feat: workspace aliases, tab groups of split panes, native path picker (v2.1.0)

- /api/workspaces and `agenthub workspace(s)` / `--workspace` as aliases of
  /api/lanes and `agenthub lanes` / `--lane`; old names print one stderr note.
  REPL `help lanes|workspace|workspaces` resolves through the aliases.
- A workspace holds up to ten sessions (slots 0-9); every console tab is a
  group of 1-4 split panes (PaneGroups, agenthub.workspace.paneLayout);
  parseGroups keeps the stored active tab when an earlier one is dropped.
- Browse button beside path fields: POST /api/lanes/pick-path opens the OS
  picker on the server's desktop — loopback only and no forwarding header
  (EREMOTE), a display failure is ENODIALOG not a Cancel, the dialog is
  killed when the request closes, a folder field falls back to the in-app
  browser on any failure.
- Changes rail counts chip, image viewer (/git/raw), status bar session
  counts and per-day cost (`date=` on /api/pricing/cost).
- /agenthub-open and /agenthub-doctor run from the INSTALLED build
  (supersededBy), doctor offers fixes behind two confirmations; plugin-open
  treats a locked bootstrap as non-fatal.
- New-terminal shell waits for the first attach (issue #55).
- repo-onboarding / debug-live-issue skills removed.
- OpenAPI: pick-path, lane/date on /pricing/cost, tool on /run/history,
  /api/workspaces mount.

server/routes/hooks.js

@@ -1318,7 +1318,7 @@ const HOOK_TOOLS = { codex: codexHookInput, antigravity: antigravityHookInput };
  */
 function bindRunSession(runId, sessionId, hookType, source, tool) {
   if (typeof sessionId !== "string" || !sessionId) return;
-  if (typeof runId !== "string" || !/^agenthub-lane-\d+(-[1-3])?$/.test(runId)) {
+  if (typeof runId !== "string" || !/^agenthub-lane-\d+(-[1-9])?$/.test(runId)) {
     // No pane named (a hook handler that predates AGENTHUB_RUN_ID): a run
     // that was started holding this very session id still owns it.
     const laneId = dashboardRuns.laneForSession(sessionId);

server/routes/lanes.js

@@ -30,6 +30,7 @@ const runs = require("../lib/pty-run");
 const { resumeRouter } = require("../lib/router-apply");
 const { sameOriginGuard } = require("./run");
 const { writeLaneFile } = require("../lib/lane-file-write");
+const { pickPath } = require("../lib/native-dialog");
 const { preflight } = require("../lib/lane-preflight");
 const {
   LANES_ROOT,
@@ -51,6 +52,7 @@ const {
   listTree,
   listTreeAll,
   readFileAt,
+  readImageAt,
 } = require("../lib/git-diff");
 const { runGitAction } = require("../lib/git-ops");
 const { withLaneLock } = require("../lib/lane-lock");
@@ -501,6 +503,40 @@ router.get("/browse", (req, res) => {
   res.json({ path: resolved, parent, entries });
 });
 
+/**
+ * The OS's own folder/file picker, shown on the SERVER's desktop
+ * (`server/lib/native-dialog.js`), answering `{path}` or `{cancelled: true}`.
+ * Only a client on this machine may ask — anywhere else the dialog would pop
+ * up on a screen nobody is looking at (`EREMOTE`); that client, and a server
+ * with no desktop (`ENODIALOG`), falls back to `GET /browse` above. A request
+ * a reverse proxy forwarded arrives from loopback too, so a forwarding header
+ * counts as remote. An SSH tunnel carries no such header and cannot be told
+ * apart — the dialog is closed when the browser's request goes away.
+ */
+router.post("/pick-path", sameOriginGuard, async (req, res) => {
+  const addr = req.socket.remoteAddress || "";
+  const proxied = req.headers["x-forwarded-for"] || req.headers.forwarded;
+  if (proxied || !["127.0.0.1", "::1", "::ffff:127.0.0.1"].includes(addr)) {
+    return res.status(403).json({
+      error: { code: "EREMOTE", message: "the native picker opens only for a local browser" },
+    });
+  }
+  const kind = req.body?.kind === "file" ? "file" : "dir";
+  const ac = new AbortController();
+  res.on("close", () => {
+    if (!res.writableFinished) ac.abort();
+  });
+  try {
+    const picked = await pickPath(kind, req.body?.start, ac.signal);
+    if (ac.signal.aborted) return;
+    res.json(picked ? { path: picked } : { cancelled: true });
+  } catch (err) {
+    if (ac.signal.aborted) return;
+    const status = err.code === "EBUSY" ? 409 : err.code === "ENODIALOG" ? 501 : 500;
+    res.status(status).json({ error: { code: err.code || "EDIALOG", message: err.message } });
+  }
+});
+
 router.get("/:id", (req, res) => {
   const lane = lanesLib.getLane(req.params.id);
   if (!lane)
@@ -901,6 +937,40 @@ router.get("/:id/git/file", async (req, res) => {
   }
 });
 
+/**
+ * One image's bytes (`?path=&rev=work|HEAD|<sha>`) for the viewer's `<img>`:
+ * `readImageAt`'s guards (the file read's, plus an image-extension allowlist
+ * that picks the Content-Type). Served under a `sandbox` CSP with `nosniff`,
+ * so an SVG opened straight from this URL runs no script on the dashboard's
+ * origin.
+ */
+router.get("/:id/git/raw", async (req, res) => {
+  const t = await gitTargetOr404(req, res);
+  if (!t) return;
+  try {
+    const { type, buf } = await readImageAt(
+      t.cwd,
+      typeof req.query.path === "string" ? req.query.path : "",
+      typeof req.query.rev === "string" && req.query.rev ? req.query.rev : "work"
+    );
+    res.set({
+      "Content-Type": type,
+      "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox",
+      "X-Content-Type-Options": "nosniff",
+      "Cache-Control": "no-store",
+    });
+    res.send(buf);
+  } catch (err) {
+    if (err.code === "ESECRET") {
+      return res.status(403).json({ error: { code: err.code, message: err.message } });
+    }
+    if (["EBADPATH", "EBADREV", "ENOFILE", "ENOTIMAGE", "ETOOBIG"].includes(err.code)) {
+      return res.status(400).json({ error: { code: err.code, message: err.message } });
+    }
+    res.status(500).json({ error: { code: "EREAD", message: "could not read the image" } });
+  }
+});
+
 /**
  * Save one text file in the lane from the viewer's editor. Guards live in
  * lane-file-write.js (the read path's own, plus existing-textual-file-only and

server/routes/pricing.js

@@ -477,6 +477,12 @@ router.get("/cost", (req, res) => {
       .status(400)
       .json({ error: { code: "INVALID_INPUT", message: "lane must be a lane id" } });
   }
+  const date = req.query.date;
+  if (date !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(String(date))) {
+    return res
+      .status(400)
+      .json({ error: { code: "INVALID_INPUT", message: "date must be YYYY-MM-DD" } });
+  }
   const scope = sourceColumnClause(parseSources(req), "s.source");
   const params = [...scope.params];
   const where = scope.clause ? [scope.clause] : [];
@@ -489,7 +495,9 @@ router.get("/cost", (req, res) => {
   }
   const whereClause = where.length ? `WHERE ${where.join(" AND ")}` : "";
 
-  const dailyTokens = dailyTokenRows(tzModifier, whereClause, params);
+  let dailyTokens = dailyTokenRows(tzModifier, whereClause, params);
+  // `date=`: only that local day (the status bar's Today and its per-model list).
+  if (date !== undefined) dailyTokens = dailyTokens.filter((r) => r.date === date);
   const rules = stmts.listPricing.all();
   // Price the date-split rows so each day's usage bills at the rate effective on
   // that date (e.g. Sonnet 5's intro discount before 2026-08-31, standard after).

server/routes/run.js

@@ -84,7 +84,8 @@ router.get("/", (_req, res) => {
  *
  * Optional ?limit=<n> caps results (default 50, max 500). The most recent
  * runs are first. Optional ?laneId=<n> narrows to the runs started through one
- * lane, which is what the Workspace page's per-lane history shows.
+ * lane, and ?tool=<id> (with a laneId) to one tool's — the sidebar reads a
+ * workspace's closed Terminal tabs with `tool=shell`.
  */
 // ── Drag & drop into the terminal ─────────────────────────────────────────
 // A local terminal answers a dropped image by typing its PATH, which is how
@@ -149,6 +150,7 @@ router.get("/history", (req, res) => {
   const items = dr.listRuns({
     limit: Number.isFinite(limit) ? limit : 50,
     laneId: Number.isFinite(laneId) ? laneId : null,
+    tool: typeof req.query.tool === "string" ? req.query.tool : null,
   });
   const liveIds = new Set(runs.listRuns().map((h) => h.id));
   res.json({