@gmickel/gno 2.7.0 → 2.8.0

package/src/mcp/tools/links.ts

@@ -219,6 +219,8 @@ interface BacklinksInput {
 interface BacklinkOutput {
   sourceDocUri: string;
   sourceDocTitle?: string;
+  /** Collection of the linking document. */
+  sourceCollection?: string;
   linkText?: string;
   position: { startLine: number; startCol: number };
 }
@@ -308,6 +310,7 @@ export function handleBacklinks(
         (b: BacklinkRow) => ({
           sourceDocUri: b.sourceDocUri,
           ...(b.sourceDocTitle && { sourceDocTitle: b.sourceDocTitle }),
+          ...(b.sourceCollection && { sourceCollection: b.sourceCollection }),
           ...(b.linkText && { linkText: b.linkText }),
           position: { startLine: b.startLine, startCol: b.startCol },
         })

package/src/mcp/tools/sessions.ts

@@ -13,9 +13,11 @@
 
 import { z } from "zod";
 
+import type { Config } from "../../config/types";
 import type { ToolContext } from "../server";
 
 import { runAutomationProfile } from "../../sessions/automation";
+import { refreshServedConfig } from "../../sessions/config-refresh";
 import {
   formatAutomationRunText,
   formatImportReceiptText,
@@ -99,9 +101,36 @@ export const SESSIONS_IMPORT_MCP_ANNOTATIONS = {
   openWorldHint: false,
 } as const;
 
-function service(ctx: ToolContext): SessionsService {
-  return new SessionsService({
+/**
+ * The config file as it is now, adopted when the CLI changed it while this
+ * server runs (same binding checks and errors as the REST routes). Inside a
+ * request `ctx.config` stays the snapshot taken at its start, so callers use
+ * the returned config. An adoption moves the egress policy epoch; this
+ * request advances with it rather than voiding itself.
+ */
+function currentConfig(ctx: ToolContext): Promise<Config> {
+  return refreshServedConfig({
+    configPath: ctx.actualConfigPath,
+    indexName: ctx.indexName,
+    store: ctx.store,
     config: ctx.config,
+    setConfig: (config) => {
+      ctx.config = config;
+    },
+    invalidateEgressPolicy: async () => {
+      const invalidation = await ctx.invalidateEgressPolicy?.();
+      if (invalidation) {
+        ctx.advanceRequestAuthorizationEpoch?.(invalidation.policyEpoch);
+      }
+    },
+    markContentMutation: () => ctx.markContentMutation?.(),
+    markIndexMutation: () => ctx.markIndexMutation?.(),
+  });
+}
+
+async function service(ctx: ToolContext): Promise<SessionsService> {
+  return new SessionsService({
+    config: await currentConfig(ctx),
     configPath: ctx.actualConfigPath,
     indexName: ctx.indexName,
     store: ctx.store,
@@ -120,7 +149,7 @@ export function handleSessionsStatus(ctx: ToolContext): Promise<ToolResult> {
     "gno_sessions_status",
     async () => {
       try {
-        return await service(ctx).status();
+        return await (await service(ctx)).status();
       } catch (error) {
         return rethrowSessionsError(error);
       }
@@ -146,7 +175,7 @@ export function handleSessionsImport(
       try {
         // A child process keeps this server answering during a long import.
         receipt = await importInChildProcess({
-          config: ctx.config,
+          config: await currentConfig(ctx),
           configPath: ctx.actualConfigPath,
           indexName: ctx.indexName,
           sourceId: args.sourceId,

package/src/mcp/tools/status.ts

@@ -4,27 +4,38 @@
  * @module src/mcp/tools/status
  */
 
-import type { IndexStatus } from "../../store/types";
+import type { CollectionStatus, IndexStatus } from "../../store/types";
 import type { ToolContext } from "../server";
 
 import { buildContentTypeBoostStatus } from "../../config/content-types";
 import { formatChunkingStatus } from "../../core/chunking-status";
+import { OWNER_CONFIG_PATH_FIELDS, withoutFields } from "../../core/host-paths";
+import { formatLinkWorkspace } from "../../core/link-workspace";
 import { formatVectorPartitionLines } from "../../core/vector-partition-status";
 import { resolveModelUri } from "../../llm/registry";
 import { createStandaloneResidentStatus } from "../../serve/resident-status";
+import { exposesHostPaths } from "../context";
 import { runTool, type ToolResult } from "./index";
 
 type StatusInput = Record<string, never>;
 
+/** Status as the caller sees it: HTTP callers get no owner config paths. */
+type StatusView = Omit<IndexStatus, "configPath" | "dbPath" | "collections"> &
+  Partial<Pick<IndexStatus, "configPath" | "dbPath">> & {
+    collections: Array<
+      Omit<CollectionStatus, "path"> & Partial<Pick<CollectionStatus, "path">>
+    >;
+  };
+
 /**
  * Format status as text for MCP content.
  */
-function formatStatus(status: IndexStatus): string {
+function formatStatus(status: StatusView): string {
   const lines: string[] = [];
 
   lines.push(`Index: ${status.indexName}`);
-  lines.push(`Config: ${status.configPath}`);
-  lines.push(`Database: ${status.dbPath}`);
+  if (status.configPath) lines.push(`Config: ${status.configPath}`);
+  if (status.dbPath) lines.push(`Database: ${status.dbPath}`);
   lines.push(`Health: ${status.healthy ? "OK" : "DEGRADED"}`);
   if ("resident" in status) {
     const resident = status.resident as NonNullable<
@@ -45,6 +56,8 @@ function formatStatus(status: IndexStatus): string {
         `  ${c.name}: ${c.activeDocuments} docs, ${c.totalChunks} chunks` +
           (c.embeddedChunks > 0 ? `, ${c.embeddedChunks} embedded` : "")
       );
+      const workspace = formatLinkWorkspace(c);
+      if (workspace) lines.push(`    Link workspace: ${workspace}`);
     }
   }
 
@@ -88,7 +101,7 @@ export function handleStatus(
   return runTool(
     ctx,
     "gno_status",
-    async () => {
+    async (): Promise<StatusView> => {
       const result = await ctx.store.getStatus({
         embedModel: resolveModelUri(ctx.config, "embed"),
         chunking: ctx.config.chunking ?? {},
@@ -98,7 +111,7 @@ export function handleStatus(
       }
 
       // Override configPath with actual path from context
-      return {
+      const status = {
         ...result.value,
         configPath: ctx.actualConfigPath,
         contentTypeBoost: buildContentTypeBoostStatus(
@@ -107,6 +120,9 @@ export function handleStatus(
         resident:
           ctx.getResidentStatus?.() ?? createStandaloneResidentStatus("stdio"),
       };
+      return exposesHostPaths(ctx)
+        ? status
+        : withoutFields(status, OWNER_CONFIG_PATH_FIELDS);
     },
     formatStatus
   );

package/src/pipeline/expansion.ts

@@ -15,6 +15,7 @@ import {
   assertInferenceActive,
   assertInferenceResult,
   inferenceOptions,
+  withInferencePage,
 } from "../llm/inference-scope";
 import { ok } from "../store/types";
 
@@ -23,7 +24,6 @@ import { ok } from "../store/types";
 // ─────────────────────────────────────────────────────────────────────────────
 
 const EXPANSION_PROMPT_VERSION = "v3";
-const DEFAULT_TIMEOUT_MS = 5000;
 // Non-greedy to avoid matching from first { to last } across multiple objects
 const JSON_EXTRACT_PATTERN = /\{[\s\S]*?\}/;
 const QUOTED_PHRASE_PATTERN = /"([^"]+)"/g;
@@ -457,8 +457,6 @@ export function parseExpansionOutput(
 export interface ExpansionOptions extends InferenceOptions {
   /** Language hint for prompt selection */
   lang?: string;
-  /** Timeout in milliseconds */
-  timeout?: number;
   /** Optional context that steers expansion for ambiguous queries */
   intent?: string;
   /** Optional bounded context size override for expansion generation */
@@ -467,59 +465,49 @@ export interface ExpansionOptions extends InferenceOptions {
 
 /**
  * Expand query using generation model.
- * Returns null on timeout or parse failure (graceful degradation).
+ * Returns null when generation fails or times out, or its output does not
+ * parse (graceful degradation).
  */
 export async function expandQuery(
   genPort: GenerationPort,
   query: string,
   options: ExpansionOptions = {}
 ): Promise<StoreResult<ExpansionResult | null>> {
-  const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
-
   // Build prompt
   const prompt = buildExpansionPrompt(query, options);
 
   assertInferenceActive(options);
   const operational = inferenceOptions(options);
-  const budget = new AbortController();
-  const expiresAt = performance.now() + timeout;
-  const timer = setTimeout(() => budget.abort(), timeout);
   try {
-    const result = await genPort.generate(
-      prompt,
-      {
-        temperature: 0,
-        seed: 42,
-        maxTokens: 512,
-        contextSize: options.contextSize,
-      },
-      {
-        ...operational,
-        signal: operational.signal
-          ? AbortSignal.any([operational.signal, budget.signal])
-          : budget.signal,
-      }
+    // Expansion is best effort but has no budget of its own: slow hardware
+    // (CPU generation takes 15-20s) and a cold model load still expand. A
+    // generation that hits models.inferenceTimeout fails only expansion.
+    const result = await withInferencePage(() =>
+      genPort.generate(
+        prompt,
+        {
+          temperature: 0,
+          seed: 42,
+          maxTokens: 512,
+          contextSize: options.contextSize,
+        },
+        operational
+      )
     );
-    // The independent expansion budget preserves its existing fallback. Caller
-    // cancellation/deadline always wins and cannot become a lexical success.
+    // Caller cancellation/deadline always wins and cannot become a lexical success.
     assertInferenceActive(options);
-    if (budget.signal.aborted || performance.now() >= expiresAt)
-      return ok(null);
+    if (!result) return ok(null);
     assertInferenceResult(result);
     if (!result.ok) return ok(null);
     return ok(parseExpansionOutput(result.value, query));
   } catch (cause) {
     assertInferenceActive(options);
-    if (budget.signal.aborted || performance.now() >= expiresAt)
-      return ok(null);
     if (
       cause instanceof Error &&
       ["AbortError", "TimeoutError"].includes(cause.name)
     )
       throw cause;
     return ok(null);
-  } finally {
-    clearTimeout(timer);
   }
 }
 

package/src/pipeline/graph-retrieval.ts

@@ -196,6 +196,7 @@ const loadGraphLinks = async (
   seedDocumentIds: number[],
   options: {
     collection?: string;
+    collections?: string[];
     includeSimilar?: boolean;
   }
 ): Promise<
@@ -205,6 +206,7 @@ const loadGraphLinks = async (
     const neighborsResult = await store.getGraphNeighborsForSeeds({
       seedDocumentIds,
       collection: options.collection,
+      collections: options.collections,
       limitEdges: GRAPH_EDGE_LIMIT,
     });
     if (!neighborsResult.ok) {
@@ -239,6 +241,11 @@ export async function expandGraphCandidates(
   fusedCandidates: FusionCandidate[],
   options: {
     collection?: string;
+    /**
+     * Graph allowlist (plural request scope). Neighbours must belong to one of
+     * these collections; defaults to `[collection]` when unset.
+     */
+    collections?: string[];
     includeSimilar?: boolean;
     eligibility?: DocumentEligibilityOptions;
     limit?: number;
@@ -353,8 +360,14 @@ export async function expandGraphCandidates(
   }
 
   const seedDocumentIds = [...seedByDocid.values()].map(({ doc }) => doc.id);
+  const graphAllowlist = options.collections
+    ? new Set(options.collections)
+    : options.collection
+      ? new Set([options.collection])
+      : undefined;
   const linksResult = await loadGraphLinks(store, seedDocumentIds, {
     collection: options.collection,
+    collections: options.collections,
     includeSimilar: options.includeSimilar,
   });
   if (!linksResult.ok) {
@@ -400,9 +413,15 @@ export async function expandGraphCandidates(
     return { candidates: [], meta };
   }
 
+  // A plural allowlist hydrates across its collections; scope is enforced on
+  // each neighbour's own collection below, never widened past the allowlist.
+  const plural = options.collections !== undefined;
   const docsResult = await store.getDocumentsByDocids(rankedNeighborDocids, {
-    eligibility: options.eligibility,
-    collection: options.collection,
+    eligibility:
+      plural && options.eligibility
+        ? { ...options.eligibility, collection: undefined }
+        : options.eligibility,
+    collection: plural ? undefined : options.collection,
     activeOnly: true,
   });
   if (!docsResult.ok) {
@@ -413,6 +432,7 @@ export async function expandGraphCandidates(
   const metadataFilteredDocs = docsResult.value.filter(
     (doc) =>
       doc.mirrorHash &&
+      (!graphAllowlist || graphAllowlist.has(doc.collection)) &&
       (options.relPathPrefix === undefined ||
         sourceRelPath(doc) === options.relPathPrefix ||
         sourceRelPath(doc).startsWith(`${options.relPathPrefix}/`)) &&

package/src/pipeline/hybrid.ts

@@ -520,7 +520,6 @@ async function searchHybridWithHydration(
       const expandResult = await expandQuery(expandPort, query, {
         // Use queryLanguage for prompt selection, NOT options.lang (retrieval filter)
         lang: queryLanguage,
-        timeout: pipelineConfig.expansionTimeout,
         intent: options.intent,
         contextSize: deps.config.models?.expandContextSize,
       });
@@ -804,6 +803,7 @@ async function searchHybridWithHydration(
     fusedCandidates,
     {
       collection: options.collection,
+      collections: options.graphCollections,
       includeSimilar: vectorAvailable,
       eligibility: vectorEligibility,
       limit,

package/src/pipeline/types.ts

@@ -191,6 +191,12 @@ export interface SearchOptions extends InferenceOptions {
   minScore?: number;
   /** Filter by collection */
   collection?: string;
+  /**
+   * Internal graph allowlist for a request partitioned into one retrieval per
+   * collection (Context Capsules, replay): graph neighbours may come from any
+   * of these collections, never from others. Defaults to `[collection]`.
+   */
+  graphCollections?: string[];
   /** Internal exact corpus scope used by deterministic retrieval replay. */
   retrievalScope?: {
     relPathPrefix?: string;
@@ -406,8 +412,6 @@ export type RerankedCandidate = FusionCandidate & {
 
 /** Search pipeline configuration */
 export interface PipelineConfig {
-  /** Expansion timeout in ms */
-  expansionTimeout: number;
   /** Max candidates to rerank */
   rerankCandidates: number;
   /** RRF configuration */
@@ -418,7 +422,6 @@ export interface PipelineConfig {
 
 /** Default pipeline configuration */
 export const DEFAULT_PIPELINE_CONFIG: PipelineConfig = {
-  expansionTimeout: 5000,
   rerankCandidates: 20,
   rrf: DEFAULT_RRF_CONFIG,
   blendingSchedule: DEFAULT_BLENDING_SCHEDULE,

package/src/serve/embed-scheduler.ts

@@ -202,8 +202,8 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
     } catch (cause) {
       if (controller.signal.aborted)
         return { result: { embedded: 0, errors: 0 } };
-      // An inference deadline or worker exit aborts the whole pass. It is a
-      // failed pass like any other, never a silently dropped rejection.
+      // A worker exit aborts the whole pass (a deadline fails only its page).
+      // It is a failed pass like any other, never a silently dropped rejection.
       return {
         result: { embedded: 0, errors: 0 },
         failure: cause instanceof Error ? cause.message : String(cause),

package/src/serve/findings-pass.ts

@@ -30,7 +30,7 @@ import {
 } from "../core/findings-run-state";
 import { acquireCliWriteLease } from "../core/write-lease";
 
-/** Audit report cap; matches the audit schema ceiling. */
+/** Audit report cap for the daemon findings pass. */
 const FINDINGS_AUDIT_MAX_FINDINGS = 1000;
 const LEASE_HOLDER_COMMAND = "gno daemon (findings pass)";
 const CONTROL_CHARS = /\p{Cc}/gu;

package/src/serve/host-path-redaction.ts

@@ -1,36 +1,72 @@
 /**
  * REST boundary for host paths: a caller the request-locality rule judges
- * remote never receives an `absPath` field from any `/api/*` JSON response.
- * Same-host callers (the loopback Web UI) keep them for Reveal and
- * "Open original". Routes that stream original source bytes are exempt:
- * their body is the owner's file, not an API envelope.
+ * remote never receives an `absPath` field from any `/api/*` JSON response,
+ * nor the host `path` fields of the status, collection, connector, and
+ * document-mutation routes (plus `configPath`/`dbPath` on status and the
+ * `file://` `uri` of a document save). Same-host callers (the loopback Web
+ * UI) keep them for Reveal, "Open original", and the Collections page.
+ * Routes that stream original source bytes are exempt: their body is the
+ * owner's file, not an API envelope.
  */
 
-import { withoutHostPaths } from "../core/host-paths";
+import {
+  HOST_PATH_FIELDS,
+  OWNER_CONFIG_PATH_FIELDS,
+  withoutFields,
+} from "../core/host-paths";
 import {
   isLocalClientRequest,
   type RequestPeerServer,
 } from "./request-locality";
 
-const HOST_PATH_KEY = '"absPath"';
 const SOURCE_BYTE_ROUTES = new Set(["/api/doc-asset"]);
+const OWNER_CONFIG_FIELDS: ReadonlySet<string> = new Set([
+  ...HOST_PATH_FIELDS,
+  ...OWNER_CONFIG_PATH_FIELDS,
+]);
+/** Document mutations answer with the file's host `path`. */
+const DOC_PATH_FIELDS: ReadonlySet<string> = new Set([
+  ...HOST_PATH_FIELDS,
+  "path",
+]);
+/** A document save also names the file by a `file://` `uri`. */
+const DOC_SAVE_FIELDS: ReadonlySet<string> = new Set([
+  ...DOC_PATH_FIELDS,
+  "uri",
+]);
+const ROUTE_FIELDS = new Map<string, ReadonlySet<string>>([
+  ["/api/status", OWNER_CONFIG_FIELDS],
+  ["/api/collections", OWNER_CONFIG_FIELDS],
+  ["/api/collections/:name", OWNER_CONFIG_FIELDS],
+  ["/api/connectors", OWNER_CONFIG_FIELDS],
+  ["/api/connectors/install", OWNER_CONFIG_FIELDS],
+  ["/api/docs", DOC_PATH_FIELDS],
+  ["/api/docs/:id", DOC_SAVE_FIELDS],
+  ["/api/docs/:id/rename", DOC_PATH_FIELDS],
+  ["/api/docs/:id/move", DOC_PATH_FIELDS],
+  ["/api/docs/:id/duplicate", DOC_PATH_FIELDS],
+  ["/api/docs/:id/trash", DOC_PATH_FIELDS],
+  ["/api/docs/:id/editable-copy", DOC_PATH_FIELDS],
+  ["/api/folders", DOC_PATH_FIELDS],
+]);
 
 type RouteHandler = (
   req: Request,
   server: RequestPeerServer
 ) => Response | Promise<Response>;
 
-/** The JSON response with every `absPath` field removed. */
+/** The JSON response with every key in `fields` removed. */
 export async function redactResponseHostPaths(
-  response: Response
+  response: Response,
+  fields: ReadonlySet<string>
 ): Promise<Response> {
   const contentType = response.headers.get("content-type") ?? "";
   if (!contentType.includes("application/json") || response.body === null) {
     return response;
   }
   const text = await response.text();
-  const body = text.includes(HOST_PATH_KEY)
-    ? JSON.stringify(withoutHostPaths(JSON.parse(text) as unknown))
+  const body = [...fields].some((field) => text.includes(`"${field}"`))
+    ? JSON.stringify(withoutFields(JSON.parse(text) as unknown, fields))
     : text;
   const headers = new Headers(response.headers);
   headers.delete("content-length");
@@ -42,12 +78,12 @@ export async function redactResponseHostPaths(
 }
 
 const redacting =
-  (handler: RouteHandler): RouteHandler =>
+  (handler: RouteHandler, fields: ReadonlySet<string>): RouteHandler =>
   async (req, server) => {
     const response = await handler(req, server);
     return isLocalClientRequest(req, server)
       ? response
-      : redactResponseHostPaths(response);
+      : redactResponseHostPaths(response, fields);
   };
 
 const isMethodTable = (route: unknown): route is Record<string, unknown> =>
@@ -62,14 +98,15 @@ export function withRemoteHostPathRedaction<T extends Record<string, unknown>>(
   const wrapped: Record<string, unknown> = { ...routes };
   for (const [path, route] of Object.entries(routes)) {
     if (!path.startsWith("/api/") || SOURCE_BYTE_ROUTES.has(path)) continue;
+    const fields = ROUTE_FIELDS.get(path) ?? HOST_PATH_FIELDS;
     if (typeof route === "function") {
-      wrapped[path] = redacting(route as RouteHandler);
+      wrapped[path] = redacting(route as RouteHandler, fields);
     } else if (isMethodTable(route)) {
       wrapped[path] = Object.fromEntries(
         Object.entries(route).map(([method, handler]) => [
           method,
           typeof handler === "function"
-            ? redacting(handler as RouteHandler)
+            ? redacting(handler as RouteHandler, fields)
             : handler,
         ])
       );

package/src/serve/public/components/BootstrapStatus.tsx

@@ -105,9 +105,11 @@ export function BootstrapStatus({
           </CardHeader>
           <CardContent className="space-y-2 text-sm">
             <p>Total cache: {bootstrap.cache.totalSizeLabel}</p>
-            <p className="font-mono text-muted-foreground text-xs">
-              {bootstrap.cache.path}
-            </p>
+            {bootstrap.cache.path && (
+              <p className="font-mono text-muted-foreground text-xs">
+                {bootstrap.cache.path}
+              </p>
+            )}
           </CardContent>
         </Card>
 

package/src/serve/public/components/CaptureModal.tsx

@@ -75,7 +75,7 @@ export interface CaptureModalProps {
 
 interface Collection {
   name: string;
-  path: string;
+  path?: string;
 }
 
 interface CreateDocResponse {

package/src/serve/public/components/CollectionModelDialog.tsx

@@ -54,7 +54,8 @@ export interface CollectionModelDetails {
   modelSources?: Record<ModelRole, ModelSource>;
   models?: Partial<Record<ModelRole, string>>;
   name: string;
-  path: string;
+  /** Host path; omitted for remote callers. */
+  path?: string;
   pattern?: string;
   egressPolicy?: {
     schemaVersion: "1.0";
@@ -110,7 +111,7 @@ const CODE_EXT_HINTS = [
 ] as const;
 
 function collectionLooksCodeHeavy(collection: CollectionModelDetails): boolean {
-  const path = collection.path.toLowerCase();
+  const path = (collection.path ?? "").toLowerCase();
   if (
     CODE_PATH_HINTS.some(
       (hint) => path.endsWith(hint) || path.includes(`${hint}/`)
@@ -284,17 +285,19 @@ export function CollectionModelDialog({
                 active preset for the rest of the workspace.
               </DialogDescription>
             </div>
-            <div className="hidden shrink-0 max-w-[200px] space-y-1 border-border/15 border-l pl-4 lg:block">
-              <p className="font-mono text-[10px] text-muted-foreground/50 uppercase tracking-[0.15em]">
-                Path
-              </p>
-              <p
-                className="break-all font-mono text-[10px] leading-relaxed text-muted-foreground/50"
-                title={collection?.path}
-              >
-                {collection?.path}
-              </p>
-            </div>
+            {collection?.path && (
+              <div className="hidden shrink-0 max-w-[200px] space-y-1 border-border/15 border-l pl-4 lg:block">
+                <p className="font-mono text-[10px] text-muted-foreground/50 uppercase tracking-[0.15em]">
+                  Path
+                </p>
+                <p
+                  className="break-all font-mono text-[10px] leading-relaxed text-muted-foreground/50"
+                  title={collection.path}
+                >
+                  {collection.path}
+                </p>
+              </div>
+            )}
           </div>
         </DialogHeader>
 

package/src/serve/public/components/CollectionsEmptyState.tsx

@@ -13,6 +13,8 @@ export function CollectionsEmptyState({
   suggestedCollections,
   onAddCollection,
 }: CollectionsEmptyStateProps) {
+  // A remote caller's suggestions carry no host path to prefill.
+  const quickPicks = suggestedCollections.filter(({ path }) => path);
   return (
     <div className="mx-auto max-w-3xl py-16 text-center">
       <div className="mx-auto mb-4 flex size-16 items-center justify-center rounded-full bg-muted">
@@ -29,7 +31,7 @@ export function CollectionsEmptyState({
           <FolderPlusIcon className="mr-2 size-4" />
           Add Folder
         </Button>
-        {suggestedCollections.map((suggestion) => (
+        {quickPicks.map((suggestion) => (
           <Button
             key={suggestion.path}
             onClick={() => onAddCollection(suggestion.path)}
@@ -40,9 +42,9 @@ export function CollectionsEmptyState({
         ))}
       </div>
 
-      {suggestedCollections.length > 0 && (
+      {quickPicks.length > 0 && (
         <div className="grid gap-3 text-left md:grid-cols-2">
-          {suggestedCollections.map((suggestion) => (
+          {quickPicks.map((suggestion) => (
             <div
               className="rounded-xl border border-border/60 bg-background/70 p-4"
               key={`${suggestion.path}-detail`}

package/src/serve/public/components/FirstRunWizard.tsx

@@ -235,6 +235,8 @@ export function FirstRunWizard({
       ? steps[activeIndex + 1]
       : null;
   const progressValue = getStepProgress(onboarding);
+  // A remote caller's suggestions carry no host path to prefill.
+  const quickPicks = onboarding.suggestedCollections.filter(({ path }) => path);
   const isShowingRecommended = activeStep?.id === recommendedStepId;
   const runRecommendedAction = () => {
     if (!activeStep) {
@@ -277,7 +279,7 @@ export function FirstRunWizard({
             </Button>
           </div>
 
-          {onboarding.suggestedCollections.length > 0 && (
+          {quickPicks.length > 0 && (
             <div className="space-y-3">
               <div className="flex items-center justify-between gap-3">
                 <div>
@@ -295,7 +297,7 @@ export function FirstRunWizard({
                 <Badge variant="outline">Quick picks</Badge>
               </div>
               <div className="grid gap-3 md:grid-cols-2">
-                {onboarding.suggestedCollections.map((suggestion) => (
+                {quickPicks.map((suggestion) => (
                   <button
                     className="rounded-xl border border-border/70 bg-background/80 p-4 text-left shadow-sm transition-all hover:border-primary/35 hover:bg-background hover:shadow-md"
                     key={suggestion.path}