feat(config): create a new project's memory file from Settings

The Memory tab could only show this machine's user memory and the
dashboard's own project file. Setting up a project you had not run
through the dashboard meant opening a terminal — `PUT /file`'s
"project" scope always resolves against the server's cwd, on purpose.

Add one narrow route per tool that writes into the directory you name:
CLAUDE.md for Claude Code, AGENTS.md for Codex, both through the same
`project-memory.js`. Being the only write path that honours a
caller-supplied directory, it pays for that:

  - the directory must be absolute and already exist — nothing is
    created for you;
  - the filename comes from the route, never from the body;
  - an existing file, symlink included, is a 409 — this can only
    create, never overwrite;
  - it sits behind the loopback-Origin guard /api/run uses, so a page
    in the user's browser cannot plant agent instructions in a project
    directory. That guard moves to lib/same-origin.js to be shared.

The modal takes the dashboard's known project dirs as suggestions on a
free-text input rather than a closed list: a project it has never seen
is exactly the case this exists for.

Mutation-checked: dropping the origin guard, and swapping lstat for
stat, each fail a test.

server/routes/cc-config.js

@@ -29,6 +29,8 @@ const ccMutate = require("../lib/cc-mutate");
 const ccCli = require("../lib/cc-plugin-cli");
 const ccMcpCli = require("../lib/cc-mcp-cli");
 const ccProfiles = require("../lib/cc-profiles");
+const projectMemory = require("../lib/project-memory");
+const { sameOriginGuard } = require("../lib/same-origin");
 const { broadcast } = require("../websocket");
 
 const router = Router();
@@ -48,6 +50,10 @@ const ERR_TO_STATUS = {
   EBADNAME: 400,
   EBADPROJECT: 400,
   EBADCONTENT: 400,
+  EBADDIR: 400,
+  EBADTOOL: 400,
+  // The project already has a memory file; creating would clobber it.
+  EEXISTS: 409,
   ETOOLARGE: 413,
   EOUTOFROOT: 400,
   ENOTFOUND: 404,
@@ -216,6 +222,27 @@ router.delete("/file", (req, res) => {
   }
 });
 
+/**
+ * POST /api/cc-config/project-memory — create `CLAUDE.md` in a project the
+ * dashboard has never run in. Body: `{ dir, content }`.
+ *
+ * The one write here that honours a caller-supplied directory, which is the
+ * whole point: you cannot bootstrap a NEW project's memory from a writer
+ * pinned to the server's own cwd. It stays narrow — see project-memory.js —
+ * and sits behind the same loopback-origin guard the process-spawning routes
+ * use, so a random web page cannot plant instructions in a project directory.
+ */
+router.post("/project-memory", sameOriginGuard, (req, res) => {
+  const { dir, content } = req.body || {};
+  try {
+    const result = projectMemory.createProjectMemory({ tool: "claude", dir, content });
+    emitChanged({ action: "write", scope: "project", type: "memory", name: null });
+    res.json({ ...result, created: true });
+  } catch (err) {
+    return mutateError(res, err);
+  }
+});
+
 // ── Plugins / marketplaces (via the `claude` CLI) ──────────────────────
 //
 // These shell out to `claude plugin …` with an argv array — never a shell

server/routes/codex-config.js

@@ -24,6 +24,8 @@ const { Router } = require("express");
 const codexDiscovery = require("../lib/codex-discovery");
 const codexMutate = require("../lib/codex-mutate");
 const codexCli = require("../lib/codex-cli");
+const projectMemory = require("../lib/project-memory");
+const { sameOriginGuard } = require("../lib/same-origin");
 const { broadcast } = require("../websocket");
 
 const router = Router();
@@ -56,9 +58,13 @@ const ERR_TO_STATUS = {
   EBADSCOPE: 400,
   EBADNAME: 400,
   EBADCONTENT: 400,
+  EBADDIR: 400,
+  EBADTOOL: 400,
   EOUTOFROOT: 400,
   ETOOLARGE: 413,
   ENOTFOUND: 404,
+  // The project already has an AGENTS.md; creating would clobber it.
+  EEXISTS: 409,
 };
 
 function mutateError(res, err) {
@@ -158,6 +164,24 @@ router.delete("/file", (req, res) => {
   }
 });
 
+/**
+ * POST /api/codex-config/project-memory — create `AGENTS.md` in a project the
+ * dashboard has never run in. Body: `{ dir, content }`. The Codex twin of
+ * cc-config.js's route of the same name; both go through project-memory.js,
+ * which is where the narrowing rules for this one caller-chosen write path
+ * are documented.
+ */
+router.post("/project-memory", sameOriginGuard, (req, res) => {
+  const { dir, content } = req.body || {};
+  try {
+    const result = projectMemory.createProjectMemory({ tool: "codex", dir, content });
+    emitChanged({ action: "write", scope: "project", type: "memory", name: null });
+    res.json({ ...result, created: true });
+  } catch (err) {
+    return mutateError(res, err);
+  }
+});
+
 router.get("/backups", (req, res) => {
   const scope =
     req.query.scope === "user" || req.query.scope === "project" ? req.query.scope : undefined;

server/routes/run.js

@@ -25,45 +25,10 @@ const path = require("node:path");
 const runs = require("../lib/pty-run");
 const tmux = require("../lib/tmux");
 const lanesLib = require("../lib/lanes");
+const { sameOriginGuard } = require("../lib/same-origin");
 
 const router = Router();
 
-const ALLOWED_ORIGIN_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
-
-/**
- * Loopback-Origin guard. Browser requests carry Origin; if it's not localhost,
- * we reject. Server/CLI requests (curl) typically don't carry Origin and pass.
- *
- * Referer is checked as a fallback for older browsers / fetch with credentials
- * disabled — the same loopback-host rule applies.
- */
-function sameOriginGuard(req, res, next) {
-  const checkHost = (raw) => {
-    try {
-      const u = new URL(raw);
-      return ALLOWED_ORIGIN_HOSTS.has(u.hostname);
-    } catch {
-      return false;
-    }
-  };
-  const origin = req.headers.origin;
-  if (origin) {
-    if (!checkHost(origin)) {
-      return res.status(403).json({
-        error: { code: "EBADORIGIN", message: "cross-origin requests are not allowed" },
-      });
-    }
-    return next();
-  }
-  const referer = req.headers.referer;
-  if (referer && !checkHost(referer)) {
-    return res.status(403).json({
-      error: { code: "EBADORIGIN", message: "cross-origin requests are not allowed" },
-    });
-  }
-  return next();
-}
-
 router.use(sameOriginGuard);
 
 function isExistingDir(p) {