instar 0.19.4 → 0.19.7

package/README.md

@@ -11,14 +11,14 @@
 <p align="center">
   <a href="https://www.npmjs.com/package/instar"><img src="https://img.shields.io/npm/v/instar?style=flat-square" alt="npm version"></a>
   <a href="https://www.npmjs.com/package/instar"><img src="https://img.shields.io/npm/dw/instar?style=flat-square" alt="npm downloads"></a>
-  <a href="https://github.com/SageMindAI/instar/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/SageMindAI/instar/ci.yml?branch=main&style=flat-square&label=CI" alt="CI"></a>
-  <a href="https://github.com/SageMindAI/instar/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-green?style=flat-square" alt="License"></a>
+  <a href="https://github.com/JKHeadley/instar/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/JKHeadley/instar/ci.yml?branch=main&style=flat-square&label=CI" alt="CI"></a>
+  <a href="https://github.com/JKHeadley/instar/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-MIT-green?style=flat-square" alt="License"></a>
   <img src="https://img.shields.io/badge/TypeScript-100%25-blue?style=flat-square&logo=typescript&logoColor=white" alt="TypeScript">
   <a href="https://instar.sh/introduction/"><img src="https://img.shields.io/badge/Docs-instar.sh-teal?style=flat-square" alt="Docs"></a>
 </p>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/instar">npm</a> · <a href="https://github.com/SageMindAI/instar">GitHub</a> · <a href="https://instar.sh">instar.sh</a> · <a href="https://instar.sh/introduction/">Docs</a>
+  <a href="https://www.npmjs.com/package/instar">npm</a> · <a href="https://github.com/JKHeadley/instar">GitHub</a> · <a href="https://instar.sh">instar.sh</a> · <a href="https://instar.sh/introduction/">Docs</a>
 </p>
 
 ---

package/dashboard/index.html

@@ -246,6 +246,190 @@
     .empty-state .icon { font-size: 32px; margin-bottom: 12px; opacity: 0.5; }
     .empty-state p { font-size: 13px; line-height: 1.5; }
 
+    /* Drop Zone */
+    .dropzone-container {
+      display: flex;
+      justify-content: center;
+      padding: 24px;
+      overflow-y: auto;
+      height: calc(100vh - 56px);
+    }
+    .dropzone-panel {
+      width: 100%;
+      max-width: 720px;
+    }
+    .dropzone-header h2 {
+      color: var(--text-bright);
+      font-size: 20px;
+      margin-bottom: 4px;
+    }
+    .dropzone-subtitle {
+      color: var(--text-dim);
+      font-size: 13px;
+      margin-bottom: 20px;
+    }
+    .dropzone-form {
+      display: flex;
+      flex-direction: column;
+      gap: 12px;
+    }
+    .dropzone-label {
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: 6px;
+      padding: 10px 12px;
+      color: var(--text);
+      font-size: 14px;
+      outline: none;
+    }
+    .dropzone-label:focus { border-color: var(--accent); }
+    .dropzone-textarea-wrap {
+      position: relative;
+    }
+    .dropzone-textarea {
+      width: 100%;
+      min-height: 200px;
+      max-height: 60vh;
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: 6px;
+      padding: 12px;
+      color: var(--text);
+      font-family: 'SF Mono', 'Fira Code', 'Consolas', monospace;
+      font-size: 13px;
+      line-height: 1.5;
+      resize: vertical;
+      outline: none;
+      box-sizing: border-box;
+    }
+    .dropzone-textarea:focus { border-color: var(--accent); }
+    .dropzone-count {
+      position: absolute;
+      bottom: 8px;
+      right: 12px;
+      font-size: 11px;
+      color: var(--text-dim);
+      pointer-events: none;
+    }
+    .dropzone-actions {
+      display: flex;
+      gap: 10px;
+      align-items: center;
+    }
+    .dropzone-session-select {
+      flex: 1;
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: 6px;
+      padding: 10px 12px;
+      color: var(--text);
+      font-size: 13px;
+      outline: none;
+    }
+    .dropzone-send-btn {
+      background: var(--accent);
+      color: #fff;
+      border: none;
+      border-radius: 6px;
+      padding: 10px 24px;
+      font-size: 14px;
+      font-weight: 600;
+      cursor: pointer;
+      transition: background 0.2s;
+    }
+    .dropzone-send-btn:hover { background: #4fa0d8; }
+    .dropzone-send-btn:disabled { background: #555; cursor: not-allowed; }
+    .dropzone-disclosure {
+      font-size: 11px;
+      color: var(--text-dim);
+      font-style: italic;
+    }
+    .dropzone-status {
+      margin-top: 12px;
+      padding: 10px 14px;
+      border-radius: 6px;
+      font-size: 13px;
+    }
+    .dropzone-status.success {
+      background: rgba(46, 160, 67, 0.15);
+      color: #3fb950;
+      border: 1px solid rgba(46, 160, 67, 0.3);
+    }
+    .dropzone-status.error {
+      background: rgba(248, 81, 73, 0.15);
+      color: #f85149;
+      border: 1px solid rgba(248, 81, 73, 0.3);
+    }
+    .dropzone-status.queued {
+      background: rgba(210, 153, 34, 0.15);
+      color: #d29922;
+      border: 1px solid rgba(210, 153, 34, 0.3);
+    }
+    .dropzone-history {
+      margin-top: 28px;
+    }
+    .dropzone-history h3 {
+      color: var(--text-bright);
+      font-size: 15px;
+      margin-bottom: 12px;
+    }
+    .dropzone-history-list {
+      display: flex;
+      flex-direction: column;
+      gap: 8px;
+    }
+    .dropzone-empty {
+      color: var(--text-dim);
+      font-size: 13px;
+      font-style: italic;
+    }
+    .dz-paste-item {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      background: var(--surface);
+      border: 1px solid var(--border);
+      border-radius: 6px;
+      padding: 10px 14px;
+    }
+    .dz-paste-info {
+      display: flex;
+      flex-direction: column;
+      gap: 2px;
+    }
+    .dz-paste-label {
+      color: var(--text);
+      font-size: 13px;
+      font-weight: 500;
+    }
+    .dz-paste-meta {
+      color: var(--text-dim);
+      font-size: 11px;
+    }
+    .dz-paste-status {
+      font-size: 11px;
+      padding: 2px 8px;
+      border-radius: 4px;
+      font-weight: 500;
+    }
+    .dz-paste-status.written { background: rgba(210, 153, 34, 0.2); color: #d29922; }
+    .dz-paste-status.notified { background: rgba(46, 160, 67, 0.2); color: #3fb950; }
+    .dz-paste-status.acknowledged { background: rgba(56, 132, 255, 0.2); color: #58a6ff; }
+    .dz-paste-delete {
+      background: none;
+      border: none;
+      color: var(--text-dim);
+      cursor: pointer;
+      font-size: 14px;
+      padding: 4px 8px;
+    }
+    .dz-paste-delete:hover { color: #f85149; }
+    @media (max-width: 768px) {
+      .dropzone-container { padding: 16px; }
+      .dropzone-actions { flex-direction: column; }
+      .dropzone-session-select { width: 100%; }
+    }
+
     /* WhatsApp QR panel */
     .wa-qr-panel {
       position: fixed;
@@ -1295,6 +1479,7 @@
         <nav class="tab-bar">
           <button class="tab active" data-tab="sessions" onclick="switchTab('sessions')">Sessions <span class="tab-count" id="tabSessionCount">0</span></button>
           <button class="tab" data-tab="files" onclick="switchTab('files')">Files</button>
+          <button class="tab" data-tab="dropzone" onclick="switchTab('dropzone')">Drop Zone</button>
         </nav>
       </div>
       <button class="wa-status-btn" id="waStatusBtn" onclick="toggleQrPanel()">WhatsApp</button>
@@ -1396,6 +1581,45 @@
     </div>
   </div>
 
+  <!-- Drop Zone tab -->
+  <div class="dropzone-container" id="dropzoneTab" style="display:none">
+    <div class="dropzone-panel">
+      <div class="dropzone-header">
+        <h2>Drop Zone</h2>
+        <p class="dropzone-subtitle">Send large text content to your agent session</p>
+      </div>
+
+      <div class="dropzone-form">
+        <input type="text" class="dropzone-label" id="dzLabel"
+          placeholder="What is this? (optional)" maxlength="256">
+
+        <div class="dropzone-textarea-wrap">
+          <textarea class="dropzone-textarea" id="dzContent"
+            placeholder="Paste your content here..."
+            oninput="updateDzCount()"></textarea>
+          <div class="dropzone-count" id="dzCount">0 chars &middot; ~0 tokens</div>
+        </div>
+
+        <div class="dropzone-actions">
+          <select class="dropzone-session-select" id="dzSession">
+            <option value="">Auto (most recent session)</option>
+          </select>
+          <button class="dropzone-send-btn" id="dzSendBtn" onclick="sendPaste()">Send</button>
+        </div>
+        <div class="dropzone-disclosure">Stored locally for up to 7 days. Avoid pasting secrets or credentials.</div>
+      </div>
+
+      <div class="dropzone-status" id="dzStatus" style="display:none"></div>
+
+      <div class="dropzone-history">
+        <h3>Recent Pastes</h3>
+        <div class="dropzone-history-list" id="dzHistoryList">
+          <div class="dropzone-empty">No pastes yet</div>
+        </div>
+      </div>
+    </div>
+  </div>
+
   <!-- WhatsApp QR panel (hidden by default) -->
   <div class="wa-qr-backdrop" id="waQrBackdrop" style="display:none" onclick="closeQrPanel()"></div>
   <div class="wa-qr-panel" id="waQrPanel" style="display:none">
@@ -2011,17 +2235,27 @@
       const sessionsTab = document.getElementById('sessionsTab');
       const mainPanel = document.getElementById('mainPanel');
       const filesTab = document.getElementById('filesTab');
+      const dropzoneTab = document.getElementById('dropzoneTab');
+
+      sessionsTab.style.display = 'none';
+      mainPanel.style.display = 'none';
+      filesTab.style.display = 'none';
+      dropzoneTab.style.display = 'none';
 
       if (tabName === 'sessions') {
         sessionsTab.style.display = '';
         mainPanel.style.display = '';
-        filesTab.style.display = 'none';
       } else if (tabName === 'files') {
-        sessionsTab.style.display = 'none';
-        mainPanel.style.display = 'none';
         filesTab.style.display = 'flex';
         // Load file tree on first switch
         if (!fileTreeLoaded) loadFileTree();
+      } else if (tabName === 'dropzone') {
+        dropzoneTab.style.display = 'flex';
+        // Auto-focus textarea
+        setTimeout(() => document.getElementById('dzContent')?.focus(), 100);
+        // Load session list and paste history
+        loadDzSessions();
+        loadDzHistory();
       }
 
       // Update URL
@@ -2759,6 +2993,169 @@
     deepLinkObserver.observe(document.getElementById('authOverlay'), {
       attributes: true, attributeFilter: ['style'],
     });
+
+    // ── Drop Zone ──────────────────────────────────────────────
+
+    function updateDzCount() {
+      const content = document.getElementById('dzContent').value;
+      const chars = content.length;
+      // Rough token estimate: ~4 chars per token for English
+      const tokens = Math.round(chars / 4);
+      document.getElementById('dzCount').textContent =
+        `${chars.toLocaleString()} chars \u00b7 ~${tokens.toLocaleString()} tokens`;
+    }
+
+    async function loadDzSessions() {
+      const select = document.getElementById('dzSession');
+      // Keep the first "Auto" option, remove the rest
+      while (select.options.length > 1) select.remove(1);
+
+      // Use the cached session list from WebSocket if available
+      if (sessions && sessions.length > 0) {
+        const interactive = sessions.filter(s => !s.jobSlug);
+        for (const s of interactive) {
+          const opt = document.createElement('option');
+          opt.value = s.name;
+          opt.textContent = s.name + (s.model ? ` (${s.model})` : '');
+          select.appendChild(opt);
+        }
+      }
+    }
+
+    async function loadDzHistory() {
+      try {
+        const resp = await fetch('/pastes', {
+          headers: { 'Authorization': 'Bearer ' + token },
+        });
+        if (!resp.ok) return;
+        const data = await resp.json();
+        renderDzHistory(data.pastes || []);
+      } catch {}
+    }
+
+    function renderDzHistory(pastes) {
+      const list = document.getElementById('dzHistoryList');
+      if (!pastes.length) {
+        list.innerHTML = '<div class="dropzone-empty">No pastes yet</div>';
+        return;
+      }
+      list.innerHTML = pastes.slice(0, 20).map(p => {
+        const age = timeAgo(new Date(p.timestamp));
+        const label = p.label || '(unlabeled)';
+        const chars = p.contentLength.toLocaleString();
+        return `
+          <div class="dz-paste-item" data-paste-id="${esc(p.pasteId)}">
+            <div class="dz-paste-info">
+              <span class="dz-paste-label">${esc(label)}</span>
+              <span class="dz-paste-meta">${chars} chars &middot; ${age}</span>
+            </div>
+            <div style="display:flex;align-items:center;gap:8px">
+              <span class="dz-paste-status ${p.status}">${p.status}</span>
+              <button class="dz-paste-delete" onclick="deletePaste('${esc(p.pasteId)}')" title="Delete">&times;</button>
+            </div>
+          </div>`;
+      }).join('');
+    }
+
+    async function sendPaste() {
+      const content = document.getElementById('dzContent').value.trim();
+      if (!content) return;
+
+      const label = document.getElementById('dzLabel').value.trim() || undefined;
+      const targetSession = document.getElementById('dzSession').value || undefined;
+      const btn = document.getElementById('dzSendBtn');
+      const status = document.getElementById('dzStatus');
+
+      btn.disabled = true;
+      btn.textContent = 'Sending...';
+      status.style.display = 'none';
+
+      try {
+        const resp = await fetch('/pastes', {
+          method: 'POST',
+          headers: {
+            'Authorization': 'Bearer ' + token,
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify({ content, label, targetSession }),
+        });
+
+        const data = await resp.json();
+
+        if (resp.ok && data.ok) {
+          const chars = data.contentLength?.toLocaleString() || content.length.toLocaleString();
+          if (data.status === 'notified') {
+            status.className = 'dropzone-status success';
+            status.textContent = `Sent ${chars} chars to session "${data.sessionName}"`;
+          } else {
+            status.className = 'dropzone-status queued';
+            status.textContent = `Queued ${chars} chars \u2014 will be delivered when a session starts.`;
+          }
+          status.style.display = 'block';
+
+          // Clear form
+          document.getElementById('dzContent').value = '';
+          document.getElementById('dzLabel').value = '';
+          updateDzCount();
+
+          // Refresh history
+          loadDzHistory();
+        } else {
+          status.className = 'dropzone-status error';
+          status.textContent = data.message || data.error || 'Failed to send paste';
+          status.style.display = 'block';
+        }
+      } catch (err) {
+        status.className = 'dropzone-status error';
+        status.textContent = 'Network error: ' + err.message;
+        status.style.display = 'block';
+      }
+
+      btn.disabled = false;
+      btn.textContent = 'Send';
+    }
+
+    async function deletePaste(pasteId) {
+      try {
+        await fetch('/pastes/' + encodeURIComponent(pasteId), {
+          method: 'DELETE',
+          headers: { 'Authorization': 'Bearer ' + token },
+        });
+        loadDzHistory();
+      } catch {}
+    }
+
+    function timeAgo(date) {
+      const seconds = Math.floor((Date.now() - date.getTime()) / 1000);
+      if (seconds < 60) return 'just now';
+      const minutes = Math.floor(seconds / 60);
+      if (minutes < 60) return minutes + 'm ago';
+      const hours = Math.floor(minutes / 60);
+      if (hours < 24) return hours + 'h ago';
+      const days = Math.floor(hours / 24);
+      return days + 'd ago';
+    }
+
+    function esc(s) {
+      const d = document.createElement('div');
+      d.textContent = s;
+      return d.innerHTML;
+    }
+
+    // Listen for WebSocket paste events
+    const origWsOnMessage = ws?.onmessage;
+    if (typeof ws !== 'undefined') {
+      const origOnMessage = ws.onmessage;
+      ws.addEventListener('message', function(event) {
+        try {
+          const msg = JSON.parse(event.data);
+          if (msg.type === 'paste_delivered' || msg.type === 'paste_acknowledged') {
+            loadDzHistory();
+          }
+        } catch {}
+      });
+    }
+
   </script>
 </body>
 </html>

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAoPH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAw+BD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAsvEtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAqPH,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAy+BD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0xEtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E"}

package/dist/commands/server.js

@@ -70,6 +70,7 @@ import { LiveConfig } from '../config/LiveConfig.js';
 import { CoherenceMonitor } from '../monitoring/CoherenceMonitor.js';
 import { ProcessIntegrity } from '../core/ProcessIntegrity.js';
 import { StaleProcessGuard } from '../core/StaleProcessGuard.js';
+import { cleanupGlobalInstalls } from '../core/GlobalInstallCleanup.js';
 import { ForegroundRestartWatcher } from '../core/ForegroundRestartWatcher.js';
 import { NotificationBatcher } from '../messaging/NotificationBatcher.js';
 import { MessageStore } from '../messaging/MessageStore.js';
@@ -730,7 +731,12 @@ function wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory
             ? userManager.resolveFromTelegramUserId(telegramUserId)
             : null;
         // Most commands are handled inside TelegramAdapter.handleCommand().
-        // /new is handled here because it needs sessionManager access.
+        // /new — create a new topic thread. Does NOT spawn a session immediately.
+        // Sessions are spawned on-demand when the user sends their first real message
+        // in the new topic (via the auto-spawn path below). This avoids premature
+        // session exit: spawning with a meta-message ("new session started") gives
+        // Claude nothing real to do, so it responds and exits. The user's actual
+        // message then arrives to a dead session.
         const newMatch = text.match(/^\/new(?:\s+(.+))?$/);
         if (newMatch) {
             const sessionName = newMatch[1]?.trim() || null;
@@ -740,16 +746,15 @@ function wireTelegramRouting(telegram, sessionManager, quotaTracker, topicMemory
             (async () => {
                 try {
                     const topic = await telegram.findOrCreateForumTopic(topicDisplayName, TOPIC_STYLE.SESSION.color);
-                    const newSession = await sessionManager.spawnInteractiveSession(`[telegram:${topic.topicId}] New session started. (IMPORTANT: Relay all responses back via: cat <<'EOF' | .claude/scripts/telegram-reply.sh ${topic.topicId}\nYour response\nEOF)`, topicName);
-                    telegram.registerTopicSession(topic.topicId, newSession, topicName);
-                    await telegram.sendToTopic(topic.topicId, `Session created. I'm here.`);
-                    await telegram.sendToTopic(topicId, `New session created: "${topicName}" — check the new topic above.`);
-                    console.log(`[telegram] Spawned session "${newSession}" for new topic ${topic.topicId}`);
+                    // Don't create a session — findOrCreateForumTopic already stored the topic name.
+                    // The first message in this topic will trigger auto-spawn with real content.
+                    await telegram.sendToTopic(topic.topicId, `Ready — send your first message to start.`);
+                    await telegram.sendToTopic(topicId, `Created topic "${topicName}" — head over there.`);
+                    console.log(`[telegram] Created topic "${topicName}" (${topic.topicId}) — session will spawn on first message`);
                 }
                 catch (err) {
                     console.error(`[telegram] /new failed:`, err);
-                    console.error(`[telegram] Session spawn failed:`, err);
-                    await telegram.sendToTopic(topicId, 'Couldn\'t create the new session. Try again in a moment.').catch(() => { });
+                    await telegram.sendToTopic(topicId, 'Couldn\'t create the topic. Try again in a moment.').catch(() => { });
                 }
             })();
             return;
@@ -1218,6 +1223,29 @@ export async function startServer(options) {
             console.warn(pc.red(`  rm -rf ${path.join(process.cwd(), 'node_modules')} ${path.join(process.cwd(), 'package.json')} ${path.join(process.cwd(), 'package-lock.json')}`));
             console.warn();
         }
+        // ── Global install cleanup ─────────────────────────────────────────
+        // Shadow installs are the sole source of truth. Global installs cause
+        // version confusion — agents report stale versions when CLI commands
+        // resolve to a global binary instead of the shadow install.
+        // Clean up any lingering globals at startup (idempotent, safe to run every time).
+        try {
+            const cleanup = cleanupGlobalInstalls();
+            if (cleanup.removed.length > 0) {
+                console.log(pc.green(`  ✓ Cleaned up ${cleanup.removed.length} stale global instar install(s):`));
+                for (const r of cleanup.removed) {
+                    console.log(pc.green(`    - ${r}`));
+                }
+            }
+            if (cleanup.failed.length > 0) {
+                for (const f of cleanup.failed) {
+                    console.warn(pc.yellow(`  ⚠ Failed to remove global install at ${f.path}: ${f.error}`));
+                }
+            }
+        }
+        catch (err) {
+            // Non-fatal — log and continue
+            console.warn(`[server] Global install cleanup error: ${err instanceof Error ? err.message : String(err)}`);
+        }
         // ── ProcessIntegrity: freeze the running version at startup ────────
         // This MUST happen before any version reporting. The version is captured
         // from the code loaded into memory, NOT from disk (which changes after
@@ -2264,6 +2292,18 @@ export async function startServer(options) {
             viewsDir: path.join(config.stateDir, 'views'),
         });
         console.log(pc.green(`  Private viewer enabled`));
+        // Set up paste manager (Drop Zone — always enabled)
+        const { PasteManager } = await import('../paste/PasteManager.js');
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- paste config fields are optional extensions
+        const cfgAny = config;
+        const pasteManager = new PasteManager({
+            pasteDir: path.join(config.stateDir, 'paste'),
+            stateDir: path.join(config.stateDir, 'state'),
+            projectDir: config.projectDir,
+            maxSizeBytes: cfgAny.pasteMaxSizeMB ? cfgAny.pasteMaxSizeMB * 1024 * 1024 : undefined,
+            retentionDays: cfgAny.pasteRetentionDays ?? undefined,
+        });
+        console.log(pc.green(`  Drop Zone (paste) enabled`));
         // Set up Cloudflare Tunnel — enabled by default (quick tunnel, zero-config)
         // Only disabled if explicitly set to tunnel.enabled = false
         const tunnelEnabled = config.tunnel?.enabled !== false;
@@ -2987,7 +3027,7 @@ export async function startServer(options) {
                 console.warn(pc.yellow(`  Response review pipeline: configured but ANTHROPIC_API_KEY not set`));
             }
         }
-        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, whatsapp: whatsappAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRelayClient, responseReviewGate, telemetryHeartbeat, liveConfig });
+        const server = new AgentServer({ config, sessionManager, state, scheduler, telegram, relationships, feedback, feedbackAnomalyDetector, dispatches, updateChecker, autoUpdater, autoDispatcher, quotaTracker, quotaManager, publisher, viewer, tunnel, evolution, watchdog, topicMemory, triageNurse, projectMapper, coherenceGate: scopeVerifier, contextHierarchy, canonicalState, operationGate, sentinel, adaptiveTrust, memoryMonitor, orphanReaper, coherenceMonitor, commitmentTracker, semanticMemory, activitySentinel, messageRouter, summarySentinel, spawnManager, systemReviewer, capabilityMapper, selfKnowledgeTree, coverageAuditor, topicResumeMap: _topicResumeMap ?? undefined, autonomyManager, trustElevationTracker, autonomousEvolution, coordinator: coordinator.enabled ? coordinator : undefined, localSigningKeyPem, whatsapp: whatsappAdapter, whatsappBusinessBackend, messageBridge, hookEventReceiver, worktreeMonitor, subagentTracker, instructionsVerifier, handshakeManager: threadlineHandshake, threadlineRelayClient, responseReviewGate, telemetryHeartbeat, pasteManager, liveConfig });
         await server.start();
         // Connect DegradationReporter downstream systems now that everything is initialized.
         // Any degradation events queued during startup will drain to feedback + telegram.