feat: avatar by link, loaded by the browser; Files nests workspaces under owners' homes

- POST /api/me/avatar/url stores the https link (users.avatar_link) instead of downloading it; GET /api/me/avatar and /api/users/:id/avatar answer 302 to it (no referrer). Link rules: https, no userinfo, <= 2048 chars, no localhost or private/reserved IP literal. Upload and link replace each other. - Settings -> Account first loads the link as an embedded image and refuses one this browser cannot show: a picture behind a login (Mattermost's /api/v4/users/<id>/image) gets no cookie cross-site and 401s. - Files sidebar: each workspace under its owner's home, chevrons remembered per browser (agenthub.files.homesOpen); ownerless ones stay flat.
2026-10-22 14:34:50 +07:00
parent 649f0599f8
commit 26952ae0d9
19 changed files with 463 additions and 289 deletions
@@ -22,6 +22,9 @@
 * another user's. An admin's Trash opens on one folder per user (with its
 * item count); each folder is THAT user's Trash, to restore from or purge
 * without waiting the 7 days.
+ * The sidebar nests each workspace under its owner's home (a chevron drops
+ * them down, remembered per browser); one with no owner home stays in a flat
+ * Workspaces list.
 * Server side: `/api/lanes/:id/fs/*` and `/api/homes/:who/fs/*`
 * (server/lib/file-explorer.js).
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -93,6 +96,7 @@ import { copyText } from "../../lib/clipboard";
 import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../ContextMenu";
 import { CloneHereDialog } from "./CloneHereDialog";
 import { isSubmitEnter } from "../../lib/keys";
+import { useAuth } from "../AuthGate";

 /** One upload batch at most (the server caps one file the same). */
 export const FX_BATCH_MAX_BYTES = 500 * 1024 * 1024;
@@ -137,6 +141,11 @@ export function packUploads<T extends { file: Blob; rel: string }>(files: T[]) {
 const MIME = "application/x-agenthub-fx";
 const VIEW_KEY = "agenthub.files.view";
 const HIDDEN_KEY = "agenthub.files.hidden";
+/** The sidebar homes whose workspaces are dropped down (a JSON list of home ids). */
+const HOMES_OPEN_KEY = "agenthub.files.homesOpen";
+/** A sidebar user row; `noHome`: it only groups an owner's workspaces, the
+ *  viewer may not open that home (an analyst's view of other users). */
+type UserRow = FsHome & { noHome?: boolean };

 type Clip = { place: FsPlace; paths: string[]; cut: boolean };
 // The clipboard outlives the dialog and a workspace switch, like a desktop's.
@@ -319,6 +328,16 @@ export function FileBrowser({
    bytes: number;
  } | null>(null);
  const [lanes, setLanes] = useState<Lane[]>([]);
+  const { state: auth } = useAuth();
+  const myId = auth.mode === "server" ? (auth.user?.id ?? null) : null;
+  const [openHomes, setOpenHomes] = useState<Set<string>>(() => {
+    try {
+      const v: unknown = JSON.parse(readPref(HOMES_OPEN_KEY, '["me"]'));
+      return new Set(Array.isArray(v) ? v.filter((x): x is string => typeof x === "string") : []);
+    } catch {
+      return new Set(["me"]);
+    }
+  });
  const [clip, setClip] = useState<Clip | null>(clipboard);
  const [dropping, setDropping] = useState(false);
  const [menu, setMenu] = useState<"new" | "upload" | "more" | null>(null);
@@ -892,6 +911,52 @@ export function FileBrowser({
        onCancel={() => setRenaming(null)}
      />
    ) : null;
+  // Each workspace drops down under its owner: the caller's own under My
+  // home, another user's under theirs (`owner_name` = that home's id). An
+  // owner whose home this viewer may not open (an analyst's view of other
+  // users) still gets a row, one that only groups. A workspace with no owner
+  // stays in the flat Workspaces list. Which rows are open is per browser.
+  const { lanesOfHome, userRows } = useMemo(() => {
+    const ids = new Set(homes.map((h) => h.id));
+    const map = new Map<string, Lane[]>();
+    const extra = new Map<string, UserRow>();
+    for (const l of lanes) {
+      const home =
+        myId != null && l.owner_id === myId && ids.has("me")
+          ? "me"
+          : l.owner_name && l.owner_name !== "me"
+            ? l.owner_name
+            : null;
+      if (!home) continue;
+      map.set(home, [...(map.get(home) ?? []), l]);
+      if (!ids.has(home) && !extra.has(home)) {
+        extra.set(home, {
+          id: home,
+          label: l.owner_display_name || home,
+          readOnly: true,
+          noHome: true,
+        });
+      }
+    }
+    const rows: UserRow[] = [
+      ...homes.filter((h) => h.id !== "me"),
+      ...[...extra.values()].sort((a, b) => a.label.localeCompare(b.label)),
+    ];
+    return { lanesOfHome: map, userRows: rows };
+  }, [homes, lanes, myId]);
+  const grouped = new Set([...lanesOfHome.values()].flat().map((l) => l.id));
+  const looseLanes = lanes.filter((l) => !grouped.has(l.id));
+  // A home holding the open workspace shows it, whatever was stored.
+  const homeIsOpen = (id: string, own: Lane[]) =>
+    openHomes.has(id) ||
+    (view === "files" && !isHomePlace(target) && own.some((l) => l.id === laneOf(target)));
+  const toggleHome = (id: string, own: Lane[]) => {
+    const next = new Set(openHomes);
+    if (homeIsOpen(id, own)) next.delete(id);
+    else next.add(id);
+    setOpenHomes(next);
+    writePref(HOMES_OPEN_KEY, JSON.stringify([...next]));
+  };
  const placeClass = (active: boolean) =>
    `flex w-full items-center gap-2 rounded-md px-2 py-1.5 text-left text-[13px] ${
      active ? "bg-accent/15 font-medium text-accent" : "text-fg-secondary hover:bg-surface-2"
@@ -920,64 +985,104 @@ export function FileBrowser({
      {/* ── Places ── */}
      <aside className="hidden w-52 shrink-0 flex-col border-r border-border bg-surface-0 sm:flex">
        <nav className="min-h-0 flex-1 overflow-y-auto px-2 pb-2" aria-label={t("fx.places")}>
-          {homes.some((h) => h.id === "me") && (
-            <div className="pt-3">
+          {(() => {
+            const laneRow = (l: Lane, nested: boolean) => (
              <button
+                key={l.id}
                type="button"
-                onClick={() => go("", { home: "me" })}
-                onContextMenu={(e) => placeCtx.open(e, { home: "me" })}
-                className={placeClass(
-                  view === "files" && isHomePlace(target) && target.home === "me"
-                )}
+                title={l.cwd}
+                onClick={() => go("", l.id)}
+                onContextMenu={(e) => placeCtx.open(e, { lane: l })}
+                className={`${placeClass(
+                  view === "files" && !isHomePlace(target) && laneOf(target) === l.id
+                )}${nested ? " pl-7" : ""}`}
              >
-                <House className="h-4 w-4 shrink-0" />
-                <span className="truncate">{t("fx.myHome")}</span>
+                <FolderGit2 className="h-4 w-4 shrink-0" />
+                <span className="truncate">{l.title || l.cwd.split("/").pop()}</span>
              </button>
-            </div>
-          )}
-          {homes.some((h) => h.id !== "me") && (
-            <>
-              <p className="px-2 pb-1 pt-3 text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
-                {t("fx.userHomes")}
-              </p>
-              {homes
-                .filter((h) => h.id !== "me")
-                .map((h) => (
-                  <button
-                    key={h.id}
-                    type="button"
-                    title={t("fx.readOnlyHome")}
-                    onClick={() => go("", { home: h.id })}
-                    onContextMenu={(e) => placeCtx.open(e, { home: h.id })}
-                    className={placeClass(
-                      view === "files" && isHomePlace(target) && target.home === h.id
-                    )}
-                  >
-                    <UserRound className="h-4 w-4 shrink-0" />
-                    <span className="truncate">{h.label}</span>
-                    <Eye className="ml-auto h-3 w-3 shrink-0 opacity-60" />
-                  </button>
-                ))}
-            </>
-          )}
-          <p className="px-2 pb-1 pt-3 text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
-            {t("fx.places")}
-          </p>
-          {lanes.map((l) => (
-            <button
-              key={l.id}
-              type="button"
-              title={l.cwd}
-              onClick={() => go("", l.id)}
-              onContextMenu={(e) => placeCtx.open(e, { lane: l })}
-              className={placeClass(
-                view === "files" && !isHomePlace(target) && laneOf(target) === l.id
-              )}
-            >
-              <FolderGit2 className="h-4 w-4 shrink-0" />
-              <span className="truncate">{l.title || l.cwd.split("/").pop()}</span>
-            </button>
-          ))}
+            );
+            // A home row with a chevron: its user's workspaces drop down under it.
+            const homeRow = (h: UserRow) => {
+              const own = lanesOfHome.get(h.id) ?? [];
+              const open = own.length > 0 && homeIsOpen(h.id, own);
+              const mine = h.id === "me";
+              // No home to open: the name drops the list down too.
+              const browse = !h.noHome;
+              return (
+                <div key={h.id} data-testid={`fx-home-${h.id}`}>
+                  <div className="flex items-center">
+                    <button
+                      type="button"
+                      aria-label={t("fx.toggleWorkspaces", {
+                        name: mine ? t("fx.myHome") : h.label,
+                      })}
+                      aria-expanded={open}
+                      disabled={!own.length}
+                      onClick={() => toggleHome(h.id, own)}
+                      className="flex h-6 w-5 shrink-0 items-center justify-center rounded text-fg-muted hover:bg-surface-2 disabled:opacity-0"
+                    >
+                      {open ? (
+                        <ChevronDown className="h-3.5 w-3.5" />
+                      ) : (
+                        <ChevronRight className="h-3.5 w-3.5" />
+                      )}
+                    </button>
+                    <button
+                      type="button"
+                      title={mine || !browse ? undefined : t("fx.readOnlyHome")}
+                      aria-expanded={browse ? undefined : open}
+                      onClick={() => (browse ? go("", { home: h.id }) : toggleHome(h.id, own))}
+                      onContextMenu={browse ? (e) => placeCtx.open(e, { home: h.id }) : undefined}
+                      className={placeClass(
+                        browse && view === "files" && isHomePlace(target) && target.home === h.id
+                      )}
+                    >
+                      {mine ? (
+                        <House className="h-4 w-4 shrink-0" />
+                      ) : (
+                        <UserRound className="h-4 w-4 shrink-0" />
+                      )}
+                      <span className="truncate">{mine ? t("fx.myHome") : h.label}</span>
+                      {own.length > 0 && (
+                        <span className="ml-auto shrink-0 text-[11px] tabular-nums text-fg-muted">
+                          {own.length}
+                        </span>
+                      )}
+                      {!mine && browse && (
+                        <Eye
+                          className={`${own.length ? "" : "ml-auto "}h-3 w-3 shrink-0 opacity-60`}
+                        />
+                      )}
+                    </button>
+                  </div>
+                  {open && own.map((l) => laneRow(l, true))}
+                </div>
+              );
+            };
+            const me = homes.find((h) => h.id === "me");
+            const others = userRows;
+            return (
+              <>
+                {me && <div className="pt-3">{homeRow(me)}</div>}
+                {others.length > 0 && (
+                  <>
+                    <p className="px-2 pb-1 pt-3 text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
+                      {others.some((h) => !h.noHome) ? t("fx.userHomes") : t("fx.users")}
+                    </p>
+                    {others.map(homeRow)}
+                  </>
+                )}
+                {looseLanes.length > 0 && (
+                  <>
+                    <p className="px-2 pb-1 pt-3 text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
+                      {t("fx.places")}
+                    </p>
+                    {looseLanes.map((l) => laneRow(l, false))}
+                  </>
+                )}
+              </>
+            );
+          })()}
        </nav>
        <div className="border-t border-border p-2" data-testid="fx-trashes">
          <button type="button" onClick={openTrashes} className={placeClass(view === "trash")}>
@@ -7,7 +7,9 @@
 * Trash, opens an admin's Trash on one folder per user (counted, an unreadable
 * one saying why), opens each user's Trash from its folder (asking before a
 * purge there, sending the item's store) and
- * shows a Trash that could not be read as an error, never as empty.
+ * shows a Trash that could not be read as an error, never as empty; nests a
+ * user's workspaces under their home in the sidebar (under a fold-only row
+ * when the viewer may not open that home).
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */
 import { describe, it, expect, vi, beforeEach } from "vitest";
@@ -470,6 +472,59 @@ describe("FileExplorer", () => {
    fireEvent.keyDown(screen.getByTestId("fx-list"), { key: "Delete" });
    expect(api.files.remove).not.toHaveBeenCalled();
  });
+
+  it("drops a user's workspaces down under their home; an unowned one stays in the list", async () => {
+    localStorage.removeItem("agenthub.files.homesOpen");
+    vi.mocked(api.lanes.list).mockResolvedValue({
+      lanes: [
+        { id: 1, title: "one", cwd: "/w/one" },
+        { id: 2, title: "two", cwd: "/w/two", owner_id: 7, owner_name: "bob" },
+      ],
+      counts: {},
+    } as never);
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("a.txt");
+    const toggle = await screen.findByRole("button", { name: "Show or hide Bob’s workspaces" });
+    expect(toggle).toHaveAttribute("aria-expanded", "false");
+    const places = screen.getByRole("navigation", { name: "Workspaces" });
+    expect(within(places).queryByRole("button", { name: "two" })).toBeNull();
+    expect(within(places).getByRole("button", { name: "one" })).toBeInTheDocument();
+    await user.click(toggle);
+    await user.click(within(places).getByRole("button", { name: "two" }));
+    await waitFor(() => expect(api.files.list).toHaveBeenLastCalledWith(2, ""));
+    expect(localStorage.getItem("agenthub.files.homesOpen")).toContain("bob");
+  });
+
+  it("groups an owner whose home the viewer cannot open (an analyst) under a row that only folds", async () => {
+    localStorage.removeItem("agenthub.files.homesOpen");
+    vi.mocked(api.files.homes).mockResolvedValue({
+      homes: [{ id: "me", label: "An", readOnly: false }],
+    });
+    vi.mocked(api.lanes.list).mockResolvedValue({
+      lanes: [
+        { id: 1, title: "one", cwd: "/w/one" },
+        {
+          id: 3,
+          title: "three",
+          cwd: "/w/three",
+          owner_id: 9,
+          owner_name: "cara",
+          owner_display_name: "Cara",
+        },
+      ],
+      counts: {},
+    } as never);
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("a.txt");
+    const places = screen.getByRole("navigation", { name: "Workspaces" });
+    expect(within(places).getByText("Users")).toBeInTheDocument();
+    expect(within(places).queryByRole("button", { name: "three" })).toBeNull();
+    await user.click(within(places).getByRole("button", { name: /^Cara/ }));
+    expect(api.files.list).not.toHaveBeenCalledWith({ home: "cara" }, "");
+    expect(within(places).getByRole("button", { name: "three" })).toBeInTheDocument();
+  });
 });

 describe("FileExplorer — New → Clone repository", () => {
@@ -4,7 +4,7 @@
 * account's own information (`GET /api/me/account` — username, role, member
 * since, workspaces, sessions, active sign-ins, last sign-in), its avatar
 * (`PUT`/`DELETE /api/me/avatar` — PNG, JPEG, GIF or WebP, at most 1 MB — or
- * an https link the server downloads, `POST /api/me/avatar/url`; the sidebar
+ * an https link the browser loads itself, `POST /api/me/avatar/url`; the sidebar
 * shows it at once), its display name
 * and email (`PATCH /api/me/account`), a password change that asks for the
 * current one and passes every rule of `lib/passwordRules.ts`, ticked as it is
@@ -48,6 +48,24 @@ const errText = (t: (k: string, o?: Record<string, unknown>) => string, e: unkno
    : err.message;
 };

+/** Whether `url` loads as an image embedded in this page — the way every
+ *  avatar is shown: no referrer, the cookies a cross-site image gets. */
+export function loadsAsImage(url: string, timeoutMs = 10_000): Promise<boolean> {
+  return new Promise((resolve) => {
+    const img = new Image();
+    const done = (ok: boolean) => {
+      window.clearTimeout(timer);
+      img.onload = img.onerror = null;
+      resolve(ok);
+    };
+    const timer = window.setTimeout(() => done(false), timeoutMs);
+    img.referrerPolicy = "no-referrer";
+    img.onload = () => done(img.naturalWidth > 0);
+    img.onerror = () => done(false);
+    img.src = url;
+  });
+}
+
 export function AccountSettings() {
  const { t } = useTranslation("settings");
  const [account, setAccount] = useState<ServerAccount | null>(null);
@@ -138,6 +156,14 @@ function ProfileCard({
  const applyLink = async () => {
    const url = link?.trim();
    if (!url) return;
+    // The avatar routes only redirect to the link, so it shows only if THIS
+    // browser can load it as an embedded image: a link behind a login (a
+    // Mattermost /api/v4/users/<id>/image) gets no cookie from another site
+    // and fails — say so now instead of saving a picture nobody sees.
+    setBusy(true);
+    const ok = await loadsAsImage(url);
+    setBusy(false);
+    if (!ok) return void toast.error(t("account.avatar.linkUnreachable"));
    if (await run(() => api.me.setAvatarFromUrl(url), t("account.avatar.saved"))) setLink(null);
  };
  const pick = (e: ChangeEvent<HTMLInputElement>) => {
@@ -78,8 +78,40 @@ describe("AccountSettings", () => {
    expect(await screen.findByTestId("user-avatar-initials")).toBeTruthy();
  });

+  /** jsdom never loads an image: play the browser's answer to `src`. */
+  const stubImage = (loads: boolean) =>
+    vi.stubGlobal(
+      "Image",
+      class {
+        naturalWidth = loads ? 64 : 0;
+        referrerPolicy = "";
+        onload: (() => void) | null = null;
+        onerror: (() => void) | null = null;
+        set src(_v: string) {
+          setTimeout(() => (loads ? this.onload?.() : this.onerror?.()), 0);
+        }
+      }
+    );
+
+  it("refuses a link this browser cannot load as an image, and saves nothing", async () => {
+    const ue = userEvent.setup();
+    stubImage(false);
+    render(<AccountSettings />);
+    await screen.findByTestId("account-card");
+    await ue.click(screen.getByTestId("account-avatar-url-toggle"));
+    await ue.type(
+      screen.getByTestId("account-avatar-url-input"),
+      "https://chat.example/api/v4/users/x/image{Enter}"
+    );
+    await waitFor(() => expect(screen.getByTestId("account-avatar-url-input")).toBeTruthy());
+    await new Promise((r) => setTimeout(r, 20));
+    expect(me.setAvatarFromUrl).not.toHaveBeenCalled();
+    vi.unstubAllGlobals();
+  });
+
  it("sets the avatar from a link and closes the field", async () => {
    const ue = userEvent.setup();
+    stubImage(true);
    const withAvatar = { ...account, user: { ...account.user, avatarAt: "2026-10-21T00:00:00Z" } };
    me.setAvatarFromUrl.mockResolvedValue(withAvatar);
    render(<AccountSettings />);
@@ -92,6 +124,7 @@ describe("AccountSettings", () => {
      "/api/me/avatar?v=2026-10-21T00:00:00Z"
    );
    expect(screen.queryByTestId("account-avatar-url-input")).toBeNull();
+    vi.unstubAllGlobals();
  });

  it("shows the account's own information", async () => {
@@ -650,6 +650,8 @@
  "fx.noWorkspace": "There is no workspace yet. Add one first, then its files show here.",
  "fx.myHome": "Home",
  "fx.userHomes": "Users' homes",
+  "fx.users": "Users",
+  "fx.toggleWorkspaces": "Show or hide {{name}}’s workspaces",
  "fx.readOnlyHome": "Another user's home — view and download only; their Trash can be restored or emptied",
  "fx.readOnly": "Read-only",
  "fx.readOnlyHint": "This is another user's home: you can view, copy and download, not change it.",
@@ -77,21 +77,13 @@
      "run_done_other": "{{count}} runs finished 🐾"
    },
    "greet": {
-      "morning": [
-        "good morning! ☀️",
-        "morning! coffee first? ☕",
-        "rise and shine 🌤️"
-      ],
+      "morning": ["good morning! ☀️", "morning! coffee first? ☕", "rise and shine 🌤️"],
      "afternoon": [
        "good afternoon! 🐾",
        "hey, welcome back 😺",
        "afternoon! ready when you are ✨"
      ],
-      "evening": [
-        "good evening! 🌆",
-        "evening shift? I'm in 😼",
-        "hey there, night owl-to-be 🌙"
-      ],
+      "evening": ["good evening! 🌆", "evening shift? I'm in 😼", "hey there, night owl-to-be 🌙"],
      "night": [
        "burning the midnight oil? 🌙",
        "late one, huh? I'll keep watch 🦉",
@@ -114,11 +106,7 @@
      "help": "I'm {{name}} - I watch your sessions. Try \"what's running\", \"any errors\", \"what's waiting\" or \"status\". Anything else, I'll hand to Claude.",
      "whoami": "I'm {{name}}, your session-watching buddy 🐾 Right-click me to change my look, or click my name in the panel to rename me.",
      "hello": "hi there! 😺 {{summary}}.",
-      "thanks": [
-        "anytime! 💜",
-        "happy to help 😸",
-        "you got it 🐾"
-      ],
+      "thanks": ["anytime! 💜", "happy to help 😸", "you got it 🐾"],
      "errors_one": "{{count}} session errored{{list}} - open the panel to jump to it.",
      "errors_other": "{{count}} sessions errored{{list}} - open the panel to jump to them.",
      "errorsNone": "no errors - all clean 🐾",
@@ -175,41 +163,17 @@
        "can't reach the server 📡",
        "no signal - taking a nap 💤"
      ],
-      "worried": [
-        "that didn't look right 😟",
-        "keeping an eye out 👀",
-        "hmm, something's off 🫣"
-      ],
+      "worried": ["that didn't look right 😟", "keeping an eye out 👀", "hmm, something's off 🫣"],
      "stuck": [
        "a session's been quiet a while… 🤔",
        "is something stuck? ⏳",
        "still chewing on it… 😾"
      ],
-      "happy": [
-        "great run! 😻",
-        "love a tidy finish ✨",
-        "purrfect 💜"
-      ],
-      "thinking": [
-        "hmm, let me look… 🤔",
-        "sniffing around… 🐾",
-        "one sec, checking 🔍"
-      ],
-      "watching": [
-        "on the prowl 👀",
-        "watching your sessions 😼",
-        "eyes peeled 🐾"
-      ],
-      "sleeping": [
-        "zzz… 💤",
-        "wake me if something happens 😴",
-        "curled up, all calm 🐈"
-      ],
-      "idle": [
-        "all quiet 😺",
-        "ready when you are 🐾",
-        "just vibing ✨"
-      ]
+      "happy": ["great run! 😻", "love a tidy finish ✨", "purrfect 💜"],
+      "thinking": ["hmm, let me look… 🤔", "sniffing around… 🐾", "one sec, checking 🔍"],
+      "watching": ["on the prowl 👀", "watching your sessions 😼", "eyes peeled 🐾"],
+      "sleeping": ["zzz… 💤", "wake me if something happens 😴", "curled up, all calm 🐈"],
+      "idle": ["all quiet 😺", "ready when you are 🐾", "just vibing ✨"]
    },
    "chat": {
      "label": "Chat with {{name}}",
@@ -1357,7 +1321,8 @@
      "tooBig": "The picture must be at most 1 MB",
      "fromUrl": "Use a picture from a link",
      "urlPlaceholder": "https://… image link",
-      "urlApply": "Use"
+      "urlApply": "Use",
+      "linkUnreachable": "That link did not load as an image in your browser — it may need a login (a Mattermost or other chat picture does). Download the picture and upload it instead."
    },
    "loadFailed": "Could not load your account: {{message}}",
    "memberSince": "Member since",
@@ -650,6 +650,8 @@
  "fx.noWorkspace": "Chưa có workspace nào. Hãy thêm một workspace, file của nó sẽ hiện ở đây.",
  "fx.myHome": "Thư mục home",
  "fx.userHomes": "Home của các user",
+  "fx.users": "Người dùng",
+  "fx.toggleWorkspaces": "Hiện/ẩn workspace của {{name}}",
  "fx.readOnlyHome": "Home của user khác — chỉ xem và tải về; Thùng rác của họ thì khôi phục hoặc xoá được",
  "fx.readOnly": "Chỉ đọc",
  "fx.readOnlyHint": "Đây là home của user khác: bạn chỉ xem, sao chép và tải về được, không sửa được.",
@@ -77,26 +77,10 @@
      "run_done_other": "{{count}} lượt chạy vừa xong 🐾"
    },
    "greet": {
-      "morning": [
-        "chào buổi sáng! ☀️",
-        "sáng rồi! cà phê chưa? ☕",
-        "ngày mới tốt lành nha 🌤️"
-      ],
-      "afternoon": [
-        "chào buổi chiều! 🐾",
-        "bạn quay lại rồi 😺",
-        "chiều nay làm gì đây? ✨"
-      ],
-      "evening": [
-        "chào buổi tối! 🌆",
-        "ca tối hả? có mình đây 😼",
-        "tối rồi, cố lên nhé 🌙"
-      ],
-      "night": [
-        "khuya rồi mà vẫn làm à? 🌙",
-        "để mình canh giúp cho 🦉",
-        "nhớ nghỉ ngơi nha 💤"
-      ],
+      "morning": ["chào buổi sáng! ☀️", "sáng rồi! cà phê chưa? ☕", "ngày mới tốt lành nha 🌤️"],
+      "afternoon": ["chào buổi chiều! 🐾", "bạn quay lại rồi 😺", "chiều nay làm gì đây? ✨"],
+      "evening": ["chào buổi tối! 🌆", "ca tối hả? có mình đây 😼", "tối rồi, cố lên nhé 🌙"],
+      "night": ["khuya rồi mà vẫn làm à? 🌙", "để mình canh giúp cho 🦉", "nhớ nghỉ ngơi nha 💤"],
      "summary_one": "{{count}} phiên đang chạy",
      "summary_other": "{{count}} phiên đang chạy",
      "summaryWaiting": "{{count}} phiên chờ bạn",
@@ -114,11 +98,7 @@
      "help": "Mình là {{name}} - mình canh các phiên của bạn. Thử hỏi \"đang chạy gì\", \"có lỗi không\", \"cái gì đang chờ\" hoặc \"tình hình\". Câu khác mình sẽ chuyển cho Claude.",
      "whoami": "Mình là {{name}}, bạn đồng hành canh phiên của bạn 🐾 Chuột phải vào mình để đổi ngoại hình, hoặc bấm vào tên trong bảng để đặt tên mới.",
      "hello": "chào bạn! 😺 {{summary}}.",
-      "thanks": [
-        "có gì đâu! 💜",
-        "rất vui được giúp 😸",
-        "chuyện nhỏ 🐾"
-      ],
+      "thanks": ["có gì đâu! 💜", "rất vui được giúp 😸", "chuyện nhỏ 🐾"],
      "errors_one": "{{count}} phiên bị lỗi{{list}} - mở bảng để xem nhé.",
      "errors_other": "{{count}} phiên bị lỗi{{list}} - mở bảng để xem nhé.",
      "errorsNone": "không có lỗi nào - sạch sẽ 🐾",
@@ -175,41 +155,13 @@
        "không gọi được máy chủ 📡",
        "mất sóng - đi ngủ chút 💤"
      ],
-      "worried": [
-        "có vẻ không ổn 😟",
-        "mình đang để mắt đây 👀",
-        "hừm, có gì đó lạ lạ 🫣"
-      ],
-      "stuck": [
-        "một phiên im lặng lâu rồi… 🤔",
-        "có gì bị kẹt không? ⏳",
-        "vẫn đang nhai… 😾"
-      ],
-      "happy": [
-        "tuyệt vời! 😻",
-        "kết thúc gọn ghê ✨",
-        "hoàn hảo 💜"
-      ],
-      "thinking": [
-        "để mình xem… 🤔",
-        "đang đánh hơi… 🐾",
-        "chờ chút, đang kiểm tra 🔍"
-      ],
-      "watching": [
-        "đang tuần tra 👀",
-        "đang canh các phiên của bạn 😼",
-        "mắt mở to 🐾"
-      ],
-      "sleeping": [
-        "zzz… 💤",
-        "có gì thì gọi mình dậy nhé 😴",
-        "cuộn tròn, mọi thứ yên ổn 🐈"
-      ],
-      "idle": [
-        "yên ắng quá 😺",
-        "sẵn sàng khi bạn cần 🐾",
-        "chill thôi ✨"
-      ]
+      "worried": ["có vẻ không ổn 😟", "mình đang để mắt đây 👀", "hừm, có gì đó lạ lạ 🫣"],
+      "stuck": ["một phiên im lặng lâu rồi… 🤔", "có gì bị kẹt không? ⏳", "vẫn đang nhai… 😾"],
+      "happy": ["tuyệt vời! 😻", "kết thúc gọn ghê ✨", "hoàn hảo 💜"],
+      "thinking": ["để mình xem… 🤔", "đang đánh hơi… 🐾", "chờ chút, đang kiểm tra 🔍"],
+      "watching": ["đang tuần tra 👀", "đang canh các phiên của bạn 😼", "mắt mở to 🐾"],
+      "sleeping": ["zzz… 💤", "có gì thì gọi mình dậy nhé 😴", "cuộn tròn, mọi thứ yên ổn 🐈"],
+      "idle": ["yên ắng quá 😺", "sẵn sàng khi bạn cần 🐾", "chill thôi ✨"]
    },
    "chat": {
      "label": "Trò chuyện với {{name}}",
@@ -1357,7 +1309,8 @@
      "tooBig": "Ảnh tối đa 1 MB",
      "fromUrl": "Dùng ảnh từ đường dẫn",
      "urlPlaceholder": "https://… đường dẫn ảnh",
-      "urlApply": "Dùng"
+      "urlApply": "Dùng",
+      "linkUnreachable": "Trình duyệt không tải được ảnh từ link này — có thể link cần đăng nhập (ảnh Mattermost hay app chat khác là vậy). Hãy tải ảnh về rồi upload lên."
    },
    "loadFailed": "Không tải được tài khoản: {{message}}",
    "memberSince": "Tham gia từ",
@@ -7244,7 +7244,7 @@ exports[`screen snapshots > Settings — about 1`] = `
                <span
                  class="text-status-warning/90"
                >
-                  UI build v2.8.18 (rebuild client to match)
+                  UI build v2.8.19 (rebuild client to match)
                </span>
              </p>
            </div>
@@ -112,7 +112,7 @@ An admin (server mode) adds an account with `POST /api/accounts` `{tool: "claude
 | `POST /api/me/sign-out-others` | `{ended}` — every login of the account but this one ends |
 | `GET /api/me/avatar` | server mode: the account's own picture (`nosniff`, `sandbox` CSP; the client adds `?v=<avatarAt>`), `404 ENOAVATAR` when it has none |
 | `PUT /api/me/avatar` (raw image bytes) | the account's picture (PNG, JPEG, GIF or WebP by magic bytes — never SVG), stored as `<data dir>/avatars/u<id>.<ext>`; the `/api/me/account` shape back with `user.avatarAt` set. `400 EBADIMAGE`, `413 ETOOBIG` over 1 MB, `403 ELOCALMODE`. Login cookie only, audited |
-| `POST /api/me/avatar/url` (`{url}`) | the same picture, downloaded by the SERVER from an `https://` link (no userinfo; every resolved address — an IP literal too — must be public, never loopback/private/link-local/CGNAT/reserved, and the connection is pinned to the vetted address; ≤ 3 redirects, each re-checked; 10 s timeout; ≤ 1 MB read; no cookie sent), then checked like an upload (`server/lib/avatar-url.js`). `400 EBADURL`/`EPRIVATEURL`/`EBADIMAGE`, `413 ETOOBIG`, `502 EFETCH`, `403 ELOCALMODE`. Login cookie only, audited |
+| `POST /api/me/avatar/url` (`{url}`) | the picture as a LINK: stored as typed (`users.avatar_link`, an `https://` URL with no userinfo, ≤ 2048 chars, not `localhost` or a loopback/private/link-local/reserved IP literal) and NEVER downloaded by the server — `GET /api/me/avatar` and `GET /api/users/:id/avatar` answer `302` to it (`Referrer-Policy: no-referrer`), so the viewer's browser loads it with its own logins and network (a Mattermost `/api/v4/users/<id>/image` link works). Replaces an uploaded picture, and an upload replaces it (`server/lib/avatar-url.js`). `400 EBADURL`/`EPRIVATEURL`, `403 ELOCALMODE`. Login cookie only, audited |
 | `DELETE /api/me/avatar` | removes it (`avatarAt` back to `null`); deleting the user removes it too |

 The keys are the browser's own localStorage names: `theme`, `agenthub.theme.dark`, `agenthub.theme.light`, `i18nextLng`, `agenthub.terminal.font`, `agenthub.terminal.fontSize`, `agenthub.ui.fontSize`, `agenthub.pet`, `agenthub.pet.size`, `agenthub.pet.names`, `agent-dashboard-sagi-enabled`, `agent-dashboard-sagi-muted`, `agent-monitor-notifications`, `agenthub.defaultTool`, `agenthub.permissionMode` (`bypassPermissions` allowed — set only from Settings → AI tools → Session defaults, behind a confirm), `agenthub.codex.sandbox`, `agenthub.codex.approval`, `agenthub.codex.bypass` (`"true"`/`"false"`: a new Codex session's defaults), `agenthub.tour`, and `agenthub.chatUi` (`"1"` = Claude/Codex sessions open as a chat; read and written on the server only, by `client/src/lib/chatUi.ts`). The request never names an account, and writes are same-origin. An account's save writes only their own row, and under S3 a `theme` of `dark` or `light` also becomes the `theme` in their own `~/.claude/settings.json`, written as them.
@@ -290,7 +290,7 @@ POST /api/lanes/:id/fs/upload-batch?dir=&conflict=   length + JSON list + bytes
 GET  /api/lanes/:id/fs/zip?p=<path>&p=…    application/zip, streamed
 ```

-The workspace **File Explorer** (server mode only — a local dashboard has no **Files** entry, `/files` redirects home, and its buttons are hidden; the routes still answer) — the **Files** page in the sidebar (`/files?lane=<id>&path=<folder>`), laid out like GNOME Files (workspaces as places, Back/Forward, a path bar, icon grid or list, hidden files behind Ctrl+H), and the same manager in a dialog from a workspace's Files tab (the folder button; "Open in File Explorer" on a folder). `?session=` / `?source=` pick the same folder the
+The workspace **File Explorer** (server mode only — a local dashboard has no **Files** entry, `/files` redirects home, and its buttons are hidden; the routes still answer) — the **Files** page in the sidebar (`/files?lane=<id>&path=<folder>`), laid out like GNOME Files (workspaces as places — each nested under its owner's home, dropped down by that home's chevron (open homes kept per browser in `agenthub.files.homesOpen`), an owner whose home the viewer may not open (an analyst's view) under a row that only folds, one with no owner in a flat Workspaces list — Back/Forward, a path bar, icon grid or list, hidden files behind Ctrl+H), and the same manager in a dialog from a workspace's Files tab (the folder button; "Open in File Explorer" on a folder). `?session=` / `?source=` pick the same folder the
 git reads do. Paths go through the read path's guards (`lanePath`, the parent
 `resolveInLane`-confined, the last segment kept as a name so a symlink is acted
 on as a link); nothing in `.git`, no secret file, never the workspace folder
@@ -345,7 +345,10 @@ remembered, so the default is always the admin's own account.

 Every signed-in user has **Settings → Account**: their username, role, member
 since, workspace and session counts and active logins; their own picture
-(PNG, JPEG, GIF or WebP up to 1 MB, kept in `<data dir>/avatars/`; shown with
+(PNG, JPEG, GIF or WebP up to 1 MB, kept in `<data dir>/avatars/`, or an
+https link to one, which the browser loads itself — never downloaded, so a
+link behind a login (a Mattermost `/api/v4/users/<id>/image`) cannot show and
+is refused when saved; shown with
 their name and role at the foot of the sidebar, which opens this page); their
 own display name and email; **Change password** (the current password is required, the login
 it is changed from stays and every other one ends); and **Sign out other
@@ -7,8 +7,9 @@
 * another account never sees it through `/api/me`; staff read it at
 * `/api/users/:id/avatar` (a developer is refused) and a workspace carries
 * `owner_avatar_at` for the sidebar's owner groups. A picture from a link
- * (`POST /api/me/avatar/url`, server/lib/avatar-url.js) takes https only and
- * never reaches a loopback/private address.
+ * (`POST /api/me/avatar/url`, server/lib/avatar-url.js) is stored, never
+ * downloaded, and the avatar routes redirect to it; https only, never a
+ * loopback/private IP literal.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

@@ -110,6 +111,46 @@ it("refuses an SVG, an empty body, a too-large image and no login", async () =>
  assert.equal((await put("", PNG)).status, 401);
 });

+it("a picture from a link is stored and redirected to, never downloaded", async () => {
+  const ava = await login("ava", "ava-pass-1");
+  const ann = await login("ann", "ann-pass-1");
+  const link =
+    "https://chat.runsystem.vn/api/v4/users/7bya4wy58bdk3qmb5ks1rgoqkh/image?_=1776312011651";
+  assert.equal((await put(ava, PNG)).status, 200);
+  const set = await fetch(BASE + "/api/me/avatar/url", {
+    method: "POST",
+    headers: { cookie: ava, "Content-Type": "application/json" },
+    body: JSON.stringify({ url: ` ${link} ` }),
+  });
+  assert.equal(set.status, 200);
+  assert.ok((await set.json()).user.avatarAt);
+  // The uploaded file is gone: a link replaces it.
+  assert.equal(fs.readdirSync(path.join(TMP, "avatars")).length, 0);
+
+  const got = await fetch(BASE + "/api/me/avatar", {
+    headers: { cookie: ava },
+    redirect: "manual",
+  });
+  assert.equal(got.status, 302);
+  assert.equal(got.headers.get("location"), link);
+  assert.equal(got.headers.get("referrer-policy"), "no-referrer");
+  const id = auth.findUser("ava").id;
+  const staff = await fetch(`${BASE}/api/users/${id}/avatar`, {
+    headers: { cookie: ann },
+    redirect: "manual",
+  });
+  assert.equal(staff.status, 302);
+  assert.equal(staff.headers.get("location"), link);
+
+  // An upload replaces the link.
+  assert.equal((await put(ava, PNG)).status, 200);
+  assert.equal(
+    (await fetch(BASE + "/api/me/avatar", { headers: { cookie: ava }, redirect: "manual" })).status,
+    200
+  );
+  await fetch(BASE + "/api/me/avatar", { method: "DELETE", headers: { cookie: ava } });
+});
+
 it("a picture from a link: https only, never a private or local address", async () => {
  const ava = await login("ava", "ava-pass-1");
  const post = (url) =>
@@ -1933,9 +1933,10 @@ try {
 }
 // An account's own display name and email (the Users page's Edit user and
 // Settings → Account), and when its avatar was last set (server/lib/avatars.js
-// — the image is a file, the column only versions its URL). Additive; after
-// the rebuild above, which predates them.
-for (const col of ["display_name", "email", "avatar_at"]) {
+// — the image is a file, the column only versions its URL — or `avatar_link`,
+// a link the avatar routes redirect to). Additive; after the rebuild above,
+// which predates them.
+for (const col of ["display_name", "email", "avatar_at", "avatar_link"]) {
  try {
    db.prepare(`SELECT ${col} FROM users LIMIT 1`).get();
  } catch {
@@ -0,0 +1,21 @@
+/**
+ * @file avatar-redirect.js
+ * @description Answers an avatar GET (`/api/me/avatar`, `/api/users/:id/avatar`)
+ * with a 302 to the account's stored avatar LINK (server/lib/avatars.js), so
+ * the viewer's browser loads the picture itself — with its own logins and
+ * network — and the server never fetches it. No referrer is sent with it.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+/** True when the account has a link and the redirect was sent. */
+function sendAvatarLink(res, userId) {
+  const link = require("./avatars").avatarLink(userId);
+  if (!link) return false;
+  res.set("Referrer-Policy", "no-referrer");
+  // The client versions the URL with `avatarAt`, so a new link is a new URL.
+  res.set("Cache-Control", "private, max-age=86400");
+  res.redirect(302, link);
+  return true;
+}
+
+module.exports = { sendAvatarLink };
@@ -1,26 +1,19 @@
 /**
 * @file avatar-url.js
- * @description Fetches an avatar picture from a URL the account typed
- * (Settings → Account, `POST /api/me/avatar/url`), so the server — not the
- * browser, which most image hosts' CORS would block — downloads it. A URL the
- * user names makes the SERVER connect somewhere, so it is held to: `https://`
- * with no userinfo, a host whose EVERY resolved address is public (no
- * loopback, private, link-local, CGNAT, multicast or reserved range — the
- * dashboard's own network is never reachable this way), the connection pinned
- * to the vetted address (a second DNS answer cannot rebind it), at most
- * `MAX_REDIRECTS` redirects each re-checked the same way, a timeout, and at
- * most `MAX_AVATAR_BYTES` read. No cookie or credential is ever sent. The
- * bytes then go through `setAvatar`'s own magic-byte check like an upload.
+ * @description Checks an avatar LINK the account typed (Settings → Account,
+ * `POST /api/me/avatar/url`). The link is stored as it is and the avatar
+ * routes redirect the viewer's browser to it — the server never downloads it,
+ * so a picture behind the viewer's own login or on a company-internal host
+ * (e.g. a Mattermost `/api/v4/users/<id>/image`) still shows. Held to:
+ * `https://`, no userinfo, at most `MAX_LINK_LENGTH` characters, and no
+ * loopback/private/link-local/reserved IP literal as the host (a link may not
+ * aim every viewer's browser at their own machine or LAN).
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

-const dns = require("node:dns");
-const https = require("node:https");
 const net = require("node:net");
-const { MAX_AVATAR_BYTES } = require("./avatars");

-const MAX_REDIRECTS = 3;
-const TIMEOUT_MS = 10_000;
+const MAX_LINK_LENGTH = 2048;

 const fail = (code, message) => Object.assign(new Error(message), { code });

@@ -75,100 +68,29 @@ function isPublicAddress(address) {
  return !blocked.check(address, "ipv6");
 }

-/** The URL as a `URL`, or EBADURL: https only, no userinfo, a real host. */
+/** The link, normalised, or EBADURL / EPRIVATEURL: https only, no userinfo, a real host. */
 function parseAvatarUrl(text) {
+  const raw = String(text ?? "").trim();
+  if (raw.length > MAX_LINK_LENGTH) throw fail("EBADURL", "the link is too long");
  let url;
  try {
-    url = new URL(String(text ?? "").trim());
+    url = new URL(raw);
  } catch {
    throw fail("EBADURL", "not a valid URL");
  }
  if (url.protocol !== "https:") throw fail("EBADURL", "only an https:// link");
  if (url.username || url.password) throw fail("EBADURL", "a link with a login is refused");
  if (!url.hostname) throw fail("EBADURL", "not a valid URL");
-  // Node never calls `lookup` for an IP-literal host, so it is checked here.
-  const literal = url.hostname.replace(/^\[|\]$/g, "");
-  if (net.isIP(literal) && !isPublicAddress(literal)) {
+  const host = url.hostname.toLowerCase();
+  const literal = host.replace(/^\[|\]$/g, "");
+  if (
+    host === "localhost" ||
+    host.endsWith(".localhost") ||
+    (net.isIP(literal) && !isPublicAddress(literal))
+  ) {
    throw fail("EPRIVATEURL", "that address is not on the public internet");
  }
-  return url;
+  return url.href;
 }

-/**
- * `lookup` for `https.request`: resolves every address and refuses the host
- * when ANY of them is not public, then hands over only vetted ones.
- */
-function safeLookup(hostname, options, cb) {
-  if (typeof options === "function") [cb, options] = [options, {}];
-  const literal = hostname.replace(/^\[|\]$/g, "");
-  const done = (addrs) => {
-    if (!addrs.length || !addrs.every((a) => isPublicAddress(a.address))) {
-      return cb(fail("EPRIVATEURL", "that address is not on the public internet"));
-    }
-    if (options?.all) return cb(null, addrs);
-    return cb(null, addrs[0].address, addrs[0].family);
-  };
-  if (net.isIP(literal)) return done([{ address: literal, family: net.isIP(literal) }]);
-  dns.lookup(hostname, { all: true, verbatim: true }, (err, addrs) => {
-    if (err) return cb(fail("EFETCH", `could not resolve ${hostname}`));
-    done(addrs);
-  });
-}
-
-function getOnce(url) {
-  return new Promise((resolve, reject) => {
-    const req = https.get(
-      url,
-      {
-        lookup: safeLookup,
-        agent: false,
-        timeout: TIMEOUT_MS,
-        headers: { Accept: "image/png,image/jpeg,image/gif,image/webp", "User-Agent": "AgentHub" },
-      },
-      (res) => {
-        const status = res.statusCode || 0;
-        if (status >= 300 && status < 400 && res.headers.location) {
-          res.resume();
-          return resolve({ redirect: new URL(res.headers.location, url).href });
-        }
-        if (status !== 200) {
-          res.resume();
-          return reject(fail("EFETCH", `the server answered ${status}`));
-        }
-        if (Number(res.headers["content-length"]) > MAX_AVATAR_BYTES) {
-          res.destroy();
-          return reject(fail("ETOOBIG", "the image is too large"));
-        }
-        const chunks = [];
-        let size = 0;
-        res.on("data", (chunk) => {
-          size += chunk.length;
-          if (size > MAX_AVATAR_BYTES) {
-            res.destroy();
-            return reject(fail("ETOOBIG", "the image is too large"));
-          }
-          chunks.push(chunk);
-        });
-        res.on("end", () => resolve({ body: Buffer.concat(chunks) }));
-        res.on("error", (e) => reject(e.code ? e : fail("EFETCH", e.message)));
-      }
-    );
-    req.on("timeout", () => req.destroy(fail("EFETCH", "the server took too long")));
-    req.on("error", (e) =>
-      reject(e.code === "EPRIVATEURL" || e.code === "EFETCH" ? e : fail("EFETCH", e.message))
-    );
-  });
-}
-
-/** Downloads the picture at `text`; resolves to its bytes (unchecked — `setAvatar` sniffs them). */
-async function fetchAvatarImage(text) {
-  let url = parseAvatarUrl(text);
-  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-    const out = await getOnce(url);
-    if (out.body) return out.body;
-    url = parseAvatarUrl(out.redirect);
-  }
-  throw fail("EFETCH", "too many redirects");
-}
-
-module.exports = { fetchAvatarImage, isPublicAddress, parseAvatarUrl };
+module.exports = { MAX_LINK_LENGTH, isPublicAddress, parseAvatarUrl };
@@ -5,7 +5,9 @@
 * `<data dir>/avatars/u<id>.<png|jpg|gif|webp>` — a name made from the
 * account id and the type its magic bytes say, never from the request — and
 * `users.avatar_at` records when it was set, so the client can version the
- * URL. Raster only: an SVG served from the dashboard's origin runs script.
+ * URL. Or, instead of a file, a LINK (`users.avatar_link`, checked by
+ * avatar-url.js) the serving routes redirect the browser to — never
+ * downloaded. Setting one clears the other. Raster only: an SVG served from the dashboard's origin runs script.
 * At most `MAX_AVATAR_BYTES`; the serving route adds `nosniff` and a
 * `sandbox` CSP like every other user-supplied file.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -32,10 +34,35 @@ function fileName(userId, ext) {

 const db = () => require("../db").db;

-/** Deletes every stored avatar file of the account and clears `avatar_at`. */
-function removeAvatar(userId) {
+const removeFiles = (userId) => {
  for (const ext of EXTS) fs.rmSync(fileName(userId, ext), { force: true });
-  db().prepare("UPDATE users SET avatar_at = NULL WHERE id = ?").run(Number(userId));
+};
+
+/** Deletes every stored avatar file of the account and clears `avatar_at` and the link. */
+function removeAvatar(userId) {
+  removeFiles(userId);
+  db()
+    .prepare("UPDATE users SET avatar_at = NULL, avatar_link = NULL WHERE id = ?")
+    .run(Number(userId));
+}
+
+/** Stores `text` (EBADURL / EPRIVATEURL) as the account's avatar link; returns `avatar_at`. */
+function setAvatarLink(userId, text) {
+  const link = require("./avatar-url").parseAvatarUrl(text);
+  removeFiles(userId);
+  const at = new Date().toISOString();
+  db()
+    .prepare("UPDATE users SET avatar_at = ?, avatar_link = ? WHERE id = ?")
+    .run(at, link, Number(userId));
+  return at;
+}
+
+/** The account's avatar link, or null when it has none. */
+function avatarLink(userId) {
+  return (
+    db().prepare("SELECT avatar_link FROM users WHERE id = ?").get(Number(userId))?.avatar_link ||
+    null
+  );
 }

 /** Stores `buf` as the account's avatar (EBADIMAGE / ETOOBIG); returns `avatar_at`. */
@@ -54,7 +81,9 @@ function setAvatar(userId, buf) {
    if (other !== ext) fs.rmSync(fileName(userId, other), { force: true });
  }
  const at = new Date().toISOString();
-  db().prepare("UPDATE users SET avatar_at = ? WHERE id = ?").run(at, Number(userId));
+  db()
+    .prepare("UPDATE users SET avatar_at = ?, avatar_link = NULL WHERE id = ?")
+    .run(at, Number(userId));
  return at;
 }

@@ -68,4 +97,12 @@ function avatarFile(userId) {
  return null;
 }

-module.exports = { MAX_AVATAR_BYTES, setAvatar, removeAvatar, avatarFile, avatarsDir };
+module.exports = {
+  MAX_AVATAR_BYTES,
+  setAvatar,
+  setAvatarLink,
+  removeAvatar,
+  avatarFile,
+  avatarLink,
+  avatarsDir,
+};
@@ -14,7 +14,7 @@
 *   - GET/PATCH /api/me/account, POST /api/me/password, POST /api/me/sign-out-others
 *     (Auth) — Settings → Account: the account's own profile, password and logins
 *   - GET/PUT/DELETE /api/me/avatar (Auth) — the account's own picture
- *   - POST /api/me/avatar/url (Auth) — the same picture downloaded from a link
+ *   - POST /api/me/avatar/url (Auth) — the picture as a link, redirected to
 *   - GET/PATCH /api/users/{id} (Auth) — the Users page's Edit user form
 *   - GET /api/users/{id}/avatar (Auth) — one account's picture (admin/analyst)
 *   - GET /api/users/tmux, POST /api/users/{id}/tmux-restart, POST /api/users/tmux-restart-idle
@@ -309,9 +309,10 @@ const paths = {
    get: {
      tags: ["Auth"],
      operationId: "getMyAvatar",
-      summary: "The account's own picture (nosniff, sandbox CSP)",
+      summary: "The account's own picture (nosniff, sandbox CSP), or a 302 to its avatar link",
      responses: {
        200: { description: "The image (PNG, JPEG, GIF or WebP)" },
+        302: { description: "Redirect to the account's avatar link" },
        401: err("EAUTH"),
        404: err("ENOAVATAR"),
      },
@@ -500,7 +501,7 @@ const paths = {
      tags: ["Auth"],
      operationId: "setMyAvatarFromUrl",
      summary:
-        "Set the account's picture from an https link the server downloads (public addresses only, at most 3 redirects, PNG/JPEG/GIF/WebP, at most 1 MB). Login cookie only, audited",
+        "Set the account's picture to an https link, stored and never downloaded — the avatar GETs answer 302 to it (no userinfo, no localhost/private IP literal, at most 2048 chars). Login cookie only, audited",
      requestBody: {
        required: true,
        content: {
@@ -515,11 +516,9 @@ const paths = {
      },
      responses: {
        200: { description: "Set", content: accountBody },
-        400: err("EBADURL / EPRIVATEURL / EBADIMAGE"),
+        400: err("EBADURL / EPRIVATEURL"),
        401: err("EAUTH — no login cookie (a pane token is refused)"),
        403: err("ELOCALMODE"),
-        413: err("ETOOBIG"),
-        502: err("EFETCH — the link could not be downloaded"),
      },
    },
  },
@@ -531,6 +530,7 @@ const paths = {
      parameters: [{ name: "id", in: "path", required: true, schema: { type: "integer" } }],
      responses: {
        200: { description: "The image (PNG, JPEG, GIF or WebP)" },
+        302: { description: "Redirect to that account's avatar link" },
        403: err("EADMIN — a developer"),
        404: err("ENOAVATAR"),
      },
@@ -27,8 +27,8 @@
 * owner) may not change the owner's login. Each change is audited.
 * `/avatar` (server mode) is the account's own picture (server/lib/avatars.js):
 * GET serves it (`nosniff`, `sandbox` CSP), PUT takes the raw image bytes
- * (PNG/JPEG/GIF/WebP, at most 1 MB), `POST /avatar/url` downloads the same
- * from an https link (public addresses only, server/lib/avatar-url.js) and
+ * (PNG/JPEG/GIF/WebP, at most 1 MB), `POST /avatar/url` stores an https link
+ * instead, which `GET /avatar` redirects to (server/lib/avatar-url.js) and
 * DELETE removes it — all writes are account writes like the profile's. The sidebar shows it beside the name.
 *
 * S3 (one Linux user per account): an account's dark/light choice also becomes
@@ -264,11 +264,13 @@ router.post(
 );

 const avatars = require("../lib/avatars");
+const { sendAvatarLink } = require("../lib/avatar-redirect");

 router.get("/avatar", (req, res) => {
  if (!auth.isServerMode()) return res.status(404).json({ error: { code: "ENOAVATAR" } });
  const user = req.user || auth.userFromRequest(req);
  if (!user) return unauth(res);
+  if (sendAvatarLink(res, user.id)) return;
  const file = avatars.avatarFile(user.id);
  if (!file) return res.status(404).json({ error: { code: "ENOAVATAR", message: "no avatar" } });
  res.set("Content-Type", file.type);
@@ -289,13 +291,13 @@ router.put(
  })
 );

-// The same picture from a link: the server downloads it (server/lib/avatar-url.js).
+// A picture by link: stored as it is, never downloaded — GET /avatar redirects
+// the browser to it (server/lib/avatar-url.js).
 router.post(
  "/avatar/url",
  sameOriginGuard,
  accountWrite(async (_req, user, body) => {
-    const buf = await require("../lib/avatar-url").fetchAvatarImage(body.url);
-    avatars.setAvatar(user.id, buf);
+    avatars.setAvatarLink(user.id, body.url);
    return { out: accountView(user.id), action: "own avatar set from a link" };
  })
 );
@@ -209,6 +209,12 @@ router.get("/:id", (req, res) => {

 router.get("/:id/avatar", (req, res) => {
  const id = Number(req.params.id);
+  if (
+    Number.isSafeInteger(id) &&
+    id > 0 &&
+    require("../lib/avatar-redirect").sendAvatarLink(res, id)
+  )
+    return;
  const file = Number.isSafeInteger(id) && id > 0 ? require("../lib/avatars").avatarFile(id) : null;
  if (!file) return res.status(404).json({ error: { code: "ENOAVATAR", message: "no avatar" } });
  res.set("Content-Type", file.type);