agent-horde 0.1.3 → 0.1.5

package/README.md

@@ -88,7 +88,7 @@ pi install npm:agent-horde
 Or from the repository, pinned to a tag:
 
 ```
-pi install git:github.com/eliyastein/agent-horde@v0.1.3
+pi install git:github.com/eliyastein/agent-horde@v0.1.5
 ```
 
 To hack on it, clone and install in place. pi loads the files from the clone, so edits take effect
@@ -192,7 +192,8 @@ ledgers, the collaboration threads with their review scope and acceptance state,
 audit, and a graph of the run. The graph is a swimlane, one lane per member, with every event
 linked to the page that shows it, so a run reads left to right: who claimed what, which findings
 landed under which ideas, who reviewed whom, and where actions were rejected. It is server-rendered
-SVG/HTML with no scripts.
+SVG/HTML with no scripts. The download icon on every page exports the whole dashboard as a zip of
+static pages that opens from disk, after a warning that it may carry sensitive data from the machine.
 
 ## Benchmark: FinanceBench
 

package/SECURITY.md

@@ -32,6 +32,14 @@ writes, rejects requests whose `Host` header is not localhost, sends a `default-
 security policy, and renders no scripts. It still exposes everything under `.horde/` to any process
 or browser tab on the machine, member transcripts included. Do not forward or proxy the port.
 
+`/export.zip` packs every dashboard page, transcripts and logs included, into one archive meant
+to be shared. The export control warns before the download, but the archive carries whatever the
+members read or produced: file contents, command output, paths, and any credentials they met.
+Review it before passing it on. Building it costs seconds of work, so the dashboard runs one
+export at a time and refuses to start one for a request the browser marks as cross-site; a page
+on another origin cannot read the dashboard, but it can otherwise make a browser request its
+localhost port.
+
 ## Supply chain
 
 The package has no runtime dependencies beyond the packages pi itself provides to extensions.

package/docs/REFERENCE.md

@@ -37,9 +37,10 @@ synthesize it.
    a fresh session takes its name, up to `PI_HORDE_RESET_CAP` times.
 3. **Repair.** After discovery ends normally, finished members get fresh, targeted sessions to
    answer open blockers, review requests, and responses, within the `PI_HORDE_REPAIR_*` budgets.
-   The default totals follow the queue, so every queued member can afford a cold first turn; the
-   phase start records the budget and `repair-end` records each attempt's turns and first-turn
-   cost. A user stop skips this phase.
+   The default totals follow the queues' demand (one floor per queue plus one per further review
+   request or blocking challenge), each attempt's share is cut in proportion to its demand, and
+   every attempt gets at least a floor; the phase start records the budget, `repair-start` the
+   attempt's demand, and `repair-end` its turns and first-turn cost. A user stop skips this phase.
 4. **Finalize.** Acceptance is frozen (`ACCEPTANCE.*`, `snapshot/`), resource cleanup commands
    run, `SUMMARY.md` and `REPORT.md` are written, then a synthesis member writes `DELIVERABLE.md`
    and a read-only reviewer writes `POSTMORTEM.md`. The widget shows `synthesizing` until both
@@ -86,6 +87,24 @@ Every page has a JSON twin under `/api/<same path>`.
 | `/runs/<id>/graph` | the run as a swimlane: one lane per member plus the parent, phase bands, every event a link to its ledger entry (`?w=<px>`, `?from=<s>&to=<s>`); the axis is real time until the last member exits, then the synthesis phases share a compressed tail |
 | `/runs/<id>/graph.mmd` | the same run as a Mermaid flowchart with absolute dashboard links (text/plain) |
 | `/ideas`, `/board`, `/findings`, `/claims`, `/facts`, `/resources` | the shared ledgers; `?run=<id>\|all`, `?view=clusters`, `?owner=<m>` filter them; `/resources` also lists who cited each resource in the active run, as REPORT.md counts reuse |
+| `/export` | confirms the export and starts the download of `/export.zip` (`?back=<path>` names the page to return to); no JSON twin |
+| `/export.zip` | the whole dashboard as static HTML (`application/zip`, streamed, no JSON twin); see below |
+
+The download icon in the top-right corner of every page opens a warning that the export may
+leak sensitive data from this machine. Its download link goes to `/export`, which closes the
+warning, explains the wait, and starts the download of `/export.zip`. The zip holds one
+folder, `horde-dashboard-<timestamp>/`, whose `index.html` opens the dashboard from disk: every
+run, member, transcript page and entry, log, run document, collaboration page, graph (each width,
+plus the Mermaid file), and the ledgers under each run filter, with links rewritten relative to
+each other. Exported pages do not refresh, expandable entries use the browser's own disclosure,
+finding bodies are shown inline, transcripts are paged fifty entries at a time, and the export
+control itself is absent. Pages that fail to load are exported as their error page, so no link
+dangles. The export is built when requested and has no cache. It is streamed one page per
+event-loop turn, so the download appears in the browser at once and grows while the pages are
+packed, and the run is not held up; a dashboard with many long transcripts takes a few seconds
+and the archive can run to hundreds of megabytes. One export runs at a time (a second request
+gets 503), and requests a browser marks as coming from another site (`Sec-Fetch-Site:
+cross-site`) get 403.
 
 Only the active run has live member state. Historical runs are rebuilt from `member-N.log` and
 the session files, so they show end cause, turns, and usage but no activity.
@@ -181,6 +200,9 @@ from the same actor as an idempotent retry. The parent appends its own lifecycle
   request, and the requester then resolves it. A challenger can withdraw its own blocking
   challenge on an F# or A# before any response by recording a supporting review of the current
   revision and resolving with evidence on it; limits that review discloses remain acceptance debt.
+  The blocking challenge a `partially-supports` review raises is cleared when a different
+  non-owner member records a full-scope `supports` review of the same revision; the resolution
+  names both reviews. Acceptance names an open blocker as `blocked by Q#`.
 - **Inbox.** Targeted messages are inserted at turn boundaries, for at most
   `PI_HORDE_INBOX_TURNS` extra turns per session. A recipient answers with `respond`; `ack` is an
   optional first step that signals intent. Delivery is a context insertion, not
@@ -240,8 +262,8 @@ carries a one-line diagnosis and, when generated, the post-mortem text.
 | `PI_HORDE_SOLVED_STOP_MS` | 30000 | extra wind-down window for a solve landing at the deadline |
 | `PI_HORDE_ALLOW_UNVERIFIED` | unset | `1` accepts a validated answer with unverified findings |
 | `PI_HORDE_REPAIR_ROUNDS` | 4 | post-discovery repair rounds (max 6; `0` disables) |
-| `PI_HORDE_REPAIR_MS` | queue-sized | total repair time: one `PI_HORDE_REPAIR_MIN_MS` per queued member (max 4) plus two recheck shares; a number here is a flat total |
-| `PI_HORDE_REPAIR_TOKENS` | queue-sized | total repair tokens: one `PI_HORDE_REPAIR_MIN_TOKENS` per queued member (max 4) plus two recheck shares; a number here is a flat total |
+| `PI_HORDE_REPAIR_MS` | demand-sized | total repair time: one `PI_HORDE_REPAIR_MIN_MS` per demand unit (max 6) plus two recheck shares; a number here is a flat total |
+| `PI_HORDE_REPAIR_TOKENS` | demand-sized | total repair tokens: one `PI_HORDE_REPAIR_MIN_TOKENS` per demand unit (max 6) plus two recheck shares; a number here is a flat total |
 | `PI_HORDE_REPAIR_MIN_TOKENS` | 40000 | token floor per attempt; below it scheduling stops with a `repair-skipped` event |
 | `PI_HORDE_REPAIR_MIN_MS` | 60000 | time floor per attempt; the clock is split only among attempts the token budget can fund |
 | `PI_HORDE_REPAIR_TURNS` | 40 | turn cap per attempt; an attempt still reading its inbox at the cap is stopped with `turns` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-horde",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Run a horde of pi agents on one task: shared ledgers, peer review, an auditable event log, and a live dashboard",
   "license": "MIT",
   "type": "module",

package/src/citations.ts

@@ -73,7 +73,10 @@ export function citedDataFiles(text: string): string[] {
   return [...out];
 }
 
-/** Bounded search for a file by name under a directory; artifact dirs are small. */
+/** Trees a basename search never descends into: run data, dependencies and version control. */
+const UNSEARCHED_DIRS = new Set([".horde", "node_modules", ".git"]);
+
+/** Bounded search for a file by name under a directory; artifact dirs and source trees are shallow. */
 function fileNamedUnder(dir: string, name: string, depth = 6): boolean {
   let entries: fs.Dirent[];
   try {
@@ -83,7 +86,7 @@ function fileNamedUnder(dir: string, name: string, depth = 6): boolean {
   }
   for (const entry of entries) {
     if (entry.isFile() && entry.name === name) return true;
-    if (entry.isDirectory() && depth > 0 && fileNamedUnder(path.join(dir, entry.name), name, depth - 1)) {
+    if (entry.isDirectory() && depth > 0 && !UNSEARCHED_DIRS.has(entry.name) && fileNamedUnder(path.join(dir, entry.name), name, depth - 1)) {
       return true;
     }
   }
@@ -94,7 +97,8 @@ function fileNamedUnder(dir: string, name: string, depth = 6): boolean {
  * True when a cited file cannot be resolved to an existing file on disk. Paths
  * are tried against the repo root, the run directory, its artifacts directory,
  * and the directory of the citing file. Because generated artifacts usually cite
- * retained files by a relative name, a basename match anywhere in this run's tree
+ * retained files by a relative name, and a deliverable cites the reviewed project's
+ * own files by bare name, a basename match in this run's tree or in the project tree
  * also counts, which keeps the warning precise instead of noisy.
  */
 function citedFileMissing(run: HordeRun, ref: string, baseDir?: string): boolean {
@@ -110,7 +114,7 @@ function citedFileMissing(run: HordeRun, ref: string, baseDir?: string): boolean
     }
   }
   const base = ref.replace(/^\.\//, "").split("/").pop() ?? ref;
-  return !fileNamedUnder(run.runDir, base);
+  return !fileNamedUnder(run.runDir, base) && !fileNamedUnder(run.cwd, base);
 }
 
 export function resourceCitations(text: string): number[] {
@@ -229,13 +233,17 @@ function citedWithoutLabel(text: string, id: number): boolean {
   return citing.length > 0 && !citing.some((paragraph) => UNREVIEWED_LABEL.test(paragraph));
 }
 
+/** A sentence ends at `.`, `!` or `?`, possibly inside closing emphasis or brackets, before a capitalised start. */
+const SENTENCE_BREAK = /(?<=[.!?][*_)\]"']*)\s+(?=[A-Z"'([*_`])/;
+
 /**
- * The units a review citation is judged in: paragraphs, except that each list item and table row
+ * The units a review citation is judged in: sentences, except that each list item and table row
  * stands alone. A bullet that cites reviews as the source of a limitation does not claim them as
- * support for a finding named two bullets up.
+ * support for a finding named two bullets up, and a sentence that cites a document's review does
+ * not claim it for the finding named in the sentence before.
  */
 function citationUnits(text: string): string[] {
-  return text.split(/\n\s*\n/).flatMap((paragraph) => (/^\s*(?:[-*]|\d+\.|\|)\s/m.test(paragraph) ? paragraph.split("\n") : [paragraph]));
+  return text.split(/\n\s*\n/).flatMap((paragraph) => (/^\s*(?:[-*]|\d+\.|\|)\s/m.test(paragraph) ? paragraph.split("\n") : paragraph.split(SENTENCE_BREAK)));
 }
 
 /**

package/src/collaboration-report.ts

@@ -51,6 +51,10 @@ function artifactProblem(hordeDir: string, runId: string, state: CollaborationSt
     const file = fs.realpathSync(path.join(hordeDir, "runs", runId, artifact.path));
     if (!file.startsWith(root + path.sep) || hashText(fs.readFileSync(file)) !== artifact.hash) return "file changed after publication";
   } catch { return "published file unavailable"; }
+  // A blocker is named as such: the acceptance text is read by members and the deliverable, and
+  // "needs a review" sent them after a review that already existed.
+  const blocker = blockingMessages(state).find((m) => m.target === artifact.id);
+  if (blocker) return `blocked by ${blocker.id} (${blocker.state} blocking ${blocker.kind} from ${blocker.sender})`;
   return artifactAccepted(state, artifact) ? undefined : artifact.kind === "document"
     ? "needs a full independent review against document criteria"
     : "needs a full independent tested/reproduced review";

package/src/dashboard-export.ts

@@ -0,0 +1,192 @@
+import * as path from "node:path";
+import * as zlib from "node:zlib";
+
+/** One rendered page; `text` pages (the Mermaid export) carry no links to rewrite. */
+export interface ExportPage {
+  body: string;
+  text?: boolean | undefined;
+}
+
+/** Renders the dashboard page at a URL; must return an error page rather than throw. */
+export type ExportRenderer = (url: URL) => ExportPage;
+
+export interface ZipEntry {
+  path: string;
+  data: Buffer;
+}
+
+const BASE = "http://127.0.0.1";
+const MAX_PAGES = 100_000;
+const ZIP_MAX_ENTRIES = 0xffff;
+const ZIP_MAX_BYTES = 0xffff_ffff;
+
+/** One name component: no separators, and never a dot-only segment, so the zip cannot escape its folder. */
+function safeName(text: string): string {
+  const safe = text.replace(/[^A-Za-z0-9._=~-]/g, "_");
+  return /^\.+$/.test(safe) ? safe.replace(/\./g, "_") : safe;
+}
+
+/** The file a dashboard URL becomes: `/` is index.html, query parameters are sorted into the name. */
+export function exportFile(url: URL): string {
+  const segments = url.pathname.split("/").filter(Boolean).map((segment) => safeName(decodeURIComponent(segment)));
+  const stem = segments.length === 0 ? "index" : segments.join("/");
+  const params = [...url.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => safeName(`${k}=${v}`));
+  const name = `${stem}${params.map((pair) => `~${pair}`).join("")}`;
+  return url.pathname.endsWith(".mmd") ? name : `${name}.html`;
+}
+
+function canonical(href: string): URL {
+  const url = new URL(href, BASE);
+  url.hash = "";
+  const sorted = [...url.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b));
+  url.search = "";
+  for (const [k, v] of sorted) url.searchParams.append(k, v);
+  return url;
+}
+
+function unescapeHtml(text: string): string {
+  return text.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+}
+
+function escapeHtml(text: string): string {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+
+/** Rewrites every dashboard-absolute href in a page to a path relative to the page's own file. */
+function rewriteLinks(body: string, file: string, visit: (url: URL) => string): string {
+  const dir = path.posix.dirname(file);
+  return body.replace(/href="([^"]*)"/g, (match, raw: string) => {
+    const href = unescapeHtml(raw);
+    if (!href.startsWith("/")) return match;
+    const hashAt = href.indexOf("#");
+    const hash = hashAt >= 0 ? href.slice(hashAt) : "";
+    const target = visit(canonical(hashAt >= 0 ? href.slice(0, hashAt) : href));
+    return `href="${escapeHtml(path.posix.relative(dir, target) + hash)}"`;
+  });
+}
+
+const yieldToLoop = (): Promise<void> => new Promise((resolve) => setImmediate(resolve));
+
+/** Renders every page reachable from `/`, as files whose links point at each other, one page per event-loop turn. */
+export async function* crawlDashboard(render: ExportRenderer): AsyncGenerator<ZipEntry> {
+  const files = new Map<string, string>();
+  const queue: URL[] = [];
+  const visit = (url: URL): string => {
+    const key = url.pathname + url.search;
+    const known = files.get(key);
+    if (known !== undefined) return known;
+    if (files.size >= MAX_PAGES) throw new Error(`dashboard export exceeds ${MAX_PAGES} pages`);
+    const file = exportFile(url);
+    files.set(key, file);
+    queue.push(url);
+    return file;
+  };
+  visit(new URL("/", BASE));
+  for (let i = 0; i < queue.length; i++) {
+    const url = queue[i] as URL;
+    const file = files.get(url.pathname + url.search) as string;
+    const page = render(url);
+    const body = page.text ? page.body : rewriteLinks(page.body, file, visit);
+    yield { path: file, data: Buffer.from(body, "utf8") };
+    await yieldToLoop();
+  }
+}
+
+function dosDateTime(date: Date): { time: number; date: number } {
+  const year = Math.min(Math.max(date.getUTCFullYear(), 1980), 2107);
+  return {
+    time: (date.getUTCHours() << 11) | (date.getUTCMinutes() << 5) | (date.getUTCSeconds() >> 1),
+    date: ((year - 1980) << 9) | ((date.getUTCMonth() + 1) << 5) | date.getUTCDate(),
+  };
+}
+
+interface ZipRecord {
+  name: Buffer;
+  method: number;
+  crc: number;
+  compressedSize: number;
+  size: number;
+  offset: number;
+}
+
+function zipHeader(signature: number, record: ZipRecord, stamp: { time: number; date: number }): Buffer {
+  const header = Buffer.alloc(26);
+  header.writeUInt16LE(20, 0);
+  header.writeUInt16LE(0x0800, 2);
+  header.writeUInt16LE(record.method, 4);
+  header.writeUInt16LE(stamp.time, 6);
+  header.writeUInt16LE(stamp.date, 8);
+  header.writeUInt32LE(record.crc, 10);
+  header.writeUInt32LE(record.compressedSize, 14);
+  header.writeUInt32LE(record.size, 18);
+  header.writeUInt16LE(record.name.length, 22);
+  header.writeUInt16LE(0, 24);
+  const sig = Buffer.alloc(4);
+  sig.writeUInt32LE(signature, 0);
+  return Buffer.concat([sig, header]);
+}
+
+function centralEntry(record: ZipRecord, stamp: { time: number; date: number }): Buffer {
+  const madeBy = Buffer.alloc(2);
+  madeBy.writeUInt16LE(20, 0);
+  const tail = Buffer.alloc(14);
+  tail.writeUInt16LE(0, 0);
+  tail.writeUInt16LE(0, 2);
+  tail.writeUInt16LE(0, 4);
+  tail.writeUInt32LE(0, 6);
+  tail.writeUInt32LE(record.offset, 10);
+  const header = zipHeader(0x02014b50, record, stamp);
+  return Buffer.concat([header.subarray(0, 4), madeBy, header.subarray(4), tail, record.name]);
+}
+
+/** A zip archive streamed one entry at a time: deflated where smaller, UTF-8 names, the given modification time. */
+export async function* zipArchive(entries: AsyncIterable<ZipEntry> | Iterable<ZipEntry>, mtime = new Date()): AsyncGenerator<Buffer> {
+  const stamp = dosDateTime(mtime);
+  const records: ZipRecord[] = [];
+  let offset = 0;
+  for await (const entry of entries) {
+    if (records.length >= ZIP_MAX_ENTRIES) throw new Error(`dashboard export exceeds ${ZIP_MAX_ENTRIES} files; zip64 is not supported`);
+    const deflated = zlib.deflateRawSync(entry.data);
+    const compressed = deflated.length < entry.data.length ? deflated : entry.data;
+    const record: ZipRecord = {
+      name: Buffer.from(entry.path, "utf8"),
+      method: compressed === deflated ? 8 : 0,
+      crc: zlib.crc32(entry.data),
+      compressedSize: compressed.length,
+      size: entry.data.length,
+      offset,
+    };
+    const local = Buffer.concat([zipHeader(0x04034b50, record, stamp), record.name, compressed]);
+    records.push(record);
+    offset += local.length;
+    if (offset > ZIP_MAX_BYTES) throw new Error("dashboard export exceeds 4 GiB; zip64 is not supported");
+    yield local;
+  }
+  const central = Buffer.concat(records.map((record) => centralEntry(record, stamp)));
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(0x06054b50, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(records.length, 8);
+  end.writeUInt16LE(records.length, 10);
+  end.writeUInt32LE(central.length, 12);
+  end.writeUInt32LE(offset, 16);
+  end.writeUInt16LE(0, 20);
+  yield Buffer.concat([central, end]);
+}
+
+async function* underFolder(entries: AsyncIterable<ZipEntry>, folder: string): AsyncGenerator<ZipEntry> {
+  for await (const entry of entries) yield { ...entry, path: `${folder}/${entry.path}` };
+}
+
+/** Crawls the dashboard into a zip, streamed as it is built, whose top-level folder holds index.html. */
+export function exportDashboard(render: ExportRenderer, folder: string, now = new Date()): AsyncGenerator<Buffer> {
+  return zipArchive(underFolder(crawlDashboard(render), folder), now);
+}
+
+/** The whole stream in one buffer, for callers that want the finished archive. */
+export async function collect(chunks: AsyncIterable<Buffer>): Promise<Buffer> {
+  const parts: Buffer[] = [];
+  for await (const chunk of chunks) parts.push(chunk);
+  return Buffer.concat(parts);
+}

package/src/dashboard-html.ts

@@ -39,6 +39,8 @@ export interface RenderContext {
   origin?: string | undefined;
   /** The run the collaboration and graph links target: this page's run, else the newest. */
   navRun?: string | undefined;
+  /** Rendering for the static export: no refresh, no export control, native disclosure. */
+  export?: boolean | undefined;
 }
 
 interface Crumb {
@@ -53,8 +55,25 @@ const CSS =
   "th{background:#eee}pre{white-space:pre-wrap;word-break:break-word;margin:0}" +
   "nav a{margin-right:8px}.r{text-align:right}h1,h2{font-size:13px;margin:8px 0 4px}" +
   "details>summary{cursor:pointer}a{color:#000}" +
+  ".export{position:absolute;top:8px;right:8px;line-height:0}" +
+  ".modal{display:none;position:fixed;inset:0;background:rgba(0,0,0,.7)}" +
+  ".modal:target{display:flex;align-items:center;justify-content:center}" +
+  ".modal-box{background:#fff;border:3px solid #000;padding:32px;width:min(90vw,760px);font-size:18px;line-height:1.5}" +
+  ".modal-box h2{font-size:24px;margin:0 0 16px}" +
+  ".modal-box .btn{display:inline-block;border:2px solid #000;padding:8px 16px;margin-right:12px}" +
   GRAPH_CSS;
 
+const EXPORT_ICON =
+  '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="22" height="22" aria-hidden="true">' +
+  '<path d="M12 3v12m0 0l-5-5m5 5l5-5M4 17v3h16v-3" fill="none" stroke="currentColor" stroke-width="2" ' +
+  'stroke-linecap="round" stroke-linejoin="round"/></svg>';
+
+const EXPORT_WARNING =
+  "The zip holds every page of this dashboard as static HTML: every run, every member transcript and log, " +
+  "the run documents, the shared ledgers and the event audit. Transcripts include everything members read " +
+  "and produced on this machine: file contents, command output, paths, and any secrets or credentials they " +
+  "encountered. Review the export before sharing it with anyone who should not see all of that.";
+
 const ESCAPES: Record<string, string> = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
 
 function escapeHtml(text: string): string {
@@ -182,12 +201,41 @@ function persistentDetails(body: string, href = "/"): string {
   });
 }
 
-export function page(title: string, crumbs: Crumb[], body: string, ctx: RenderContext): string {
-  body = persistentDetails(body, ctx.href);
-  const meta = ctx.refresh?.on ? `<meta http-equiv="refresh" content="${ctx.refresh.seconds}">` : "";
+/** The export opens the modal on the paused page, so a refresh cannot close it; cancel restores the page. */
+function exportControl(ctx: RenderContext): string {
+  if (ctx.export) return "";
+  const current = ctx.href ?? "/";
+  const paused = ctx.refresh?.on ? ctx.refresh.toggleHref : current;
+  return (
+    `<a class="export" href="${e(`${paused}#export`)}" title="export dashboard" aria-label="export dashboard">${EXPORT_ICON}</a>` +
+    `<div id="export" class="modal"><div class="modal-box"><h2>Export this dashboard?</h2><p>${EXPORT_WARNING}</p>` +
+    `<p><a class="btn" href="${e(`/export${query({ back: current })}`)}">download zip</a><a class="btn" href="${e(current)}">cancel</a></p></div></div>`
+  );
+}
+
+/** Shown once the download is confirmed; it starts the download itself and says what the wait is. */
+export function renderExportStart(zipHref: string, backHref: string, ctx: RenderContext): string {
+  const body =
+    "<p>The archive is being packed one page at a time and streamed to your browser, so it appears in the " +
+    "browser's download list right away and grows until it is complete. A dashboard with long transcripts takes " +
+    "a while; the dashboard stays usable meanwhile.</p>" +
+    `<p>If no download appears, ${link(zipHref, "download it directly")}.</p>` +
+    `<p>${link(backHref, "back to the dashboard")}</p>`;
+  const start = `<meta http-equiv="refresh" content="0;url=${e(zipHref)}">`;
+  return page("exporting dashboard", [{ text: "runs", href: "/" }, { text: "export" }], body, { ...ctx, refresh: undefined }, start);
+}
+
+/** The static export has no server, so disclosure falls back to the browser's own details element. */
+function nativeDetails(body: string): string {
+  return body.replace(/<details data-expand="[a-f0-9]+">/g, "<details>");
+}
+
+export function page(title: string, crumbs: Crumb[], body: string, ctx: RenderContext, head = ""): string {
+  body = ctx.export ? nativeDetails(body) : persistentDetails(body, ctx.href);
+  const meta = ctx.refresh?.on ? `<meta http-equiv="refresh" content="${ctx.refresh.seconds}">` : head;
   return (
     `<!doctype html><html><head><meta charset="utf-8"><title>${e(title)}</title>${meta}` +
-    `<style>${CSS}</style></head><body>${nav(ctx)}${crumbLine(crumbs)}${refreshLine(ctx)}` +
+    `<style>${CSS}</style></head><body>${exportControl(ctx)}${nav(ctx)}${crumbLine(crumbs)}${refreshLine(ctx)}` +
     `<h1>${e(title)}</h1>${body}</body></html>`
   );
 }
@@ -331,7 +379,7 @@ export function renderMemberDetail(vm: MemberDetailVm, ctx: RenderContext): stri
     ["session file", vm.sessionFile ? e(vm.sessionFile) : "none mapped; see " + link(`${runHref(vm.runId)}/sessions`, "session files")],
   ];
   const transcript = vm.sessionFile
-    ? `<p>${link(`${base}/transcript?from=last&n=40`, "transcript (tail)")} | ${link(`${base}/transcript?from=0&n=50`, "transcript (start)")}</p>`
+    ? `<p>${link(`${base}/transcript?from=last&n=${TRANSCRIPT_PAGE}`, "transcript (tail)")} | ${link(`${base}/transcript?from=0&n=${TRANSCRIPT_PAGE}`, "transcript (start)")}</p>`
     : "";
   const last = vm.lastText ? `<h2>last text</h2>${pre(vm.lastText)}` : "";
   const final = vm.finalText
@@ -359,6 +407,8 @@ export function renderMemberLog(vm: MemberLogVm, ctx: RenderContext): string {
 // Transcript
 // ---------------------------------------------------------------------------
 
+const TRANSCRIPT_PAGE = 50;
+
 function transcriptBase(vm: { runId: string; member?: string | undefined; file: string }): string {
   return vm.member
     ? `${memberHref(vm.runId, vm.member)}/transcript`
@@ -409,18 +459,27 @@ function entryRow(entry: TranscriptEntry, base: string, full: boolean, file: str
   return [link(href, `#${entry.index}`), clock(entry.timestamp), entryRole(entry), content, entryUsage(entry)];
 }
 
-function pagingBar(vm: TranscriptVm, base: string): string {
+/** The export crawls one page size, so it offers no size links. */
+function pagingBar(vm: TranscriptVm, base: string, ctx: RenderContext): string {
   const to = Math.min(vm.total, vm.from + vm.n);
   const go = (from: number | "last", n = vm.n): string => `${base}${query({ from: String(from), n: String(n) })}`;
   const prev = vm.from > 0 ? link(go(Math.max(0, vm.from - vm.n)), "prev") : "prev";
   const next = vm.hasMore ? link(go(vm.from + vm.n), "next") : "next";
-  const sizes = [20, 50, 100].map((n) => (n === vm.n ? `n=${n}` : link(go(vm.from, n), `n=${n}`))).join(" ");
+  const sizes = ctx.export
+    ? ""
+    : ` | ${[20, 50, 100].map((n) => (n === vm.n ? `n=${n}` : link(go(vm.from, n), `n=${n}`))).join(" ")}`;
   return (
     `<p>entries ${vm.from}..${to} of ${vm.total} | ${link(go(0), "first")} ${prev} ${next} ` +
-    `${link(go("last"), "last")} | ${sizes}</p>`
+    `${link(go("last"), "last")}${sizes}</p>`
   );
 }
 
+/** Live pages centre the entry in a short window; the export returns to the crawled page holding it. */
+function transcriptPageHref(base: string, index: number, ctx: RenderContext): string {
+  if (ctx.export) return `${base}?from=${Math.floor(index / TRANSCRIPT_PAGE) * TRANSCRIPT_PAGE}&n=${TRANSCRIPT_PAGE}`;
+  return `${base}?from=${Math.max(0, index - 10)}&n=20`;
+}
+
 function transcriptCrumbs(vm: { runId: string; member?: string | undefined; file: string }, leaf: string): Crumb[] {
   const crumbs: Crumb[] = [{ text: "runs", href: "/" }, { text: vm.runId, href: runHref(vm.runId) }];
   if (vm.member) crumbs.push({ text: vm.member, href: memberHref(vm.runId, vm.member) });
@@ -433,18 +492,17 @@ export function renderTranscript(vm: TranscriptVm, ctx: RenderContext): string {
   const base = transcriptBase(vm);
   const body =
     `<p>file ${e(vm.file)}${vm.sessionId ? `, session ${e(vm.sessionId)}` : ""}${vm.cwd ? `, cwd ${e(vm.cwd)}` : ""}</p>` +
-    pagingBar(vm, base) +
+    pagingBar(vm, base, ctx) +
     table(["#", "time", "role", "content", "in/out"], vm.entries.map((entry) => entryRow(entry, base, false, vm.file)), "no entries") +
-    pagingBar(vm, base);
+    pagingBar(vm, base, ctx);
   const title = `${vm.member ?? vm.file} transcript`;
   return page(title, transcriptCrumbs(vm, "transcript"), body, ctx);
 }
 
 export function renderTranscriptEntry(vm: TranscriptEntryVm, ctx: RenderContext): string {
   const base = transcriptBase(vm);
-  const from = Math.max(0, vm.entry.index - 10);
   const body =
-    `<p>${link(`${base}?from=${from}&n=20`, "back to transcript")}</p>` +
+    `<p>${link(transcriptPageHref(base, vm.entry.index, ctx), "back to transcript")}</p>` +
     table(["#", "time", "role", "content", "in/out"], [entryRow(vm.entry, base, true, vm.file)]) +
     details("raw json", pre(vm.raw), `${base}:${vm.file}:${vm.entry.index}:raw`);
   return page(`entry #${vm.entry.index}`, transcriptCrumbs(vm, `#${vm.entry.index}`), body, ctx);
@@ -529,16 +587,17 @@ function findingsHref(vm: FindingsVm, open: number[]): string {
   return `/findings${query({ run: vm.run, view: vm.view, open: open.length > 0 ? open.join(",") : undefined })}`;
 }
 
-/** The body is expanded when its id is in the URL, so the state survives auto-refresh. */
-function findingBody(f: FindingEntry, vm: FindingsVm): string {
+/** The body is expanded when its id is in the URL, so the state survives auto-refresh; the export shows it inline. */
+function findingBody(f: FindingEntry, vm: FindingsVm, ctx: RenderContext): string {
   if (!f.body) return "";
+  if (ctx.export) return pre(f.body);
   if (vm.open.includes(f.id)) {
     return pre(f.body) + link(findingsHref(vm, vm.open.filter((id) => id !== f.id)), "[hide body]");
   }
   return ` ${link(findingsHref(vm, [...vm.open, f.id]), "[show body]")}`;
 }
 
-function findingRow(f: FindingEntry, vm: FindingsVm): string[] {
+function findingRow(f: FindingEntry, vm: FindingsVm, ctx: RenderContext): string[] {
   const idea = f.ideaId === undefined ? "" : link(`/ideas#idea-${f.ideaId}`, `#${f.ideaId}`);
   const authors = [f.author, ...f.corroborators].map((a) => authorLink(a, f.runId)).join(", ");
   const title = (f.supersededBy !== undefined ? "<b>SUPERSEDED</b> " : "") + e(f.title);
@@ -555,7 +614,7 @@ function findingRow(f: FindingEntry, vm: FindingsVm): string[] {
     f.supersedes === undefined ? "" : link(`#F${f.supersedes}`, `F${f.supersedes}`),
     f.supersededBy === undefined ? "" : link(`#F${f.supersededBy}`, `F${f.supersededBy}`),
     e(vm.reviewStates?.[f.id] ?? (f.verifiedBy ? `legacy (${f.verifiedBy})` : "unreviewed")),
-    title + findingBody(f, vm),
+    title + findingBody(f, vm, ctx),
   ];
 }
 
@@ -577,13 +636,13 @@ export function renderFindings(vm: FindingsVm, ctx: RenderContext): string {
         const deltas = cluster.deltaMembers.length > 0 ? `; deltas ${cluster.deltaMembers.join(", ")}` : "";
         return (
           `<h2>cluster ${i + 1}: F${cluster.representative}, members ${e(members)}${e(deltas)}</h2>` +
-          table(FINDING_HEADERS, cluster.findings.map((f) => findingRow(f, vm)))
+          table(FINDING_HEADERS, cluster.findings.map((f) => findingRow(f, vm, ctx)))
         );
       })
       .join("");
     if (vm.clusters.length === 0) body += "<p>no findings</p>";
   } else {
-    body += table(FINDING_HEADERS, vm.findings.map((f) => findingRow(f, vm)), "no findings");
+    body += table(FINDING_HEADERS, vm.findings.map((f) => findingRow(f, vm, ctx)), "no findings");
   }
   return page("findings", [{ text: "findings" }], body, ctx);
 }