feat: AI Router per session; Settings at the sidebar's foot; shipped tool icons

AI Router is a session's choice, not a workspace's:
- an AI Router select beside the model picker in the workspace home and a
  pane's run form (RouterPicker.tsx; hidden off Claude/Codex or with only
  Native; last pick remembered in agenthub.session.router)
- `router` on POST /api/lanes/:id/start and POST /api/run; Claude gets
  --settings=<data dir>/router-settings/<name>.json (0600, outranks project
  and user settings, key never in argv), Codex -p <name> + key via tmux -e
- dashboard_runs.router; a resume naming none goes back to it
- profile PATCH rewrites the session files, DELETE removes them
- gone: POST /api/lanes/:id/router/apply, LaneRouterRow, the Add-workspace
  router radio, the claude-/codex-home `routers` answers; clearLaneRouters
  takes the old keys out of each workspace's settings.local.json at start

Sidebar: Settings pinned to the foot, the collapse toggle beside it (stacked
on the rail) instead of in the brand's corner.

Icons: shipped SVG marks for claude, codex, openclaw and hermes (a
black/white pair swapped by theme) in client/public/ai-tools/, used by
AiToolIcon before the server's favicon.

client/src/pages/__tests__/AiRouterConfig.test.tsx

@@ -69,12 +69,8 @@ beforeEach(() => {
     .mockReset()
     .mockResolvedValue({ items: [native] });
   vi.mocked(api.aiRouters.create).mockReset().mockResolvedValue(nineRouter);
-  vi.mocked(api.aiRouters.update)
-    .mockReset()
-    .mockResolvedValue({ ...nineRouter, lanes: { updated: 0, failed: [] } });
-  vi.mocked(api.aiRouters.remove)
-    .mockReset()
-    .mockResolvedValue({ removed: "9router", lanes: { updated: 0, failed: [] } });
+  vi.mocked(api.aiRouters.update).mockReset().mockResolvedValue(nineRouter);
+  vi.mocked(api.aiRouters.remove).mockReset().mockResolvedValue({ removed: "9router" });
   vi.mocked(api.aiRouters.test)
     .mockReset()
     .mockResolvedValue({ ok: true, status: 200, message: "Highest" });
@@ -149,25 +145,6 @@ describe("AiRouterConfig", () => {
     expect(call?.[1]).not.toHaveProperty("apiKey");
   });
 
-  it("warns when a rotated key did not reach every lane using the profile", async () => {
-    // The whole point of pushing an edit out to the lanes is that a revoked key
-    // stops being used. A lane that silently kept the old one must be named,
-    // or the user believes a rotation is complete when it is not.
-    vi.mocked(api.aiRouters.list).mockResolvedValue({ items: [native, nineRouter] });
-    vi.mocked(api.aiRouters.update).mockResolvedValue({
-      ...nineRouter,
-      lanes: { updated: 1, failed: ["7 (checkout): EBADJSON"] },
-    });
-    render(<AiRouterConfig />);
-    const user = userEvent.setup();
-
-    await user.click(await screen.findByLabelText("aiRouter.edit 9Router"));
-    await user.type(screen.getByLabelText("aiRouter.fieldApiKey"), "sk-rotated");
-    await user.click(screen.getByRole("button", { name: "aiRouter.save" }));
-
-    expect(await screen.findByText("aiRouter.lanesFailed")).toBeInTheDocument();
-  });
-
   it("surfaces a server error instead of closing the form", async () => {
     vi.mocked(api.aiRouters.create).mockRejectedValue(
       new Error("baseUrl must be http:// or https://")

client/src/pages/__tests__/CodexConfig.test.tsx

@@ -123,14 +123,13 @@ afterEach(() => {
 });
 
 describe("CodexConfig", () => {
-  it("edits CODEX_HOME on the Overview and reports lanes whose router layer failed", async () => {
+  it("edits CODEX_HOME on the Overview", async () => {
     stubCodexApi({});
     codexHomeMock.get.mockResolvedValue({ codex_home: "/home/.codex", env_owned: false });
     codexHomeMock.set.mockResolvedValue({
       ok: true,
       codex_home: "/work/.codex",
       env_owned: false,
-      routers: { updated: 1, failed: ["4 (api): EDIR"] },
     });
     render(<CodexConfig />);
     await settle();
@@ -146,7 +145,6 @@ describe("CodexConfig", () => {
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
 
     expect(codexHomeMock.set).toHaveBeenCalledWith("/work/.codex");
-    expect(await screen.findByText(/4 \(api\): EDIR/)).toBeInTheDocument();
     // Every list lives under CODEX_HOME, so a new one re-reads them.
     expect(codexConfigMock.overview.mock.calls.length).toBeGreaterThan(overviewCalls);
   });

client/src/pages/__tests__/Run.defaultCwd.test.tsx

@@ -30,6 +30,7 @@ vi.mock("../../lib/api", async (importOriginal) => {
   return {
     ...actual,
     api: {
+      aiRouters: { list: r({ items: [] }) },
       run: {
         list: r({ runs: [], items: [] }),
         history: r({ items: [] }),

client/src/pages/__tests__/Workspace.laneRouter.test.tsx

@@ -1,243 +0,0 @@
-/**
- * @file Workspace.laneRouter.test.tsx
- * @description The Model (AI Router) picker in the Workspace lane-detail
- * header, exercised through the page rather than through `LaneRouterRow` on its
- * own — one row instance serves every lane, so the bug this pins is a lane
- * switch carrying the previous lane's selection with it: pick a router on one
- * lane, come back to a lane that is on native, and see the router still
- * selected there.
- * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
- */
-
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, act, screen, waitFor } from "@testing-library/react";
-import { MemoryRouter, useSearchParams } from "react-router-dom";
-import userEvent from "@testing-library/user-event";
-
-type LaneFixture = {
-  id: number;
-  cwd: string;
-  title: string;
-  pipeline: string;
-  pipeline_name: string;
-  pipeline_nodes: never[];
-  detected_signal: string | null;
-  run_id: string | null;
-  router_profile: string | null;
-};
-
-const lane = (id: number, title: string): LaneFixture => ({
-  id,
-  cwd: `/workspace/${id}`,
-  title,
-  pipeline: "default",
-  pipeline_name: "default",
-  pipeline_nodes: [],
-  detected_signal: null,
-  run_id: null,
-  router_profile: null,
-});
-
-const h = vi.hoisted(() => {
-  const nativeProfile = {
-    name: "native",
-    label: "Native",
-    builtin: true,
-    baseUrl: "",
-    hasKey: false,
-    model: "claude-sonnet-5",
-    models: {
-      opus: "claude-opus-5",
-      sonnet: "claude-sonnet-5",
-      haiku: "claude-haiku-4-5-20251001",
-      smallFast: "claude-haiku-4-5-20251001",
-      subagent: "claude-haiku-4-5-20251001",
-    },
-  };
-  return {
-    lanes: [] as { id: number; router_profile: string | null }[],
-    routerApply: vi.fn(),
-    profiles: [
-      nativeProfile,
-      { ...nativeProfile, name: "9router", label: "9Router", builtin: false },
-    ],
-  };
-});
-
-const routerApply = h.routerApply;
-let lanesToReturn: LaneFixture[] = [];
-
-// The workspace's home (its own suite) fetches sources and memory; these
-// tests are about the session view it hides, so it is a stub here.
-vi.mock("../../components/lanes/WorkspaceHome", () => ({
-  WorkspaceHome: () => <div data-testid="workspace-home" />,
-  paneRunId: (id: number, slot: number) =>
-    slot ? `agenthub-lane-${id}-${slot}` : `agenthub-lane-${id}`,
-}));
-vi.mock("../../lib/api", async (importOriginal) => {
-  const actual = await importOriginal<Record<string, unknown>>();
-  return {
-    ...actual,
-    api: {
-      lanes: {
-        list: vi.fn().mockImplementation(async () => ({
-          lanes: h.lanes,
-          counts: { total: h.lanes.length, running: 0, needs_you: 0, dead: 0 },
-        })),
-        ensure: vi.fn(),
-        action: vi.fn(),
-        git: vi.fn().mockResolvedValue({ available: false }),
-        runtime: vi.fn().mockResolvedValue({ available: false }),
-        stage: vi.fn(),
-        update: vi.fn(),
-        pipelines: vi
-          .fn()
-          .mockResolvedValue({ pipelines: [{ id: "default", name: "default", nodes: [] }] }),
-        // The route the picker must use — never a lane PATCH.
-        routerApply: vi.fn().mockImplementation(async (id: number, profile: string) => {
-          h.routerApply(id, profile);
-          // The row moving with the call is the server's broadcast, not a test
-          // convenience: the apply route broadcasts the lane so the cached row
-          // stops disagreeing with what was just written. Drop the broadcast
-          // server-side and the next lane switch re-reads a stale profile.
-          const row = h.lanes.find((l) => l.id === id);
-          if (row) row.router_profile = profile === "native" ? null : profile;
-          return { tool: "claude", file: `/workspace/${id}/.claude/settings.local.json`, profile };
-        }),
-        features: { list: vi.fn().mockResolvedValue({ features: [] }), show: vi.fn() },
-        proof: {
-          list: vi.fn().mockResolvedValue({ features: [] }),
-          imageUrl: vi.fn(),
-          delete: vi.fn(),
-        },
-      },
-      aiRouters: {
-        list: vi.fn().mockImplementation(async () => ({ items: h.profiles })),
-      },
-      run: {
-        list: vi.fn().mockResolvedValue({ runs: [], items: [] }),
-        history: vi.fn().mockResolvedValue({ items: [] }),
-        binary: vi.fn().mockResolvedValue({ found: true, path: "/usr/bin/claude" }),
-        cwds: vi.fn().mockResolvedValue({ items: [] }),
-        files: vi.fn().mockResolvedValue({ items: [] }),
-        start: vi.fn(),
-        get: vi.fn(),
-        send: vi.fn(),
-        kill: vi.fn(),
-      },
-      ccConfig: {
-        commands: vi.fn().mockResolvedValue({ items: [] }),
-        plugins: vi.fn().mockResolvedValue({ plugins: [] }),
-        file: vi.fn().mockResolvedValue({ text: "", content: "" }),
-      },
-      sessions: {
-        list: vi.fn().mockResolvedValue({ sessions: [], total: 0, limit: 50, offset: 0 }),
-        transcript: vi.fn().mockResolvedValue({ messages: [] }),
-      },
-    },
-  };
-});
-
-vi.mock("../../lib/eventBus", () => ({
-  eventBus: {
-    subscribe: () => () => {},
-    publish: () => {},
-    onConnection: () => () => {},
-    connected: true,
-    setConnected: () => {},
-  },
-}));
-
-vi.mock("../../components/run/TerminalView", () => ({
-  TerminalView: ({ runId }: { runId: string }) => (
-    <div data-testid="terminal-view" data-run-id={runId} />
-  ),
-}));
-
-import { Workspace } from "../Workspace";
-
-class ObserverStub {
-  observe() {}
-  unobserve() {}
-  disconnect() {}
-  takeRecords() {
-    return [];
-  }
-}
-
-globalThis.ResizeObserver =
-  globalThis.ResizeObserver || (ObserverStub as unknown as typeof ResizeObserver);
-for (const fn of ["scrollIntoView", "scrollBy", "scrollTo"] as const) {
-  if (!(Element.prototype as unknown as Record<string, unknown>)[fn]) {
-    (Element.prototype as unknown as Record<string, unknown>)[fn] = function () {};
-  }
-}
-
-async function settle() {
-  await act(async () => {
-    await new Promise((r) => setTimeout(r, 0));
-    await new Promise((r) => setTimeout(r, 0));
-  });
-}
-
-beforeEach(() => {
-  routerApply.mockClear();
-  lanesToReturn = [lane(1, "Lane A"), lane(2, "Lane B")];
-  h.lanes = lanesToReturn as unknown as typeof h.lanes;
-});
-
-/** Stands in for the sidebar's project tree: picking a workspace sets `?lane=`. */
-function Picker() {
-  const [, setParams] = useSearchParams();
-  return (
-    <>
-      {lanesToReturn.map((l) => (
-        <button key={l.id} onClick={() => setParams({ lane: String(l.id) })}>
-          {`pick ${l.title}`}
-        </button>
-      ))}
-    </>
-  );
-}
-
-async function renderWorkspace() {
-  const utils = render(
-    <MemoryRouter initialEntries={["/run"]}>
-      <Picker />
-      <Workspace />
-    </MemoryRouter>
-  );
-  await settle();
-  await settle();
-  await settle();
-  return utils;
-}
-
-/** Pick a lane the way the sidebar does: by naming it in the URL. */
-async function selectLane(user: ReturnType<typeof userEvent.setup>, title: string) {
-  await user.click(screen.getByRole("button", { name: `pick ${title}` }));
-  await settle();
-}
-
-describe("Workspace — the lane Model picker across a lane switch", () => {
-  it("leaves a lane on native after another lane was pointed at a router", async () => {
-    await renderWorkspace();
-    const user = userEvent.setup();
-
-    await selectLane(user, "Lane A");
-    expect(await screen.findByDisplayValue("Native (Claude)")).toBeInTheDocument();
-
-    await selectLane(user, "Lane B");
-    await user.selectOptions(screen.getByDisplayValue("Native (Claude)"), ["9router"]);
-    await waitFor(() => expect(routerApply).toHaveBeenCalledWith(2, "9router"));
-    await settle();
-    expect(screen.getByDisplayValue("9Router")).toBeInTheDocument();
-
-    // Back to the lane that was never switched. It is still native server-side,
-    // so the picker must say so — the row is one instance shared by every lane.
-    await selectLane(user, "Lane A");
-    expect(screen.getByDisplayValue("Native (Claude)")).toBeInTheDocument();
-    // And nothing may have been written to lane A on the way.
-    expect(routerApply).not.toHaveBeenCalledWith(1, expect.anything());
-  });
-});

client/src/pages/__tests__/screens.snapshot.test.tsx

@@ -258,6 +258,7 @@ vi.mock("../../lib/api", async (importOriginal) => {
   return {
     ...actual,
     api: {
+      aiRouters: { list: r({ items: [] }) },
       stats: { get: r(stats), facets: r({ cwds: [] }) },
       sessions: {
         list: r({ sessions: [], total: 0, limit: 50, offset: 0 }),