feat: pet chat window replaces the Sagi panel; Windows pane attach no longer crashes the server

- Sagi: clicking the pet opens its chat window directly (PetChat + SagiInfo
  status strip, Needs you, Mute / Clear alerts); SagiPanel removed.
- Chat view answers Claude's unnumbered folder-trust prompt (parseBareMenu).
- pty-attach: resize/write after a Windows attach exited, and node-pty's pipe
  errors, no longer throw out of the WebSocket handler.
- restart-helper: the server started by an update logs to
  data/agenthub-server.log instead of discarding its output.

server/lib/pty-attach.js

@@ -84,17 +84,49 @@ const tell = (v, msg) => {
   }
 };
 
+// node-pty throws from resize() once its process has exited ("Cannot resize a
+// pty that has already exited" on Windows), and a viewer's attach can exit
+// before its socket's close event takes it out of the group — a throw here,
+// inside a WebSocket message handler, would take the whole server down.
+const resize = (v, cols, rows) => {
+  if (v.exited) return;
+  try {
+    v.pty.resize(cols, rows);
+  } catch {
+    /* attach already gone — its exit/close handlers clean up */
+  }
+};
+
 /** `v` sizes the window now: every other attach is held at its size and told. */
 function drive(group, v) {
   group.driver = v;
-  v.pty.resize(v.cols, v.rows);
+  resize(v, v.cols, v.rows);
   for (const o of group.viewers) {
     if (o === v) continue;
-    o.pty.resize(v.cols, v.rows);
+    resize(o, v.cols, v.rows);
     tell(o, { type: "size", cols: v.cols, rows: v.rows });
   }
 }
 
+/**
+ * Windows node-pty re-throws any read-pipe error that is not EIO unless a
+ * second `error` listener exists, and its write pipe has no listener at all —
+ * so the EPIPE/ECONNRESET a pane's attach raises when the session is stopped
+ * (Stop, kill-session) became an uncaught exception that killed the dashboard.
+ * The attach's exit is reported by `onExit`; the error itself carries nothing.
+ */
+function swallowPipeErrors(pty) {
+  const ignore = () => {};
+  try {
+    pty.on?.("error", ignore);
+  } catch {
+    /* no event emitter on this pty — nothing to guard */
+  }
+  // Private on node-pty's Windows agent; absent elsewhere and in tests.
+  const input = pty._agent?.inSocket;
+  if (input && typeof input.on === "function") input.on("error", ignore);
+}
+
 /**
  * Attach `ws` to the tmux session `runId`. Spawns one PTY-backed
  * `tmux attach-session -t <runId>` per call.
@@ -132,7 +164,8 @@ function attach(ws, runId, { cols, rows, platform = process.platform }) {
     // newer one VS Code uses for the same reason. Ignored elsewhere.
     ...(platform === "win32" && { useConptyDll: true }),
   });
-  const me = { ws, pty, cols: cols || 80, rows: rows || 24 };
+  swallowPipeErrors(pty);
+  const me = { ws, pty, cols: cols || 80, rows: rows || 24, exited: false };
   group.viewers.add(me);
   if (lead) tell(me, { type: "size", cols: lead.cols, rows: lead.rows });
   else group.driver = me;
@@ -179,16 +212,22 @@ function attach(ws, runId, { cols, rows, platform = process.platform }) {
     }
   };
   function write(text) {
+    if (me.exited) return; // the attach is gone: nothing reads this pipe
     const wait = holdUntil - Date.now();
     if (held.length || wait > 0) {
       if (held.push(text) === 1) setTimeout(flush, Math.max(0, wait));
       return;
     }
-    pty.write(text);
+    try {
+      pty.write(text);
+    } catch {
+      return; // exited between the check and the write — onExit follows
+    }
     if (holdsPaste && text.includes("\x1b[201~")) holdUntil = Date.now() + PASTE_HOLD_MS;
   }
 
   pty.onExit(({ exitCode }) => {
+    me.exited = true;
     try {
       ws.send(JSON.stringify({ type: "exit", code: exitCode }), { binary: false });
     } catch {

server/lib/self-restart.js

@@ -77,7 +77,10 @@ function scheduleRestart(root = path.join(__dirname, "..", ".."), deps = {}) {
   }
   const helperPath = path.join(root, "scripts", "restart-helper.js");
   const entry = process.argv[1] || path.join(root, "server", "index.js");
-  const helper = spawnHelper(process.execPath, [helperPath, String(process.pid), entry], {
+  // The same log `agenthub start` writes: without it every server started by
+  // an update ran with no stdout/stderr at all, and a crash left no trace.
+  const logFile = path.join(root, "data", "agenthub-server.log");
+  const helper = spawnHelper(process.execPath, [helperPath, String(process.pid), entry, logFile], {
     cwd: root,
     detached: true,
     stdio: "ignore",