feat: edit in the Changes panel, git graph history, plan quota (v2.3.0)

- Changes panel: a working file opens in a CodeMirror editor with its diff
  inline (DiffEditor.tsx, @codemirror/merge, lazy-loaded); Changes folds the
  unchanged lines, Whole file shows them; side by side at 50/50 and full
  width; a Revert per block; original from HEAD or the branch's merge base
  (`mergeBase` on GET /git/changes?range=branch)
- Every diff: green = line added whole, red = removed whole, blue = edited
  in place (--diff-mod)
- History drawn as a commit graph (#58: `parents` on GET /git/log,
  --date-order; lib/commitGraph.ts)
- Per-workspace never-stage list, drawn orange in the Files tree (--kept);
  closed Terminal rows past three deleted
- Status bar plan quota for Claude (per account) and Codex
  (GET /api/pricing/quota, server/lib/quota.js); compact hover panel that
  stays open, Refresh button with a spinner
- Settings → Appearance holds language, theme and pet; Ctrl+Shift+C copies;
  compact sidebar navigation and short session times

server/__tests__/dashboard-runs.test.js

@@ -61,6 +61,27 @@ describe("dashboard-runs", () => {
     assert.equal(runs.getRun("agenthub-lane-9-1"), null);
   });
 
+  it("keeps only the newest closed Terminal tabs of a lane, live ones untouched", () => {
+    for (let i = 1; i <= 5; i++) {
+      start(`agenthub-lane-11-${i}`, {
+        laneId: 11,
+        tool: "shell",
+        startedAt: Date.parse(`2026-10-0${i}T10:00:00Z`),
+      });
+    }
+    start("agenthub-lane-11", { laneId: 11, tool: "claude", startedAt: Date.parse("2026-09-01") });
+    // Pane 5 still runs; every other one has closed.
+    runs.reconcileOrphans((id) => id === "agenthub-lane-11-5");
+    const shells = runs.listRuns({ laneId: 11, tool: "shell" }).map((r) => r.id);
+    assert.deepEqual(shells, [
+      "agenthub-lane-11-5",
+      "agenthub-lane-11-4",
+      "agenthub-lane-11-3",
+      "agenthub-lane-11-2",
+    ]);
+    assert.ok(runs.getRun("agenthub-lane-11"), "another tool's row stays");
+  });
+
   it("flags as abandoned only the running rows whose pane is gone", () => {
     start("agenthub-lane-5", { laneId: 5 });
     start("agenthub-lane-6", { laneId: 6 });

server/__tests__/git-diff-ops.test.js

@@ -195,6 +195,7 @@ describe("collectChanges — branch range", () => {
 
     const out = await collectChanges(LANE, { range: "branch", base: "development", full: true });
     assert.equal(out.baseRef, "origin/development");
+    assert.equal(out.mergeBase, g(LANE, "merge-base", "origin/development", "HEAD").trim());
     assert.deepEqual(
       out.files.map((f) => f.path),
       ["a.txt"]
@@ -401,6 +402,8 @@ describe("listCommits / readFileAt / listPaths / listTree", () => {
       ["touch keep", "touch a", "init"]
     );
     assert.ok(all[0].refs.includes("HEAD -> feat/thing"));
+    assert.deepEqual(all[0].parents, [all[1].sha]);
+    assert.deepEqual(all[2].parents, []);
 
     const forA = await listCommits(LANE, { file: "a.txt" });
     assert.deepEqual(

server/__tests__/quota.test.js

@@ -0,0 +1,109 @@
+/**
+ * @file Tests server/lib/quota.js: a rollout's `rate_limits`
+ * window mapped to the status bar's label/percent/reset, and a window that has
+ * reset since Codex last wrote reading as empty, and the Codex login's
+ * account + expiry read from `auth.json`; and a saved Claude profile asked
+ * with its own token only while it is valid, never refreshed.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { test } = require("node:test");
+const assert = require("node:assert");
+const { codexWindow, windowLabel } = require("../lib/quota");
+
+test("windowLabel names the plan windows", () => {
+  assert.strictEqual(windowLabel(300), "5h");
+  assert.strictEqual(windowLabel(10080), "wk");
+  assert.strictEqual(windowLabel(43200), "mo");
+  assert.strictEqual(windowLabel(2880), "2d");
+});
+
+test("codexWindow keeps a live window and empties a reset one", () => {
+  const future = Math.floor(Date.now() / 1000) + 3600;
+  assert.deepStrictEqual(
+    codexWindow({ used_percent: 27, window_minutes: 300, resets_at: future }, Date.now()),
+    { label: "5h", usedPercent: 27, resetsAt: new Date(future * 1000).toISOString() }
+  );
+  const past = codexWindow(
+    { used_percent: 92, window_minutes: 10080, resets_in_seconds: 60 },
+    Date.now() - 120_000
+  );
+  assert.strictEqual(past.usedPercent, 0);
+  assert.strictEqual(codexWindow(null, 0), null);
+});
+
+test("codexAccount reads the email and access-token expiry, never a token", () => {
+  const fs = require("node:fs");
+  const os = require("node:os");
+  const path = require("node:path");
+  const { codexAccount } = require("../lib/quota");
+  const jwt = (claims) => `h.${Buffer.from(JSON.stringify(claims)).toString("base64url")}.s`;
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "quota-codex-"));
+  const prev = process.env.CODEX_HOME;
+  process.env.CODEX_HOME = home;
+  try {
+    assert.deepStrictEqual(codexAccount(), {});
+    fs.writeFileSync(
+      path.join(home, "auth.json"),
+      JSON.stringify({
+        tokens: { id_token: jwt({ email: "a@b.c" }), access_token: jwt({ exp: 1_800_000_000 }) },
+      })
+    );
+    assert.deepStrictEqual(codexAccount(), {
+      account: "a@b.c",
+      expiresAt: new Date(1_800_000_000_000).toISOString(),
+    });
+  } finally {
+    if (prev === undefined) delete process.env.CODEX_HOME;
+    else process.env.CODEX_HOME = prev;
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("a saved profile is asked with its own token only while valid, never refreshed", async () => {
+  const fs = require("node:fs");
+  const os = require("node:os");
+  const path = require("node:path");
+  const { quotas, __resetCache } = require("../lib/quota");
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "quota-claude-"));
+  const dir = path.join(home, "agenthub-profiles");
+  fs.mkdirSync(dir);
+  const profile = (name, token, expiresAt) =>
+    fs.writeFileSync(
+      path.join(dir, `${name}.json`),
+      JSON.stringify({
+        label: name,
+        account: { accountUuid: name, emailAddress: `${name}@x.y` },
+        credentials: { accessToken: token, refreshToken: "r", expiresAt },
+      })
+    );
+  profile("fresh", "tok-fresh", Date.now() + 3600_000);
+  profile("stale", "tok-stale", Date.now() - 1000);
+  const prev = { home: process.env.CLAUDE_HOME, fetch: global.fetch };
+  const asked = [];
+  process.env.CLAUDE_HOME = home;
+  global.fetch = async (url, opts) => {
+    asked.push(`${url} ${opts.headers.Authorization}`);
+    return {
+      status: 200,
+      ok: true,
+      json: async () => ({ five_hour: { utilization: 40, resets_at: null } }),
+    };
+  };
+  try {
+    __resetCache();
+    const claude = (await quotas()).tools.filter((t) => t.id === "claude");
+    assert.deepStrictEqual(asked, ["https://api.anthropic.com/api/oauth/usage Bearer tok-fresh"]);
+    const by = Object.fromEntries(claude.map((t) => [t.label, t]));
+    assert.strictEqual(by.fresh.active, false);
+    assert.strictEqual(by.fresh.windows[0].usedPercent, 40);
+    assert.strictEqual(by.stale.error, "EPROFILEEXPIRED");
+    assert.strictEqual(by.stale.account, "stale@x.y");
+  } finally {
+    if (prev.home === undefined) delete process.env.CLAUDE_HOME;
+    else process.env.CLAUDE_HOME = prev.home;
+    global.fetch = prev.fetch;
+    __resetCache();
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});