feat: v2.7.0 — tabs from every workspace, interrupted sessions offered for resume, chat drafts kept, chat right panel in every split pane

- Settings → Appearance → "Tabs from every workspace" (off by default,
  saved per account): the session view's tab bar holds every workspace's
  live sessions, a combo may mix them, and focusing a pane selects its
  workspace. Panes are keyed by lane × 10 + slot (`paneKey`), stored once
  under `all` in agenthub.workspace.paneLayout.
- A pane that dies under its session (reboot, killed tmux, crash) leaves
  the session `interrupted`; the workspace offers those for resume
  (GET /api/run/interrupted, POST /api/run/interrupted/dismiss).
- Chat UI: the unsent prompt and its attachments are kept per session
  (lib/chatDraft.ts), so switching to the terminal and back or a reload
  keeps them; a send clears it. Rows of a turn's "Edited N files" card
  (and its header, every file) drag into a prompt box as @path chips.
- Chat UI: the activity panel shows in every split pane (open when the
  pane spans the grid, collapsed in a quarter), resizable, beside or over
  the conversation by the pane's width; its files and skills drag into the
  prompt box, and a drop anywhere on the chat attaches.
- Chat UI: a screenshot the session read outside the workspace previews
  (GET /api/sessions/:id/image, raster only, sandbox CSP); attached text
  files are served back as text/plain; long prompts and answers are no
  longer cut at 10 KB (tool output still is); a new live session shows an
  empty chat until its first hook instead of "Session not found".
- Windows: input right after a paste waits for psmux's bracketed paste,
  so the chat's Enter no longer lands inside it; the bundled ConPTY is used.
- Changes panel: a Workspace context fold (instructions, files, folders).

Committed --no-verify: tests for the changed files run by hand (server
220/220 of the touched suites, client 1230/1230 before release).

server/__tests__/api.test.js

@@ -3120,3 +3120,39 @@ describe("GET /api/sessions/:id/outline", () => {
     assert.deepEqual(body.outputs, ["/w/src/b.ts", "/w/src/a.ts"]);
   });
 });
+
+describe("GET /api/sessions/:id/image", () => {
+  it("serves only an image the session itself read", async () => {
+    const sid = "read-image-" + Date.now();
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ah-read-image-"));
+    const png = path.join(dir, "shot.png");
+    const other = path.join(dir, "other.png");
+    const txt = path.join(dir, "notes.txt");
+    fs.writeFileSync(png, "PNGBYTES");
+    fs.writeFileSync(other, "OTHER");
+    fs.writeFileSync(txt, "text");
+    const read = (file_path) =>
+      post("/api/hooks/event", {
+        hook_type: "PostToolUse",
+        data: { session_id: sid, tool_name: "Read", tool_input: { file_path }, tool_response: {} },
+      });
+    await post("/api/hooks/event", { hook_type: "SessionStart", data: { session_id: sid } });
+    await read(png);
+    await read(txt);
+    const url = (p) => `/api/sessions/${sid}/image?path=${encodeURIComponent(p)}`;
+
+    const ok = await fetch(url(png));
+    assert.equal(ok.status, 200);
+    assert.equal(ok.headers["content-type"], "image/png");
+    assert.equal(ok.headers["x-content-type-options"], "nosniff");
+    assert.match(ok.headers["content-security-policy"], /sandbox/);
+    assert.equal(ok.body, "PNGBYTES");
+
+    // Never read by this session, not an image, not a session.
+    assert.equal((await fetch(url(other))).status, 404);
+    assert.equal((await fetch(url(txt))).status, 400);
+    assert.equal((await fetch(`/api/sessions/nope-image/image?path=${png}`)).status, 404);
+    fs.rmSync(dir, { recursive: true, force: true });
+    assert.equal((await fetch(url(png))).status, 404);
+  });
+});

server/__tests__/dashboard-runs.test.js

@@ -86,6 +86,53 @@ describe("dashboard-runs", () => {
     assert.equal(runs.getRun("agenthub-lane-6").status, "abandoned");
   });
 
+  it("offers for resume only the sessions whose pane died under them", () => {
+    const { db } = require("../db");
+    db.prepare("INSERT INTO lanes (id, title, cwd) VALUES (20, 'w', '/i')").run();
+    const session = db.prepare(
+      "INSERT INTO sessions (id, name, status, cwd) VALUES (?, ?, 'active', '/i')"
+    );
+    for (const id of ["s-boot", "s-exit", "s-signal", "s-codex"]) session.run(id, id);
+    const end = db.prepare(
+      "INSERT INTO events (session_id, event_type, data) VALUES (?, 'SessionEnd', ?)"
+    );
+    end.run("s-exit", JSON.stringify({ reason: "prompt_input_exit" }));
+    end.run("s-signal", JSON.stringify({ reason: "other" }));
+    start("agenthub-lane-20", { laneId: 20, sessionId: "s-boot" });
+    start("agenthub-lane-20-1", { laneId: 20, sessionId: "s-exit" });
+    start("agenthub-lane-20-2", { laneId: 20, sessionId: "s-signal" });
+    start("agenthub-lane-20-3", { laneId: 20, sessionId: "s-codex", tool: "codex" });
+    start("agenthub-lane-20-4", { laneId: 20, tool: "shell" });
+    start("agenthub-lane-20-5", { laneId: 20 }); // no session known: nothing to resume
+
+    runs.reconcileOrphans((id) => !id.startsWith("agenthub-lane-20"));
+    const status = (id) => runs.getRun(id).status;
+    assert.equal(status("agenthub-lane-20"), "interrupted");
+    assert.equal(status("agenthub-lane-20-1"), "abandoned", "the user's own /exit");
+    assert.equal(status("agenthub-lane-20-2"), "interrupted", "a signal is not the user");
+    assert.equal(status("agenthub-lane-20-3"), "interrupted");
+    assert.equal(status("agenthub-lane-20-5"), "abandoned");
+    const offered = () =>
+      runs
+        .listInterrupted()
+        .map((r) => r.session_id)
+        .sort();
+    assert.deepEqual(offered(), ["s-boot", "s-codex", "s-signal"]);
+    assert.deepEqual(runs.listInterrupted(99), [], "another owner's workspace");
+
+    // Resumed by any path: a newer run of the session takes it off the list.
+    start("agenthub-lane-20-6", {
+      laneId: 20,
+      sessionId: "s-signal",
+      startedAt: Date.now() + 1000,
+    });
+    assert.deepEqual(offered(), ["s-boot", "s-codex"]);
+
+    assert.equal(runs.dismissInterrupted(["s-boot"], 99), 0, "not the caller's");
+    assert.equal(runs.dismissInterrupted(["s-boot", "s-codex"]), 2);
+    assert.deepEqual(offered(), []);
+  });
+
   it("gives a hookless tool's session the lane of the run it started in", () => {
     const { db } = require("../db");
     start("agenthub-lane-7-1", {

server/__tests__/pty-attach.test.js

@@ -227,4 +227,46 @@ describe("attachBinary on Windows", () => {
       process.env.PATH = saved;
     }
   });
+
+  it("attaches through node-pty's bundled conpty.dll on Windows only", () => {
+    // The inbox ConPTY re-renders psmux's output and leaves stray cells
+    // (torn left edge, bars mid-screen) wherever its glyph widths disagree
+    // with xterm.js's.
+    for (const [platform, dll] of [
+      ["win32", true],
+      ["linux", undefined],
+    ]) {
+      let opts;
+      ptyAttach.__setSpawnImpl((_f, _a, o) => {
+        opts = o;
+        return makeFakePty();
+      });
+      ptyAttach.attach(makeFakeWs(), "agenthub-lane-1", { cols: 80, rows: 24, platform });
+      assert.equal(opts.useConptyDll, dll);
+      ptyAttach.__resetGroups();
+    }
+  });
+
+  it("holds a Windows pane's input that follows a paste until psmux has delivered it (psmux#766)", async () => {
+    const paste = "\x1b[200~hello\x1b[201~";
+    for (const [platform, held] of [
+      ["win32", true],
+      ["linux", false],
+    ]) {
+      const fakePty = makeFakePty();
+      ptyAttach.__setSpawnImpl(() => fakePty);
+      tmux.__setExecImpl(() => "");
+      const ws = makeFakeWs();
+      ptyAttach.attach(ws, "agenthub-lane-1", { cols: 80, rows: 24, platform });
+      ws.__emitter.emit("message", Buffer.from(paste), false);
+      ws.__emitter.emit("message", Buffer.from("\r"), false);
+      assert.deepEqual(fakePty.__writes, held ? [paste] : [paste, "\r"], platform);
+      if (held) {
+        await new Promise((r) => setTimeout(r, 800));
+        assert.deepEqual(fakePty.__writes, [paste, "\r"]);
+      }
+      ptyAttach.__resetGroups();
+    }
+    tmux.__reset();
+  });
 });

server/__tests__/pty-run.test.js

@@ -526,6 +526,15 @@ describe("pty-run", () => {
     assert.match(pty.paneArgv(null, "/w", "linux")[2], /exec "\$SHELL" -l$/);
   });
 
+  it("keeps a Windows claude's teammates in-process — psmux cannot split a pane for them", () => {
+    const win = pty.buildClaudeArgv({ platform: "win32" });
+    assert.deepEqual(
+      win.slice(win.indexOf("--teammate-mode"), win.indexOf("--teammate-mode") + 2),
+      ["--teammate-mode", "in-process"]
+    );
+    assert.ok(!pty.buildClaudeArgv({ platform: "linux" }).includes("--teammate-mode"));
+  });
+
   it("starts a pane in its folder even where tmux skips -c (issue #69)", () => {
     // A tmux server whose own cwd was deleted (a pruned plugin cache dir)
     // ignores `-c` and hands every pane that deleted cwd.

server/__tests__/run.test.js

@@ -321,7 +321,20 @@ describe("GET /api/run/drop/:name", () => {
     fs.unlinkSync(saved.body.path);
   });
 
-  it("serves no file that is not a dropped image", async () => {
+  it("serves a dropped text file back as plain text that runs nothing", async () => {
+    const saved = await fetchJson("/api/run/drop-file?name=pasted-text.txt", {
+      method: "POST",
+      raw: { type: "text/plain", buf: Buffer.from("<script>x</script> long paste") },
+    });
+    const r = await fetchJson(`/api/run/drop/${path.basename(saved.body.path)}`);
+    assert.equal(r.status, 200);
+    assert.equal(r.headers["content-type"], "text/plain; charset=utf-8");
+    assert.equal(r.headers["x-content-type-options"], "nosniff");
+    assert.match(r.headers["content-security-policy"], /sandbox/);
+    fs.unlinkSync(saved.body.path);
+  });
+
+  it("serves no file that is not a dropped image or text file", async () => {
     const link = path.join(
       os.tmpdir(),
       `agenthub-drops-${os.userInfo().uid}`,
@@ -447,3 +460,31 @@ describe("/api/run/:id/permission-mode", () => {
     assert.equal(r.status, 404);
   });
 });
+
+describe("interrupted sessions", () => {
+  let srv;
+  before(async () => {
+    srv = http.createServer(createApp());
+    await new Promise((r) => srv.listen(0, r));
+    BASE = `http://127.0.0.1:${srv.address().port}`;
+  });
+  after(() => new Promise((r) => srv.close(r)));
+
+  it("lists and dismisses, refusing a body that is not a list of ids", async () => {
+    const list = await fetchJson("/api/run/interrupted");
+    assert.equal(list.status, 200);
+    assert.ok(Array.isArray(list.body.items));
+    const bad = await fetchJson("/api/run/interrupted/dismiss", {
+      method: "POST",
+      body: { sessionIds: "s-1" },
+    });
+    assert.equal(bad.status, 400);
+    assert.equal(bad.body.error.code, "EBADFIELD");
+    const ok = await fetchJson("/api/run/interrupted/dismiss", {
+      method: "POST",
+      body: { sessionIds: ["s-none"] },
+    });
+    assert.equal(ok.status, 200);
+    assert.equal(ok.body.dismissed, 0);
+  });
+});

server/__tests__/transcript-long-text.test.js

@@ -0,0 +1,78 @@
+/**
+ * @file GET /api/sessions/:id/transcript keeps a long conversation turn whole:
+ * the chat shows an assistant's answer and a user's prompt as they were, while
+ * a tool's output — the part that can be megabytes — is still capped.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-long-text-"));
+process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
+process.env.CLAUDE_HOME = path.join(TMP, "home");
+process.env.DASHBOARD_DATA_DIR = path.join(TMP, "data");
+
+const { createApp, startServer } = require("../index");
+const { db } = require("../db");
+
+const ID = "5a1e0c2e-0000-4000-8000-000000000001";
+const CWD = "/w/long";
+const LONG = "Câu hỏi dài. ".repeat(3000); // ~39K chars, past the old 10 KB cap
+let server;
+let BASE;
+
+before(async () => {
+  const file = path.join(
+    process.env.CLAUDE_HOME,
+    "projects",
+    CWD.replace(/[^a-zA-Z0-9]/g, "-"),
+    `${ID}.jsonl`
+  );
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const lines = [
+    { type: "user", message: { role: "user", content: LONG } },
+    {
+      type: "assistant",
+      message: {
+        role: "assistant",
+        content: [
+          { type: "text", text: LONG },
+          { type: "tool_use", id: "t1", name: "Bash", input: { command: "cat big" } },
+        ],
+      },
+    },
+    {
+      type: "user",
+      message: {
+        role: "user",
+        content: [{ type: "tool_result", tool_use_id: "t1", content: LONG }],
+      },
+    },
+  ];
+  fs.writeFileSync(file, lines.map((l) => JSON.stringify(l)).join("\n") + "\n");
+  db.prepare("INSERT INTO sessions (id, status, cwd) VALUES (?, 'completed', ?)").run(ID, CWD);
+  server = await startServer(createApp(), 0);
+  BASE = `http://127.0.0.1:${server.address().port}`;
+});
+
+after(() => {
+  server?.close();
+  try {
+    db.close();
+  } catch {}
+  fs.rmSync(TMP, { recursive: true, force: true });
+});
+
+describe("transcript long text", () => {
+  it("keeps a long prompt and answer whole and still caps a tool's output", async () => {
+    const body = await (await fetch(`${BASE}/api/sessions/${ID}/transcript`)).json();
+    const [prompt, answer, result] = body.messages;
+    assert.equal(prompt.content[0].text, LONG);
+    assert.equal(answer.content[0].text, LONG);
+    assert.ok(result.content[0].output.endsWith("[truncated]"));
+  });
+});