@edspencer/paddock 0.71.1 → 0.72.0

package/packages/server/dist/config.js

@@ -24,12 +24,13 @@ import { fileURLToPath } from "node:url";
 import YAML from "yaml";
 import { DEFAULT_DRIVE_MODE, isKnownDriveMode, isKnownModel, } from "./models.js";
 import { SCHEMA_VERSION_KEY, configSchemaRefusal } from "./schema-version.js";
-import { DEFAULT_MAX_SPAWN_DEPTH, isValidMaxSpawnDepth } from "./spawn-capability.js";
-import { DEFAULT_TRANSCRIPTS_MODE, isKnownTranscriptsMode, } from "./transcripts.js";
-import { DEFAULT_CREDENTIALS_MODE, isKnownCredentialsMode, } from "./claude-credentials.js";
-import { DEFAULT_INSTRUCTIONS_MODE, isKnownInstructionsMode, } from "./claude-instructions.js";
-import { DEFAULT_HOOKS_MODE, isKnownHooksMode } from "./claude-settings.js";
-import { DEFAULT_MCP_SERVERS_MODE, isKnownMcpServersMode, } from "./claude-mcp.js";
+import { isValidMaxSpawnDepth } from "./spawn-capability.js";
+import { posture as postureFor, resolveProfileName, } from "./profiles.js";
+import { isKnownTranscriptsMode } from "./transcripts.js";
+import { isKnownCredentialsMode } from "./claude-credentials.js";
+import { isKnownInstructionsMode } from "./claude-instructions.js";
+import { isKnownHooksMode } from "./claude-settings.js";
+import { isKnownMcpServersMode, } from "./claude-mcp.js";
 import { resolveDeclaredMcpServers } from "./mcp-servers.js";
 import { DEFAULT_ENVIRONMENT_PROMPT } from "./environment-prompt.js";
 import { DEFAULT_RECOVERY } from "./recovery-config.js";
@@ -254,7 +255,7 @@ function loadBrandConfig(file = {}) {
 export function resolveDefaultWebDist(moduleUrl) {
     return path.resolve(path.dirname(fileURLToPath(moduleUrl)), "../../web/dist");
 }
-export function loadPaddockConfig() {
+export function loadPaddockConfig(opts = {}) {
     // The optional YAML instance-config file provides the BASE layer; env vars
     // override it (precedence file < env). The file is located under the data dir,
     // so resolve a BOOTSTRAP data dir from env/default first to find it — the file
@@ -264,11 +265,13 @@ export function loadPaddockConfig() {
     // Ensure the data root exists first so symlinks (e.g. /tmp -> /private/tmp on
     // macOS) resolve consistently for every derived path below.
     const dataRoot = abs(envOr("PADDOCK_DATA_DIR", fileOr(file.dataDir, "./data")));
-    try {
-        fs.mkdirSync(dataRoot, { recursive: true });
-    }
-    catch {
-        /* best-effort; downstream mkdirs will surface real errors */
+    if (opts.createDataDir !== false) {
+        try {
+            fs.mkdirSync(dataRoot, { recursive: true });
+        }
+        catch {
+            /* best-effort; downstream mkdirs will surface real errors */
+        }
     }
     // working_directory of keeper agents MUST be canonical so session discovery
     // (which encodes the real path) can find Claude transcripts.
@@ -283,7 +286,15 @@ export function loadPaddockConfig() {
     const resolvedClaudeHome = resolveClaudeHome(dataDir, fileOpt(file.claudeHome));
     const legacyClaudeHome = userClaudeHome();
     const defaultWebDist = resolveDefaultWebDist(import.meta.url);
+    // The posture profile (#878), resolved BEFORE the levers it supplies defaults
+    // for. It is not a config layer of its own: `p` is handed to each posture
+    // loader as the fallback that used to be a hardcoded literal, so an individual
+    // file key or env var still wins over it. See `profiles.ts` for why an
+    // individual FILE key deliberately beats `PADDOCK_PROFILE` in the env.
+    const profile = resolveProfileName(file.profile);
+    const p = postureFor(profile);
     return Object.freeze({
+        profile,
         port: Number(envOr("PORT", fileOr(file.port, "7233"))),
         // Safe by default (#435): bind loopback unless explicitly told otherwise, so
         // a fresh source/tarball run is network-closed. Non-loopback + no auth is then
@@ -300,7 +311,7 @@ export function loadPaddockConfig() {
         webDist: abs(envOr("PADDOCK_WEB_DIST", fileOr(file.webDist, defaultWebDist))),
         claudeHome: resolvedClaudeHome,
         legacyClaudeHome,
-        claude: loadClaudeConfig(file.claude),
+        claude: loadClaudeConfig(file.claude, p),
         auth: loadAuthConfig(file.auth),
         transcription: loadTranscriptionConfig(file.transcription),
         brand: loadBrandConfig(file.brand),
@@ -308,15 +319,19 @@ export function loadPaddockConfig() {
         driveMode: loadDriveMode(file.driveMode),
         nativeSystemPrompt: loadNativeSystemPrompt(file.nativeSystemPrompt),
         environmentPrompt: loadEnvironmentPrompt(file.environmentPrompt),
-        selfMcpEnabled: loadSelfMcpEnabled(file.selfMcpEnabled),
-        selfMcpWriteEnabled: loadSelfMcpEnabled(file.selfMcpEnabled) && loadSelfMcpWriteEnabled(file.selfMcpWriteEnabled),
+        selfMcpEnabled: loadSelfMcpEnabled(file.selfMcpEnabled, p.selfMcpEnabled),
+        selfMcpWriteEnabled: loadSelfMcpEnabled(file.selfMcpEnabled, p.selfMcpEnabled) &&
+            loadSelfMcpWriteEnabled(file.selfMcpWriteEnabled, p.selfMcpWriteEnabled),
         // Projects tool implies write implies read — the tool is appended in the write
         // block, so both outer gates must be on for it to mean anything (issue #467).
-        selfMcpProjectsEnabled: loadSelfMcpEnabled(file.selfMcpEnabled) &&
-            loadSelfMcpWriteEnabled(file.selfMcpWriteEnabled) &&
-            loadSelfMcpProjectsEnabled(file.selfMcpProjectsEnabled),
-        maxSpawnDepth: loadMaxSpawnDepth(file.maxSpawnDepth),
-        scheduleMutationEnabled: loadScheduleMutationEnabled(file.scheduleMutationEnabled),
+        // The cascade is why a profile's three self-MCP values are never read in
+        // isolation: `profile: yolo` plus an explicit `selfMcpEnabled: false`
+        // correctly collapses write and projects too.
+        selfMcpProjectsEnabled: loadSelfMcpEnabled(file.selfMcpEnabled, p.selfMcpEnabled) &&
+            loadSelfMcpWriteEnabled(file.selfMcpWriteEnabled, p.selfMcpWriteEnabled) &&
+            loadSelfMcpProjectsEnabled(file.selfMcpProjectsEnabled, p.selfMcpProjectsEnabled),
+        maxSpawnDepth: loadMaxSpawnDepth(file.maxSpawnDepth, p.maxSpawnDepth),
+        scheduleMutationEnabled: loadScheduleMutationEnabled(file.scheduleMutationEnabled, p.scheduleMutationEnabled),
         ...(() => {
             // #312 M1: resolved against the real environment (token material is only
             // ever an `env:` reference). Diagnostics ride along for app.ts to log.
@@ -330,12 +345,12 @@ export function loadPaddockConfig() {
             const { servers, errors, warnings } = resolveDeclaredMcpServers(file.mcpServers, process.env);
             return { mcpServers: servers, mcpServersDiagnostics: { errors, warnings } };
         })(),
-        hooksMcpEnabled: loadHooksMcpEnabled(file.hooksMcpEnabled),
+        hooksMcpEnabled: loadHooksMcpEnabled(file.hooksMcpEnabled, p.hooksMcpEnabled),
         recovery: loadRecoveryConfig(file.recovery),
         attachments: loadAttachmentsConfig(file.attachments),
         curation: loadCurationConfig(file.curation),
         logLevel: envOr("LOG_LEVEL", fileOr(file.logLevel, "info")),
-        browserMcp: loadBrowserMcp(file.browserMcp),
+        browserMcp: loadBrowserMcp(file.browserMcp, p.browserMcp),
         openapi: loadOpenApiConfig(file.openapi),
         sweepMinIntervalMs: loadSweepMinIntervalMs(file.sweepMinIntervalMs),
         gitAuthor: {
@@ -383,11 +398,13 @@ function loadSweepMinIntervalMs(file) {
  * behaviour); only when the env var is UNSET does the config file provide the
  * base, using the 1/true/yes convention shared by the other boolean knobs.
  */
-function loadBrowserMcp(file) {
+function loadBrowserMcp(file, fallback) {
     const env = process.env.PADDOCK_BROWSER_MCP;
     if (env !== undefined)
         return env === "1";
     const raw = fileOpt(file)?.toLowerCase();
+    if (raw === undefined)
+        return fallback;
     return raw === "1" || raw === "true" || raw === "yes";
 }
 /**
@@ -414,12 +431,12 @@ function loadOpenApiConfig(file) {
  * missing/blank/out-of-range value falls back to the default rather than failing
  * startup. A per-project override still wins at dispatch.
  */
-function loadMaxSpawnDepth(file) {
+function loadMaxSpawnDepth(file, fallback) {
     const raw = envOpt("PADDOCK_MAX_SPAWN_DEPTH") ?? fileOpt(file);
     if (raw === undefined)
-        return DEFAULT_MAX_SPAWN_DEPTH;
+        return fallback;
     const n = Number(raw);
-    return isValidMaxSpawnDepth(n) ? n : DEFAULT_MAX_SPAWN_DEPTH;
+    return isValidMaxSpawnDepth(n) ? n : fallback;
 }
 /**
  * Resolve a boolean recovery knob (issue #301) with the shared 1/true/yes
@@ -503,8 +520,8 @@ function loadAttachmentsConfig(file) {
  * operator opts in with `PADDOCK_SCHEDULE_MUTATION=1` (or the config file). Accepts
  * 1/true/yes. Static `project.yaml` schedules are armed regardless of this flag.
  */
-function loadScheduleMutationEnabled(file) {
-    const raw = envOr("PADDOCK_SCHEDULE_MUTATION", fileOr(file, "false")).toLowerCase();
+function loadScheduleMutationEnabled(file, fallback) {
+    const raw = envOr("PADDOCK_SCHEDULE_MUTATION", fileOr(file, String(fallback))).toLowerCase();
     return raw === "1" || raw === "true" || raw === "yes";
 }
 /**
@@ -514,8 +531,8 @@ function loadScheduleMutationEnabled(file) {
  * override still wins at dispatch. Accepts 1/true/yes. Only meaningful when the
  * self-MCP write tools are also enabled (the hook tools live on that server).
  */
-function loadHooksMcpEnabled(file) {
-    const raw = envOr("PADDOCK_HOOKS_MCP", fileOr(file, "false")).toLowerCase();
+function loadHooksMcpEnabled(file, fallback) {
+    const raw = envOr("PADDOCK_HOOKS_MCP", fileOr(file, String(fallback))).toLowerCase();
     return raw === "1" || raw === "true" || raw === "yes";
 }
 /**
@@ -524,8 +541,8 @@ function loadHooksMcpEnabled(file) {
  * is also on (write implies read — enforced at the call site above). Accepts
  * 1/true/yes.
  */
-function loadSelfMcpWriteEnabled(file) {
-    const raw = envOr("PADDOCK_SELF_MCP_WRITE", fileOr(file, "false")).toLowerCase();
+function loadSelfMcpWriteEnabled(file, fallback) {
+    const raw = envOr("PADDOCK_SELF_MCP_WRITE", fileOr(file, String(fallback))).toLowerCase();
     return raw === "1" || raw === "true" || raw === "yes";
 }
 /**
@@ -534,8 +551,8 @@ function loadSelfMcpWriteEnabled(file) {
  * `PADDOCK_SELF_MCP` and `PADDOCK_SELF_MCP_WRITE` are also on (enforced at the call
  * site above). Accepts 1/true/yes.
  */
-function loadSelfMcpProjectsEnabled(file) {
-    const raw = envOr("PADDOCK_SELF_MCP_PROJECTS", fileOr(file, "false")).toLowerCase();
+function loadSelfMcpProjectsEnabled(file, fallback) {
+    const raw = envOr("PADDOCK_SELF_MCP_PROJECTS", fileOr(file, String(fallback))).toLowerCase();
     return raw === "1" || raw === "true" || raw === "yes";
 }
 /**
@@ -543,8 +560,8 @@ function loadSelfMcpProjectsEnabled(file) {
  * Defaults to OFF so a plain instance never advertises it; opt in per instance
  * with `PADDOCK_SELF_MCP=1`. Accepts 1/true/yes.
  */
-function loadSelfMcpEnabled(file) {
-    const raw = envOr("PADDOCK_SELF_MCP", fileOr(file, "false")).toLowerCase();
+function loadSelfMcpEnabled(file, fallback) {
+    const raw = envOr("PADDOCK_SELF_MCP", fileOr(file, String(fallback))).toLowerCase();
     return raw === "1" || raw === "true" || raw === "yes";
 }
 /**
@@ -660,20 +677,18 @@ export function userClaudeHome() {
  * reason — an MCP server is a process paddock spawns, so a typo that attaches
  * nothing is better than one that attaches the user's whole set unasked.
  */
-function loadClaudeConfig(file = {}) {
+function loadClaudeConfig(file = {}, p) {
     const transcripts = (envOpt("PADDOCK_CLAUDE_TRANSCRIPTS") ?? fileOpt(file.transcripts))?.toLowerCase();
     const credentials = (envOpt("PADDOCK_CLAUDE_CREDENTIALS") ?? fileOpt(file.credentials))?.toLowerCase();
     const instructions = (envOpt("PADDOCK_CLAUDE_INSTRUCTIONS") ?? fileOpt(file.instructions))?.toLowerCase();
     const hooks = (envOpt("PADDOCK_CLAUDE_HOOKS") ?? fileOpt(file.hooks))?.toLowerCase();
     const mcpServers = (envOpt("PADDOCK_CLAUDE_MCP_SERVERS") ?? fileOpt(file.mcpServers))?.toLowerCase();
     return {
-        transcripts: transcripts && isKnownTranscriptsMode(transcripts) ? transcripts : DEFAULT_TRANSCRIPTS_MODE,
-        credentials: credentials && isKnownCredentialsMode(credentials) ? credentials : DEFAULT_CREDENTIALS_MODE,
-        instructions: instructions && isKnownInstructionsMode(instructions)
-            ? instructions
-            : DEFAULT_INSTRUCTIONS_MODE,
-        hooks: hooks && isKnownHooksMode(hooks) ? hooks : DEFAULT_HOOKS_MODE,
-        mcpServers: mcpServers && isKnownMcpServersMode(mcpServers) ? mcpServers : DEFAULT_MCP_SERVERS_MODE,
+        transcripts: transcripts && isKnownTranscriptsMode(transcripts) ? transcripts : p.transcripts,
+        credentials: credentials && isKnownCredentialsMode(credentials) ? credentials : p.credentials,
+        instructions: instructions && isKnownInstructionsMode(instructions) ? instructions : p.instructions,
+        hooks: hooks && isKnownHooksMode(hooks) ? hooks : p.hooks,
+        mcpServers: mcpServers && isKnownMcpServersMode(mcpServers) ? mcpServers : p.mcpServers,
     };
 }
 /**

package/packages/server/dist/herdctl.d.ts

@@ -49,6 +49,7 @@
 import { FleetManager, type DiscoveredSession, type ChatMessage, type SDKMessage, type TriggerResult, type AgentInfo, type FleetStatus, type SlashCommand, type InjectedMcpServerDef, type SessionWakeHandler, type ResolveInjectedMcpServers, type ScheduleTriggerHandler, type ScheduleInfo, type JobMetadata, type AdoptionPlacementMode, type AdoptableSession, type AdoptSkippedSession } from "@herdctl/core";
 import type { PaddockConfig } from "./config.js";
 import type { Project } from "./projects.js";
+import { type UnplantedChatsLink } from "./transcripts.js";
 import { type PaddockTrigger } from "./trigger-config.js";
 import { type McpSources } from "./claude-mcp.js";
 import { type HostPluginSource } from "./claude-plugins.js";
@@ -190,6 +191,22 @@ export declare class HerdctlService {
      * fix's residue gate — see {@link residueDepthFor} + `./resume-drain.ts`).
      */
     private agentWorkingDirs;
+    /**
+     * Each agent's `.chats` HOST dir — `project.dir`, which for a repo-backed
+     * project is NOT `workingDir` (#187). Recorded so {@link deleteSession} can ask
+     * whether this project's store is still a planted symlink before it runs an
+     * `rm` through it (#708).
+     */
+    private agentChatsHostDirs;
+    /**
+     * Stale `.chats` symlinks this service unplanted while bringing the on-disk
+     * layout in line with `claude.transcripts` (#708) — i.e. an instance that used
+     * to run `host` and now runs `own`. Drained by `app.ts` into the boot log:
+     * the transcripts written during the `host` period are still in the user's own
+     * Claude home and are no longer in paddock's chat list, so the operator needs
+     * the paths to decide what to import. Empty on every normal boot.
+     */
+    readonly unplantedChatsLinks: UnplantedChatsLink[];
     /**
      * Live session-mode turns keyed by the synthetic turn id we hand back as the
      * `jobId` (Paddock#111). `openChatSession` creates no herdctl job record, so
@@ -557,6 +574,26 @@ export declare class HerdctlService {
      *
      * The chat leaves paddock's list either way — which is what the user asked for
      * — so `retained` is how a caller tells "gone" from "no longer shown here".
+     *
+     * ## The `own` branch's one precondition (#708)
+     *
+     * `manager.deleteSession` `rm`s `<claudeHome>/projects/<enc>/<id>.jsonl`, which
+     * paddock has symlinked at `<project.dir>/.chats`. That is only paddock's store
+     * if `.chats` is a real directory. On an instance flipped `host` → `own` it was
+     * a leftover symlink into the user's own Claude home, so the `own` branch —
+     * chosen precisely because "these transcripts are ours to delete" — resolved
+     * through it and unlinked the user's real terminal history.
+     *
+     * `ensureProjectChats` clears that symlink on every boot now, so this should
+     * never fire. It is here anyway because that healing is best-effort by
+     * construction: the whole module swallows its own errors so a layout problem
+     * can never block chat, and the single operation that must not run against an
+     * unhealed layout is this `rm`. Checking is one `lstat` that never follows the
+     * link, so the guard itself cannot touch `~/.claude` either.
+     *
+     * Refusing reports the same `{removed: false, retained: true}` the `host`
+     * branch does, for the same reason: nothing was deleted, so do not claim it
+     * was. The next boot heals the layout and the delete then works normally.
      */
     deleteSession(agentName: string, sessionId: string): Promise<ChatDeletion>;
     /**
@@ -983,6 +1020,14 @@ export declare class HerdctlService {
      * errors, and a missing symlink only means Claude keeps its default location.
      */
     private ensureSweeperHome;
+    /**
+     * {@link ensureProjectChats} for every call site, so the stale-`.chats`-symlink
+     * findings it reports (#708) are accumulated in one place rather than dropped
+     * by three independent callers. Sweeper homes are included deliberately: they
+     * inherited the same stale link, so they wrote their transcripts into the
+     * user's real Claude home too.
+     */
+    private ensureChats;
     private triggerAgentConfig;
     private ensureConfigFile;
 }

package/packages/server/dist/herdctl.js

@@ -53,7 +53,7 @@ import { promises as fs } from "node:fs";
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 import { DEFAULT_MODEL } from "./models.js";
-import { ensureProjectChats, projectChatsDir } from "./transcripts.js";
+import { chatsDirIsPlanted, ensureProjectChats, projectChatsDir, } from "./transcripts.js";
 import { triggerRunsOnOwnAgent, isCuratorTrigger, } from "./trigger-config.js";
 import { buildAgentConfig, buildSweeperConfig, sweeperWorkingDir, buildTriggerConfig, ensureConfigFile as writeBootConfigFile, } from "./herdctl-agent-config.js";
 import { EMPTY_MCP_SOURCES } from "./claude-mcp.js";
@@ -254,6 +254,22 @@ export class HerdctlService {
      * fix's residue gate — see {@link residueDepthFor} + `./resume-drain.ts`).
      */
     agentWorkingDirs = new Map();
+    /**
+     * Each agent's `.chats` HOST dir — `project.dir`, which for a repo-backed
+     * project is NOT `workingDir` (#187). Recorded so {@link deleteSession} can ask
+     * whether this project's store is still a planted symlink before it runs an
+     * `rm` through it (#708).
+     */
+    agentChatsHostDirs = new Map();
+    /**
+     * Stale `.chats` symlinks this service unplanted while bringing the on-disk
+     * layout in line with `claude.transcripts` (#708) — i.e. an instance that used
+     * to run `host` and now runs `own`. Drained by `app.ts` into the boot log:
+     * the transcripts written during the `host` period are still in the user's own
+     * Claude home and are no longer in paddock's chat list, so the operator needs
+     * the paths to decide what to import. Empty on every normal boot.
+     */
+    unplantedChatsLinks = [];
     /**
      * Live session-mode turns keyed by the synthetic turn id we hand back as the
      * `jobId` (Paddock#111). `openChatSession` creates no herdctl job record, so
@@ -420,7 +436,7 @@ export class HerdctlService {
             // at the .chats store in the metadata dir — so repo-backed transcripts stay
             // out of the external checkout's working tree (issue #187). For a notebook
             // project workingDir === dir, so this is the classic behavior.
-            await ensureProjectChats(project.workingDir, project.dir, this.claudeHomeTarget);
+            await this.ensureChats(project.workingDir, project.dir);
             await this.ensureSweeperHome(project);
             await this.fleet.addAgent(this.keeperAgentConfig(project), { replace: true });
             await this.fleet.addAgent(this.sweeperAgentConfig(project), { replace: true });
@@ -430,6 +446,7 @@ export class HerdctlService {
             await this.registerTriggerAgents(project);
             this.agentModels.set(keeperAgentName(project.slug), project.model ?? DEFAULT_MODEL);
             this.agentWorkingDirs.set(keeperAgentName(project.slug), project.workingDir);
+            this.agentChatsHostDirs.set(keeperAgentName(project.slug), project.dir);
         }
     }
     /** Start the scheduler (keeper agents currently have no schedules, but this
@@ -494,7 +511,7 @@ export class HerdctlService {
     async ensureProjectAgent(project) {
         if (!this.fleet)
             return;
-        await ensureProjectChats(project.workingDir, project.dir, this.claudeHomeTarget);
+        await this.ensureChats(project.workingDir, project.dir);
         await this.ensureSweeperHome(project);
         await this.fleet.addAgent(this.keeperAgentConfig(project), { replace: true });
         await this.fleet.addAgent(this.sweeperAgentConfig(project), { replace: true });
@@ -507,6 +524,7 @@ export class HerdctlService {
         // default), so a model change via PATCH takes effect here too.
         this.agentModels.set(keeperAgentName(project.slug), project.model ?? DEFAULT_MODEL);
         this.agentWorkingDirs.set(keeperAgentName(project.slug), project.workingDir);
+        this.agentChatsHostDirs.set(keeperAgentName(project.slug), project.dir);
     }
     /**
      * Register (or replace) every trigger a project declares that runs on its OWN scoped
@@ -922,9 +940,33 @@ export class HerdctlService {
      *
      * The chat leaves paddock's list either way — which is what the user asked for
      * — so `retained` is how a caller tells "gone" from "no longer shown here".
+     *
+     * ## The `own` branch's one precondition (#708)
+     *
+     * `manager.deleteSession` `rm`s `<claudeHome>/projects/<enc>/<id>.jsonl`, which
+     * paddock has symlinked at `<project.dir>/.chats`. That is only paddock's store
+     * if `.chats` is a real directory. On an instance flipped `host` → `own` it was
+     * a leftover symlink into the user's own Claude home, so the `own` branch —
+     * chosen precisely because "these transcripts are ours to delete" — resolved
+     * through it and unlinked the user's real terminal history.
+     *
+     * `ensureProjectChats` clears that symlink on every boot now, so this should
+     * never fire. It is here anyway because that healing is best-effort by
+     * construction: the whole module swallows its own errors so a layout problem
+     * can never block chat, and the single operation that must not run against an
+     * unhealed layout is this `rm`. Checking is one `lstat` that never follows the
+     * link, so the guard itself cannot touch `~/.claude` either.
+     *
+     * Refusing reports the same `{removed: false, retained: true}` the `host`
+     * branch does, for the same reason: nothing was deleted, so do not claim it
+     * was. The next boot heals the layout and the delete then works normally.
      */
     async deleteSession(agentName, sessionId) {
         if (this.cfg.claude.transcripts === "own") {
+            const chatsHostDir = this.agentChatsHostDirs.get(agentName);
+            if (chatsHostDir !== undefined && (await chatsDirIsPlanted(chatsHostDir))) {
+                return { removed: false, retained: true };
+            }
             const removed = await this.manager.deleteSession(agentName, sessionId);
             await this.dropAgentSessionPointer(agentName, sessionId);
             return { removed, retained: false };
@@ -1831,7 +1873,19 @@ export class HerdctlService {
      */
     async ensureSweeperHome(project) {
         const dir = sweeperWorkingDir(this.cfg, project.slug);
-        await ensureProjectChats(dir, dir, this.claudeHomeTarget);
+        await this.ensureChats(dir, dir);
+    }
+    /**
+     * {@link ensureProjectChats} for every call site, so the stale-`.chats`-symlink
+     * findings it reports (#708) are accumulated in one place rather than dropped
+     * by three independent callers. Sweeper homes are included deliberately: they
+     * inherited the same stale link, so they wrote their transcripts into the
+     * user's real Claude home too.
+     */
+    async ensureChats(workingDir, chatsHostDir) {
+        const unplanted = await ensureProjectChats(workingDir, chatsHostDir, this.claudeHomeTarget);
+        if (unplanted)
+            this.unplantedChatsLinks.push(unplanted);
     }
     triggerAgentConfig(project, triggerName, trigger) {
         return buildTriggerConfig(this.cfg, project, triggerName, trigger);

package/packages/server/dist/instance-config.d.ts

@@ -1,3 +1,5 @@
+import { type ProfileName } from "./profiles.js";
+import { type TranscriptsMode } from "./transcripts.js";
 import { type PaddockConfig } from "./config.js";
 /** Groups the Settings screen renders, in display order. */
 export declare const GROUPS: {
@@ -91,6 +93,14 @@ export interface InstanceConfigFieldDto {
     envOverridden: boolean;
     /** The env var shadowing this field (only when `envOverridden`). */
     envVar?: string;
+    /**
+     * The instance's posture profile is what put `value` here (#878): this field
+     * is one of the profile's levers, and neither the config file nor an env var
+     * overrode it. False on every non-posture field, and — importantly — false on
+     * a posture field the environment or the file set, so the UI never credits the
+     * profile for a value it did not choose. See {@link isFromProfile}.
+     */
+    fromProfile: boolean;
 }
 export interface InstanceConfigGroupDto {
     id: string;
@@ -129,33 +139,29 @@ export interface InstanceConfigDto {
  * than trusting a cached value: the point is to notice a write we did not make.
  */
 export declare function instanceConfigVersion(configPath: string): string | null;
+/**
+ * The transcripts mode a RESTART would resolve — read from the config FILE,
+ * falling back to the profile's default when the file is silent about it.
+ *
+ * NOT `cfg.claude.transcripts`, which is what THIS process froze at boot. The
+ * two differ for the whole window between a successful `own → host` migration
+ * (#882) and the restart it asks for, and that window is precisely when a
+ * second POST arrives: without this the idempotency check would see `own`,
+ * decide nothing had happened, and re-run a migration that already had.
+ *
+ * The environment is deliberately not consulted. `PADDOCK_CLAUDE_TRANSCRIPTS`
+ * beats the file, so when it is set the true answer to "what would a restart
+ * resolve" is the env var — but a caller in that situation is already refusing
+ * with `env_shadowed`, and folding it in here would make a shadowed instance
+ * look permanently migrated.
+ */
+export declare function pendingTranscriptsMode(cfg: PaddockConfig): TranscriptsMode;
 /**
  * Resolve the path a PUT writes to: an explicit `PADDOCK_CONFIG` env var wins
  * (the same rule {@link import("./config.js").loadConfigFile} reads it back
  * from), else `<dataDir>/paddock.config.yaml`.
  */
 export declare function instanceConfigPath(cfg: PaddockConfig): string;
-/**
- * Build the grouped GET DTO from the resolved (frozen) config, the live env AND
- * the config file on disk. Each field reports:
- *
- *  - `value` — EFFECTIVE now, out of the frozen boot config;
- *  - `pendingValue` — what a restart would resolve, out of the file this instant;
- *  - `pendingRestart` — those two differ.
- *
- * Reading the file is the load-bearing part (#722). While this built the DTO
- * from the frozen config alone, `GET` could not observe ANY write — including
- * the one the caller had just made — so a successful save appeared to revert,
- * two tabs clobbered each other with nothing able to notice, and
- * `restartRequired` had no choice but to be a hardcoded `false`.
- *
- * Pending values are computed for EDITABLE, non-env-shadowed fields only:
- *  - an env-shadowed field resolves to the same env value after a restart, so
- *    the file cannot make it diverge;
- *  - the read-only `advanced` bindings are normalised at boot (`dataDir` and
- *    friends are canonicalised, `port` is `Number()`-ed), so comparing them
- *    against raw file text would manufacture divergence that isn't there.
- */
 export declare function buildInstanceConfig(cfg: PaddockConfig): InstanceConfigDto;
 /** A rejected PUT: which field failed and why (surfaced as a 400). */
 export declare class InstanceConfigError extends Error {
@@ -191,4 +197,126 @@ export declare function writeInstanceConfig(configPath: string, pairs: {
     key: string;
     value: unknown;
 }[]): void;
+/**
+ * WHICH LAYER supplied a field's effective value.
+ *
+ * Paddock resolves config as `profile < file < env` beneath a static code
+ * default, and #878's argument for a `config show --resolved` is that naming the
+ * layer is the honest answer to "I want it all written down" — unlike a
+ * hand-maintained file, a printed resolution cannot drift from what the process
+ * actually did.
+ *
+ * `profile` and `default` are deliberately separate, and that distinction is the
+ * whole point of the command for the twelve posture keys. Those keys no longer
+ * HAVE a code default of their own: the profile supplies it (see
+ * {@link defaultFor}). Collapsing the two would leave an operator unable to tell
+ * "Paddock has always shipped this" from "your profile chose this, and picking a
+ * different one would change it".
+ */
+export type ConfigSource = "env" | "file" | "profile" | "default";
+/** One field's effective value and where it came from. */
+export interface ResolvedConfigField {
+    key: string;
+    group: string;
+    label: string;
+    help?: string;
+    type: FieldType;
+    /**
+     * The EFFECTIVE value, normalised the way {@link buildInstanceConfig} does it:
+     * a field the frozen config leaves unset reads as the fallback it implies (the
+     * profile's, or the code default), never as a bare `null`. Printing `null` for
+     * `models` — which resolves to "offer the whole catalog" — would be a lie
+     * dressed as precision.
+     */
+    value: unknown;
+    source: ConfigSource;
+    /** `env` → the variable name; `profile` → the profile name; `file` → its path. */
+    origin?: string;
+    sensitive: boolean;
+    /**
+     * Whether `paddock config eject` may materialise this key into the config file
+     * (#878). Decided here rather than in the CLI because it is a property of the
+     * field catalog, and a lever added to {@link FIELDS} tomorrow should land on
+     * the right side of it without anyone remembering the eject command exists.
+     *
+     * The rule is `(editable || posture key) && !sensitive`, which draws the line
+     * at **what an ejected file can honestly promise to be**:
+     *
+     * - **Posture and editable keys are in.** These are the settings a config file
+     *   is for — the twelve levers a profile governs, plus everything the Settings
+     *   screen already round-trips through this same file. Writing them changes no
+     *   effective value, only where it comes from.
+     * - **Process/filesystem bindings are out** — `port`, `host`, `dataDir`,
+     *   `projectsRoot`, `stateDir`, `herdctlConfigPath`, `webDist`. Their resolved
+     *   values are absolute, canonicalised, machine-specific paths; `dataDir` in
+     *   particular resolves to the directory the file itself lives in, so ejecting
+     *   it writes a self-reference that survives a move and silently points the
+     *   copy back at the original. An ejected config should stay portable and
+     *   stay mountable, and freezing this instance's port into it is how a second
+     *   instance started from the same file collides on boot.
+     * - **`sensitive` fields are out**, unconditionally and with no flag to
+     *   override. `transcription.endpoint` is an operator-supplied URL that can
+     *   read `https://user:token@host`; bulk-materialising a possibly
+     *   credential-bearing value into a file on disk is not a thing to make one
+     *   keystroke away. Writing that key by hand stays available and is a
+     *   deliberate act, which is the right shape for it.
+     *
+     * Excluding sensitive fields costs nothing in fidelity, which is worth stating
+     * because it is not obvious: a sensitive field's value can only have come from
+     * the file (in which case it is already there and eject leaves it alone) or
+     * from the environment (which eject skips anyway) or from its default (in which
+     * case there is nothing to write). So there is no case where skipping one makes
+     * the ejected file resolve differently.
+     */
+    ejectable: boolean;
+    /**
+     * The config file names this key, but a higher layer won and this value is
+     * inert. Worth surfacing rather than silently ignoring: an operator who edited
+     * the file and saw nothing change is exactly the person running this command.
+     */
+    shadowedFileValue?: unknown;
+}
+/** The resolved profile, and which layer named it. */
+export interface ResolvedProfileInfo {
+    name: ProfileName;
+    source: "env" | "file" | "default";
+    /** The variable name, or the config file path. Absent on `default`. */
+    origin?: string;
+    /**
+     * A profile name that WAS set and is not one of the three. `resolveProfileName`
+     * falls back to the default rather than failing the boot, which is the right
+     * call for a boot and a terrible one for a diagnostic — so the typo is reported
+     * here instead of vanishing.
+     */
+    unrecognised?: {
+        value: string;
+        origin: string;
+    };
+}
+/** Everything `paddock config show` needs, with no formatting decisions taken. */
+export interface ResolvedConfigReport {
+    dataDir: string;
+    configPath: string;
+    configFileExists: boolean;
+    /** The file exists but could not be read/parsed (the loader is the strict reader). */
+    configFileError?: string;
+    profile: ResolvedProfileInfo;
+    fields: ResolvedConfigField[];
+}
+/**
+ * Resolve every field in {@link FIELDS} against a loaded config, reporting the
+ * layer each value came from.
+ *
+ * Built on the same descriptor table the Config screen uses rather than a
+ * parallel list, so a lever added for the UI is printed by the CLI for free and
+ * the two can never disagree about what a default is. What it does NOT reuse is
+ * `buildInstanceConfig`'s DTO: that answers "what would a restart change?", which
+ * needs the file compared against the process. This answers "where did each of
+ * these values come from?", which needs the file compared against the LAYERS.
+ *
+ * No value here is a secret — {@link FIELDS} excludes them by construction — but
+ * `sensitive` rides along so a caller can decide what to put on a terminal that
+ * ends up pasted into an issue.
+ */
+export declare function resolveConfigReport(cfg: PaddockConfig): ResolvedConfigReport;
 export {};