feat: v2.6.0 — Chat UI composer (+ menu, project files, activity panel, permission mode, Stop), git on a workspace's extra folders (#70), long paste as a file (#68), S3 server mode (experimental)

Chat UI:
- Each Claude/Codex session keeps its own chat/terminal view; Settings only
  sets how new sessions open.
- Composer + menu: upload, project files and folders (#54, also dragged from
  the Files/Changes tree), context files, recent uploads, skills, plugins.
- Activity side panel (progress, outputs, files read, uploads, memory,
  skills, connectors) with a file preview; edited-file counts per turn.
- Permission-mode chip (Shift+Tab steps, read back from the pane:
  server/lib/pane-mode.js, GET|POST /api/run/:id/permission-mode).
- Stop (Esc) while the main agent works; the status is checked per agent
  (with session_id /api/agents ignores its status filter) and re-read every
  5 s while Stop shows.
- Dropped images shown in the conversation (GET /api/run/drop/:name, the
  requester's own drop dir), full-size viewer.
- A plain-text paste over 5,000 characters is attached as pasted-text.txt,
  so no prompt reaches tmux/argv limits (#68).

Changes panel: every /api/lanes/:id/git* route takes ?source=<lane_sources
id> (sourceFolder; ENOSOURCE otherwise) and a folder picker switches the
whole panel to a workspace's extra folder (#70).

Server mode S3 (one Linux user per account) — experimental, verified with
fake sudo plus a P6 managed-settings spike on a test account:
- member tmux listing runs in the background (cached, 15 s => unknown);
- transcript snapshot copy is async, chunked, temp file + rename;
- Express Layer patch only on Express 4;
- tmux capturePane/sendKey go to the member's own server.

Docs: the multi-user design moved in as docs/plans/server-mode/README.md
(the AgentHub-Server repo is gone); S3-PLAN P6 result; LANES/API/openapi.

server/routes/run.js

@@ -3,7 +3,9 @@
  * @description HTTP routes for the dashboard's terminal-run feature. Starts,
  * resumes, kills, and lists tmux-backed sessions for `claude` or `codex` (one per lane),
  * streamed to the client over a dedicated WebSocket path (see
- * server/websocket.js `/ws-pty/:runId`) rather than this REST surface.
+ * server/websocket.js `/ws-pty/:runId`) rather than this REST surface. Also
+ * saves files dropped on a pane or a prompt box (and serves a dropped image
+ * back for the chat), and reads/steps a live claude pane's permission mode.
  *
  * Security model:
  *   - Local-first dashboard. The dashboard server is expected to bind to
@@ -31,6 +33,7 @@ const { sameOriginGuard } = require("../lib/same-origin");
 const aiTools = require("../lib/ai-tools");
 const { resumeProxy } = require("../lib/proxy-apply");
 const scope = require("../lib/scope");
+const paneMode = require("../lib/pane-mode");
 
 const router = Router();
 
@@ -331,6 +334,8 @@ router.get("/files", (req, res) => {
   }
   if (!insideOwnWorkspace(req, cwd)) return refuseFolder(res);
   const q = typeof req.query.q === "string" ? req.query.q.toLowerCase() : "";
+  // The composer's "Add from project" also attaches folders (`dir/`).
+  const dirs = req.query.dirs === "1";
   const SKIP_DIRS = new Set([
     "node_modules",
     ".git",
@@ -364,7 +369,9 @@ router.get("/files", (req, res) => {
       if (ent.name.startsWith(".") && ent.name !== ".env" && ent.name !== ".gitignore") continue;
       if (ent.isDirectory()) {
         if (SKIP_DIRS.has(ent.name)) continue;
-        walk(path.join(dir, ent.name), rel ? `${rel}/${ent.name}` : ent.name);
+        const relDir = rel ? `${rel}/${ent.name}` : ent.name;
+        if (dirs && (!q || relDir.toLowerCase().includes(q))) results.push(`${relDir}/`);
+        walk(path.join(dir, ent.name), relDir);
       } else if (ent.isFile()) {
         const relPath = rel ? `${rel}/${ent.name}` : ent.name;
         if (!q || relPath.toLowerCase().includes(q)) {
@@ -451,7 +458,9 @@ router.post("/", (req, res) => {
     return res.status(201).json(handle);
   } catch (err) {
     // A busy pane is a conflict with live state, not a malformed request.
-    if (["ERUNLIVE", "ENOTSHARED", "EMEMBERGONE", "EOWNERFOLDER", "ECWDACCOUNT"].includes(err.code)) {
+    if (
+      ["ERUNLIVE", "ENOTSHARED", "EMEMBERGONE", "EOWNERFOLDER", "ECWDACCOUNT"].includes(err.code)
+    ) {
       return res.status(409).json({ error: { code: err.code, message: err.message } });
     }
     // Nor is a host missing tmux: the request was fine, the dependency is not
@@ -466,6 +475,91 @@ router.post("/", (req, res) => {
   }
 });
 
+// A dropped image, shown back in the session's conversation. Only a name
+// drop-image/drop-file made (random hex prefix, no separator) and only an image
+// type; raster only and under a sandbox CSP, like `/git/raw`.
+const DROP_IMAGE_TYPES = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+};
+router.get("/drop/:name", (req, res) => {
+  const name = String(req.params.name);
+  const m = /^[0-9a-f]{16}(?:-[A-Za-z0-9._-]+)?\.([A-Za-z]+)$/.exec(name);
+  const type = m && DROP_IMAGE_TYPES[m[1].toLowerCase()];
+  // Opened first, then checked on the descriptor (no window to swap the name
+  // for a link after the check): a regular file this account wrote. NOFOLLOW
+  // refuses a link outright; NONBLOCK keeps a FIFO from hanging the loop.
+  // S3: the requester's own drop dir, owned by their member account — so an
+  // admin viewing a member's session gets the name chip, not the image.
+  let fd = null;
+  try {
+    if (type) {
+      const { dir, member } = dropDir(req);
+      fd = fs.openSync(
+        path.join(dir, name),
+        fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0)
+      );
+      const st = fs.fstatSync(fd);
+      const uid = member
+        ? member.uid
+        : typeof process.getuid === "function"
+          ? process.getuid()
+          : st.uid;
+      if (!st.isFile() || st.uid !== uid) {
+        fs.closeSync(fd);
+        fd = null;
+      }
+    }
+  } catch {
+    /* pruned, never dropped, or a link */
+  }
+  if (fd === null) {
+    return res.status(404).json({ error: { code: "ENOTFOUND", message: "no such image" } });
+  }
+  res.set({
+    "Content-Type": type,
+    "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox",
+    "X-Content-Type-Options": "nosniff",
+    "Cache-Control": "private, max-age=86400",
+  });
+  fs.createReadStream(null, { fd }).pipe(res);
+});
+
+// A live claude pane, or the 404/400 already sent.
+function claudePane(req, res) {
+  const handle = scope.canSeeRun(req, req.params.id) ? runs.getRun(req.params.id) : null;
+  if (!handle || handle.status === "gone") {
+    res.status(404).json({ error: { code: "ENOTFOUND", message: "run not found" } });
+    return null;
+  }
+  if (handle.tool !== "claude") {
+    res.status(400).json({
+      error: { code: "EUNSUPPORTED", message: "only a claude pane has a permission mode" },
+    });
+    return null;
+  }
+  return handle;
+}
+
+router.get("/:id/permission-mode", (req, res) => {
+  const handle = claudePane(req, res);
+  if (handle) res.json({ mode: paneMode.readMode(handle.id) });
+});
+
+router.post("/:id/permission-mode", async (req, res) => {
+  const handle = claudePane(req, res);
+  if (!handle) return;
+  try {
+    res.json({ mode: await paneMode.setMode(handle.id, String(req.body?.mode ?? "")) });
+  } catch (err) {
+    const status = err.code === "EBADMODE" ? 400 : err.code ? 409 : 500;
+    res.status(status).json({ error: { code: err.code || "EINTERNAL", message: err.message } });
+  }
+});
+
 router.get("/:id", (req, res) => {
   const handle = scope.canSeeRun(req, req.params.id) ? runs.getRun(req.params.id) : null;
   if (!handle || handle.status === "gone") {