chore: v2.8.5 — Trash opens on one folder per user, server setup installs S3

- Files → Trash: ONE sidebar entry. An admin's opens on a folder per user's Trash (My Trash first, item counts from GET /api/homes/trash, an unreadable one showing its error); a folder opens that user's Trash (path bar Trash › user, Up back to the folders). An admin may restore/purge in another user's Trash (audited); purging asks first. The merged "All users" list is gone from the UI. - A home's Trash is its user's whole recycle bin (home store + host store, items tagged `store`). - `agenthub server setup` installs one Linux user per account on Linux by default (`--no-system` opts out); install-system messages drop `sudo`. - Settings → Git: the author email suggests <username>@<AGENTHUB_EMAIL_DOMAIN>. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 16:02:11 +07:00
parent 09efb089cf
commit 758609775f
27 changed files with 839 additions and 107 deletions
@@ -1,6 +1,6 @@
 # Claude Code Working Guide

-_Last synced: v2.8.4 (2026-10-15) — tmux-member (member tmux follows upgrades), Users → Members' tmux._ A change that makes any statement in this file, `AGENTS.md`, or a README wrong — a moved path, a new or changed extension point, a retired rule — updates that file in the same change-set and bumps this marker. **Bump = replace the version/date and a ≤ 1-line summary; never append a changelog here** — details belong in the commit message and `docs/`, because this whole file is loaded into every session.
+_Last synced: v2.8.5 (2026-10-15) — `server setup` installs S3 on Linux by default (`--no-system` opts out); `install-system` runs WITHOUT sudo; admin Trash = one folder per user._ A change that makes any statement in this file, `AGENTS.md`, or a README wrong — a moved path, a new or changed extension point, a retired rule — updates that file in the same change-set and bumps this marker. **Bump = replace the version/date and a ≤ 1-line summary; never append a changelog here** — details belong in the commit message and `docs/`, because this whole file is loaded into every session.

 ## Project mission
 - Maintain a reliable local-first dashboard for Claude Code session monitoring.
@@ -56,7 +56,7 @@ A **workspace** — called a **lane** in the API, CLI, database and code, which
 - **Adopted lanes are not destroyable.** A lane with `kind === "adopted"` may never have its worktree reset or removed; "removing" one only drops the dashboard's own record of it. This is enforced in code (`assertDestroyable`'s first check) — do not add a path that bypasses it.
 - **Removing a lane deletes the lane's RECORD and nothing else — for every kind, managed included.** `POST /api/lanes/:id/remove` stops the run and the stack, clears AgentHub's own runtime bookkeeping under `LANES_ROOT/.state/lane<slot>/`, and deletes the row. It calls neither `removeWorktree` nor `removeLaneData`: the working tree, its branch and the lane's database are the USER's data, and a mis-click on a dashboard row may never cost a branch's unpushed code. Deleting those is the user's own `git worktree remove` / `git branch -d` / db drop. Consequently `remove` has no unpushed-commits force-gate (only `reset` does) and no preflight blocker stops it. Do not add a "also delete the worktree" flag back onto this route. (A session's own `claude --worktree` tree is a different thing with its own guarded route — see the session-worktree rule below; a lane's folder is never it.)
 - **A lane can hold up to ten tmux sessions (slots 0–9; the Workspace groups them into tabs of up to four split panes) — and only slot 0 is the lane's run.** `agenthub-lane-<id>` is slot 0 and the only one `run_id`/`status` ever record; `agenthub-lane-<id>-<1-9>` are extra sessions on the same lane (`MAX_PANE_SLOT` in `server/lib/pty-run.js`; the `-[1-9]` run id pattern is repeated in `pty-attach.js`, `websocket.js`, `routes/hooks.js` and the client — widen them together). Anything that must stop a lane's agents (`stop`, `reset`, `remove`) goes through `laneRunIds` so no slot survives it; anything that names "the lane's pane" (`agenthub lanes shell`) means slot 0. A client that wants "a new tab" sends `slot: "auto"` and the SERVER picks the first free slot under the lane lock (`409 ERUNLIVE` when all ten are busy) — never a slot computed from the client's own list, which may already be stale.
- **The File Explorer (`server/lib/file-explorer.js`, `/api/lanes/:id/fs/*`) reuses the read path's guards and never replaces silently.** Every path is `lanePath` + the PARENT `resolveInLane`-confined with the last segment kept as a name (so a symlink is moved/deleted as a link, never followed); never in or under `.git`, never a secret, never the workspace folder itself. Writes run as the folder's account — a member's only through `write-as` (`move`/`copy` modes; `writeAsAsync` streams an upload to its stdin) — and a move/copy never crosses accounts (`sameOwner`, `EFOREIGN`). A taken name is settled by `conflict` (`fail` → 409 with `names`, `skip`, `keep`, `replace` = the old one to the trash first). Delete is a move into the account's trash (member: `~/.local/share/agenthub/trash/`, host: `<data dir>/trash/<user id>/`), restorable 7 days. `write-as` is root-installed: a change to it needs `sudo agenthub server install-system` again (`EUPGRADE` until then). A user's HOME is browsed through the same module inside `inHome` (`/api/homes/:who/fs/*`, `server/lib/homes.js` picks the folder): every dot entry at the TOP of a home stays hidden and refused — through a symlink, a download, a zip or as a copy source too — and another user's home is an admin's READ-ONLY, audited view (`EREADONLY`). Do not add a delete that skips the trash, an overwrite without `conflict`, or a request path that is not run through `locate`/`folder`.
+- **The File Explorer (`server/lib/file-explorer.js`, `/api/lanes/:id/fs/*`) reuses the read path's guards and never replaces silently.** Every path is `lanePath` + the PARENT `resolveInLane`-confined with the last segment kept as a name (so a symlink is moved/deleted as a link, never followed); never in or under `.git`, never a secret, never the workspace folder itself. Writes run as the folder's account — a member's only through `write-as` (`move`/`copy` modes; `writeAsAsync` streams an upload to its stdin) — and a move/copy never crosses accounts (`sameOwner`, `EFOREIGN`). A taken name is settled by `conflict` (`fail` → 409 with `names`, `skip`, `keep`, `replace` = the old one to the trash first). Delete is a move into the account's trash (member: `~/.local/share/agenthub/trash/`, host: `<data dir>/trash/<user id>/`), restorable 7 days. `write-as` is root-installed: a change to it needs `agenthub server install-system` again (`EUPGRADE` until then). A user's HOME is browsed through the same module inside `inHome` (`/api/homes/:who/fs/*`, `server/lib/homes.js` picks the folder): every dot entry at the TOP of a home stays hidden and refused — through a symlink, a download, a zip or as a copy source too — and another user's home is an admin's READ-ONLY, audited view (`EREADONLY`) — except its TRASH, whose restore/purge an admin may run (`TRASH_W` in `server/routes/homes.js`, the owner's trash via `trashKey`, audited with the item id); keep that exception to the trash routes only. A home's Trash is its USER's one recycle bin (`listUserTrash`: home-account store + host store `<data dir>/trash/<user id>/`, items tagged `store`). Do not add a delete that skips the trash, an overwrite without `conflict`, or a request path that is not run through `locate`/`folder`.
 - **The whole-file editor and the Files tab's upload are the two non-git writes on the lane file surface, and both live outside `git-ops.js` on purpose.** `git-ops.js` only touches paths `git status` reports as changed; `lane-file-write.js` may save any existing text file, so it must reuse the READ path's guards (`lanePath`, `resolveInLane`, `isSecretOnDisk`) and never be weaker than them, and it saves only over the `baseSha` it was opened at — do not let it create files or touch a binary. `lane-file-transfer.js`'s upload (`POST /api/lanes/:id/git/upload`, issue #78) is the opposite and only that: it CREATES one file (any bytes, ≤ 25 MB) under the same guards, into an existing folder, refuses a taken name (`EEXISTS`, a symlink included) and anything into or named `.git` (a hook there runs on the dashboard's next git call), and writes as the folder's member through `write-as` under S3 — do not let it overwrite, make folders or take a path from anything but `dir` + one plain name. Its `GET …/git/download` twin streams any file through `openSafe` as a `sandbox`ed attachment. The tree, expand-all and quick-open read the disk (`walkFolder`) for a folder that is not a repo.
 - **Server tests never touch the user's tmux.** Run them through `npm run test:server` (`scripts/test-server.js`), never a bare `node --test server/__tests__/*.test.js` from inside a lane pane — the suites create and kill real `agenthub-lane-<id>` sessions.
 - **An artifact is shared as a SNAPSHOT and installed only into the viewer's own account.** `server/lib/artifacts.js` (`/api/artifacts`): a pinned file or a skill is copied once into `<data dir>/artifacts/<random>/` and every viewer reads only that copy — `raw` serves only a file the snapshot recorded, under a `sandbox` CSP + `nosniff`; a `page` is a `https://claude.ai/…` link only. A developer sees their own rows plus shared ones; only the owner or an admin changes one. Install writes a skill into the CALLER's `~/.claude/skills/` (S3: as them through `write-as`), never over an existing one without `replace` (the old one is moved to `~/.claude/agenthub-replaced-skills/`, never deleted), and runs a plugin's `claude plugin marketplace add`/`install --scope user` as the caller, never with `-y`; an admin's switch (Settings → AI tools, `ArtifactsHubSettings`) turns installs off. An uploaded or written skill is snapshotted under the same checks (paths relative, no `..`, no secret names, zip sizes read before inflating). `POST /api/artifacts/plugin/inspect` clones a user-named https link only to read `marketplace.json`, with every credential helper OFF — never send a login with it. Do not add a route that serves a live file of another user, installs into someone else's account, or takes a plugin command from the request.
@@ -3934,21 +3934,73 @@ async function cmdServer(sub, flags) {
    } else {
      console.log(c.dim("  an admin already exists — add more with `agenthub users add`"));
    }
+    const wasServer = auth.isServerMode();
    settingsEnv.writeSetting("AGENTHUB_MODE", "server");
    envNote("AGENTHUB_MODE");
    console.log(`${c.green("✔")} server mode on (${file})`);
+    // One Linux user per account (S3) is the default on Linux: install it now
+    // (one sudo), unless it is already in place or `--no-system` opts out.
+    const linux = require(path.join(REPO_ROOT, "server", "lib", "linux-accounts.js"));
+    const shared = flags["no-system"] === true || process.platform !== "linux";
+    if (!shared) {
+      if (linux.serverConf()) {
+        console.log(c.dim("  one Linux user per account is already installed"));
+        // The system unit serves; it reads the mode only when it starts.
+        if (!wasServer) {
+          const r = spawnSync("sudo", [
+            "-n",
+            "systemctl",
+            "restart",
+            "--no-block",
+            "agenthub.service",
+          ]);
+          console.log(
+            r.status === 0
+              ? `${c.green("✔")} agenthub.service restarted`
+              : c.yellow("! restart it: sudo systemctl restart agenthub")
+          );
+        }
+      } else {
+        console.log("  Installing one Linux user per account (asks for your sudo password)…");
+        try {
+          await installSystem({}, settingsEnv);
+        } catch (e) {
+          throw new Error(
+            `${e.message}\n  Server mode is on, but every pane still runs as this account.` +
+              "\n  Fix it and run `agenthub server install-system`, or keep one shared" +
+              " account with `agenthub server setup --no-system`."
+          );
+        }
+      }
+      // The admin made above (and anyone made before) gets their Linux account.
+      process.env.AGENTHUB_MODE = "server";
+      await cmdUsers("provision", [], { all: true });
+    }
    console.log("  Next:");
    console.log(
-      "  1. Restart the dashboard: systemctl --user restart agenthub  (or agenthub start)"
+      shared
+        ? "  1. Restart the dashboard: systemctl --user restart agenthub  (or agenthub start)"
+        : "  1. Log out and back in once, so your shell joins the agenthub groups"
    );
    console.log(
      "  2. Serve it over HTTPS through a reverse proxy that keeps the Host header,\n" +
        "     and run setup with --hostname <that name> — see docs/SERVER-MODE.md."
    );
-    console.log(
-      c.dim("  Members see only their own workspaces, but every pane still runs as this")
-    );
-    console.log(c.dim("  one Linux account — use it with people you trust (docs/SERVER-MODE.md)."));
+    if (shared) {
+      console.log(
+        c.yellow(
+          process.platform === "linux"
+            ? "! --no-system: every pane runs as this one Linux account"
+            : "! one Linux user per account needs Linux: every pane runs as this one account"
+        )
+      );
+      console.log(
+        c.dim("  Members see only their own workspaces, but an agent in a pane can read")
+      );
+      console.log(
+        c.dim("  every user's files — use it with people you trust (docs/SERVER-MODE.md).")
+      );
+    }
    console.log(
      c.dim("  Workspaces made before now have no owner: agenthub users assign <id> <user>")
    );
@@ -3989,7 +4041,7 @@ async function cmdServer(sub, flags) {
  }
  console.error(
    c.red(
-      "✖ Usage: agenthub server setup [--hostname name] [--admin name] | install-system [--dry-run|--uninstall] | tools | off | status"
+      "✖ Usage: agenthub server setup [--hostname name] [--admin name] [--no-system] | install-system [--dry-run|--uninstall] | tools | off | status"
    )
  );
  process.exitCode = 1;
@@ -18,7 +18,12 @@
 * or dropped from the desktop), streamed with progress, ≤ 500 MB a batch;
 * drag items onto a folder to move them (Ctrl: copy); download a file as
 * itself, anything else as one zip; a taken name asks Replace / Keep both /
- * Skip. Server side: `/api/lanes/:id/fs/*` (server/lib/file-explorer.js).
+ * Skip. Deleting forever asks first when it empties the Trash or touches
+ * another user's. An admin's Trash opens on one folder per user (with its
+ * item count); each folder is THAT user's Trash, to restore from or purge
+ * without waiting the 7 days.
+ * Server side: `/api/lanes/:id/fs/*` and `/api/homes/:who/fs/*`
+ * (server/lib/file-explorer.js).
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

@@ -82,6 +87,7 @@ import {
 import type { Lane } from "../../lib/types";
 import { useDialog } from "../../hooks/useDialog";
 import { toast } from "../../lib/toast";
+import { confirmDialog } from "../../lib/confirm";
 import { formatBytes } from "../../lib/format";
 import { copyText } from "../../lib/clipboard";
 import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../ContextMenu";
@@ -250,6 +256,10 @@ export function FileBrowser({
  const [showHidden, setShowHidden] = useState(() => readPref(HIDDEN_KEY, "0") === "1");
  const [query, setQuery] = useState<string | null>(null);
  const [trash, setTrash] = useState<FsTrashItem[]>([]);
+  // An admin's Trash opens on its root: one folder per user's Trash, counted
+  // from `GET /api/homes/trash` (a Trash that could not be read: its error).
+  const [trashRoot, setTrashRoot] = useState(false);
+  const [trashErrors, setTrashErrors] = useState<Record<string, string>>({});
  const [busy, setBusy] = useState(false);
  const [renaming, setRenaming] = useState<{ path: string; value: string } | null>(null);
  const [creating, setCreating] = useState<{ kind: "dir" | "file"; value: string } | null>(null);
@@ -330,7 +340,12 @@ export function FileBrowser({
    setError(null);
    setLoading(true);
    try {
-      if (view === "trash") setTrash((await api.files.trash(target)).items);
+      if (view === "trash" && trashRoot) {
+        const out = await api.files.allTrash();
+        setTrash(out.items);
+        // A user whose trash could not be read is said so on their folder.
+        setTrashErrors(Object.fromEntries((out.errors ?? []).map((e) => [e.home, e.message])));
+      } else if (view === "trash") setTrash((await api.files.trash(target)).items);
      else setListing(await api.files.list(target, path));
    } catch (e) {
      // A dashboard that does not know /fs yet (not restarted) answers 404.
@@ -338,10 +353,11 @@ export function FileBrowser({
        (e as { status?: number }).status === 404 && !errCode(e) ? t("fx.unavailable") : errText(e)
      );
      if (view === "files" && errCode(e) === "ENOFILE" && path) setPathState("");
+      if (view === "trash") setTrash([]);
    } finally {
      setLoading(false);
    }
-  }, [target, path, view, t]);
+  }, [target, path, view, trashRoot, t]);
  useEffect(() => {
    void load();
  }, [load]);
@@ -635,11 +651,70 @@ export function FileBrowser({

  const homeName = (who: string) =>
    who === "me" ? t("fx.myHome") : (homes.find((h) => h.id === who)?.label ?? who);
+  /** Delete forever — asked first when it is all of it or someone else's. */
+  const purge = async (id: string) => {
+    if (id === "all" || ro) {
+      const item = trash.find((i) => i.id === id);
+      const ok = await confirmDialog({
+        title: id === "all" ? t("fx.emptyTrashTitle") : t("fx.purgeTitle"),
+        message:
+          id === "all"
+            ? t("fx.emptyTrashBody", { count: trash.length, where: trashLabel })
+            : t("fx.purgeBody", { name: item?.path ?? id, where: trashLabel }),
+        confirmLabel: id === "all" ? t("fx.emptyTrash") : t("fx.purge"),
+      });
+      if (!ok) return;
+    }
+    const item = trash.find((i) => i.id === id);
+    await run(() => api.files.purge(target, id, item?.store), t("fx.purged"));
+  };
+  const restoreItem = (id: string) => {
+    const item = trash.find((i) => i.id === id);
+    void run(() => api.files.restore(target, id, item?.store), t("fx.restored"));
+  };
+  /**
+   * Open a Trash. Every user has ONE recycle bin — their home's, over every
+   * place they deleted in — so `home` opens that user's ("me": the caller's);
+   * null (no home to open) falls back to the trash of the place shown, and
+   * "*" opens the root an admin starts on: one folder per user's Trash.
+   */
+  const openTrash = (home: string | null) => {
+    if (home === "*") {
+      setTrashRoot(true);
+      setView("trash");
+      setSelected(new Set());
+      return;
+    }
+    setTrashRoot(false);
+    if (home && !(isHomePlace(target) && target.home === home)) {
+      setTarget({ home });
+      setPathState("");
+      setHistory({ back: [], fwd: [] });
+      onNavigate?.({ home }, "");
+    }
+    setView("trash");
+    setSelected(new Set());
+  };
+  // Someone else's Trash can be opened: the Trash starts on its folders.
+  const manyTrashes = homes.some((h) => h.id !== "me");
+  const openTrashes = () =>
+    openTrash(manyTrashes ? "*" : homes.some((h) => h.id === "me") ? "me" : null);
  const placeName = (p: FsPlace) => (isHomePlace(p) ? homeName(p.home) : laneName(laneOf(p)!));
  const laneName = (id: number) => {
    const l = lanes.find((x) => x.id === id);
    return l ? l.title || l.cwd.split("/").pop() || `#${id}` : `#${id}`;
  };
+  // A home's Trash is its USER's recycle bin, named after them: another
+  // user's shows THAT user's (an admin may restore from or purge it; the rest
+  // of the home stays read-only). A workspace's (no home to open) is the
+  // trash of whoever owns its folder.
+  const trashLabel = trashRoot
+    ? t("fx.trash")
+    : !isHomePlace(target)
+      ? t("fx.trashAt", { name: laneName(laneOf(target)!) })
+      : target.home === "me"
+        ? t("fx.myTrash")
+        : t("fx.trashOf", { name: homeName(target.home) });
  const crumbs = path ? path.split("/") : [];
  const menuItem = ctx.menu?.item ?? null;
  const menuTargets = menuItem ? (selected.has(menuItem.path) ? selectedEntries : [menuItem]) : [];
@@ -748,17 +823,10 @@ export function FileBrowser({
            </button>
          ))}
        </nav>
-        <div className="border-t border-border p-2">
-          <button
-            type="button"
-            onClick={() => {
-              setView("trash");
-              setSelected(new Set());
-            }}
-            className={placeClass(view === "trash")}
-          >
-            <Trash2 className="h-4 w-4" />
-            {t("fx.trash")}
+        <div className="border-t border-border p-2" data-testid="fx-trashes">
+          <button type="button" onClick={openTrashes} className={placeClass(view === "trash")}>
+            <Trash2 className="h-4 w-4 shrink-0" />
+            <span className="truncate">{t("fx.trash")}</span>
          </button>
        </div>
      </aside>
@@ -774,8 +842,8 @@ export function FileBrowser({
          </HeadButton>
          <HeadButton
            label={t("fx.up")}
-            disabled={view !== "files" || listing?.parent == null}
-            onClick={goUp}
+            disabled={view === "trash" ? trashRoot || !manyTrashes : listing?.parent == null}
+            onClick={view === "trash" ? () => openTrash("*") : goUp}
          >
            <ArrowUp className="h-4 w-4" />
          </HeadButton>
@@ -805,9 +873,29 @@ export function FileBrowser({
              aria-label={t("fx.location")}
              className="flex min-w-0 flex-1 items-center overflow-x-auto rounded-md bg-surface-2 px-1 py-0.5"
            >
-              {view === "trash" ? (
+              {view === "trash" && manyTrashes ? (
+                <>
+                  <button
+                    type="button"
+                    onClick={() => openTrash("*")}
+                    className={`flex shrink-0 items-center gap-1.5 rounded px-2 py-1 text-sm hover:bg-surface-3 ${
+                      trashRoot ? "font-semibold" : "text-fg-secondary"
+                    }`}
+                  >
+                    <Trash2 className="h-4 w-4" /> {t("fx.trash")}
+                  </button>
+                  {!trashRoot && (
+                    <span className="flex shrink-0 items-center">
+                      <ChevronRight className="h-3.5 w-3.5 text-fg-muted" />
+                      <span className="px-2 py-1 text-sm font-semibold">
+                        {isHomePlace(target) ? homeName(target.home) : trashLabel}
+                      </span>
+                    </span>
+                  )}
+                </>
+              ) : view === "trash" ? (
                <span className="flex items-center gap-1.5 px-2 py-1 text-sm font-medium">
-                  <Trash2 className="h-4 w-4" /> {t("fx.trash")}
+                  <Trash2 className="h-4 w-4" /> {trashLabel}
                </span>
              ) : (
                <>
@@ -1169,12 +1257,23 @@ export function FileBrowser({
              </div>
            )}
          </div>
+        ) : trashRoot ? (
+          <TrashFolders
+            homes={homes}
+            items={trash}
+            errors={trashErrors}
+            error={error}
+            loading={loading}
+            homeName={homeName}
+            onOpen={openTrash}
+          />
        ) : (
          <TrashView
            items={trash}
+            error={error}
            laneName={laneName}
-            onRestore={(id) => void run(() => api.files.restore(target, id), t("fx.restored"))}
-            onPurge={(id) => void run(() => api.files.purge(target, id))}
+            onRestore={restoreItem}
+            onPurge={(id) => void purge(id)}
          />
        )}

@@ -1651,13 +1750,102 @@ function InlineName({
  );
 }

+/**
+ * An admin's Trash root: one folder per user's Trash (theirs first), each
+ * with its item count — or why it could not be read. Opening one shows that
+ * user's Trash, where its items are restored or deleted forever.
+ */
+function TrashFolders({
+  homes,
+  items,
+  errors,
+  error,
+  loading,
+  homeName,
+  onOpen,
+}: {
+  homes: FsHome[];
+  /** Every Trash's items, merged, each tagged with its `home`. */
+  items: FsTrashItem[];
+  /** Per home id: why its Trash could not be read. */
+  errors: Record<string, string>;
+  error: string | null;
+  loading: boolean;
+  homeName: (id: string) => string;
+  onOpen: (home: string) => void;
+}) {
+  const { t } = useTranslation(["lanes"]);
+  const counts = new Map<string, number>();
+  for (const i of items) if (i.home) counts.set(i.home, (counts.get(i.home) ?? 0) + 1);
+  const ordered = [...homes.filter((h) => h.id === "me"), ...homes.filter((h) => h.id !== "me")];
+  return (
+    <div className="flex min-h-0 flex-1 flex-col" data-testid="fx-trash-root">
+      <div className="border-b border-border px-4 py-2 text-sm text-fg-secondary">
+        {t("fx.trashFoldersHint")}
+      </div>
+      {error && (
+        <div className="m-4 rounded-md border border-status-danger/40 bg-status-danger/10 px-3 py-2 text-sm text-status-danger">
+          {error}
+        </div>
+      )}
+      <div className="grid min-h-0 flex-1 auto-rows-min grid-cols-[repeat(auto-fill,minmax(8.5rem,1fr))] gap-2 overflow-y-auto p-4">
+        {ordered.map((h) => {
+          const n = counts.get(h.id) ?? 0;
+          const failed = errors[h.id];
+          const name = h.id === "me" ? t("fx.myTrash") : homeName(h.id);
+          return (
+            <button
+              key={h.id}
+              type="button"
+              title={t("fx.trashOf", { name: h.id === "me" ? t("fx.myHome") : h.label })}
+              onClick={() => onOpen(h.id)}
+              className="flex flex-col items-center gap-1 rounded-lg px-2 py-3 text-center hover:bg-surface-2"
+              data-testid="fx-trash-folder"
+            >
+              <span className="relative">
+                <Folder
+                  className={`h-14 w-14 ${
+                    n ? "fill-accent/25 text-accent" : "fill-surface-3 text-fg-muted"
+                  }`}
+                />
+                {h.id === "me" ? (
+                  <House className="absolute bottom-2 right-0 h-4 w-4 text-fg-secondary" />
+                ) : (
+                  <UserRound className="absolute bottom-2 right-0 h-4 w-4 text-fg-secondary" />
+                )}
+              </span>
+              <span className="w-full truncate text-[13px] font-medium">{name}</span>
+              <span
+                className={`w-full truncate text-[11px] ${
+                  failed ? "text-status-danger" : "text-fg-muted"
+                }`}
+                title={failed}
+              >
+                {failed
+                  ? failed
+                  : loading
+                    ? "…"
+                    : n
+                      ? t("fx.itemsCount", { count: n })
+                      : t("fx.trashFolderEmpty")}
+              </span>
+            </button>
+          );
+        })}
+      </div>
+    </div>
+  );
+}
+
 function TrashView({
  items,
+  error,
  laneName,
  onRestore,
  onPurge,
 }: {
  items: FsTrashItem[];
+  error: string | null;
  laneName: (id: number) => string;
  onRestore: (id: string) => void;
  onPurge: (id: string) => void;
@@ -1665,6 +1853,11 @@ function TrashView({
  const { t } = useTranslation(["lanes"]);
  return (
    <div className="flex min-h-0 flex-1 flex-col" data-testid="fx-trash">
+      {error && (
+        <div className="m-4 rounded-md border border-status-danger/40 bg-status-danger/10 px-3 py-2 text-sm text-status-danger">
+          {error}
+        </div>
+      )}
      <div className="flex items-center gap-2 border-b border-border px-4 py-2 text-sm text-fg-secondary">
        <span className="flex-1">{t("fx.trashHint")}</span>
        <button
@@ -1732,7 +1925,7 @@ function TrashView({
            ))}
          </tbody>
        </table>
-        {!items.length && (
+        {!items.length && !error && (
          <div className="flex flex-col items-center gap-2 py-16 text-fg-muted">
            <Trash2 className="h-14 w-14 opacity-40" />
            <p className="text-sm">{t("fx.trashEmpty")}</p>
@@ -3,7 +3,11 @@
 * opens sub-folders, makes a folder inline, deletes into the Trash without a
 * confirm, copies in one workspace and pastes into another (`fromLane`),
 * asks Replace / Keep both / Skip when an upload's name is taken, refuses a
- * batch over 500 MB before sending anything, and restores from the Trash.
+ * batch over 500 MB before sending anything, restores from the user's own
+ * Trash, opens an admin's Trash on one folder per user (counted, an unreadable
+ * one saying why), opens each user's Trash from its folder (asking before a
+ * purge there, sending the item's store) and
+ * shows a Trash that could not be read as an error, never as empty.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */
 import { describe, it, expect, vi, beforeEach } from "vitest";
@@ -12,6 +16,9 @@ import userEvent from "@testing-library/user-event";
 import { FileExplorer } from "../FileExplorer";
 import { api, type FsListing } from "../../../lib/api";
 import { toast } from "../../../lib/toast";
+import { confirmDialog } from "../../../lib/confirm";
+
+vi.mock("../../../lib/confirm", () => ({ confirmDialog: vi.fn(async () => false) }));

 vi.mock("../../../lib/api", () => ({
  gitTarget: (lane: number, session?: string | null) => (session ? { lane, session } : lane),
@@ -32,6 +39,7 @@ vi.mock("../../../lib/api", () => ({
      copy: vi.fn(),
      remove: vi.fn(),
      trash: vi.fn(),
+      allTrash: vi.fn(),
      restore: vi.fn(),
      purge: vi.fn(),
      upload: vi.fn(),
@@ -70,6 +78,7 @@ beforeEach(() => {
  } as never);
  vi.mocked(api.files.list).mockImplementation(async (_t, p = "") => (p === "src" ? src : root));
  vi.mocked(api.files.trash).mockResolvedValue({ items: [] });
+  vi.mocked(api.files.allTrash).mockResolvedValue({ items: [], errors: [] });
  vi.mocked(api.files.homes).mockResolvedValue({
    homes: [
      { id: "me", label: "An", readOnly: false },
@@ -212,10 +221,93 @@ describe("FileExplorer", () => {
    const user = userEvent.setup();
    open();
    await screen.findByText("a.txt");
-    await user.click(screen.getByRole("button", { name: "Trash" }));
+    await user.click(
+      within(screen.getByTestId("fx-trashes")).getByRole("button", { name: "Trash" })
+    );
+    await user.click(await screen.findByRole("button", { name: /My Trash/ }));
+    await waitFor(() => expect(api.files.trash).toHaveBeenLastCalledWith({ home: "me" }));
    const trashRow = await screen.findByTestId("fx-trash-row");
    await user.click(within(trashRow).getByRole("button", { name: /Restore/ }));
-    await waitFor(() => expect(api.files.restore).toHaveBeenCalledWith(1, "abc12345"));
+    await waitFor(() =>
+      expect(api.files.restore).toHaveBeenCalledWith({ home: "me" }, "abc12345", undefined)
+    );
+  });
+
+  it("opens an admin's Trash on one folder per user, each opening that user's Trash", async () => {
+    vi.mocked(api.files.allTrash).mockResolvedValue({
+      items: [
+        {
+          id: "bob12345",
+          name: "old",
+          laneId: null,
+          path: "old",
+          isDir: true,
+          deletedAt: "2026-10-15T08:00:00.000Z",
+          store: "host",
+          home: "bob",
+          owner: "Bob",
+        },
+      ],
+      errors: [{ home: "me", owner: "An", message: "EMEMBERGONE" }],
+    });
+    vi.mocked(api.files.trash).mockResolvedValue({
+      items: [
+        {
+          id: "bob12345",
+          name: "old",
+          laneId: null,
+          path: "old",
+          isDir: true,
+          deletedAt: "2026-10-15T08:00:00.000Z",
+          store: "host",
+        },
+      ],
+    });
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("a.txt");
+    const trashes = screen.getByTestId("fx-trashes");
+    expect(within(trashes).getAllByRole("button")).toHaveLength(1);
+    await user.click(within(trashes).getByRole("button", { name: "Trash" }));
+    const folders = await screen.findAllByTestId("fx-trash-folder");
+    expect(folders.map((f) => f.textContent)).toEqual(["My TrashEMEMBERGONE", "Bob1 item(s)"]);
+    expect(screen.queryByTestId("fx-trash-row")).toBeNull();
+    await user.click(folders[1]!);
+    await waitFor(() => expect(api.files.trash).toHaveBeenLastCalledWith({ home: "bob" }));
+    expect(screen.getByRole("navigation", { name: "Location" }).textContent).toContain("Bob");
+    const trashRow = await screen.findByTestId("fx-trash-row");
+    await user.click(within(trashRow).getByRole("button", { name: /Delete forever/ }));
+    await waitFor(() =>
+      expect(confirmDialog).toHaveBeenCalledWith(
+        expect.objectContaining({ message: expect.stringContaining("Bob's Trash") })
+      )
+    );
+    expect(api.files.purge).not.toHaveBeenCalled();
+    vi.mocked(confirmDialog).mockResolvedValueOnce(true);
+    await user.click(within(trashRow).getByRole("button", { name: /Delete forever/ }));
+    await waitFor(() =>
+      expect(api.files.purge).toHaveBeenCalledWith({ home: "bob" }, "bob12345", "host")
+    );
+    // Back to the folders through the path bar.
+    await user.click(
+      within(screen.getByRole("navigation", { name: "Location" })).getByRole("button", {
+        name: "Trash",
+      })
+    );
+    expect(await screen.findAllByTestId("fx-trash-folder")).toHaveLength(2);
+  });
+
+  it("shows why a Trash could not be read instead of an empty one", async () => {
+    vi.mocked(api.files.trash).mockRejectedValue(new Error("ENOENT: no such folder"));
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("a.txt");
+    await user.click(
+      within(screen.getByTestId("fx-trashes")).getByRole("button", { name: "Trash" })
+    );
+    await user.click(await screen.findByRole("button", { name: /My Trash/ }));
+    expect(await screen.findByText(/ENOENT: no such folder/)).toBeTruthy();
+    expect(screen.queryByText("The Trash is empty.")).toBeNull();
  });

  it("opens the user's home from the sidebar, and pastes from it into a workspace", async () => {
@@ -242,7 +334,7 @@ describe("FileExplorer", () => {
    const user = userEvent.setup();
    open();
    await screen.findByText("a.txt");
-    await user.click(await screen.findByRole("button", { name: /Bob/ }));
+    await user.click(await screen.findByRole("button", { name: "Bob" }));
    expect(await screen.findByTestId("fx-readonly")).toBeInTheDocument();
    expect(screen.queryByRole("button", { name: "New" })).toBeNull();
    expect(screen.queryByRole("button", { name: "Upload" })).toBeNull();
@@ -2,8 +2,9 @@
 * @file GitIdentitySettings.tsx
 * @description Settings → Git → **Your git identity** (`/api/me/git`): the
 * commit author (name + email in the account's global git config — prefilled
- * from Settings → Account while unset, since a member's commits fail without
- * one), the SSH
+ * from Settings → Account while unset, the email else `<username>@smartgift.vn`,
+ * since a member's commits fail without one; a new SSH key is labelled with
+ * that email), the SSH
 * keys a clone (Add workspace → Clone) and the pushes from that clone use —
 * an ED25519 and/or an RSA one (AWS CodeCommit takes only RSA) — make one, copy its public half to add to GitHub/GitLab, replace or delete
 * it, and whether git typed in the account's own terminal uses it too (a
@@ -308,7 +309,7 @@ export function GitIdentitySettings() {
  const member = id.account === "member";
  const authorShown = author ?? {
    name: id.author.name ?? me?.displayName ?? me?.username ?? "",
-    email: id.author.email ?? me?.email ?? "",
+    email: id.author.email ?? me?.email ?? id.defaultEmail ?? "",
  };
  const authorUnset = !id.author.name || !id.author.email;
  const authorDirty =
@@ -577,7 +577,7 @@
  "fx.cutDone": "Cut {{count}} item(s) — open a folder (or another workspace) and Paste.",
  "fx.pasted": "Pasted.",
  "fx.crossOnlyWorkspace": "These items can only be pasted where they came from (a session worktree, an extra folder, or between two homes).",
-  "fx.needsUpgrade": "This needs the updated server helper — ask an admin to run `sudo agenthub server install-system` once.",
+  "fx.needsUpgrade": "This needs the updated server helper — ask an admin to run `agenthub server install-system` once.",
  "fx.conflictTitle": "Already there",
  "fx.conflictBody": "This name is taken in the destination: {{names}}",
  "fx.conflictAll": "Do this for every remaining file",
@@ -591,6 +591,16 @@
  "fx.purge": "Delete forever",
  "fx.restored": "Restored.",
  "fx.trashEmpty": "The Trash is empty.",
+  "fx.trashOf": "{{name}}'s Trash",
+  "fx.myTrash": "My Trash",
+  "fx.trashAt": "Trash ({{name}})",
+  "fx.trashFoldersHint": "Each folder is one user's Trash — open it to restore or delete forever.",
+  "fx.trashFolderEmpty": "Empty",
+  "fx.purged": "Deleted forever.",
+  "fx.emptyTrashTitle": "Empty the Trash?",
+  "fx.emptyTrashBody": "All {{count}} items in {{where}} will be deleted forever. This cannot be undone.",
+  "fx.purgeTitle": "Delete forever?",
+  "fx.purgeBody": "“{{name}}” in {{where}} will be deleted forever. This cannot be undone.",
  "changes.openExplorer": "Open File Explorer — manage, upload and download files",
  "changes.openInExplorer": "Open in File Explorer",
  "fx.places": "Workspaces",
@@ -620,7 +630,7 @@
  "fx.noWorkspace": "There is no workspace yet. Add one first, then its files show here.",
  "fx.myHome": "Home",
  "fx.userHomes": "Users' homes",
-  "fx.readOnlyHome": "Another user's home — view and download only",
+  "fx.readOnlyHome": "Another user's home — view and download only; their Trash can be restored or emptied",
  "fx.readOnly": "Read-only",
  "fx.readOnlyHint": "This is another user's home: you can view, copy and download, not change it.",
  "fx.homeEmpty": "Nothing in your home yet — its hidden files (.bashrc, .claude…) are not shown here. Your workspaces are on the left.",
@@ -209,7 +209,7 @@
    "title": "Members' tmux",
    "description": "Each member's own tmux server keeps the version it started with until its last pane closes. Installed: tmux {{version}}.",
    "refresh": "Refresh",
-    "notMatched": "Run `sudo agenthub server install-system` once: until then an older member server is asked with the installed tmux, which can leave it stuck at 100% CPU.",
+    "notMatched": "Run `agenthub server install-system` once: until then an older member server is asked with the installed tmux, which can leave it stuck at 100% CPU.",
    "empty": "No member has a tmux server running.",
    "user": "User",
    "version": "tmux",
@@ -577,7 +577,7 @@
  "fx.cutDone": "Đã cắt {{count}} mục — mở thư mục (hoặc workspace khác) rồi Dán.",
  "fx.pasted": "Đã dán.",
  "fx.crossOnlyWorkspace": "Các mục này chỉ dán được ở nơi chúng được lấy ra (worktree của session, thư mục phụ, hoặc giữa hai home).",
-  "fx.needsUpgrade": "Cần cập nhật helper của server — nhờ admin chạy `sudo agenthub server install-system` một lần.",
+  "fx.needsUpgrade": "Cần cập nhật helper của server — nhờ admin chạy `agenthub server install-system` một lần.",
  "fx.conflictTitle": "Đã có sẵn",
  "fx.conflictBody": "Tên này đã có ở nơi đến: {{names}}",
  "fx.conflictAll": "Áp dụng cho tất cả file còn lại",
@@ -591,6 +591,16 @@
  "fx.purge": "Xoá vĩnh viễn",
  "fx.restored": "Đã khôi phục.",
  "fx.trashEmpty": "Thùng rác trống.",
+  "fx.trashOf": "Thùng rác của {{name}}",
+  "fx.myTrash": "Thùng rác của tôi",
+  "fx.trashAt": "Thùng rác ({{name}})",
+  "fx.trashFoldersHint": "Mỗi thư mục là Thùng rác của một user — mở ra để khôi phục hoặc xoá vĩnh viễn.",
+  "fx.trashFolderEmpty": "Trống",
+  "fx.purged": "Đã xoá vĩnh viễn.",
+  "fx.emptyTrashTitle": "Dọn sạch Thùng rác?",
+  "fx.emptyTrashBody": "Toàn bộ {{count}} mục trong {{where}} sẽ bị xoá vĩnh viễn, không khôi phục được.",
+  "fx.purgeTitle": "Xoá vĩnh viễn?",
+  "fx.purgeBody": "“{{name}}” trong {{where}} sẽ bị xoá vĩnh viễn, không khôi phục được.",
  "changes.openExplorer": "Mở Quản lý file — quản lý, tải lên và tải về file",
  "changes.openInExplorer": "Mở trong Quản lý file",
  "fx.places": "Workspace",
@@ -620,7 +630,7 @@
  "fx.noWorkspace": "Chưa có workspace nào. Hãy thêm một workspace, file của nó sẽ hiện ở đây.",
  "fx.myHome": "Thư mục home",
  "fx.userHomes": "Home của các user",
-  "fx.readOnlyHome": "Home của user khác — chỉ xem và tải về",
+  "fx.readOnlyHome": "Home của user khác — chỉ xem và tải về; Thùng rác của họ thì khôi phục hoặc xoá được",
  "fx.readOnly": "Chỉ đọc",
  "fx.readOnlyHint": "Đây là home của user khác: bạn chỉ xem, sao chép và tải về được, không sửa được.",
  "fx.homeEmpty": "Home của bạn chưa có thư mục nào — các file ẩn (.bashrc, .claude…) không hiện ở đây. Các workspace nằm ở danh sách bên trái.",
@@ -209,7 +209,7 @@
    "title": "Tmux của member",
    "description": "Mỗi member có tmux server riêng, giữ phiên bản lúc nó khởi động cho đến khi pane cuối cùng đóng. Bản đã cài: tmux {{version}}.",
    "refresh": "Làm mới",
-    "notMatched": "Chạy `sudo agenthub server install-system` một lần: trước đó, server cũ của member được hỏi bằng tmux bản mới và có thể kẹt ở 100% CPU.",
+    "notMatched": "Chạy `agenthub server install-system` một lần: trước đó, server cũ của member được hỏi bằng tmux bản mới và có thể kẹt ở 100% CPU.",
    "empty": "Không member nào đang chạy tmux server.",
    "user": "Người dùng",
    "version": "tmux",
@@ -842,6 +842,11 @@ export interface FsTrashItem {
  path: string;
  isDir: boolean;
  deletedAt: string;
+  /** A home's recycle bin only: which of the user's trash folders holds it. */
+  store?: "home" | "host";
+  /** The merged view only (`allTrash`): the home it belongs to, and its user. */
+  home?: string;
+  owner?: string;
 }
 /** How a taken name is settled: ask (409 EEXISTS with `names`), skip, keep both, replace. */
 export type FsConflict = "fail" | "skip" | "keep" | "replace";
@@ -2638,15 +2643,22 @@ export const api = {
        body: JSON.stringify({ paths }),
      }),
    trash: (t: FsPlace) => request<{ items: FsTrashItem[]; keepDays?: number }>(fsUrl(t, "/trash")),
-    restore: (t: FsPlace, id: string) =>
+    /** Every Trash the caller may open, merged (an admin: every user's). */
+    allTrash: () =>
+      request<{
+        items: FsTrashItem[];
+        errors?: { home: string; owner: string; message: string }[];
+        keepDays?: number;
+      }>("/homes/trash"),
+    restore: (t: FsPlace, id: string, store?: FsTrashItem["store"]) =>
      request<{ path: string; laneId: number | null }>(fsUrl(t, "/trash/restore"), {
        method: "POST",
-        body: JSON.stringify({ id }),
+        body: JSON.stringify(store ? { id, store } : { id }),
      }),
-    purge: (t: FsPlace, id: string | "all") =>
+    purge: (t: FsPlace, id: string | "all", store?: FsTrashItem["store"]) =>
      request<{ purged: number }>(fsUrl(t, "/trash/purge"), {
        method: "POST",
-        body: JSON.stringify({ id }),
+        body: JSON.stringify(store ? { id, store } : { id }),
      }),
    /** A zip of `paths` (files and folders), for a plain link/anchor download. */
    zipUrl: (t: FsPlace, paths: string[]) => {
@@ -4262,6 +4274,8 @@ export interface GitIdentity {
  sshUsers?: { host: string; user: string }[];
  /** The account's commit author (`git config --global`); null fields = unset. */
  author: { name: string | null; email: string | null };
+  /** The suggested email while none is set: `<username>@smartgift.vn`. */
+  defaultEmail?: string | null;
  https: {
    protocol: "http" | "https";
    host: string;
@@ -7178,7 +7178,7 @@ exports[`screen snapshots > Settings — about 1`] = `
                <span
                  class="text-status-warning/90"
                >
-                  UI build v2.8.4 (rebuild client to match)
+                  UI build v2.8.5 (rebuild client to match)
                </span>
              </p>
            </div>
@@ -292,7 +292,7 @@ come `fromLane` another workspace the caller can see, of the same account
 (`403 EFOREIGN` otherwise). An upload is at most 500 MB (`413 ETOOBIG`, from
 `Content-Length` before a byte is stored), a zip at most 2 GB / 50,000 files.
 Under S3 a move/copy/delete needs the installed `write-as` to know
-`move`/`copy`: `409 EUPGRADE` until `sudo agenthub server install-system` is
+`move`/`copy`: `409 EUPGRADE` until `agenthub server install-system` is
 re-run.

 #### File Explorer on a home
@@ -311,7 +311,32 @@ the host account's home. Every dot entry at the TOP of a home (`.ssh`,
 refused for every read and write — also through a symlink, a download or a
 zip (`403 ESECRET`); dot files deeper down are ordinary. `:who` is `me`; an
 admin may also name another user — read-only (`403 EREADONLY` on every
-write), each read written to the audit log. A copy goes home ↔ workspace
+write), each read written to the audit log. The one exception is that user's
+**Trash**.
+
+A home's Trash is its USER's one recycle bin, whatever place they deleted in:
+`GET …/trash` merges their home account's trash (a member's
+`~/.local/share/agenthub/trash/`) with their host trash
+(`<data dir>/trash/<user id>/`, what they deleted in a host-folder workspace)
+and tags each item `store: "home" | "host"`; `POST …/trash/restore` and
+`POST …/trash/purge` take `{id, store}` (`store` defaults to `home`;
+`{id: "all"}` empties every store). A host item whose workspace is gone
+answers `404 ENOFILE` (nowhere of that account to put it back). An admin may
+restore and purge in ANOTHER user's Trash too, each written to the audit log
+with the item id — so a member's deleted files can be restored or freed
+without waiting the 7 days. `GET /api/homes/trash` merges every Trash the
+caller may open into one list (`{items, errors, keepDays}`; an admin's is
+every user's, each other user's read audited): each item carries `home` (the
+`:who` its restore/purge goes to) and `owner`, and a user whose trash cannot
+be read is listed in `errors` rather than left out. The Files sidebar has ONE
+**Trash** entry: a user's opens their own Trash; an admin's opens on one
+folder per user (**My Trash** first, each counted from that merged list, an
+unreadable one showing its error), and opening a folder shows that user's
+Trash (path bar **Trash › user**, Up goes back to the folders). A trash that
+could not be read shows as an error rather than as empty, and deleting
+forever asks first.
+
+A copy goes home ↔ workspace
 (`fromHome` on the workspace route, `fromLane` on the home one) when both are
 one Linux account; each side is checked under its own rule. A home is never a
 workspace. The **Files** page opens on `?home=me` by default.
@@ -1042,7 +1067,7 @@ cannot collide on `index.lock`.
 #### Your git identity

 ```
-GET    /api/me/git                 { account: "member"|"host", writable, ssh: { type, publicKey, fingerprint, terminal: "on"|"off"|"foreign" } | null (the first key), sshKeys: [{ type, publicKey, fingerprint }] (ed25519 first), sshTerminal, https: [{ protocol, host, username, hasToken }] }
+GET    /api/me/git                 { account: "member"|"host", writable, ssh: { type, publicKey, fingerprint, terminal: "on"|"off"|"foreign" } | null (the first key), sshKeys: [{ type, publicKey, fingerprint }] (ed25519 first), sshTerminal, https: [{ protocol, host, username, hasToken }], author: { name, email }, defaultEmail }
 POST   /api/me/git/ssh-key         Make the SSH key of `type` — Body: { replace?, type?: "ed25519" | "rsa" } (409 EEXISTS when that TYPE exists, without replace; the other type is kept — an account may hold one of each, and every ssh git offers both) → 201, same shape
 DELETE /api/me/git/ssh-key         Delete the key of `?type=ed25519|rsa`, or every key without it (404 ENOTFOUND, 400 EBADKEYTYPE) — also removes our terminal `core.sshCommand`
 PUT    /api/me/git/ssh-terminal    Use the key for git typed in the account's own terminal — Body: { on } — sets/unsets `core.sshCommand` in its `~/.gitconfig` (ours first, then `~/.ssh/id_*`); on by default when a member makes a key; 409 EFOREIGNSSH over one the user wrote, which is never touched
@@ -1050,7 +1075,7 @@ PUT    /api/me/git/ssh-user        The SSH login name for one host — Body: { h
 DELETE /api/me/git/ssh-user/:host  Drop that rule (404 ENOTFOUND); any other `insteadOf` the user wrote is never touched
 POST   /api/me/git/https           Save an https login — Body: { host, username, password }
 DELETE /api/me/git/https/:host     Delete one (404 ENOTFOUND)
-PUT    /api/me/git/author          Commit author — Body: { name, email } (400 EBADAUTHOR) — `git config --global user.name/email` as the account
+PUT    /api/me/git/author          Commit author — Body: { name, email } (400 EBADAUTHOR) — `git config --global user.name/email` as the account. A new SSH key is labelled with that email, else `defaultEmail` (`<username>@smartgift.vn`; `AGENTHUB_EMAIL_DOMAIN` overrides the domain), also returned by GET /api/me/git as the email form's suggestion
 ```

 `GET` also answers `author: { name, email }` (null when unset). A member's
@@ -104,7 +104,7 @@ The CLI talks to the local dashboard server — **API-backed commands require it
 | `agenthub uninstall [--yes]` | **Uninstall AgentHub** (`scripts/uninstall.js`; Settings → System has the same button). Without `--yes` it only lists what is there and exits 1. With it, in order: closes every workspace terminal, removes the systemd/launchd unit, stops every dashboard server, the status-area icon and workspace stacks, takes AgentHub's own entries out of `~/.claude/settings.json` (hooks, statusline; backup `settings.json.agenthub-uninstall.bak`), Codex `hooks.json` and Antigravity `hooks.json`, deletes the AI Proxy `$CODEX_HOME/<name>.config.toml` files, runs `claude plugin uninstall` for `agenthub@*` and every plugin of the `agenthub` marketplace and removes that marketplace (never a shared one), then deletes `~/.local/bin/agenthub`, `~/.config/agenthub/`, `~/.claude/.agenthub.json`, `~/.claude/agenthub-{proxies,routers,git-credentials,accounts,profiles}`, `agenthub-lanes/.state` and `.locks`, the plugin's cached copies and the data directory (database included). **Kept:** the AI tools' own conversations (`~/.claude/projects`, `~/.codex/sessions`, …), workspace worktrees and branches, anything in your repositories, config backups. A data directory that is the home, `CLAUDE_HOME`, a checkout or not recognisably AgentHub's is refused. A failing step is logged and the rest still run; log: `$TMPDIR/agenthub-uninstall-<uid>.log`. Needs no running server. Run inside a dashboard terminal, it closes that terminal last. |
 | `agenthub tray` | Show AgentHub's **status-area icon** now, in the foreground (`scripts/tray.js`): Open AgentHub, Quit AgentHub (a submenu asks again, then runs `agenthub stop`), Start AgentHub after a quit (`agenthub start`), Hide this icon. A production server already keeps the icon up on its own unless Settings → System turned it off; this command does not change that setting. Exits at once when an icon is already running |
 | `agenthub repl` (aliases `shell`, `i`) | Open the **interactive shell** — see [Interactive REPL](#interactive-repl) |
-| `agenthub server setup [--hostname name] [--admin name]` | Turn **server mode** on (logins for a shared dashboard): writes `AGENTHUB_MODE=server` (and `DASHBOARD_ALLOWED_HOSTS`) to the settings file and creates the first admin, asking for its password. Works with the server down; restart it afterwards. See [SERVER-MODE.md](SERVER-MODE.md) |
+| `agenthub server setup [--hostname name] [--admin name] [--no-system]` | Turn **server mode** on (logins for a shared dashboard): writes `AGENTHUB_MODE=server` (and `DASHBOARD_ALLOWED_HOSTS`) to the settings file and creates the first admin, asking for its password. On Linux it then installs **one Linux user per account** by default — runs `install-system` (one sudo; skipped when `/etc/agenthub/server.conf` already exists) and `users provision --all`; if that fails, server mode stays on and the error says how to finish. `--no-system` (and any non-Linux machine) keeps every pane on the one host account, as before; then restart the dashboard yourself. See [SERVER-MODE.md](SERVER-MODE.md) |
 | `agenthub server install-system [--dry-run\|--uninstall]` | **One Linux user per account** (S3). Run as the account that runs the dashboard, never as root: it runs `scripts/server/install-system.sh` through one `sudo`. That script creates the groups, `/srv/agenthub/users`, `/opt/agenthub`, the sudoers file, the member hooks and `hidepid`, and installs the system unit `agenthub.service`. The command then points the unit at this install, writes `AGENTHUB_USERS_ROOT`, and moves the dashboard from the `systemd --user` unit to the system one (panes stay). `--dry-run` prints the sudo command; `--uninstall` goes back to the user unit. See [SERVER-MODE.md](SERVER-MODE.md#one-linux-user-per-account) |
 | `agenthub server tools` | One Linux user per account: publish this install's scripts and every installed AI tool under `/opt/agenthub` (`tools/bin/<command>`), where every account's pane runs them. The server also does this at start and after each install or update. Prints each tool's shared copy, or why it could not be shared |
 | `agenthub server off` / `agenthub server status` | Back to local mode (accounts kept) / show the mode and account count |
@@ -15,8 +15,9 @@ Local mode does not change at all. The login code stays dormant until
 > **What server mode separates, and what it does not.** In the dashboard and
 > its API, each developer sees only their own workspaces and the sessions,
 > prompts, events, tokens and cost under them (see [What each user sees](#what-each-user-sees)).
-> Until [one Linux user per account](#one-linux-user-per-account) is installed
-> (`agenthub server install-system`), every terminal pane runs as the one Linux
+> On Linux, `agenthub server setup` installs [one Linux user per account](#one-linux-user-per-account)
+> by default. Without it (`--no-system`, a machine that is not Linux, or an
+> install that failed), every terminal pane runs as the one Linux
 > account that runs the dashboard. An agent in a pane can then read every
 > user's folders, transcripts and the database straight from disk. Without it,
 > use server mode only with people you trust.
@@ -27,12 +28,14 @@ On the machine that will host the dashboard, logged in as the account that
 runs it:

 ```bash
-# 1. Turn server mode on, allow the public name, and create the first admin
+# 1. Turn server mode on, allow the public name, create the first admin and,
+#    on Linux, install one Linux user per account (one sudo; it moves the
+#    dashboard to the system unit agenthub.service, which picks the mode up)
 agenthub server setup --hostname agenthub.example.com --admin boss
 #    (asks for the admin's password twice; from a script: pipe it on stdin)

-# 2. Restart the dashboard so it picks the mode up
-systemctl --user restart agenthub     # or: agenthub start
+# 2. Log out and back in once, so your shell joins the agenthub groups
+#    (with --no-system instead: systemctl --user restart agenthub)

 # 3. Add the other people
 agenthub users add alice                      # developer
@@ -42,7 +45,14 @@ agenthub users add carol --role analyst       # reads everyone, works in their o
 `setup` writes `AGENTHUB_MODE=server` and `DASHBOARD_ALLOWED_HOSTS` into
 AgentHub's settings file (`~/.config/agenthub/settings.env`). The real
 environment and a checkout's `.env` still take priority over that file. Run
-setup again whenever you need to: it creates an admin only when none exists.
+setup again whenever you need to: it creates an admin only when none exists,
+runs `install-system` only while `/etc/agenthub/server.conf` is missing, and
+gives every user their Linux account (`users provision --all`, idempotent).
+The machine needs what [What a new machine needs](#what-a-new-machine-needs-before-install-system)
+lists first. If the install fails, server mode stays on with every pane on the
+host account, and the error says so: fix the cause and run
+`agenthub server install-system`, or choose that shared account on purpose
+with `agenthub server setup --no-system`.

 ## Put HTTPS in front of it

@@ -687,7 +697,7 @@ a pane really is. Each case below is refused or bounded, with a test in
  through `/opt/agenthub/libexec/tmux-member` (root's, in sudoers): it runs
  the call with the binary of the member's running server (`/proc/<pid>/exe`,
  found from their socket), else with `TMUX_BIN`, so a newer tmux never asks
-  an older server. Until `sudo agenthub server install-system` has installed
+  an older server. Until `agenthub server install-system` has installed
  it, calls use `TMUX_BIN` directly, as before. A member's server keeps its
  version until their last pane closes; the next start runs `TMUX_BIN`.
 - **Users → Members' tmux** (admin/analyst read, admin acts): each member's
@@ -763,12 +773,21 @@ itself, once.
 `/opt/agenthub/libexec` by `install-system` only — an update of AgentHub does
 not touch root-owned files. When a release changes them (v2.7.7: `write-as`
 learned `move`/`copy` for the File Explorer; v2.8.4 added `tmux-member`),
-re-run it once:
+re-run it once, as the host account and **without** `sudo` in front (it asks
+for the sudo password itself; as root it refuses, and `sudo agenthub …` fails
+with `command not found` because sudo's `secure_path` has no `~/.local/bin`):

 ```bash
-sudo agenthub server install-system
+agenthub server install-system
 ```

+A member server that a newer tmux already reached before `tmux-member` was
+installed can stay wedged: every call on that socket — `tmux-member`'s too —
+prints `server exited unexpectedly`. If Users → Members' tmux shows it with
+no panes, stop that one server (its pid is the `ah-<name>` process running
+`tmux -S <USERS_ROOT>/<name>/.agenthub/tmux/sock`) with `sudo kill -9 <pid>`;
+the next start runs a fresh server on `TMUX_BIN`. Never `tmux kill-server`.
+
 Until then the File Explorer's move, copy and delete in a member's folder
 answer `409 EUPGRADE` (listing, upload, new folder/file and zip work).
 The same re-run installs `agenthub-provision delete`, behind the Users page's
@@ -803,9 +822,10 @@ again under the same name gets a NEW, empty Linux account and home.
 4. AgentHub installed for the host account, as the plugin or a checkout
   (`npm run setup && npm run build`), and running once
   (`agenthub start`).
-5. Server mode on, with the first admin:
-   `agenthub server setup --hostname agenthub.example.com --admin boss`
-   (see [Set it up](#set-it-up)).
+5. Server mode itself is NOT a step before this: `agenthub server setup`
+   (see [Set it up](#set-it-up)) turns it on and then runs `install-system`
+   and `users provision --all` below itself. Run the Install steps by hand only
+   after a `setup --no-system` or a failed install, or to repeat one.
 6. The AI tools members will use, installed for the host account (the AI
   Tools page or by hand).
 7. The HTTPS reverse proxy (see [Put HTTPS in front of it](#put-https-in-front-of-it)).
@@ -860,8 +880,8 @@ again changes nothing that is already in place):

 What a new machine still needs by hand after it:

-1. `agenthub users provision --all`: users created before S3 was on (the
-   admin from `server setup` is one) have no Linux account yet.
+1. `agenthub users provision --all`: users created before S3 was on have no
+   Linux account yet (`server setup` already ran this for you).
 2. Log out and back in once, so your own shell joins `agenthub` and
   `agenthub-proc` (the unit gets them on its own).
 3. `chmod o-rwx ~` for the host account if the installer warned: the database
@@ -112,7 +112,7 @@ Branch: `server-s3`. Commits happen only when the user asks.
 - Verify: an e2e against a fake upstream (header swapped, streaming kept, a dead pane's token refused, another member's profile refused).

 ### P2. Host setup (sudo; on this machine with the agh-test users)
- [x] `sudo agenthub server install-system` is idempotent, has `--uninstall`, and does the following:
+- [x] `agenthub server install-system` is idempotent, has `--uninstall`, and does the following:
  - creates groups `agenthub` and `agenthub-members`;
  - creates `/srv/agenthub/users` (0751) and `/opt/agenthub/{tools,app,libexec,sbin}`;
  - writes the sudoers file and checks it with `visudo -c`;
@@ -1,12 +1,12 @@
 {
  "name": "agenthub",
-  "version": "2.8.4",
+  "version": "2.8.5",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "agenthub",
-      "version": "2.8.4",
+      "version": "2.8.5",
      "hasInstallScript": true,
      "license": "UNLICENSED",
      "dependencies": {
@@ -1,6 +1,6 @@
 {
  "name": "agenthub",
-  "version": "2.8.4",
+  "version": "2.8.5",
  "bin": {
    "agenthub": "bin/agenthub.js"
  },
@@ -6,7 +6,7 @@
 * a systemd `--user` unit everywhere else (`systemd-service.js`, which reports
 * itself unavailable off Linux). Both export the same API — and so does the
 * third, `systemd-system-service.js`, chosen while the server-mode SYSTEM unit
- * `sudo agenthub server install-system` wrote exists (pure fs check).
+ * `agenthub server install-system` wrote exists (pure fs check).
 * Require THIS module, never one of the three directly.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */
@@ -3,7 +3,7 @@
 * @file systemd-system-service.js
 * @description Server mode with one Linux user per account (S3): the dashboard
 * runs as a SYSTEM unit, `/etc/systemd/system/agenthub.service`, written once
- * by `sudo agenthub server install-system` (scripts/server/install-system.sh).
+ * by `agenthub server install-system` (scripts/server/install-system.sh).
 * The unit runs as the host account with group `agenthub` and
 * CAP_DAC_READ_SEARCH — the two things a `systemd --user` unit cannot give.
 *
@@ -162,7 +162,7 @@ function installUserService(opts) {
  return result;
 }

-/** Removing the system unit is root's: `sudo agenthub server install-system --uninstall`. */
+/** Removing the system unit is root's: `agenthub server install-system --uninstall`. */
 function uninstallUserService() {
  return "foreign";
 }
@@ -246,6 +246,8 @@ describe("/api/me/git", () => {
    const made = await request("POST", "/api/me/git/ssh-key", {});
    assert.equal(made.status, 201);
    assert.match(made.body.ssh.publicKey, /^ssh-ed25519 /);
+    // No commit author yet: the key is labelled with the default email.
+    assert.match(made.body.ssh.publicKey, /@smartgift\.vn$/);
    assert.match(made.body.ssh.fingerprint, /^SHA256:/);
    assert.ok(!JSON.stringify(made.body).includes("PRIVATE"));
    const key = path.join(ROOT, ".claude", "agenthub-ssh", "id_ed25519");
@@ -311,6 +313,7 @@ describe("/api/me/git", () => {
  it("reads and sets the commit author, refusing a bad one", async () => {
    const r0 = await request("GET", "/api/me/git");
    assert.deepEqual(r0.body.author, { name: null, email: null });
+    assert.equal(r0.body.defaultEmail, `${os.userInfo().username}@smartgift.vn`);
    const bad = await request("PUT", "/api/me/git/author", { name: "a\nb", email: "x@y" });
    assert.equal(bad.status, 400);
    assert.equal(bad.body.error.code, "EBADAUTHOR");
@@ -318,6 +321,10 @@ describe("/api/me/git", () => {
    assert.equal(ok.status, 200);
    assert.deepEqual(ok.body.author, { name: "Vi", email: "vi@example.com" });
    assert.match(fs.readFileSync(path.join(ROOT, ".gitconfig"), "utf8"), /email = vi@example.com/);
+    // A key made now is labelled with the author's email.
+    const key = await request("POST", "/api/me/git/ssh-key", { replace: true });
+    assert.match(key.body.ssh.publicKey, / vi@example\.com$/);
+    await request("DELETE", "/api/me/git/ssh-key");
  });

  it("saves an https login without ever returning the token", async () => {
@@ -5,7 +5,8 @@
 * (also through a symlink, a download or a zip) while a nested dotfile is
 * fine, delete/restore work with no workspace, a copy goes home ↔ workspace
 * under each side's own rule — and in server mode a developer never reaches
- * another user's home while an admin gets it read-only.
+ * another user's home while an admin gets it read-only — except its Trash,
+ * which the admin lists, restores from and purges as the member's own.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

@@ -204,3 +205,143 @@ describe("homes in server mode", () => {
    assert.ok(homes.listHomes({ user: ann }).some((x) => x.id === "bob" && x.readOnly));
  });
 });
+
+describe("an admin manages a member's Trash", () => {
+  const auth = require("../lib/auth");
+  const USERS = path.join(ROOT, "users");
+  let cara;
+  let dan;
+  const call = (method, p, cookie, body) =>
+    fetch(`${base}${p}`, {
+      method,
+      headers: { "Content-Type": "application/json", cookie },
+      body: body === undefined ? undefined : JSON.stringify(body),
+    }).then(async (r) => ({ status: r.status, body: await r.json().catch(() => null) }));
+  const login = async (username, password) => {
+    const r = await fetch(`${base}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ username, password }),
+    });
+    return r.headers.get("set-cookie").split(";")[0];
+  };
+  before(async () => {
+    fs.mkdirSync(path.join(USERS, "cara"), { recursive: true });
+    process.env.AGENTHUB_MODE = "server";
+    process.env.AGENTHUB_USERS_ROOT = USERS;
+    await auth.createUser("cara", "cara-pass-1", "developer");
+    await auth.createUser("dan", "dan-pass-1", "admin");
+    cara = await login("cara", "cara-pass-1");
+    dan = await login("dan", "dan-pass-1");
+  });
+  after(() => {
+    delete process.env.AGENTHUB_MODE;
+    delete process.env.AGENTHUB_USERS_ROOT;
+  });
+
+  it("lists, restores and purges the member's own trash — the rest stays read-only", async () => {
+    const C = "/api/homes/me/fs";
+    const D = "/api/homes/cara/fs";
+    for (const n of ["old", "junk"]) {
+      assert.equal((await call("POST", `${C}/mkdir`, cara, { path: n })).status, 201);
+    }
+    assert.equal((await call("POST", `${C}/delete`, cara, { paths: ["old", "junk"] })).status, 200);
+
+    // The admin sees CARA's trash, not their own.
+    let items = (await call("GET", `${D}/trash`, dan)).body.items;
+    assert.deepEqual(items.map((i) => i.name).sort(), ["junk", "old"]);
+    assert.equal((await call("GET", "/api/homes/me/fs/trash", dan)).body?.items?.length ?? 0, 0);
+
+    // …and every user's in one list, each item tagged with its home and owner.
+    const all = (await call("GET", "/api/homes/trash", dan)).body;
+    assert.deepEqual(
+      all.items.map((i) => [i.name, i.home, i.owner]).sort(),
+      [
+        ["junk", "cara", "cara"],
+        ["old", "cara", "cara"],
+      ]
+    );
+    // A developer's merged view is only their own.
+    assert.deepEqual(
+      (await call("GET", "/api/homes/trash", cara)).body.items.map((i) => i.home),
+      ["me", "me"]
+    );
+    const old = items.find((i) => i.name === "old");
+    const r = await call("POST", `${D}/trash/restore`, dan, { id: old.id });
+    assert.equal(r.status, 200, JSON.stringify(r.body));
+    assert.ok(fs.statSync(path.join(USERS, "cara", "old")).isDirectory());
+
+    assert.equal((await call("POST", `${D}/trash/purge`, dan, { id: "all" })).body.purged, 1);
+    assert.equal((await call("GET", `${C}/trash`, cara)).body.items.length, 0);
+
+    // Everything else in another user's home is still refused.
+    const w = await call("POST", `${D}/mkdir`, dan, { path: "nope" });
+    assert.equal(w.status, 403);
+    assert.equal(w.body.error.code, "EREADONLY");
+    assert.equal((await call("POST", `${D}/delete`, dan, { paths: ["old"] })).status, 403);
+
+    // A developer still never reaches another user's trash.
+    assert.equal((await call("GET", "/api/homes/dan/fs/trash", cara)).status, 404);
+  });
+});
+
+describe("one recycle bin per user", () => {
+  const fx = require("../lib/file-explorer");
+  const runAs = require("../lib/run-as");
+  const MEMBER = path.join(ROOT, "member-home");
+  const put = (root, id, name, laneId) => {
+    fs.mkdirSync(path.join(root, id, "item"), { recursive: true });
+    fs.writeFileSync(
+      path.join(root, id, "meta.json"),
+      JSON.stringify({
+        id,
+        name,
+        laneId,
+        rel: name,
+        isDir: true,
+        deletedAt: new Date().toISOString(),
+      })
+    );
+  };
+
+  it("has one store when the home is the host's", async () => {
+    const out = await fx.listUserTrash(HOME, "solo");
+    assert.deepEqual(out.items, []);
+    put(path.join(process.env.DASHBOARD_DATA_DIR, "trash", "solo"), "solo0001", "x", null);
+    const items = (await fx.listUserTrash(HOME, "solo")).items;
+    assert.deepEqual(
+      items.map((i) => [i.name, i.store]),
+      [["x", "home"]]
+    );
+    assert.equal(
+      (await fx.purgeUserTrash(HOME, "solo", "host", "solo0001").catch((e) => e)).code,
+      "EBADPATH"
+    );
+  });
+
+  it("merges a member's home trash with their host trash, each item tagged", async (t) => {
+    fs.mkdirSync(MEMBER, { recursive: true });
+    const acct = { name: "mem", home: MEMBER, uid: process.getuid() };
+    const orig = runAs.accountForPath;
+    t.after(() => {
+      runAs.accountForPath = orig;
+    });
+    runAs.accountForPath = (p) => (String(p).startsWith(MEMBER) ? acct : null);
+    put(path.join(MEMBER, ".local", "share", "agenthub", "trash"), "memhome01", "fromHome", null);
+    put(path.join(process.env.DASHBOARD_DATA_DIR, "trash", "77"), "memhost01", "fromHostWs", 5);
+    const items = (await fx.listUserTrash(MEMBER, "77")).items;
+    assert.deepEqual(items.map((i) => [i.name, i.store]).sort(), [
+      ["fromHome", "home"],
+      ["fromHostWs", "host"],
+    ]);
+    // A host item whose workspace is gone has nowhere to go back to.
+    const r = await fx
+      .restoreUserTrash(MEMBER, "77", "host", "memhost01", () => null)
+      .catch((e) => e);
+    assert.equal(r.code, "ENOFILE");
+    assert.equal((await fx.purgeUserTrash(MEMBER, "77", "host", "memhost01")).purged, 1);
+    assert.ok(
+      !fs.existsSync(path.join(process.env.DASHBOARD_DATA_DIR, "trash", "77", "memhost01"))
+    );
+  });
+});
@@ -1146,7 +1146,7 @@ async function installSkill(req, row, { replace = false } = {}) {
    );
    if (acct) {
      if (!runAs.writeAsCanMove()) {
-        throw fail("EUPGRADE", "replacing needs the updated helper: run `sudo agenthub server install-system` once");
+        throw fail("EUPGRADE", "replacing needs the updated helper: run `agenthub server install-system` once");
      }
      runAs.mkdirAs(acct, path.dirname(aside));
      await runAs.writeAsAsync(acct, target, ["move", aside]);
@@ -2,7 +2,8 @@
 * @file The workspace File Explorer (`/api/lanes/:id/fs/*`): list a folder,
 * make a folder or an empty file, rename, move and copy (within a workspace
 * or into another of the same account), delete into a per-account TRASH that
- * can be restored (kept TRASH_DAYS), upload a file streamed from the request
+ * can be restored (kept TRASH_DAYS) — and, for `/api/homes`, one recycle bin
+ * per USER over every store their deletes went to — upload a file streamed from the request
 * into any (new) sub-folder, and download files or folders as one streamed zip.
 *
 * Every path is the read path's own (git-diff.js): `lanePath` (lexical, no
@@ -17,7 +18,7 @@
 * Writes run as the folder's ACCOUNT (run-as.js): a member's through
 * `write-as` (sudo, as them — the host never writes in their home), the
 * host's directly. A move/copy/trash in a member's folder needs write-as's
- * `move`/`copy` (`EUPGRADE` until `sudo agenthub server install-system` has
+ * `move`/`copy` (`EUPGRADE` until `agenthub server install-system` has
 * installed it). A copy or move never crosses accounts (`EFOREIGN`).
 *
 * A name that is taken is never silently replaced: `conflict` decides —
@@ -140,7 +141,7 @@ function needMove(acct) {
  if (acct && !runAs.writeAsCanMove()) {
    throw bad(
      "EUPGRADE",
-      "moving or copying in a member's folder needs the updated helper: run `sudo agenthub server install-system` once"
+      "moving or copying in a member's folder needs the updated helper: run `agenthub server install-system` once"
    );
  }
 }
@@ -468,12 +469,17 @@ async function dropTrash(acct, idDir) {
 async function listTrash(dir, userKey) {
  const root = await laneRoot(dir);
  const acct = accountAt(root);
-  const tr = trashRoot(acct, userKey);
+  const items = await readStore(acct, trashRoot(acct, userKey));
+  return { items, keepDays: TRASH_DAYS };
+}
+
+/** The live items of one trash folder `tr` (of `acct`), expired ones dropped. */
+async function readStore(acct, tr, store) {
  let ids = [];
  try {
    ids = (await fs.promises.readdir(tr)).filter((n) => TRASH_ID_RE.test(n));
  } catch {
-    return { items: [] };
+    return [];
  }
  const cutoff = Date.now() - TRASH_DAYS * 86_400_000;
  const items = [];
@@ -490,15 +496,20 @@ async function listTrash(dir, userKey) {
      path: meta.rel,
      isDir: !!meta.isDir,
      deletedAt: meta.deletedAt,
+      ...(store ? { store } : {}),
    });
  }
  items.sort((a, b) => b.deletedAt.localeCompare(a.deletedAt));
-  return { items, keepDays: TRASH_DAYS };
+  return items;
 }

 function trashEntry(acct, userKey, id) {
+  return entryAt(acct, trashRoot(acct, userKey), id);
+}
+
+function entryAt(acct, tr, id) {
  if (!TRASH_ID_RE.test(String(id || ""))) throw bad("EBADPATH", "no such trash item");
-  const idDir = path.join(trashRoot(acct, userKey), id);
+  const idDir = path.join(tr, id);
  const meta = readMeta(acct, idDir);
  if (!meta) throw bad("ENOFILE", "no such trash item");
  return { idDir, meta };
@@ -515,6 +526,11 @@ async function restore(dir, id, userKey, resolveLane) {
  const acct = accountAt(root);
  const { idDir, meta } = trashEntry(acct, userKey, id);
  const home = (meta.laneId != null && resolveLane(meta.laneId)) || dir;
+  return putBack(acct, idDir, meta, home, dir);
+}
+
+/** Move trash entry `idDir` back under folder `home` (`dir`: the fallback). */
+async function putBack(acct, idDir, meta, home, dir) {
  const parentRel = path.posix.dirname(String(meta.rel || meta.name));
  const relDir = parentRel === "." ? "" : parentRel;
  await ensureFolders(home, relDir);
@@ -530,6 +546,77 @@ async function restore(dir, id, userKey, resolveLane) {
  return { path: relDir ? `${relDir}/${name}` : name, laneId: home === dir ? null : meta.laneId };
 }

+// ── A user's recycle bin ───────────────────────────────────────────────────
+//
+// One Trash per USER, whatever place a delete happened in: the trash of their
+// home's account (a member's `~/.local/share/agenthub/trash/`, or the host's
+// `<data dir>/trash/<user id>/` when their home is the host's) plus — when
+// that is another folder — the host trash under their user id, where what
+// they deleted in a host-folder workspace went. Items carry `store`
+// ("home" | "host") so a restore or purge finds the right one.
+
+/** The trash stores of the user `userKey` whose home is `homeDir`. */
+function userStores(homeDir, userKey) {
+  const acct = accountAt(homeDir);
+  const out = [{ store: "home", acct, root: trashRoot(acct, userKey) }];
+  const host = trashRoot(null, userKey);
+  if (acct || path.resolve(host) !== path.resolve(out[0].root)) {
+    out.push({ store: "host", acct: null, root: host });
+  }
+  return out;
+}
+
+function pickStore(homeDir, userKey, store) {
+  const s = userStores(homeDir, userKey).find((x) => x.store === (store || "home"));
+  if (!s) throw bad("EBADPATH", "no such trash");
+  return s;
+}
+
+/** Every item of the user's recycle bin, newest first. */
+async function listUserTrash(homeDir, userKey) {
+  const items = [];
+  for (const s of userStores(homeDir, userKey)) {
+    items.push(...(await readStore(s.acct, s.root, s.store)));
+  }
+  items.sort((a, b) => b.deletedAt.localeCompare(a.deletedAt));
+  return { items, keepDays: TRASH_DAYS };
+}
+
+/**
+ * Restore item `id` of the user's `store`: into the workspace it came from
+ * when `resolveLane` still gives one, else — for the home store — into the
+ * home. A host-store item whose workspace is gone has nowhere of the same
+ * account to go (`ENOFILE`).
+ */
+async function restoreUserTrash(homeDir, userKey, store, id, resolveLane) {
+  const s = pickStore(homeDir, userKey, store);
+  const { idDir, meta } = entryAt(s.acct, s.root, id);
+  const fallback = s.store === "home" ? homeDir : null;
+  const home = (meta.laneId != null && resolveLane(meta.laneId)) || fallback;
+  if (!home) {
+    throw bad("ENOFILE", "the workspace this came from is gone — there is nowhere to restore it");
+  }
+  return putBack(s.acct, idDir, meta, home, fallback);
+}
+
+/** Delete item `id` of `store` forever, or `"all"` of every store. */
+async function purgeUserTrash(homeDir, userKey, store, id) {
+  if (id === "all") {
+    let n = 0;
+    for (const s of userStores(homeDir, userKey)) {
+      for (const it of await readStore(s.acct, s.root)) {
+        await dropTrash(s.acct, path.join(s.root, it.id));
+        n++;
+      }
+    }
+    return { purged: n };
+  }
+  const s = pickStore(homeDir, userKey, store);
+  const { idDir } = entryAt(s.acct, s.root, id);
+  await dropTrash(s.acct, idDir);
+  return { purged: 1 };
+}
+
 async function purgeTrash(dir, userKey, id) {
  const root = await laneRoot(dir);
  const acct = accountAt(root);
@@ -800,6 +887,9 @@ module.exports = {
  remove,
  trashOne,
  listTrash,
+  listUserTrash,
+  restoreUserTrash,
+  purgeUserTrash,
  restore,
  purgeTrash,
  upload,
@@ -386,6 +386,15 @@ async function getAuthor(account) {
  return { name: await get("user.name"), email: await get("user.email") };
 }

+/** The domain of a suggested email when the account has no author yet. */
+const DEFAULT_EMAIL_DOMAIN = process.env.AGENTHUB_EMAIL_DOMAIN || "smartgift.vn";
+
+/** `<username>@<DEFAULT_EMAIL_DOMAIN>`, or null without a usable name. */
+function defaultEmail(username) {
+  const local = String(username || "").replace(/[^\w.+-]/g, "");
+  return local ? `${local}@${DEFAULT_EMAIL_DOMAIN}` : null;
+}
+
 /**
 * Set the account's commit author. Neither is a secret, so they may cross
 * sudo's argv; each is one line, a name up to 100 and an email up to 254
@@ -798,6 +807,7 @@ module.exports = {
  defaultName,
  cloneRepo,
  getAuthor,
+  defaultEmail,
  setAuthor,
  sshConfigFor,
  memberHttpsConfig,
@@ -6,7 +6,7 @@
 * workspaces in.
 *
 * S3 is ON when server mode is on AND `/etc/agenthub/server.conf` exists
- * (written by `sudo agenthub server install-system`, root-owned). Without it
+ * (written by `agenthub server install-system`, root-owned). Without it
 * everything here is a no-op and server mode behaves as in S2.
 *
 * `provision` is the dashboard's only way to create, disable or enable a Linux
@@ -158,7 +158,7 @@ function provision(action, username) {
    // An installed helper older than this build (root's copy is refreshed
    // only by install-system) does not know the action yet.
    const hint = /unknown action/.test(why)
-      ? " — the server helper is older than this AgentHub: run `sudo agenthub server install-system` once"
+      ? " — the server helper is older than this AgentHub: run `agenthub server install-system` once"
      : "";
    throw Object.assign(new Error(`could not ${action} the Linux account: ${why}${hint}`), {
      code: "EPROVISION",
@@ -6,13 +6,15 @@
 * git uses that key (`core.sshCommand`), the SSH login name per host
 * (`url.<…>.insteadOf` — AWS CodeCommit's SSH key ID), and the commit author (`user.name` /
 * `user.email` of the account's global git config — a member's commits fail
- * without one). The account is the signed-in user's
+ * without one; a new SSH key is labelled with that email, else
+ * `<username>@smartgift.vn`). The account is the signed-in user's
 * own Linux account under S3, else the host's, which only an admin (or local
 * mode) may change (`EHOSTIDENTITY`). Nothing here takes a path from the
 * request, and every write passes the same-origin guard.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

+const os = require("node:os");
 const express = require("express");

 const identity = require("../lib/git-identity");
@@ -39,7 +41,7 @@ function fail(res, e) {
    .json({ error: { code: e.code || "EINTERNAL", message: e.message } });
 }

-async function view(account) {
+async function view(account, username) {
  const keys = identity.sshKeysInfo(account);
  const terminal = keys.length ? await identity.terminalSshState(account) : undefined;
  return {
@@ -52,9 +54,14 @@ async function view(account) {
    sshUsers: await identity.listSshUsers(account),
    https: identity.listHttps(account),
    author: await identity.getAuthor(account),
+    // What the author email form suggests while none is set.
+    defaultEmail: identity.defaultEmail(username),
  };
 }

+/** The signed-in user's name, or the OS user's in local mode. */
+const usernameOf = (req) => req.user?.username || os.userInfo().username;
+
 /** The request's account; a write to the host's identity needs an admin. */
 function accountOf(req, { write = false } = {}) {
  const account = identity.accountForRequest(req);
@@ -68,7 +75,7 @@ function accountOf(req, { write = false } = {}) {

 router.get("/", async (req, res) => {
  try {
-    res.json(await view(accountOf(req)));
+    res.json(await view(accountOf(req), usernameOf(req)));
  } catch (e) {
    fail(res, e);
  }
@@ -80,9 +87,11 @@ router.post("/ssh-key", sameOriginGuard, async (req, res) => {
    await identity.generateSshKey(account, {
      replace: req.body?.replace === true,
      type: req.body?.type === "rsa" ? "rsa" : "ed25519",
-      comment: req.user?.username ? `${req.user.username}@agenthub` : "agenthub",
+      // The key is labelled with the commit author's email, else the default one.
+      comment:
+        (await identity.getAuthor(account)).email || identity.defaultEmail(usernameOf(req)),
    });
-    res.status(201).json(await view(account));
+    res.status(201).json(await view(account, usernameOf(req)));
  } catch (e) {
    fail(res, e);
  }
@@ -95,7 +104,7 @@ router.delete("/ssh-key", sameOriginGuard, async (req, res) => {
    if (!(await identity.removeSshKey(account, type))) {
      return res.status(404).json({ error: { code: "ENOTFOUND", message: "no SSH key" } });
    }
-    res.json(await view(account));
+    res.json(await view(account, usernameOf(req)));
  } catch (e) {
    fail(res, e);
  }
@@ -112,7 +121,7 @@ router.put("/ssh-terminal", sameOriginGuard, async (req, res) => {
      return res.status(404).json({ error: { code: "ENOTFOUND", message: "no SSH key" } });
    }
    await identity.setTerminalSsh(account, req.body?.on === true);
-    res.json(await view(account));
+    res.json(await view(account, usernameOf(req)));
  } catch (e) {
    fail(res, e);
  }
@@ -126,7 +135,7 @@ router.put("/ssh-user", sameOriginGuard, async (req, res) => {
  try {
    const account = accountOf(req, { write: true });
    await identity.setSshUser(account, req.body || {});
-    res.json(await view(account));
+    res.json(await view(account, usernameOf(req)));
  } catch (e) {
    fail(res, e);
  }
@@ -138,7 +147,7 @@ router.delete("/ssh-user/:host", sameOriginGuard, async (req, res) => {
    if (!(await identity.removeSshUser(account, req.params.host))) {
      return res.status(404).json({ error: { code: "ENOTFOUND", message: "no such SSH user" } });
    }
-    res.json(await view(account));
+    res.json(await view(account, usernameOf(req)));
  } catch (e) {
    fail(res, e);
  }
@@ -149,7 +158,7 @@ router.post("/https", sameOriginGuard, async (req, res) => {
    const account = accountOf(req, { write: true });
    const { host, username, password } = req.body || {};
    identity.saveHttps(account, { protocol: "https", host, username, password });
-    res.json(await view(account));
+    res.json(await view(account, usernameOf(req)));
  } catch (e) {
    fail(res, e);
  }
@@ -161,7 +170,7 @@ router.delete("/https/:host", sameOriginGuard, async (req, res) => {
    if (!identity.removeHttps(account, "https", req.params.host)) {
      return res.status(404).json({ error: { code: "ENOTFOUND", message: "no such login" } });
    }
-    res.json(await view(account));
+    res.json(await view(account, usernameOf(req)));
  } catch (e) {
    fail(res, e);
  }
@@ -172,7 +181,7 @@ router.put("/author", sameOriginGuard, async (req, res) => {
  try {
    const account = accountOf(req, { write: true });
    await identity.setAuthor(account, req.body || {});
-    res.json(await view(account));
+    res.json(await view(account, usernameOf(req)));
  } catch (e) {
    fail(res, e);
  }
@@ -4,13 +4,18 @@
 * `inHome` so the dot entries at the top of a home stay out of reach).
 *
 *   GET  /api/homes                      the homes the caller may open
+ *   GET  /api/homes/trash                every Trash the caller may open, merged
 *   GET  /api/homes/:who/fs/list|trash|zip|download
 *   POST /api/homes/:who/fs/mkdir|newfile|rename|move|copy|delete|upload|trash/restore|trash/purge
 *
 * `:who` is `me`, or — for an admin — another user's name: read-only
- * (`403 EREADONLY` on every write) and written to the audit log. Writes are
- * same-origin; a copy may come from a workspace (`fromLane`) the caller can
- * see, of the same Linux account.
+ * (`403 EREADONLY` on every write) and written to the audit log. The one
+ * exception is that user's TRASH: an admin lists, restores and purges it
+ * (the recycle-bin management in /files), each write audited with the item
+ * id. A home's Trash is its USER's whole recycle bin (`fx.listUserTrash`:
+ * their home account's trash plus their host trash), each item tagged with
+ * the `store` a restore/purge names. Writes are same-origin; a copy may come
+ * from a workspace (`fromLane`) the caller can see, of the same Linux account.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

@@ -57,12 +62,12 @@ const paths = (body) =>
 * Resolve `:who`, refuse a write to someone else's home, audit an admin's
 * read of it, then run `fn(home)` inside the home rule.
 */
-function handle(fn, { write = false } = {}) {
+function handle(fn, { write = false, trash = false } = {}) {
  return async (req, res) => {
    let home;
    try {
      home = homes.resolveHome(req, req.params.who);
-      if (write && home.readOnly) {
+      if (write && !trash && home.readOnly) {
        throw Object.assign(new Error("another user's home is read-only"), { code: "EREADONLY" });
      }
      if (home.readOnly && req.user) {
@@ -70,7 +75,7 @@ function handle(fn, { write = false } = {}) {
          req.user.id,
          home.ownerId,
          req.method,
-          `home ${req.params.who}: ${req.path} ${String(req.query.path ?? "")}`
+          `home ${req.params.who}: ${req.path} ${String(req.query.path ?? req.body?.id ?? "")}`
        );
      }
      await fx.inHome(() => fn(req, res, home));
@@ -81,11 +86,51 @@ function handle(fn, { write = false } = {}) {
  };
 }
 const trashFor = (req, home) => (rel) => fx.trashOne(home.dir, null, rel, userKey(req));
+/** Whose trash a home's Trash view shows: the home OWNER's (an admin looking
+ *  at another user's home manages THEIR recycle bin, not the admin's own). */
+const trashKey = (req, home) =>
+  home.readOnly && home.ownerId != null ? String(home.ownerId) : userKey(req);

 router.get("/", (req, res) => {
  res.json({ homes: homes.listHomes(req) });
 });

+/**
+ * Every recycle bin the caller may open in one list — an admin's is every
+ * user's — each item tagged with its home (`home`, the `:who` a restore or
+ * purge goes to) and that user's name (`owner`). A home whose trash cannot
+ * be read is reported in `errors`, never silently left out. Each other
+ * user's trash read is audited like opening their home.
+ */
+router.get("/trash", async (req, res) => {
+  const items = [];
+  const errors = [];
+  let keepDays;
+  for (const h of homes.listHomes(req)) {
+    try {
+      const home = homes.resolveHome(req, h.id);
+      if (home.readOnly && req.user) {
+        require("../lib/audit").recordHomeRead(
+          req.user.id,
+          home.ownerId,
+          "GET",
+          `home ${h.id}: /trash (all trashes)`
+        );
+      }
+      const out = await fx.listUserTrash(home.dir, trashKey(req, home));
+      keepDays = out.keepDays;
+      for (const i of out.items) {
+        if (i.laneId != null && !scope.canSeeLane(req, i.laneId)) continue;
+        items.push({ ...i, home: h.id, owner: h.label });
+      }
+    } catch (err) {
+      errors.push({ home: h.id, owner: h.label, message: err.message });
+    }
+  }
+  items.sort((a, b) => b.deletedAt.localeCompare(a.deletedAt));
+  res.json({ items, errors, keepDays });
+});
+
 router.get(
  "/:who/fs/list",
  handle(async (req, res, home) => {
@@ -136,13 +181,15 @@ router.get(
 router.get(
  "/:who/fs/trash",
  handle(async (req, res, home) => {
-    const out = await fx.listTrash(home.dir, userKey(req));
+    const out = await fx.listUserTrash(home.dir, trashKey(req, home));
    out.items = out.items.filter((i) => i.laneId == null || scope.canSeeLane(req, i.laneId));
    res.json(out);
  })
 );

 const W = { write: true };
+// Restore/purge: writes, but allowed in another user's home for an admin.
+const TRASH_W = { write: true, trash: true };
 router.post(
  "/:who/fs/mkdir",
  sameOriginGuard,
@@ -223,15 +270,26 @@ router.post(
      const l = lanesLib.getLane(Number(laneId));
      return l && scope.canSeeLane(req, l.id) ? l.cwd : null;
    };
-    res.json(await fx.restore(home.dir, req.body?.id, userKey(req), resolveLane));
-  }, W)
+    res.json(
+      await fx.restoreUserTrash(
+        home.dir,
+        trashKey(req, home),
+        req.body?.store,
+        req.body?.id,
+        resolveLane
+      )
+    );
+  }, TRASH_W)
 );
 router.post(
  "/:who/fs/trash/purge",
  sameOriginGuard,
  handle(
-    async (req, res, home) => res.json(await fx.purgeTrash(home.dir, userKey(req), req.body?.id)),
-    W
+    async (req, res, home) =>
+      res.json(
+        await fx.purgeUserTrash(home.dir, trashKey(req, home), req.body?.store, req.body?.id)
+      ),
+    TRASH_W
  )
 );
 router.post(