From 44426faf16588bdf89f1ebaeb44e5132c485546c Mon Sep 17 00:00:00 2001
From: nntrivi2001 <vinnt@smartgift.vn>
Date: Thu, 22 Oct 2026 14:34:50 +0700
Subject: [PATCH] =?UTF-8?q?chore:=20v2.8.19=20=E2=80=94=20avatar=20from=20?=
 =?UTF-8?q?a=20link=20the=20browser=20loads,=20Files=20groups=20workspaces?=
 =?UTF-8?q?=20by=20owner?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CLAUDE.md         |  2 +-
 openapi.yaml      | 24 ++++++++----------------
 package-lock.json |  4 ++--
 package.json      |  2 +-
 4 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 7202edcd..1a66789b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,6 +1,6 @@
 # Claude Code Working Guide
 
-_Last synced: v2.8.18 (2026-10-22) — a pasted file-manager copy attaches by path on a local browser; OpenAPI covers every route; config writes same-origin._ A change that makes any statement in this file, `AGENTS.md`, or a README wrong — a moved path, a new or changed extension point, a retired rule — updates that file in the same change-set and bumps this marker. **Bump = replace the version/date and a ≤ 1-line summary; never append a changelog here** — details belong in the commit message and `docs/`, because this whole file is loaded into every session.
+_Last synced: v2.8.19 (2026-10-22) — an avatar can be a link the browser loads (refused when it does not load); Files nests workspaces under their owners' homes._ A change that makes any statement in this file, `AGENTS.md`, or a README wrong — a moved path, a new or changed extension point, a retired rule — updates that file in the same change-set and bumps this marker. **Bump = replace the version/date and a ≤ 1-line summary; never append a changelog here** — details belong in the commit message and `docs/`, because this whole file is loaded into every session.
 
 ## Project mission
 - Maintain a reliable local-first dashboard for Claude Code session monitoring.
diff --git a/openapi.yaml b/openapi.yaml
index 65574bb8..2a39c22c 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
   title: Agent Dashboard for Claude Code API
-  version: 2.8.18
+  version: 2.8.19
   description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
   contact:
     name: Nguyễn Ngọc Trí Vĩ
@@ -14564,10 +14564,12 @@ paths:
       tags:
         - Auth
       operationId: getMyAvatar
-      summary: The account's own picture (nosniff, sandbox CSP)
+      summary: The account's own picture (nosniff, sandbox CSP), or a 302 to its avatar link
       responses:
         '200':
           description: The image (PNG, JPEG, GIF or WebP)
+        '302':
+          description: Redirect to the account's avatar link
         '401':
           description: EAUTH
           content:
@@ -14846,7 +14848,7 @@ paths:
       tags:
         - Auth
       operationId: setMyAvatarFromUrl
-      summary: Set the account's picture from an https link the server downloads (public addresses only, at most 3 redirects, PNG/JPEG/GIF/WebP, at most 1 MB). Login cookie only, audited
+      summary: Set the account's picture to an https link, stored and never downloaded — the avatar GETs answer 302 to it (no userinfo, no localhost/private IP literal, at most 2048 chars). Login cookie only, audited
       requestBody:
         required: true
         content:
@@ -14867,7 +14869,7 @@ paths:
               schema:
                 $ref: '#/components/schemas/MyAccount'
         '400':
-          description: EBADURL / EPRIVATEURL / EBADIMAGE
+          description: EBADURL / EPRIVATEURL
           content:
             application/json:
               schema:
@@ -14884,18 +14886,6 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/ErrorResponse'
-        '413':
-          description: ETOOBIG
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
-        '502':
-          description: EFETCH — the link could not be downloaded
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/ErrorResponse'
   /api/users/{id}/avatar:
     get:
       tags:
@@ -14911,6 +14901,8 @@ paths:
       responses:
         '200':
           description: The image (PNG, JPEG, GIF or WebP)
+        '302':
+          description: Redirect to that account's avatar link
         '403':
           description: EADMIN — a developer
           content:
diff --git a/package-lock.json b/package-lock.json
index d83ebea8..05e10337 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "agenthub",
-  "version": "2.8.18",
+  "version": "2.8.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agenthub",
-      "version": "2.8.18",
+      "version": "2.8.19",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "dependencies": {
diff --git a/package.json b/package.json
index 6b08571d..a5cfd3df 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "agenthub",
-  "version": "2.8.18",
+  "version": "2.8.19",
   "bin": {
     "agenthub": "bin/agenthub.js"
   },