kryptheon 0.1.38 → 0.1.40

package/LICENSE

@@ -5,7 +5,7 @@ Copyright (c) 2026 Kryptheon (https://kryptheon.tech). All rights reserved.
 This software is proprietary. It is not open source.
 
 1. Use. You may install and run this software, as published by Kryptheon,
-   free of charge, to check software and databases that you own or are
+   at no charge, to check software and databases that you own or are
    authorised to test. Features that kryptheon.tech offers on a paid plan
    are provided only under that plan and the Terms at
    https://kryptheon.tech/terms.

package/README.md

@@ -1,261 +1,261 @@
-# kryptheon
-
-Record a flow in your app once, replay it after every AI change, and get told in
-plain English what broke.
-
-Runs entirely on your machine. No account, no API key, nothing leaves your
-computer. It is a wrapper around [Playwright](https://playwright.dev).
-
-## The one command
-
-```
-npx kryptheon@latest dashboard
-```
-
-Run it in your project's folder. It opens a page in your browser, and
-everything else is a button on that page:
-
-| | how often |
-| --- | --- |
-| Read my code | after every change |
-| Record a flow | one time - again only when that flow changes |
-| Replay | after every change |
-| Connect your database | one time |
-| Check my database | after every change |
-| Set up the nightly check | one time |
-| Re-check a finding | after every change |
-
-Every button shows the terminal command that does the same thing, in small
-print, for when the page cannot be used. The database connection string is
-pasted into the page, used for one run, and never saved, logged or shown
-again; reload the page and it is gone.
-
-## Only have a web address?
-
-Built your app in Lovable, Bolt or v0, and there is no project folder on your
-computer? Open a terminal and run:
-
-```
-npx kryptheon record https://your-app.lovable.app
-```
-
-Before it opens anything, it looks at the folder you are in. If that folder is
-not set up for recordings it says so and asks first, then adds a `package.json`
-and kryptheon itself (about 20MB) — nothing else. A new terminal opens in your
-home folder, so from there it keeps your recordings in a `kryptheon-tests`
-folder of their own and tells you where that is.
-
-After every change to your app, from that same folder:
-
-```
-npx kryptheon check
-```
-
-## Install
-
-```
-npm i -D kryptheon
-```
-
-Install it into your project, not globally — every recording imports
-`kryptheon/kryptheon-fixture`, and your tests can only find that if kryptheon is
-in your project's `node_modules`.
-
-## Record
-
-```
-npx kryptheon record https://your-app.example.com
-```
-
-A browser opens. Use your app the way a customer would. Close the browser when
-you are done, and the recording is saved as a test.
-
-Add `--phone` to record in a phone-sized window (390 x 844) - for a menu or a
-layout that only changes on a phone. The recording keeps that size, so every
-replay uses it too. On the dashboard it is the "Phone size" box under Record.
-
-On its own, a recording knows that every button and field is still there and
-that the last page looks the same. To say what must be true — "Reservation
-received" appears after booking — use the toolbar at the top of the page while
-recording:
-
-| Button | Click it, then click… | Kryptheon then checks |
-| --- | --- | --- |
-| Eye | any element | it is on the page |
-| `ab` | some text | that text is there |
-| Box | a filled-in field | the field still holds that value |
-| `{ }` | a part of the page | that part is laid out the same |
-
-The round red button pauses and resumes recording. The arrow only shows how an
-element would be found; it adds nothing to the test. One check at the end of a
-flow — on the success message — is usually all a recording needs.
-
-## Check
-
-```
-npx kryptheon check
-```
-
-Runs everything you have recorded:
-
-```
-OK  Sign in  (4.1s)
-
-X  Checkout
-   Could not find the button "Place order" on the page.
-   This was working on 12 Mar at 9:14 AM.
-   What to check: your last change may have renamed, hidden, or removed it.
-   Where to look:
-     - Browser was on: https://your-app.example.com/cart
-     - POST /api/orders returned 500
-       the server crashed or is unavailable - the error is in backend code, not the page
-```
-
-Every failure ends with a short summary you can paste straight into an AI coding
-tool.
-
-## Recording something that replays
-
-A recording is only useful if it still works the second time. So:
-
-- **Record one simple flow.** Sign in and look at a page. Open a thing and check
-  it loaded. Short beats thorough.
-- **Sign in with an account that already exists.** Do not sign up during a
-  recording — the account exists next time, and the signup step fails.
-- **Avoid steps that cannot repeat.** Adding data piles up a row on every run.
-  Logging out at the end means the next run does not start where this one did.
-
-Kryptheon warns you about these after a recording, and names the exact step.
-
-## Make your AI assistant check its own work
-
-An assistant will happily call a change done after only reading the code. This
-writes a rule into the files assistants already read, so it has to run the check
-first:
-
-```
-npx kryptheon setup-ai
-```
-
-It writes `CLAUDE.md`, `AGENTS.md` and `.cursorrules`. If a file already exists,
-it adds a marked section at the end rather than overwriting anything, and
-running it again replaces that section instead of adding a second copy.
-
-The rule: after any change, run `npx kryptheon check`, show the output, and do
-not report the work as done until it passes.
-
-For an assistant running the check after every change, `--quiet` keeps the
-conversation readable — one line when everything passes, the full explanation
-only when something breaks:
-
-```
-npx kryptheon check --quiet
-```
-
-```
-OK  3 recordings still working.
-```
-
-## Automatic checks
-
-The first time a test passes, kryptheon remembers where the browser ended up and
-what the page was called. If either changes later, the test fails and says what
-changed — so a recording catches regressions without you writing a single
-assertion.
-
-When a change is intentional, accept it for that one test:
-
-```
-npx kryptheon accept "Checkout"
-```
-
-`npx kryptheon accept` on its own lists what has been saved.
-
-## Renamed buttons
-
-A button that only changed its words has not broken anything. When a step
-cannot find "Reserve a table" and the page shows exactly one new button in its
-place — "Reserve here" — kryptheon clicks that one, carries on through the rest
-of the flow, and says so:
-
-```
-OK  Reserve a table  (16.0s)
-    Renamed: The button "Reserve a table" is now called "Reserve here" - I used "Reserve here" and carried on.
-    Nothing is broken. To stop seeing this, record the flow again.
-```
-
-It only does this when the page proves it: one name gone, the one the step
-wanted, and one new name of the same kind. A button that is gone with nothing
-in its place, or a rename next to other new buttons, fails as it always did.
-Checks you added with the toolbar are never redirected.
-
-## Dashboard
-
-```
-npx kryptheon
-```
-
-In a terminal, with no command, this opens a page on your own machine
-(`http://127.0.0.1:4789/`) for this project, in your browser by itself (the
-address is printed too): what is broken, what needs a look, every run, recent
-changes, and switches for each check. Every check runs from a button, one at a
-time, with its progress shown on the page as it goes. It is only reachable
-from this machine; press Ctrl+C to stop it. From a script, use
-`npx kryptheon dashboard`; set `KRYPTHEON_NO_OPEN=1` to keep the browser shut.
-
-It opens on the one thing to do next, and under it "Start here": read your
-code, record your main flows, replay them, connect and check your database,
-and set up the nightly check - each marked done only once it has actually run,
-and each labelled "one time" or "after every change".
-
-Checks that are not built yet are listed as "not available" - never as
-passed.
-
-## Reading your code
-
-```
-npx kryptheon code
-```
-
-Reads your frontend code for values put into the page as HTML - `innerHTML`,
-`insertAdjacentHTML`, `document.write`, React's `dangerouslySetInnerHTML`,
-Vue's `v-html`. If such a value can hold text someone typed, a `<` in it can
-run script with the signed-in person's session. Nothing is run; every result
-is "verification required", ranked HIGH when the value comes from a server
-response or an error message, MEDIUM when the code alone cannot say. The fix
-prompt for each one names the file, line and value.
-
-## What goes where
-
-Only your recordings go in your project, in `tests/`. Everything Kryptheon
-remembers about the project is kept outside it, so it can never end up in your
-repo:
-
-    ~/.kryptheon/projects/<folder-name>-<id>/
-      baselines.json   the remembered result for each test
-      history.jsonl    one line per run, used for "this was working on …"
-      test-results/    the screenshot of the last failure
-
-Set `KRYPTHEON_HOME` to keep them somewhere else. Each project folder gets its
-own store, so two projects are never mixed. A project folder that is moved or
-renamed starts a new store.
-
-Older versions kept `kryptheon-baselines.json`, `kryptheon-history.jsonl` and
-`test-results/` in the project. The first run of this version moves them out,
-once, and says so.
-
-A `.env` in the same folder is loaded automatically, and anything you type into a
-password box is replaced with an environment variable rather than written into
-the test. When there is a password, `.env` is added to an existing `.gitignore`.
-
-## Requirements
-
-Node 20.6 or later. The first run downloads a browser (about 200MB, once).
-
-Recording opens a browser window, so it needs a machine with a screen. It will
-always try — if no window appears within 30 seconds it stops and says so,
-rather than refusing up front.
-
-## Licence
-
-Free to use, not open source: see LICENSE. Paid features are on kryptheon.tech.
+# kryptheon
+
+Record a flow in your app once, replay it after every AI change, and get told in
+plain English what broke.
+
+Runs entirely on your machine. No account, no API key, nothing leaves your
+computer. It is a wrapper around [Playwright](https://playwright.dev).
+
+## The one command
+
+```
+npx kryptheon@latest dashboard
+```
+
+Run it in your project's folder. It opens a page in your browser, and
+everything else is a button on that page:
+
+| | how often |
+| --- | --- |
+| Read my code | after every change |
+| Record a flow | one time - again only when that flow changes |
+| Replay | after every change |
+| Connect your database | one time |
+| Check my database | after every change |
+| Set up the nightly check | one time |
+| Re-check a finding | after every change |
+
+Every button shows the terminal command that does the same thing, in small
+print, for when the page cannot be used. The database connection string is
+pasted into the page, used for one run, and never saved, logged or shown
+again; reload the page and it is gone.
+
+## Only have a web address?
+
+Built your app in Lovable, Bolt or v0, and there is no project folder on your
+computer? Open a terminal and run:
+
+```
+npx kryptheon record https://your-app.lovable.app
+```
+
+Before it opens anything, it looks at the folder you are in. If that folder is
+not set up for recordings it says so and asks first, then adds a `package.json`
+and kryptheon itself (about 20MB) — nothing else. A new terminal opens in your
+home folder, so from there it keeps your recordings in a `kryptheon-tests`
+folder of their own and tells you where that is.
+
+After every change to your app, from that same folder:
+
+```
+npx kryptheon check
+```
+
+## Install
+
+```
+npm i -D kryptheon
+```
+
+Install it into your project, not globally — every recording imports
+`kryptheon/kryptheon-fixture`, and your tests can only find that if kryptheon is
+in your project's `node_modules`.
+
+## Record
+
+```
+npx kryptheon record https://your-app.example.com
+```
+
+A browser opens. Use your app the way a customer would. Close the browser when
+you are done, and the recording is saved as a test.
+
+Add `--phone` to record in a phone-sized window (390 x 844) - for a menu or a
+layout that only changes on a phone. The recording keeps that size, so every
+replay uses it too. On the dashboard it is the "Phone size" box under Record.
+
+On its own, a recording knows that every button and field is still there and
+that the last page looks the same. To say what must be true — "Reservation
+received" appears after booking — use the toolbar at the top of the page while
+recording:
+
+| Button | Click it, then click… | Kryptheon then checks |
+| --- | --- | --- |
+| Eye | any element | it is on the page |
+| `ab` | some text | that text is there |
+| Box | a filled-in field | the field still holds that value |
+| `{ }` | a part of the page | that part is laid out the same |
+
+The round red button pauses and resumes recording. The arrow only shows how an
+element would be found; it adds nothing to the test. One check at the end of a
+flow — on the success message — is usually all a recording needs.
+
+## Check
+
+```
+npx kryptheon check
+```
+
+Runs everything you have recorded:
+
+```
+OK  Sign in  (4.1s)
+
+X  Checkout
+   Could not find the button "Place order" on the page.
+   This was working on 12 Mar at 9:14 AM.
+   What to check: your last change may have renamed, hidden, or removed it.
+   Where to look:
+     - Browser was on: https://your-app.example.com/cart
+     - POST /api/orders returned 500
+       the server crashed or is unavailable - the error is in backend code, not the page
+```
+
+Every failure ends with a short summary you can paste straight into an AI coding
+tool.
+
+## Recording something that replays
+
+A recording is only useful if it still works the second time. So:
+
+- **Record one simple flow.** Sign in and look at a page. Open a thing and check
+  it loaded. Short beats thorough.
+- **Sign in with an account that already exists.** Do not sign up during a
+  recording — the account exists next time, and the signup step fails.
+- **Avoid steps that cannot repeat.** Adding data piles up a row on every run.
+  Logging out at the end means the next run does not start where this one did.
+
+Kryptheon warns you about these after a recording, and names the exact step.
+
+## Make your AI assistant check its own work
+
+An assistant will happily call a change done after only reading the code. This
+writes a rule into the files assistants already read, so it has to run the check
+first:
+
+```
+npx kryptheon setup-ai
+```
+
+It writes `CLAUDE.md`, `AGENTS.md` and `.cursorrules`. If a file already exists,
+it adds a marked section at the end rather than overwriting anything, and
+running it again replaces that section instead of adding a second copy.
+
+The rule: after any change, run `npx kryptheon check`, show the output, and do
+not report the work as done until it passes.
+
+For an assistant running the check after every change, `--quiet` keeps the
+conversation readable — one line when everything passes, the full explanation
+only when something breaks:
+
+```
+npx kryptheon check --quiet
+```
+
+```
+OK  3 recordings still working.
+```
+
+## Automatic checks
+
+The first time a test passes, kryptheon remembers where the browser ended up and
+what the page was called. If either changes later, the test fails and says what
+changed — so a recording catches regressions without you writing a single
+assertion.
+
+When a change is intentional, accept it for that one test:
+
+```
+npx kryptheon accept "Checkout"
+```
+
+`npx kryptheon accept` on its own lists what has been saved.
+
+## Renamed buttons
+
+A button that only changed its words has not broken anything. When a step
+cannot find "Reserve a table" and the page shows exactly one new button in its
+place — "Reserve here" — kryptheon clicks that one, carries on through the rest
+of the flow, and says so:
+
+```
+OK  Reserve a table  (16.0s)
+    Renamed: The button "Reserve a table" is now called "Reserve here" - I used "Reserve here" and carried on.
+    Nothing is broken. To stop seeing this, record the flow again.
+```
+
+It only does this when the page proves it: one name gone, the one the step
+wanted, and one new name of the same kind. A button that is gone with nothing
+in its place, or a rename next to other new buttons, fails as it always did.
+Checks you added with the toolbar are never redirected.
+
+## Dashboard
+
+```
+npx kryptheon
+```
+
+In a terminal, with no command, this opens a page on your own machine
+(`http://127.0.0.1:4789/`) for this project, in your browser by itself (the
+address is printed too): what is broken, what needs a look, every run, recent
+changes, and switches for each check. Every check runs from a button, one at a
+time, with its progress shown on the page as it goes. It is only reachable
+from this machine; press Ctrl+C to stop it. From a script, use
+`npx kryptheon dashboard`; set `KRYPTHEON_NO_OPEN=1` to keep the browser shut.
+
+It opens on the one thing to do next, and under it "Start here": read your
+code, record your main flows, replay them, connect and check your database,
+and set up the nightly check - each marked done only once it has actually run,
+and each labelled "one time" or "after every change".
+
+Checks that are not built yet are listed as "not available" - never as
+passed.
+
+## Reading your code
+
+```
+npx kryptheon code
+```
+
+Reads your frontend code for values put into the page as HTML - `innerHTML`,
+`insertAdjacentHTML`, `document.write`, React's `dangerouslySetInnerHTML`,
+Vue's `v-html`. If such a value can hold text someone typed, a `<` in it can
+run script with the signed-in person's session. Nothing is run; every result
+is "verification required", ranked HIGH when the value comes from a server
+response or an error message, MEDIUM when the code alone cannot say. The fix
+prompt for each one names the file, line and value.
+
+## What goes where
+
+Only your recordings go in your project, in `tests/`. Everything Kryptheon
+remembers about the project is kept outside it, so it can never end up in your
+repo:
+
+    ~/.kryptheon/projects/<folder-name>-<id>/
+      baselines.json   the remembered result for each test
+      history.jsonl    one line per run, used for "this was working on …"
+      test-results/    the screenshot of the last failure
+
+Set `KRYPTHEON_HOME` to keep them somewhere else. Each project folder gets its
+own store, so two projects are never mixed. A project folder that is moved or
+renamed starts a new store.
+
+Older versions kept `kryptheon-baselines.json`, `kryptheon-history.jsonl` and
+`test-results/` in the project. The first run of this version moves them out,
+once, and says so.
+
+A `.env` in the same folder is loaded automatically, and anything you type into a
+password box is replaced with an environment variable rather than written into
+the test. When there is a password, `.env` is added to an existing `.gitignore`.
+
+## Requirements
+
+Node 20.6 or later. The first run downloads a browser (about 200MB, once).
+
+Recording opens a browser window, so it needs a machine with a screen. It will
+always try — if no window appears within 30 seconds it stops and says so,
+rather than refusing up front.
+
+## Licence
+
+Proprietary software, not open source - see LICENSE. It runs on your own machine, with no account and no card. The nightly check, with its morning report, alerts and history, is part of the Pro and Studio plans on kryptheon.tech.

package/bin/kryptheon.js

@@ -2537,6 +2537,88 @@ function openInBrowser(url) {
   }
 }
 
+/**
+ * The person's own folder picker, on this computer: the one Windows or the
+ * Mac shows everywhere else. Resolves to the folder, or null when it was
+ * closed. KRYPTHEON_CHOOSE_FOLDER answers instead, for the checks - no
+ * window is shown then.
+ *
+ * Found when the first person paid: the dashboard opened from Win+R is for
+ * a kryptheon-tests folder, and nothing on it said how to point it at an
+ * app whose code is on this computer.
+ */
+function chooseFolder() {
+  if (process.env.KRYPTHEON_CHOOSE_FOLDER !== undefined) return Promise.resolve(process.env.KRYPTHEON_CHOOSE_FOLDER || null);
+  return new Promise((resolve) => {
+    let cmd;
+    let args;
+    if (process.platform === 'win32') {
+      // A form kept on top owns the dialog, or it opens behind the browser.
+      const script = [
+        '[Console]::OutputEncoding = [Text.Encoding]::UTF8',
+        'Add-Type -AssemblyName System.Windows.Forms',
+        '$owner = New-Object System.Windows.Forms.Form -Property @{ TopMost = $true; ShowInTaskbar = $false }',
+        '$f = New-Object System.Windows.Forms.FolderBrowserDialog',
+        "$f.Description = 'Choose your app''s folder - the one with its package.json'",
+        '$f.ShowNewFolderButton = $false',
+        "if ($f.ShowDialog($owner) -eq 'OK') { [Console]::Out.Write($f.SelectedPath) }",
+      ].join('; ');
+      cmd = 'powershell.exe';
+      args = ['-NoProfile', '-STA', '-ExecutionPolicy', 'Bypass', '-Command', script];
+    } else if (process.platform === 'darwin') {
+      cmd = 'osascript';
+      args = ['-e', 'POSIX path of (choose folder with prompt "Choose your app\'s folder - the one with its package.json")'];
+    } else {
+      return resolve(null);
+    }
+    let out = '';
+    const child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
+    child.stdout.on('data', (c) => (out += c));
+    child.on('error', () => resolve(null));
+    child.on('close', () => {
+      const folder = out.trim().replace(/\/$/, '');
+      resolve(folder && fs.existsSync(folder) && fs.statSync(folder).isDirectory() ? folder : null);
+    });
+  });
+}
+
+/**
+ * A dashboard for that folder, in a window of its own - the same line as
+ * Win+R, started there. The port this one holds is taken, so that one picks
+ * a free port and opens its own browser tab. KRYPTHEON_OPEN_FOLDER_LOG names
+ * a file the folder is written to instead, for the checks.
+ */
+function openFolderDashboard(folder) {
+  const where = path.resolve(folder);
+  const plan = project.setupPlan(where);
+  if (plan.action === 'refuse') {
+    return { ok: false, why: plan.reason === 'system' ? 'that is a system folder, not an app' : 'that folder cannot be used' };
+  }
+  if (process.env.KRYPTHEON_OPEN_FOLDER_LOG) {
+    fs.appendFileSync(process.env.KRYPTHEON_OPEN_FOLDER_LOG, where + '\n');
+    return { ok: true, opened: path.basename(where) };
+  }
+  try {
+    let child;
+    if (process.platform === 'win32') {
+      // start's first quoted word is the window's title; /d is where it runs.
+      child = spawn('cmd.exe', ['/c', 'start "Kryptheon - ' + path.basename(where).replace(/["%^&|<>]/g, '') + '" /d "' + where + '" cmd /k npx -y kryptheon@latest dashboard'],
+        { detached: true, stdio: 'ignore', windowsVerbatimArguments: true, env: Object.assign({}, process.env, { KRYPTHEON_FOLDER_CHOSEN: '1' }) });
+    } else if (process.platform === 'darwin') {
+      const line = 'cd ' + JSON.stringify(where) + ' && KRYPTHEON_FOLDER_CHOSEN=1 npx -y kryptheon@latest dashboard';
+      child = spawn('osascript', ['-e', 'tell application "Terminal" to do script ' + JSON.stringify(line), '-e', 'tell application "Terminal" to activate'],
+        { detached: true, stdio: 'ignore' });
+    } else {
+      return { ok: false, why: 'open a terminal in that folder and run: npx kryptheon@latest dashboard' };
+    }
+    child.on('error', () => {});
+    child.unref();
+    return { ok: true, opened: path.basename(where) };
+  } catch (err) {
+    return { ok: false, why: 'the new window could not be opened: ' + err.message };
+  }
+}
+
 /**
  * Whether this project's dashboard is already running on the usual port -
  * started at sign-in, most likely - by asking it which project it shows.
@@ -2625,6 +2707,26 @@ async function dashboardCommand() {
   if (!here.ok) {
     const plan = project.setupPlan(USER_DIR);
     if (plan.action === 'home') return await dashboardFromHome(plan);
+    // A folder of the person's own with no package.json - a site exported
+    // from a builder, or one chosen on the dashboard's "Choose its folder" -
+    // is set up the way record sets one up: said first, asked once.
+    if (plan.action === 'create') {
+      for (const line of project.setupLines(plan)) console.log(line);
+      // Without a keyboard to ask, only a window the person opened for this
+      // folder - "Choose its folder" marks it - is taken as a yes. Anything
+      // else run here unattended writes nothing.
+      const question = project.setupQuestion(plan);
+      const yes = process.stdin.isTTY
+        ? project.answeredYes(await askLine(question.text), question.yesByDefault)
+        : process.env.KRYPTHEON_FOLDER_CHOSEN === '1';
+      if (!yes || !makeReady(USER_DIR)) {
+        console.log('');
+        console.log('  Nothing was changed.');
+        console.log('');
+        return 1;
+      }
+      return await dashboardCommand();
+    }
     for (const line of project.noProjectLines(here)) console.error(line);
     return 1;
   }
@@ -2651,6 +2753,8 @@ async function dashboardCommand() {
     record: (address, say, options) => recordFromDashboard(address, say, options),
     db: (action, connection, say) => databaseFromDashboard(action, connection, say),
     words: (connection) => nightWords(connection),
+    chooseFolder: () => chooseFolder(),
+    openFolder: (folder) => openFolderDashboard(folder),
   });
   let port;
   try {

package/kryptheon-dashboard-page.js

@@ -51,6 +51,7 @@
     arrow: 'M5 12h14m-6-6l6 6-6 6',
     sun: 'M12 16a4 4 0 100-8 4 4 0 000 8zM12 2v2m0 16v2M4.9 4.9l1.4 1.4m11.4 11.4l1.4 1.4M2 12h2m16 0h2M4.9 19.1l1.4-1.4M17.7 6.3l1.4-1.4',
     terminal: 'M4 5h16v14H4zM7 9l3 3-3 3M13 15h4',
+    folder: 'M3 6h6l2 2h10v11H3z',
     dot: 'M12 12h.01',
   };
   function icon(name, size) {
@@ -155,6 +156,12 @@
   recordInput.placeholder = 'http://localhost:3000';
   recordInput.setAttribute('aria-label', 'Your app address');
   recordInput.spellcheck = false;
+  // The app's web address, at the top of the page: kept like the others.
+  var appInput = el('input', 'field');
+  appInput.type = 'url';
+  appInput.placeholder = 'https://my-app.lovable.app';
+  appInput.setAttribute('aria-label', 'Your app\'s web address');
+  appInput.spellcheck = false;
   // Kept like the box beside it, so a page refresh does not untick it.
   var phoneBox = el('input');
   phoneBox.type = 'checkbox';
@@ -1103,11 +1110,71 @@
     if (!busy) { clear(run); run.appendChild(icon('play', 15)); run.appendChild(el('span', null, 'Run checks')); }
   }
 
+  /* ------------------------------ your app ------------------------------ */
+
+  // Found when the first person paid: the dashboard opened from Win+R is for
+  // a kryptheon-tests folder, and nothing said which app it checks or how to
+  // point it at one. Said first: the app's web address - all a Lovable app
+  // has - and, for code on this computer, its folder.
+  function renderApp() {
+    var box = byId('appBox');
+    if (!box) return;
+    var app = state.app || {};
+    clear(box);
+    if (document.activeElement !== appInput && !appInput.value && app.address) appInput.value = app.address;
+    if (!recordInput.value && app.address) recordInput.value = app.address;
+
+    if (!app.webOnly) {
+      var here = el('p', 'app-here');
+      here.appendChild(document.createTextNode('This dashboard checks the code in '));
+      here.appendChild(el('b', null, (state.project && state.project.name) || 'this folder'));
+      here.appendChild(el('small', 'app-path', app.folder || ''));
+      box.appendChild(here);
+    }
+    var label = el('label', 'app-label', app.webOnly ? 'Your app\'s web address' : 'Its web address - optional, for recording it');
+    box.appendChild(label);
+    var row = el('div', 'field-row');
+    row.appendChild(appInput);
+    var save = button('sun sm', 'check', app.address ? 'Save' : 'Save the address', function () {
+      post('/api/app', { address: appInput.value.trim() }).then(function (r) {
+        appInput.value = r.address || '';
+        if (!recordInput.value || recordInput.value === app.address) recordInput.value = r.address || '';
+        toast(r.address ? 'Saved. Record starts from ' + r.address : 'Cleared.');
+        load();
+      }, function (err) { toast(err.message); });
+    });
+    row.appendChild(save);
+    box.appendChild(row);
+    box.appendChild(el('div', 'fallback', app.address
+      ? 'Saved: ' + app.address + ' - Record and the checks start from it.'
+      : 'The address you open your app at. For a Lovable app it ends in .lovable.app. That is all Kryptheon needs.'));
+
+    if (app.canChooseFolder) {
+      var other = el('div', 'app-folder');
+      other.appendChild(el('p', null, app.webOnly
+        ? 'Is your app\'s code on this computer - from Cursor, Bolt or GitHub?'
+        : 'Another app on this computer?'));
+      var pick = button('', 'folder', app.webOnly ? 'Choose its folder...' : 'Open another app\'s folder...', function () {
+        pick.disabled = true;
+        toast('A folder picker is opening - it may be behind this window.');
+        post('/api/choose-folder', {}).then(function (r) {
+          toast('Opening a dashboard for ' + r.opened + ' in a new window. It opens in your browser by itself.');
+        }, function (err) {
+          toast(/no folder was chosen/.test(err.message) ? 'No folder chosen.' : 'It did not open: ' + err.message);
+        }).then(function () { pick.disabled = false; });
+      });
+      other.appendChild(pick);
+      other.appendChild(el('div', 'fallback', 'Its own dashboard opens in a new window, for that folder: recordings and checks then live beside your code, and Kryptheon can read it.'));
+      box.appendChild(other);
+    }
+  }
+
   function render(next) {
     if (!next) return;
     state = next;
     renderSide();
     renderTop();
+    renderApp();
     renderNow();
     renderSteps();
     renderKeep();

package/kryptheon-dashboard.html

@@ -289,6 +289,15 @@
   .field { flex: 1; min-width: 220px; width: 100%; padding: 10px 12px; font: 13px/1.4 var(--mono); color: var(--on-light); background: var(--white); border: 1px solid var(--on-light); border-radius: 0; }
   .field-row .btn { margin-top: 0; }
   .field-note { font-size: 13px; line-height: 1.55; color: var(--muted); }
+  /* --- your app: which app this dashboard checks ----------------------------- */
+  .app-card { margin-bottom: 26px; }
+  #appBox { display: grid; gap: 10px; max-width: 760px; margin-top: 16px; }
+  .app-label { font: 11px var(--mono); letter-spacing: 0.08em; text-transform: uppercase; color: var(--muted); }
+  .app-here { font-size: 15px; line-height: 1.5; }
+  .app-path { display: block; margin-top: 2px; font: 11px var(--mono); color: var(--muted); overflow-wrap: anywhere; }
+  .app-folder { display: grid; gap: 10px; margin-top: 14px; padding-top: 16px; border-top: 1px solid var(--line); }
+  .app-folder p { font-size: 15px; line-height: 1.5; }
+  .app-folder .btn { justify-self: start; }
   .controls pre { margin: 0; padding: 14px 16px; font: 12px/1.65 var(--mono); white-space: pre-wrap; overflow-wrap: anywhere; }
   .controls pre.help { color: var(--on-light); background: rgba(18, 22, 29, 0.05); border-left: 2px solid var(--on-light); }
   .controls pre.warn { color: var(--orange-deep); background: rgba(255, 77, 0, 0.06); border-left: 2px solid var(--orange); }
@@ -351,6 +360,10 @@
     <section class="job" id="job" hidden aria-live="polite"></section>
 
     <section class="view" id="view-dashboard">
+      <div class="card app-card" id="appCard">
+        <div class="card-head"><div><h3>Your app</h3><div class="c-sub">What this dashboard checks</div></div></div>
+        <div id="appBox"></div>
+      </div>
       <div class="sky" id="sky">
         <div class="s-chip" id="skyIcon"></div>
         <div class="s-text">

package/kryptheon-dashboard.js

@@ -200,6 +200,13 @@ const EVERY_CHANGE = 'after every change';
 function startSteps(checks, seen) {
   const on = (id) => (checks.find((c) => c.id === id) || {}).enabled;
   const nightly = seen.nightly || null;
+  // With no code on this computer - the home folder's dashboard - there is
+  // no code to read, and "Read your frontend code" would only say it read
+  // nothing. The app is checked by its address.
+  return startStepList(on, seen, nightly).filter((s) => !(seen.webOnly && s.id === 'frontend'));
+}
+
+function startStepList(on, seen, nightly) {
   return [
     {
       id: 'frontend',
@@ -508,7 +515,9 @@ function buildState(root, env) {
     };
   });
 
+  const webOnly = isHomeKept(root, env);
   const steps = startSteps(checks, {
+    webOnly: webOnly,
     codeAt: code ? code.checkedAt : null,
     recordings: recordings,
     lastRunAt: lastRun ? lastRun.runAt : null,
@@ -542,6 +551,15 @@ function buildState(root, env) {
     runs: history.slice().reverse().map((r) => ({ runAt: r.runAt, status: r.status, passed: r.passed, failed: r.failed, durationMs: r.durationMs })),
     recordings: recordings,
     steps: steps,
+    // Which app this dashboard is for: its web address, kept here, and whether
+    // its code is on this computer at all. The dashboard started from the home
+    // folder (Win+R) holds recordings only - the app is a web address.
+    app: {
+      address: readAppAddress(paths),
+      webOnly: webOnly,
+      folder: root,
+      canChooseFolder: process.platform === 'win32' || process.platform === 'darwin',
+    },
     next: nextAction(findings, steps),
     baselines: Object.keys(baselines).length,
     changes: recentChanges(root),
@@ -613,6 +631,33 @@ const JOB_LINES = 400;
  * anything that could be read as an option by the command it is passed to,
  * and anything with a scheme other than http(s).
  */
+/**
+ * The dashboard started from the home folder: the kryptheon-tests folder
+ * there, which holds recordings and nothing of the app's own code.
+ */
+function isHomeKept(root, env) {
+  const environment = env || process.env;
+  const home = environment.USERPROFILE || environment.HOME || require('os').homedir();
+  const tidy = (p) => (process.platform === 'win32' ? path.resolve(p).toLowerCase() : path.resolve(p));
+  return path.basename(root) === 'kryptheon-tests' && tidy(path.dirname(root)) === tidy(home);
+}
+
+/** The app's web address, as saved on the page - or empty. */
+function readAppAddress(paths) {
+  const saved = readJson(path.join(paths.dir, 'app.json'));
+  return saved && typeof saved.address === 'string' ? saved.address : '';
+}
+
+function saveAppAddress(paths, address) {
+  try {
+    fs.mkdirSync(paths.dir, { recursive: true });
+    fs.writeFileSync(path.join(paths.dir, 'app.json'), JSON.stringify({ address: address, savedAt: new Date().toISOString() }, null, 2));
+    return true;
+  } catch (err) {
+    return false;
+  }
+}
+
 function appAddress(value) {
   if (typeof value !== 'string') return null;
   const text = value.trim();
@@ -859,6 +904,26 @@ function createServer(root, options) {
           return begin('db', DB_ACTIONS[action].title, DB_ACTIONS[action].command,
             (say) => opts.db(action, connection, say), secretsOf(connection));
         }
+        if (url.pathname === '/api/app') {
+          // The app's web address: saved for this project, so Record and the
+          // outside check start from it. Empty clears it.
+          const raw = typeof input.address === 'string' ? input.address.trim() : '';
+          const address = raw ? appAddress(raw) : '';
+          if (address === null) return json(res, 400, { ok: false, why: 'that is not a web address - it should look like https://my-app.lovable.app' });
+          const full = address && !/^https?:\/\//i.test(address) ? 'https://' + address : address;
+          return saveAppAddress(store.pathsFor(root, env), full)
+            ? json(res, 200, { ok: true, address: full })
+            : json(res, 500, { ok: false, why: 'it could not be saved on this computer' });
+        }
+        if (url.pathname === '/api/choose-folder' && typeof opts.chooseFolder === 'function' && typeof opts.openFolder === 'function') {
+          // The person's own folder picker, on this computer; then a dashboard
+          // for that folder in a window of its own. Nothing is run in it here.
+          return Promise.resolve(opts.chooseFolder()).then((folder) => {
+            if (!folder) return json(res, 200, { ok: false, cancelled: true, why: 'no folder was chosen' });
+            const opened = opts.openFolder(folder);
+            return json(res, opened.ok ? 200 : 400, Object.assign({ folder: folder }, opened));
+          }, (err) => json(res, 500, { ok: false, why: err.message }));
+        }
         if (url.pathname === '/api/db/words' && typeof opts.words === 'function') {
           // What kryptheon-night itself would say about this string - its help,
           // its consent screens, its warnings - asked of it without connecting.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "description": "Record what you do in your app and get plain-language reports when it breaks.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",