feat: v2.6.0 — Chat UI composer (+ menu, project files, activity panel, permission mode, Stop), git on a workspace's extra folders (#70), long paste as a file (#68), S3 server mode (experimental)

Chat UI:
- Each Claude/Codex session keeps its own chat/terminal view; Settings only
  sets how new sessions open.
- Composer + menu: upload, project files and folders (#54, also dragged from
  the Files/Changes tree), context files, recent uploads, skills, plugins.
- Activity side panel (progress, outputs, files read, uploads, memory,
  skills, connectors) with a file preview; edited-file counts per turn.
- Permission-mode chip (Shift+Tab steps, read back from the pane:
  server/lib/pane-mode.js, GET|POST /api/run/:id/permission-mode).
- Stop (Esc) while the main agent works; the status is checked per agent
  (with session_id /api/agents ignores its status filter) and re-read every
  5 s while Stop shows.
- Dropped images shown in the conversation (GET /api/run/drop/:name, the
  requester's own drop dir), full-size viewer.
- A plain-text paste over 5,000 characters is attached as pasted-text.txt,
  so no prompt reaches tmux/argv limits (#68).

Changes panel: every /api/lanes/:id/git* route takes ?source=<lane_sources
id> (sourceFolder; ENOSOURCE otherwise) and a folder picker switches the
whole panel to a workspace's extra folder (#70).

Server mode S3 (one Linux user per account) — experimental, verified with
fake sudo plus a P6 managed-settings spike on a test account:
- member tmux listing runs in the background (cached, 15 s => unknown);
- transcript snapshot copy is async, chunked, temp file + rename;
- Express Layer patch only on Express 4;
- tmux capturePane/sendKey go to the member's own server.

Docs: the multi-user design moved in as docs/plans/server-mode/README.md
(the AgentHub-Server repo is gone); S3-PLAN P6 result; LANES/API/openapi.

server/__tests__/api.test.js

@@ -3035,3 +3035,88 @@ describe("Nested Agent Spawning", () => {
     );
   });
 });
+
+describe("GET /api/sessions/:id/outline", () => {
+  it("reads progress, outputs and context off the session's tool events", async () => {
+    const sid = "outline-" + Date.now();
+    const pre = (tool_name, tool_input, tool_response) =>
+      post("/api/hooks/event", {
+        hook_type: "PostToolUse",
+        data: { session_id: sid, tool_name, tool_input, tool_response },
+      });
+    await post("/api/hooks/event", { hook_type: "SessionStart", data: { session_id: sid } });
+    await pre(
+      "TaskCreate",
+      { subject: "Parse plan" },
+      { task: { id: "1", subject: "Parse plan" } }
+    );
+    await pre(
+      "TaskCreate",
+      { subject: "Parse plan" },
+      { task: { id: "1", subject: "Parse plan" } }
+    );
+    await pre(
+      "TaskCreate",
+      { subject: "Build report" },
+      { task: { id: "2", subject: "Build report" } }
+    );
+    await pre("TaskUpdate", { taskId: "1", status: "completed" });
+    await pre("TaskUpdate", { taskId: "2", status: "in_progress" });
+    await pre("Write", { file_path: "/w/a.xlsx", content: "x" });
+    await pre("Write", { file_path: "/w/b.md", content: "x" });
+    await pre("Write", { file_path: "/w/a.xlsx", content: "y" });
+    await pre("Skill", { skill: "xlsx" });
+    await pre("Skill", { skill: "xlsx" });
+    await pre("mcp__plugin_vercel_vercel__list_projects", {});
+
+    const res = await fetch(`/api/sessions/${sid}/outline`);
+    assert.equal(res.status, 200);
+    assert.deepEqual(res.body.progress, [
+      { id: "1", subject: "Parse plan", status: "completed" },
+      { id: "2", subject: "Build report", status: "in_progress" },
+    ]);
+    assert.deepEqual(res.body.outputs, ["/w/a.xlsx", "/w/b.md"]);
+    assert.deepEqual(res.body.skills, ["xlsx"]);
+    assert.deepEqual(res.body.mcp, ["vercel_vercel"]);
+
+    // A TodoWrite replaces the list wholesale.
+    await pre("TodoWrite", { todos: [{ content: "Verify", status: "pending" }] });
+    const again = await fetch(`/api/sessions/${sid}/outline`);
+    assert.deepEqual(again.body.progress, [{ id: "0", subject: "Verify", status: "pending" }]);
+
+    assert.equal((await fetch("/api/sessions/nope-outline/outline")).status, 404);
+  });
+
+  it("splits what a session used (uploads, files, memory) from what it changed", async () => {
+    const sid = "outline-used-" + Date.now();
+    const pre = (tool_name, tool_input) =>
+      post("/api/hooks/event", {
+        hook_type: "PostToolUse",
+        data: { session_id: sid, tool_name, tool_input, tool_response: {} },
+      });
+    const drop = "/tmp/agenthub-drops-1000/0123456789abcdef-minutes.xlsx";
+    await post("/api/hooks/event", { hook_type: "SessionStart", data: { session_id: sid } });
+    await post("/api/hooks/event", {
+      hook_type: "UserPromptSubmit",
+      data: {
+        session_id: sid,
+        prompt: `compare these ${drop}\n/tmp/agenthub-drops-1000/fedcba9876543210.png`,
+      },
+    });
+    const mem = "/home/u/.claude/projects/-w/memory/release.md";
+    await pre("Read", { file_path: drop });
+    await pre("Read", { file_path: "/w/src/a.ts" });
+    await pre("Read", { file_path: "/w/src/c.ts" });
+    await pre("Read", { file_path: mem });
+    await pre("Edit", { file_path: "/w/src/a.ts", old_string: "a", new_string: "b" });
+    await pre("MultiEdit", { file_path: "/w/src/b.ts", edits: [] });
+    await pre("Write", { file_path: mem, content: "x" });
+
+    const { body } = await fetch(`/api/sessions/${sid}/outline`);
+    assert.deepEqual(body.uploads, ["/tmp/agenthub-drops-1000/fedcba9876543210.png", drop]);
+    // a.ts was read, then edited: an output, no longer a file it only used.
+    assert.deepEqual(body.files, ["/w/src/c.ts"]);
+    assert.deepEqual(body.memory, [mem]);
+    assert.deepEqual(body.outputs, ["/w/src/b.ts", "/w/src/a.ts"]);
+  });
+});