feat: v2.7.8 — Artifacts hub, clone related repos as extra folders, quieter resume prompt

- Artifacts (/artifacts): claude.ai pages sessions publish (captured from the
  Artifact tool's hook), pinned workspace files, skills and plugins, each
  kept as a snapshot; shared ones appear in a Hub and a skill or plugin
  installs into the viewer's own account (server/lib/artifacts.js,
  /api/artifacts, docs/plans/artifacts/).
- Workspace extra folders: clone one or more related repos beside the
  workspace and add them in one step (POST /api/lanes/:id/sources/clone).
- A pane that ended by itself while tmux kept running is no longer offered
  for resume (tmux.serverStartedAt in reconcileOrphans).
- Changes panel: a folder that is not a git repo opens on Files, and its
  files open from there.
- Plus the parallel sessions' work in this tree: File Explorer button in the
  panel header, user delete, RSA SSH keys, chat/terminal and pet fixes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

client/src/pages/__tests__/Artifacts.test.tsx

@@ -0,0 +1,128 @@
+/**
+ * @file Tests for the `/artifacts` page: the library lists what the server
+ * answers, the Hub tab and Share appear only in server mode, a skill is
+ * installed only after a confirmation (and a taken name asks to replace),
+ * and a file preview is a sandboxed iframe with no `allow-*` token.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { MemoryRouter } from "react-router-dom";
+import { Artifacts } from "../Artifacts";
+import { api, type Artifact } from "../../lib/api";
+import { confirmDialog } from "../../lib/confirm";
+
+vi.mock("../../lib/confirm", () => ({ confirmDialog: vi.fn() }));
+vi.mock("../../lib/api", () => ({
+  api: {
+    lanes: { list: vi.fn() },
+    artifacts: {
+      settings: vi.fn(),
+      list: vi.fn(),
+      update: vi.fn(),
+      remove: vi.fn(),
+      install: vi.fn(),
+      setInstallsEnabled: vi.fn(),
+      rawUrl: (id: number, path?: string) => `/api/artifacts/${id}/raw?path=${path ?? ""}`,
+    },
+  },
+}));
+
+const item = (over: Partial<Artifact>): Artifact => ({
+  id: 1,
+  kind: "file",
+  title: "report.html",
+  description: "",
+  ownerId: 1,
+  owner: "vi",
+  mine: true,
+  canChange: true,
+  laneId: 1,
+  sessionId: null,
+  source: "out/report.html",
+  market: null,
+  url: null,
+  files: [{ path: "report.html", size: 10 }],
+  size: 10,
+  shared: false,
+  sharedAt: null,
+  installs: 0,
+  createdAt: "2026-10-14T00:00:00Z",
+  updatedAt: "2026-10-14T00:00:00Z",
+  ...over,
+});
+
+const open = () =>
+  render(
+    <MemoryRouter>
+      <Artifacts />
+    </MemoryRouter>
+  );
+
+beforeEach(() => {
+  vi.mocked(api.artifacts.settings).mockResolvedValue({
+    serverMode: false,
+    canShare: false,
+    installsEnabled: true,
+    canManage: true,
+  });
+  vi.mocked(api.artifacts.list).mockResolvedValue({
+    items: [
+      item({}),
+      item({ id: 2, kind: "skill", title: "deploy", source: "deploy", files: [{ path: "SKILL.md", size: 3 }] }),
+    ],
+  });
+  vi.mocked(confirmDialog).mockReset();
+  vi.mocked(api.artifacts.install).mockReset();
+});
+
+describe("Artifacts", () => {
+  it("lists the library, with no Hub or Share in local mode", async () => {
+    open();
+    expect(await screen.findByText("report.html")).toBeInTheDocument();
+    expect(screen.getByText("deploy")).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: "Hub" })).toBeNull();
+    expect(screen.queryByRole("button", { name: /Share/ })).toBeNull();
+  });
+
+  it("shows the Hub and Share in server mode", async () => {
+    vi.mocked(api.artifacts.settings).mockResolvedValue({
+      serverMode: true,
+      canShare: true,
+      installsEnabled: true,
+      canManage: false,
+    });
+    open();
+    expect(await screen.findByRole("button", { name: "Hub" })).toBeInTheDocument();
+    expect(screen.getAllByRole("button", { name: /^Share$/ }).length).toBe(2);
+  });
+
+  it("installs a skill only after a confirmation, and asks before replacing", async () => {
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("deploy");
+    vi.mocked(confirmDialog).mockResolvedValueOnce(false);
+    await user.click(screen.getByRole("button", { name: "Install" }));
+    expect(api.artifacts.install).not.toHaveBeenCalled();
+
+    vi.mocked(confirmDialog).mockResolvedValue(true);
+    vi.mocked(api.artifacts.install)
+      .mockRejectedValueOnce(Object.assign(new Error("taken"), { code: "EEXISTS" }))
+      .mockResolvedValueOnce({ installed: "/h/.claude/skills/deploy", replaced: true });
+    await user.click(screen.getByRole("button", { name: "Install" }));
+    await waitFor(() => expect(api.artifacts.install).toHaveBeenLastCalledWith(2, true));
+    const calls = vi.mocked(confirmDialog).mock.calls;
+    expect(calls[calls.length - 1]?.[0].title).toMatch(/Replace/);
+  });
+
+  it("previews a file in a sandboxed iframe that may run nothing", async () => {
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("report.html");
+    await user.click(screen.getAllByRole("button", { name: "Preview" })[0]!);
+    const frame = await screen.findByTestId("artifact-preview");
+    expect(frame.getAttribute("sandbox")).toBe("");
+    expect(frame.getAttribute("src")).toBe("/api/artifacts/1/raw?path=report.html");
+  });
+});