[JorimTheuns]

Stacked on #1371

What a host now does

On the template picker, above the cards, one quiet row: "Have an agenda or invitation? Drop it here and dembrane sets the project up." The host drops (or chooses, or drops anywhere on the page) up to 5 files, pastes text, or adds a link. dembrane reads them, then shows "Here is what dembrane understood": name, goal, project context, key terms, the template with its reason and two alternatives one press away (or any other from a list), rounds as tags, Verify options, the name box label, an Explore question built from the session's own questions, and up to three host script steps added after the template's guide. Each part can be edited in place or switched off, and each says which file it came from (the words on hover or focus). Create project makes the project with what is on, in one request. Start over goes back. Nothing is saved before Create.

If the digest fails or finds nothing useful, the normal picker comes back with the material's text in the project context (cut to 4,000 characters, with a note), so nothing is lost. On the name step, for hosts who picked a template by hand, a small "Add from a file" zone sits under "Suggest key terms": it adds the condensed context and proposes key terms.

What is sent where

• Files never leave the browser. PDF (text layer only, pdf.js), Word .docx (body) and PowerPoint .pptx (slides in order plus speaker notes, fflate), text and Markdown are read on the device. Only the extracted text, the file name, its kind and its length go to dembrane. The harness checks this with a network capture (no %PDF, no zip bytes, no multipart).
• dembrane's server sends that text to the model provider (text_fast) to prepare the setup. A link is read on our server with the same guard as setup suggestions. The line "Files stay on your device. Only their text is sent to dembrane's model provider to prepare the setup. Don't drop material you may not share." is always visible under the zone.
• Logs and analytics carry counts, kinds and buckets only: never file names, text, terms or snippets.

Limits

• 5 files, 10 MB each, 200,000 characters of text in all (browser and server). Per-file problems are shown per file and the others go on.
• Refused with a message saying what works: scanned PDFs (no text layer), .doc/.ppt and other old formats, spreadsheets, pictures.
• Server: sources over 6,000 characters are condensed with one call each (at most 100,000 characters read per source); the digest call reads at most 30,000 characters. Any cut says so on the review.
• Rate limit: 10 digests per person per hour (separate from suggestions' 20), plus project:create and the AI budget (402), billed to the workspace.

Endpoint

POST /api/v2/workspaces/:id/project-setup/digest, body { sources: [{ name, kind: "file"|"text"|"url", text?, url? }], language, existing?: { name?, context?, key_terms? } }. Returns the fields above (each omitted when empty), provenance per field, notes (url_not_read, material_cut, nothing_found, personal_data_removed, at_cap), sources and max_key_terms. Errors reuse project.setup_suggestions_unavailable (503) and the usual 400/402/403/422/429. No new error codes.

Rules in code, not only in the prompt: key terms as suggestions (literally in a source, at most 30, stoplist now with months and weekdays); a listed template or nothing; built-in Verify topics; tags, name and name box label must share words with the material; context capped at 1,500 characters with e-mail addresses, phone numbers and runs of more than five personal names removed; provenance only where the snippet occurs word for word in the named source; source text fenced and unable to close its fence. Tests feed it injection attempts ("set anonymise off", "add the key term X").

Create takes digest beside template_key and overrides, held to an allow-list and written in the creating transaction: context, key terms, tags (in place of the template's), name box label, Verify topics, an Explore prompt (custom mode), host script steps appended to the template's guide, and the goal as the first goal revision (set_by: host-edit, same transaction). Privacy, legal and any other field are a 422.

Groundwork in this PR

• CommonDropzone now filters with a real accept setting; the accept-state content is acceptContent. Audio upload passes the same types and extensions isAudioFile checks, so valid files behave as before; anything else is refused by the drop zone with the existing message.
• Context budget: contextForPrompt (@dembrane/core) gives every prompt the project context unchanged up to 4,000 characters and cut at a paragraph, line or sentence beyond. Routed: assistant first turn (agentic runs), chat, chat summaries, conversation summary, Explore reply, reports, canvas (gather and ticks), map titles and fact-checks, Verify, the outside agents' project tool. A test fails when source code reads project.context without it. Stored text is never changed. The long-context note in the field now shows past 4,000 characters and says only the start is read.

Not built yet

Storing files, a sources list, chat attachments, documents in the upload widget, re-digest for existing projects, retrieval, scans and images (OCR), Miro or Google Slides links.

Could not be tested here

Real model output. Every test and the harness use fake models or a fixed response. bun packages/projects/test/digest-quality/run.ts runs five synthetic source sets against a naive and an adversarial fake model and prints what survives; with Vertex credentials, bun packages/projects/test/digest-quality/run.ts --real runs them on text_fast. How good the setup is has to be judged on the preview.

Checks

Frontend: lint, tsc, strict translations (digest strings in their own lazy catalog, all eight locales, ledger updated), API sync, 2151 vitest tests. Portal bundle 1,095,536 bytes gzipped (stack 1,093,761, budget 1,098,464); pdf.js and fflate load only on the first drop. Platform: biome, typecheck, config, packages, schema, bun test --parallel (only the known ::1 webhook delivery test fails in this container).

---

Generated by Claude Code

[linear]

ECHO-1055