feat: v2.7.6 — edit users in one form, Settings → Account, display names, copy over plain HTTP

- Users page: one Edit user form (display name, email, role, active, a new or
  generated password, workspaces given or taken back, sign out everywhere),
  validated as a whole before anything is written (PATCH /api/users/:id,
  GET /api/users/:id); users.display_name/email added migration-safe.
- Settings → Account for every signed-in user: profile, own password (the
  current one required, this login kept), sign out other devices
  (/api/me/account, /api/me/password, /api/me/sign-out-others; login cookie
  only, never a pane token).
- Display names wherever a person is named (sidebar, workspace owner groups,
  Users page and audit log); owner_display_name / reader_display additive.
- Users page: admins add and remove Claude/Codex pool accounts.
- Folder browser: an admin with their own Linux account opens in their home;
  the "Server folder" tick opens the host's (never remembered).
- AI Proxy: "Config 9router" beside Add profile when 9router is installed,
  opened on the dashboard's own host (GET /api/ai-proxies/9router).
- Terminal: a tmux selection reaches the clipboard over plain HTTP too
  (writeClipboard's textarea fallback, focus handed back).
- Chat: a file the session touched outside the workspace previews
  (GET /api/sessions/:id/file).
- install-system: `!requiretty` only when visudo accepts it (sudo-rs on
  Ubuntu 25.10+ rejects the setting).
- openapi.yaml regenerated; docs (API, SERVER-MODE, LANES) updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/routes/users.js

@@ -7,8 +7,12 @@
  * workspace — server/lib/scope.js); `GET /audit` the newest audit entries
  * (server/lib/audit.js).
  *
- * The Users page's account changes — `POST /` (create), `PATCH /:id` (role,
- * disabled), `POST /:id/password` (reset) and `POST /:id/workspaces` (give a
+ * `GET /:id` is one account with the workspaces it owns, for the Edit user form.
+ *
+ * The Users page's account changes — `POST /` (create), `PATCH /:id` (the Edit
+ * user form: display name, email, role, disabled, a new password, workspaces
+ * given and taken back, sign out everywhere — every field validated before any
+ * is applied), `POST /:id/password` (reset) and `POST /:id/workspaces` (give a
  * workspace) — are an admin's only (`/users` is in ADMIN_WRITE_PREFIXES), each
  * needs the admin's own password again (`currentPassword`, `confirmPassword`),
  * an admin never demotes or disables themselves (ESELF), every change is
@@ -69,6 +73,7 @@ router.get("/", (_req, res) => {
     const w = sessionWhere({ user: { id: u.id, role: "developer" } });
     return {
       ...u,
+      ...auth.loginStats(u.id),
       workspaces: db.prepare("SELECT COUNT(*) AS n FROM lanes WHERE owner_id = ?").get(u.id).n,
       sessions: db.prepare(`SELECT COUNT(*) AS n FROM sessions WHERE ${w.where}`).get(...w.params)
         .n,
@@ -85,6 +90,8 @@ router.get("/audit", (req, res) => {
 
 const STATUS = {
   EBADUSER: 400,
+  EBADEMAIL: 400,
+  ENOTOWNED: 409,
   EBADPASSWORD: 400,
   EBADROLE: 400,
   EBADFIELD: 400,
@@ -132,6 +139,24 @@ function target(req) {
   return u;
 }
 
+router.get("/:id", (req, res) => {
+  const u = db.prepare("SELECT * FROM users WHERE id = ?").get(Number(req.params.id));
+  if (!u) return res.status(404).json({ error: { code: "ENOUSER", message: "no such user" } });
+  res.json({
+    user: { ...auth.publicUser(u), ...auth.loginStats(u.id) },
+    workspaces: auth.ownedWorkspaces(u.id),
+  });
+});
+
+/** A list of workspace ids from the body, or [] when absent. */
+function laneIds(value, field) {
+  if (value === undefined) return [];
+  if (!Array.isArray(value) || value.some((v) => !Number.isInteger(v) || v <= 0)) {
+    throw Object.assign(new Error(`${field}: a list of workspace ids`), { code: "EBADFIELD" });
+  }
+  return [...new Set(value)];
+}
+
 router.post(
   "/",
   accountChange(async (_req, body) => {
@@ -146,25 +171,78 @@ router.patch(
   accountChange(async (req, body) => {
     const u = target(req);
     const self = u.id === req.user.id;
-    const done = [];
-    if (body.role !== undefined && body.role !== auth.publicUser(u).role) {
-      if (self)
-        throw Object.assign(new Error("you cannot change your own role"), { code: "ESELF" });
-      auth.setRole(u.username, body.role);
-      done.push(`role ${body.role}`);
+    const ESELF = (msg) => Object.assign(new Error(msg), { code: "ESELF" });
+
+    // 1. Validate everything — nothing is written until all of it passes.
+    const profile = auth.validateProfile(body);
+    const roleChange = body.role !== undefined && body.role !== u.role;
+    if (roleChange) {
+      if (self) throw ESELF("you cannot change your own role");
+      if (!auth.ROLES.includes(body.role)) {
+        throw Object.assign(new Error(`role: one of ${auth.ROLES.join(", ")}`), {
+          code: "EBADROLE",
+        });
+      }
     }
     if (body.disabled !== undefined) {
       if (typeof body.disabled !== "boolean") {
         throw Object.assign(new Error("disabled: true or false"), { code: "EBADFIELD" });
       }
-      if (self && body.disabled) {
-        throw Object.assign(new Error("you cannot disable yourself"), { code: "ESELF" });
+      if (self && body.disabled) throw ESELF("you cannot disable yourself");
+    }
+    const disabledChange = body.disabled !== undefined && body.disabled !== Boolean(u.disabled);
+    if (body.password !== undefined) auth.validatePassword(body.password);
+    if (body.signOut !== undefined && body.signOut !== true) {
+      throw Object.assign(new Error("signOut: true"), { code: "EBADFIELD" });
+    }
+    const add = laneIds(body.addWorkspaces, "addWorkspaces");
+    const remove = laneIds(body.removeWorkspaces, "removeWorkspaces");
+    const runAs = require("../lib/run-as");
+    for (const id of [...add, ...remove]) {
+      const lane = db.prepare("SELECT owner_id, cwd FROM lanes WHERE id = ?").get(id);
+      if (!lane) throw Object.assign(new Error(`no workspace ${id}`), { code: "ENOLANE" });
+      if (remove.includes(id) && lane.owner_id !== u.id) {
+        throw Object.assign(new Error(`workspace ${id} is not ${u.username}'s`), {
+          code: "ENOTOWNED",
+        });
       }
+      // S3: a workspace in a member's home is theirs alone (EOWNERFOLDER).
+      if (add.includes(id)) runAs.assertOwnerFits(lane.cwd, u.id);
+    }
+
+    // 2. Apply. Disable last: it may stop panes and lock a Linux account
+    //    (EPROVISION), and the admin should learn that after the rest held.
+    const done = [];
+    if (Object.keys(profile).length) {
+      auth.setProfile(u.id, profile);
+      if ("display_name" in profile) done.push("display name");
+      if ("email" in profile) done.push("email");
+    }
+    if (roleChange) {
+      auth.setRole(u.username, body.role);
+      done.push(`role ${body.role}`);
+    }
+    for (const id of add) auth.assignWorkspace(id, u.username);
+    for (const id of remove) auth.unassignWorkspace(id, u.username);
+    if (add.length) done.push(`workspace ${add.join(", ")}`);
+    if (remove.length) done.push(`removed workspace ${remove.join(", ")}`);
+    // An admin changing their own password or signing themselves out keeps
+    // the login they are doing it from.
+    const keepToken = self ? auth.cookieToken(req) : undefined;
+    if (body.password !== undefined) {
+      await auth.setPassword(u.username, body.password, { keepToken });
+      done.push("password reset");
+    }
+    if (body.signOut) {
+      auth.endSessions(u.id, keepToken);
+      done.push("signed out everywhere");
+    }
+    if (disabledChange) {
       auth.setDisabled(u.username, body.disabled);
       done.push(body.disabled ? "disable" : "enable");
     }
     return {
-      user: auth.publicUser(target(req)),
+      user: { ...auth.publicUser(target(req)), ...auth.loginStats(u.id) },
       action: `${u.username}: ${done.join(", ") || "no change"}`,
     };
   })