feat: per-change-block hunk actions (#50), codex lanes without a pipeline, macOS LaunchAgent

- git (#50): stage-hunk/discard-hunk take an optional `block` — one run of
  consecutive +/- lines inside an @@ hunk. `onlyBlock` (server/lib/git-diff.js)
  cuts git's fresh hunk down to it, folding the other blocks into the side
  being checked; LaneDiffView hangs one review bar per block (unified + split)
  and its arrows walk blocks.
- git exclude: entries AgentHub writes for a lane go to the COMMON git dir with
  the lane's path prefix (server/lib/git-exclude.js, used by router-apply and
  lane-mcp) — a linked worktree's own info/exclude is never read by git, and a
  subdir lane has no .git. MCP sync no longer fails with ENOTDIR on a worktree
  lane or creates a stray .git in a non-repo lane.
- codex lanes carry no pipeline: codex-ingest mirrors only idle/running,
  codex-nudge is removed, agents install writes nothing for codex, the
  Workspace hides stage/pipeline/feature pickers/PipelineMap for them, and
  every server start clears leftover codex stage data and the old AGENTS.md
  stage block.
- Changes panel: a whole file opens for reading and enters the editor on a
  click on its text (caret at the clicked line), not automatically.
- macOS: LaunchAgent start-at-login (scripts/launchd-service.js, picked by
  scripts/service-manager.js).
- Adds the AgentHub introduction slides and their image-embedding script.

scripts/launchd-service.js

@@ -0,0 +1,241 @@
+#!/usr/bin/env node
+/**
+ * @file launchd-service.js
+ * @description The macOS twin of `systemd-service.js`: a per-user LaunchAgent
+ * (`~/Library/LaunchAgents/io.smartgift.<name>.plist`) that starts the AgentHub
+ * dashboard at login and keeps it running, without Claude Code being opened
+ * first. Same exports and the same return values as the systemd module, so
+ * `service-manager.js` can hand either one to the bootstrap, the CLI and the
+ * doctor. Every `launchctl` call goes through one seam (`__setExecImpl`) so
+ * tests never touch a real launchd.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+const MARKER = "<!-- agenthub-managed-unit — regenerated on install, do not edit by hand -->";
+
+const kind = "launchd";
+const label = "LaunchAgent";
+
+function jobLabel(name) {
+  return `io.smartgift.${name}`;
+}
+
+function unitPath(name) {
+  return path.join(os.homedir(), "Library", "LaunchAgents", `${jobLabel(name)}.plist`);
+}
+
+function logPath() {
+  return path.join(os.homedir(), "Library", "Logs", "agenthub.log");
+}
+
+function domain() {
+  return `gui/${process.getuid()}`;
+}
+
+let execImpl = (args, opts) => spawnSync("launchctl", args, opts);
+
+function __setExecImpl(fn) {
+  execImpl = fn;
+}
+function __reset() {
+  execImpl = (args, opts) => spawnSync("launchctl", args, opts);
+}
+
+function launchctl(args) {
+  return execImpl(args, { encoding: "utf8", stdio: "pipe" });
+}
+
+/**
+ * A LaunchAgent lives in the user's GUI domain, which exists only while that
+ * user is logged in at the console. Over a bare SSH login there is none, and
+ * the caller falls back to its detached spawn.
+ */
+function systemctlAvailable() {
+  if (process.platform !== "darwin") return false;
+  return launchctl(["print", domain()]).status === 0;
+}
+
+function readPlist(name) {
+  try {
+    return fs.readFileSync(unitPath(name), "utf8");
+  } catch {
+    return null;
+  }
+}
+
+function unitIsOurs(name) {
+  const body = readPlist(name);
+  return !!body && body.includes(MARKER);
+}
+
+const xmlEscape = (s) =>
+  String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const xmlUnescape = (s) => s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+
+function workingDirOf(body) {
+  const m = body.match(/<key>WorkingDirectory<\/key>\s*<string>([^<]*)<\/string>/);
+  return m ? xmlUnescape(m[1]) : null;
+}
+
+/** Same contract as the systemd twin: pure fs, never a foreign plist. */
+function unitIsStale(name, root) {
+  const body = readPlist(name);
+  if (!body || !body.includes(MARKER)) return false;
+  return workingDirOf(body) !== root;
+}
+
+/** The directory the plist runs from — ours or not (the cache pruner's guard). */
+function unitRoot(name) {
+  const body = readPlist(name);
+  return body ? workingDirOf(body) : null;
+}
+
+function isLoaded(name) {
+  return launchctl(["print", `${domain()}/${jobLabel(name)}`]).status === 0;
+}
+
+function unitIsActive(name) {
+  if (!systemctlAvailable()) return false;
+  const res = launchctl(["print", `${domain()}/${jobLabel(name)}`]);
+  return res.status === 0 && /^\s*state = running$/m.test(String(res.stdout || ""));
+}
+
+/**
+ * `argv` is the program and its arguments as separate strings (the systemd
+ * twin's `execStart` is one line; a path with a space would split here).
+ * `KeepAlive` true is `Restart=always`. `AbandonProcessGroup` keeps the lane
+ * panes alive: they run in a tmux server the dashboard spawned, and launchd
+ * otherwise kills a stopped job's whole process group — every running agent
+ * with it, on every update.
+ */
+function unitContent({ name, workingDir, argv, env }) {
+  const str = (v) => `<string>${xmlEscape(v)}</string>`;
+  const envLines = Object.entries(env)
+    .map(([k, v]) => `\t\t<key>${xmlEscape(k)}</key>\n\t\t${str(v)}`)
+    .join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+${MARKER}
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	${str(jobLabel(name))}
+	<key>ProgramArguments</key>
+	<array>
+${argv.map((a) => `\t\t${str(a)}`).join("\n")}
+	</array>
+	<key>WorkingDirectory</key>
+	${str(workingDir)}
+	<key>EnvironmentVariables</key>
+	<dict>
+${envLines}
+	</dict>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<true/>
+	<key>ThrottleInterval</key>
+	<integer>3</integer>
+	<key>AbandonProcessGroup</key>
+	<true/>
+	<key>StandardOutPath</key>
+	${str(logPath())}
+	<key>StandardErrorPath</key>
+	${str(logPath())}
+</dict>
+</plist>
+`;
+}
+
+/**
+ * Writes the plist and clears any "disabled" override — and starts nothing.
+ * A loaded job keeps running its OLD definition until `restartUserService`;
+ * an unloaded one is picked up at the next login. Same split, same reason, as
+ * the systemd twin.
+ *
+ * @returns {"written"|"unchanged"|"foreign"|"unavailable"|"failed"}
+ */
+function writeUserService({ name, workingDir, argv, env = {} }) {
+  if (!systemctlAvailable()) return "unavailable";
+  const body = unitContent({ name, workingDir, argv, env });
+  const target = unitPath(name);
+  try {
+    const current = readPlist(name);
+    if (current !== null) {
+      if (!current.includes(MARKER)) return "foreign";
+      if (current === body) return "unchanged";
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.mkdirSync(path.dirname(logPath()), { recursive: true });
+    fs.writeFileSync(target, body, "utf8");
+    launchctl(["enable", `${domain()}/${jobLabel(name)}`]);
+    return "written";
+  } catch {
+    return "failed";
+  }
+}
+
+/**
+ * Reload the job from its plist. `kickstart -k` would restart the process but
+ * keep the definition launchd already holds — the old plugin root — so it is
+ * bootout + bootstrap. Unlike systemd, the caller is not reaped with the job:
+ * it runs in its own process group and the job abandons its group anyway.
+ */
+function restartUserService(name) {
+  if (!systemctlAvailable()) return "unavailable";
+  launchctl(["bootout", `${domain()}/${jobLabel(name)}`]); // not loaded: fine
+  const res = launchctl(["bootstrap", domain(), unitPath(name)]);
+  return res.status === 0 ? "restarted" : "failed";
+}
+
+/** Write, then load and start. For `agenthub service install` and a bootstrap
+ *  that owns no running job. */
+function installUserService(opts) {
+  const result = writeUserService(opts);
+  if (result === "written" || (result === "unchanged" && !isLoaded(opts.name))) {
+    if (restartUserService(opts.name) !== "restarted") return "failed";
+  } else if (result === "unchanged") {
+    launchctl(["kickstart", `${domain()}/${jobLabel(opts.name)}`]); // start if stopped
+  }
+  return result;
+}
+
+/** @returns {"removed"|"absent"|"foreign"|"unavailable"} */
+function uninstallUserService(name) {
+  if (!systemctlAvailable()) return "unavailable";
+  const body = readPlist(name);
+  if (body === null) return "absent";
+  if (!body.includes(MARKER)) return "foreign";
+  launchctl(["bootout", `${domain()}/${jobLabel(name)}`]);
+  fs.rmSync(unitPath(name), { force: true });
+  return "removed";
+}
+
+/** A LaunchAgent starts at login by definition; there is no linger to grant. */
+function enableLinger() {
+  return true;
+}
+
+module.exports = {
+  kind,
+  label,
+  systemctlAvailable,
+  unitIsOurs,
+  unitIsStale,
+  unitRoot,
+  unitIsActive,
+  writeUserService,
+  restartUserService,
+  installUserService,
+  uninstallUserService,
+  enableLinger,
+  unitPath,
+  logPath,
+  __setExecImpl,
+  __reset,
+};

scripts/plugin-bootstrap.js

@@ -9,7 +9,8 @@
  * The worker installs runtime dependencies, removes hook entries left behind by
  * an older `npm run install-hooks` (they would double-count every event), puts
  * the `agenthub` CLI on PATH, and starts the dashboard server — as a systemd
- * `--user` service when available (see `systemd-service.js`), so it survives
+ * `--user` service or a macOS LaunchAgent when available (see
+ * `service-manager.js`), so it survives
  * reboots without Claude Code being opened first; otherwise a detached spawn
  * scoped to this session, same as before.
  *
@@ -169,7 +170,7 @@ function fastPathOk(rt = runtimeDir()) {
   // until the next reboot — and then the dashboard is simply gone, from a path
   // Claude Code deleted long ago. Reading one file is cheap enough for a hot
   // path; `unitIsStale` deliberately spawns nothing.
-  if (require("./systemd-service").unitIsStale("agenthub", PLUGIN_ROOT)) return false;
+  if (require("./service-manager").unitIsStale("agenthub", PLUGIN_ROOT)) return false;
   // Leftover checkout hooks are the one defect that corrupts the DATA rather
   // than the install: events carry no id, so a second handler doubles every
   // event, every subagent row and every turn. `stripLegacyHooks` removes them —
@@ -591,7 +592,7 @@ function pruneRetiredPluginRoots(rt, root = PLUGIN_ROOT) {
     /* no record to read — the other three protections still apply */
   }
   try {
-    const unitRoot = require("./systemd-service").unitRoot("agenthub");
+    const unitRoot = require("./service-manager").unitRoot("agenthub");
     if (unitRoot) keep.add(path.resolve(unitRoot));
   } catch {
     /* best effort */
@@ -724,7 +725,7 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
       log(rt, "built the dashboard UI bundle");
     }
 
-    const svc = require("./systemd-service");
+    const svc = require("./service-manager");
     // Who owns the running server decides how it may be retired. A unit of
     // ours means systemd owns it — and this process is a descendant of that
     // server, so it sits in the unit's cgroup. SIGTERM-ing the main process
@@ -763,6 +764,7 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
         description: "AgentHub dashboard server (Claude Code plugin)",
         workingDir: PLUGIN_ROOT,
         execStart: `${process.execPath} ${path.join(PLUGIN_ROOT, "server", "index.js")}`,
+        argv: [process.execPath, path.join(PLUGIN_ROOT, "server", "index.js")],
         env: {
           NODE_ENV: "production",
           NODE_PATH: path.join(rt, "node_modules"),
@@ -792,13 +794,14 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
         log(
           rt,
           result === "unchanged"
-            ? "systemd --user service already up to date"
+            ? `${svc.label} already up to date`
             : unitStale && !needsServer
-              ? "repointed the systemd --user service at the current plugin version (it named a retired one)"
-              : "installed a systemd --user service — the dashboard now survives reboots without Claude Code"
+              ? `repointed the ${svc.label} at the current plugin version (it named a retired one)`
+              : `installed a ${svc.label} — the dashboard now survives reboots without Claude Code`
         );
       } else if (needsServer) {
-        // No systemd (macOS/Windows/WSL without it), or the unit exists but
+        // No service manager (Windows, WSL without systemd, a Mac over SSH with
+        // no GUI login), or the unit exists but
         // wasn't ours to touch — same detached-spawn fallback as before,
         // scoped to this session only. Guarded by `needsServer`: entering this
         // block for a stale unit alone must never spawn a second server onto
@@ -806,7 +809,7 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
         const pid = startDashboard(rt);
         log(
           rt,
-          `started the dashboard server (pid ${pid})${result === "foreign" ? " — a foreign systemd unit named 'agenthub' already exists" : ""}`
+          `started the dashboard server (pid ${pid})${result === "foreign" ? ` — a foreign ${svc.label} named 'agenthub' already exists` : ""}`
         );
       }
     }
@@ -843,8 +846,17 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
     // file is written and the lock is gone, so even being killed here leaves
     // no debris and no half-recorded bootstrap.
     if (pendingSystemdRestart) {
-      log(rt, "handing the server over to systemd (restarting the unit)");
-      require("./systemd-service").restartUserService("agenthub");
+      const svc = require("./service-manager");
+      log(rt, `handing the server over to ${svc.kind} (restarting the unit)`);
+      // On launchd the restart is bootout + bootstrap, and a failed bootstrap
+      // leaves NOTHING running (systemd's restart either happens or leaves the
+      // old server up). This process survives it there, so fall back.
+      if (svc.restartUserService("agenthub") === "failed" && !serverIsLive()) {
+        log(
+          rt,
+          `${svc.kind} could not start the server — started it detached (pid ${startDashboard(rt)})`
+        );
+      }
     }
   }
 }

scripts/plugin-doctor.js

@@ -233,16 +233,17 @@ function skillPluginStatus() {
  * about.
  */
 function systemdStatus() {
-  const svc = require("./systemd-service");
+  const svc = require("./service-manager");
   const unit = svc.unitPath("agenthub");
+  const row = svc.kind;
 
   if (!svc.unitIsOurs("agenthub")) {
     if (fs.existsSync(unit)) {
-      return ["warn", "systemd", `${unit} exists but was not written by AgentHub — left untouched`];
+      return ["warn", row, `${unit} exists but was not written by AgentHub — left untouched`];
     }
     return [
       "ok",
-      "systemd",
+      row,
       svc.systemctlAvailable()
         ? "no unit — the server is started per session (install one with `agenthub service install`)"
         : "not available on this platform — the server is started per session",
@@ -252,7 +253,7 @@ function systemdStatus() {
   if (svc.unitIsStale("agenthub", PLUGIN_ROOT)) {
     return [
       "warn",
-      "systemd",
+      row,
       `${unit} still points at a previous plugin version — the dashboard will NOT come back after a reboot. ` +
         `Starting a new Claude Code session repairs it; or run: node ${path.join(PLUGIN_ROOT, "scripts", "plugin-bootstrap.js")} --force`,
     ];
@@ -261,11 +262,13 @@ function systemdStatus() {
   if (!svc.unitIsActive("agenthub")) {
     return [
       "warn",
-      "systemd",
-      "unit is installed and current but not running — start it with `systemctl --user start agenthub`",
+      row,
+      svc.kind === "launchd"
+        ? "LaunchAgent is installed and current but not running — start it with `agenthub service install`"
+        : "unit is installed and current but not running — start it with `systemctl --user start agenthub`",
     ];
   }
-  return ["ok", "systemd", "unit is current and running — the dashboard survives reboots"];
+  return ["ok", row, `${svc.label} is current and running — the dashboard survives reboots`];
 }
 
 /**

scripts/service-manager.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+/**
+ * @file service-manager.js
+ * @description Picks the per-user service manager that keeps the dashboard
+ * running without Claude Code: a LaunchAgent on macOS (`launchd-service.js`),
+ * a systemd `--user` unit everywhere else (`systemd-service.js`, which reports
+ * itself unavailable off Linux). Both export the same API.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+module.exports =
+  process.platform === "darwin" ? require("./launchd-service") : require("./systemd-service");

scripts/systemd-service.js

@@ -224,6 +224,8 @@ function enableLinger() {
 }
 
 module.exports = {
+  kind: "systemd",
+  label: "systemd --user service",
   systemctlAvailable,
   unitIsOurs,
   unitIsStale,