feat: v2.7.6 — edit users in one form, Settings → Account, display names, copy over plain HTTP

- Users page: one Edit user form (display name, email, role, active, a new or
  generated password, workspaces given or taken back, sign out everywhere),
  validated as a whole before anything is written (PATCH /api/users/:id,
  GET /api/users/:id); users.display_name/email added migration-safe.
- Settings → Account for every signed-in user: profile, own password (the
  current one required, this login kept), sign out other devices
  (/api/me/account, /api/me/password, /api/me/sign-out-others; login cookie
  only, never a pane token).
- Display names wherever a person is named (sidebar, workspace owner groups,
  Users page and audit log); owner_display_name / reader_display additive.
- Users page: admins add and remove Claude/Codex pool accounts.
- Folder browser: an admin with their own Linux account opens in their home;
  the "Server folder" tick opens the host's (never remembered).
- AI Proxy: "Config 9router" beside Add profile when 9router is installed,
  opened on the dashboard's own host (GET /api/ai-proxies/9router).
- Terminal: a tmux selection reaches the clipboard over plain HTTP too
  (writeClipboard's textarea fallback, focus handed back).
- Chat: a file the session touched outside the workspace previews
  (GET /api/sessions/:id/file).
- install-system: `!requiretty` only when visudo accepts it (sudo-rs on
  Ubuntu 25.10+ rejects the setting).
- openapi.yaml regenerated; docs (API, SERVER-MODE, LANES) updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

client/src/components/run/ChatFilePreview.tsx

@@ -8,8 +8,9 @@
  * `GET /api/lanes/:id/git/file` (or `/git/raw` for an image), a file under
  * `~/.claude` (a memory file, a plugin's skill) through `GET /api/cc-config/file`,
  * an attached image or text file through `GET /api/run/drop/:name`, an image
- * the session read anywhere else through `GET /api/sessions/:id/image`. Anything
- * else (or an image that route refuses) shows its path only. A Windows path's `\` counts as `/` throughout.
+ * the session read anywhere else through `GET /api/sessions/:id/image`, and a
+ * text file it read or wrote anywhere else through `GET /api/sessions/:id/file`.
+ * Anything else (or a file those routes refuse) shows its path only. A Windows path's `\` counts as `/` throughout.
  * `SkillListModal` is the same dialog over the session's skills, each one's
  * SKILL.md found by name (`plugin:name` from the plugin list, else the user's
  * or the project's); a built-in skill has no file and shows by name only.
@@ -106,6 +107,14 @@ function useContent(path: string, scope: PreviewScope): Content {
         // An image it read elsewhere (a screenshot under ~/.cache): served
         // only because this session's own Read named it.
         setContent({ kind: "image", src: api.sessions.readImageUrl(scope.sessionId, path) });
+      } else if (scope.sessionId && /^(?:\/|[A-Za-z]:\/)/.test(file)) {
+        // A text file it read or wrote elsewhere (a report under ~/Documents):
+        // served only because this session's own Read/Write/Edit named it.
+        show(
+          api.sessions
+            .readFile(scope.sessionId, path)
+            .then((f) => ({ kind: "text", text: f.text, truncated: f.truncated }))
+        );
       } else setContent({ kind: "none" });
       return () => {
         live = false;

client/src/components/run/TerminalView.tsx

@@ -32,7 +32,8 @@
  * (OSC 52 — tmux's default `set-clipboard external` passes its own
  * copy-mode selections on; a CLI's OSC 52 inside the pane is not) lands in the browser
  * clipboard (`@xterm/addon-clipboard`, write-only: no program in the pane may
- * READ the user's clipboard). While the socket is down a "Reconnecting…"
+ * READ the user's clipboard) — over plain HTTP too, through `writeClipboard`'s
+ * textarea fallback. While the socket is down a "Reconnecting…"
  * overlay says keystrokes are not reaching the pane; resizes reach tmux at
  * most every 150 ms. Several browsers on one pane share ONE size: the server
  * names a driver (see pty-attach.js) and the others FOLLOW — their xterm takes
@@ -59,6 +60,7 @@ import "@xterm/xterm/css/xterm.css";
 import { useTheme } from "../../hooks/useTheme";
 import { terminalThemeFor } from "../../lib/terminalTheme";
 import { api } from "../../lib/api";
+import { writeClipboard } from "../../lib/clipboard";
 import { notePaneFocus, registerPane } from "../../lib/panePaste";
 import { attachImeInput } from "../../lib/imeInput";
 import { TERMINAL_FONTS, readTerminalFont } from "../../lib/terminalFont";
@@ -85,9 +87,11 @@ const clipboardProvider: IClipboardProvider = {
   // tmux names no selection (`52;;<b64>`), a CLI usually `c`: both are the
   // clipboard. An empty write (a "clear") is ignored.
   writeText: (_selection, text) => {
-    // Silent and best effort: no toast per copy, and on a non-secure origin
-    // (no Clipboard API, no user gesture for a fallback) it simply does nothing.
-    if (text) void navigator.clipboard?.writeText(text).catch(() => undefined);
+    // Silent and best effort: no toast per copy. On a non-secure origin
+    // (`http://<lan-ip>`, no Clipboard API) writeClipboard falls back to the
+    // textarea copy, which the browser allows while the drag that made the
+    // selection still counts as the user's gesture.
+    if (text) void writeClipboard(text);
   },
 };
 

client/src/components/run/__tests__/ChatFilePreview.test.tsx

@@ -4,7 +4,7 @@
  * pane's folder through the lane's git file read, a memory file under
  * `~/.claude` through the config pages' read, a dropped text file through the
  * drop route, an image read outside the folder through the session's image
- * route, a Windows path like a POSIX one, anything else by path only; the
+ * route, a text file read or written outside it through the session's file route, a Windows path like a POSIX one, anything else by path only; the
  * list dialog previewing the file picked in it; and the skills dialog finding
  * each skill's SKILL.md by name.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -31,7 +31,14 @@ vi.mock("../../../lib/api", async (importOriginal) => {
         }),
         gitRawUrl: () => "",
       },
-      sessions: { readImageUrl: (id: string, p: string) => `/img/${id}?path=${p}` },
+      sessions: {
+        readImageUrl: (id: string, p: string) => `/img/${id}?path=${p}`,
+        readFile: vi.fn((_id: string, p: string) =>
+          p.endsWith(".md")
+            ? Promise.resolve({ text: "# Audit report", truncated: false })
+            : Promise.reject(new Error("404"))
+        ),
+      },
       ccConfig: {
         skills: vi.fn().mockResolvedValue({
           items: [{ scope: "user", name: "xlsx", file: "/h/.claude/skills/xlsx/SKILL.md" }],
@@ -110,9 +117,16 @@ describe("FilePreview", () => {
     expect(screen.getByText("No preview for this file here")).toBeTruthy();
   });
 
-  it("shows only the path of a file it may not read", () => {
+  it("reads a text file it wrote outside the folder through the session", async () => {
+    const report = "/home/a/Documents/audit/REPORT_ssh_ec2.md";
+    render(<FilePreview path={report} scope={scope} onClose={() => {}} />);
+    expect(await screen.findByText("Audit report")).toBeTruthy();
+    expect(vi.mocked(api.sessions.readFile)).toHaveBeenCalledWith("s1", report);
+  });
+
+  it("shows only the path of a file it may not read", async () => {
     render(<FilePreview path="/etc/hosts" scope={scope} onClose={() => {}} />);
-    expect(screen.getByText("No preview for this file here")).toBeTruthy();
+    expect(await screen.findByText("No preview for this file here")).toBeTruthy();
   });
 });
 

client/src/components/run/__tests__/PaneChat.test.tsx

@@ -87,6 +87,7 @@ vi.mock("../../../lib/api", async (importOriginal) => {
           skills: [],
           mcp: [],
         }),
+        readFile: r({ text: "", truncated: false }),
       },
       lanes: {
         gitFile: r({
@@ -355,7 +356,9 @@ describe("PaneChat — the activity panel", () => {
     );
     const first = render(pane());
     fireEvent.click(
-      within(await screen.findByTestId("chat-outline")).getByRole("button", { name: "Hide side panel" })
+      within(await screen.findByTestId("chat-outline")).getByRole("button", {
+        name: "Hide side panel",
+      })
     );
     first.unmount();
     render(pane());