@edspencer/paddock 0.72.1 → 0.73.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edspencer/paddock",
-  "version": "0.72.1",
+  "version": "0.73.0",
   "description": "Project-first launchpad for Claude Code: server-hosted, persistent, resumable sessions organized by project.",
   "keywords": [
     "claude",

package/packages/server/dist/config.d.ts

@@ -10,6 +10,7 @@ import { type RecoveryConfig } from "./recovery-config.js";
 import { type CurationConfig } from "./curation-config.js";
 import { type ManagementApiConfig, type ManagementApiConfigFile } from "./management-config.js";
 import { type AttachmentsConfig } from "./attachments-config.js";
+import { type UiConfig } from "./ui-config.js";
 /**
  * User-authentication strategy.
  *
@@ -433,6 +434,13 @@ export interface PaddockConfig {
      * allow-all by default.
      */
     attachments: AttachmentsConfig;
+    /**
+     * Instance-level UI knobs (issue #914) — currently just how many trailing
+     * messages a chat transcript renders on open. Instance-only by design: there is
+     * no per-project override, because this describes the operator's browser
+     * tolerance, not anything about a project.
+     */
+    ui: UiConfig;
     /**
      * Per-file token budgets the post-turn sweeper (curation) must keep its three
      * curated files under (issue #379). These bound the context every keeper chat
@@ -614,6 +622,13 @@ export interface PaddockConfigFile {
         maxFilesPerMessage?: number | string;
         allowedTypes?: string[] | string;
     };
+    /**
+     * Instance-level UI knobs (issue #914). Every field optional; a matching
+     * `PADDOCK_UI_*` env var still overrides it (file < env).
+     */
+    ui?: {
+        transcriptRenderLimit?: number | string;
+    };
     /**
      * Per-file curation token budgets (issue #379). Every field optional; a
      * matching `PADDOCK_CURATION_*` env var still overrides it (file < env).

package/packages/server/dist/config.js

@@ -37,6 +37,7 @@ import { DEFAULT_RECOVERY } from "./recovery-config.js";
 import { DEFAULT_CURATION } from "./curation-config.js";
 import { resolveManagementApiConfig, } from "./management-config.js";
 import { DEFAULT_ATTACHMENTS, sanitizeAllowedTypes, } from "./attachments-config.js";
+import { DEFAULT_UI } from "./ui-config.js";
 function abs(p) {
     return path.isAbsolute(p) ? p : path.resolve(process.cwd(), p);
 }
@@ -348,6 +349,7 @@ export function loadPaddockConfig(opts = {}) {
         hooksMcpEnabled: loadHooksMcpEnabled(file.hooksMcpEnabled, p.hooksMcpEnabled),
         recovery: loadRecoveryConfig(file.recovery),
         attachments: loadAttachmentsConfig(file.attachments),
+        ui: loadUiConfig(file.ui),
         curation: loadCurationConfig(file.curation),
         logLevel: envOr("LOG_LEVEL", fileOr(file.logLevel, "info")),
         browserMcp: loadBrowserMcp(file.browserMcp, p.browserMcp),
@@ -514,6 +516,23 @@ function loadAttachmentsConfig(file) {
         allowedTypes: loadAllowedTypes(f.allowedTypes, DEFAULT_ATTACHMENTS.allowedTypes),
     };
 }
+/**
+ * Resolve the instance-level UI config (issue #914).
+ *
+ * `transcriptRenderLimit` is a NON-NEGATIVE knob — `0` is the meaningful value
+ * "unlimited", so this cannot reuse {@link loadAttachmentsInt}, whose floor is 1.
+ * A missing/blank/non-integer/negative value falls back to the default rather
+ * than failing startup, like every other loader here.
+ */
+function loadUiConfig(file) {
+    const raw = envOpt("PADDOCK_UI_TRANSCRIPT_RENDER_LIMIT") ?? fileOpt(file?.transcriptRenderLimit);
+    if (raw === undefined)
+        return { ...DEFAULT_UI };
+    const n = Number(raw);
+    return {
+        transcriptRenderLimit: Number.isInteger(n) && n >= 0 ? n : DEFAULT_UI.transcriptRenderLimit,
+    };
+}
 /**
  * Resolve the per-deployment schedule-mutation gate (issue #265 / DD-7). Defaults
  * OFF so a plain instance can't have its schedules mutated programmatically; an

package/packages/server/dist/instance-config.js

@@ -35,6 +35,7 @@ import { DRIVE_MODES, DEFAULT_DRIVE_MODE, MODELS, isKnownModel } from "./models.
 import { DEFAULT_MAX_SPAWN_DEPTH, isValidMaxSpawnDepth } from "./spawn-capability.js";
 import { DEFAULT_RECOVERY } from "./recovery-config.js";
 import { DEFAULT_ATTACHMENTS, sanitizeAllowedTypes } from "./attachments-config.js";
+import { DEFAULT_UI } from "./ui-config.js";
 import { DEFAULT_CURATION } from "./curation-config.js";
 import { DEFAULT_ENVIRONMENT_PROMPT } from "./environment-prompt.js";
 import { CONFIG_SCHEMA_VERSION, SCHEMA_VERSION_KEY } from "./schema-version.js";
@@ -51,6 +52,7 @@ export const GROUPS = [
     { id: "capabilities", label: "Capabilities", description: "What keeper agents are allowed to do. Most default off." },
     { id: "recovery", label: "Recovery" },
     { id: "attachments", label: "Attachments" },
+    { id: "ui", label: "Interface", description: "How the web UI renders. These affect the browser only — nothing is deleted or changed on disk." },
     { id: "branding", label: "Branding" },
     { id: "transcription", label: "Transcription" },
     { id: "git", label: "Git identity" },
@@ -270,6 +272,8 @@ export const FIELDS = [
     { key: "attachments.maxFileSizeMb", group: "attachments", label: "Max file size (MB)", type: "number", envVars: ["PADDOCK_ATTACHMENTS_MAX_FILE_SIZE_MB"], default: DEFAULT_ATTACHMENTS.maxFileSizeMb, editable: true, coerce: posInt },
     { key: "attachments.maxFilesPerMessage", group: "attachments", label: "Max files / message", type: "number", envVars: ["PADDOCK_ATTACHMENTS_MAX_FILES_PER_MESSAGE"], default: DEFAULT_ATTACHMENTS.maxFilesPerMessage, editable: true, coerce: posInt },
     { key: "attachments.allowedTypes", group: "attachments", label: "Allowed types", help: "MIME types / extensions (e.g. image/*, .pdf). * = allow all.", type: "string-list", envVars: ["PADDOCK_ATTACHMENTS_ALLOWED_TYPES"], default: [...DEFAULT_ATTACHMENTS.allowedTypes], editable: true, coerce: stringList },
+    // Interface (issue #914). `nonNegInt`, not `posInt`: 0 means "render everything".
+    { key: "ui.transcriptRenderLimit", group: "ui", label: "Transcript render limit", help: "How many recent messages a chat renders on open. 0 = no limit. Older messages stay on disk and are not deleted.", type: "number", envVars: ["PADDOCK_UI_TRANSCRIPT_RENDER_LIMIT"], default: DEFAULT_UI.transcriptRenderLimit, editable: true, coerce: nonNegInt },
     // Branding (issue #34).
     { key: "brand.name", group: "branding", label: "Name", type: "string", envVars: ["PADDOCK_BRAND_NAME"], default: "Paddock", editable: true, coerce: nonEmptyString },
     { key: "brand.logo", group: "branding", label: "Logo", help: "An emoji/glyph, or a URL/path to an image.", type: "string", envVars: ["PADDOCK_BRAND_LOGO"], default: "🐎", editable: true, coerce: nonEmptyString },

package/packages/server/dist/models.d.ts

@@ -9,8 +9,9 @@
  * constants — so changing the available models or a context limit is a one-file
  * edit here.
  *
- * Context limits (verified against the Models API): Opus 5, Fable 5, Opus 4.8
- * and Sonnet 5 all have a 1,000,000-token context window; Haiku 4.5 is 200,000.
+ * Context limits (verified against the Models API): Opus 5, Fable 5.1, Fable 5,
+ * Opus 4.8 and Sonnet 5 all have a 1,000,000-token context window; Haiku 4.5 is
+ * 200,000.
  * On the Max plan the keeper agents run Opus 5 at its full 1M window, so
  * the context meter must use 1M for it — otherwise a long chat reads >100%.
  */
@@ -28,6 +29,14 @@ export interface ModelPricing {
     inputPer1M: number;
     /** USD per 1M output tokens. */
     outputPer1M: number;
+    /**
+     * Cache-read price as a multiple of {@link inputPer1M}, when the model departs
+     * from the standard 0.1× ({@link CACHE_READ_MULTIPLIER}). Fable 5.1 and Mythos
+     * 5.1 read cached tokens at **0.025×** ($0.25/MTok against a $10 base); every
+     * other model is the standard tenth. Cache reads dominate a long chat's token
+     * counts, so getting this wrong overstates a Fable 5.1 chat's cost ~4×.
+     */
+    cacheReadMultiplier?: number;
 }
 /** A single selectable model: its id, a human label, and its context window. */
 export interface ModelInfo {

package/packages/server/dist/models.js

@@ -9,8 +9,9 @@
  * constants — so changing the available models or a context limit is a one-file
  * edit here.
  *
- * Context limits (verified against the Models API): Opus 5, Fable 5, Opus 4.8
- * and Sonnet 5 all have a 1,000,000-token context window; Haiku 4.5 is 200,000.
+ * Context limits (verified against the Models API): Opus 5, Fable 5.1, Fable 5,
+ * Opus 4.8 and Sonnet 5 all have a 1,000,000-token context window; Haiku 4.5 is
+ * 200,000.
  * On the Max plan the keeper agents run Opus 5 at its full 1M window, so
  * the context meter must use 1M for it — otherwise a long chat reads >100%.
  */
@@ -32,6 +33,12 @@ export const MODELS = [
         contextLimit: 1_000_000,
         pricing: { inputPer1M: 5, outputPer1M: 25 },
     },
+    {
+        id: "claude-fable-5-1",
+        label: "Fable 5.1",
+        contextLimit: 1_000_000,
+        pricing: { inputPer1M: 10, outputPer1M: 50, cacheReadMultiplier: 0.025 },
+    },
     {
         id: "claude-fable-5",
         label: "Fable 5",
@@ -159,7 +166,10 @@ export function getContextLimit(id) {
 export function getModelInfo(id) {
     return MODELS.find((m) => m.id === id);
 }
-/** Cache-write (5-minute ephemeral) is 1.25× the input rate; cache-read is 0.1×. */
+/**
+ * Cache-write (5-minute ephemeral) is 1.25× the input rate; cache-read is 0.1×
+ * — except on models that override it via {@link ModelPricing.cacheReadMultiplier}.
+ */
 const CACHE_WRITE_MULTIPLIER = 1.25;
 const CACHE_READ_MULTIPLIER = 0.1;
 /**
@@ -176,9 +186,10 @@ export function estimateCostUsd(modelId, t) {
     if (!pricing)
         return null;
     const { inputPer1M, outputPer1M } = pricing;
+    const cacheRead = pricing.cacheReadMultiplier ?? CACHE_READ_MULTIPLIER;
     const usd = (t.inputTokens * inputPer1M +
         t.cacheCreationTokens * inputPer1M * CACHE_WRITE_MULTIPLIER +
-        t.cacheReadTokens * inputPer1M * CACHE_READ_MULTIPLIER +
+        t.cacheReadTokens * inputPer1M * cacheRead +
         t.outputTokens * outputPer1M) /
         1_000_000;
     return usd;

package/packages/server/dist/project-files.d.ts

@@ -74,10 +74,11 @@ export declare function readFileBytes(dir: string, name: string, hiddenSegments?
  * UI's markdown/Mermaid + sandboxed-iframe renderers (issue #3) and the image
  * viewer (issue #61).
  *
- * For an IMAGE the raw bytes are NOT returned here (decoding binary as UTF-8
- * would mangle it): `content` is empty and the client fetches the bytes from
- * the raw endpoint. We still stat the file so a missing image 404s. Path-
- * traversal guarded; throws ProjectError("not_found") when missing. See
+ * For a BINARY kind (image, pdf) the raw bytes are NOT returned here (decoding
+ * binary as UTF-8 would mangle it — a PDF read this way is the garbled text of
+ * issue #917): `content` is empty and the client fetches the bytes from the raw
+ * endpoint. We still stat the file so a missing one 404s. Path-traversal
+ * guarded; throws ProjectError("not_found") when missing. See
  * {@link resolveInProject} for `hiddenSegments`.
  */
 export declare function readFileWithKind(dir: string, name: string, hiddenSegments?: "refuse" | "allow"): Promise<{

package/packages/server/dist/project-files.js

@@ -156,15 +156,16 @@ export async function readFileBytes(dir, name, hiddenSegments = "refuse") {
  * UI's markdown/Mermaid + sandboxed-iframe renderers (issue #3) and the image
  * viewer (issue #61).
  *
- * For an IMAGE the raw bytes are NOT returned here (decoding binary as UTF-8
- * would mangle it): `content` is empty and the client fetches the bytes from
- * the raw endpoint. We still stat the file so a missing image 404s. Path-
- * traversal guarded; throws ProjectError("not_found") when missing. See
+ * For a BINARY kind (image, pdf) the raw bytes are NOT returned here (decoding
+ * binary as UTF-8 would mangle it — a PDF read this way is the garbled text of
+ * issue #917): `content` is empty and the client fetches the bytes from the raw
+ * endpoint. We still stat the file so a missing one 404s. Path-traversal
+ * guarded; throws ProjectError("not_found") when missing. See
  * {@link resolveInProject} for `hiddenSegments`.
  */
 export async function readFileWithKind(dir, name, hiddenSegments = "refuse") {
     const kind = fileKind(name);
-    if (kind === "image") {
+    if (kind === "image" || kind === "pdf") {
         // Existence check only — the bytes go over the raw endpoint.
         try {
             await fs.stat(resolveInProject(dir, name, hiddenSegments));

package/packages/server/dist/project-mime.d.ts

@@ -22,11 +22,11 @@ export declare const IMAGE_MIME: Record<string, string>;
 export declare const VIDEO_MIME: Record<string, string>;
 /**
  * Non-image document extensions → their MIME type. Kept SEPARATE from
- * `IMAGE_MIME` on purpose: the file-kind classifier (`fileKind`) treats every
- * `IMAGE_MIME` entry as `kind: "image"`, so a `.pdf` must not live there. It's
- * used only for the byte endpoint's Content-Type (a PDF must serve as
- * `application/pdf`, not the octet-stream the attachment store rewrites to
- * `text/plain`).
+ * `IMAGE_MIME` on purpose: the file-kind classifier (`fileKind`) maps every
+ * `IMAGE_MIME` entry to `kind: "image"`, so a `.pdf` must not live there — it
+ * gets its own `kind: "pdf"` (issue #917). Also the byte endpoint's
+ * Content-Type (a PDF must serve as `application/pdf`, not the octet-stream the
+ * attachment store rewrites to `text/plain`).
  */
 export declare const DOCUMENT_MIME: Record<string, string>;
 /** Derive a render kind from a file name's extension. */

package/packages/server/dist/project-mime.js

@@ -28,11 +28,11 @@ export const VIDEO_MIME = {
 };
 /**
  * Non-image document extensions → their MIME type. Kept SEPARATE from
- * `IMAGE_MIME` on purpose: the file-kind classifier (`fileKind`) treats every
- * `IMAGE_MIME` entry as `kind: "image"`, so a `.pdf` must not live there. It's
- * used only for the byte endpoint's Content-Type (a PDF must serve as
- * `application/pdf`, not the octet-stream the attachment store rewrites to
- * `text/plain`).
+ * `IMAGE_MIME` on purpose: the file-kind classifier (`fileKind`) maps every
+ * `IMAGE_MIME` entry to `kind: "image"`, so a `.pdf` must not live there — it
+ * gets its own `kind: "pdf"` (issue #917). Also the byte endpoint's
+ * Content-Type (a PDF must serve as `application/pdf`, not the octet-stream the
+ * attachment store rewrites to `text/plain`).
  */
 export const DOCUMENT_MIME = {
     ".pdf": "application/pdf",
@@ -46,6 +46,8 @@ export function fileKind(name) {
         return "html";
     if (ext in IMAGE_MIME)
         return "image";
+    if (ext in DOCUMENT_MIME)
+        return "pdf";
     return "text";
 }
 /** The MIME type for a file name's extension, defaulting to octet-stream. */

package/packages/server/dist/project-types.d.ts

@@ -25,7 +25,7 @@ export declare const PROJECT_STATUSES: readonly ["idea", "active", "paused", "bl
 export type ProjectStatus = (typeof PROJECT_STATUSES)[number];
 export type ProjectVisibility = "public" | "private";
 /** Render-kind hint for a project file (drives the UI renderer choice). */
-export type FileKind = "markdown" | "html" | "text" | "image";
+export type FileKind = "markdown" | "html" | "text" | "image" | "pdf";
 /**
  * One entry in a project directory listing (issue #259): a name plus whether
  * it's a file or a subdirectory, so the Files tab can distinguish the two and

package/packages/server/dist/routes/chats.js

@@ -15,6 +15,7 @@ import { ROOT_KEY } from "../projects.js";
 import { applyMessageProvenance } from "../message-provenance.js";
 import { buildProjectRuns } from "../runs.js";
 import { DEFAULT_MODEL } from "../models.js";
+import { capMessages } from "../ui-config.js";
 import { projectChatsDir } from "../transcripts.js";
 import { readSubagentMessages, readSessionTokenUsageWithSubagents } from "../subagents.js";
 import { readContextSeries } from "../usage.js";
@@ -461,7 +462,7 @@ export function registerChatWorkspaceRoutes(app, ctx) {
         schema: {
             tags: ["Chats"],
             summary: "Read a project chat's messages",
-            description: "READ-ONLY: returns the messages of a project chat, enriched with tool details and per-message provenance, plus a synthetic trailing notice if the chat dead-ended at a usage/subscription limit. Sending a message is WebSocket-only (a `chat:send` frame on GET /ws) — there is no HTTP send-message endpoint. Response: `{ messages: [...] }`.",
+            description: "READ-ONLY: returns the messages of a project chat, enriched with tool details and per-message provenance, plus a synthetic trailing notice if the chat dead-ended at a usage/subscription limit. Sending a message is WebSocket-only (a `chat:send` frame on GET /ws) — there is no HTTP send-message endpoint. Optional `?limit=N` returns only the trailing N messages (issue #914); omitted or `0` returns the whole transcript, which is the default and unchanged behaviour. Response: `{ messages: [...], total, truncated }`, where `total` is the full count before any cap.",
             params: {
                 type: "object",
                 properties: {
@@ -470,6 +471,16 @@ export function registerChatWorkspaceRoutes(app, ctx) {
                 },
                 required: ["slug", "sessionId"],
             },
+            querystring: {
+                type: "object",
+                properties: {
+                    limit: {
+                        type: "integer",
+                        minimum: 0,
+                        description: "Return only the trailing N messages. Omit (or pass 0) for the whole transcript. The SPA passes the instance's `ui.transcriptRenderLimit`; other clients are uncapped by default so the published contract is unchanged.",
+                    },
+                },
+            },
             response: {
                 200: {
                     description: "Object `{ messages }` with the chat's message array.",
@@ -525,7 +536,18 @@ export function registerChatWorkspaceRoutes(app, ctx) {
                     notice,
                 });
             }
-            return { messages: withProvenance };
+            // Transcript render cap (issue #914). The slice is deliberately the LAST
+            // step, after enrich/provenance/context-fill, even though slicing earlier
+            // would also save that work: `applyMessageProvenance` walks its markers
+            // with an ordered cursor from index 0 (`message-provenance.ts:274-288`),
+            // so handing it a head-sliced list desyncs the cursor and silently drops
+            // attribution for the whole window. Slicing here means every message the
+            // client receives is byte-identical to the uncapped response — the only
+            // difference is how many of them there are. Moving the cut earlier is a
+            // real optimisation, but it needs a marker offset plumbed through first.
+            const total = withProvenance.length;
+            const capped = capMessages(withProvenance, req.query.limit ?? 0);
+            return { messages: capped, total, truncated: capped.length < total };
         }
         catch (err) {
             return sendProjectError(reply, err);

package/packages/server/dist/routes/git.js

@@ -1,6 +1,7 @@
 import { sendProjectError } from "../route-errors.js";
 import { ProjectError } from "../project-paths.js";
 import { readFileWithKind, readFileBytes } from "../project-files.js";
+import { cspFor } from "../http-bytes.js";
 export function registerGitRoutes(app, ctx) {
     const { git, githubAuth } = ctx;
     // --- git (backing store): fleet-level remote + connection state --------
@@ -358,7 +359,9 @@ export function registerGitWorkspaceRoutes(app, ctx) {
                     .header("content-type", mime)
                     .header("content-disposition", "inline")
                     .header("x-content-type-options", "nosniff")
-                    .header("content-security-policy", "sandbox; default-src 'none'")
+                    // Per-MIME, not a hard-coded constant: a bare `sandbox` token stops
+                    // the browser's native PDF viewer painting at all (issue #917).
+                    .header("content-security-policy", cspFor(mime))
                     .header("cache-control", "private, max-age=60")
                     .send(bytes);
             }

package/packages/server/dist/routes/meta.js

@@ -230,7 +230,7 @@ export function registerMetaRoutes(app, ctx) {
         schema: {
             tags: ["System"],
             summary: "Selectable models and instance defaults",
-            description: "Returns the models this instance offers (the built-in catalog filtered to the `PADDOCK_MODELS` / YAML `models:` allow-list; unset ⇒ the whole catalog) plus the default model and the box-wide defaults (drive mode, max spawn depth, recovery, attachments, curation) that projects fall back to when their own overrides are unset. `defaultModel` is the effective default for the offered list. Returns a JSON object with `models`, `defaultModel`, `driveModeDefault`, `maxSpawnDepthDefault`, `recoveryDefault`, `attachmentsDefault`, and `curationDefault`.",
+            description: "Returns the models this instance offers (the built-in catalog filtered to the `PADDOCK_MODELS` / YAML `models:` allow-list; unset ⇒ the whole catalog) plus the default model and the box-wide defaults (drive mode, max spawn depth, recovery, attachments, curation) that projects fall back to when their own overrides are unset. `defaultModel` is the effective default for the offered list. Returns a JSON object with `models`, `defaultModel`, `driveModeDefault`, `maxSpawnDepthDefault`, `recoveryDefault`, `attachmentsDefault`, `curationDefault`, and `uiDefault`.",
             response: {
                 200: {
                     description: "Model list and inherited defaults.",
@@ -263,6 +263,10 @@ export function registerMetaRoutes(app, ctx) {
             // when its own `curation` override fields are unset (issue #384). Settings
             // shows these as the "Instance default" for each per-file token budget.
             curationDefault: cfg.curation,
+            // Instance-level UI knobs (issue #914). Unlike its neighbours this has no
+            // per-project override — the transcript render cap is a property of the
+            // operator's browser tolerance, not of a project — so the SPA uses it as-is.
+            uiDefault: cfg.ui,
         };
     });
     app.get("/api/fleet", {

package/packages/server/dist/routes/projects.js

@@ -3,6 +3,7 @@ import { keeperAgentName } from "../herdctl.js";
 import { isKnownModel, isKnownPermissionMode, isValidMaxTurns, isKnownDriveMode, resolveModels, MAX_TURNS_LIMIT, } from "../models.js";
 import { isValidMaxSpawnDepth, MAX_SPAWN_DEPTH_LIMIT } from "../spawn-capability.js";
 import { sendProjectError } from "../route-errors.js";
+import { cspFor } from "../http-bytes.js";
 import { buildProjectChats, makeTriggerResolver, makeParentResolver } from "../chat-dto.js";
 import { quiesceProject, turnRunningError } from "../turn-interlock.js";
 /**
@@ -722,7 +723,7 @@ export function registerProjectWorkspaceRoutes(app, ctx) {
         schema: {
             tags: ["Projects"],
             summary: "Get a single project file",
-            description: "Dual-mode. By default returns JSON with the file content plus a render-kind hint (markdown | html | text | image). With `?raw=1` it instead STREAMS the file's raw bytes with the correct Content-Type (locked down: sandbox CSP + nosniff + inline disposition) — how the image viewer loads an `<img>`. No response schema is declared so the raw byte stream is never corrupted.",
+            description: "Dual-mode. By default returns JSON with the file content plus a render-kind hint (markdown | html | text | image | pdf). Binary kinds (image, pdf) carry an EMPTY `content` — their bytes come from the raw mode instead. With `?raw=1` it STREAMS the file's raw bytes with the correct Content-Type (locked down: nosniff + inline disposition + a per-MIME CSP — `sandbox` is dropped for PDF, which cannot render under it). No response schema is declared so the raw byte stream is never corrupted.",
             params: {
                 type: "object",
                 properties: {
@@ -752,7 +753,9 @@ export function registerProjectWorkspaceRoutes(app, ctx) {
                     .header("content-type", mime)
                     .header("content-disposition", "inline")
                     .header("x-content-type-options", "nosniff")
-                    .header("content-security-policy", "sandbox; default-src 'none'")
+                    // Per-MIME, not a hard-coded constant: a bare `sandbox` token stops
+                    // the browser's native PDF viewer painting at all (issue #917).
+                    .header("content-security-policy", cspFor(mime))
                     .header("cache-control", "private, max-age=60")
                     .send(bytes);
             }

package/packages/server/dist/ui-config.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Instance-level UI knobs (issue #914) — settings that shape how the SPA renders,
+ * as opposed to what the server will do. Instance-level only: there is deliberately
+ * no per-project override, because these describe the operator's browser/box
+ * tolerance rather than anything about a project's content.
+ *
+ * Kept as its own block module per the one-file-per-config-block convention (cf.
+ * `attachments-config.ts`, `recovery-config.ts`).
+ */
+/**
+ * Resolved UI config — all fields concrete. Held on
+ * {@link import("./config.js").PaddockConfig.ui} and served to the SPA as
+ * `uiDefault` on `GET /api/models`.
+ */
+export interface UiConfig {
+    /**
+     * How many trailing messages a chat's transcript renders on open.
+     *
+     * A long-running chat is ~1,500 turns, and mounting all of them is what makes
+     * switching into one slow (#914). The cap is applied at the `/messages` join,
+     * so it also bounds the server-side enrich/provenance/serialise work — not just
+     * the DOM.
+     *
+     * **`0` means unlimited** (render everything, the pre-#914 behaviour), so this
+     * is a NON-NEGATIVE integer knob — unlike the attachment counts, `1` is not the
+     * floor. Default 500. Env `PADDOCK_UI_TRANSCRIPT_RENDER_LIMIT`.
+     *
+     * This is a *render* cap, not a retention policy: nothing is deleted, and the
+     * full transcript is always one uncapped fetch away (#915).
+     */
+    transcriptRenderLimit: number;
+}
+/** The built-in UI defaults (beneath env + YAML): last 500 messages rendered. */
+export declare const DEFAULT_UI: UiConfig;
+/**
+ * Apply a transcript render cap to a message list: the trailing `limit`, or the
+ * whole list when `limit` is 0 (unlimited) or the list already fits.
+ *
+ * Split out as a pure function so the slice semantics are unit-testable without
+ * a transcript on disk, and so the route and any future caller cannot disagree
+ * about what "the last N" means.
+ */
+export declare function capMessages<T>(messages: T[], limit: number): T[];

package/packages/server/dist/ui-config.js

@@ -0,0 +1,28 @@
+/**
+ * Instance-level UI knobs (issue #914) — settings that shape how the SPA renders,
+ * as opposed to what the server will do. Instance-level only: there is deliberately
+ * no per-project override, because these describe the operator's browser/box
+ * tolerance rather than anything about a project's content.
+ *
+ * Kept as its own block module per the one-file-per-config-block convention (cf.
+ * `attachments-config.ts`, `recovery-config.ts`).
+ */
+/** The built-in UI defaults (beneath env + YAML): last 500 messages rendered. */
+export const DEFAULT_UI = Object.freeze({
+    transcriptRenderLimit: 500,
+});
+/**
+ * Apply a transcript render cap to a message list: the trailing `limit`, or the
+ * whole list when `limit` is 0 (unlimited) or the list already fits.
+ *
+ * Split out as a pure function so the slice semantics are unit-testable without
+ * a transcript on disk, and so the route and any future caller cannot disagree
+ * about what "the last N" means.
+ */
+export function capMessages(messages, limit) {
+    if (!Number.isInteger(limit) || limit <= 0)
+        return messages;
+    if (messages.length <= limit)
+        return messages;
+    return messages.slice(messages.length - limit);
+}

package/packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paddock/server",
-  "version": "0.72.1",
+  "version": "0.73.0",
   "private": true,
   "type": "module"
 }

package/packages/web/dist/assets/DiscoverPage-DSrVUGFF.js

@@ -0,0 +1,2 @@
+import{j as r}from"./index-f1oSUgoy.js";import{D as o}from"./DiscoverView-CKdc3D8Z.js";import"./Surfaces-DDZFCO3e.js";function s(){return r.jsx(o,{})}export{s as DiscoverPage};
+

package/packages/web/dist/assets/{DiscoverView-yPLCp_YE.js → DiscoverView-CKdc3D8Z.js}

@@ -1,2 +1,2 @@
-import{a as oe,u as ie,V as de,r as u,b as A,j as s,J as X,G as Y,a2 as Z,z as $,W as ce,H as le,P as he,a3 as ue,a4 as J,D,l as K,a5 as pe,h as xe,M as W}from"./index-C3MdluUb.js";import{E as R,C as me}from"./Surfaces-BidCkENw.js";function ge(e){const t={};for(const n of e)t[n.path]={checked:!0,expanded:!1,loading:!1,error:null};return t}function fe(e){if(!e.sessions||!e.selected)return e.checked?"on":"off";const t=e.sessions.sessions.length,n=e.selected.size;return t===0||n===0?"off":n===t?"on":"mixed"}function C(e,t){return e.sessions&&e.selected?e.selected.size:e.checked?t.sessionCount:0}function je(e,t){return t.reduce((n,r)=>n+C(e[r.path]??z(),r),0)}function be(e,t){return t.filter(n=>C(e[n.path]??z(),n)>0)}function we(e,t,n){const r=e[t];if(!r)return e;const a={...r,checked:n};return r.sessions&&(a.selected=n?new Set(r.sessions.sessions.map(c=>c.sessionId)):new Set),{...e,[t]:a}}function ye(e,t,n){const r=e[t];if(!r||!r.sessions)return e;const a=new Set(r.selected??[]);return a.delete(n)||a.add(n),{...e,[t]:{...r,selected:a,checked:a.size>0}}}function ve(e,t,n){const r=e[t];if(!r)return e;const a=r.checked?new Set(n.sessions.map(c=>c.sessionId)):new Set;return{...e,[t]:{...r,sessions:n,selected:a,loading:!1,error:null}}}function T(e,t,n){const r=e[t];return r?{...e,[t]:{...r,...n}}:e}function Ne(e,t){const n=e??z();return C(n,t)===0?null:n.sessions&&n.selected?{sessionIds:[...n.selected]}:{}}function z(){return{checked:!1,expanded:!1,loading:!1,error:null}}function ke(e){return e.error!==void 0?e.stage==="create"?"danger":"warn":e.adopted>0?"success":"warn"}async function Se(e,t,n){let r;try{r=await e.createProject({name:t.name,slug:t.suggestedSlug,path:t.path,managed:!1})}catch(a){return{stage:"create",adopted:0,skipped:[],error:q(a)}}try{const a=await e.adoptChats(r.slug,{sourceCwd:r.workingDir,...n.sessionIds?{sessionIds:n.sessionIds}:{}});return{project:r,adopted:a.adopted.length,skipped:a.skipped}}catch(a){return{stage:"import",project:r,adopted:0,skipped:[],error:q(a)}}}async function $e(e,t,n){const r=[];for(const a of t){n(a.candidate.path,"running");const c=await Se(e,a.candidate,a.plan);r.push(c),n(a.candidate.path,"done",c)}return r}const Ce={sidechain:"sub-agent transcript","already-adopted":"already adopted","destination-exists":"a chat with that id already exists here","attributed-to-run":"belongs to a Paddock run",unreadable:"transcript unreadable","placement-failed":"copy failed","record-failed":"could not be recorded"};function _(e){if(e.length===0)return"";const t=[...new Set(e.map(n=>Ce[n.reason]??n.reason))];return`${e.length} skipped (${t.join(", ")})`}function Ie(e,t){var l;if(e.stage==="create")return`Couldn't create the project: ${e.error}`;const n=((l=e.project)==null?void 0:l.slug)??t.suggestedSlug;if(e.stage==="import")return`Project “${n}” was created, but importing its chats failed: ${e.error}. It is there and empty — you can import them from the project itself.`;if(e.adopted===0){const m=_(e.skipped);return t.recordedPath!==void 0?`Project “${n}” was created but no chats came with it. Its transcripts record ${t.recordedPath}, a different spelling of ${t.path}, and an import matches on the exact path.`:m?`Project “${n}” was created but no chats came with it — ${m}.`:`Project “${n}” was created but no chats came with it.`}const r=e.adopted,a=_(e.skipped),c=`Adopted ${r} chat${r===1?"":"s"} into “${n}”`;return a?`${c} — ${a}.`:`${c}.`}function q(e){return e instanceof Error?e.message:String(e)}function He({firstRun:e=!1,embedded:t=!1,onLeave:n,onStartChat:r}){const a=oe(),{refresh:c}=ie(),l=de(),[m,d]=u.useState(!1),[j,I]=u.useState(!1),[h,x]=u.useState(null),[y,O]=u.useState(null),[G,P]=u.useState(!0),[f,v]=u.useState({}),[k,H]=u.useState(!1),[L,F]=u.useState({}),[E,B]=u.useState({}),[S,ee]=u.useState(!1);u.useEffect(()=>{let o=!0;return P(!0),O(null),A.discover({includeNonGit:m,includeOutsideHome:j}).then(i=>{o&&(x(i),v(ge(i.candidates)),P(!1))}).catch(i=>{o&&(O(i instanceof Error?i.message:"Discovery failed"),P(!1))}),()=>{o=!1}},[m,j]);const w=(h==null?void 0:h.candidates)??[],M=u.useMemo(()=>je(f,w),[f,w]),b=u.useMemo(()=>be(f,w),[f,w]),se=u.useCallback(o=>{v(p=>{const g=p[o.path];if(!g)return p;const N=T(p,o.path,{expanded:!g.expanded});return g.expanded||g.sessions||g.loading?N:T(N,o.path,{loading:!0,error:null})});const i=f[o.path];!i||i.expanded||i.sessions||i.loading||A.discoverSessions(o.path).then(p=>v(g=>ve(g,o.path,p))).catch(p=>v(g=>T(g,o.path,{loading:!1,error:p instanceof Error?p.message:"Could not read this directory's sessions"})))},[f]),te=u.useCallback(async()=>{if(k)return;H(!0),F(Object.fromEntries(b.map(i=>[i.path,"pending"]))),B({});const o=b.map(i=>({candidate:i,plan:Ne(f[i.path],i)??{}}));await $e(A,o,(i,p,g)=>{F(N=>({...N,[i]:p})),g&&B(N=>({...N,[i]:g}))}),H(!1),ee(!0),await c()},[b,f,k,c]),ne=u.useCallback(async()=>{await c(),n==null||n(),a("/")},[a,c,n]),ae=Object.values(E).reduce((o,i)=>o+i.adopted,0),re=Object.values(E).filter(o=>o.project).length,V=s.jsxs(s.Fragment,{children:[s.jsx("p",{className:"mb-5 text-sm text-fg-muted",children:e?"If you have used Claude Code in a terminal on this machine, Paddock can adopt that history: each directory becomes a project with its conversations already in it.":"Directories on this machine with existing Claude Code history. Adopting one links it as a project and brings its conversations in; your own history is never moved or deleted."}),S&&s.jsx(De,{imported:ae,projects:re,onGetStarted:ne}),y!==null&&s.jsx(X,{tone:"danger",icon:s.jsx(Y,{width:16,height:16}),children:y}),G&&s.jsx(Te,{}),!G&&y===null&&h!==null&&s.jsxs(s.Fragment,{children:[h.scanned===0?s.jsx(Ae,{claudeHome:h.claudeHome,onStartChat:r}):w.length===0?s.jsx(R,{variant:"panel",icon:s.jsx(Z,{width:22,height:22}),title:"Nothing to adopt",body:"Paddock found Claude Code history on this machine, but none of it is available to adopt right now. The tally below says what was skipped, and the two toggles relax the rules that are safe to relax."}):s.jsx("ul",{className:"space-y-2",children:w.map(o=>s.jsx(Pe,{candidate:o,row:f[o.path],status:L[o.path],outcome:E[o.path],locked:k||S,onToggleRow:i=>v(p=>we(p,o.path,i)),onToggleSession:i=>v(p=>ye(p,o.path,i)),onToggleExpanded:()=>se(o)},o.path))}),!S&&h.scanned>0&&s.jsx(Ee,{result:h,includeNonGit:m,includeOutsideHome:j,disabled:k,onIncludeNonGit:d,onIncludeOutsideHome:I}),w.length>0&&!S&&s.jsxs("div",{className:"mt-5 flex items-center justify-between gap-3 border-t border-edge pt-4",children:[s.jsxs("span",{className:"text-sm text-fg-muted",children:[M," conversation",M===1?"":"s"," from ",b.length," director",b.length===1?"y":"ies"]}),s.jsxs($,{variant:"primary",onClick:()=>void te(),disabled:b.length===0,loading:k,loadingLabel:"Adopting…",children:["Adopt ",b.length," project",b.length===1?"":"s"]})]})]})]});return t?V:s.jsxs("div",{className:"flex h-full min-h-0 flex-col",children:[s.jsxs("header",{className:"pt-safe flex items-center gap-2 border-b border-edge px-3 pb-2.5 sm:px-6 lg:py-4",children:[s.jsx("button",{type:"button",onClick:()=>l==null?void 0:l.openNav(),"aria-label":"Open menu",className:"btn-subtle -ml-1 shrink-0 px-2 py-1.5 lg:hidden",children:s.jsx(ce,{width:20,height:20})}),s.jsx(le,{width:18,height:18,className:"shrink-0 text-fg-subtle"}),s.jsx("h1",{className:"text-md font-semibold tracking-tight",children:"Discover"})]}),s.jsx("div",{className:"flex-1 overflow-y-auto overscroll-contain",children:s.jsx("div",{className:"mx-auto max-w-3xl px-6 py-6",children:V})})]})}function Pe({candidate:e,row:t,status:n,outcome:r,locked:a,onToggleRow:c,onToggleSession:l,onToggleExpanded:m}){const d=t??{checked:!1,expanded:!1,loading:!1,error:null},j=fe(d),I=C(d,e),h=r?ke(r):null;return s.jsx("li",{children:s.jsxs(me,{flush:!0,className:K("overflow-hidden",h==="success"&&"border-success-edge bg-success-soft",h==="warn"&&"border-warn-edge bg-warn-soft",h==="danger"&&"border-danger-edge bg-danger-soft",n==="running"&&"border-accent-edge"),"data-testid":`discover-row-${e.suggestedSlug}`,"data-tone":h??void 0,children:[s.jsxs("div",{className:"flex items-start gap-3 px-3 py-2.5",children:[s.jsx(J,{className:"mt-1",checked:j==="on",indeterminate:j==="mixed",disabled:a,"aria-label":`Adopt ${e.path}`,onChange:x=>c(x.target.checked)}),s.jsxs("div",{className:"min-w-0 flex-1",children:[s.jsx("code",{className:"block break-all text-sm text-fg",children:e.path}),s.jsxs("div",{className:"mt-1 flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-fg-muted",children:[s.jsxs("span",{className:"tabular",children:[e.sessionCount," conversation",e.sessionCount===1?"":"s"]}),e.filteredCount>0&&s.jsxs("span",{className:"tabular",title:"Empty, slash-command-only or sweeper transcripts, withheld as noise",children:["· ",e.filteredCount," filtered out"]}),e.lastSessionAt!==void 0&&s.jsxs("span",{className:"tabular",children:["· last ",U(e.lastSessionAt)]}),e.gitRemote!==void 0&&s.jsx(D,{tone:"lineage",size:"sm",children:e.gitRemote}),!e.hasGit&&s.jsx(D,{tone:"neutral",size:"sm",children:"no git"}),!e.insideHome&&s.jsx(D,{tone:"neutral",size:"sm",children:"outside home"})]}),e.recordedPath!==void 0&&s.jsx(X,{tone:"warn",className:"mt-2",icon:s.jsx(Y,{width:14,height:14}),children:s.jsxs("span",{className:"text-xs",children:["These transcripts record"," ",s.jsx("code",{className:"break-all",children:e.recordedPath})," — a different spelling of this path. The import matches on the exact path, so it may bring nothing in."]})}),r&&s.jsx("p",{className:K("mt-2 text-xs",h==="success"&&"text-success",h==="warn"&&"text-warn",h==="danger"&&"text-danger"),children:Ie(r,e)}),n==="running"&&!r&&s.jsx("p",{className:"mt-2 text-xs text-fg-muted",children:"Adopting…"})]}),s.jsxs("span",{className:"flex shrink-0 items-center gap-1",children:[s.jsx("span",{className:"tabular text-xs text-fg-subtle",children:I}),s.jsx($,{size:"icon-sm",variant:"subtle","aria-label":d.expanded?"Hide conversations":"Show conversations","aria-expanded":d.expanded,onClick:m,children:d.expanded?s.jsx(pe,{width:14,height:14}):s.jsx(xe,{width:14,height:14})})]})]}),d.expanded&&s.jsxs("div",{className:"border-t border-edge px-3 py-2",children:[d.loading&&s.jsx("p",{className:"py-2 text-xs text-fg-muted",children:"Reading transcripts…"}),d.error!==null&&s.jsx("p",{className:"py-2 text-xs text-danger",children:d.error}),d.sessions&&d.sessions.sessions.length===0&&s.jsx("p",{className:"py-2 text-xs text-fg-muted",children:"Nothing to adopt here any more — it may have been adopted since the scan."}),d.sessions&&d.sessions.sessions.length>0&&s.jsx("ul",{className:"space-y-1",children:d.sessions.sessions.map(x=>{var y;return s.jsx("li",{children:s.jsxs("label",{className:"flex cursor-pointer items-start gap-2 rounded-lg px-2 py-1.5 transition-colors hover:bg-surface-hover",children:[s.jsx(J,{checked:((y=d.selected)==null?void 0:y.has(x.sessionId))??!1,disabled:a,"aria-label":Q(x),onChange:()=>l(x.sessionId)}),s.jsxs("span",{className:"min-w-0 flex-1",children:[s.jsx("span",{className:"block truncate text-xs text-fg",children:Q(x)}),s.jsxs("span",{className:"tabular mt-0.5 block text-3xs text-fg-muted",children:[U(x.mtime)," · ",ze(x.sizeBytes)]})]})]})},x.sessionId)})}),d.sessions&&d.sessions.filtered.length>0&&s.jsxs("p",{className:"mt-2 px-2 text-3xs text-fg-subtle",children:[d.sessions.filtered.length," more withheld as noise (",[...new Set(d.sessions.filtered.map(x=>x.reason))].join(", "),")."]})]})]})})}function Ee({result:e,includeNonGit:t,includeOutsideHome:n,disabled:r,onIncludeNonGit:a,onIncludeOutsideHome:c}){const l=e.excluded["no-git"]??0,m=e.excluded["outside-home"]??0,d=l>0||t,j=m>0||n;return e.scanned===0?null:s.jsxs("div",{className:"mt-5 space-y-2 border-t border-edge pt-4",children:[s.jsx("p",{className:"text-xs text-fg-muted",children:Re(e)}),d&&s.jsxs("div",{className:"flex items-center gap-2 text-xs text-fg-muted",children:[s.jsx(W,{checked:t,disabled:r,onChange:a,label:"Also offer directories without a git repository"}),s.jsxs("span",{children:["Also offer directories without a git repository",l>0&&` (${l} hidden)`]})]}),j&&s.jsxs("div",{className:"flex items-center gap-2 text-xs text-fg-muted",children:[s.jsx(W,{checked:n,disabled:r,onChange:c,label:"Also offer directories outside your home directory"}),s.jsxs("span",{children:["Also offer directories outside ",s.jsx("code",{children:e.homeDir}),m>0&&` (${m} hidden)`]})]})]})}function Ae({claudeHome:e,onStartChat:t}){return s.jsx(R,{variant:"panel",icon:s.jsx(ue,{width:22,height:22}),title:"Nothing to adopt yet",body:s.jsxs(s.Fragment,{children:["No Claude Code history has been recorded under"," ",s.jsx("code",{className:"break-all",children:e}),". That is normal on a new install, and on a container whose Claude home is its own rather than yours — nothing is wrong. Start a chat here and Paddock writes its own history; or bind-mount an existing one there and re-open this page, or import it headlessly with ",s.jsx("code",{children:"npm run import-chats"}),"."]}),action:t&&s.jsx($,{variant:"primary",icon:s.jsx(he,{width:14,height:14}),onClick:t,children:"Start a chat"})})}function De({imported:e,projects:t,onGetStarted:n}){return s.jsx("div",{className:"mb-6",children:s.jsx(R,{variant:"panel",icon:s.jsx(Z,{width:22,height:22}),title:t===0?"Nothing was adopted":`${t} project${t===1?"":"s"}, ${e} conversation${e===1?"":"s"}`,body:t===0?"Every row failed. Each one says why below.":"They are in the sidebar now. Anything that did not land says why below.",action:s.jsx($,{variant:"primary",onClick:()=>void n(),children:"Get started"})})})}function Te(){return s.jsx("div",{className:"space-y-2","aria-label":"Scanning",role:"status",children:[0,1,2].map(e=>s.jsx("div",{className:"h-16 animate-pulse rounded-2xl bg-surface-active"},e))})}function Re(e){const t=[],n=[["temp-root",a=>`${a} in temp directories`],["no-git",a=>`${a} without a git repository`],["outside-home",a=>`${a} outside your home directory`],["already-managed",a=>`${a} already a project`],["no-sessions",a=>`${a} with nothing to adopt`],["no-recorded-cwd",a=>`${a} with no recorded directory`],["missing",a=>`${a} no longer on disk`],["home-root",a=>`${a} your home directory itself`],["system-path",a=>`${a} system directories`],["paddock-internal",a=>`${a} inside Paddock's own data`]];for(const[a,c]of n){const l=e.excluded[a];l!==void 0&&l>0&&t.push(c(l))}const r=`${e.scanned} transcript folder${e.scanned===1?"":"s"} scanned`;return t.length===0?`${r}.`:`${r}; skipped ${t.join(", ")}.`}function Q(e){var r,a;const t=(r=e.autoName)==null?void 0:r.trim();if(t!==void 0&&t!=="")return t;const n=(a=e.preview)==null?void 0:a.trim();return n!==void 0&&n!==""?n:e.sessionId}function U(e){const t=new Date(e);return Number.isNaN(t.getTime())?"unknown date":t.toLocaleDateString(void 0,{year:"numeric",month:"short",day:"numeric"})}function ze(e){return e<1024?`${e} B`:e<1024*1024?`${Math.round(e/1024)} kB`:`${(e/(1024*1024)).toFixed(1)} MB`}export{He as D};
+import{a as oe,u as ie,V as de,r as u,b as A,j as s,J as X,G as Y,a2 as Z,z as $,W as ce,H as le,P as he,a3 as ue,a4 as J,D,l as K,a5 as pe,h as xe,M as W}from"./index-f1oSUgoy.js";import{E as R,C as me}from"./Surfaces-DDZFCO3e.js";function ge(e){const t={};for(const n of e)t[n.path]={checked:!0,expanded:!1,loading:!1,error:null};return t}function fe(e){if(!e.sessions||!e.selected)return e.checked?"on":"off";const t=e.sessions.sessions.length,n=e.selected.size;return t===0||n===0?"off":n===t?"on":"mixed"}function C(e,t){return e.sessions&&e.selected?e.selected.size:e.checked?t.sessionCount:0}function je(e,t){return t.reduce((n,r)=>n+C(e[r.path]??z(),r),0)}function be(e,t){return t.filter(n=>C(e[n.path]??z(),n)>0)}function we(e,t,n){const r=e[t];if(!r)return e;const a={...r,checked:n};return r.sessions&&(a.selected=n?new Set(r.sessions.sessions.map(c=>c.sessionId)):new Set),{...e,[t]:a}}function ye(e,t,n){const r=e[t];if(!r||!r.sessions)return e;const a=new Set(r.selected??[]);return a.delete(n)||a.add(n),{...e,[t]:{...r,selected:a,checked:a.size>0}}}function ve(e,t,n){const r=e[t];if(!r)return e;const a=r.checked?new Set(n.sessions.map(c=>c.sessionId)):new Set;return{...e,[t]:{...r,sessions:n,selected:a,loading:!1,error:null}}}function T(e,t,n){const r=e[t];return r?{...e,[t]:{...r,...n}}:e}function Ne(e,t){const n=e??z();return C(n,t)===0?null:n.sessions&&n.selected?{sessionIds:[...n.selected]}:{}}function z(){return{checked:!1,expanded:!1,loading:!1,error:null}}function ke(e){return e.error!==void 0?e.stage==="create"?"danger":"warn":e.adopted>0?"success":"warn"}async function Se(e,t,n){let r;try{r=await e.createProject({name:t.name,slug:t.suggestedSlug,path:t.path,managed:!1})}catch(a){return{stage:"create",adopted:0,skipped:[],error:q(a)}}try{const a=await e.adoptChats(r.slug,{sourceCwd:r.workingDir,...n.sessionIds?{sessionIds:n.sessionIds}:{}});return{project:r,adopted:a.adopted.length,skipped:a.skipped}}catch(a){return{stage:"import",project:r,adopted:0,skipped:[],error:q(a)}}}async function $e(e,t,n){const r=[];for(const a of t){n(a.candidate.path,"running");const c=await Se(e,a.candidate,a.plan);r.push(c),n(a.candidate.path,"done",c)}return r}const Ce={sidechain:"sub-agent transcript","already-adopted":"already adopted","destination-exists":"a chat with that id already exists here","attributed-to-run":"belongs to a Paddock run",unreadable:"transcript unreadable","placement-failed":"copy failed","record-failed":"could not be recorded"};function _(e){if(e.length===0)return"";const t=[...new Set(e.map(n=>Ce[n.reason]??n.reason))];return`${e.length} skipped (${t.join(", ")})`}function Ie(e,t){var l;if(e.stage==="create")return`Couldn't create the project: ${e.error}`;const n=((l=e.project)==null?void 0:l.slug)??t.suggestedSlug;if(e.stage==="import")return`Project “${n}” was created, but importing its chats failed: ${e.error}. It is there and empty — you can import them from the project itself.`;if(e.adopted===0){const m=_(e.skipped);return t.recordedPath!==void 0?`Project “${n}” was created but no chats came with it. Its transcripts record ${t.recordedPath}, a different spelling of ${t.path}, and an import matches on the exact path.`:m?`Project “${n}” was created but no chats came with it — ${m}.`:`Project “${n}” was created but no chats came with it.`}const r=e.adopted,a=_(e.skipped),c=`Adopted ${r} chat${r===1?"":"s"} into “${n}”`;return a?`${c} — ${a}.`:`${c}.`}function q(e){return e instanceof Error?e.message:String(e)}function He({firstRun:e=!1,embedded:t=!1,onLeave:n,onStartChat:r}){const a=oe(),{refresh:c}=ie(),l=de(),[m,d]=u.useState(!1),[j,I]=u.useState(!1),[h,x]=u.useState(null),[y,O]=u.useState(null),[G,P]=u.useState(!0),[f,v]=u.useState({}),[k,H]=u.useState(!1),[L,F]=u.useState({}),[E,B]=u.useState({}),[S,ee]=u.useState(!1);u.useEffect(()=>{let o=!0;return P(!0),O(null),A.discover({includeNonGit:m,includeOutsideHome:j}).then(i=>{o&&(x(i),v(ge(i.candidates)),P(!1))}).catch(i=>{o&&(O(i instanceof Error?i.message:"Discovery failed"),P(!1))}),()=>{o=!1}},[m,j]);const w=(h==null?void 0:h.candidates)??[],M=u.useMemo(()=>je(f,w),[f,w]),b=u.useMemo(()=>be(f,w),[f,w]),se=u.useCallback(o=>{v(p=>{const g=p[o.path];if(!g)return p;const N=T(p,o.path,{expanded:!g.expanded});return g.expanded||g.sessions||g.loading?N:T(N,o.path,{loading:!0,error:null})});const i=f[o.path];!i||i.expanded||i.sessions||i.loading||A.discoverSessions(o.path).then(p=>v(g=>ve(g,o.path,p))).catch(p=>v(g=>T(g,o.path,{loading:!1,error:p instanceof Error?p.message:"Could not read this directory's sessions"})))},[f]),te=u.useCallback(async()=>{if(k)return;H(!0),F(Object.fromEntries(b.map(i=>[i.path,"pending"]))),B({});const o=b.map(i=>({candidate:i,plan:Ne(f[i.path],i)??{}}));await $e(A,o,(i,p,g)=>{F(N=>({...N,[i]:p})),g&&B(N=>({...N,[i]:g}))}),H(!1),ee(!0),await c()},[b,f,k,c]),ne=u.useCallback(async()=>{await c(),n==null||n(),a("/")},[a,c,n]),ae=Object.values(E).reduce((o,i)=>o+i.adopted,0),re=Object.values(E).filter(o=>o.project).length,V=s.jsxs(s.Fragment,{children:[s.jsx("p",{className:"mb-5 text-sm text-fg-muted",children:e?"If you have used Claude Code in a terminal on this machine, Paddock can adopt that history: each directory becomes a project with its conversations already in it.":"Directories on this machine with existing Claude Code history. Adopting one links it as a project and brings its conversations in; your own history is never moved or deleted."}),S&&s.jsx(De,{imported:ae,projects:re,onGetStarted:ne}),y!==null&&s.jsx(X,{tone:"danger",icon:s.jsx(Y,{width:16,height:16}),children:y}),G&&s.jsx(Te,{}),!G&&y===null&&h!==null&&s.jsxs(s.Fragment,{children:[h.scanned===0?s.jsx(Ae,{claudeHome:h.claudeHome,onStartChat:r}):w.length===0?s.jsx(R,{variant:"panel",icon:s.jsx(Z,{width:22,height:22}),title:"Nothing to adopt",body:"Paddock found Claude Code history on this machine, but none of it is available to adopt right now. The tally below says what was skipped, and the two toggles relax the rules that are safe to relax."}):s.jsx("ul",{className:"space-y-2",children:w.map(o=>s.jsx(Pe,{candidate:o,row:f[o.path],status:L[o.path],outcome:E[o.path],locked:k||S,onToggleRow:i=>v(p=>we(p,o.path,i)),onToggleSession:i=>v(p=>ye(p,o.path,i)),onToggleExpanded:()=>se(o)},o.path))}),!S&&h.scanned>0&&s.jsx(Ee,{result:h,includeNonGit:m,includeOutsideHome:j,disabled:k,onIncludeNonGit:d,onIncludeOutsideHome:I}),w.length>0&&!S&&s.jsxs("div",{className:"mt-5 flex items-center justify-between gap-3 border-t border-edge pt-4",children:[s.jsxs("span",{className:"text-sm text-fg-muted",children:[M," conversation",M===1?"":"s"," from ",b.length," director",b.length===1?"y":"ies"]}),s.jsxs($,{variant:"primary",onClick:()=>void te(),disabled:b.length===0,loading:k,loadingLabel:"Adopting…",children:["Adopt ",b.length," project",b.length===1?"":"s"]})]})]})]});return t?V:s.jsxs("div",{className:"flex h-full min-h-0 flex-col",children:[s.jsxs("header",{className:"pt-safe flex items-center gap-2 border-b border-edge px-3 pb-2.5 sm:px-6 lg:py-4",children:[s.jsx("button",{type:"button",onClick:()=>l==null?void 0:l.openNav(),"aria-label":"Open menu",className:"btn-subtle -ml-1 shrink-0 px-2 py-1.5 lg:hidden",children:s.jsx(ce,{width:20,height:20})}),s.jsx(le,{width:18,height:18,className:"shrink-0 text-fg-subtle"}),s.jsx("h1",{className:"text-md font-semibold tracking-tight",children:"Discover"})]}),s.jsx("div",{className:"flex-1 overflow-y-auto overscroll-contain",children:s.jsx("div",{className:"mx-auto max-w-3xl px-6 py-6",children:V})})]})}function Pe({candidate:e,row:t,status:n,outcome:r,locked:a,onToggleRow:c,onToggleSession:l,onToggleExpanded:m}){const d=t??{checked:!1,expanded:!1,loading:!1,error:null},j=fe(d),I=C(d,e),h=r?ke(r):null;return s.jsx("li",{children:s.jsxs(me,{flush:!0,className:K("overflow-hidden",h==="success"&&"border-success-edge bg-success-soft",h==="warn"&&"border-warn-edge bg-warn-soft",h==="danger"&&"border-danger-edge bg-danger-soft",n==="running"&&"border-accent-edge"),"data-testid":`discover-row-${e.suggestedSlug}`,"data-tone":h??void 0,children:[s.jsxs("div",{className:"flex items-start gap-3 px-3 py-2.5",children:[s.jsx(J,{className:"mt-1",checked:j==="on",indeterminate:j==="mixed",disabled:a,"aria-label":`Adopt ${e.path}`,onChange:x=>c(x.target.checked)}),s.jsxs("div",{className:"min-w-0 flex-1",children:[s.jsx("code",{className:"block break-all text-sm text-fg",children:e.path}),s.jsxs("div",{className:"mt-1 flex flex-wrap items-center gap-x-2 gap-y-1 text-xs text-fg-muted",children:[s.jsxs("span",{className:"tabular",children:[e.sessionCount," conversation",e.sessionCount===1?"":"s"]}),e.filteredCount>0&&s.jsxs("span",{className:"tabular",title:"Empty, slash-command-only or sweeper transcripts, withheld as noise",children:["· ",e.filteredCount," filtered out"]}),e.lastSessionAt!==void 0&&s.jsxs("span",{className:"tabular",children:["· last ",U(e.lastSessionAt)]}),e.gitRemote!==void 0&&s.jsx(D,{tone:"lineage",size:"sm",children:e.gitRemote}),!e.hasGit&&s.jsx(D,{tone:"neutral",size:"sm",children:"no git"}),!e.insideHome&&s.jsx(D,{tone:"neutral",size:"sm",children:"outside home"})]}),e.recordedPath!==void 0&&s.jsx(X,{tone:"warn",className:"mt-2",icon:s.jsx(Y,{width:14,height:14}),children:s.jsxs("span",{className:"text-xs",children:["These transcripts record"," ",s.jsx("code",{className:"break-all",children:e.recordedPath})," — a different spelling of this path. The import matches on the exact path, so it may bring nothing in."]})}),r&&s.jsx("p",{className:K("mt-2 text-xs",h==="success"&&"text-success",h==="warn"&&"text-warn",h==="danger"&&"text-danger"),children:Ie(r,e)}),n==="running"&&!r&&s.jsx("p",{className:"mt-2 text-xs text-fg-muted",children:"Adopting…"})]}),s.jsxs("span",{className:"flex shrink-0 items-center gap-1",children:[s.jsx("span",{className:"tabular text-xs text-fg-subtle",children:I}),s.jsx($,{size:"icon-sm",variant:"subtle","aria-label":d.expanded?"Hide conversations":"Show conversations","aria-expanded":d.expanded,onClick:m,children:d.expanded?s.jsx(pe,{width:14,height:14}):s.jsx(xe,{width:14,height:14})})]})]}),d.expanded&&s.jsxs("div",{className:"border-t border-edge px-3 py-2",children:[d.loading&&s.jsx("p",{className:"py-2 text-xs text-fg-muted",children:"Reading transcripts…"}),d.error!==null&&s.jsx("p",{className:"py-2 text-xs text-danger",children:d.error}),d.sessions&&d.sessions.sessions.length===0&&s.jsx("p",{className:"py-2 text-xs text-fg-muted",children:"Nothing to adopt here any more — it may have been adopted since the scan."}),d.sessions&&d.sessions.sessions.length>0&&s.jsx("ul",{className:"space-y-1",children:d.sessions.sessions.map(x=>{var y;return s.jsx("li",{children:s.jsxs("label",{className:"flex cursor-pointer items-start gap-2 rounded-lg px-2 py-1.5 transition-colors hover:bg-surface-hover",children:[s.jsx(J,{checked:((y=d.selected)==null?void 0:y.has(x.sessionId))??!1,disabled:a,"aria-label":Q(x),onChange:()=>l(x.sessionId)}),s.jsxs("span",{className:"min-w-0 flex-1",children:[s.jsx("span",{className:"block truncate text-xs text-fg",children:Q(x)}),s.jsxs("span",{className:"tabular mt-0.5 block text-3xs text-fg-muted",children:[U(x.mtime)," · ",ze(x.sizeBytes)]})]})]})},x.sessionId)})}),d.sessions&&d.sessions.filtered.length>0&&s.jsxs("p",{className:"mt-2 px-2 text-3xs text-fg-subtle",children:[d.sessions.filtered.length," more withheld as noise (",[...new Set(d.sessions.filtered.map(x=>x.reason))].join(", "),")."]})]})]})})}function Ee({result:e,includeNonGit:t,includeOutsideHome:n,disabled:r,onIncludeNonGit:a,onIncludeOutsideHome:c}){const l=e.excluded["no-git"]??0,m=e.excluded["outside-home"]??0,d=l>0||t,j=m>0||n;return e.scanned===0?null:s.jsxs("div",{className:"mt-5 space-y-2 border-t border-edge pt-4",children:[s.jsx("p",{className:"text-xs text-fg-muted",children:Re(e)}),d&&s.jsxs("div",{className:"flex items-center gap-2 text-xs text-fg-muted",children:[s.jsx(W,{checked:t,disabled:r,onChange:a,label:"Also offer directories without a git repository"}),s.jsxs("span",{children:["Also offer directories without a git repository",l>0&&` (${l} hidden)`]})]}),j&&s.jsxs("div",{className:"flex items-center gap-2 text-xs text-fg-muted",children:[s.jsx(W,{checked:n,disabled:r,onChange:c,label:"Also offer directories outside your home directory"}),s.jsxs("span",{children:["Also offer directories outside ",s.jsx("code",{children:e.homeDir}),m>0&&` (${m} hidden)`]})]})]})}function Ae({claudeHome:e,onStartChat:t}){return s.jsx(R,{variant:"panel",icon:s.jsx(ue,{width:22,height:22}),title:"Nothing to adopt yet",body:s.jsxs(s.Fragment,{children:["No Claude Code history has been recorded under"," ",s.jsx("code",{className:"break-all",children:e}),". That is normal on a new install, and on a container whose Claude home is its own rather than yours — nothing is wrong. Start a chat here and Paddock writes its own history; or bind-mount an existing one there and re-open this page, or import it headlessly with ",s.jsx("code",{children:"npm run import-chats"}),"."]}),action:t&&s.jsx($,{variant:"primary",icon:s.jsx(he,{width:14,height:14}),onClick:t,children:"Start a chat"})})}function De({imported:e,projects:t,onGetStarted:n}){return s.jsx("div",{className:"mb-6",children:s.jsx(R,{variant:"panel",icon:s.jsx(Z,{width:22,height:22}),title:t===0?"Nothing was adopted":`${t} project${t===1?"":"s"}, ${e} conversation${e===1?"":"s"}`,body:t===0?"Every row failed. Each one says why below.":"They are in the sidebar now. Anything that did not land says why below.",action:s.jsx($,{variant:"primary",onClick:()=>void n(),children:"Get started"})})})}function Te(){return s.jsx("div",{className:"space-y-2","aria-label":"Scanning",role:"status",children:[0,1,2].map(e=>s.jsx("div",{className:"h-16 animate-pulse rounded-2xl bg-surface-active"},e))})}function Re(e){const t=[],n=[["temp-root",a=>`${a} in temp directories`],["no-git",a=>`${a} without a git repository`],["outside-home",a=>`${a} outside your home directory`],["already-managed",a=>`${a} already a project`],["no-sessions",a=>`${a} with nothing to adopt`],["no-recorded-cwd",a=>`${a} with no recorded directory`],["missing",a=>`${a} no longer on disk`],["home-root",a=>`${a} your home directory itself`],["system-path",a=>`${a} system directories`],["paddock-internal",a=>`${a} inside Paddock's own data`]];for(const[a,c]of n){const l=e.excluded[a];l!==void 0&&l>0&&t.push(c(l))}const r=`${e.scanned} transcript folder${e.scanned===1?"":"s"} scanned`;return t.length===0?`${r}.`:`${r}; skipped ${t.join(", ")}.`}function Q(e){var r,a;const t=(r=e.autoName)==null?void 0:r.trim();if(t!==void 0&&t!=="")return t;const n=(a=e.preview)==null?void 0:a.trim();return n!==void 0&&n!==""?n:e.sessionId}function U(e){const t=new Date(e);return Number.isNaN(t.getTime())?"unknown date":t.toLocaleDateString(void 0,{year:"numeric",month:"short",day:"numeric"})}function ze(e){return e<1024?`${e} B`:e<1024*1024?`${Math.round(e/1024)} kB`:`${(e/(1024*1024)).toFixed(1)} MB`}export{He as D};