chore: v2.8.19 — avatar from a link the browser loads, Files groups workspaces by owner

CLAUDE.md

@@ -1,6 +1,6 @@
 # Claude Code Working Guide
 
-_Last synced: v2.8.18 (2026-10-22) — a pasted file-manager copy attaches by path on a local browser; OpenAPI covers every route; config writes same-origin._ A change that makes any statement in this file, `AGENTS.md`, or a README wrong — a moved path, a new or changed extension point, a retired rule — updates that file in the same change-set and bumps this marker. **Bump = replace the version/date and a ≤ 1-line summary; never append a changelog here** — details belong in the commit message and `docs/`, because this whole file is loaded into every session.
+_Last synced: v2.8.19 (2026-10-22) — an avatar can be a link the browser loads (refused when it does not load); Files nests workspaces under their owners' homes._ A change that makes any statement in this file, `AGENTS.md`, or a README wrong — a moved path, a new or changed extension point, a retired rule — updates that file in the same change-set and bumps this marker. **Bump = replace the version/date and a ≤ 1-line summary; never append a changelog here** — details belong in the commit message and `docs/`, because this whole file is loaded into every session.
 
 ## Project mission
 - Maintain a reliable local-first dashboard for Claude Code session monitoring.

openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
   title: Agent Dashboard for Claude Code API
-  version: 2.8.18
+  version: 2.8.19
   description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
   contact:
     name: Nguyễn Ngọc Trí Vĩ
@@ -14564,10 +14564,12 @@ paths:
       tags:
         - Auth
       operationId: getMyAvatar
-      summary: The account's own picture (nosniff, sandbox CSP)
+      summary: The account's own picture (nosniff, sandbox CSP), or a 302 to its avatar link
       responses:
         '200':
           description: The image (PNG, JPEG, GIF or WebP)
+        '302':
+          description: Redirect to the account's avatar link
         '401':
           description: EAUTH
           content:
@@ -14846,7 +14848,7 @@ paths:
       tags:
         - Auth
       operationId: setMyAvatarFromUrl
-      summary: Set the account's picture from an https link the server downloads (public addresses only, at most 3 redirects, PNG/JPEG/GIF/WebP, at most 1 MB). Login cookie only, audited
+      summary: Set the account's picture to an https link, stored and never downloaded — the avatar GETs answer 302 to it (no userinfo, no localhost/private IP literal, at most 2048 chars). Login cookie only, audited
       requestBody:
         required: true
         content:
@@ -14867,7 +14869,7 @@ paths:
               schema:
                 $ref: '#/components/schemas/MyAccount'
         '400':
-          description: EBADURL / EPRIVATEURL / EBADIMAGE
+          description: EBADURL / EPRIVATEURL
           content:
             application/json:
               schema:
@@ -14884,18 +14886,6 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/ErrorResponse'
-        '413':
-          description: ETOOBIG
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '502':
-          description: EFETCH — the link could not be downloaded
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
   /api/users/{id}/avatar:
     get:
       tags:
@@ -14911,6 +14901,8 @@ paths:
       responses:
         '200':
           description: The image (PNG, JPEG, GIF or WebP)
+        '302':
+          description: Redirect to that account's avatar link
         '403':
           description: EADMIN — a developer
           content:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "agenthub",
-  "version": "2.8.18",
+  "version": "2.8.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agenthub",
-      "version": "2.8.18",
+      "version": "2.8.19",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenthub",
-  "version": "2.8.18",
+  "version": "2.8.19",
   "bin": {
     "agenthub": "bin/agenthub.js"
   },