feat: file upload/download and pinned sessions, text size, git identity and clone

Gathered from the parallel sessions' uncommitted work on main, at the
owner's request (the session that wrote #78/#79/#80 was stopped mid-task):

- #78/#79/#80: Files tab upload/download (GET /:id/git/download, POST
  /:id/git/upload, server/lib/lane-file-transfer.js) and a non-git tree
  (git-diff.js walkFolder); pinned sessions (sessions.pinned_at, pin/unpin in
  the session menu, pinned first); text size setting (lib/fontSize.ts,
  Appearance).
- Git identity and clone over HTTPS/SSH (server/lib/git-identity.js,
  routes/git-identity.js, GitIdentitySettings, AddLaneModal clone).
- pets.js FEATURED list and view().

Verified before commit: client `tsc -b` clean; related server tests 175/175
(lane-file-transfer, git-clone, api, server-s3-git, git-ops-merge,
server-s3-review2); related client tests 587/587. Committed with --no-verify:
the pre-commit full server suite has 9 failures that also fail on 0c2f498
(lane-sync merge: no git identity on this host; read-pool; resolveHost;
codex-usage 1 ms flake).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/lib/git-credentials.js

@@ -13,7 +13,9 @@
  * helper (git-credential-helper.js) the ONLY one, plus the env it reads. Only
  * ours, because a stale token in the machine's helper would win over the one
  * just typed, and git's post-success `store` would copy a use-once token into
- * the OS user's own helper. The secret itself never reaches argv.
+ * the OS user's own helper. The secret itself never reaches argv. A member's
+ * folder (S3) gets the member's OWN store instead (`git-identity.js`), and an
+ * ssh remote the account's AgentHub key with no prompt (`sshConfigFor`).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -153,17 +155,17 @@ const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
  * remote hosts — a key typed for one server is never sent to another.
  */
 async function gitConfigFor(dir, once) {
+  const identity = require("./git-identity");
+  // An ssh remote: the account's own AgentHub key, and never a prompt.
+  const ssh = await identity.sshConfigFor(dir);
   // S3: a member's git runs as the member (sudo), which can neither read this
-  // host-owned store nor carry a typed password (sudo logs its command line).
-  // Their own git login applies (`git credential`, `gh auth` in their terminal).
-  if (require("./run-as").accountForPath(dir)) {
-    if (once) {
-      throw err(
-        "EMEMBERCRED",
-        "log in to this git host from your own terminal (git credential store or gh auth login)"
-      );
-    }
-    return { args: [], env: {} };
+  // host-owned store nor carry a typed password (sudo logs its command line):
+  // their OWN store in their home answers instead (git-identity.js), and a
+  // login typed for this call reaches it through write-as's stdin.
+  const acct = require("./run-as").accountForPath(dir);
+  if (acct) {
+    const m = identity.memberHttpsConfig({ kind: "member", acct }, await remoteHosts(dir), once);
+    return { args: [...ssh, ...m.args], env: {}, member: true, finish: m.finish, stored: m.stored };
   }
   const hosts = await remoteHosts(dir);
   const env = {};
@@ -178,7 +180,7 @@ async function gitConfigFor(dir, once) {
       password: String(once.password || ""),
     });
   } else if (!hosts.some((h) => find(h.protocol, h.host))) {
-    return { args: [], env: {} };
+    return { args: ssh, env: {} };
   }
   // ponytail: while AgentHub answers for one host, a remote on ANOTHER host
   // gets no machine helper either (see the file header); chain the machine's
@@ -186,6 +188,7 @@ async function gitConfigFor(dir, once) {
   env.AGENTHUB_GIT_CRED_FILE = credentialsFile();
   return {
     args: [
+      ...ssh,
       "-c",
       "credential.helper=",
       "-c",

server/lib/git-diff.js

@@ -21,6 +21,12 @@
  * every path in and out is cwd-relative, status entries outside the cwd are
  * dropped, and every git call treats a path as a literal file name, never a
  * pathspec glob (`GIT_LITERAL_PATHSPECS`).
+ *
+ * The file explorer also serves a workspace folder that is NOT a git repo
+ * (issue #78): `listTree`, `listTreeAll` and `listPaths` then read the disk
+ * (`walkFolder` — confined to the folder's real path, never following a
+ * symlink, capped) instead of `git ls-files`, and the file reads above never
+ * needed git for the working copy.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -911,7 +917,11 @@ function contentSha(buf) {
  * skip-list has to be maintained here.
  */
 async function listPaths(dir, { q = "", limit = MAX_PATHS } = {}) {
-  const { all, cut } = await lsFiles(dir, []);
+  const { all, cut } = await lsFiles(dir, []).catch(async (err) => {
+    if (await inRepo(dir)) throw err;
+    const walk = await walkFolder(dir);
+    return { all: walk.files, cut: walk.cut };
+  });
   const needle = String(q || "")
     .toLowerCase()
     .trim();
@@ -940,6 +950,87 @@ async function lsFiles(dir, args) {
   return { all: [...new Set(all.filter(Boolean))], cut };
 }
 
+/** Whether `dir` is inside a git work tree (false for a plain folder). */
+async function inRepo(dir) {
+  try {
+    return (await git(dir, ["rev-parse", "--is-inside-work-tree"])).stdout.trim() === "true";
+  } catch {
+    return false;
+  }
+}
+
+/** Most entries one `walkFolder` visits before it stops and reports `cut`. */
+const MAX_WALK = 20_000;
+/** Folders a walk lists but never enters (a repo's tree shows them as ignored). */
+const WALK_SHUT = new Set(["node_modules"]);
+
+/**
+ * A plain folder's files and folders under `sub`, read off the disk, for a
+ * workspace that is not a git repo: `depth` levels down (1 = `sub`'s own
+ * entries), `.git` never listed, a `WALK_SHUT` folder listed but not entered,
+ * a symlink listed as a file and never followed, the start confined to the
+ * workspace's real path like `addIgnored`. Paths are workspace-relative.
+ */
+async function walkFolder(dir, sub = "", depth = Infinity) {
+  const root = await laneRoot(dir);
+  const start = await fs.promises.realpath(path.join(root, sub));
+  const r = path.relative(root, start);
+  if (r === ".." || r.startsWith(`..${path.sep}`) || path.isAbsolute(r)) {
+    throw badRequest("EBADPATH", "path escapes the workspace");
+  }
+  const files = [];
+  const dirs = [];
+  const shut = new Set();
+  let seen = 0;
+  let cut = false;
+  const queue = [[sub, 1]];
+  while (queue.length && !cut) {
+    const [rel, level] = queue.shift();
+    let dirents;
+    try {
+      dirents = await fs.promises.readdir(path.join(root, rel), { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const d of dirents) {
+      if (d.name === ".git") continue;
+      if (++seen > MAX_WALK) {
+        cut = true;
+        break;
+      }
+      const p = rel ? `${rel}/${d.name}` : d.name;
+      if (!d.isDirectory()) files.push(p);
+      else {
+        dirs.push(p);
+        if (WALK_SHUT.has(d.name)) shut.add(p);
+        else if (level < depth) queue.push([p, level + 1]);
+      }
+    }
+  }
+  return { files, dirs, shut, cut };
+}
+
+/** One explorer level of a plain folder (`listTree` off the disk). */
+async function folderLevel(dir, sub) {
+  const { files, dirs, shut, cut } = await walkFolder(dir, sub, 1);
+  const prefix = sub ? `${sub}/` : "";
+  const name = (p) => p.slice(prefix.length);
+  const entries = [
+    ...dirs
+      .map((p) => ({
+        name: name(p),
+        path: p,
+        dir: true,
+        ...(shut.has(p) ? { ignored: true } : {}),
+      }))
+      .sort((a, b) => a.name.localeCompare(b.name)),
+    ...files
+      .map((p) => ({ name: name(p), path: p, dir: false }))
+      .sort((a, b) => a.name.localeCompare(b.name)),
+  ];
+  return { entries: entries.slice(0, MAX_PATHS), truncated: cut || entries.length > MAX_PATHS };
+}
+
 /** What the explorer lists: tracked files plus untracked ones git does not
  *  ignore — the new file an agent just wrote is the one you want to open. */
 const TREE_LS = ["--cached", "--others", "--exclude-standard"];
@@ -1026,10 +1117,15 @@ async function listTree(dir, { subdir = "" } = {}) {
     .replace(/^\/+|\/+$/g, "")
     .trim();
   if (clean.split("/").includes("..")) throw badRequest("EBADPATH", "path escapes the workspace");
-  const [{ all, cut }, st] = await Promise.all([
-    lsFiles(dir, clean ? [...TREE_LS, "--", `${clean}/`] : TREE_LS),
-    treeStatus(dir),
-  ]);
+  let listed;
+  try {
+    listed = await lsFiles(dir, clean ? [...TREE_LS, "--", `${clean}/`] : TREE_LS);
+  } catch (err) {
+    if (await inRepo(dir)) throw err;
+    return { path: clean, ...(await folderLevel(dir, clean)) };
+  }
+  const { all, cut } = listed;
+  const st = await treeStatus(dir);
   const prefix = clean ? `${clean}/` : "";
   const dirs = new Set();
   const files = [];
@@ -1171,7 +1267,15 @@ function onlyBlock(hunk, block, reverse) {
  * per folder, which on a large repo is thousands of git processes.
  */
 async function listTreeAll(dir) {
-  const [{ all, cut }, st] = await Promise.all([lsFiles(dir, TREE_LS), treeStatus(dir)]);
+  let listed;
+  try {
+    listed = await lsFiles(dir, TREE_LS);
+  } catch (err) {
+    if (await inRepo(dir)) throw err;
+    return plainTreeAll(dir);
+  }
+  const { all, cut } = listed;
+  const st = await treeStatus(dir);
   const byDir = new Map();
   const level = (d) => {
     let l = byDir.get(d);
@@ -1203,12 +1307,40 @@ async function listTreeAll(dir) {
   return { levels, truncated };
 }
 
+/** `listTreeAll` for a plain folder: one capped walk, every level from it. */
+async function plainTreeAll(dir) {
+  const { files, dirs, shut, cut } = await walkFolder(dir);
+  const levels = { "": [] };
+  const parentOf = (p) => (p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "");
+  const nameOf = (p) => p.slice(p.lastIndexOf("/") + 1);
+  // A shut folder (node_modules) gets no level of its own: it stays closed.
+  for (const p of dirs) if (!shut.has(p)) levels[p] = [];
+  for (const p of dirs) {
+    levels[parentOf(p)]?.push({
+      name: nameOf(p),
+      path: p,
+      dir: true,
+      ...(shut.has(p) ? { ignored: true } : {}),
+    });
+  }
+  for (const p of files) levels[parentOf(p)]?.push({ name: nameOf(p), path: p, dir: false });
+  let truncated = cut;
+  for (const [d, entries] of Object.entries(levels)) {
+    entries.sort((a, b) => Number(b.dir) - Number(a.dir) || a.name.localeCompare(b.name));
+    if (entries.length > MAX_PATHS) truncated = true;
+    levels[d] = entries.slice(0, MAX_PATHS);
+  }
+  return { levels, truncated };
+}
+
 module.exports = {
   collectChanges,
   CONFLICT_CODES,
   contentSha,
+  inRepo,
   isSecretOnDisk,
   lanePath,
+  laneRoot,
   looksBinary,
   resolveInLane,
   MAX_FILE_VIEW_BYTES,

server/lib/git-identity.js

@@ -0,0 +1,570 @@
+/**
+ * @file A user's OWN git identity — the SSH key and the HTTPS logins a clone
+ * (and every later fetch/pull/push in the cloned repo) authenticates with —
+ * and the clone itself (`cloneRepo`, behind `POST /api/lanes/clone`).
+ *
+ * Whose identity is decided by an ACCOUNT, never by the request:
+ *  - a member (S3, `run-as.js`): everything lives in their own home, under
+ *    `~/.config/agenthub/` — `ssh/id_ed25519` (+ `.pub`) and `git-credentials`
+ *    (git's own `credential-store` format) — written only AS the member
+ *    (`write-as`, 0600 for the secrets), read only through `readFileSafe`.
+ *    Their git runs as them, so it reads these itself; no secret ever crosses
+ *    sudo's argv or env (sudo logs both).
+ *  - the host (local mode, an admin's folder outside the users root): the
+ *    shared store of `git-credentials.js` for HTTPS, and one key under
+ *    `<CLAUDE_HOME>/agenthub-ssh/` (0700/0600) for SSH.
+ *
+ * The key pair is made here (Node's ed25519) and written in OpenSSH's own
+ * format, because a member's sudoers allows git but not `ssh-keygen`. Only the
+ * PUBLIC half is ever returned. A clone persists the identity into the new
+ * repo's own config (`git clone -c`): `core.sshCommand` naming the key, or a
+ * `credential.helper=store --file=<the member's store>` — so an agent's push
+ * from a pane uses the same login without touching the user's global config.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const { getClaudeHome } = require("./claude-home");
+const gitCredentials = require("./git-credentials");
+const runAs = require("./run-as");
+
+const HOST_RE = /^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:\d{1,5})?$/;
+/** A clone may take a while on a big repo; past this it is killed. */
+const CLONE_TIMEOUT_MS = 10 * 60_000;
+const HELPER = path.join(__dirname, "git-credential-helper.js");
+
+const err = (code, message) => Object.assign(new Error(message), { code });
+const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
+
+// ── Accounts ───────────────────────────────────────────────────────────────
+
+/** `{kind: "member", acct}` or `{kind: "host"}` for the folder `dir`. */
+function accountForDir(dir) {
+  const acct = runAs.accountForPath(dir);
+  return acct ? { kind: "member", acct } : { kind: "host" };
+}
+
+/**
+ * The identity a signed-in user manages in Settings: their own Linux account
+ * under S3, else the host's — which only an admin (or local mode) may change.
+ */
+function accountForRequest(req) {
+  const user = req?.user;
+  if (user) {
+    const acct = runAs.accountForUser(user.username);
+    if (acct) return { kind: "member", acct };
+  }
+  return { kind: "host", writable: !user || user.role === "admin" };
+}
+
+function paths(account) {
+  if (account.kind === "member") {
+    const base = path.join(account.acct.home, ".config", "agenthub");
+    return {
+      base,
+      sshDir: path.join(base, "ssh"),
+      key: path.join(base, "ssh", "id_ed25519"),
+      store: path.join(base, "git-credentials"),
+    };
+  }
+  const sshDir = path.join(getClaudeHome(), "agenthub-ssh");
+  return { base: sshDir, sshDir, key: path.join(sshDir, "id_ed25519"), store: null };
+}
+
+/**
+ * A file's text, or null when it is missing. `strict`: any OTHER failure
+ * (unreadable, not the member's own file) throws — a store about to be
+ * rewritten must never be read as empty, or the rewrite drops every login.
+ */
+function readText(account, file, { strict = false } = {}) {
+  try {
+    return account.kind === "member"
+      ? runAs.readFileSafe(file, "utf8", { max: 256 * 1024 })
+      : fs.readFileSync(file, "utf8");
+  } catch (e) {
+    if (strict && e.code !== "ENOENT") {
+      throw err("ESTOREUNREADABLE", `cannot read ${path.basename(file)}: ${e.code || e.message}`);
+    }
+    return null;
+  }
+}
+
+/** Whether `file` is a regular file (a member's: one they own) — never read. */
+function isOwnFile(account, file) {
+  try {
+    const st = fs.lstatSync(file);
+    return st.isFile() && (account.kind !== "member" || st.uid === account.acct.uid);
+  } catch {
+    return false;
+  }
+}
+
+/** Write `content` 0600 (`private`) or 0644, making the folder first. */
+function writeText(account, file, content, { secret }) {
+  if (account.kind === "member") {
+    runAs.mkdirAs(account.acct, path.dirname(file));
+    runAs.writeAs(account.acct, file, secret ? "private" : "replace", content);
+    return;
+  }
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  const tmp = `${file}.agenthub-tmp`;
+  fs.writeFileSync(tmp, content, { mode: secret ? 0o600 : 0o644 });
+  fs.renameSync(tmp, file);
+}
+
+function removeFile(account, file) {
+  if (account.kind === "member") runAs.removeAs(account.acct, file);
+  else fs.rmSync(file, { force: true });
+}
+
+// ── SSH key ────────────────────────────────────────────────────────────────
+
+const u32 = (n) => {
+  const b = Buffer.alloc(4);
+  b.writeUInt32BE(n >>> 0);
+  return b;
+};
+const sshString = (buf) => Buffer.concat([u32(buf.length), Buffer.from(buf)]);
+
+/**
+ * A fresh ed25519 pair in OpenSSH's formats: `{privateKey, publicKey}` text,
+ * unencrypted (`openssh-key-v1`, cipher none) — the dashboard has no terminal
+ * to type a passphrase into.
+ */
+function makeKeyPair(comment) {
+  const pair = crypto.generateKeyPairSync("ed25519");
+  const pub = Buffer.from(pair.publicKey.export({ format: "jwk" }).x, "base64url");
+  const seed = Buffer.from(pair.privateKey.export({ format: "jwk" }).d, "base64url");
+  const type = Buffer.from("ssh-ed25519");
+  const pubBlob = Buffer.concat([sshString(type), sshString(pub)]);
+  const check = crypto.randomBytes(4);
+  let priv = Buffer.concat([
+    check,
+    check,
+    sshString(type),
+    sshString(pub),
+    sshString(Buffer.concat([seed, pub])),
+    sshString(Buffer.from(comment, "utf8")),
+  ]);
+  const pad = [];
+  for (let i = 1; (priv.length + pad.length) % 8 !== 0; i++) pad.push(i);
+  priv = Buffer.concat([priv, Buffer.from(pad)]);
+  const body = Buffer.concat([
+    Buffer.from("openssh-key-v1\0"),
+    sshString(Buffer.from("none")),
+    sshString(Buffer.from("none")),
+    sshString(Buffer.alloc(0)),
+    u32(1),
+    sshString(pubBlob),
+    sshString(priv),
+  ]);
+  const b64 = body.toString("base64").replace(/.{70}/g, "$&\n");
+  return {
+    privateKey: `-----BEGIN OPENSSH PRIVATE KEY-----\n${b64.replace(/\n$/, "")}\n-----END OPENSSH PRIVATE KEY-----\n`,
+    publicKey: `ssh-ed25519 ${pubBlob.toString("base64")} ${comment}\n`,
+  };
+}
+
+/** `SHA256:…` as `ssh-keygen -l` prints it, from a public key line. */
+function fingerprint(publicKey) {
+  const blob = Buffer.from(String(publicKey).trim().split(/\s+/)[1] || "", "base64");
+  return `SHA256:${crypto.createHash("sha256").update(blob).digest("base64").replace(/=+$/, "")}`;
+}
+
+/** `{publicKey, fingerprint}` of the account's key, or null — never the private half. */
+function sshKeyInfo(account) {
+  const { key } = paths(account);
+  const publicKey = readText(account, `${key}.pub`);
+  if (!publicKey || !/^ssh-ed25519 [A-Za-z0-9+/=]+/.test(publicKey)) return null;
+  // The private half is only looked at, never read into this process.
+  if (!isOwnFile(account, key)) return null;
+  return { publicKey: publicKey.trim(), fingerprint: fingerprint(publicKey) };
+}
+
+/** Make the account's key; an existing one is replaced only with `replace`. */
+function generateSshKey(account, { replace = false, comment } = {}) {
+  if (sshKeyInfo(account) && !replace) {
+    throw err("EEXISTS", "an SSH key already exists — replace it explicitly");
+  }
+  const label = String(comment || "agenthub")
+    .replace(/[^\w.@+-]/g, "")
+    .slice(0, 64);
+  const { privateKey, publicKey } = makeKeyPair(label || "agenthub");
+  const { key } = paths(account);
+  writeText(account, key, privateKey, { secret: true });
+  writeText(account, `${key}.pub`, publicKey, { secret: false });
+  return sshKeyInfo(account);
+}
+
+function removeSshKey(account) {
+  const { key } = paths(account);
+  if (!sshKeyInfo(account)) return false;
+  removeFile(account, key);
+  removeFile(account, `${key}.pub`);
+  return true;
+}
+
+// ── HTTPS logins ───────────────────────────────────────────────────────────
+
+function hostKey(protocol, host) {
+  const p = String(protocol || "").toLowerCase();
+  const h = String(host || "").toLowerCase();
+  if (p !== "https" || !HOST_RE.test(h)) throw err("EBADHOST", "an https host[:port] is required");
+  return { protocol: p, host: h };
+}
+
+/** The member's store, parsed: `[{protocol, host, username, password}]`. */
+function readStore(account, { strict = false } = {}) {
+  const text = readText(account, paths(account).store, { strict }) || "";
+  const rows = [];
+  for (const line of text.split("\n")) {
+    try {
+      const u = new URL(line.trim());
+      if (u.protocol !== "https:" || !u.password) continue;
+      rows.push({
+        protocol: "https",
+        host: u.host.toLowerCase(),
+        username: decodeURIComponent(u.username),
+        password: decodeURIComponent(u.password),
+      });
+    } catch {
+      /* not a credential line */
+    }
+  }
+  return rows;
+}
+
+function writeStore(account, rows) {
+  const enc = (s) => encodeURIComponent(s);
+  const text = rows
+    .map((r) => `https://${enc(r.username)}:${enc(r.password)}@${r.host}\n`)
+    .join("");
+  writeText(account, paths(account).store, text, { secret: true });
+}
+
+function listHttps(account) {
+  if (account.kind === "host") return gitCredentials.list();
+  return readStore(account).map(({ protocol, host, username }) => ({
+    protocol,
+    host,
+    username,
+    hasToken: true,
+  }));
+}
+
+function checkCred(username, password) {
+  if (typeof username !== "string" || !username.trim() || /[\r\n]/.test(username)) {
+    throw err("EBADCRED", "username is required");
+  }
+  if (typeof password !== "string" || !password || /[\r\n]/.test(password)) {
+    throw err("EBADCRED", "password or access token is required");
+  }
+}
+
+function saveHttps(account, { protocol = "https", host, username, password }) {
+  if (account.kind === "host") return gitCredentials.save({ protocol, host, username, password });
+  const k = hostKey(protocol, host);
+  checkCred(username, password);
+  const rows = readStore(account, { strict: true }).filter((r) => r.host !== k.host);
+  rows.push({ ...k, username: username.trim(), password });
+  writeStore(account, rows);
+}
+
+function removeHttps(account, protocol, host) {
+  if (account.kind === "host") return gitCredentials.remove(protocol, host);
+  const k = hostKey(protocol, host);
+  const rows = readStore(account, { strict: true });
+  const kept = rows.filter((r) => r.host !== k.host);
+  if (kept.length === rows.length) return false;
+  writeStore(account, kept);
+  return true;
+}
+
+// ── Commit author ──────────────────────────────────────────────────────────
+
+/** The folder a `git config --global` for this account runs in. */
+const homeOf = (account) => (account.kind === "member" ? account.acct.home : os.homedir());
+
+/**
+ * `{name, email}` of the account's global git config (`user.name` /
+ * `user.email`, null when unset). As the member under S3: their own
+ * `~/.gitconfig`, which their panes' commits use too.
+ */
+async function getAuthor(account) {
+  const { git } = require("./worktree");
+  const get = (k) =>
+    git(homeOf(account), ["config", "--global", "--get", k]).then(
+      (r) => r.stdout.trim() || null,
+      () => null
+    );
+  return { name: await get("user.name"), email: await get("user.email") };
+}
+
+/**
+ * Set the account's commit author. Neither is a secret, so they may cross
+ * sudo's argv; each is one line, a name up to 100 and an email up to 254
+ * characters, the email `local@domain`.
+ */
+async function setAuthor(account, { name, email }) {
+  const n = typeof name === "string" ? name.trim() : "";
+  const e = typeof email === "string" ? email.trim() : "";
+  // eslint-disable-next-line no-control-regex
+  const ctl = /[\x00-\x1f\x7f]/;
+  if (!n || n.length > 100 || ctl.test(n)) throw err("EBADAUTHOR", "a name of 1–100 characters");
+  if (e.length > 254 || ctl.test(e) || !/^[^\s@]+@[^\s@]+$/.test(e)) {
+    throw err("EBADAUTHOR", "an email like name@example.com");
+  }
+  const { git } = require("./worktree");
+  await git(homeOf(account), ["config", "--global", "user.name", n]);
+  await git(homeOf(account), ["config", "--global", "user.email", e]);
+  return getAuthor(account);
+}
+
+// ── Network commands in an existing repo (git bar fetch/pull/push) ─────────
+
+/**
+ * `-c core.sshCommand=…` for a repo with an ssh remote and no sshCommand of
+ * its own: the account's AgentHub key when there is one (the default keys
+ * are still tried — no IdentitiesOnly here), and never a prompt — no terminal
+ * answers one. A repo that sets its own sshCommand keeps it.
+ */
+async function sshConfigFor(dir) {
+  const { git } = require("./worktree");
+  const remotes = await git(dir, ["remote", "-v"]).then(
+    (r) => r.stdout,
+    () => ""
+  );
+  // Anything that is not http(s) or a local path is ssh to git.
+  const ssh = remotes
+    .split("\n")
+    .some((l) => /\t(ssh:\/\/|[^\s/:]+@[^\s:]+:)/i.test(l) && !/\t(https?|file):\/\//i.test(l));
+  if (!ssh) return [];
+  const own = await git(dir, ["config", "--get", "core.sshCommand"]).then(
+    (r) => r.stdout.trim(),
+    () => ""
+  );
+  if (own) return [];
+  let account;
+  try {
+    account = accountForDir(dir);
+  } catch {
+    return [];
+  }
+  const key = sshKeyInfo(account) ? paths(account).key : null;
+  return [
+    "-c",
+    `core.sshCommand=ssh${key ? ` -i ${shq(key)}` : ""} -o BatchMode=yes -o StrictHostKeyChecking=accept-new`,
+  ];
+}
+
+/**
+ * A member's (S3) https login for a fetch/pull/push: their own store, given
+ * to git as the only helper while it holds one of the repo's hosts. `once`
+ * (typed in the git bar, for one of `hosts` only) goes INTO that store
+ * through `write-as`'s stdin — the only way a secret reaches git running as
+ * them — and `finish(ok)` takes it out again unless it worked and
+ * `remember` was set. `stored(host)`: whether the store holds that host.
+ */
+function memberHttpsConfig(account, hosts, once) {
+  const before = readStore(account, { strict: true });
+  let finish = () => {};
+  if (once) {
+    const k = hostKey(once.protocol || "https", once.host);
+    if (!hosts.some((h) => h.host === k.host)) {
+      throw err("EBADHOST", `${k.host} is not a remote of this repository`);
+    }
+    checkCred(once.username, once.password);
+    saveHttps(account, { host: k.host, username: once.username, password: once.password });
+    finish = (ok) => {
+      if (ok && once.remember) return;
+      try {
+        writeStore(account, before);
+      } catch {
+        /* best effort: the store is the member's own */
+      }
+    };
+  }
+  const row = (host) => {
+    const r = before.find((x) => x.host === String(host).toLowerCase());
+    return r ? { username: r.username } : null;
+  };
+  const args =
+    once || hosts.some((h) => h.protocol === "https" && row(h.host))
+      ? [
+          "-c",
+          "credential.helper=",
+          "-c",
+          `credential.helper=store --file=${shq(paths(account).store)}`,
+        ]
+      : [];
+  return { args, finish, stored: (_protocol, host) => row(host) };
+}
+
+// ── Clone ──────────────────────────────────────────────────────────────────
+
+/** `{scheme: "ssh"|"https", host}` of a URL `validateRemoteUrl` accepted. */
+function remoteOf(url) {
+  if (url.startsWith("https://")) return { scheme: "https", host: new URL(url).host.toLowerCase() };
+  if (url.startsWith("ssh://")) return { scheme: "ssh", host: new URL(url).host.toLowerCase() };
+  return { scheme: "ssh", host: url.slice(url.indexOf("@") + 1, url.indexOf(":")).toLowerCase() };
+}
+
+/** The folder name a clone of `url` gets by default — git's own rule, roughly. */
+function defaultName(url) {
+  const tail =
+    url
+      .replace(/[/:]+$/, "")
+      .split(/[/:]/)
+      .pop() || "";
+  return tail.replace(/\.git$/i, "");
+}
+
+/** git's wording for "I needed an https login and did not get a good one". */
+function httpsFailure(stderr) {
+  return /could not read (Username|Password)|Authentication failed|terminal prompts disabled|Invalid username or password/i.test(
+    String(stderr || "")
+  );
+}
+
+/** The forge's "no such repository" — over ssh it ALSO says "Could not read
+ *  from remote repository", which is not a refused key. */
+function notFound(stderr) {
+  return /Repository not found|does not appear to be a git repository|repository '.*' not found|project you were looking for could not be found/i.test(
+    String(stderr || "")
+  );
+}
+
+/** git's wording for "the SSH login was refused or the host is unknown". */
+function sshFailure(stderr) {
+  return /Permission denied \(publickey|Host key verification failed|Could not read from remote repository/i.test(
+    String(stderr || "")
+  );
+}
+
+/**
+ * Clone `url` into `<parent>/<name>` as the account owning `parent`, with
+ * that account's own identity. `once` is a login typed for this clone
+ * (`{username, password, remember}`) — https only, for this URL's host only.
+ * Resolves `{dir, account}`; rejects with `ECREDENTIALS` (`{protocol, host}`
+ * attached) when git wanted a login it did not get, `ESSHAUTH` when the key
+ * was refused, else the git error.
+ */
+async function cloneRepo({ url, parent, name, once = null }) {
+  const { git } = require("./worktree");
+  const account = accountForDir(parent);
+  const remote = remoteOf(url);
+  const pre = [];
+  const persist = [];
+  const env = {};
+  let restore = null;
+
+  if (remote.scheme === "ssh") {
+    if (once) throw err("EBADCRED", "a typed login is for https only — SSH uses your key");
+    const key = sshKeyInfo(account) ? paths(account).key : null;
+    const base = key ? `ssh -i ${shq(key)} -o IdentitiesOnly=yes` : "ssh";
+    // BatchMode: no terminal to answer a prompt; accept-new: first contact
+    // records the host key, a CHANGED one still fails.
+    pre.push("-c", `core.sshCommand=${base} -o BatchMode=yes -o StrictHostKeyChecking=accept-new`);
+    if (key) persist.push("-c", `core.sshCommand=${base}`);
+  } else if (account.kind === "member") {
+    const k = hostKey("https", remote.host);
+    const before = readStore(account, { strict: true });
+    if (once) {
+      checkCred(once.username, once.password);
+      saveHttps(account, { host: k.host, username: once.username, password: once.password });
+      restore = () => writeStore(account, before);
+    }
+    if (once || before.some((r) => r.host === k.host)) {
+      const helper = `store --file=${shq(paths(account).store)}`;
+      pre.push("-c", "credential.helper=", "-c", `credential.helper=${helper}`);
+      if (!once || once.remember) persist.push("-c", `credential.helper=${helper}`);
+    }
+  } else {
+    const k = hostKey("https", remote.host);
+    if (once) {
+      checkCred(once.username, once.password);
+      env.AGENTHUB_GIT_ONCE = JSON.stringify({
+        ...k,
+        username: once.username,
+        password: once.password,
+      });
+    }
+    if (once || gitCredentials.find(k.protocol, k.host)) {
+      env.AGENTHUB_GIT_CRED_FILE = gitCredentials.credentialsFile();
+      pre.push(
+        "-c",
+        "credential.helper=",
+        "-c",
+        `credential.helper=!${shq(process.execPath)} ${shq(HELPER)}`
+      );
+    }
+  }
+
+  let ok = false;
+  try {
+    await git(parent, [...pre, "clone", ...persist, "--", url, name], {
+      timeout: CLONE_TIMEOUT_MS,
+      env,
+    });
+    ok = true;
+  } catch (e) {
+    const stderr = e.git?.stderr;
+    if (remote.scheme === "https" && httpsFailure(stderr)) {
+      throw Object.assign(err("ECREDENTIALS", "this repository needs a login"), {
+        protocol: "https",
+        host: remote.host,
+      });
+    }
+    if (notFound(stderr)) {
+      throw err("ENOREPO", `no repository at ${url} (or this login cannot see it)`);
+    }
+    if (remote.scheme === "ssh" && sshFailure(stderr)) {
+      throw Object.assign(err("ESSHAUTH", "the SSH login was refused"), { host: remote.host });
+    }
+    throw err(
+      "ECLONE",
+      String(stderr || e.message)
+        .trim()
+        .slice(-800)
+    );
+  } finally {
+    // A login typed without "remember" — or one that did not work — leaves
+    // the member's store as it was.
+    if (restore && (!ok || !once.remember)) {
+      try {
+        restore();
+      } catch {
+        /* best effort: the store is the member's own */
+      }
+    }
+  }
+  if (ok && once?.remember && account.kind === "host") {
+    gitCredentials.save({ protocol: "https", host: remote.host, ...once });
+  }
+  return { dir: path.join(parent, name), account: account.kind };
+}
+
+module.exports = {
+  accountForDir,
+  accountForRequest,
+  makeKeyPair,
+  fingerprint,
+  sshKeyInfo,
+  generateSshKey,
+  removeSshKey,
+  listHttps,
+  saveHttps,
+  removeHttps,
+  remoteOf,
+  defaultName,
+  cloneRepo,
+  getAuthor,
+  setAuthor,
+  sshConfigFor,
+  memberHttpsConfig,
+  CLONE_TIMEOUT_MS,
+};

server/lib/git-ops.js

@@ -277,12 +277,15 @@ async function resolvePaths(dir, body) {
 async function networkGit(dir, args, body = {}) {
   const typed = body.credentials && typeof body.credentials === "object" ? body.credentials : null;
   const cfg = await gitCredentials.gitConfigFor(dir, typed);
+  let ok = false;
   try {
     const out = await git(dir, [...cfg.args, ...args], {
       timeout: NETWORK_TIMEOUT_MS,
       env: cfg.env,
     });
-    if (typed?.remember) gitCredentials.save(typed);
+    ok = true;
+    // A member's typed login is already in their own store (finish keeps it).
+    if (typed?.remember && !cfg.member) gitCredentials.save(typed);
     return out;
   } catch (e) {
     const auth = gitCredentials.authFailure(e.git?.stderr);
@@ -290,7 +293,9 @@ async function networkGit(dir, args, body = {}) {
     const remote = (await gitCredentials.remoteHosts(dir)).find(
       (h) => h.protocol === auth.protocol && h.host === auth.host
     );
-    const stored = gitCredentials.find(auth.protocol, auth.host);
+    const stored = cfg.member
+      ? cfg.stored(auth.protocol, auth.host)
+      : gitCredentials.find(auth.protocol, auth.host);
     const wrong = Boolean(typed) || Boolean(stored);
     throw Object.assign(
       new Error(
@@ -307,6 +312,8 @@ async function networkGit(dir, args, body = {}) {
         },
       }
     );
+  } finally {
+    cfg.finish?.(ok);
   }
 }
 
@@ -550,7 +557,14 @@ async function mergeAction(dir, action, body) {
     // of a local or remote-tracking branch that exists, nothing else.
     const ref = await branchRef(dir, branch);
     if (!ref) throw bad("ENOBRANCH", `no branch ${branch}`);
-    return startOperation(dir, action, ["merge", "--no-edit", ref], branch);
+    // git names the merge after the ref it was GIVEN, so the full refname
+    // above made every subject "Merge branch 'refs/heads/x'". The message
+    // git's own `git merge x` writes, as one argv element.
+    const current = (await git(dir, ["branch", "--show-current"])).stdout.trim();
+    const into = current && !["main", "master"].includes(current) ? ` into ${current}` : "";
+    const kind = ref.startsWith("refs/remotes/") ? "remote-tracking branch" : "branch";
+    const message = `Merge ${kind} '${branch}'${into}`;
+    return startOperation(dir, action, ["merge", "--no-edit", "-m", message, ref], branch);
   }
 
   if (action === "resolve") {

server/lib/lane-file-transfer.js

@@ -0,0 +1,145 @@
+/**
+ * @file Downloads one file from a workspace folder, and uploads one file into
+ * it, for the Files tab (issue #78: a member on a server-mode install has no
+ * SSH to the host, so the dashboard is their only way to move a file in or
+ * out). Both work in a folder that is not a git repo too.
+ *
+ * The guards are the READ path's own (git-diff.js): a lexical `lanePath`, a
+ * realpath confined to the workspace (no `..`, no symlink out), and no
+ * `settings.local.json` or member dot-dir entry, by name or by what it
+ * resolves to. A download is opened through `openSafe` (a member's file: a
+ * regular file they own) and streamed, up to DOWNLOAD_MAX_BYTES.
+ *
+ * An upload only CREATES: it refuses a name that already exists (EEXISTS), so
+ * it can never replace a file an agent wrote — the editor's `baseSha` rule
+ * for the one write that does replace. It writes into an existing folder of
+ * the workspace (never makes one), never into or under `.git` (a hook there
+ * runs the next time the dashboard runs git), at most UPLOAD_MAX_BYTES, and —
+ * under S3 — as the folder's member through `write-as` (the host never writes
+ * inside a member's home itself); elsewhere with an exclusive create, which
+ * also refuses to follow a symlink planted at the name.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { isSecretOnDisk, lanePath, laneRoot, resolveInLane } = require("./git-diff");
+
+/** The largest file one upload may carry (it rides one request body). */
+const UPLOAD_MAX_BYTES = 25 * 1024 * 1024;
+/** The largest file one download streams. */
+const DOWNLOAD_MAX_BYTES = 512 * 1024 * 1024;
+
+function bad(code, message) {
+  return Object.assign(new Error(message), { code });
+}
+
+const underGit = (rel) => rel.split("/").includes(".git");
+
+/**
+ * Open `requested` in workspace `dir` for a download. Returns its base name,
+ * size and a read stream. Throws EBADPATH, ESECRET, ENOFILE or ETOOBIG.
+ */
+async function openDownload(dir, requested) {
+  const file = lanePath(requested);
+  if (await isSecretOnDisk(dir, file)) {
+    throw bad("ESECRET", "that file holds secrets and is not downloadable here");
+  }
+  const abs = await resolveInLane(dir, file);
+  const runAs = require("./run-as");
+  let fh;
+  try {
+    fh = await runAs.openSafeAsync(abs);
+  } catch {
+    throw bad("ENOFILE", "no such file in the working tree");
+  }
+  const st = await fh.stat();
+  if (!st.isFile()) {
+    await fh.close();
+    throw bad("ENOFILE", "no such file in the working tree");
+  }
+  if (st.size > DOWNLOAD_MAX_BYTES) {
+    await fh.close();
+    throw bad("ETOOBIG", "file is larger than 512 MB");
+  }
+  // Never past the size fstat gave: a file growing under the read is cut.
+  const stream = fh.createReadStream({ start: 0, end: Math.max(0, st.size - 1) });
+  return { name: path.basename(file), size: st.size, stream };
+}
+
+/** A file name an upload may create: one path segment, nothing special. */
+function uploadName(name) {
+  const n = typeof name === "string" ? name.trim() : "";
+  if (
+    !n ||
+    n === "." ||
+    n === ".." ||
+    n === ".git" ||
+    /[/\\\0]/.test(n) ||
+    Buffer.byteLength(n) > 255
+  ) {
+    throw bad("EBADNAME", "the file name must be a single, plain file name");
+  }
+  return n;
+}
+
+/**
+ * Create `name` in the folder `folder` ("" = the workspace root) of workspace
+ * `dir` with `content`. Returns its workspace-relative path. Throws EBADPATH,
+ * EBADNAME, ESECRET, ENOFILE (no such folder), EEXISTS or ETOOBIG.
+ */
+async function saveUpload(dir, folder, name, content) {
+  const base = uploadName(name);
+  const sub = folder ? lanePath(folder) : "";
+  const rel = sub ? `${sub}/${base}` : base;
+  if (underGit(rel)) throw bad("EBADPATH", "nothing is uploaded into .git");
+  if (!Buffer.isBuffer(content)) throw bad("EBADCONTENT", "the upload carried no file");
+  if (content.length > UPLOAD_MAX_BYTES) throw bad("ETOOBIG", "a file may be at most 25 MB");
+  if (await isSecretOnDisk(dir, rel)) {
+    throw bad("ESECRET", "that name is reserved for secrets and is not writable here");
+  }
+  // The folder must exist inside the workspace, by its REAL path.
+  const root = await laneRoot(dir);
+  let target;
+  if (sub) {
+    let real;
+    try {
+      real = await resolveInLane(dir, sub);
+    } catch (err) {
+      throw err.code === "ENOFILE" ? bad("ENOFILE", "no such folder in the workspace") : err;
+    }
+    const st = await fs.promises.stat(real).catch(() => null);
+    if (!st?.isDirectory()) throw bad("ENOFILE", "no such folder in the workspace");
+    target = path.join(real, base);
+  } else {
+    target = path.join(root, base);
+  }
+  // Re-checked on the resolved folder: a folder linked to a secret's place.
+  if (await isSecretOnDisk(root, path.relative(root, target))) {
+    throw bad("ESECRET", "that name is reserved for secrets and is not writable here");
+  }
+  const exists = () => bad("EEXISTS", `${rel} already exists — rename the file or remove that one`);
+  const taken = await fs.promises.lstat(target).then(
+    () => true,
+    () => false
+  );
+  if (taken) throw exists();
+  const runAs = require("./run-as");
+  const acct = runAs.accountForPath(target);
+  if (acct) {
+    // As the member (S3): write-as's `replace` is an atomic new file. The
+    // existence check above is the member's own race to lose, in their home.
+    runAs.writeAs(acct, target, "replace", content);
+  } else {
+    try {
+      // `wx`: O_CREAT|O_EXCL — fails on any existing name, a symlink included.
+      await fs.promises.writeFile(target, content, { flag: "wx" });
+    } catch (err) {
+      if (err.code === "EEXIST") throw exists();
+      throw err;
+    }
+  }
+  return { path: rel };
+}
+
+module.exports = { openDownload, saveUpload, UPLOAD_MAX_BYTES, DOWNLOAD_MAX_BYTES };

server/lib/pets.js

@@ -36,7 +36,8 @@ const FEATURED_HOST = "https://codex-pets.net";
 const FEATURED = [
   { id: "goku", displayName: "Goku", by: "hackminit" },
   { id: "border-collie", displayName: "Border Collie", by: "dev-minsoo" },
-  { id: "11", displayName: "11", by: "ct" },
+  // codex-pets.net names it "11"; it is a silver-shaded British Shorthair.
+  { id: "11", displayName: "British Shorthair", by: "ct" },
 ];
 const ID_RE = /^(?:p-[0-9a-f]{12}|cp-[a-z0-9-]{1,40})$/;
 const IMAGE_TYPES = {
@@ -127,9 +128,12 @@ function readMeta(id) {
 }
 
 function view(id, meta) {
+  // A featured pet shows the name it has in FEATURED now, so a rename there
+  // reaches pets installed before it.
+  const featured = meta.featuredId && FEATURED.find((f) => f.id === meta.featuredId);
   return {
     id,
-    displayName: meta.displayName,
+    displayName: featured ? featured.displayName : meta.displayName,
     description: meta.description || "",
     kind: meta.kind,
     source: meta.source,

server/lib/scope.js

@@ -128,6 +128,7 @@ function canSeeRunRow(req, id) {
 const LANE_WORDS = new Set([
   "branches",
   "browse",
+  "clone",
   "ensure",
   "gc",
   "pick-path",
@@ -213,9 +214,38 @@ function scopeGuard(req, res, next) {
   if (bad) return notFound();
   if (lanes.some((id) => !/^\d+$/.test(id) || !canSeeLane(req, Number(id)))) return notFound();
   if (sessions.some((id) => !canSeeSession(req, id))) return notFound();
+  // S3: a WRITE to a workspace re-checks that its owner may still own that
+  // folder, by the LIVE role — an admin demoted since keeps owning their
+  // host-folder workspaces, and `/up`, `/hook`, a commit (git hooks) or a
+  // file write there would run as the HOST account. An owner that fits (every
+  // workspace was checked when it was made) never notices; reads stay open.
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    const m = /^\/(?:lanes|workspaces)\/(\d+)(?:\/|$)/i.exec(p);
+    const ids = [...(m ? [m[1]] : []), ...lanes];
+    if (ids.some((id) => !ownerStillFits(Number(id)))) {
+      return res.status(403).json({
+        error: {
+          code: "EOWNERFOLDER",
+          message: "this workspace runs as the host account: only an admin may change it",
+        },
+      });
+    }
+  }
   return next();
 }
 
+/** Whether a workspace's owner may still own its folder (S3, live role). */
+function ownerStillFits(laneId) {
+  const lane = sql("SELECT cwd, owner_id FROM lanes WHERE id = ?").get(laneId);
+  if (!lane) return true;
+  try {
+    require("./run-as").assertOwnerFits(lane.cwd, lane.owner_id);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // ── WebSocket broadcasts ───────────────────────────────────────────────────
 
 const STAFF = { staffOnly: true };