@edspencer/paddock 0.72.1 → 0.74.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edspencer/paddock",
-  "version": "0.72.1",
+  "version": "0.74.0",
   "description": "Project-first launchpad for Claude Code: server-hosted, persistent, resumable sessions organized by project.",
   "keywords": [
     "claude",

package/packages/server/dist/config.d.ts

@@ -10,6 +10,7 @@ import { type RecoveryConfig } from "./recovery-config.js";
 import { type CurationConfig } from "./curation-config.js";
 import { type ManagementApiConfig, type ManagementApiConfigFile } from "./management-config.js";
 import { type AttachmentsConfig } from "./attachments-config.js";
+import { type UiConfig } from "./ui-config.js";
 /**
  * User-authentication strategy.
  *
@@ -433,6 +434,13 @@ export interface PaddockConfig {
      * allow-all by default.
      */
     attachments: AttachmentsConfig;
+    /**
+     * Instance-level UI knobs (issue #914) — currently just how many trailing
+     * messages a chat transcript renders on open. Instance-only by design: there is
+     * no per-project override, because this describes the operator's browser
+     * tolerance, not anything about a project.
+     */
+    ui: UiConfig;
     /**
      * Per-file token budgets the post-turn sweeper (curation) must keep its three
      * curated files under (issue #379). These bound the context every keeper chat
@@ -614,6 +622,13 @@ export interface PaddockConfigFile {
         maxFilesPerMessage?: number | string;
         allowedTypes?: string[] | string;
     };
+    /**
+     * Instance-level UI knobs (issue #914). Every field optional; a matching
+     * `PADDOCK_UI_*` env var still overrides it (file < env).
+     */
+    ui?: {
+        transcriptRenderLimit?: number | string;
+    };
     /**
      * Per-file curation token budgets (issue #379). Every field optional; a
      * matching `PADDOCK_CURATION_*` env var still overrides it (file < env).

package/packages/server/dist/config.js

@@ -37,6 +37,7 @@ import { DEFAULT_RECOVERY } from "./recovery-config.js";
 import { DEFAULT_CURATION } from "./curation-config.js";
 import { resolveManagementApiConfig, } from "./management-config.js";
 import { DEFAULT_ATTACHMENTS, sanitizeAllowedTypes, } from "./attachments-config.js";
+import { DEFAULT_UI } from "./ui-config.js";
 function abs(p) {
     return path.isAbsolute(p) ? p : path.resolve(process.cwd(), p);
 }
@@ -348,6 +349,7 @@ export function loadPaddockConfig(opts = {}) {
         hooksMcpEnabled: loadHooksMcpEnabled(file.hooksMcpEnabled, p.hooksMcpEnabled),
         recovery: loadRecoveryConfig(file.recovery),
         attachments: loadAttachmentsConfig(file.attachments),
+        ui: loadUiConfig(file.ui),
         curation: loadCurationConfig(file.curation),
         logLevel: envOr("LOG_LEVEL", fileOr(file.logLevel, "info")),
         browserMcp: loadBrowserMcp(file.browserMcp, p.browserMcp),
@@ -514,6 +516,23 @@ function loadAttachmentsConfig(file) {
         allowedTypes: loadAllowedTypes(f.allowedTypes, DEFAULT_ATTACHMENTS.allowedTypes),
     };
 }
+/**
+ * Resolve the instance-level UI config (issue #914).
+ *
+ * `transcriptRenderLimit` is a NON-NEGATIVE knob — `0` is the meaningful value
+ * "unlimited", so this cannot reuse {@link loadAttachmentsInt}, whose floor is 1.
+ * A missing/blank/non-integer/negative value falls back to the default rather
+ * than failing startup, like every other loader here.
+ */
+function loadUiConfig(file) {
+    const raw = envOpt("PADDOCK_UI_TRANSCRIPT_RENDER_LIMIT") ?? fileOpt(file?.transcriptRenderLimit);
+    if (raw === undefined)
+        return { ...DEFAULT_UI };
+    const n = Number(raw);
+    return {
+        transcriptRenderLimit: Number.isInteger(n) && n >= 0 ? n : DEFAULT_UI.transcriptRenderLimit,
+    };
+}
 /**
  * Resolve the per-deployment schedule-mutation gate (issue #265 / DD-7). Defaults
  * OFF so a plain instance can't have its schedules mutated programmatically; an

package/packages/server/dist/instance-config.js

@@ -35,6 +35,7 @@ import { DRIVE_MODES, DEFAULT_DRIVE_MODE, MODELS, isKnownModel } from "./models.
 import { DEFAULT_MAX_SPAWN_DEPTH, isValidMaxSpawnDepth } from "./spawn-capability.js";
 import { DEFAULT_RECOVERY } from "./recovery-config.js";
 import { DEFAULT_ATTACHMENTS, sanitizeAllowedTypes } from "./attachments-config.js";
+import { DEFAULT_UI } from "./ui-config.js";
 import { DEFAULT_CURATION } from "./curation-config.js";
 import { DEFAULT_ENVIRONMENT_PROMPT } from "./environment-prompt.js";
 import { CONFIG_SCHEMA_VERSION, SCHEMA_VERSION_KEY } from "./schema-version.js";
@@ -51,6 +52,7 @@ export const GROUPS = [
     { id: "capabilities", label: "Capabilities", description: "What keeper agents are allowed to do. Most default off." },
     { id: "recovery", label: "Recovery" },
     { id: "attachments", label: "Attachments" },
+    { id: "ui", label: "Interface", description: "How the web UI renders. These affect the browser only — nothing is deleted or changed on disk." },
     { id: "branding", label: "Branding" },
     { id: "transcription", label: "Transcription" },
     { id: "git", label: "Git identity" },
@@ -245,7 +247,7 @@ export const FIELDS = [
     { key: "sweepMinIntervalMs", group: "sweeper", label: "Min sweep interval (ms)", help: "Minimum ms between post-turn sweeps for one project. Blank = default (5 min).", type: "number", envVars: ["PADDOCK_SWEEP_MIN_INTERVAL_MS"], default: null, editable: true, coerce: optNonNegNumber },
     // Capabilities.
     { key: "driveMode", group: "capabilities", label: "Keeper drive mode", help: "session = persistent (streaming + cross-turn autonomy); batch = legacy one-shot.", type: "enum", enumValues: DRIVE_MODES, envVars: ["PADDOCK_DRIVE_MODE"], default: DEFAULT_DRIVE_MODE, editable: true, coerce: oneOf(DRIVE_MODES) },
-    { key: "models", group: "capabilities", label: "Offered models", help: "Which built-in catalog models the picker offers, by id (e.g. claude-opus-5, claude-sonnet-5). Blank = offer all catalog models.", type: "string-list", envVars: ["PADDOCK_MODELS"], default: MODELS.map((m) => m.id), editable: true, coerce: modelList },
+    { key: "models", group: "capabilities", label: "Offered models", help: "Which built-in catalog models the picker offers, by id (e.g. claude-opus-5-5, claude-sonnet-5). Blank = offer all catalog models.", type: "string-list", envVars: ["PADDOCK_MODELS"], default: MODELS.map((m) => m.id), editable: true, coerce: modelList },
     { key: "nativeSystemPrompt", group: "capabilities", label: "Native system prompt", help: "Use Claude Code's native prompt + CLAUDE.md hierarchy (recommended).", type: "boolean", envVars: ["PADDOCK_NATIVE_PROMPT"], default: true, editable: true, coerce: asBool },
     // Issue #635. `envShadowWhenDefined` because loadEnvironmentPrompt keys on
     // definedness, not emptiness — a defined-but-empty PADDOCK_ENVIRONMENT_PROMPT
@@ -270,6 +272,8 @@ export const FIELDS = [
     { key: "attachments.maxFileSizeMb", group: "attachments", label: "Max file size (MB)", type: "number", envVars: ["PADDOCK_ATTACHMENTS_MAX_FILE_SIZE_MB"], default: DEFAULT_ATTACHMENTS.maxFileSizeMb, editable: true, coerce: posInt },
     { key: "attachments.maxFilesPerMessage", group: "attachments", label: "Max files / message", type: "number", envVars: ["PADDOCK_ATTACHMENTS_MAX_FILES_PER_MESSAGE"], default: DEFAULT_ATTACHMENTS.maxFilesPerMessage, editable: true, coerce: posInt },
     { key: "attachments.allowedTypes", group: "attachments", label: "Allowed types", help: "MIME types / extensions (e.g. image/*, .pdf). * = allow all.", type: "string-list", envVars: ["PADDOCK_ATTACHMENTS_ALLOWED_TYPES"], default: [...DEFAULT_ATTACHMENTS.allowedTypes], editable: true, coerce: stringList },
+    // Interface (issue #914). `nonNegInt`, not `posInt`: 0 means "render everything".
+    { key: "ui.transcriptRenderLimit", group: "ui", label: "Transcript render limit", help: "How many recent messages a chat renders on open. 0 = no limit. Older messages stay on disk and are not deleted.", type: "number", envVars: ["PADDOCK_UI_TRANSCRIPT_RENDER_LIMIT"], default: DEFAULT_UI.transcriptRenderLimit, editable: true, coerce: nonNegInt },
     // Branding (issue #34).
     { key: "brand.name", group: "branding", label: "Name", type: "string", envVars: ["PADDOCK_BRAND_NAME"], default: "Paddock", editable: true, coerce: nonEmptyString },
     { key: "brand.logo", group: "branding", label: "Logo", help: "An emoji/glyph, or a URL/path to an image.", type: "string", envVars: ["PADDOCK_BRAND_LOGO"], default: "🐎", editable: true, coerce: nonEmptyString },

package/packages/server/dist/models.d.ts

@@ -9,10 +9,11 @@
  * constants — so changing the available models or a context limit is a one-file
  * edit here.
  *
- * Context limits (verified against the Models API): Opus 5, Fable 5, Opus 4.8
- * and Sonnet 5 all have a 1,000,000-token context window; Haiku 4.5 is 200,000.
- * On the Max plan the keeper agents run Opus 5 at its full 1M window, so
- * the context meter must use 1M for it — otherwise a long chat reads >100%.
+ * Context limits (verified against the Models API): Opus 5.5, Opus 5, Fable 5.1,
+ * Fable 5, Opus 4.8 and Sonnet 5 all have a 1,000,000-token context window;
+ * Haiku 4.5 is 200,000.
+ * On the Max plan the keeper agents run Opus at its full 1M window, so the
+ * context meter must use 1M for it — otherwise a long chat reads >100%.
  */
 /**
  * Public first-party API list price per 1M tokens, used only to put a
@@ -28,6 +29,16 @@ export interface ModelPricing {
     inputPer1M: number;
     /** USD per 1M output tokens. */
     outputPer1M: number;
+    /**
+     * Cache-read price as a multiple of {@link inputPer1M}, when the model departs
+     * from the standard 0.1× ({@link CACHE_READ_MULTIPLIER}). Two models do:
+     * Fable 5.1 (and Mythos 5.1) read cached tokens at **0.025×** ($0.25/MTok
+     * against a $10 base), and Opus 5.5 at **0.05×** ($0.20/MTok against a $4
+     * base). Every other model is the standard tenth. Cache reads dominate a long
+     * chat's token counts, so getting this wrong overstates a Fable 5.1 chat's
+     * cost ~4× and an Opus 5.5 chat's ~2×.
+     */
+    cacheReadMultiplier?: number;
 }
 /** A single selectable model: its id, a human label, and its context window. */
 export interface ModelInfo {
@@ -46,8 +57,17 @@ export interface ModelInfo {
  * renders.
  */
 export declare const MODELS: ModelInfo[];
-/** The model a project runs on unless the project overrides it. */
-export declare const DEFAULT_MODEL = "claude-opus-5";
+/**
+ * The model a project runs on unless the project overrides it. Moved from
+ * Opus 5 to Opus 5.5 when 5.5 shipped: it is both newer and cheaper ($4/$20 vs
+ * $5/$25, and half-price cache reads), so unpinned projects get a better model
+ * for less. A project that pins `model` in its `project.yaml` is untouched.
+ *
+ * Keep this equal to `MODELS[0].id` — the picker renders catalog order, so the
+ * default must be the first entry or the UI implies a different default than
+ * the server applies. `models.test.ts` asserts the two agree.
+ */
+export declare const DEFAULT_MODEL = "claude-opus-5-5";
 /**
  * Resolve the models OFFERED (the picker/allow-list) from an optional list of
  * allowed ids (issue #457 Step 2). {@link MODELS} stays the authoritative CATALOG

package/packages/server/dist/models.js

@@ -9,10 +9,11 @@
  * constants — so changing the available models or a context limit is a one-file
  * edit here.
  *
- * Context limits (verified against the Models API): Opus 5, Fable 5, Opus 4.8
- * and Sonnet 5 all have a 1,000,000-token context window; Haiku 4.5 is 200,000.
- * On the Max plan the keeper agents run Opus 5 at its full 1M window, so
- * the context meter must use 1M for it — otherwise a long chat reads >100%.
+ * Context limits (verified against the Models API): Opus 5.5, Opus 5, Fable 5.1,
+ * Fable 5, Opus 4.8 and Sonnet 5 all have a 1,000,000-token context window;
+ * Haiku 4.5 is 200,000.
+ * On the Max plan the keeper agents run Opus at its full 1M window, so the
+ * context meter must use 1M for it — otherwise a long chat reads >100%.
  */
 /**
  * The selectable models, in picker order. The first entry is the keeper default
@@ -20,6 +21,12 @@
  * renders.
  */
 export const MODELS = [
+    {
+        id: "claude-opus-5-5",
+        label: "Opus 5.5",
+        contextLimit: 1_000_000,
+        pricing: { inputPer1M: 4, outputPer1M: 20, cacheReadMultiplier: 0.05 },
+    },
     {
         id: "claude-opus-5",
         label: "Opus 5",
@@ -32,6 +39,12 @@ export const MODELS = [
         contextLimit: 1_000_000,
         pricing: { inputPer1M: 5, outputPer1M: 25 },
     },
+    {
+        id: "claude-fable-5-1",
+        label: "Fable 5.1",
+        contextLimit: 1_000_000,
+        pricing: { inputPer1M: 10, outputPer1M: 50, cacheReadMultiplier: 0.025 },
+    },
     {
         id: "claude-fable-5",
         label: "Fable 5",
@@ -42,7 +55,11 @@ export const MODELS = [
         id: "claude-sonnet-5",
         label: "Sonnet 5",
         contextLimit: 1_000_000,
-        pricing: { inputPer1M: 3, outputPer1M: 15 },
+        // $2/$10, not $3/$15: the $2/$10 launch price was announced as introductory
+        // through 2026-08-31, but the scheduled 2026-09-01 rise to $3/$15 was
+        // cancelled and $2/$10 is now standard. We shipped the increase that never
+        // happened, overstating every Sonnet 5 cost estimate by 50%.
+        pricing: { inputPer1M: 2, outputPer1M: 10 },
     },
     {
         id: "claude-haiku-4-5-20251001",
@@ -51,8 +68,17 @@ export const MODELS = [
         pricing: { inputPer1M: 1, outputPer1M: 5 },
     },
 ];
-/** The model a project runs on unless the project overrides it. */
-export const DEFAULT_MODEL = "claude-opus-5";
+/**
+ * The model a project runs on unless the project overrides it. Moved from
+ * Opus 5 to Opus 5.5 when 5.5 shipped: it is both newer and cheaper ($4/$20 vs
+ * $5/$25, and half-price cache reads), so unpinned projects get a better model
+ * for less. A project that pins `model` in its `project.yaml` is untouched.
+ *
+ * Keep this equal to `MODELS[0].id` — the picker renders catalog order, so the
+ * default must be the first entry or the UI implies a different default than
+ * the server applies. `models.test.ts` asserts the two agree.
+ */
+export const DEFAULT_MODEL = "claude-opus-5-5";
 /**
  * Resolve the models OFFERED (the picker/allow-list) from an optional list of
  * allowed ids (issue #457 Step 2). {@link MODELS} stays the authoritative CATALOG
@@ -142,7 +168,12 @@ export function isValidMaxTurns(n) {
 }
 /** The cheap model the post-turn sweeper (curator) always uses. */
 export const SWEEPER_DEFAULT_MODEL = "claude-haiku-4-5-20251001";
-/** Default context limit when a model id is unknown (every current model is 200k). */
+/**
+ * Default context limit when a model id is unknown. 200k is the conservative
+ * floor, not the common case — every catalog model except Haiku 4.5 is 1M. An
+ * unknown id reading 200k makes the context meter over-report rather than
+ * silently divide by undefined.
+ */
 const DEFAULT_CONTEXT_LIMIT = 200000;
 /** Whether `id` is one of the known selectable models. */
 export function isKnownModel(id) {
@@ -159,7 +190,10 @@ export function getContextLimit(id) {
 export function getModelInfo(id) {
     return MODELS.find((m) => m.id === id);
 }
-/** Cache-write (5-minute ephemeral) is 1.25× the input rate; cache-read is 0.1×. */
+/**
+ * Cache-write (5-minute ephemeral) is 1.25× the input rate; cache-read is 0.1×
+ * — except on models that override it via {@link ModelPricing.cacheReadMultiplier}.
+ */
 const CACHE_WRITE_MULTIPLIER = 1.25;
 const CACHE_READ_MULTIPLIER = 0.1;
 /**
@@ -176,9 +210,10 @@ export function estimateCostUsd(modelId, t) {
     if (!pricing)
         return null;
     const { inputPer1M, outputPer1M } = pricing;
+    const cacheRead = pricing.cacheReadMultiplier ?? CACHE_READ_MULTIPLIER;
     const usd = (t.inputTokens * inputPer1M +
         t.cacheCreationTokens * inputPer1M * CACHE_WRITE_MULTIPLIER +
-        t.cacheReadTokens * inputPer1M * CACHE_READ_MULTIPLIER +
+        t.cacheReadTokens * inputPer1M * cacheRead +
         t.outputTokens * outputPer1M) /
         1_000_000;
     return usd;

package/packages/server/dist/project-files.d.ts

@@ -74,10 +74,11 @@ export declare function readFileBytes(dir: string, name: string, hiddenSegments?
  * UI's markdown/Mermaid + sandboxed-iframe renderers (issue #3) and the image
  * viewer (issue #61).
  *
- * For an IMAGE the raw bytes are NOT returned here (decoding binary as UTF-8
- * would mangle it): `content` is empty and the client fetches the bytes from
- * the raw endpoint. We still stat the file so a missing image 404s. Path-
- * traversal guarded; throws ProjectError("not_found") when missing. See
+ * For a BINARY kind (image, pdf) the raw bytes are NOT returned here (decoding
+ * binary as UTF-8 would mangle it — a PDF read this way is the garbled text of
+ * issue #917): `content` is empty and the client fetches the bytes from the raw
+ * endpoint. We still stat the file so a missing one 404s. Path-traversal
+ * guarded; throws ProjectError("not_found") when missing. See
  * {@link resolveInProject} for `hiddenSegments`.
  */
 export declare function readFileWithKind(dir: string, name: string, hiddenSegments?: "refuse" | "allow"): Promise<{

package/packages/server/dist/project-files.js

@@ -156,15 +156,16 @@ export async function readFileBytes(dir, name, hiddenSegments = "refuse") {
  * UI's markdown/Mermaid + sandboxed-iframe renderers (issue #3) and the image
  * viewer (issue #61).
  *
- * For an IMAGE the raw bytes are NOT returned here (decoding binary as UTF-8
- * would mangle it): `content` is empty and the client fetches the bytes from
- * the raw endpoint. We still stat the file so a missing image 404s. Path-
- * traversal guarded; throws ProjectError("not_found") when missing. See
+ * For a BINARY kind (image, pdf) the raw bytes are NOT returned here (decoding
+ * binary as UTF-8 would mangle it — a PDF read this way is the garbled text of
+ * issue #917): `content` is empty and the client fetches the bytes from the raw
+ * endpoint. We still stat the file so a missing one 404s. Path-traversal
+ * guarded; throws ProjectError("not_found") when missing. See
  * {@link resolveInProject} for `hiddenSegments`.
  */
 export async function readFileWithKind(dir, name, hiddenSegments = "refuse") {
     const kind = fileKind(name);
-    if (kind === "image") {
+    if (kind === "image" || kind === "pdf") {
         // Existence check only — the bytes go over the raw endpoint.
         try {
             await fs.stat(resolveInProject(dir, name, hiddenSegments));

package/packages/server/dist/project-mime.d.ts

@@ -22,11 +22,11 @@ export declare const IMAGE_MIME: Record<string, string>;
 export declare const VIDEO_MIME: Record<string, string>;
 /**
  * Non-image document extensions → their MIME type. Kept SEPARATE from
- * `IMAGE_MIME` on purpose: the file-kind classifier (`fileKind`) treats every
- * `IMAGE_MIME` entry as `kind: "image"`, so a `.pdf` must not live there. It's
- * used only for the byte endpoint's Content-Type (a PDF must serve as
- * `application/pdf`, not the octet-stream the attachment store rewrites to
- * `text/plain`).
+ * `IMAGE_MIME` on purpose: the file-kind classifier (`fileKind`) maps every
+ * `IMAGE_MIME` entry to `kind: "image"`, so a `.pdf` must not live there — it
+ * gets its own `kind: "pdf"` (issue #917). Also the byte endpoint's
+ * Content-Type (a PDF must serve as `application/pdf`, not the octet-stream the
+ * attachment store rewrites to `text/plain`).
  */
 export declare const DOCUMENT_MIME: Record<string, string>;
 /** Derive a render kind from a file name's extension. */

package/packages/server/dist/project-mime.js

@@ -28,11 +28,11 @@ export const VIDEO_MIME = {
 };
 /**
  * Non-image document extensions → their MIME type. Kept SEPARATE from
- * `IMAGE_MIME` on purpose: the file-kind classifier (`fileKind`) treats every
- * `IMAGE_MIME` entry as `kind: "image"`, so a `.pdf` must not live there. It's
- * used only for the byte endpoint's Content-Type (a PDF must serve as
- * `application/pdf`, not the octet-stream the attachment store rewrites to
- * `text/plain`).
+ * `IMAGE_MIME` on purpose: the file-kind classifier (`fileKind`) maps every
+ * `IMAGE_MIME` entry to `kind: "image"`, so a `.pdf` must not live there — it
+ * gets its own `kind: "pdf"` (issue #917). Also the byte endpoint's
+ * Content-Type (a PDF must serve as `application/pdf`, not the octet-stream the
+ * attachment store rewrites to `text/plain`).
  */
 export const DOCUMENT_MIME = {
     ".pdf": "application/pdf",
@@ -46,6 +46,8 @@ export function fileKind(name) {
         return "html";
     if (ext in IMAGE_MIME)
         return "image";
+    if (ext in DOCUMENT_MIME)
+        return "pdf";
     return "text";
 }
 /** The MIME type for a file name's extension, defaulting to octet-stream. */

package/packages/server/dist/project-paths.d.ts

@@ -23,6 +23,21 @@ export type WorkspaceKey = string;
 export declare const ROOT_KEY: WorkspaceKey;
 /** Whether a key addresses the root workspace (i.e. `projectsRoot` itself). */
 export declare function isRootKey(key: WorkspaceKey): boolean;
+/**
+ * The root workspace's title when nothing has been set (#921).
+ *
+ * A project falls back to its slug; the root has none, so it used to read as
+ * `basename(projectsRoot)` — which surfaced a filesystem detail as a title:
+ * lowercase `projects` by default, and whatever `PADDOCK_PROJECTS_DIR` happens
+ * to be called otherwise. "Home" is what the rest of the app already calls this
+ * place (the side-nav row and the workspace's own tab label), so the title bar
+ * now agrees with them.
+ *
+ * It is a DEFAULT, never a stored value: `normalize` applies it on read, and
+ * `writeYaml` keeps it off disk (see there), so a later instance-name config
+ * field has one obvious place to feed and nothing baked in to fight.
+ */
+export declare const ROOT_DEFAULT_NAME = "Home";
 /**
  * The root workspace's name in the **herdctl agent namespace**.
  *

package/packages/server/dist/project-paths.js

@@ -16,6 +16,21 @@ export const ROOT_KEY = "";
 export function isRootKey(key) {
     return key === ROOT_KEY;
 }
+/**
+ * The root workspace's title when nothing has been set (#921).
+ *
+ * A project falls back to its slug; the root has none, so it used to read as
+ * `basename(projectsRoot)` — which surfaced a filesystem detail as a title:
+ * lowercase `projects` by default, and whatever `PADDOCK_PROJECTS_DIR` happens
+ * to be called otherwise. "Home" is what the rest of the app already calls this
+ * place (the side-nav row and the workspace's own tab label), so the title bar
+ * now agrees with them.
+ *
+ * It is a DEFAULT, never a stored value: `normalize` applies it on read, and
+ * `writeYaml` keeps it off disk (see there), so a later instance-name config
+ * field has one obvious place to feed and nothing baked in to fight.
+ */
+export const ROOT_DEFAULT_NAME = "Home";
 /**
  * The root workspace's name in the **herdctl agent namespace**.
  *

package/packages/server/dist/project-types.d.ts

@@ -25,7 +25,7 @@ export declare const PROJECT_STATUSES: readonly ["idea", "active", "paused", "bl
 export type ProjectStatus = (typeof PROJECT_STATUSES)[number];
 export type ProjectVisibility = "public" | "private";
 /** Render-kind hint for a project file (drives the UI renderer choice). */
-export type FileKind = "markdown" | "html" | "text" | "image";
+export type FileKind = "markdown" | "html" | "text" | "image" | "pdf";
 /**
  * One entry in a project directory listing (issue #259): a name plus whether
  * it's a file or a subdirectory, so the Files tab can distinguish the two and

package/packages/server/dist/projects.d.ts

@@ -1,7 +1,7 @@
 import { IMAGE_MIME, VIDEO_MIME, DOCUMENT_MIME, fileKind, contentTypeFor } from "./project-mime.js";
 export { IMAGE_MIME, VIDEO_MIME, DOCUMENT_MIME, fileKind, contentTypeFor };
-import { ROOT_KEY, isRootKey, isPathInside, isSystemPath, isManaged, contentDirFor, isValidRepoUrl, repoCheckoutName, workingDirFor, slugify, ProjectError } from "./project-paths.js";
-export { ROOT_KEY, isRootKey, isPathInside, isSystemPath, isManaged, contentDirFor, isValidRepoUrl, repoCheckoutName, workingDirFor, slugify, ProjectError, };
+import { ROOT_KEY, ROOT_DEFAULT_NAME, isRootKey, isPathInside, isSystemPath, isManaged, contentDirFor, isValidRepoUrl, repoCheckoutName, workingDirFor, slugify, ProjectError } from "./project-paths.js";
+export { ROOT_KEY, ROOT_DEFAULT_NAME, isRootKey, isPathInside, isSystemPath, isManaged, contentDirFor, isValidRepoUrl, repoCheckoutName, workingDirFor, slugify, ProjectError, };
 import { type Project, type FileKind, type FileEntry, type CreateProjectInput, type UpdateProjectInput } from "./project-types.js";
 export * from "./project-types.js";
 export declare class ProjectStore {

package/packages/server/dist/projects.js

@@ -36,8 +36,8 @@ import { PROJECT_SCHEMA_VERSION, SCHEMA_VERSION_KEY, projectSchemaSkip, } from "
 // them at `./projects.js` — the same one-place-to-import discipline as before.
 import { IMAGE_MIME, VIDEO_MIME, DOCUMENT_MIME, fileKind, contentTypeFor, } from "./project-mime.js";
 export { IMAGE_MIME, VIDEO_MIME, DOCUMENT_MIME, fileKind, contentTypeFor };
-import { SLUG_RE, ROOT_KEY, isRootKey, isPathInside, isSystemPath, isManaged, contentDirFor, isValidRepoUrl, repoCheckoutName, workingDirFor, slugify, today, claudeTemplate, ProjectError, } from "./project-paths.js";
-export { ROOT_KEY, isRootKey, isPathInside, isSystemPath, isManaged, contentDirFor, isValidRepoUrl, repoCheckoutName, workingDirFor, slugify, ProjectError, };
+import { SLUG_RE, ROOT_KEY, ROOT_DEFAULT_NAME, isRootKey, isPathInside, isSystemPath, isManaged, contentDirFor, isValidRepoUrl, repoCheckoutName, workingDirFor, slugify, today, claudeTemplate, ProjectError, } from "./project-paths.js";
+export { ROOT_KEY, ROOT_DEFAULT_NAME, isRootKey, isPathInside, isSystemPath, isManaged, contentDirFor, isValidRepoUrl, repoCheckoutName, workingDirFor, slugify, ProjectError, };
 import { gitRemotes, normalizeRemote } from "./adoptable.js";
 import { normalizeLinks, PATCHABLE_KEYS, } from "./project-types.js";
 import * as projectFiles from "./project-files.js";
@@ -78,6 +78,36 @@ function sanitizeModelsOverride(raw) {
     }
     return ids.length > 0 ? ids : undefined;
 }
+/**
+ * A workspace's displayed name, defaulted (#921).
+ *
+ * A project falls back to its slug. The ROOT has no slug to fall back to, so it
+ * used to read as `basename(projectsRoot)` — a filesystem detail in the title
+ * bar: lowercase `projects` by default, and whatever `PADDOCK_PROJECTS_DIR`
+ * happened to be called otherwise. It now reads as {@link ROOT_DEFAULT_NAME},
+ * the word the side-nav row and the workspace's own tab label already use. A
+ * name the user actually set still wins. (No instance-name config field exists
+ * yet; when one lands, this is the single place it should feed.)
+ *
+ * The root's default also survives a BLANK on-disk name, not just an absent one.
+ * The UI cannot save one — its Save button disables on an empty Name — but the
+ * fix ships with "delete the `name:` line by hand" as the upgrade path for an
+ * instance that already persisted a derived value, and a half-done edit
+ * (`name:` with nothing after it, `name: ""`) is the likely slip. Unset, null and
+ * blank all mean the same thing here, so they all read as Home rather than as an
+ * empty title bar.
+ */
+function nameFor(name, key) {
+    if (isRootKey(key))
+        return name?.trim() ? name : ROOT_DEFAULT_NAME;
+    return name ?? key;
+}
+/** The on-disk record minus `name` — the root's un-persisted default (#921). */
+function omitName(yaml) {
+    const { name: _name, ...rest } = yaml;
+    void _name;
+    return rest;
+}
 export class ProjectStore {
     root;
     dataDir;
@@ -1158,10 +1188,7 @@ export class ProjectStore {
     normalize(p, key) {
         const started = p.started ?? today();
         return {
-            // The root workspace has no slug to fall back to, so it reads as its own
-            // directory's basename. (No instance-name config field exists yet; when
-            // one lands, this is the single place it should feed.)
-            name: p.name ?? (isRootKey(key) ? path.basename(path.resolve(this.root)) : key),
+            name: nameFor(p.name, key),
             slug: p.slug ?? key,
             status: p.status ?? "active",
             domain: Array.isArray(p.domain) ? p.domain : [],
@@ -1320,7 +1347,16 @@ export class ProjectStore {
         // construction this build's shape whatever the file said before. A legacy
         // file therefore gains the key the next time it is saved for some other
         // reason — there is no backfill pass, and merely reading one writes nothing.
-        const body = YAML.stringify({ [SCHEMA_VERSION_KEY]: PROJECT_SCHEMA_VERSION, ...yaml });
+        // A DERIVED root name never reaches the disk (#921). `normalize` runs on
+        // every read and the mutators write the normalized record straight back, so
+        // one unrelated settings save used to bake the fallback into project.yaml
+        // permanently — where it would then outlive any later change to the default,
+        // and would mask an instance-name config field if one ever lands. Filtered
+        // for the ROOT only, and only when the value IS the default: an intentional
+        // title is written like any other (and a user who types "Home" gets exactly
+        // "Home" back from the fallback, so nothing is lost by not storing it).
+        const record = isRootKey(slug) && yaml.name === ROOT_DEFAULT_NAME ? omitName(yaml) : yaml;
+        const body = YAML.stringify({ [SCHEMA_VERSION_KEY]: PROJECT_SCHEMA_VERSION, ...record });
         await fs.writeFile(path.join(this.dirFor(slug), PROJECT_FILE), header + body, "utf8");
     }
     /**

package/packages/server/dist/routes/chats.js

@@ -15,6 +15,7 @@ import { ROOT_KEY } from "../projects.js";
 import { applyMessageProvenance } from "../message-provenance.js";
 import { buildProjectRuns } from "../runs.js";
 import { DEFAULT_MODEL } from "../models.js";
+import { capMessages } from "../ui-config.js";
 import { projectChatsDir } from "../transcripts.js";
 import { readSubagentMessages, readSessionTokenUsageWithSubagents } from "../subagents.js";
 import { readContextSeries } from "../usage.js";
@@ -461,7 +462,7 @@ export function registerChatWorkspaceRoutes(app, ctx) {
         schema: {
             tags: ["Chats"],
             summary: "Read a project chat's messages",
-            description: "READ-ONLY: returns the messages of a project chat, enriched with tool details and per-message provenance, plus a synthetic trailing notice if the chat dead-ended at a usage/subscription limit. Sending a message is WebSocket-only (a `chat:send` frame on GET /ws) — there is no HTTP send-message endpoint. Response: `{ messages: [...] }`.",
+            description: "READ-ONLY: returns the messages of a project chat, enriched with tool details and per-message provenance, plus a synthetic trailing notice if the chat dead-ended at a usage/subscription limit. Sending a message is WebSocket-only (a `chat:send` frame on GET /ws) — there is no HTTP send-message endpoint. Optional `?limit=N` returns only the trailing N messages (issue #914); omitted or `0` returns the whole transcript, which is the default and unchanged behaviour. Response: `{ messages: [...], total, truncated }`, where `total` is the full count before any cap.",
             params: {
                 type: "object",
                 properties: {
@@ -470,6 +471,16 @@ export function registerChatWorkspaceRoutes(app, ctx) {
                 },
                 required: ["slug", "sessionId"],
             },
+            querystring: {
+                type: "object",
+                properties: {
+                    limit: {
+                        type: "integer",
+                        minimum: 0,
+                        description: "Return only the trailing N messages. Omit (or pass 0) for the whole transcript. The SPA passes the instance's `ui.transcriptRenderLimit`; other clients are uncapped by default so the published contract is unchanged.",
+                    },
+                },
+            },
             response: {
                 200: {
                     description: "Object `{ messages }` with the chat's message array.",
@@ -525,7 +536,18 @@ export function registerChatWorkspaceRoutes(app, ctx) {
                     notice,
                 });
             }
-            return { messages: withProvenance };
+            // Transcript render cap (issue #914). The slice is deliberately the LAST
+            // step, after enrich/provenance/context-fill, even though slicing earlier
+            // would also save that work: `applyMessageProvenance` walks its markers
+            // with an ordered cursor from index 0 (`message-provenance.ts:274-288`),
+            // so handing it a head-sliced list desyncs the cursor and silently drops
+            // attribution for the whole window. Slicing here means every message the
+            // client receives is byte-identical to the uncapped response — the only
+            // difference is how many of them there are. Moving the cut earlier is a
+            // real optimisation, but it needs a marker offset plumbed through first.
+            const total = withProvenance.length;
+            const capped = capMessages(withProvenance, req.query.limit ?? 0);
+            return { messages: capped, total, truncated: capped.length < total };
         }
         catch (err) {
             return sendProjectError(reply, err);

package/packages/server/dist/routes/git.js

@@ -1,6 +1,7 @@
 import { sendProjectError } from "../route-errors.js";
 import { ProjectError } from "../project-paths.js";
 import { readFileWithKind, readFileBytes } from "../project-files.js";
+import { cspFor } from "../http-bytes.js";
 export function registerGitRoutes(app, ctx) {
     const { git, githubAuth } = ctx;
     // --- git (backing store): fleet-level remote + connection state --------
@@ -358,7 +359,9 @@ export function registerGitWorkspaceRoutes(app, ctx) {
                     .header("content-type", mime)
                     .header("content-disposition", "inline")
                     .header("x-content-type-options", "nosniff")
-                    .header("content-security-policy", "sandbox; default-src 'none'")
+                    // Per-MIME, not a hard-coded constant: a bare `sandbox` token stops
+                    // the browser's native PDF viewer painting at all (issue #917).
+                    .header("content-security-policy", cspFor(mime))
                     .header("cache-control", "private, max-age=60")
                     .send(bytes);
             }

package/packages/server/dist/routes/meta.js

@@ -230,7 +230,7 @@ export function registerMetaRoutes(app, ctx) {
         schema: {
             tags: ["System"],
             summary: "Selectable models and instance defaults",
-            description: "Returns the models this instance offers (the built-in catalog filtered to the `PADDOCK_MODELS` / YAML `models:` allow-list; unset ⇒ the whole catalog) plus the default model and the box-wide defaults (drive mode, max spawn depth, recovery, attachments, curation) that projects fall back to when their own overrides are unset. `defaultModel` is the effective default for the offered list. Returns a JSON object with `models`, `defaultModel`, `driveModeDefault`, `maxSpawnDepthDefault`, `recoveryDefault`, `attachmentsDefault`, and `curationDefault`.",
+            description: "Returns the models this instance offers (the built-in catalog filtered to the `PADDOCK_MODELS` / YAML `models:` allow-list; unset ⇒ the whole catalog) plus the default model and the box-wide defaults (drive mode, max spawn depth, recovery, attachments, curation) that projects fall back to when their own overrides are unset. `defaultModel` is the effective default for the offered list. Returns a JSON object with `models`, `defaultModel`, `driveModeDefault`, `maxSpawnDepthDefault`, `recoveryDefault`, `attachmentsDefault`, `curationDefault`, and `uiDefault`.",
             response: {
                 200: {
                     description: "Model list and inherited defaults.",
@@ -263,6 +263,10 @@ export function registerMetaRoutes(app, ctx) {
             // when its own `curation` override fields are unset (issue #384). Settings
             // shows these as the "Instance default" for each per-file token budget.
             curationDefault: cfg.curation,
+            // Instance-level UI knobs (issue #914). Unlike its neighbours this has no
+            // per-project override — the transcript render cap is a property of the
+            // operator's browser tolerance, not of a project — so the SPA uses it as-is.
+            uiDefault: cfg.ui,
         };
     });
     app.get("/api/fleet", {