}`); }
+          remember(to);
+          changed();
+          return json({ ok: true, dir: join(to, ".kaizen") });
+        }
+
         // Clone a GitHub repository into the projects folder (else ~/Projects) and
         // set it up as a project. Arguments go to git as an array: no shell.
         if (path === "/clone") {
@@ -1124,6 +1173,18 @@ async function openDefault(url: string) {
 let picking = false;
 // One `kaizen upgrade` at a time, from any page.
 let upgrading = false;
+// What a Windows hand-off upgrade said (see POST /upgrade). Read once at start: no
+// "Upgraded" or "Up to date" line means it failed, and its last lines say why.
+const UPGRADE_LOG = join(home, ".kaizen", "upgrade.log");
+const upgradeFailed = (() => {
+  if (!existsSync(UPGRADE_LOG)) return null;
+  const lines = readText(UPGRADE_LOG).replace(/\x1b\[[0-9;]*m/g, "").split("\n").map((l) => l.trim()).filter(Boolean);
+  try { rmSync(UPGRADE_LOG, { force: true }); } catch { /* shown again next start */ }
+  if (lines.some((l) => /^(Upgraded|Up to date)\b/.test(l))) return null;
+  // "kept ~/kaizen (in use …)" is the reason when there is one; else the closing lines.
+  const kept = lines.find((l) => /^\+?\s*kept\b/.test(l));
+  return kept?.replace(/^\+\s*/, "") ?? (lines.filter((l) => !l.startsWith("+")).slice(-2).join(" — ") || "kaizen upgrade said nothing");
+})();
 
 // The system folder picker for this platform, printing the chosen path on stdout.
 // macOS and Windows always have one; on Linux it is whichever desktop tool exists.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kaizen-agent",
-  "version": "1.41.3",
+  "version": "1.42.1",
   "description": "Staged workflow for AI agents — code, writing, research, operations: plan, human approval, build, independent review, bounded fix loop.",
   "type": "module",
   "bin": {

package/skills/kaizen/README.md

@@ -206,7 +206,7 @@ the defaults.
 | `auto_fix.min_severity` | `high` | Lower to `medium` or `low` to have more auto-fixed; raise findings you see instead of auto-fixing |
 | `auto_fix.max_iterations` | `2` | Fix/recheck rounds before whatever is left is escalated to you |
 | `review.memory_max_lines` | `100` | The cap on `memory.md`, which every stage of every run reads. Raise only if the lessons are genuinely all load-bearing |
-| `git.auto_commit` | `false` | Leave it. Kaizen does not commit or push unless you ask |
+| `git.auto_commit` | `false` | `true` commits the files a run changed when it is done, by path. Never pushes |
 | `track.default` | `auto` (inferred) | A repo that is always one kind of work, e.g. a docs repo |
 | `backlog.enabled` | `true` | Set `false` to skip both backlog capture points; the run still executes, just without a `06-backlog.md` |
 | `backlog.file` | `06-backlog.md` | The per-run file name. Rarely. |

package/skills/kaizen/config.default.yml

@@ -125,7 +125,9 @@ state:
   keep_runs: 20
 
 git:
-  # Never commit, push, or open a PR unless the user explicitly asks.
+  # true: when a run reaches done (approved at review, or an auto run finishing),
+  # commit the files that run changed, by path, with its ## Commit message. Never
+  # pushes. false: never commit, push, or open a PR unless the user explicitly asks.
   # Ignored when the project is not a git repository.
   auto_commit: false
   # Create a branch before the implement stage when on the default branch.

package/skills/kaizen/spec-main.md

@@ -131,6 +131,17 @@ change is that it is written down rather than spoken and discarded.
 
 Set `stage: "done"` in `state.json` once the user accepts.
 
+**Commit at done, when `git.auto_commit` is `true`.** Setting `stage: "done"` — the
+user approving at review, or an `auto` run finishing — is then the ask to commit, under
+either runner. Commit only the files this run changed (the paths `03-impl.md` names,
+that `git status` shows changed), by path: `git add -A -- <paths>` then
+`git commit -m <message> -- <paths>`, never the whole tree, since other sessions edit
+the same checkout. The message is `03-impl.md`'s `## Commit`. In a run with a
+`worktree`, commit there. Then write `runs/<id>/07-commit.md` as `commit: <short sha>`
+and `pushed: no`, so the board shows it committed and offers the push. Never push. A
+failed commit is reported as printed; the run is still `done`. With the setting
+`false`, nothing is committed unless the user asks.
+
 ---
 
 ## Child cards

package/skills/kaizen-help/SKILL.md

@@ -95,7 +95,7 @@ Each iteration is written to `runs/<id>/05-iterations/`.
 | `backlog.orphan_file` | `backlog.md` | Where a pruned run's open items are rescued to |
 | `state.dir` | `.kaizen` | State directory |
 | `state.keep_runs` | `20` | Completed runs kept before pruning oldest (rescues open backlog first) |
-| `git.auto_commit` | `false` | Never commit/push/PR unless the user explicitly asks |
+| `git.auto_commit` | `false` | `true`: commit the run's changed files when it is done; never pushes |
 | `git.branch_before_implement` | `true` | Branch before implement stage when on the default branch |
 | `subagents.model` | `inherit` | Model the stage subagents run on (opus/sonnet/haiku, Claude Code only) |
 | `subagents.effort` | `inherit` | Reasoning effort for the stage subagents (low/medium/high, Claude Code only) |

package/web/board/cards.ts

@@ -467,6 +467,7 @@ export function render() {
     ["All projects", "all"],
     ...store.S.projects.map((p) => [p.label, p.dir]),
     ...store.S.fresh.map((p) => [p.label, p.dir, 1]),
+    ["New project…", "__new"],
     ["Find projects on this PC…", "__find"],
     ["Clone from GitHub…", "__clone"],
   ];

package/web/board/main.ts

@@ -12,6 +12,7 @@ import { initKeys } from "./keys.ts";
 import { filterBox, statusSheet } from "./cards.ts";
 import { initLive } from "./live.ts";
 import { store } from "./store.ts";
+import { initViewer } from "./viewer.ts";
 
 initPanel();
 initViews();
@@ -19,6 +20,7 @@ initProjects();
 initUpdate();
 initKeys();
 initLive();
+initViewer();
 filterBox();
 statusSheet();
 

package/web/board/projects.ts

@@ -35,7 +35,7 @@ export function list() {
     store.PL.map((p, i) =>
       p[0].toLowerCase().includes(q)
         ? (p[2] && !g++ ? `<div class="grp">In your projects folder</div>` : "") +
-          `<button role="option" data-i="${i}" title="${esc(p[0])}">${p[1] === "all" ? `<span class="plogo" aria-hidden="true">${ico("board")}</span><span>${esc(p[0])}</span>` : p[1] === "__find" || p[1] === "__clone" ? `<span class="plogo" aria-hidden="true">${ico("plus")}</span><span>${esc(p[0])}</span>` : prow(p[1], p[0])}</button>`
+          `<button role="option" data-i="${i}" title="${esc(p[0])}">${p[1] === "all" ? `<span class="plogo" aria-hidden="true">${ico("board")}</span><span>${esc(p[0])}</span>` : p[1] === "__new" || p[1] === "__find" || p[1] === "__clone" ? `<span class="plogo" aria-hidden="true">${ico("plus")}</span><span>${esc(p[0])}</span>` : prow(p[1], p[0])}</button>`
         : "",
     ).join("") || `<div class="grp">No match</div>`;
   const f = $("projs").querySelector("button");
@@ -55,6 +55,45 @@ async function pick(v) {
     toast("Searching…");
     const j = await post("/find", {});
     if (j.ok) toast(j.added ? `Found ${j.added} new project${j.added === 1 ? "" : "s"}` : "No new projects found");
+  } else if (v === "__new") {
+    // A name, and where it goes: the projects folder unless typed or picked.
+    const dl = modal(
+      `<b>New project</b><input name="name" placeholder="Project name" aria-label="Project name" spellcheck="false" autocomplete="off"><div class="row"><input name="to" placeholder="Create in (a new folder is made)" aria-label="Create in" spellcheck="false" autocomplete="off"><button type="button" class="btn ghost" data-a="pick">Pick…</button></div><div class="row"><button type="button" class="btn ghost" data-a="x">Cancel</button><button class="btn pri">Create</button></div>`,
+    );
+    const f = dl.querySelector("form"),
+      name = f.querySelector("[name=name]"),
+      to = f.querySelector("[name=to]");
+    let auto = ""; // the folder this form filled in; one the user typed is left alone
+    name.oninput = async () => {
+      const n = name.value.trim();
+      if (!n || /[\\/:*?"<>|]/.test(n) || (to.value.trim() && to.value !== auto)) return; // a bad name is reported once, at Create
+      const d = await post("/new-project", { name: n, check: true });
+      if (d.ok && name.value.trim() === n) to.value = auto = d.to;
+    };
+    f.querySelector("[data-a=x]").onclick = () => dl.close();
+    f.querySelector("[data-a=pick]").onclick = async () => {
+      const p = await post("/pick-folder", {});
+      if (p.path)
+        to.value = p.path.replace(/[\\/]+$/, "") + (p.path.includes("\\") ? "\\" : "/") + (name.value.trim() || "");
+    };
+    name.focus();
+    const dir = await new Promise((done) => {
+      dl.addEventListener("close", () => done(null));
+      f.onsubmit = async (e) => {
+        e.preventDefault();
+        if (!name.value.trim()) return name.focus();
+        const j = await post("/new-project", { name: name.value.trim(), to: to.value.trim() || undefined });
+        if (!j.ok) return;
+        done(j.dir);
+        dl.close();
+      };
+    });
+    if (!dir) return;
+    await post("/cd", { dir });
+    store.all = false;
+    store.dir = dir;
+    keep(dir);
+    toast("Project created");
   } else if (v === "__clone") {
     // One form: the link, then where it goes. The folder fills in once the link names a repo.
     const dl = modal(

package/web/board/update.ts

@@ -30,6 +30,7 @@ export function updBar() {
       : "";
     d.innerHTML = `<span>kaizen <b>${esc(upd.latest)}</b> is available. You are running ${esc(upd.version)}.</span><span class="updact">${news}<button class="btn" id="upd-chk">Check for updates</button><button class="btn pri" id="upd-go">Update kaizen</button></span>`;
   }
+  if (ver && ver.failed) d.insertAdjacentHTML("afterbegin", `<span class="updfail" role="alert">Last update failed: ${esc(ver.failed)}</span>`);
   $("pbody").prepend(d);
   const check = $("upd-chk");
   check.onclick = async () => {

package/web/board/viewer.ts

@@ -0,0 +1,47 @@
+// Files the board links to (attachments, Preview screenshots, icebox images) open in a
+// popup over the board rather than a new tab. Ctrl/Cmd/Shift or a middle click still
+// gets the browser's own tab; external links are not files and are left alone.
+const IMG = /\.(png|jpe?g|gif|webp|svg|bmp|avif|ico)$/i;
+
+export function initViewer() {
+  const dlg = document.createElement("dialog");
+  dlg.className = "kz viewer";
+  document.body.append(dlg);
+  // A click on the backdrop lands on the dialog itself, not its contents.
+  dlg.addEventListener("click", (e) => e.target === dlg && dlg.close());
+  dlg.addEventListener("close", () => dlg.replaceChildren());
+
+  document.addEventListener("click", (e) => {
+    if (e.defaultPrevented || e.button !== 0 || e.ctrlKey || e.metaKey || e.shiftKey || e.altKey) return;
+    const a = (e.target as HTMLElement).closest?.("a[href]") as HTMLAnchorElement | null;
+    const href = a?.getAttribute("href") ?? "";
+    if (!/^\/(file|ice-image)\?/.test(href)) return;
+    e.preventDefault();
+    const name = new URLSearchParams(href.split("?")[1]).get("p")?.split("/").pop() ?? "Image";
+    const head = document.createElement("div");
+    head.className = "viewer-hd";
+    const title = document.createElement("span");
+    title.textContent = name;
+    const tab = document.createElement("a");
+    tab.href = href;
+    tab.target = "_blank";
+    tab.rel = "noopener";
+    tab.textContent = "Open in new tab";
+    const x = document.createElement("button");
+    x.className = "btn sm";
+    x.textContent = "Close";
+    x.onclick = () => dlg.close();
+    head.append(title, tab, x);
+    const body =
+      href.startsWith("/ice-image") || IMG.test(name)
+        ? document.createElement("img")
+        : document.createElement("iframe");
+    body.src = href;
+    if (body instanceof HTMLImageElement) {
+      body.alt = name;
+      body.referrerPolicy = "no-referrer";
+    }
+    dlg.replaceChildren(head, body);
+    dlg.showModal();
+  });
+}

package/web/board.html

@@ -219,7 +219,7 @@ section li.hint{display:block;padding:14px;border:1px dashed var(--line);border-
 .inl input::placeholder,.inl textarea::placeholder,.notes textarea::placeholder{color:var(--dim)}
 .inl .row,.notes .row{display:flex;gap:6px;justify-content:flex-end;align-items:center}
 .inl .row .mic{margin-right:0}.inl .row #newpick{margin-right:auto}.inl .row .btn{white-space:nowrap}.inl .att{font-size:12px;color:var(--dim)}.inl .att{font-size:12px;color:var(--dim)}.inl .att:empty{display:none}
-dialog.kz{border:0;padding:0;background:none;width:min(480px,calc(100vw - 32px));max-height:calc(100dvh - 32px);overflow:visible;color:var(--ink)}dialog.kz::backdrop{background:rgb(0 0 0/.45)}dialog.kz .row input{flex:1;min-width:0}dialog.kz #ndc{align-self:flex-start}
+dialog.kz{border:0;padding:0;background:none;width:min(480px,calc(100vw - 32px));max-height:calc(100dvh - 32px);overflow:visible;color:var(--ink)}dialog.kz::backdrop{background:rgb(0 0 0/.45)}dialog.kz .row input{flex:1;min-width:0}dialog.kz #ndc{align-self:flex-start}dialog.viewer{width:min(1100px,calc(100vw - 32px));height:calc(100dvh - 32px);background:var(--bg);border-radius:var(--r);display:none;flex-direction:column;overflow:hidden}dialog.viewer[open]{display:flex}.viewer-hd{display:flex;gap:12px;align-items:center;padding:8px 12px;border-bottom:1px solid var(--line)}.viewer-hd span{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-weight:600}dialog.viewer img{flex:1;min-height:0;width:100%;object-fit:contain}dialog.viewer iframe{flex:1;border:0;width:100%;background:#fff}
 .inl .run-actions{display:grid;gap:8px}.inl .run-actions .row{display:grid;grid-template-columns:repeat(2,minmax(0,1fr))}.inl .run-actions .pri{grid-column:1/-1}
 .notes{display:flex;flex-direction:column;gap:8px}
 #pbody img{max-width:100%;border-radius:var(--r-s)}
@@ -338,6 +338,7 @@ aside .foot .more .menu-pop{left:0;right:auto;top:auto;bottom:calc(100% + 4px)}.
 .updnew:hover .updpop,.updnew:focus-within .updpop{display:block}
 .updpop ul{margin:0 0 8px;padding-left:18px}.updpop li{margin:2px 0}.updpop a{color:var(--accent)}
 .updbar.quiet{border:0;background:none;padding:0;margin-bottom:32px;color:var(--dim)}#psub:empty{display:none}
+.updfail{flex-basis:100%;color:var(--warn)}
 .toast.on.rep{pointer-events:auto}.toast a{color:inherit;margin-left:8px;text-decoration:underline;text-underline-offset:2px}
 .help{position:fixed;inset:0;z-index:12;display:none;align-items:center;justify-content:center;background:color-mix(in srgb,var(--bg) 60%,transparent);backdrop-filter:blur(3px)}
 .help.on{display:flex}.help div{background:var(--bg-2);border:1px solid var(--line);border-radius:var(--r);padding:24px 28px;box-shadow:var(--shadow-2)}