local-kanban 1.11.0 → 1.13.0

package/CHANGELOG.md

@@ -3,10 +3,66 @@
 Notable changes, newest first. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and the project uses [semantic versioning](https://semver.org/).
 
+Anything not shipped yet is collected under **Unreleased**; releasing renames that section to the
+version it goes out as and opens an empty one again. Released sections are history and stay as they are.
+
+## [Unreleased]
+
+## [1.13.0]
+
+### Added
+
+- **The board tells you what's new.** The changelog was written for every release and shown nowhere:
+  the only place to read it was the package page on npm. The About screen now has a "What's new"
+  block. For the version you are running it reads the `CHANGELOG.md` that ships next to the code, so
+  it needs no network at all. When an update is waiting, it shows the notes of the version you do
+  *not* have yet, read from that release's page on GitHub — the decision to update is made on what
+  actually changed, not on a version number. Releases now get such a page: publishing puts the
+  changelog section for that version into it, which also gives the npm page real releases to link to.
+
+### Fixed
+
+- **A folder the board is not allowed to read is no longer reported as missing.** The Check button
+  next to the project folder answered every refusal the same way — "no such folder on this computer" —
+  whether the folder was absent, was a file, or simply could not be read. For a folder without
+  permissions that is plainly untrue: it is there, the board was not let in, and the answer sent you
+  off to fix a path that was already correct. Each case now says what actually happened, and a check
+  that could not reach the server says so instead of blaming the path.
+
+## [1.12.0]
+
+### Added
+
+- **The wizard answers before you press Create.** Three checks with one result line each: the ssh host
+  ("Check" runs a real connection, and says *why* it failed — unknown host, refused key, unknown host
+  key, no answer — rather than handing you ssh's stderr), the project folder, and the project key,
+  whose availability now shows while you type instead of arriving as a refusal after Create. The key
+  line also shows the task prefix you are going to get, which until now you first saw on your first
+  task and could never change.
+
+- **A third way to add a project: let Claude do it.** Half of the form (ssh host, server path, pm2,
+  deploy skill) needs you to go and look something up, and Claude is right there and can look. The
+  first step now offers a ready prompt to copy: it makes Claude inspect the folder, verify the ssh
+  access itself, ask you one question at a time, and register the project when you have both agreed.
+
+- **The git clone mode says where the repository lands.** It was called "clone from a git URL…" and
+  said nothing else. It now shows the actual destination path on this computer, and the two facts you
+  could not have guessed: an existing folder is refused rather than overwritten, and git credentials
+  are never asked for here.
+
 ## [1.11.0]
 
 ### Fixed
 
+- **Where the SSH key or password goes: nowhere, and that is now said out loud.** The fields told
+  you access "comes from your `~/.ssh/config`", which answers where it comes from and not what you
+  are supposed to do. The board holds no credentials at all: it runs `ssh <host>`, and a password
+  cannot work even in principle, because it connects without prompts — key-based access is required.
+  The short test is in the hint now: if `ssh <host>` works in your terminal, it works here. The same
+  paragraph went into the security section of both READMEs, which said nothing about ssh until now.
+  The server fields also got a heading of their own, and the host field shows an address as an
+  example rather than a description of one.
+
 - **The server fields say which side they are about.** "SSH host" and "Server path" gave no hint of
   whether they meant this computer or the machine you deploy to — a fair question, and the owner of
   the board asked it. A line above the group now answers it, and the ssh field says the part you

package/README.md

@@ -38,6 +38,12 @@ than what it actually shipped.
 
 The server listens on **127.0.0.1 only** and has **no authentication**. The board is strictly local: your machine is the trust boundary. **Never expose the port to the network** (no reverse proxies, no `0.0.0.0`, no port forwarding). Third-party integrations should run on the same machine and talk to `127.0.0.1` (see [docs/API.md](docs/API.md)).
 
+**The board holds no credentials.** A project can name an SSH host to deploy to, but neither a key
+nor a password is ever entered here: the board simply runs `ssh <host>`, and who you are, on which
+port and with which key is decided by your own `~/.ssh/config` — the same file your terminal uses.
+A password will not work at all, because the board connects without prompts, so key-based access is
+required. The short test: if `ssh <host>` works in your terminal, it works here.
+
 ## Requirements
 
 - **Node.js ≥ 22** (macOS or Linux) — 24 LTS or newer is what most people have

package/README.ru.md

@@ -38,6 +38,12 @@ English version — [README.md](README.md).
 
 Сервер слушает **только 127.0.0.1**, авторизации **нет**. Доска строго локальная: граница доверия — твоя машина. **Никогда не выставляй порт наружу** (никаких reverse proxy, `0.0.0.0`, проброса портов). Сторонние интеграции запускаются на той же машине и ходят на `127.0.0.1` (см. [docs/API.md](docs/API.md)).
 
+**Доска не хранит доступов.** У проекта можно указать ssh-хост, куда он выкатывается, но ни ключ, ни
+пароль здесь не вводятся: доска просто запускает `ssh <хост>`, а кто ты, на каком порту и с каким
+ключом — решает твой собственный `~/.ssh/config`, тот же файл, которым пользуется терминал. Пароль
+не подойдёт вовсе: доска подключается без запросов, значит нужен ключ. Проверка одной строкой:
+работает `ssh <хост>` в терминале — заработает и здесь.
+
 ## Требования
 
 - **Node.js ≥ 22** (macOS или Linux) — у большинства стоит 24 LTS или новее

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "local-kanban",
-  "version": "1.11.0",
+  "version": "1.13.0",
   "license": "MIT",
   "author": "Dannylamao",
   "repository": {

package/public/js/core.js

@@ -375,9 +375,11 @@ const I18N_RU = {
   'Claude moves these columns itself': 'эти колонки двигает сам Claude',
   'no file': 'файла нет',
   'no folders inside': 'внутри нет папок',
+  'no notes for this version': 'для этой версии заметок нет',
   'no such folder on this computer': 'такой папки на этом компьютере нет',
   'not deleted': 'не удалено',
   'not installed': 'не установлен',
+  'not installed yet': 'ещё не установлена',
   'not set': 'не задан',
   'not set — no deploy': 'не задан — деплоя нет',
   'not there': 'нет файла',
@@ -413,8 +415,32 @@ const I18N_RU = {
   'the skill is not installed — the file will be created on save': 'скилл не установлен — файл появится при сохранении',
   'the update did not go through': 'обновиться не удалось',
   'Run it yourself': 'Выполни сам',
-  'Below is about the SERVER this project is deployed to, not about this computer. Empty means the project stays local.': 'Ниже — про СЕРВЕР, на который выкатывается проект, а не про этот компьютер. Пусто — проект остаётся локальным.',
-  'user, port and key come from your ~/.ssh/config — the board keeps no secrets': 'пользователь, порт и ключ берутся из твоего ~/.ssh/config — секретов доска не хранит',
+  'Server': 'Сервер',
+  'Check': 'Проверить',
+  'checking…': 'проверяю…',
+  'connecting…': 'подключаюсь…',
+  'connected': 'подключились',
+  'the server path is there': 'путь на сервере есть',
+  'but there is no such path on the server': 'но такого пути на сервере нет',
+  'give the ssh host': 'укажи ssh-хост',
+  'the folder is there': 'папка на месте',
+  'subfolders': 'подпапок',
+  'key is free': 'ключ свободен',
+  'task prefix': 'префикс задач',
+  'the folder is there, but the board cannot read it — check its permissions': 'папка есть, но доска не может её прочитать — посмотри права доступа',
+  'this key is already taken by': 'этот ключ уже занят проектом',
+  'no such host — check the name, or add it to your ~/.ssh/config': 'такого хоста нет — проверь имя или добавь его в свой ~/.ssh/config',
+  'the server refused the key — a password will not help here, the key has to be authorized': 'сервер не принял ключ — пароль тут не поможет, ключ надо разрешить на сервере',
+  'the host key is unknown — connect once from your terminal and confirm the fingerprint': 'ключ хоста неизвестен — подключись разок из терминала и подтверди отпечаток',
+  'the server did not answer — wrong address, wrong port, or it is down': 'сервер не ответил — не тот адрес, не тот порт или он лежит',
+  'could not check the folder': 'не удалось проверить папку',
+  'could not connect': 'подключиться не вышло',
+  'on create, git clone puts it on THIS computer at': 'при создании git clone положит его на ЭТОТ компьютер в',
+  'An existing folder is refused, not overwritten. Git credentials are not asked here — access comes from your own git and ssh setup.': 'Если папка уже есть — откажет, а не перезапишет. Логин git тут не спрашивается: доступ берётся из твоих git-настроек и ssh-ключей.',
+  'or let Claude do it': 'или пусть настроит Claude',
+  'Claude looks at the folder itself, checks the server access, and asks you one question at a time. Paste this into your Claude Code chat.': 'Claude сам посмотрит папку, проверит доступ к серверу и задаст вопросы по одному. Вставь это в чат Claude Code.',
+  'Not about this computer. Empty means the project simply stays local.': 'Не про этот компьютер. Пусто — проект просто останется локальным.',
+  'no key or password is entered here: access comes from your ~/.ssh/config, and a password will not do — a key is required. If ssh <host> works in your terminal, it works here.': 'ключ и пароль здесь не вводятся: доступ берётся из твоего ~/.ssh/config, и пароль не подойдёт — нужен ключ. Работает ssh <хост> в терминале — заработает и здесь.',
   '“Local folder” is on this computer. The rest describes the server this project is deployed to — leave it empty and the project simply stays local.': '«Папка на компьютере» — это здесь, на твоей машине. Остальное про сервер, на который выкатывается проект: оставь пустым — и проект просто останется локальным.',
   'the board runs ssh <host> — user, port and key come from your ~/.ssh/config, no secrets are kept here': 'доска выполняет ssh <хост> — пользователь, порт и ключ берутся из твоего ~/.ssh/config, секретов доска не хранит',
   'where the project lies ON THE SERVER — the deploy pulls into this folder': 'где проект лежит НА СЕРВЕРЕ — именно в эту папку деплой делает git pull',
@@ -513,6 +539,7 @@ const I18N_RU = {
   'recovered on retry': 'починилось повторной попыткой',
   'related': 'связана',
   'Read': 'Открыть',
+  'release page': 'страница релиза',
   'Reload now': 'Обновить сейчас',
   'Reload the page': 'Обновить страницу',
   'remove': 'убрать',
@@ -614,6 +641,7 @@ const I18N_RU = {
   'The board could not reach the server — the change was not saved': 'доска не достучалась до сервера — правка не сохранена',
   'capped: the task sat in a working column too long': 'урезано: задача слишком долго лежала в рабочей колонке',
   'To do': 'Сделать',
+  'this path is not a folder': 'по этому пути не папка',
   'Today': 'Сегодня',
   'Top projects': 'Топ проектов',
   'Tue': 'Вт',
@@ -635,6 +663,7 @@ const I18N_RU = {
   'waiting for the board to come back…': 'жду, пока доска поднимется…',
   'Waiting for you': 'Ждёт тебя',
   'Wed': 'Ср',
+  "What's new": 'Что нового',
   'Week': 'Неделя',
   'Weeks': 'Недели',
   'Welcome!': 'Добро пожаловать!',
@@ -799,6 +828,30 @@ Do not touch my files or servers without asking.`,
 };
 export const setupPrompt = () => SETUP_PROMPT[LANG] || SETUP_PROMPT.ru;
 
+export const ADD_PROJECT_PROMPT = {
+  ru: `Заведи мне проект на канбан-доске (local-kanban). Спрашивай по одному вопросу и жди ответа — ничего не додумывай за меня.
+
+1. Спроси, что за проект и где на этом компьютере лежит его код. Проверь, что папка существует, и загляни в неё: посмотри package.json или другой манифест, есть ли git и куда он смотрит.
+2. Если проект куда-то выкатывается — спроси ssh-хост и путь на сервере. ПРОВЕРЬ доступ сам: ssh -o BatchMode=yes <хост> "test -d <путь> && echo ok". Не сработало — скажи мне, в чём дело, и не выдумывай значения.
+3. Спроси, надо ли перезапускать что-то после выкатки (имена процессов pm2) и по какому домену проверять, что всё поднялось.
+4. Реши, каким деплой-скиллом его выкатывать: посмотри kb p и деплой-скиллы соседних проектов, предложи подходящий или «без деплоя». Свой скилл заводится в «Настройках → Скиллы».
+5. Заведи проект через API доски (POST /api/projects) со всем, что выяснили, и покажи мне kb info <ключ>.
+6. Если у проекта есть CLAUDE.md или README — прочитай и предложи 3-5 первых задач в бэклог, но НЕ создавай их без моего «да».
+
+Ничего не меняй в самом проекте и на сервере: эта задача — только про запись в реестр доски.`,
+  en: `Set up a project on my kanban board (local-kanban). Ask one question at a time and wait for the answer — do not assume anything on my behalf.
+
+1. Ask what the project is and where its code lives on this computer. Check that the folder exists and look inside: package.json or another manifest, whether there is a git repo and where it points.
+2. If the project gets deployed somewhere, ask for the ssh host and the path on the server. CHECK the access yourself: ssh -o BatchMode=yes <host> "test -d <path> && echo ok". If it fails, tell me why and do not invent values.
+3. Ask whether anything needs restarting after a deploy (pm2 process names) and which domain to check afterwards.
+4. Decide which deploy skill should ship it: look at kb p and at the deploy skills of neighbouring projects, then suggest one or "no deploy". A skill of your own is created in Settings → Skills.
+5. Register the project through the board API (POST /api/projects) with everything we worked out, and show me kb info <key>.
+6. If the project has a CLAUDE.md or a README, read it and suggest 3-5 first backlog tasks — but do NOT create them without my go-ahead.
+
+Change nothing in the project itself and nothing on the server: this task is only about the board's registry.`,
+};
+export const addProjectPrompt = () => ADD_PROJECT_PROMPT[LANG] || ADD_PROJECT_PROMPT.en;
+
 export const seg = (s) => encodeURIComponent(String(s));
 export let ghSyncOn = true;
 export function setGhSyncOn(v) { ghSyncOn = v; }

package/public/js/project.js

@@ -71,8 +71,8 @@ export async function renderProjectSettings(force) {
           <small class="ps-hint">${tr('where the code lies on this computer — Claude edits and commits it here')}</small></label>
         <label class="pp-field">${tr('Domain')}<input id="ps-domain" type="text" placeholder="example.com">
           <small class="ps-hint">${tr('opened after a deploy to check the site answers')}</small></label>
-        <label class="pp-field">${tr('SSH host')}<input id="ps-server" type="text" placeholder="${tr('ssh alias or address')}">
-          <small class="ps-hint">${tr('the board runs ssh &lt;host&gt; — user, port and key come from your ~/.ssh/config, no secrets are kept here')}</small></label>
+        <label class="pp-field">${tr('SSH host')}<input id="ps-server" type="text" placeholder="192.168.1.10">
+          <small class="ps-hint">${tr('no key or password is entered here: access comes from your ~/.ssh/config, and a password will not do — a key is required. If ssh &lt;host&gt; works in your terminal, it works here.')}</small></label>
         <label class="pp-field">${tr('Server path')}<input id="ps-spath" type="text" placeholder="/var/www/my-project">
           <small class="ps-hint">${tr('where the project lies ON THE SERVER — the deploy pulls into this folder')}</small></label>
         <label class="pp-field">${tr('pm2 processes (comma-separated)')}<input id="ps-pm2" type="text" placeholder="my-api, my-web">

package/public/js/settings.js

@@ -6,6 +6,35 @@ import { checkVersion, pendingReload } from './init.js';
 import { loadProjects, popLayer, pushLayer, setupPromptBlockHTML, styledAlert, styledConfirm, styledPrompt, wireSetupPrompt } from './sidebar.js';
 import { SHORT_MONTHS, SOUND_LIB, STATUS_LABELS, audioCtx, lastMissedAt, lastSseAt, missedSounds, pageLoadedAt, playNamedSound, refresh, relTime, titleOr, updateSoundBadge } from './sse.js';
 
+function mdInline(text) {
+  return esc(text)
+    .replace(/`([^`]+)`/g, '<code>$1</code>')
+    .replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>')
+    .replace(/\*([^*\n]+)\*/g, '<em>$1</em>')
+    .replace(/\[([^\]]+)\]\((https?:\/\/[^)\s]+)\)/g, '<a href="$2" target="_blank" rel="noopener noreferrer">$1</a>');
+}
+export function mdLite(md) {
+  const out = [];
+  let list = false;
+  const closeList = () => { if (list) { out.push('</ul>'); list = false; } };
+  for (const block of String(md || '').split(/\n\s*\n/).map((b) => b.trim()).filter(Boolean)) {
+    const flat = block.split('\n').map((l) => l.trim()).join(' ');
+    const head = flat.match(/^#{1,6}\s+(.*)$/);
+    if (head) { closeList(); out.push(`<h4>${mdInline(head[1])}</h4>`); continue; }
+    if (/^[-*]\s+/.test(block)) {
+      if (!list) { out.push('<ul>'); list = true; }
+      for (const item of block.split(/\n(?=[-*]\s)/)) {
+        out.push(`<li>${mdInline(item.replace(/^[-*]\s+/, '').split('\n').map((l) => l.trim()).join(' '))}</li>`);
+      }
+      continue;
+    }
+    closeList();
+    out.push(`<p>${mdInline(flat)}</p>`);
+  }
+  closeList();
+  return out.join('');
+}
+
 const SETTINGS_DEFAULTS = { sound: true, soundReview: 'ding', soundDone: 'click', startScreen: 'dashboard', dashRange: 'week', theme: 'system', keepDrawer: false, notifyReview: false, compactCards: false, linkLines: true, keymap: {} };
 export function getSetting(k) {
   const v = localStorage.getItem('kb.set.' + k);
@@ -424,6 +453,7 @@ async function renderSection(sec) {
       + `<div class="set-col hidden" id="about-upd-fail"><span class="set-lab">${tr('Run it yourself')}<small>${tr('the board is not allowed to do this — the command is the same one it just tried')}</small></span>`
       + '<pre class="onb-code" id="about-upd-cmd"></pre></div>'
       + `<div class="set-row hidden" id="about-dev-row"><span class="set-lab">${tr('dev branch')}<small id="about-dev-sub">…</small></span><span class="about-fresh" id="about-dev"></span></div>`
+      + `<div class="set-col"><span class="set-lab">${tr("What's new")}<small id="about-news-sub">…</small></span><div class="about-news" id="about-news">…</div></div>`
       + `<div class="set-row"><span class="set-lab">${tr('Check for updates')}<small id="about-recheck-sub">${tr('re-read branch state from GitHub')}</small></span><button class="btn-ghost" id="about-recheck">${tr('Check')}</button></div>`
       + `<div class="set-row"><span class="set-lab">${tr('Reload the page')}<small>${tr('re-read the board code right now')}</small></span><button class="btn-ghost" id="about-reload">${tr('Reload now')}</button></div>`
       + `<div class="set-row"><span class="set-lab">${tr('Using the board at work')}<small>${tr('free for everyone, nothing switched off — if it earns you money, $12 a year per person keeps it maintained')}</small></span>`
@@ -475,8 +505,21 @@ async function renderSection(sec) {
         ? `${u.dev.sha}${u.dev.date ? ` ${tr('at')} ${fmtDbTime(u.dev.date.slice(0, 19).replace('T', ' '))}` : ''}${u.dev.message ? ` · ${u.dev.message}` : ''}`
         : tr('dev has no commits beyond main');
     };
+    const loadNews = async (upd, forced) => {
+      const box = $('about-news'); const sub = $('about-news-sub');
+      if (!box || !sub) return;
+      try {
+        const remote = upd?.update_available === true ? `?remote=1${forced ? '&refresh=1' : ''}` : '';
+        const n = await api('GET', `/api/whats-new${remote}`, null, { quiet: true });
+        box.innerHTML = n?.notes ? mdLite(n.notes) : `<p class="muted">${esc(tr('no notes for this version'))}</p>`;
+        const ver = n?.version ? `${tr('version')} ${n.version}${n.source === 'github' ? ` · ${tr('not installed yet')}` : ''}` : '';
+        const link = /^https:\/\//.test(n?.url || '')
+          ? ` · <a href="${esc(n.url)}" target="_blank" rel="noopener noreferrer">${esc(tr('release page'))}</a>` : '';
+        sub.innerHTML = esc(ver) + link;
+      } catch { box.textContent = '—'; sub.textContent = ''; }
+    };
     api('GET', '/api/about').catch(() => null).then((a) => { about = a; })
-      .then(() => api('GET', '/api/update-check')).then(renderUpd)
+      .then(() => api('GET', '/api/update-check')).then((u) => { renderUpd(u); return loadNews(u); })
       .catch(() => { const s = $('about-upd-sub'); if (s) s.textContent = '—'; });
     const showFailCmd = (cmd) => {
       const wrap = $('about-upd-fail');
@@ -531,7 +574,7 @@ async function renderSection(sec) {
     $('about-recheck').onclick = async () => {
       const btn = $('about-recheck');
       btn.disabled = true; $('about-upd-sub').textContent = tr('checking…');
-      try { renderUpd(await api('GET', '/api/update-check?refresh=1')); }
+      try { const u = await api('GET', '/api/update-check?refresh=1'); renderUpd(u); await loadNews(u, true); }
       catch { $('about-upd-sub').textContent = '—'; }
       btn.disabled = false;
     };

package/public/js/sidebar.js

@@ -3,7 +3,7 @@ import { buildSelect, renderBoard, selVal } from './board.js';
 
 const GENERIC_DEPLOY = 'deploy';
 import { renderChaos } from './chaos.js';
-import { $, ALL, CALENDAR, CHAOS, DASH, HIDDEN_SECTIONS, HORIZON, LANG, SETTINGS, SIDEBAR_SECTIONS, api, esc, ic, seg, setupPrompt, state, tr } from './core.js';
+import { $, ALL, CALENDAR, CHAOS, DASH, HIDDEN_SECTIONS, HORIZON, LANG, SETTINGS, SIDEBAR_SECTIONS, addProjectPrompt, api, esc, ic, seg, setupPrompt, state, tr } from './core.js';
 import { renderDashboard } from './dash.js';
 import { renderCalendar, renderHorizon } from './horizon.js';
 import { openProjectSettings, renderProjectSettings, skillOptions, deploySkills } from './project.js';
@@ -346,6 +346,66 @@ function wizSlugify(name) {
     .replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40);
 }
 
+function setState(id, text, kind) {
+  const el = $(id);
+  if (!el) return;
+  el.textContent = text || '';
+  el.classList.remove('ok', 'bad');
+  if (text && kind) el.classList.add(kind);
+}
+
+function wizPrefix(slug, used = new Set(state.projects.map((p) => p.prefix).filter(Boolean))) {
+  const words = slug.replace(/[^a-z0-9-]/gi, '').split('-').filter(Boolean);
+  let base = words.length >= 2
+    ? words.map((w) => w[0]).join('').slice(0, 3).toUpperCase()
+    : slug.slice(0, 3).toUpperCase();
+  if (base.length < 2) base = (base + 'XX').slice(0, 2);
+  let prefix = base;
+  let n = 2;
+  while (used.has(prefix)) prefix = base + n++;
+  return prefix;
+}
+
+export async function checkPath(path) {
+  if (!path) { setState('wiz-path-state', tr('give the folder path'), 'bad'); return false; }
+  setState('wiz-path-state', tr('checking…'));
+  try {
+    const r = await api('GET', `/api/fs?path=${encodeURIComponent(path)}`, null, { quiet: true });
+    setState('wiz-path-state', `${tr('the folder is there')} · ${r.dirs.length} ${tr('subfolders')}`, 'ok');
+    return true;
+  } catch (e) {
+    const said = { 404: tr('no such folder on this computer'),
+      400: tr('this path is not a folder'),
+      403: tr('the folder is there, but the board cannot read it — check its permissions') }[e.status];
+    setState('wiz-path-state', said || `${tr('could not check the folder')}: ${e.message || path}`, 'bad');
+    return false;
+  }
+}
+
+const SSH_WHY = {
+  unknown_host: 'no such host — check the name, or add it to your ~/.ssh/config',
+  key_refused: 'the server refused the key — a password will not help here, the key has to be authorized',
+  host_key: 'the host key is unknown — connect once from your terminal and confirm the fingerprint',
+  unreachable: 'the server did not answer — wrong address, wrong port, or it is down',
+  failed: 'could not connect',
+};
+export async function checkSsh() {
+  const server = $('wiz-server')?.value.trim();
+  const path = $('wiz-spath')?.value.trim();
+  if (!server) { setState('wiz-ssh-state', tr('give the ssh host'), 'bad'); return; }
+  const btn = $('wiz-ssh-check');
+  if (btn) btn.disabled = true;
+  setState('wiz-ssh-state', tr('connecting…'));
+  try {
+    const r = await api('POST', '/api/projects/ssh-check', { server, path }, { quiet: true });
+    const dir = r.path_exists === null ? '' : ` · ${r.path_exists ? tr('the server path is there') : tr('but there is no such path on the server')}`;
+    setState('wiz-ssh-state', `${tr('connected')}${dir}`, r.path_exists === false ? 'bad' : 'ok');
+  } catch (e) {
+    setState('wiz-ssh-state', tr(SSH_WHY[e.body?.reason] || SSH_WHY.failed), 'bad');
+  }
+  if (btn) btn.disabled = false;
+}
+
 export async function openFolderPicker() {
   const box = $('wiz-browser'); const input = $('wiz-path');
   if (!box || !input) return;
@@ -399,10 +459,21 @@ function openProjectWizard() {
   const stepType = () => {
     err('');
     body.innerHTML = WIZ_TYPES.map(([id, title, sub]) =>
-      `<button type="button" class="wiz-type" data-type="${id}"><b>${esc(title)}</b><small>${esc(sub)}</small></button>`).join('');
+      `<button type="button" class="wiz-type" data-type="${id}"><b>${esc(title)}</b><small>${esc(sub)}</small></button>`).join('')
+      + `<div class="wiz-h">${tr('or let Claude do it')}</div>`
+      + `<div class="kbh-note muted">${tr('Claude looks at the folder itself, checks the server access, and asks you one question at a time. Paste this into your Claude Code chat.')}</div>`
+      + `<div class="setup-prompt"><pre class="onb-code setup-prompt-text">${esc(addProjectPrompt())}</pre>`
+      + `<button type="button" class="btn-ghost wiz-ai-copy">${ic('copy', 13)} ${tr('Copy the prompt')}</button></div>`;
     actions.innerHTML = `<button class="btn-ghost wiz-cancel">${tr('Cancel')}</button>`;
     actions.querySelector('.wiz-cancel').onclick = close;
     body.querySelectorAll('.wiz-type').forEach((b) => { b.onclick = () => stepForm(b.dataset.type); });
+    const aiBtn = body.querySelector('.wiz-ai-copy');
+    aiBtn.onclick = async () => {
+      const okCopy = await copyText(addProjectPrompt());
+      const was = aiBtn.innerHTML;
+      aiBtn.innerHTML = okCopy ? `✓ ${tr('Copied')}` : `✕ ${tr('did not work — select and copy manually')}`;
+      setTimeout(() => { aiBtn.innerHTML = was; }, 2000);
+    };
   };
 
   const stepForm = (type) => {
@@ -411,21 +482,28 @@ function openProjectWizard() {
     const withLocal = type !== 'server';
     const folders = state.folders.unregistered || [];
     let html = `<label class="pp-field">${tr('Project name')}<input id="wiz-name" type="text" placeholder="my project"></label>`
-      + `<label class="pp-field">${tr('Key (slug + task prefix)')}<input id="wiz-slug" type="text" placeholder="my-project"></label>`;
+      + `<label class="pp-field">${tr('Key (slug + task prefix)')}<input id="wiz-slug" type="text" placeholder="my-project">`
+      + `<small class="pp-hint" id="wiz-slug-state"></small></label>`;
     if (withLocal) {
       html += `<div class="pp-field">${tr('Project folder')}
         <div id="wiz-folder"></div>
         <div id="wiz-path-row" class="wiz-path-row hidden">
           <input id="wiz-path" type="text" placeholder="/full/path/to/the/folder">
           <button type="button" class="btn-ghost" id="wiz-browse">${tr('Choose…')}</button>
+          <button type="button" class="btn-ghost" id="wiz-path-check">${tr('Check')}</button>
         </div>
+        <small class="pp-hint" id="wiz-path-state"></small>
         <div id="wiz-browser" class="wiz-browser hidden"></div>
-        <input id="wiz-git" type="text" class="hidden" placeholder="git@github.com:me/repo.git"></div>`;
+        <input id="wiz-git" type="text" class="hidden" placeholder="git@github.com:me/repo.git">
+        <small class="pp-hint hidden" id="wiz-git-hint"></small></div>`;
     }
     if (withServer) {
-      html += `<div class="kbh-note muted">${tr('Below is about the SERVER this project is deployed to, not about this computer. Empty means the project stays local.')}</div>`
-        + `<label class="pp-field">${tr('SSH host')}<input id="wiz-server" type="text" placeholder="${tr('ssh alias or address')}">`
-        + `<small class="pp-hint">${tr('user, port and key come from your ~/.ssh/config — the board keeps no secrets')}</small></label>`
+      html += `<div class="wiz-h">${tr('Server')}</div>`
+        + `<div class="kbh-note muted">${tr('Not about this computer. Empty means the project simply stays local.')}</div>`
+        + `<div class="pp-field">${tr('SSH host')}`
+        + `<div class="wiz-path-row"><input id="wiz-server" type="text" placeholder="192.168.1.10">`
+        + `<button type="button" class="btn-ghost" id="wiz-ssh-check">${tr('Check')}</button></div>`
+        + `<small class="pp-hint" id="wiz-ssh-state">${tr('no key or password is entered here: access comes from your ~/.ssh/config, and a password will not do — a key is required. If ssh &lt;host&gt; works in your terminal, it works here.')}</small></div>`
         + `<label class="pp-field">${tr('Server path')}<input id="wiz-spath" type="text" placeholder="/var/www/my-project"></label>`
         + `<label class="pp-field">${tr('pm2 processes (comma-separated)')}<input id="wiz-pm2" type="text" placeholder="my-api, my-web"></label>`
         + `<label class="pp-field">${tr('Domain (to verify after deploy)')}<input id="wiz-domain" type="text" placeholder="example.com"></label>`
@@ -438,8 +516,19 @@ function openProjectWizard() {
     const nameEl = $('wiz-name');
     const slugEl = $('wiz-slug');
     let slugTouched = false;
-    slugEl.oninput = () => { slugTouched = true; };
-    nameEl.oninput = () => { if (!slugTouched) slugEl.value = wizSlugify(nameEl.value); };
+    const showSlugState = () => {
+      const el = $('wiz-slug-state');
+      if (!el) return;
+      const v = slugEl.value.trim();
+      const taken = v && state.projects.find((p) => p.slug === v);
+      el.classList.remove('ok', 'bad');
+      if (!v) { el.textContent = ''; return; }
+      if (!/^[a-z0-9-]{2,40}$/.test(v)) { el.textContent = tr('key: lowercase latin letters, digits and hyphens'); el.classList.add('bad'); return; }
+      el.textContent = taken ? `${tr('this key is already taken by')} ${taken.name || taken.slug}` : `${tr('key is free')} · ${tr('task prefix')} ${wizPrefix(v)}`;
+      el.classList.add(taken ? 'bad' : 'ok');
+    };
+    slugEl.oninput = () => { slugTouched = true; showSlugState(); };
+    nameEl.oninput = () => { if (!slugTouched) slugEl.value = wizSlugify(nameEl.value); showSlugState(); };
     const folderSel = $('wiz-folder');
     if (folderSel) {
       const options = [
@@ -449,13 +538,29 @@ function openProjectWizard() {
       ];
       const onFolderChange = (v) => {
         $('wiz-path-row').classList.toggle('hidden', v !== '__manual__');
+        $('wiz-path-state').classList.toggle('hidden', v !== '__manual__');
         $('wiz-browser').classList.add('hidden');
         $('wiz-git').classList.toggle('hidden', v !== '__clone__');
+        const gh = $('wiz-git-hint');
+        gh.classList.toggle('hidden', v !== '__clone__');
+        if (v === '__clone__') {
+          const root = state.folders.root || '~';
+          const key = $('wiz-slug').value.trim() || 'my-project';
+          gh.textContent = `${tr('on create, git clone puts it on THIS computer at')} ${root}/${key}. `
+            + tr('An existing folder is refused, not overwritten. Git credentials are not asked here — access comes from your own git and ssh setup.');
+        }
       };
       const start = type === 'local' ? '' : '__manual__';
       buildSelect(folderSel, { value: start, options, onChange: onFolderChange });
       onFolderChange(start);
       $('wiz-browse').onclick = openFolderPicker;
+      $('wiz-path-check').onclick = () => checkPath($('wiz-path').value.trim());
+      $('wiz-path').oninput = () => setState('wiz-path-state', '');
+    }
+    if ($('wiz-ssh-check')) {
+      $('wiz-ssh-check').onclick = checkSsh;
+      $('wiz-server').oninput = () => setState('wiz-ssh-state', '');
+      $('wiz-spath').oninput = () => setState('wiz-ssh-state', '');
     }
     const skillHost = $('wiz-skill');
     if (skillHost) {

package/public/style.css

@@ -22,6 +22,7 @@
   --done: #22c55e;
   --cancelled: #ef4444;
   --danger: #dc2626;
+  --ok: #15803d;
   --hover: #f5f5f4;
   --hover-strong: #f4f4f2;
   --chip-bg: #fafaf9;
@@ -146,6 +147,9 @@ a.btn-ghost { text-decoration: none; }
 .sync-about .muted, .sync-about p.muted { color: var(--muted); }
 .sync-about code { font-size: 11.5px; background: var(--chip-bg); padding: 1px 5px; border-radius: 5px; }
 .pp-hint { display: block; margin-top: 5px; color: var(--muted); font-size: 11.5px; }
+.pp-hint.ok { color: var(--ok); }
+.pp-hint.bad, .ps-hint.bad { color: var(--danger); }
+.ps-hint.ok { color: var(--ok); }
 .wiz-path-row { display: flex; gap: 8px; align-items: center; }
 .wiz-path-row input { flex: 1; min-width: 0; }
 .wiz-browser {
@@ -613,8 +617,8 @@ body.dragging-board .col-add-ghost { display: none; }
 .modal-err { font-size: 12px; color: var(--danger); }
 .modal-actions { display: flex; gap: 8px; }
 
-.modal.wiz { width: 400px; max-width: calc(100vw - 32px); }
-.wiz-body { display: flex; flex-direction: column; gap: 8px; max-height: calc(100vh - 170px); overflow-y: auto; }
+.modal.wiz { width: 460px; max-width: calc(100vw - 32px); }
+.wiz-body { display: flex; flex-direction: column; gap: 7px; max-height: calc(100vh - 170px); overflow-y: auto; }
 .wiz-type {
   display: flex; flex-direction: column; gap: 3px; text-align: left; padding: 10px 12px;
   border: 1px solid var(--border); border-radius: 9px; background: var(--panel); cursor: pointer; font: inherit; color: var(--text);
@@ -946,6 +950,8 @@ body.dragging-board .col-add-ghost { display: none; }
 .kbh-remap:hover kbd { border-color: var(--accent); }
 .kbh-remap.listening kbd { border-color: var(--accent); color: var(--accent); }
 .kbh-note { font-size: 11.5px; margin-top: 10px; }
+.wiz-h { font-size: 11px; text-transform: uppercase; letter-spacing: .04em; color: var(--muted); margin-top: 6px; }
+.wiz-h + .kbh-note { margin-top: 0; }
 .about-fresh { font-size: 12px; color: var(--muted); flex-shrink: 0; }
 .about-fresh.stale-ver { color: var(--accent); }
 #about-diag .bk-row span:first-child { white-space: nowrap; }
@@ -989,6 +995,19 @@ body.dragging-board .col-add-ghost { display: none; }
 .theme-opt { border: none; background: var(--panel); color: var(--muted); font: inherit; font-size: 12.5px; padding: 6px 12px; cursor: pointer; }
 .theme-opt + .theme-opt { border-left: 1px solid var(--border); }
 .theme-opt.active { background: var(--accent); color: #fff; }
+.about-news {
+  max-height: 260px; overflow-y: auto; font-size: 12.5px; line-height: 1.5;
+  border: 1px solid var(--border-soft); border-radius: 8px; padding: 10px 12px; background: var(--panel);
+}
+.about-news h4 { font-size: 12.5px; font-weight: 600; margin: 12px 0 6px; color: var(--muted); }
+.about-news h4:first-child { margin-top: 0; }
+.about-news p { margin: 0 0 8px; }
+.about-news ul { margin: 0 0 8px; padding-left: 18px; }
+.about-news li { margin-bottom: 7px; }
+.about-news li:last-child, .about-news p:last-child { margin-bottom: 0; }
+.about-news code { font-size: 11.5px; background: var(--border-soft); border-radius: 4px; padding: 1px 4px; }
+.about-news a { color: var(--accent); }
+
 .bk-list { display: flex; flex-direction: column; gap: 0; margin-top: 6px; }
 .bk-row { display: flex; justify-content: space-between; gap: 12px; font-size: 12.5px; padding: 7px 0; border-top: 1px solid var(--border-soft); }
 .bk-row:first-child { border-top: none; }
@@ -1129,6 +1148,7 @@ body.dragging-board .col-add-ghost { display: none; }
   --field-text: #c7c0b3;
   --warn-bg: #3a3320; --warn-border: #5a4d22; --warn-text: #e6c46e;
   --danger: #f0716b;
+  --ok: #6fbf85;
   --danger-soft: #3a2222;
   --tl-created: #4d4940;
   --shadow: rgba(0, 0, 0, .55);
@@ -1155,7 +1175,7 @@ body.dragging-board .col-add-ghost { display: none; }
   --border-hover: #4a4946;
   --field-text: #c7c4ba;
   --warn-bg: #3a3320; --warn-border: #5a4d22; --warn-text: #e6c46e;
-  --danger: #e8706a; --danger-soft: #3a2222;
+  --danger: #e8706a; --danger-soft: #3a2222; --ok: #6fbf85;
   --tl-created: #4a4946;
   --shadow: rgba(0, 0, 0, .55);
   --input-bg: #1d1d1c;

package/src/routes/projects.js

@@ -440,6 +440,28 @@ export default async function projectRoutes(app) {
     return { git: !r.err && r.out === 'true' };
   });
 
+  app.post('/api/projects/ssh-check', async (req, reply) => {
+    const server = String(req.body?.server || '').trim();
+    const path = String(req.body?.path || '').trim();
+    if (!server) return reply.code(400).send({ error: 'server is required' });
+    if (!/^[\w.@][\w.@-]*$/.test(server)) return reply.code(400).send({ error: 'server: an ssh alias or host, no options or spaces' });
+    if (path && /["'`;|&$\\]/.test(path)) return reply.code(400).send({ error: 'path: invalid characters' });
+    const cmd = path ? `test -d "${path}" && echo dir || echo nodir` : 'echo ok';
+    const res = await new Promise((done) => execFile('ssh',
+      ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=8', '--', server, cmd],
+      { timeout: 20000 }, (err, out, serr) => done({ err, out: String(out || '').trim(), serr: String(serr || '').trim() })));
+    if (res.err) {
+      const t = res.serr;
+      const why = /permission denied|publickey/i.test(t) ? 'key_refused'
+        : /host key verification/i.test(t) ? 'host_key'
+          : /could not resolve|name or service not known|no address/i.test(t) ? 'unknown_host'
+            : /connection refused|timed out|no route/i.test(t) || res.err.killed ? 'unreachable'
+              : 'failed';
+      return reply.code(502).send({ ok: false, reason: why, detail: t.split('\n').filter(Boolean).at(-1) || res.err.message });
+    }
+    return { ok: true, path_exists: path ? res.out.includes('dir') && !res.out.includes('nodir') : null };
+  });
+
   const DEMO_TEXTS = {
     ru: {
       name: 'Демо-проект',

package/src/routes/system.js

@@ -20,8 +20,8 @@ let selfPkgCache;
 function selfPkg() {
   if (selfPkgCache === undefined) {
     try {
-      const { name, version } = JSON.parse(readFileSync(join(ROOT_DIR, 'package.json'), 'utf8'));
-      selfPkgCache = name && version ? { name, version } : null;
+      const { name, version, repository } = JSON.parse(readFileSync(join(ROOT_DIR, 'package.json'), 'utf8'));
+      selfPkgCache = name && version ? { name, version, repository: repository?.url || repository || null } : null;
     } catch { selfPkgCache = null; }
   }
   return selfPkgCache;
@@ -82,6 +82,32 @@ export async function registryCheck() {
   } catch { return null; }
 }
 
+export async function ghApi(path) {
+  try {
+    const res = await fetch(`https://api.github.com/${path}`, {
+      headers: { 'User-Agent': 'local-kanban', Accept: 'application/vnd.github+json' },
+      signal: AbortSignal.timeout(8000),
+    });
+    if (res.ok) return await res.json();
+  } catch {  }
+  try { return JSON.parse(await ghCli(['api', path], { timeout: 10000 })); }
+  catch { return null; }
+}
+
+export function changelogSection(text, version) {
+  const head = new RegExp(`^##\\s*\\[?${String(version).replace(/\./g, '\\.')}\\]?`, 'm');
+  const m = head.exec(String(text || ''));
+  if (!m) return null;
+  const rest = text.slice(m.index + m[0].length);
+  const end = rest.search(/^## /m);
+  return (end === -1 ? rest : rest.slice(0, end)).trim() || null;
+}
+
+export function repoSlug(url) {
+  const m = String(url || '').match(/github\.com[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?(?:#.*)?$/);
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+
 const UPLOAD_FLOOR = 64 * 1024 * 1024;
 function uploadLimit() {
   try { return Math.max(UPLOAD_FLOOR, statSync(join(DATA_DIR, 'kanban.db')).size * 4); } catch { return UPLOAD_FLOOR; }
@@ -255,17 +281,6 @@ export default async function systemRoutes(app) {
     const git = (args) => new Promise((resolve) => {
       execFile('git', args, { cwd: ROOT, timeout: 8000 }, (err, out) => resolve(err ? null : out.trim()));
     });
-    const ghApi = async (path) => {
-      try {
-        const res = await fetch(`https://api.github.com/${path}`, {
-          headers: { 'User-Agent': 'local-kanban', Accept: 'application/vnd.github+json' },
-          signal: AbortSignal.timeout(8000),
-        });
-        if (res.ok) return await res.json();
-      } catch {  }
-      try { return JSON.parse(await ghCli(['api', path], { timeout: 10000 })); }
-      catch { return null; }
-    };
     let data = { update_available: null, local: null, remote: null, branch: null, tag: null, dev: null };
     try {
       const [local, branch, origin, tag] = await Promise.all([
@@ -300,6 +315,30 @@ export default async function systemRoutes(app) {
     return data;
   });
 
+  const NEWS_OK_MS = 3600000;
+  const NEWS_FAIL_MS = 60000;
+  let newsCache = { at: 0, ttl: 0, data: null };
+  app.get('/api/whats-new', async (req) => {
+    const version = selfPkg()?.version || null;
+    const own = () => {
+      let text = null;
+      try { text = readFileSync(join(ROOT_DIR, 'CHANGELOG.md'), 'utf8'); } catch {  }
+      return { version, notes: (text && version) ? changelogSection(text, version) : null, source: 'changelog', url: null };
+    };
+    if (!req.query?.remote) return own();
+    if (!req.query?.refresh && newsCache.data && Date.now() - newsCache.at < newsCache.ttl) return newsCache.data;
+    const repo = repoSlug(selfPkg()?.repository);
+    const rel = repo ? await ghApi(`repos/${repo}/releases/latest`) : null;
+    const tag = String(rel?.tag_name || '').replace(/^v/, '');
+    const body = String(rel?.body || '').trim();
+    const got = Boolean(tag && body);
+    const data = got
+      ? { version: tag, notes: body, source: 'github', url: rel.html_url || null }
+      : own();
+    newsCache = { at: Date.now(), ttl: got ? NEWS_OK_MS : NEWS_FAIL_MS, data };
+    return data;
+  });
+
   let updateRunning = null;
   app.post('/api/update', async (req, reply) => {
     if (updateRunning) return reply.code(409).send({ error: 'an update is already running' });