diff --git a/AGENTS.md b/AGENTS.md
index d3e61340..c14e0d39 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,7 +13,7 @@
 
 ## Lane stage
 
-AgentHub's `codex` (and `antigravity`) lanes carry no pipeline: the dashboard shows no stage for
+AgentHub's `codex` lanes (like every non-Claude AI tool lane) carry no pipeline: the dashboard shows no stage for
 them and never infers or advances one, so there is no `agenthub stage` call to
 make while you work here as Codex.
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 4b7dae89..28c3521c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,6 +1,6 @@
 # Claude Code Working Guide
 
-_Last synced: v1.8.12 (2026-09-28) + the pipeline layer going DORMANT (no template ships: `server/data/pipelines/` deleted, `EMPTY_PIPELINE`, `ENOPIPELINE`, test templates under `server/__tests__/fixtures/pipelines/`) and the workflow skills leaving the plugin (`skills/ship-feature`, `skills/ship-feature-lane`, the 18 stage/ship commands, all four `agents/`, `agenthub skills install`, `agenthub lanes agents install`, `agenthub ship-full|ship-quick`, `POST /api/skills/install`, `POST /api/lanes/:id/agents/install`, and the Superpowers auto-install with `server/lib/skill-plugins.js` and its doctor row) + v1.8.10 (2026-09-25) + `antigravity` lanes (a third `lanes.tool`, running Antigravity's `agy` CLI; no pipeline, no AI Router, no model/effort picker; the lane card no longer renders a bare tool chip, and the prompt box names the lane's CLI via `LANE_TOOL_LABEL` in `client/src/lib/types.ts`) + a lane whose pane EXITED being released on a server beat (`healAllRunIds` in `server/routes/lanes.js`, every `DASHBOARD_RUN_HEAL_MS`=10 s from `server/index.js`) — a codex/antigravity pane fires no hook, so nothing else re-read it and the lane stayed `running` + a codex Start no longer sending `resumeLast` (only **Resume last session** does) + per-CHANGE-BLOCK review bars (issue #50: `stage-hunk`/`discard-hunk` take an optional `block` — the index of a run of consecutive +/- lines inside the `@@` hunk — and `onlyBlock` in `server/lib/git-diff.js` cuts git's fresh hunk down to it, folding every other block into the side being checked; `changeBlocks`/`LaneDiffChange` in `LaneDiffView.tsx` hang one bar per block, and the arrows land on `data-change-index`) + `codex` lanes losing their pipeline (`codex-ingest.js` mirrors only idle↔running — no stage detection or auto-advance, no `keepDetection`; `codex-nudge.js` deleted; every server start runs `clearCodexPipelines` (`server/lib/lanes.js`: a codex lane's stage columns, `lane_stage_events` and `lane_features` wiped) and `removeStageDoc` (`server/lib/lane-agents.js`: the old `<!-- agenthub:stage:start -->` block taken out of each codex lane's `AGENTS.md`, the file deleted when nothing else is left); `agenthub lanes agents install` installs nothing on a codex lane; the Workspace hides stage, time-on-stage, pipeline/feature pickers and PipelineMap for one) + `info/exclude` entries AgentHub writes into a lane going to the COMMON git dir with the lane's path prefix (`server/lib/git-exclude.js`, used by `router-apply.js` and `lane-mcp.js` — a linked worktree's own `info/exclude` is never read by git, and a subdir lane has no `.git`) + macOS start-at-login (`scripts/launchd-service.js`: the LaunchAgent `~/Library/LaunchAgents/io.smartgift.agenthub.plist`, same API as `systemd-service.js`, chosen by `scripts/service-manager.js` — which the bootstrap, `agenthub service` and `/agenthub-doctor` now require instead of `systemd-service` directly) + v1.8.6 (2026-09-24) + four fixes found by the #37 evaluation, shipped without #37 itself: tmux targets are EXACT (`=name` for has-/kill-/attach-session, `=name:` for pane and option targets, in `server/lib/tmux.js`, `pty-attach.js` and `scripts/cc-update-all-helper.js`) because a bare `-t agenthub-lane-1` resolves by prefix to `agenthub-lane-12` once lane 1 is gone; `getRun`/`killRun` in `server/lib/pty-run.js` refuse any id that is not `agenthub-lane-<n>`, so `DELETE /api/run/main` can no longer kill a user's own tmux session; `POST /api/lanes/:id/router/apply` reports `restart_required` only when the pane's status is `running` (it was always true, since `getRun` returns a `gone` handle); and a lane's `needs_action` is cleared only by the session that raised it (new nullable `lanes.needs_action_session`, `server/routes/hooks.js`) + macOS support, code-audited and untested on a Mac (#22): `server/index.js` deletes a DENYLIST of parent-session variables at startup (`PARENT_SESSION_VARS`: CLAUDECODE, CLAUDE_CODE_SESSION_ID, CLAUDE_CODE_MESSAGING_*, CLAUDE_PLUGIN_ROOT, AI_AGENT, …, plus GIT_EDITOR only when it is Claude Code's `true`; user config such as CLAUDE_CONFIG_DIR/CLAUDE_CODE_USE_BEDROCK/ANTHROPIC_* passes through), because a server started from a Claude Code session handed them through tmux to every lane pane; the `~/.local/bin/agenthub` launcher falling back to `node` on PATH when its pinned node is gone (`linkCli` in `scripts/plugin-bootstrap.js`); `liveServers` ignoring a discovery entry whose `startedAt` predates this boot, so a recycled pid is never a live dashboard; lane cwds stored by real path (`canonicalCwd` in `server/lib/lanes.js`, used by `createLane`, `POST /api/lanes/ensure` and the liveness reaper — `/tmp` becomes `/private/tmp`, a not-yet-existing path through its deepest existing ancestor, existing rows untouched); an `__setExecImpl` seam in `server/lib/session-liveness.js`; and the `INSTALL.md` § macOS section with the Mac checklist + issue #34's empty-repo half — `publish` as a git write (`server/lib/git-ops.js`: `remote add origin -- <url>` + `push -u origin HEAD`, only in a repo with a commit and NO remote, URL allowlisted by `validateRemoteUrl` to https-without-userinfo/ssh:///scp-like, `origin` removed again on a failed push; `ENOCOMMITS`/`EREMOTEEXISTS`/`EBADURL`), an unborn repo being readable (`gitFacts`/`statusCounts` in `server/lib/worktree.js`: `head: null`, new `unborn`, branch via `symbolic-ref`), `POST /api/lanes/worktree` answering `400 EEMPTYREPO` instead of leaving a `failed` row, and `LaneGitBar.tsx` gaining **Publish…** (no remote), **Publish branch** (remote but no upstream) and a commit-first hint (unborn) while `AddLaneModal.tsx` steers an empty repo to Repo mode + a dashboard fetch/pull/push that needs a git LOGIN asking for one in the git bar (issue #45: `409 EGITAUTH` with `auth`, resent with `credentials`; AgentHub's own shared store `server/lib/git-credentials.js` + helper `server/lib/git-credential-helper.js`, `/api/git-credentials`, Settings → **Git credentials** = `client/src/pages/GitCredentialsConfig.tsx`) + MERGE and conflict resolution from the dashboard (issue #45 part B: `merge`/`resolve`/`merge-commit`/`merge-abort` in `server/lib/git-ops.js`, `gitFacts.merging`/`conflicts`, the git bar's **Merge into current** and diverged-upstream **Merge**, the Changes panel's merge banner and **Merge conflicts** group, and the per-block conflict view `client/src/components/lanes/LaneConflictView.tsx` over the pure parser `client/src/lib/conflicts.ts` — keep mine/theirs/both per block, saved through the whole-file editor's `PUT /git/file` + `resolve done`, no new API) + drag-and-drop of an image onto the lane terminal (`TerminalView.tsx` uploads to `POST /api/run/drop-image` in `server/routes/run.js` — raw body, png/jpeg/gif/webp only, random name under `<tmpdir>/agenthub-drops-<uid>/`, never a name from the request — then `term.paste()`s the returned path, which is how `claude` attaches it) + Claude Opus 5.5 getting its own pricing row (`claude-opus-5-5%` at 4/20/0.2/5/8, fast 8/40 — `claude-opus-5%` had been pricing it as Opus 5) + AUTOMATIC pricing (`server/lib/pricing-sync.js`, started in `startBackgroundServices`: a model family used in `token_usage` with no `<family>%` row of its own is INSERTED from LiteLLM's public price list, never updated, off with `AGENTHUB_PRICING_SYNC=0`) + the Changes panel at **Full screen** moving the whole Files view (finder + expand-all + tree, one `browsePane`) into a left SIDEBAR and dropping the Files tab and in-place editing (`full` prop on `LaneChangesPanel` from `Workspace.tsx`; a whole file opens for READING and enters the editor only on a click on its text — `onEditAt` on `LaneFileView`, caret at the clicked line, a drag-selection is not a click; Cancel returns to reading, and only a diff keeps an Edit button) and height-locking the page (`viewportLocked` also true at full, else the panel shrank to content with no live run) + the overview splitting into **Staged Changes** / **Changes** groups in the `work` range + a changed tree row tinted whole (`treeMark` tone carries a `bg-status-*/10`) + the Files tree listing untracked-not-ignored files and carrying each entry's git status (`treeStatus`/`treeEntries`/`TREE_LS` in `server/lib/git-diff.js`: file `status` = porcelain code, folder `changed: true`, from ONE `laneStatus` per tree read; `treeMark` in `LaneChangesPanel.tsx` paints M/U/A/D/R) + split panes on ONE lane (every Workspace pane shows the strip's selected lane, each in its own tmux session: `slot` 0–3 on `POST /api/lanes/:id/start`, `agenthub-lane-<id>` for slot 0 = `run_id`, `agenthub-lane-<id>-<slot>` for 1–3 — `runIdForLane(id, slot)`/`MAX_PANE_SLOT` in `server/lib/pty-run.js`, the `-[1-3]` suffix accepted by `pty-attach.js` and `websocket.js`; `stop`/`reset`/`remove` kill every slot via `laneRunIds`; a pane's Active runs hides what the other panes show; no per-pane lane picker) + the server suite running on a PRIVATE tmux server (`npm run test:server` = `scripts/test-server.js`: drops `TMUX`, sets `TMUX_TMPDIR` to a temp dir, kills that server after — suites spawn and kill real `agenthub-lane-<id>` sessions with ids from their own DB, and on the default server that killed the user's real lane panes, including the one running the tests) + the whole-file EDITOR (`PUT /api/lanes/:id/git/file`, `server/lib/lane-file-write.js`: the read path's guards plus existing-text-file-only and a `baseSha` stale check → `409 ESTALE`; `readFileAt` returns that `sha`) + the per-hunk controls moving into an editor-style review bar under each hunk's last changed line (`HunkBar` in `LaneDiffView.tsx`: ^/v, `n of N`, Undo, Keep) + **Unstage all** on the ONE commit/Stage-all row + Changes sizes Narrow (30%) / Medium (50/50) / Full screen, no 70/30 + the lane card's needs-you banner gone (the strip tile keeps it) + per-HUNK Stage/Undo in the Changes panel's Review and single-file views (`stage-hunk`/`discard-hunk` in `server/lib/git-ops.js`: the hunk is named by its `@@` line and re-matched against a FRESH `git diff -U<context> HEAD` by `hunkPatch` in `git-diff.js`, then `git apply --cached` / `git apply -R` from a temp file — `409 EHUNKGONE` when it moved, `400 EUNTRACKED` on an untracked file; `discard-hunk` is the SECOND irreversible git action and carries the same `confirm: true` gate and two-click UI; the controls reach every `HunkHeader` through a context in `LaneDiffView.tsx`), each Review file header sticky with its own stage/unstage/discard (`FileActions`, shared with the overview row) + the Changes panel gaining a FULL-width step (`CHANGES_SIZES` in `Workspace.tsx`: narrow → 50/50 → 70/30 → full → closed; at full the `lane-detail` section gets `hidden` — CSS, so the one console render site stays mounted), **Stage all** plus the staged-only commit box ABOVE the overview list and sticky (as is the Files finder), and **Expand all folders** being ONE `GET /api/lanes/:id/git/tree-all` (`listTreeAll` in `server/lib/git-diff.js`: one `ls-files`, every level shaped like `listTree`'s) instead of a request — and a `git ls-files` — per folder + the lane's git section MOVING from the lane card to the top of the Changes panel (`client/src/components/lanes/LaneGitHeader.tsx`: `useLaneGitFacts`, the working-copy line, `LaneGitFilesPanel` and `LaneGitBar`, sharing ONE facts read with `LaneChangesPanel`, which refreshes it after every stage/unstage/discard/commit while a git bar action re-reads the diff; `onNewLane` comes from `Workspace.tsx`, and `LaneCard` has no git row and no `onNewLaneFromRepo` any more) and the git bar losing its commit UI — the overview's staged-only box is the ONE commit path, the server's `commit` without `only` is unchanged; the git line and its icon-only actions are ONE row in one card, the panel toolbar ONE wrapping row, and `LaneCard` hides itself (`empty:hidden`) when it has nothing to show + the run form's `/` and `@` autocomplete being REAL again (`PromptEditor` in `client/src/components/run/RunSetup.tsx` — the `2f39f4e` rewrite had left a bare textarea: `/` offers the run cwd's project + user commands and skills, via `api.ccConfig.commands|skills(scope, cwd)`, plus the CLI built-ins, claude lanes only; `@` offers `GET /api/run/files`; Enter picks while the list is open and sends otherwise) + the console's **Active runs** listing only the CURRENT lane's runs and external sessions (`LaneConsolePane.tsx`: runs by `laneId`, sessions by the longest path-boundary lane cwd, `owningLaneId`) + v1.8.3 (2026-09-23) + `GET /api/settings/info` reporting `server.memory.heapLimit` (V8's `heap_size_limit`), which the Dashboard's V8 Heap bar and Health Score now divide by instead of `heapTotal` + every `claude plugin install|update -y` (`cc-plugin-cli.js`, `skill-plugins.js`, both detached update helpers, `/agenthub-update`) retrying WITHOUT `-y` when an older Claude Code answers `unknown option '-y'` + `LaneDiffView.tsx` WINDOWING a diff above `WINDOW_THRESHOLD` (500) items at a fixed `ROW_PX` row height (`visibleRange`, spacers, a `ch` min-width off the longest line; at or below the threshold the DOM is unchanged) and clamping its mirrored split scroll (`clampScroll`/`follow`) + a git action that git itself refuses (a numeric exec exit status) answering 409 `EGIT` instead of 500 with a number for a code (`gitErrorCode` in `server/routes/lanes.js`), and one `parseNumstat` (`server/lib/git-diff.js`) shared by the Changes panel and `gitFacts.files` + the Dashboard heatmap ramp mixing `--accent` into `--surface-0` so it reads on every theme + the lane git surface being HARDENED (`server/lib/git-diff.js`, `server/lib/git-ops.js`, `server/lib/worktree.js`: every lane git call runs with `GIT_LITERAL_PATHSPECS=1` and `-z` porcelain, is scoped to the LANE's cwd — a subdir lane sees and acts on only its own paths, `gitFacts.files` included — and reads through `lanePath` at every rev; any file whose basename is `settings.local.json`, the lane router key file, is refused as `ESECRET`/403 on disk and at every rev; `commit` refuses with `ESTAGEDOUTSIDE` while anything outside the lane is staged, checked with `--no-renames`; `push` without a resolvable remote is `ENOREMOTE`; git writes serialize on the repo's absolute git dir, not the lane id) + the xterm terminal following the selected DARK theme (`client/src/lib/terminalTheme.ts`, live via `term.options.theme`) and chart colours using structural tokens + the Add-lane modal asking `POST /api/lanes/ensure` with `exact: true` (#42) — without it a directory NESTED inside an existing lane resolves to that parent lane with `created: false`, so the modal closed on the parent and no new card ever appeared; `exact` counts only a lane on that very directory, and a `created: false` answer now names the lane that owns the folder instead of closing. The CLI, the run console and Sagi keep the parent lookup + Settings → **Appearance** (`client/src/components/settings/AppearanceSettings.tsx`: mode Dark/Light/**System** — `prefers-color-scheme`, followed live — plus one NAMED theme remembered per mode: dark Default/Darcula/Apple Dark, light Default/Apple Light/IntelliJ Light/Canvas). A theme is a CSS-variable override block in `client/src/index.css` keyed by `data-theme` on `<html>` (`.dark[data-theme=…]` / `[data-mode="light"][data-theme=…]`, `data-mode` is set on `<html>` too), and `--tint-base`/light `--syn-plain` are now `var(--surface-3)`/`var(--fg-primary)` so no theme restates them; `hooks/useTheme.ts` is a `useSyncExternalStore` reader over `localStorage` (`theme` = `dark|light|system`, `agenthub.theme.dark|light`) that caches NOTHING in the module, so the Sidebar and Settings can never disagree — do not reintroduce per-instance `useState` there; an inline `<script>` in `client/index.html` reads the same keys before first paint, so a key rename touches BOTH + the diff's +/- rows (`LaneDiffView.tsx` `rowTint`/`markerClass`, `highlight.ts` `diff-add`/`diff-del`) taking a /20 status tint, a 3px status bar and a coloured marker, and the changed-span emphasis `bg-fg-primary/15` instead of `bg-white/15`, which vanished on every light theme + the light theme going WARM (`client/src/index.css`: the whole light ramp is Claude's ivory/terracotta family — page `#e8e5da`, `.card` `#f5f3ec` (one notch below Claude's own `#faf9f5` ivory), warm borders and a warm `--shadow-card`, `--accent` `#a34a28` which is the brand `#cc785c` two steps down because the brand value is 3.1:1 on ivory and 3.3:1 under white text — dark mode is untouched and stays Radix slate + blue) + the Add-lane modal having NO pipeline picker and no Advanced disclosure (`AddLaneModal.tsx`: every lane is created on the server's own `default`, changed afterwards from the lane's detail header or at creation via `agenthub lanes add --pipeline <id>`; the router radio is the one per-lane extra left and it sits in the form) + the lane-detail header dropping its stage and `auto: <stage>` chips (the PipelineMap directly below already draws both) + the Changes panel's ONE resize control being icon-only, drawing the width the next click lands on + status/accent FILLS being pre-mixed instead of translucent (`tint()` in `client/tailwind.config.js` + `--tint-base` in both themes of `client/src/index.css`: `bg-status-success/10` and `border-status-danger/40` now compile to `color-mix(…, rgb(var(--tint-base)))`, because `rgb(… / 0.1)` composites with whatever sits behind it — one "success" chip rendered as five different colours over the five surface steps and washed out on light cards. Scoped to `backgroundColor`/`borderColor` ONLY: `text-status-warning/80` and `ring-accent/40` sit on top of a fill and must stay translucent, and a translucent `surface` is what every scrim is made of. Light `--status-*` also dropped two steps below Radix 11 so a label clears 4.5:1 on its own densest chip, not just on the card) + the LIGHT theme being rebuilt around the rule that the surface ramp rises in lightness with its index in BOTH themes (`client/src/index.css`: page `surface-0` #eef0f3 under a brighter `.card` `surface-3` #f8f9fb, so hovers lift; light `--accent` #0068d6 because dark's #0090ff is 3.3:1 on white; `--fg-muted` held at ≥4.5:1; new `--syn-*` syntax tokens + `syntax.*` in `tailwind.config.js` consumed by `tokenClass` in `client/src/lib/highlight.ts`, dark keeping its pastels and light taking the same hues four steps darker) — a hardcoded near-black panel, a `hover:text-white` or a global `filter: invert(1)` is a light-mode BUG, token it or scope it under `.dark` + `client/src/components/Tooltip.tsx` — `GlobalTooltip`, mounted once in `App.tsx`, upgrades EVERY native `title` in the app into an anchored, themed bubble (parks the attribute in `data-tip` while the bubble is up and restores it after, so the accessible name and the no-JS fallback survive; `data-tip-off` opts out, `Tip.tsx` shares its `TOOLTIP_SURFACE`) — do NOT add a per-call-site tooltip wrapper, keep writing `title=` + the lane git surface of issues #34 and #35 — `server/lib/git-diff.js` (a lane's changes as parsed hunks, `range=work|branch|commit`, a caller-chosen `context`, three caps, plus `listCommits`/`readFileAt`/`listPaths`/`listTree`) behind `GET /api/lanes/:id/git/changes|log|file|ls|tree`, `server/lib/git-ops.js` (fetch/pull/push/stage/unstage/discard/commit/switch/branch-create/branch-delete — a per-file path must be one `git status` reports as changed, and `discard` needs `confirm: true`) behind `POST /api/lanes/:id/git/:action`, the Changes panel's five modes (**Files** first) with a staged-only commit box in its overview and per-file collapse in its review list (the header folds, only the PATH opens the file; plus collapse/expand-all) and a **back** that returns to the originating mode AND scroll offset, ONE header control that steps narrow/50-50/70-30/closed (`agenthub.workspace.changesSize` beside `changesOpen`), and its VS Code-shaped viewer (`LaneDiffView.tsx`: a diff bounded to its own box and scrolling on BOTH axes — a horizontal bar at the foot of a 2000-line container is only reachable at the end of the file — unified/side-by-side as two independently scrolling columns with MIRRORED `scrollLeft` — halves inside one scroller painted over each other with nothing to scroll — highlighting reused from `client/src/lib/highlight.ts`, intra-line emphasis, expand AND collapse context, whole-file), the Add-lane modal's third branch answer **Current branch** (it switches the modal to Repo mode — a lane that simply IS the repo on `main`, which a worktree could not do anyway because git holds one worktree per branch) and its `prefill` prop, driven by the git bar's **New lane here**, `gitFacts` gaining `hasRemote`/`upstream`/`ahead`/`behind`, `GET /api/lanes/branches` gaining `worktrees`, `GET /api/run/cwds` gaining a `repo` kind (the `source_repo` of existing lanes), the Add-lane modal's new/existing branch toggle + worktree list + Advanced disclosure (`AddLaneModal.tsx`), and the two new client components `LaneGitBar.tsx` (now in the Changes panel, via `LaneGitHeader`) and `LaneChangesPanel.tsx` (the collapsible Changes card beside `lane-detail` in `Workspace.tsx`, `agenthub.workspace.changesOpen`) + v1.6.17 (2026-09-18) + the run's permission mode defaulting to `auto` and the model picker sending ALIASES (`ALLOWED_PERMISSION_MODES` in `server/lib/pty-run.js` + `server/routes/run.js` gained `auto`, which is also the fallback `buildClaudeArgv` passes to `--permission-mode`, the `RunSetup` select's first option and `LaneConsolePane`'s initial state; and `RUN_MODEL_CHOICES` in `client/src/lib/api.ts` now holds `fable`/`opus`/`sonnet`/`haiku` instead of pinned ids — `claude --model` resolves an alias to the latest model itself, so a release like Fable 5.1 needs no edit here, and pricing is unaffected because it keys off the resolved id the transcript reports) + `convertEol` being GONE from the xterm terminal (`TerminalView.tsx`) — it rewrote every bare LF as CR+LF, so a tmux pane that scrolled (tmux emits a bare LF and keeps drawing at the column it was on) had the rest of that draw land at column 0, stamping a line's first characters into the left margin of the rows below: the torn left edge of issue #33, which the attach-size fix alone did NOT cure + the lane pane inheriting the graphical session's `DISPLAY`/`WAYLAND_DISPLAY`/`XAUTHORITY`/`XDG_RUNTIME_DIR` (`server/lib/desktop-env.js`, merged into `spawnRun`'s tmux `-e` env) — a systemd user service has none of them, so `claude` in a dashboard-started pane could not read the clipboard and answered "no image found in clipboard" on every image paste + the PTY attach carrying the client's REAL size (`sizeFromQuery` in `server/websocket.js`, `?cols=&rows=` on the `/ws-pty/:runId` URL built in `TerminalView.tsx`) — `attach()` was spawning `tmux attach-session` at a hardcoded 80×24 on EVERY attach, and tmux sizes the window to the newest client, so `claude` redrew its whole UI at 80 columns until the first `resize` message landed and that width stayed in the scrollback as the torn left-margin fragments of issue #33 + the Workspace's no-lane state being a real banner (`lane-empty` in `client/src/pages/Workspace.tsx`, `empty.title`/`empty.body` in `lanes.json` replacing `emptyState`) — the lane strip, add tile included, now renders only when a lane exists + the **Create/update readme file** action living in the lane's **Tools** menu (`LaneToolsMenu` in `client/src/components/lanes/LaneCard.tsx`, `actions.writeDocs*` in `lanes.json`) instead of being a checkbox in the Add-lane modal — same `api.run.start({initialPrompt: "/sg-all:sg-md-writing"})`, claude lanes only, but re-runnable long after creation + the lane terminal taking focus on mount and reporting its own death (`TerminalView.tsx`: `term.focus()` after the first fit, so typing reaches tmux without clicking the pane, and a new `onExit` prop — read through a ref so an inline parent callback never re-attaches the socket — fired on the server's `exit` frame; `LaneConsolePane` runs `newRun()` there, so a double Ctrl+C out of `claude` lands back on the run setup form instead of a dead pane behind a **New run** button) + the run console pre-filling NOTHING into the prompt box and a resume sending NO prompt (`LaneConsolePane.tsx`'s `promptPrefill` is gone — picking a pipeline used to write its driving slash command into the box on a claude lane and a stage-declaration checklist on a codex one, and whatever sits there is sent as a real prompt the moment the run starts; `handleStart` in `RunSetup.tsx` now drops `initialPrompt` entirely when a session is being resumed, since a resume carries its own transcript and anything typed would fire an extra turn into it) + browser notifications falling back when the push landed NOWHERE (`notify()` in `client/src/hooks/useNotifications.ts`): `POST /api/push/send` answers 200 with `{native:false, pushed:0}` whenever this browser has no push subscription — no service worker, a non-secure origin like `http://<lan-ip>:4820`, an unreachable push service — and the client counted that as delivered, so nothing ever appeared; delivery is now `native || pushed > 0` and anything else shows the notification locally (skipped when the push DID land, or every one would be doubled). The `Notification` API still needs a secure context, so a bare LAN IP can show nothing at all + auth-profile switching reading and writing the macOS **login Keychain** (`readCredentials`/`writeCredentials` in `server/lib/cc-profiles.js`): on darwin the `claude` CLI keeps `claudeAiOauth` in the generic-password item `Claude Code-credentials` (account `$USER`), never in `<CLAUDE_HOME>/.credentials.json` — so a switch rewrote a file nothing reads and the CLI kept running as the previous account. The Keychain wins when it holds an item, the file stays the fallback and is kept in step only when it already exists, and `AGENTHUB_CC_KEYCHAIN=0` pins the file (the test suite sets it so a Mac dev run never touches the real Keychain) + turn bookkeeping being idempotent (`stmts.insertEventAt` in `server/db.js`, used for `TurnDuration` with the TRANSCRIPT's timestamp — its dedup guard matches on `created_at`, so a NOW stamp made every hook re-insert the session's whole turn history: 587k rows, 75% of the events table — and `meta.thinking_blocks`/`turn_count`/`total_turn_duration_ms` now ASSIGNED from the full parse instead of `+=`, since `extract()` returns whole-transcript totals every time) + `hasLegacyHooks` blocking `fastPathOk` (`scripts/plugin-bootstrap.js`): leftover checkout hook entries double EVERY event and subagent row, `stripLegacyHooks` only ever ran inside `bootstrap()`, and the fast path skipped it on exactly the healthy installs where it mattered + the one-time repair marker moving to `user_version` 3 (`server/index.js`) — it now also deletes the duplicated `TurnDuration` rows, and 2 could not be trusted because an old build still ingesting hooks re-inflated whatever that pass corrected + a router switch on a LIVE pane reporting itself (`POST /api/lanes/:id/router/apply` now answers `restart_required`/`run_id` when `runs.getRun(runIdForLane(id))` is live, and `LaneRouterRow` renders a **Restart** button that kills that pane and restarts it from the lane id alone — Claude Code re-applies `env` to a running session but keeps the model it resolved at startup, so the old router's model name reaches the new endpoint and the next prompt fails) + the sidebar brand being the SmartGift wordmark with the `AgentHub` caption under it and the vendored `client/public/favicon.ico` (`Sidebar.tsx`, `client/index.html`, `client/public/manifest.json`) + the two "Claude is waiting for YOU" notification types (`client/src/lib/notifPrefs.ts` — the ONE definition of the prefs shape/defaults/storage, now imported by both `Settings.tsx` and `useNotifications.ts`; `onAwaitingInput` and `onTurnComplete` default ON, issue #29) + per-message token counting (`lastUsageMsgId` in `server/lib/transcript-cache.js` and both parsers in `scripts/import-history.js`: Claude Code writes ONE JSONL line per content block of an assistant message and each repeats the same message-level `usage`, so summing lines over-counted tokens and cost ~1.5–2× on tool-heavy sessions) + `stmts.setTokenUsage` (`server/db.js`) — the EXACT counterpart of `replaceTokenUsage`, used only by `reconcileTokens`, because the high-water `baseline_*` columns make a downward CORRECTION impossible; the server runs that reconcile once in the background at the first start after upgrading (`user_version` 2, `server/index.js`) + v1.6.12 (2026-09-18) + the same three rules in `skills/ship-feature-lane/SKILL.md` (three scheduled touchpoints now: Stage 0 Q&A, Stage 0b plan approval, Stage 7 acceptance before the PR is published — the publish rule and the turn-liveness rule name them) + the `default` 8-node pipeline asking the user twice and looping on a NO-GO (`skills/ship-feature/SKILL.md` + `server/data/pipelines/default.json`: `intake` now DECLARES `/superpowers:brainstorming` and detects it, the `plan` phase blocks on an explicit approval, `ship-feature` gained the four sections that make a long run followable and affordable (**Right-size the run** — trivial work does not enter the pipeline and a small change skips the plan-debate/independent-test/gate agents, **Dispatching a judgement** — the fresh-context/foreground/never-fork/never-dispatch-what-a-command-answers contract written ONCE instead of re-argued per phase, **Resuming after a compaction**, and a per-phase **Leave when:**), `review` DECLARES the bare `/code-review` (Claude Code's own, no `plugin:` prefix — `requiredSkillPlugins` skips it, so it adds no install requirement) and runs it always and a domain reviewer only for the layers `git diff --name-only` shows, and `gate` requires the user's acceptance — a NO-GO re-declares `implementing` or `plan` instead of proceeding) + `KEEP_RETIRED_ROOTS` dropping to 1 (`scripts/plugin-bootstrap.js`) + lane removal being record-only (the `remove` branch in `server/routes/lanes.js` no longer calls `removeWorktree`/`removeLaneData`, so a worktree, its branch and its database survive forgetting a lane — see the rule under **Lanes**) + v1.6.10 (2026-09-17) + per-profile Claude quota (`server/lib/cc-usage.js`, `POST /api/cc-config/profiles/usage`, the **Check quota** button in the Profiles modal) — a POST because a saved profile's token is normally expired, so answering refreshes it and the refresh ROTATES the credentials written back to disk, which is also why it never runs on a poll; the LIVE account is the exception and is read from `.credentials.json` via `cc-profiles.liveCredentialsFor`, never refreshed, because the CLI has already retired the refresh token its profile copy holds + the settings patch that changes nothing now writing nothing (`patchSettings` in `server/lib/cc-mutate.js`, plus `.claude/.cc-config-backups/` in a lane's git exclude) + the Add-lane modal closing itself on a clean setup and offering a real Close when a step failed + a lane's router pick no longer landing on whichever lane the user switched to mid-apply (`LaneRouterRow`), nor reverting on the next lane switch — `POST /api/lanes/:id/router/apply` now `broadcastLane`s like every other mutating lane route, so the client's cached row stops disagreeing with what was written + a run being opened by a DECLARATION only — a backwards DETECTION now continues the run in flight (`appendStageEvent` in `server/lib/lanes.js`), because detection bounces within one feature and `runs` is what every pass rate on the Workflows page is divided by + `SETTLE_MS` in `server/lib/cc-reload.js` — the two reload commands are typed a second apart, and `reloadOpenSessions` is now async, because Claude Code swallows the Enter after a slash command and back-to-back sends merged into one composer line + v1.6.0 (2026-09-14) + the lane strip's drag/Alt-arrow reordering and inline rename (`client/src/lib/laneOrderStorage.ts`, `LaneStripCard`'s `index`/`onReorder` props, the Workspace detail header's rename field, and `normalizeTitle`/`bindable` in `server/lib/lanes.js`) + the uncommitted-files hover panel (`LaneGitFilesPanel`, now in `LaneGitHeader`, and `files` from `GET /api/lanes/:id/git` now being `{path,status,added,deleted}` records off one extra `git diff --numstat HEAD`) + AI Router profiles (`server/lib/ai-routers.js`, `server/lib/router-apply.js`, the Settings tab `/settings?tool=ai-router`, its **Test** button / `POST /api/ai-routers/test`, the per-lane router select — labelled **Model**, `LaneRouterRow` exported from `LaneCard` and rendered in the Workspace lane-detail header row — and `lanes.router_profile`) + the bootstrap's superseded-build guard and plugin-cache pruner (`supersededBy`/`pruneRetiredPluginRoots` in `scripts/plugin-bootstrap.js`, `unitRoot` in `scripts/systemd-service.js`) + v1.5.6 (2026-09-11) + the systemd handover rule below (`scripts/systemd-service.js`'s `writeUserService`/`restartUserService` split and `plugin-bootstrap.js`'s deferred `pendingSystemdRestart`) + eb63569 (2026-09-10) + release-based update detection (`server/lib/update-check.js` reads the forge releases API — a checkout via its `origin` remote, a plugin-cache install via the marketplace manifest on disk, since an archive-sourced cache dir has no `.git`; a `plugin_managed` install self-updates via the detached `plugin-update` chain) + the install-wide **Update all** batch and session reload (`server/lib/cc-update-all.js`, `server/lib/cc-reload.js`)._ A change that makes any statement in this file, `AGENTS.md`, or a README wrong — a moved path, a new or changed extension point, a retired rule — updates that file in the same change-set and bumps this marker.
+_Last synced: v1.8.12 (2026-09-28) + the pipeline layer going DORMANT (no template ships: `server/data/pipelines/` deleted, `EMPTY_PIPELINE`, `ENOPIPELINE`, test templates under `server/__tests__/fixtures/pipelines/`) and the workflow skills leaving the plugin (`skills/ship-feature`, `skills/ship-feature-lane`, the 18 stage/ship commands, all four `agents/`, `agenthub skills install`, `agenthub lanes agents install`, `agenthub ship-full|ship-quick`, `POST /api/skills/install`, `POST /api/lanes/:id/agents/install`, and the Superpowers auto-install with `server/lib/skill-plugins.js` and its doctor row) + the AI TOOLS catalog (#40 part A1: `server/lib/ai-tools.js` loads one JSON per AI coding CLI from `server/data/ai-tools/` — 38 tools, data from Orca, MIT — plus overrides in `DASHBOARD_AI_TOOLS_DIR`, detects each by walking PATH, and keeps enable/default in `<data dir>/ai-tools.json`; `server/lib/shell-path.js` merges the login shell's PATH (`$SHELL -ilc`, 5 s, off with `AGENTHUB_SHELL_PATH=0`) at startup and on Refresh; `/api/ai-tools` GET/refresh/PUT; Settings → Dashboard → **AI Tools** (`client/src/components/settings/AiToolsSettings.tsx`) and the shared `client/src/hooks/useAiTools.ts`, which replaced `LANE_TOOL_LABEL`; the Add-lane modal's **Default (<tool>)** + **Other…** picker; the built-in router profile now labelled plain `Native`, rendered **Native (<tool>)**; the Claude Code/Codex settings tabs hidden while that tool is disabled; a per-run **Bypass permissions** switch; `POST /api/run` now forwarding `sandbox`/`approval`/`resumeLast`, which it had dropped) + `antigravity` lanes (a third `lanes.tool`, running Antigravity's `agy` CLI; no pipeline, no AI Router, no model/effort picker; the lane card no longer renders a bare tool chip, and the prompt box names the lane's CLI via `LANE_TOOL_LABEL` in `client/src/lib/types.ts`) + a lane whose pane EXITED being released on a server beat (`healAllRunIds` in `server/routes/lanes.js`, every `DASHBOARD_RUN_HEAL_MS`=10 s from `server/index.js`) — a codex/antigravity pane fires no hook, so nothing else re-read it and the lane stayed `running` + a codex Start no longer sending `resumeLast` (only **Resume last session** does) + per-CHANGE-BLOCK review bars (issue #50: `stage-hunk`/`discard-hunk` take an optional `block` — the index of a run of consecutive +/- lines inside the `@@` hunk — and `onlyBlock` in `server/lib/git-diff.js` cuts git's fresh hunk down to it, folding every other block into the side being checked; `changeBlocks`/`LaneDiffChange` in `LaneDiffView.tsx` hang one bar per block, and the arrows land on `data-change-index`) + `codex` lanes losing their pipeline (`codex-ingest.js` mirrors only idle↔running — no stage detection or auto-advance, no `keepDetection`; `codex-nudge.js` deleted; every server start runs `clearCodexPipelines` (`server/lib/lanes.js`: a codex lane's stage columns, `lane_stage_events` and `lane_features` wiped) and `removeStageDoc` (`server/lib/lane-agents.js`: the old `<!-- agenthub:stage:start -->` block taken out of each codex lane's `AGENTS.md`, the file deleted when nothing else is left); `agenthub lanes agents install` installs nothing on a codex lane; the Workspace hides stage, time-on-stage, pipeline/feature pickers and PipelineMap for one) + `info/exclude` entries AgentHub writes into a lane going to the COMMON git dir with the lane's path prefix (`server/lib/git-exclude.js`, used by `router-apply.js` and `lane-mcp.js` — a linked worktree's own `info/exclude` is never read by git, and a subdir lane has no `.git`) + macOS start-at-login (`scripts/launchd-service.js`: the LaunchAgent `~/Library/LaunchAgents/io.smartgift.agenthub.plist`, same API as `systemd-service.js`, chosen by `scripts/service-manager.js` — which the bootstrap, `agenthub service` and `/agenthub-doctor` now require instead of `systemd-service` directly) + v1.8.6 (2026-09-24) + four fixes found by the #37 evaluation, shipped without #37 itself: tmux targets are EXACT (`=name` for has-/kill-/attach-session, `=name:` for pane and option targets, in `server/lib/tmux.js`, `pty-attach.js` and `scripts/cc-update-all-helper.js`) because a bare `-t agenthub-lane-1` resolves by prefix to `agenthub-lane-12` once lane 1 is gone; `getRun`/`killRun` in `server/lib/pty-run.js` refuse any id that is not `agenthub-lane-<n>`, so `DELETE /api/run/main` can no longer kill a user's own tmux session; `POST /api/lanes/:id/router/apply` reports `restart_required` only when the pane's status is `running` (it was always true, since `getRun` returns a `gone` handle); and a lane's `needs_action` is cleared only by the session that raised it (new nullable `lanes.needs_action_session`, `server/routes/hooks.js`) + macOS support, code-audited and untested on a Mac (#22): `server/index.js` deletes a DENYLIST of parent-session variables at startup (`PARENT_SESSION_VARS`: CLAUDECODE, CLAUDE_CODE_SESSION_ID, CLAUDE_CODE_MESSAGING_*, CLAUDE_PLUGIN_ROOT, AI_AGENT, …, plus GIT_EDITOR only when it is Claude Code's `true`; user config such as CLAUDE_CONFIG_DIR/CLAUDE_CODE_USE_BEDROCK/ANTHROPIC_* passes through), because a server started from a Claude Code session handed them through tmux to every lane pane; the `~/.local/bin/agenthub` launcher falling back to `node` on PATH when its pinned node is gone (`linkCli` in `scripts/plugin-bootstrap.js`); `liveServers` ignoring a discovery entry whose `startedAt` predates this boot, so a recycled pid is never a live dashboard; lane cwds stored by real path (`canonicalCwd` in `server/lib/lanes.js`, used by `createLane`, `POST /api/lanes/ensure` and the liveness reaper — `/tmp` becomes `/private/tmp`, a not-yet-existing path through its deepest existing ancestor, existing rows untouched); an `__setExecImpl` seam in `server/lib/session-liveness.js`; and the `INSTALL.md` § macOS section with the Mac checklist + issue #34's empty-repo half — `publish` as a git write (`server/lib/git-ops.js`: `remote add origin -- <url>` + `push -u origin HEAD`, only in a repo with a commit and NO remote, URL allowlisted by `validateRemoteUrl` to https-without-userinfo/ssh:///scp-like, `origin` removed again on a failed push; `ENOCOMMITS`/`EREMOTEEXISTS`/`EBADURL`), an unborn repo being readable (`gitFacts`/`statusCounts` in `server/lib/worktree.js`: `head: null`, new `unborn`, branch via `symbolic-ref`), `POST /api/lanes/worktree` answering `400 EEMPTYREPO` instead of leaving a `failed` row, and `LaneGitBar.tsx` gaining **Publish…** (no remote), **Publish branch** (remote but no upstream) and a commit-first hint (unborn) while `AddLaneModal.tsx` steers an empty repo to Repo mode + a dashboard fetch/pull/push that needs a git LOGIN asking for one in the git bar (issue #45: `409 EGITAUTH` with `auth`, resent with `credentials`; AgentHub's own shared store `server/lib/git-credentials.js` + helper `server/lib/git-credential-helper.js`, `/api/git-credentials`, Settings → **Git credentials** = `client/src/pages/GitCredentialsConfig.tsx`) + MERGE and conflict resolution from the dashboard (issue #45 part B: `merge`/`resolve`/`merge-commit`/`merge-abort` in `server/lib/git-ops.js`, `gitFacts.merging`/`conflicts`, the git bar's **Merge into current** and diverged-upstream **Merge**, the Changes panel's merge banner and **Merge conflicts** group, and the per-block conflict view `client/src/components/lanes/LaneConflictView.tsx` over the pure parser `client/src/lib/conflicts.ts` — keep mine/theirs/both per block, saved through the whole-file editor's `PUT /git/file` + `resolve done`, no new API) + drag-and-drop of an image onto the lane terminal (`TerminalView.tsx` uploads to `POST /api/run/drop-image` in `server/routes/run.js` — raw body, png/jpeg/gif/webp only, random name under `<tmpdir>/agenthub-drops-<uid>/`, never a name from the request — then `term.paste()`s the returned path, which is how `claude` attaches it) + Claude Opus 5.5 getting its own pricing row (`claude-opus-5-5%` at 4/20/0.2/5/8, fast 8/40 — `claude-opus-5%` had been pricing it as Opus 5) + AUTOMATIC pricing (`server/lib/pricing-sync.js`, started in `startBackgroundServices`: a model family used in `token_usage` with no `<family>%` row of its own is INSERTED from LiteLLM's public price list, never updated, off with `AGENTHUB_PRICING_SYNC=0`) + the Changes panel at **Full screen** moving the whole Files view (finder + expand-all + tree, one `browsePane`) into a left SIDEBAR and dropping the Files tab and in-place editing (`full` prop on `LaneChangesPanel` from `Workspace.tsx`; a whole file opens for READING and enters the editor only on a click on its text — `onEditAt` on `LaneFileView`, caret at the clicked line, a drag-selection is not a click; Cancel returns to reading, and only a diff keeps an Edit button) and height-locking the page (`viewportLocked` also true at full, else the panel shrank to content with no live run) + the overview splitting into **Staged Changes** / **Changes** groups in the `work` range + a changed tree row tinted whole (`treeMark` tone carries a `bg-status-*/10`) + the Files tree listing untracked-not-ignored files and carrying each entry's git status (`treeStatus`/`treeEntries`/`TREE_LS` in `server/lib/git-diff.js`: file `status` = porcelain code, folder `changed: true`, from ONE `laneStatus` per tree read; `treeMark` in `LaneChangesPanel.tsx` paints M/U/A/D/R) + split panes on ONE lane (every Workspace pane shows the strip's selected lane, each in its own tmux session: `slot` 0–3 on `POST /api/lanes/:id/start`, `agenthub-lane-<id>` for slot 0 = `run_id`, `agenthub-lane-<id>-<slot>` for 1–3 — `runIdForLane(id, slot)`/`MAX_PANE_SLOT` in `server/lib/pty-run.js`, the `-[1-3]` suffix accepted by `pty-attach.js` and `websocket.js`; `stop`/`reset`/`remove` kill every slot via `laneRunIds`; a pane's Active runs hides what the other panes show; no per-pane lane picker) + the server suite running on a PRIVATE tmux server (`npm run test:server` = `scripts/test-server.js`: drops `TMUX`, sets `TMUX_TMPDIR` to a temp dir, kills that server after — suites spawn and kill real `agenthub-lane-<id>` sessions with ids from their own DB, and on the default server that killed the user's real lane panes, including the one running the tests) + the whole-file EDITOR (`PUT /api/lanes/:id/git/file`, `server/lib/lane-file-write.js`: the read path's guards plus existing-text-file-only and a `baseSha` stale check → `409 ESTALE`; `readFileAt` returns that `sha`) + the per-hunk controls moving into an editor-style review bar under each hunk's last changed line (`HunkBar` in `LaneDiffView.tsx`: ^/v, `n of N`, Undo, Keep) + **Unstage all** on the ONE commit/Stage-all row + Changes sizes Narrow (30%) / Medium (50/50) / Full screen, no 70/30 + the lane card's needs-you banner gone (the strip tile keeps it) + per-HUNK Stage/Undo in the Changes panel's Review and single-file views (`stage-hunk`/`discard-hunk` in `server/lib/git-ops.js`: the hunk is named by its `@@` line and re-matched against a FRESH `git diff -U<context> HEAD` by `hunkPatch` in `git-diff.js`, then `git apply --cached` / `git apply -R` from a temp file — `409 EHUNKGONE` when it moved, `400 EUNTRACKED` on an untracked file; `discard-hunk` is the SECOND irreversible git action and carries the same `confirm: true` gate and two-click UI; the controls reach every `HunkHeader` through a context in `LaneDiffView.tsx`), each Review file header sticky with its own stage/unstage/discard (`FileActions`, shared with the overview row) + the Changes panel gaining a FULL-width step (`CHANGES_SIZES` in `Workspace.tsx`: narrow → 50/50 → 70/30 → full → closed; at full the `lane-detail` section gets `hidden` — CSS, so the one console render site stays mounted), **Stage all** plus the staged-only commit box ABOVE the overview list and sticky (as is the Files finder), and **Expand all folders** being ONE `GET /api/lanes/:id/git/tree-all` (`listTreeAll` in `server/lib/git-diff.js`: one `ls-files`, every level shaped like `listTree`'s) instead of a request — and a `git ls-files` — per folder + the lane's git section MOVING from the lane card to the top of the Changes panel (`client/src/components/lanes/LaneGitHeader.tsx`: `useLaneGitFacts`, the working-copy line, `LaneGitFilesPanel` and `LaneGitBar`, sharing ONE facts read with `LaneChangesPanel`, which refreshes it after every stage/unstage/discard/commit while a git bar action re-reads the diff; `onNewLane` comes from `Workspace.tsx`, and `LaneCard` has no git row and no `onNewLaneFromRepo` any more) and the git bar losing its commit UI — the overview's staged-only box is the ONE commit path, the server's `commit` without `only` is unchanged; the git line and its icon-only actions are ONE row in one card, the panel toolbar ONE wrapping row, and `LaneCard` hides itself (`empty:hidden`) when it has nothing to show + the run form's `/` and `@` autocomplete being REAL again (`PromptEditor` in `client/src/components/run/RunSetup.tsx` — the `2f39f4e` rewrite had left a bare textarea: `/` offers the run cwd's project + user commands and skills, via `api.ccConfig.commands|skills(scope, cwd)`, plus the CLI built-ins, claude lanes only; `@` offers `GET /api/run/files`; Enter picks while the list is open and sends otherwise) + the console's **Active runs** listing only the CURRENT lane's runs and external sessions (`LaneConsolePane.tsx`: runs by `laneId`, sessions by the longest path-boundary lane cwd, `owningLaneId`) + v1.8.3 (2026-09-23) + `GET /api/settings/info` reporting `server.memory.heapLimit` (V8's `heap_size_limit`), which the Dashboard's V8 Heap bar and Health Score now divide by instead of `heapTotal` + every `claude plugin install|update -y` (`cc-plugin-cli.js`, `skill-plugins.js`, both detached update helpers, `/agenthub-update`) retrying WITHOUT `-y` when an older Claude Code answers `unknown option '-y'` + `LaneDiffView.tsx` WINDOWING a diff above `WINDOW_THRESHOLD` (500) items at a fixed `ROW_PX` row height (`visibleRange`, spacers, a `ch` min-width off the longest line; at or below the threshold the DOM is unchanged) and clamping its mirrored split scroll (`clampScroll`/`follow`) + a git action that git itself refuses (a numeric exec exit status) answering 409 `EGIT` instead of 500 with a number for a code (`gitErrorCode` in `server/routes/lanes.js`), and one `parseNumstat` (`server/lib/git-diff.js`) shared by the Changes panel and `gitFacts.files` + the Dashboard heatmap ramp mixing `--accent` into `--surface-0` so it reads on every theme + the lane git surface being HARDENED (`server/lib/git-diff.js`, `server/lib/git-ops.js`, `server/lib/worktree.js`: every lane git call runs with `GIT_LITERAL_PATHSPECS=1` and `-z` porcelain, is scoped to the LANE's cwd — a subdir lane sees and acts on only its own paths, `gitFacts.files` included — and reads through `lanePath` at every rev; any file whose basename is `settings.local.json`, the lane router key file, is refused as `ESECRET`/403 on disk and at every rev; `commit` refuses with `ESTAGEDOUTSIDE` while anything outside the lane is staged, checked with `--no-renames`; `push` without a resolvable remote is `ENOREMOTE`; git writes serialize on the repo's absolute git dir, not the lane id) + the xterm terminal following the selected DARK theme (`client/src/lib/terminalTheme.ts`, live via `term.options.theme`) and chart colours using structural tokens + the Add-lane modal asking `POST /api/lanes/ensure` with `exact: true` (#42) — without it a directory NESTED inside an existing lane resolves to that parent lane with `created: false`, so the modal closed on the parent and no new card ever appeared; `exact` counts only a lane on that very directory, and a `created: false` answer now names the lane that owns the folder instead of closing. The CLI, the run console and Sagi keep the parent lookup + Settings → **Appearance** (`client/src/components/settings/AppearanceSettings.tsx`: mode Dark/Light/**System** — `prefers-color-scheme`, followed live — plus one NAMED theme remembered per mode: dark Default/Darcula/Apple Dark, light Default/Apple Light/IntelliJ Light/Canvas). A theme is a CSS-variable override block in `client/src/index.css` keyed by `data-theme` on `<html>` (`.dark[data-theme=…]` / `[data-mode="light"][data-theme=…]`, `data-mode` is set on `<html>` too), and `--tint-base`/light `--syn-plain` are now `var(--surface-3)`/`var(--fg-primary)` so no theme restates them; `hooks/useTheme.ts` is a `useSyncExternalStore` reader over `localStorage` (`theme` = `dark|light|system`, `agenthub.theme.dark|light`) that caches NOTHING in the module, so the Sidebar and Settings can never disagree — do not reintroduce per-instance `useState` there; an inline `<script>` in `client/index.html` reads the same keys before first paint, so a key rename touches BOTH + the diff's +/- rows (`LaneDiffView.tsx` `rowTint`/`markerClass`, `highlight.ts` `diff-add`/`diff-del`) taking a /20 status tint, a 3px status bar and a coloured marker, and the changed-span emphasis `bg-fg-primary/15` instead of `bg-white/15`, which vanished on every light theme + the light theme going WARM (`client/src/index.css`: the whole light ramp is Claude's ivory/terracotta family — page `#e8e5da`, `.card` `#f5f3ec` (one notch below Claude's own `#faf9f5` ivory), warm borders and a warm `--shadow-card`, `--accent` `#a34a28` which is the brand `#cc785c` two steps down because the brand value is 3.1:1 on ivory and 3.3:1 under white text — dark mode is untouched and stays Radix slate + blue) + the Add-lane modal having NO pipeline picker and no Advanced disclosure (`AddLaneModal.tsx`: every lane is created on the server's own `default`, changed afterwards from the lane's detail header or at creation via `agenthub lanes add --pipeline <id>`; the router radio is the one per-lane extra left and it sits in the form) + the lane-detail header dropping its stage and `auto: <stage>` chips (the PipelineMap directly below already draws both) + the Changes panel's ONE resize control being icon-only, drawing the width the next click lands on + status/accent FILLS being pre-mixed instead of translucent (`tint()` in `client/tailwind.config.js` + `--tint-base` in both themes of `client/src/index.css`: `bg-status-success/10` and `border-status-danger/40` now compile to `color-mix(…, rgb(var(--tint-base)))`, because `rgb(… / 0.1)` composites with whatever sits behind it — one "success" chip rendered as five different colours over the five surface steps and washed out on light cards. Scoped to `backgroundColor`/`borderColor` ONLY: `text-status-warning/80` and `ring-accent/40` sit on top of a fill and must stay translucent, and a translucent `surface` is what every scrim is made of. Light `--status-*` also dropped two steps below Radix 11 so a label clears 4.5:1 on its own densest chip, not just on the card) + the LIGHT theme being rebuilt around the rule that the surface ramp rises in lightness with its index in BOTH themes (`client/src/index.css`: page `surface-0` #eef0f3 under a brighter `.card` `surface-3` #f8f9fb, so hovers lift; light `--accent` #0068d6 because dark's #0090ff is 3.3:1 on white; `--fg-muted` held at ≥4.5:1; new `--syn-*` syntax tokens + `syntax.*` in `tailwind.config.js` consumed by `tokenClass` in `client/src/lib/highlight.ts`, dark keeping its pastels and light taking the same hues four steps darker) — a hardcoded near-black panel, a `hover:text-white` or a global `filter: invert(1)` is a light-mode BUG, token it or scope it under `.dark` + `client/src/components/Tooltip.tsx` — `GlobalTooltip`, mounted once in `App.tsx`, upgrades EVERY native `title` in the app into an anchored, themed bubble (parks the attribute in `data-tip` while the bubble is up and restores it after, so the accessible name and the no-JS fallback survive; `data-tip-off` opts out, `Tip.tsx` shares its `TOOLTIP_SURFACE`) — do NOT add a per-call-site tooltip wrapper, keep writing `title=` + the lane git surface of issues #34 and #35 — `server/lib/git-diff.js` (a lane's changes as parsed hunks, `range=work|branch|commit`, a caller-chosen `context`, three caps, plus `listCommits`/`readFileAt`/`listPaths`/`listTree`) behind `GET /api/lanes/:id/git/changes|log|file|ls|tree`, `server/lib/git-ops.js` (fetch/pull/push/stage/unstage/discard/commit/switch/branch-create/branch-delete — a per-file path must be one `git status` reports as changed, and `discard` needs `confirm: true`) behind `POST /api/lanes/:id/git/:action`, the Changes panel's five modes (**Files** first) with a staged-only commit box in its overview and per-file collapse in its review list (the header folds, only the PATH opens the file; plus collapse/expand-all) and a **back** that returns to the originating mode AND scroll offset, ONE header control that steps narrow/50-50/70-30/closed (`agenthub.workspace.changesSize` beside `changesOpen`), and its VS Code-shaped viewer (`LaneDiffView.tsx`: a diff bounded to its own box and scrolling on BOTH axes — a horizontal bar at the foot of a 2000-line container is only reachable at the end of the file — unified/side-by-side as two independently scrolling columns with MIRRORED `scrollLeft` — halves inside one scroller painted over each other with nothing to scroll — highlighting reused from `client/src/lib/highlight.ts`, intra-line emphasis, expand AND collapse context, whole-file), the Add-lane modal's third branch answer **Current branch** (it switches the modal to Repo mode — a lane that simply IS the repo on `main`, which a worktree could not do anyway because git holds one worktree per branch) and its `prefill` prop, driven by the git bar's **New lane here**, `gitFacts` gaining `hasRemote`/`upstream`/`ahead`/`behind`, `GET /api/lanes/branches` gaining `worktrees`, `GET /api/run/cwds` gaining a `repo` kind (the `source_repo` of existing lanes), the Add-lane modal's new/existing branch toggle + worktree list + Advanced disclosure (`AddLaneModal.tsx`), and the two new client components `LaneGitBar.tsx` (now in the Changes panel, via `LaneGitHeader`) and `LaneChangesPanel.tsx` (the collapsible Changes card beside `lane-detail` in `Workspace.tsx`, `agenthub.workspace.changesOpen`) + v1.6.17 (2026-09-18) + the run's permission mode defaulting to `auto` and the model picker sending ALIASES (`ALLOWED_PERMISSION_MODES` in `server/lib/pty-run.js` + `server/routes/run.js` gained `auto`, which is also the fallback `buildClaudeArgv` passes to `--permission-mode`, the `RunSetup` select's first option and `LaneConsolePane`'s initial state; and `RUN_MODEL_CHOICES` in `client/src/lib/api.ts` now holds `fable`/`opus`/`sonnet`/`haiku` instead of pinned ids — `claude --model` resolves an alias to the latest model itself, so a release like Fable 5.1 needs no edit here, and pricing is unaffected because it keys off the resolved id the transcript reports) + `convertEol` being GONE from the xterm terminal (`TerminalView.tsx`) — it rewrote every bare LF as CR+LF, so a tmux pane that scrolled (tmux emits a bare LF and keeps drawing at the column it was on) had the rest of that draw land at column 0, stamping a line's first characters into the left margin of the rows below: the torn left edge of issue #33, which the attach-size fix alone did NOT cure + the lane pane inheriting the graphical session's `DISPLAY`/`WAYLAND_DISPLAY`/`XAUTHORITY`/`XDG_RUNTIME_DIR` (`server/lib/desktop-env.js`, merged into `spawnRun`'s tmux `-e` env) — a systemd user service has none of them, so `claude` in a dashboard-started pane could not read the clipboard and answered "no image found in clipboard" on every image paste + the PTY attach carrying the client's REAL size (`sizeFromQuery` in `server/websocket.js`, `?cols=&rows=` on the `/ws-pty/:runId` URL built in `TerminalView.tsx`) — `attach()` was spawning `tmux attach-session` at a hardcoded 80×24 on EVERY attach, and tmux sizes the window to the newest client, so `claude` redrew its whole UI at 80 columns until the first `resize` message landed and that width stayed in the scrollback as the torn left-margin fragments of issue #33 + the Workspace's no-lane state being a real banner (`lane-empty` in `client/src/pages/Workspace.tsx`, `empty.title`/`empty.body` in `lanes.json` replacing `emptyState`) — the lane strip, add tile included, now renders only when a lane exists + the **Create/update readme file** action living in the lane's **Tools** menu (`LaneToolsMenu` in `client/src/components/lanes/LaneCard.tsx`, `actions.writeDocs*` in `lanes.json`) instead of being a checkbox in the Add-lane modal — same `api.run.start({initialPrompt: "/sg-all:sg-md-writing"})`, claude lanes only, but re-runnable long after creation + the lane terminal taking focus on mount and reporting its own death (`TerminalView.tsx`: `term.focus()` after the first fit, so typing reaches tmux without clicking the pane, and a new `onExit` prop — read through a ref so an inline parent callback never re-attaches the socket — fired on the server's `exit` frame; `LaneConsolePane` runs `newRun()` there, so a double Ctrl+C out of `claude` lands back on the run setup form instead of a dead pane behind a **New run** button) + the run console pre-filling NOTHING into the prompt box and a resume sending NO prompt (`LaneConsolePane.tsx`'s `promptPrefill` is gone — picking a pipeline used to write its driving slash command into the box on a claude lane and a stage-declaration checklist on a codex one, and whatever sits there is sent as a real prompt the moment the run starts; `handleStart` in `RunSetup.tsx` now drops `initialPrompt` entirely when a session is being resumed, since a resume carries its own transcript and anything typed would fire an extra turn into it) + browser notifications falling back when the push landed NOWHERE (`notify()` in `client/src/hooks/useNotifications.ts`): `POST /api/push/send` answers 200 with `{native:false, pushed:0}` whenever this browser has no push subscription — no service worker, a non-secure origin like `http://<lan-ip>:4820`, an unreachable push service — and the client counted that as delivered, so nothing ever appeared; delivery is now `native || pushed > 0` and anything else shows the notification locally (skipped when the push DID land, or every one would be doubled). The `Notification` API still needs a secure context, so a bare LAN IP can show nothing at all + auth-profile switching reading and writing the macOS **login Keychain** (`readCredentials`/`writeCredentials` in `server/lib/cc-profiles.js`): on darwin the `claude` CLI keeps `claudeAiOauth` in the generic-password item `Claude Code-credentials` (account `$USER`), never in `<CLAUDE_HOME>/.credentials.json` — so a switch rewrote a file nothing reads and the CLI kept running as the previous account. The Keychain wins when it holds an item, the file stays the fallback and is kept in step only when it already exists, and `AGENTHUB_CC_KEYCHAIN=0` pins the file (the test suite sets it so a Mac dev run never touches the real Keychain) + turn bookkeeping being idempotent (`stmts.insertEventAt` in `server/db.js`, used for `TurnDuration` with the TRANSCRIPT's timestamp — its dedup guard matches on `created_at`, so a NOW stamp made every hook re-insert the session's whole turn history: 587k rows, 75% of the events table — and `meta.thinking_blocks`/`turn_count`/`total_turn_duration_ms` now ASSIGNED from the full parse instead of `+=`, since `extract()` returns whole-transcript totals every time) + `hasLegacyHooks` blocking `fastPathOk` (`scripts/plugin-bootstrap.js`): leftover checkout hook entries double EVERY event and subagent row, `stripLegacyHooks` only ever ran inside `bootstrap()`, and the fast path skipped it on exactly the healthy installs where it mattered + the one-time repair marker moving to `user_version` 3 (`server/index.js`) — it now also deletes the duplicated `TurnDuration` rows, and 2 could not be trusted because an old build still ingesting hooks re-inflated whatever that pass corrected + a router switch on a LIVE pane reporting itself (`POST /api/lanes/:id/router/apply` now answers `restart_required`/`run_id` when `runs.getRun(runIdForLane(id))` is live, and `LaneRouterRow` renders a **Restart** button that kills that pane and restarts it from the lane id alone — Claude Code re-applies `env` to a running session but keeps the model it resolved at startup, so the old router's model name reaches the new endpoint and the next prompt fails) + the sidebar brand being the SmartGift wordmark with the `AgentHub` caption under it and the vendored `client/public/favicon.ico` (`Sidebar.tsx`, `client/index.html`, `client/public/manifest.json`) + the two "Claude is waiting for YOU" notification types (`client/src/lib/notifPrefs.ts` — the ONE definition of the prefs shape/defaults/storage, now imported by both `Settings.tsx` and `useNotifications.ts`; `onAwaitingInput` and `onTurnComplete` default ON, issue #29) + per-message token counting (`lastUsageMsgId` in `server/lib/transcript-cache.js` and both parsers in `scripts/import-history.js`: Claude Code writes ONE JSONL line per content block of an assistant message and each repeats the same message-level `usage`, so summing lines over-counted tokens and cost ~1.5–2× on tool-heavy sessions) + `stmts.setTokenUsage` (`server/db.js`) — the EXACT counterpart of `replaceTokenUsage`, used only by `reconcileTokens`, because the high-water `baseline_*` columns make a downward CORRECTION impossible; the server runs that reconcile once in the background at the first start after upgrading (`user_version` 2, `server/index.js`) + v1.6.12 (2026-09-18) + the same three rules in `skills/ship-feature-lane/SKILL.md` (three scheduled touchpoints now: Stage 0 Q&A, Stage 0b plan approval, Stage 7 acceptance before the PR is published — the publish rule and the turn-liveness rule name them) + the `default` 8-node pipeline asking the user twice and looping on a NO-GO (`skills/ship-feature/SKILL.md` + `server/data/pipelines/default.json`: `intake` now DECLARES `/superpowers:brainstorming` and detects it, the `plan` phase blocks on an explicit approval, `ship-feature` gained the four sections that make a long run followable and affordable (**Right-size the run** — trivial work does not enter the pipeline and a small change skips the plan-debate/independent-test/gate agents, **Dispatching a judgement** — the fresh-context/foreground/never-fork/never-dispatch-what-a-command-answers contract written ONCE instead of re-argued per phase, **Resuming after a compaction**, and a per-phase **Leave when:**), `review` DECLARES the bare `/code-review` (Claude Code's own, no `plugin:` prefix — `requiredSkillPlugins` skips it, so it adds no install requirement) and runs it always and a domain reviewer only for the layers `git diff --name-only` shows, and `gate` requires the user's acceptance — a NO-GO re-declares `implementing` or `plan` instead of proceeding) + `KEEP_RETIRED_ROOTS` dropping to 1 (`scripts/plugin-bootstrap.js`) + lane removal being record-only (the `remove` branch in `server/routes/lanes.js` no longer calls `removeWorktree`/`removeLaneData`, so a worktree, its branch and its database survive forgetting a lane — see the rule under **Lanes**) + v1.6.10 (2026-09-17) + per-profile Claude quota (`server/lib/cc-usage.js`, `POST /api/cc-config/profiles/usage`, the **Check quota** button in the Profiles modal) — a POST because a saved profile's token is normally expired, so answering refreshes it and the refresh ROTATES the credentials written back to disk, which is also why it never runs on a poll; the LIVE account is the exception and is read from `.credentials.json` via `cc-profiles.liveCredentialsFor`, never refreshed, because the CLI has already retired the refresh token its profile copy holds + the settings patch that changes nothing now writing nothing (`patchSettings` in `server/lib/cc-mutate.js`, plus `.claude/.cc-config-backups/` in a lane's git exclude) + the Add-lane modal closing itself on a clean setup and offering a real Close when a step failed + a lane's router pick no longer landing on whichever lane the user switched to mid-apply (`LaneRouterRow`), nor reverting on the next lane switch — `POST /api/lanes/:id/router/apply` now `broadcastLane`s like every other mutating lane route, so the client's cached row stops disagreeing with what was written + a run being opened by a DECLARATION only — a backwards DETECTION now continues the run in flight (`appendStageEvent` in `server/lib/lanes.js`), because detection bounces within one feature and `runs` is what every pass rate on the Workflows page is divided by + `SETTLE_MS` in `server/lib/cc-reload.js` — the two reload commands are typed a second apart, and `reloadOpenSessions` is now async, because Claude Code swallows the Enter after a slash command and back-to-back sends merged into one composer line + v1.6.0 (2026-09-14) + the lane strip's drag/Alt-arrow reordering and inline rename (`client/src/lib/laneOrderStorage.ts`, `LaneStripCard`'s `index`/`onReorder` props, the Workspace detail header's rename field, and `normalizeTitle`/`bindable` in `server/lib/lanes.js`) + the uncommitted-files hover panel (`LaneGitFilesPanel`, now in `LaneGitHeader`, and `files` from `GET /api/lanes/:id/git` now being `{path,status,added,deleted}` records off one extra `git diff --numstat HEAD`) + AI Router profiles (`server/lib/ai-routers.js`, `server/lib/router-apply.js`, the Settings tab `/settings?tool=ai-router`, its **Test** button / `POST /api/ai-routers/test`, the per-lane router select — labelled **Model**, `LaneRouterRow` exported from `LaneCard` and rendered in the Workspace lane-detail header row — and `lanes.router_profile`) + the bootstrap's superseded-build guard and plugin-cache pruner (`supersededBy`/`pruneRetiredPluginRoots` in `scripts/plugin-bootstrap.js`, `unitRoot` in `scripts/systemd-service.js`) + v1.5.6 (2026-09-11) + the systemd handover rule below (`scripts/systemd-service.js`'s `writeUserService`/`restartUserService` split and `plugin-bootstrap.js`'s deferred `pendingSystemdRestart`) + eb63569 (2026-09-10) + release-based update detection (`server/lib/update-check.js` reads the forge releases API — a checkout via its `origin` remote, a plugin-cache install via the marketplace manifest on disk, since an archive-sourced cache dir has no `.git`; a `plugin_managed` install self-updates via the detached `plugin-update` chain) + the install-wide **Update all** batch and session reload (`server/lib/cc-update-all.js`, `server/lib/cc-reload.js`)._ A change that makes any statement in this file, `AGENTS.md`, or a README wrong — a moved path, a new or changed extension point, a retired rule — updates that file in the same change-set and bumps this marker.
 
 ## Project mission
 - Maintain a reliable local-first dashboard for Claude Code session monitoring.
@@ -21,7 +21,7 @@ A **lane** is a durable unit of parallel agent work — one working directory, m
 - Sessions are bound to lanes by longest path-boundary prefix match on their `cwd` (set in hook data from `claude` CLI).
 - A lane's stage is **declared** by the driving Claude session (via `agenthub stage <stage> [--evidence "..."]`), not inferred by the dashboard.
 - **A CLI command resolves its lane by (cwd, tool), never cwd alone.** `resolveLaneArg` (`bin/agenthub.js`) answers in order: `--lane`/leading id → `AGENTHUB_LANE_ID` (every tmux pane the dashboard starts carries it, via `tmux new-session -e`) → `--tool`, else the harness marker (`CLAUDECODE` ⇒ claude; Codex has NO reliable env marker, so it passes `--tool codex`) → the owning lane. Two candidates at one directory and no signal is an ERROR that names both, never a pick — writing a codex session's stage onto the claude lane's card is a lie about which agent did the work.
-- **The console never writes a lane's stage.** Declared stages come from `agenthub stage` (a skill calling the CLI command), and inferred stages come from tool-event detection only. **`codex` and `antigravity` lanes carry no pipeline at all:** `codex-ingest.js` mirrors only their `status` (idle↔running) and never writes `stage` or a detection, and the Workspace hides stage, pipeline/feature pickers and PipelineMap for them. Do not bring stage inference back for them. The UI's run console and the Workspace page never call `POST /api/lanes/:id/stage` — that boundary exists because the console observes tool calls but cannot see their outcomes. A lane's stage is the session's truth about progress; the console's observation of tool execution would not be proof of completion.
+- **The console never writes a lane's stage.** Declared stages come from `agenthub stage` (a skill calling the CLI command), and inferred stages come from tool-event detection only. **Every non-`claude` lane (`codex`, `antigravity`, any other AI Tools id) carries no pipeline at all:** `codex-ingest.js` mirrors only their `status` (idle↔running) and never writes `stage` or a detection, and the Workspace hides stage, pipeline/feature pickers and PipelineMap for them. Do not bring stage inference back for them. The UI's run console and the Workspace page never call `POST /api/lanes/:id/stage` — that boundary exists because the console observes tool calls but cannot see their outcomes. A lane's stage is the session's truth about progress; the console's observation of tool execution would not be proof of completion.
 - **Going back is a declaration, and it takes the nodes ahead with it.** A declaration landing on a node BEFORE the lane's current one (a fix-loop re-entry, or a new request on a lane that already reached `done`) clears the detection columns like every real transition AND drops the `stages` records of every node ahead of it — those belong to the previous pass, and left in place they render `done` with the old work's evidence beside a `current` ring further back, contradicting `progress` (computed from the declared index alone). Records under a key matching no node are left alone: unplaceable, so unprovably ahead. `agenthub feature activate <slug>` is the other half of this — a feature switch archives the outgoing pipeline and clears detection too, because a detection belongs to the feature that produced it.
 - **A detection expires, an evidence rule does not.** `recordDetection` skips its forward-only comparison once `detected_at` is older than `DETECTION_TTL_MS` (default 5 min), so a lane can move backwards between work sessions. That window changes only WHICH detection is current — it never relaxes declared-wins (an agent's own claim has no expiry) and never lets an inferred node render `done`. Declared-wins has exactly ONE exception: a declaration on the pipeline's LAST node (`done`) stops vetoing, because the pipeline is over there and a later detection is new work — without it a lane left at `done` rejects every detection for the rest of its life.
 - **Working-copy facts live at `GET /api/lanes/:id/git`, never inside `GET /api/lanes`.** That endpoint shells out to git five times; the lane list is polled and re-broadcast on every hook. A cwd that is not a readable repo returns `{available:false}` with HTTP 200 — a normal state, not a fault. The Changes panel fetches it itself (`useLaneGitFacts`, every 30s and after each git write) and fails silently.
@@ -38,7 +38,7 @@ A **lane** is a durable unit of parallel agent work — one working directory, m
 - **A lane's AI Router profile is a lane fact too, and it never travels alone.** `lanes.router_profile` (nullable; null means the same as `native`) is written ONLY by `setRouterProfile`, called beside the disk write in `POST /api/lanes/:id/router/apply` — never through `PATCHABLE`. The column and the lane's own config must move together, or the row claims a router the lane's `settings.local.json` has never heard of. What is written comes from the lane row, never the request: a **claude** lane gets eight `env` keys merged into `<cwd>/.claude/settings.local.json` (`.local` because the value carries an API key; every other key in that file is preserved and a non-JSON file is refused, not rewritten), a **codex** lane gets `$CODEX_HOME/<name>.config.toml` — the layer `codex -p <name>` loads — because Codex has NO project-level config, and its base `config.toml` is never touched. Key material never leaves the server: profiles live at `<CLAUDE_HOME>/agenthub-routers/` (0700/0600), `GET /api/ai-routers` reports only `hasKey`, and there is deliberately no route that returns one profile in full. **`POST /api/ai-routers/test` sends a stored key ONLY to the endpoint it was stored against** — a blank `apiKey` falls back to the profile named by `name`, but only while the submitted `baseUrl` still equals the saved one, else `EBADKEY`. Relax that and the route becomes a way to make the server POST a saved key to any URL a browser names. **Re-pointing a lane is allowed and is not a PATCH:** the lane card's AI Router select calls `POST /api/lanes/:id/router/apply` (column + disk together, same rule as above), never `PATCH /api/lanes/:id`. **Codex's key reaches the pane through tmux's `-e` argv and is never typed into it** — `tmux.sendCommand` takes over an idle pane with `respawn-pane` for exactly this reason; a `KEY='sk-…' codex …` line typed with `send-keys` would be rendered to every attached browser, kept in the scrollback and appended to the user's shell history. Do not reintroduce a typed command line there. **And attaching COPIES a profile**, so the store stops being the single source of truth the moment a lane exists: `PATCH`/`DELETE /api/ai-routers/:name` must push through to the lanes naming it (`reapplyToLanes`/`detachFromLanes`), or a rotated key silently never reaches the lane still using the revoked one. See `server/lib/ai-routers.js`, `server/lib/router-apply.js`.
 - **The dashboard's git writes are these seventeen, and the guards are IN `git-ops.js`, not in the UI.** `POST /api/lanes/:id/git/:action` offers `fetch`, `pull`, `push`, `stage`, `unstage`, `discard`, `stage-hunk`, `discard-hunk`, `commit`, `switch`, `branch-create`, `branch-delete`, `publish`, `merge`, `resolve`, `merge-commit`, `merge-abort` — nothing else. **`publish` is the ONE write that takes a destination from the request** (`{url}`), so it can only give a remote to a repo that has NONE: it refuses before the first commit (`ENOCOMMITS`) and whenever `git remote` prints anything (`EREMOTEEXISTS` — it never re-points a remote, so it cannot redirect a repo that already publishes somewhere), the name is always `origin`, the URL passes `validateRemoteUrl`'s allowlist (`https://` with NO userinfo, `ssh://`, scp-like `user@host:path` — never a local path, `file://`, `ext::`, `fd::`, `git://`, `http://` or anything starting with `-`), it runs `remote add origin -- <url>` then the same `push -u origin HEAD` as `push`, and a failed push removes `origin` again. That is still weaker than the AI-router "a key goes only to its stored endpoint" rule — a browser on the dashboard's origin can publish a remote-less repo to any allowlisted host — so do not widen the allowlist or let it touch a repo that already has a remote. **A path in the body is never a path**: `resolvePaths` accepts only what `git status` is reporting as changed right now, which is the whole authorization story for the per-file actions (no `..`, no absolute path, no untouched file). `discard`, `discard-hunk` and `merge-abort` are the irreversible actions and all refuse to run without `confirm: true`; do not add another destructive action without the same gate. `branch-create` never switches (the reason to create one from a lane is a sibling worktree, not moving a working agent's HEAD) and `branch-delete` is `-d`, never `-D`, refusing `main`/`master`/`development`/`develop`, the current branch and one another worktree holds. `pull` is ALWAYS `--ff-only` and `switch` refuses a dirty tree, so neither can invent a merge commit or a conflict underneath a running agent; `push` pushes `HEAD`, never a branch name from the request; `commit` passes its message as one argv element. **The lane is the boundary, not the repo**: a subdir lane's reads and writes stay under its own cwd, and no read may return a `settings.local.json` (`ESECRET`) — do not add a git read that skips `lanePath`/`isSecret`. **A merge is the one history-joining action, and only because its recovery is a button too** (`merge-abort`): it starts only by name, on a clean tree, from a lane at the repo ROOT (`ESUBDIR` — a merge is repo-wide and a subdir lane could not resolve a conflict outside itself), one at a time (`pull`/`switch`/`merge`/hunk actions answer `EMERGING` meanwhile); the ref is looked up in `refs/heads`+`refs/remotes`, never passed through; a conflicted file is resolved only through `resolve` (ours/theirs, or `done` once no conflict marker is left — `stage` refuses a conflicted file that still has markers, `EMARKERS`), and `merge-commit` refuses while anything is unmerged (`ECONFLICTS`). Do not add rebase, reset or stash here: a dashboard click is the wrong place to start an operation whose recovery needs a terminal, and `reset` already lives behind `worktree.js`'s three-check destroy guard. A button that looks disabled in `LaneGitBar` is a courtesy; the refusal that matters is the server's. Reads (`/git`, `/git/changes`, `/git/log`, `/git/file`, `/git/ls`, `/git/tree`, `/git/branches`) stay unguarded like `/git` always was, and resolve their repo from the LANE ROW — `GET /api/lanes/branches` is the only one that takes a path from the request, because its lane does not exist yet.
 - **AgentHub's git credentials are its OWN store, shared by every user of the install, and git is given ONLY that store when it holds a login for the host.** `server/lib/git-credentials.js` keeps one record per `protocol + host` under `<CLAUDE_HOME>/agenthub-git-credentials/` (0700/0600) and no route ever returns a password (`hasToken` only). `gitConfigFor` runs a network action with `-c credential.helper= -c credential.helper=<ours>` whenever AgentHub holds a login for a repo remote's host or the request carries one — the machine's helpers are left out on purpose: a stale token there would win over the typed one, and git's post-success `store` would copy a use-once token into the OS user's helper. The secret travels in the helper's env or the store file, never argv. A typed credential is accepted only for one of the repo's OWN remote hosts (`EBADHOST`), so a login is never sent to a server it was not typed for, and it is saved only after git SUCCEEDED and `remember` is set. Do not add a route that returns a stored password or a path that forwards one to a host other than its own.
-- **A lane's `tool` is a lane fact, immutable, and never read from a request.** `lanes.tool` (`claude` | `codex` | `antigravity`, default `claude`) is set by `createLane` only — it is deliberately absent from `PATCHABLE`, so no PATCH can flip the CLI under a live pane. Every spawn path (`POST /api/lanes/:id/start`, `POST /api/run`) takes the tool from the lane row and ignores whatever the body says; the run panel's Codex-only fields (`sandbox`, `approval`, `resumeLast`) are validated against the fixed allowlists in `server/lib/pty-run.js` before they reach an argv, and the bypass flags (`--dangerously-bypass-approvals-and-sandbox`, `--dangerously-bypass-hook-trust`, `agy`'s `--dangerously-skip-permissions`) are never emitted. An `antigravity` lane runs `agy` and gets only `--continue` (resume) and `-i <prompt>` — `agy` has no model/effort/permission flag — and, like codex, carries no pipeline; it also takes no AI Router (`applyRouterToLane` accepts only `native` for it, else `EUNSUPPORTED`). `GET /api/run/binary?tool=` resolves the probed binary name from that same allowlist — the query string reaches `which`.
+- **A lane's `tool` is a lane fact, immutable, and never read from a request — and it is an AI Tools catalog id.** `lanes.tool` (default `claude`) is any id `server/lib/ai-tools.js` knows; `createLane` refuses an unknown one (`EBADTOOL`) and one the user disabled (`EDISABLED` — only CREATION asks, an existing lane on a tool disabled since keeps working), and it is deliberately absent from `PATCHABLE`, so no PATCH can flip the CLI under a live pane. Every spawn path (`POST /api/lanes/:id/start`, `POST /api/run`) takes the tool from the lane row and ignores whatever the body says; a lane whose tool left the catalog answers `ENOTOOL` at start. `claude`/`codex` keep their hand-written argv builders (`launcher` in their catalog file — a `DASHBOARD_AI_TOOLS_DIR` file may NOT claim one); every other tool is started by its detected absolute path as `[path, ...args, ...resume?, ...bypass?, ...prompt]`, every piece but the prompt from its catalog file, the prompt ONE argv element or, for an `after-start` tool, a tmux paste buffer (`tmux.pasteText`) after `delayMs`. Codex-only fields (`sandbox`, `approval`) are validated against the fixed allowlists in `server/lib/pty-run.js`. **Bypass args are emitted ONLY when the run request carries `bypass: true`** — the run form's red per-run switch, never remembered — and they come from the tool's catalog file (Codex: `--dangerously-bypass-approvals-and-sandbox`, which then replaces `-s`/`-a`); Claude has none (it has the `bypassPermissions` mode), and `--dangerously-bypass-hook-trust` is never emitted. Every pane gets the dashboard's hydrated `PATH` through tmux `-e`. Only `claude`/`codex` are `routerCapable`; `applyRouterToLane` accepts only `native` for any other tool, else `EUNSUPPORTED`. `GET /api/run/binary?tool=` resolves through the catalog — the query string never names a command. Do not add a route that takes a command, args or env for a tool from a request.
 - **A lane's card position is a viewer preference; its name is a lane fact.** The Workspace strip's drag/Alt-arrow order lives in `localStorage` (`agenthub.workspace.laneOrder`, `client/src/lib/laneOrderStorage.ts`) and writes NOTHING server-side — `GET /api/lanes` and `agenthub lanes` stay in id order, so no `sort_order` column, no reorder route, no websocket message. Renaming is the opposite: it is `PATCH /api/lanes/:id` with `{title}`, the one lane column a user now types into directly, so `updateLane` normalizes it (`normalizeTitle`: trim, 200-char cap, `null` ⇒ `""`, because clearing is legitimate — every render is `lane.title || lane.cwd`). The rule is the column-wide one, not a special case for the field the UI exposes: `bindable` rejects any non-scalar patch value with `EBADFIELD` (`links` excepted — it is stored as JSON), and the route answers 400 for that AND for the `SQLITE_CONSTRAINT` family, rather than handing better-sqlite3 a datatype throw and reporting 500 on plain bad input.
 - **Adopted lanes are not destroyable.** A lane with `kind === "adopted"` may never have its worktree reset or removed; "removing" one only drops the dashboard's own record of it. This is enforced in code (`assertDestroyable`'s first check) — do not add a path that bypasses it.
 - **Removing a lane deletes the lane's RECORD and nothing else — for every kind, managed included.** `POST /api/lanes/:id/remove` stops the run and the stack, clears AgentHub's own runtime bookkeeping under `LANES_ROOT/.state/lane<slot>/`, and deletes the row. It calls neither `removeWorktree` nor `removeLaneData`: the working tree, its branch and the lane's database are the USER's data, and a mis-click on a dashboard row may never cost a branch's unpushed code. Deleting those is the user's own `git worktree remove` / `git branch -d` / db drop. Consequently `remove` has no unpushed-commits force-gate (only `reset` does) and no preflight blocker stops it. Do not add a "also delete the worktree" flag back onto this route.
diff --git a/client/src/components/lanes/AddLaneModal.tsx b/client/src/components/lanes/AddLaneModal.tsx
index 9e1369e5..287a0663 100644
--- a/client/src/components/lanes/AddLaneModal.tsx
+++ b/client/src/components/lanes/AddLaneModal.tsx
@@ -25,7 +25,8 @@ import { CwdAutocomplete } from "../run/RunSetup";
 import { FolderBrowseModal } from "./FolderBrowseModal";
 import { api } from "../../lib/api";
 import type { AiRouter, CwdSuggestion } from "../../lib/api";
-import type { Lane, LaneTool, LaneWorktree } from "../../lib/types";
+import type { Lane, LaneWorktree } from "../../lib/types";
+import { useAiTools } from "../../hooks/useAiTools";
 
 /** Polls the lane until the background `git worktree add` finishes (status
  *  leaves "provisioning"), or gives up after `timeoutMs`. Returns the final
@@ -109,7 +110,15 @@ export function AddLaneModal({
   const [routers, setRouters] = useState<AiRouter[]>([]);
   const [routersLoaded, setRoutersLoaded] = useState(false);
   const [branchesError, setBranchesError] = useState<string | null>(null);
-  const [tool, setTool] = useState<LaneTool>("claude");
+  // null = the default AI tool (Settings → AI Tools), resolved at submit time.
+  const [pickedTool, setPickedTool] = useState<string | null>(null);
+  const aiTools = useAiTools();
+  const defaultTool = aiTools.defaultId ?? "claude";
+  const tool = pickedTool ?? defaultTool;
+  const otherTools = aiTools.tools.filter((x) => x.installed && x.enabled && x.id !== defaultTool);
+  const noTools = aiTools.loaded && aiTools.defaultId === null;
+  const toolRouterCapable =
+    aiTools.byId(tool)?.routerCapable ?? (tool === "claude" || tool === "codex");
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [browseOpen, setBrowseOpen] = useState(false);
@@ -130,7 +139,7 @@ export function AddLaneModal({
     setBase("");
     setRouter("native");
     setRoutersLoaded(false);
-    setTool("claude");
+    setPickedTool(null);
     setBranchesError(null);
     setError(null);
     setBusy(false);
@@ -414,27 +423,49 @@ export function AddLaneModal({
 
         <div>
           <label className="mb-1 block text-xs text-fg-secondary">{t("addLaneToolHint")}</label>
-          <div className="flex items-center rounded-md border border-border bg-surface-2 p-0.5">
-            <Seg
-              active={tool === "claude"}
-              label={t("addLaneToolClaude")}
-              onClick={() => setTool("claude")}
-            />
-            <Seg
-              active={tool === "codex"}
-              label={t("addLaneToolCodex")}
-              onClick={() => setTool("codex")}
-            />
-            <Seg
-              active={tool === "antigravity"}
-              label={t("addLaneToolAntigravity")}
-              onClick={() => {
-                setTool("antigravity");
-                // `agy` cannot run behind an AI Router (see router-apply.js).
-                setRouter("native");
-              }}
-            />
-          </div>
+          {noTools ? (
+            <p className="rounded-md border border-status-warning/40 bg-status-warning/10 px-2 py-1.5 text-xs text-status-warning">
+              {t("addLaneNoTools")}{" "}
+              <a href="/settings#ai-tools" className="underline">
+                {t("addLaneNoToolsLink")}
+              </a>
+            </p>
+          ) : (
+            <div className="flex items-center gap-1.5">
+              <div className="flex items-center rounded-md border border-border bg-surface-2 p-0.5">
+                <Seg
+                  active={tool === defaultTool}
+                  label={t("addLaneToolDefault", { tool: aiTools.label(defaultTool) })}
+                  onClick={() => setPickedTool(null)}
+                />
+              </div>
+              {otherTools.length > 0 && (
+                <select
+                  aria-label={t("addLaneToolOther")}
+                  value={tool === defaultTool ? "" : tool}
+                  onChange={(e) => {
+                    const next = e.target.value || null;
+                    setPickedTool(next);
+                    // A tool with no endpoint to rewrite runs native only
+                    // (see router-apply.js).
+                    if (next && !aiTools.byId(next)?.routerCapable) setRouter("native");
+                  }}
+                  className={`rounded-md border bg-surface-2 px-2 py-1 text-xs ${
+                    tool !== defaultTool
+                      ? "border-accent text-accent"
+                      : "border-border text-fg-secondary"
+                  }`}
+                >
+                  <option value="">{t("addLaneToolOther")}</option>
+                  {otherTools.map((x) => (
+                    <option key={x.id} value={x.id}>
+                      {x.label}
+                    </option>
+                  ))}
+                </select>
+              )}
+            </div>
+          )}
         </div>
 
         <div>
@@ -640,17 +671,17 @@ export function AddLaneModal({
             hid it. The pipeline picker is gone entirely: every lane is created
             on `default` (the server's own default) and the template is changed
             from the lane's own header afterwards. */}
-        <div
-          className="rounded-md border border-border-light bg-surface-0 p-2"
-          hidden={tool === "antigravity"}
-        >
+        <div className="rounded-md border border-border-light bg-surface-0 p-2">
           <div>
             <fieldset>
               <legend className="mb-1 text-xs text-fg-secondary">{t("addLaneRouterLabel")}</legend>
               <div className="flex gap-2">
                 {(
                   [
-                    { value: "native", label: t("addLaneRouterNative") },
+                    {
+                      value: "native",
+                      label: t("addLaneRouterNativeTool", { tool: aiTools.label(tool) }),
+                    },
                     { value: "router", label: t("addLaneRouterCustom") },
                   ] as const
                 ).map((option) => {
@@ -658,10 +689,16 @@ export function AddLaneModal({
                     option.value === "native" ? router === "native" : router !== "native";
                   // Clicking "AI Router" before the list lands would resolve back to
                   // Native and read as a dead control.
-                  const disabled = option.value === "router" && !routersLoaded;
+                  const disabled =
+                    option.value === "router" && (!routersLoaded || !toolRouterCapable);
                   return (
                     <label
                       key={option.value}
+                      title={
+                        option.value === "router" && !toolRouterCapable
+                          ? t("router.nativeOnly", { tool: aiTools.label(tool) })
+                          : undefined
+                      }
                       // No radio dot: the card itself lights up when selected. That
                       // leaves the DISABLED state with nothing to show it, since the
                       // greyed-out dot was carrying it — hence the explicit branch.
diff --git a/client/src/components/lanes/LaneCard.tsx b/client/src/components/lanes/LaneCard.tsx
index d1759f9a..129446e5 100644
--- a/client/src/components/lanes/LaneCard.tsx
+++ b/client/src/components/lanes/LaneCard.tsx
@@ -30,6 +30,7 @@ import { eventBus } from "../../lib/eventBus";
 import { keepIfSame } from "../../lib/keepIfSame";
 import type { AiRouter } from "../../lib/api";
 import type { Lane, LaneRuntime, NamedLock } from "../../lib/types";
+import { useAiTools } from "../../hooks/useAiTools";
 
 /** How often a mounted card re-probes its stack. Faster than the Changes panel's
  *  git refresh because a stack dying is exactly what the user needs to see, and slower than
@@ -120,6 +121,13 @@ function useLaneLocks(laneSlot: number | null): NamedLock[] {
  */
 export function LaneRouterRow({ lane }: { lane: Lane }) {
   const { t } = useTranslation(["lanes"]);
+  const aiTools = useAiTools();
+  const toolLabel = aiTools.label(lane.tool || "claude");
+  // Only Claude and Codex have an endpoint/model override to write; every
+  // other tool is offered native alone (the server refuses the rest anyway).
+  const routerCapable =
+    aiTools.byId(lane.tool || "claude")?.routerCapable ??
+    (lane.tool === "claude" || lane.tool === "codex" || !lane.tool);
   const [routers, setRouters] = useState<AiRouter[] | null>(null);
   const [current, setCurrent] = useState(lane.router_profile || "native");
   const [busy, setBusy] = useState(false);
@@ -225,8 +233,15 @@ export function LaneRouterRow({ lane }: { lane: Lane }) {
         className="max-w-40 truncate rounded border border-border bg-surface-1 px-2 py-0.5 text-fg-secondary disabled:opacity-50"
       >
         {routers.map((r) => (
-          <option key={r.name} value={r.name}>
-            {r.label}
+          <option
+            key={r.name}
+            value={r.name}
+            disabled={!r.builtin && !routerCapable}
+            title={
+              !r.builtin && !routerCapable ? t("router.nativeOnly", { tool: toolLabel }) : undefined
+            }
+          >
+            {r.builtin ? t("router.native", { tool: toolLabel }) : r.label}
           </option>
         ))}
       </select>
diff --git a/client/src/components/lanes/LaneStripCard.tsx b/client/src/components/lanes/LaneStripCard.tsx
index 83e834d1..29313c59 100644
--- a/client/src/components/lanes/LaneStripCard.tsx
+++ b/client/src/components/lanes/LaneStripCard.tsx
@@ -18,7 +18,7 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import type { Lane } from "../../lib/types";
-import { LANE_TOOL_LABEL } from "../../lib/types";
+import { useAiTools } from "../../hooks/useAiTools";
 
 const LIVENESS_DOT: Record<Lane["liveness"], string> = {
   active: "bg-status-success",
@@ -65,6 +65,7 @@ export default function LaneStripCard({
   onReorder: (from: number, to: number) => void;
 }) {
   const { t } = useTranslation(["lanes"]);
+  const { label: toolLabel } = useAiTools();
   const [dropTarget, setDropTarget] = useState(false);
 
   return (
@@ -120,7 +121,7 @@ export default function LaneStripCard({
             installed; the others show their CLI's tag in place of the stage chip. */}
         {lane.tool !== "claude" || lane.pipeline_nodes.length === 0 ? (
           <span className="shrink-0 rounded border border-border bg-surface-2 px-1.5 py-0.5 text-[10px] text-fg-muted">
-            {LANE_TOOL_LABEL[lane.tool]}
+            {toolLabel(lane.tool)}
           </span>
         ) : (
           <span className="truncate rounded bg-surface-4 px-1.5 py-0.5 text-fg-secondary">
diff --git a/client/src/components/lanes/__tests__/AddLaneModal.test.tsx b/client/src/components/lanes/__tests__/AddLaneModal.test.tsx
index d0992e2a..07c518e9 100644
--- a/client/src/components/lanes/__tests__/AddLaneModal.test.tsx
+++ b/client/src/components/lanes/__tests__/AddLaneModal.test.tsx
@@ -14,7 +14,8 @@ import { render, screen, waitFor } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { AddLaneModal } from "../AddLaneModal";
 import { api } from "../../../lib/api";
-import type { CwdSuggestion } from "../../../lib/api";
+import type { AiTool, AiToolsView, CwdSuggestion } from "../../../lib/api";
+import { __resetAiTools } from "../../../hooks/useAiTools";
 import type { Lane } from "../../../lib/types";
 
 vi.mock("../../../lib/api", () => ({
@@ -31,10 +32,38 @@ vi.mock("../../../lib/api", () => ({
       routerApply: vi.fn(),
     },
     aiRouters: { list: vi.fn() },
+    aiTools: { list: vi.fn() },
     run: { start: vi.fn() },
   },
 }));
 
+const tool = (id: string, label: string, over: Partial<AiTool> = {}): AiTool => ({
+  id,
+  label,
+  command: id,
+  homepageUrl: null,
+  installed: true,
+  path: `/usr/bin/${id}`,
+  enabled: true,
+  source: "builtin",
+  launcher: null,
+  prompt: { mode: "argv" },
+  resume: false,
+  bypass: false,
+  routerCapable: false,
+  ...over,
+});
+const TOOLS: AiToolsView = {
+  default: "claude",
+  tools: [
+    tool("claude", "Claude Code", { launcher: "claude", routerCapable: true, prompt: null }),
+    tool("codex", "Codex", { launcher: "codex", routerCapable: true, prompt: null }),
+    tool("gemini", "Gemini"),
+    tool("aider", "Aider", { installed: false, path: null }),
+    tool("grok", "Grok", { enabled: false }),
+  ],
+};
+
 function laneFixture(over: Partial<Lane> = {}): Lane {
   // `as Lane`: spreading a Partial<Lane> widens every field it may carry to
   // `T | undefined`, which no longer satisfies Lane's required fields. The
@@ -107,6 +136,8 @@ async function fillWorktreeForm(
 }
 
 beforeEach(() => {
+  __resetAiTools();
+  vi.mocked(api.aiTools.list).mockReset().mockResolvedValue(TOOLS);
   vi.mocked(api.lanes.branches).mockReset();
   vi.mocked(api.lanes.worktree).mockReset();
   vi.mocked(api.lanes.ensure).mockReset();
@@ -138,7 +169,7 @@ beforeEach(() => {
 function nativeRouter() {
   return {
     name: "native",
-    label: "Native (Claude / Codex)",
+    label: "Native",
     builtin: true,
     baseUrl: "",
     hasKey: false,
@@ -649,7 +680,7 @@ describe("AddLaneModal — AI Router", () => {
     const user = userEvent.setup();
     await user.click(await screen.findByRole("radio", { name: "AI Router" }));
 
-    expect(screen.getByRole("radio", { name: "Native" })).toBeChecked();
+    expect(screen.getByRole("radio", { name: /^Native/ })).toBeChecked();
     expect(screen.getByText(/No router profile saved yet/)).toBeInTheDocument();
   });
 
@@ -716,7 +747,7 @@ describe("AddLaneModal — a router profile that disappeared", () => {
     rerender(<AddLaneModal open={false} onClose={vi.fn()} onAdded={vi.fn()} cwdSuggestions={[]} />);
     rerender(<AddLaneModal open onClose={vi.fn()} onAdded={vi.fn()} cwdSuggestions={[]} />);
 
-    await waitFor(() => expect(screen.getByRole("radio", { name: "Native" })).toBeChecked());
+    await waitFor(() => expect(screen.getByRole("radio", { name: /^Native/ })).toBeChecked());
   });
 
   it("does not offer AI Router until the profile list has arrived", async () => {
@@ -751,7 +782,14 @@ describe("AddLaneModal — tool selection", () => {
     const dirField = screen.getByLabelText("Directory");
     await focusField(user, dirField);
     await user.type(dirField, "/tmp/demo");
-    await user.click(screen.getByRole("button", { name: /codex/i }));
+    const other = await screen.findByRole("combobox", { name: "Other…" });
+    // Installed + enabled only, and never the default itself.
+    expect(Array.from((other as HTMLSelectElement).options).map((o) => o.value)).toEqual([
+      "",
+      "codex",
+      "gemini",
+    ]);
+    await user.selectOptions(other, "codex");
     await user.click(screen.getByRole("button", { name: /add lane|create/i }));
 
     await waitFor(() =>
@@ -759,6 +797,24 @@ describe("AddLaneModal — tool selection", () => {
     );
   });
 
+  it("offers only Native for a tool that cannot use an AI Router", async () => {
+    renderModal({});
+    const user = userEvent.setup();
+    await user.selectOptions(await screen.findByRole("combobox", { name: "Other…" }), "gemini");
+    expect(screen.getByRole("radio", { name: "Native (Gemini)" })).toBeChecked();
+    expect(screen.getByRole("radio", { name: "AI Router" })).toBeDisabled();
+  });
+
+  it("says so, with a link to Settings, when no tool is installed and enabled", async () => {
+    vi.mocked(api.aiTools.list).mockResolvedValue({ default: null, tools: [] });
+    renderModal({});
+    expect(await screen.findByText(/No AI tool is installed and enabled/)).toBeInTheDocument();
+    expect(screen.getByRole("link", { name: /AI Tools/ })).toHaveAttribute(
+      "href",
+      "/settings#ai-tools"
+    );
+  });
+
   it("defaults to claude code", async () => {
     vi.mocked(api.lanes.ensure).mockResolvedValue({
       lane: laneFixture({ id: 24, kind: "adopted", status: "idle" }),
diff --git a/client/src/components/lanes/__tests__/LaneCard.test.tsx b/client/src/components/lanes/__tests__/LaneCard.test.tsx
index 9462628f..419b174d 100644
--- a/client/src/components/lanes/__tests__/LaneCard.test.tsx
+++ b/client/src/components/lanes/__tests__/LaneCard.test.tsx
@@ -378,7 +378,7 @@ describe("LaneToolsMenu", () => {
 describe("LaneRouterRow — the Model picker", () => {
   const native = {
     name: "native",
-    label: "Native (Claude / Codex)",
+    label: "Native",
     builtin: true,
     baseUrl: "",
     hasKey: false,
@@ -406,6 +406,16 @@ describe("LaneRouterRow — the Model picker", () => {
     expect(await screen.findByDisplayValue("9Router")).toBeInTheDocument();
   });
 
+  it("offers only native to a tool that cannot use an AI Router", async () => {
+    vi.mocked(api.aiRouters.list).mockResolvedValue({ items: [native, nineRouter] });
+    render(<LaneRouterRow lane={makeLane({ tool: "gemini" })} />);
+    const select = await screen.findByDisplayValue("Native (gemini)");
+    const router = Array.from((select as HTMLSelectElement).options).find(
+      (o) => o.value === "9router"
+    );
+    expect(router?.disabled).toBe(true);
+  });
+
   it("applies a switch through the router route, not a lane PATCH", async () => {
     vi.mocked(api.aiRouters.list).mockResolvedValue({ items: [native, nineRouter] });
     vi.mocked(api.lanes.routerApply).mockResolvedValue({
@@ -417,9 +427,7 @@ describe("LaneRouterRow — the Model picker", () => {
     });
     render(<LaneRouterRow lane={makeLane()} />);
 
-    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude / Codex)"), [
-      "9router",
-    ]);
+    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude)"), ["9router"]);
     await waitFor(() => expect(api.lanes.routerApply).toHaveBeenCalledWith(1, "9router"));
     expect(await screen.findByDisplayValue("9Router")).toBeInTheDocument();
   });
@@ -440,9 +448,7 @@ describe("LaneRouterRow — the Model picker", () => {
     vi.mocked(api.run.start).mockResolvedValue({} as never);
     render(<LaneRouterRow lane={makeLane()} />);
 
-    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude / Codex)"), [
-      "9router",
-    ]);
+    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude)"), ["9router"]);
 
     const restart = await screen.findByRole("button", { name: "Restart" });
     await userEvent.click(restart);
@@ -464,9 +470,7 @@ describe("LaneRouterRow — the Model picker", () => {
     });
     render(<LaneRouterRow lane={makeLane()} />);
 
-    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude / Codex)"), [
-      "9router",
-    ]);
+    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude)"), ["9router"]);
     await waitFor(() => expect(api.lanes.routerApply).toHaveBeenCalled());
     expect(screen.queryByRole("button", { name: "Restart" })).toBeNull();
   });
@@ -487,14 +491,14 @@ describe("LaneRouterRow — the Model picker", () => {
     const laneA = makeLane({ id: 1, router_profile: null });
     const laneB = makeLane({ id: 2, router_profile: null });
     const { rerender } = render(<LaneRouterRow lane={laneA} />);
-    await screen.findByDisplayValue("Native (Claude / Codex)");
+    await screen.findByDisplayValue("Native (Claude)");
 
     rerender(<LaneRouterRow lane={laneB} />);
-    await userEvent.selectOptions(screen.getByDisplayValue("Native (Claude / Codex)"), ["9router"]);
+    await userEvent.selectOptions(screen.getByDisplayValue("Native (Claude)"), ["9router"]);
     await waitFor(() => expect(api.lanes.routerApply).toHaveBeenCalledWith(2, "9router"));
 
     rerender(<LaneRouterRow lane={laneA} />);
-    expect(screen.getByDisplayValue("Native (Claude / Codex)")).toBeInTheDocument();
+    expect(screen.getByDisplayValue("Native (Claude)")).toBeInTheDocument();
   });
 
   it("does not roll a failed apply back onto a DIFFERENT lane the user has since switched to", async () => {
@@ -510,9 +514,7 @@ describe("LaneRouterRow — the Model picker", () => {
     const laneB = makeLane({ id: 2, router_profile: null });
 
     const { rerender } = render(<LaneRouterRow lane={laneB} />);
-    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude / Codex)"), [
-      "9router",
-    ]);
+    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude)"), ["9router"]);
     await waitFor(() => expect(api.lanes.routerApply).toHaveBeenCalledWith(2, "9router"));
 
     rerender(<LaneRouterRow lane={laneA} />);
@@ -521,7 +523,7 @@ describe("LaneRouterRow — the Model picker", () => {
       await Promise.resolve();
     });
 
-    expect(screen.getByDisplayValue("Native (Claude / Codex)")).toBeInTheDocument();
+    expect(screen.getByDisplayValue("Native (Claude)")).toBeInTheDocument();
     expect(screen.queryByTitle("EBADJSON")).toBeNull();
     // And the picker must not be left locked by a request for another lane.
     expect(screen.getByRole("combobox")).not.toBeDisabled();
@@ -532,10 +534,8 @@ describe("LaneRouterRow — the Model picker", () => {
     vi.mocked(api.lanes.routerApply).mockRejectedValue(new Error("EBADJSON"));
     render(<LaneRouterRow lane={makeLane()} />);
 
-    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude / Codex)"), [
-      "9router",
-    ]);
+    await userEvent.selectOptions(await screen.findByDisplayValue("Native (Claude)"), ["9router"]);
     await waitFor(() => expect(screen.getByTitle("EBADJSON")).toBeInTheDocument());
-    expect(screen.getByDisplayValue("Native (Claude / Codex)")).toBeInTheDocument();
+    expect(screen.getByDisplayValue("Native (Claude)")).toBeInTheDocument();
   });
 });
diff --git a/client/src/components/run/LaneConsolePane.tsx b/client/src/components/run/LaneConsolePane.tsx
index 9e38eeb8..8df41988 100644
--- a/client/src/components/run/LaneConsolePane.tsx
+++ b/client/src/components/run/LaneConsolePane.tsx
@@ -43,8 +43,8 @@ import type {
   CodexSandbox,
   CodexApproval,
 } from "../../lib/api";
-import type { Session, Lane, LaneTool } from "../../lib/types";
-import { LANE_TOOL_LABEL } from "../../lib/types";
+import type { Session, Lane } from "../../lib/types";
+import { useAiTools } from "../../hooks/useAiTools";
 import { TerminalView } from "./TerminalView";
 import { RunSetup } from "./RunSetup";
 import { ActiveRunsSwitcher } from "./RunHistory";
@@ -69,7 +69,7 @@ export interface LaneConsolePaneProps {
   showLaneSelector: boolean;
   onLaneIdChange: (id: number) => void;
   onLaneCreated: (lane: Lane) => void;
-  binaryStatus: Record<LaneTool, { found: boolean; path: string | null }> | null;
+  binaryStatus: Record<string, { found: boolean; path: string | null }> | null;
   cwdSuggestions: CwdSuggestion[];
   activeRuns: RunListResponse | null;
   /** Active Claude Code sessions started outside the dashboard, listed in the
@@ -150,7 +150,8 @@ export function LaneConsolePane({
         : (externalSessions ?? []).filter((s) => s.cwd && owningLaneId(s.cwd, lanes) === laneId),
     [externalSessions, laneId, lanes]
   );
-  const toolLabel = LANE_TOOL_LABEL[laneTool];
+  const aiTools = useAiTools();
+  const toolLabel = aiTools.label(laneTool);
 
   useEffect(() => {
     onHasActiveRunChange?.(handle !== null);
@@ -313,6 +314,7 @@ export function LaneConsolePane({
             sandbox: args.sandbox,
             approval: args.approval,
             resumeLast: args.resumeLast,
+            bypass: args.bypass,
           });
         } catch (laneErr: unknown) {
           // A code-only check: the server's message is human prose ("lane
@@ -566,12 +568,13 @@ export function LaneConsolePane({
         />
       </header>
 
-      {binaryStatus && !binaryStatus[laneTool]?.found && (
+      {/* Not probed yet (a lane on a tool the page has not probed) is not "missing". */}
+      {binaryStatus?.[laneTool] && !binaryStatus[laneTool].found && (
         <div className="rounded-lg border border-status-danger/40 bg-status-danger/10 px-4 py-3 text-sm text-status-danger flex items-center gap-2">
           <AlertCircle className="w-4 h-4 flex-shrink-0" />
           <span>
             {t("binary.missing", {
-              cli: laneTool === "antigravity" ? "agy" : laneTool,
+              cli: aiTools.byId(laneTool)?.command ?? laneTool,
               tool: toolLabel,
             })}
           </span>
@@ -613,7 +616,9 @@ export function LaneConsolePane({
           onSandboxChange={setSandbox}
           approval={approval}
           onApprovalChange={setApproval}
-          onResumeLast={() => onStartFromSetup({ laneId: laneId ?? 0, cwd, resumeLast: true })}
+          onResumeLast={(bypass) =>
+            onStartFromSetup({ laneId: laneId ?? 0, cwd, resumeLast: true, bypass })
+          }
         />
       ) : (
         <div className="flex-1 min-h-0 flex flex-col">
diff --git a/client/src/components/run/RunSetup.tsx b/client/src/components/run/RunSetup.tsx
index 00fab23b..17b1e494 100644
--- a/client/src/components/run/RunSetup.tsx
+++ b/client/src/components/run/RunSetup.tsx
@@ -56,7 +56,7 @@ import type {
   CcMdItem,
 } from "../../lib/api";
 import type { Session, LaneTool } from "../../lib/types";
-import { LANE_TOOL_LABEL } from "../../lib/types";
+import { useAiTools } from "../../hooks/useAiTools";
 import { Select } from "../Select";
 
 export interface SlashCommand {
@@ -389,9 +389,10 @@ interface RunSetupProps {
   onSandboxChange: (s: CodexSandbox) => void;
   approval: CodexApproval;
   onApprovalChange: (a: CodexApproval) => void;
-  /** Codex lanes resume with `--last`: the sessions table holds Claude
+  /** Every non-Claude lane resumes its tool's LAST session (`codex resume
+   *  --last`, a catalog tool's `resume` args): the sessions table holds Claude
    *  sessions only, so there is nothing for the picker to list. */
-  onResumeLast: () => void;
+  onResumeLast: (bypass?: boolean) => void;
 }
 
 export function RunSetup(props: RunSetupProps) {
@@ -399,6 +400,15 @@ export function RunSetup(props: RunSetupProps) {
   const atCap = false; // TODO: re-add when concurrency info is available
   const isResume = !!props.resumeSession;
   const [resumePicked, setResumePicked] = useState(isResume);
+  const aiTools = useAiTools();
+  const entry = aiTools.byId(props.tool);
+  // Claude and Codex keep their hand-written fields; every other catalog tool
+  // gets the plain form — cwd, prompt, resume and bypass when it has them.
+  const catalogTool = props.tool !== "claude" && props.tool !== "codex";
+  const canResume = !catalogTool || !!entry?.resume;
+  // Per run, never remembered: the form starts unticked every time it mounts.
+  const [bypass, setBypass] = useState(false);
+  const canBypass = props.tool !== "claude" && !!entry?.bypass;
   // Keep "resume picked" in sync with the parent. Parent set a resume session
   // (e.g. user clicked Resume in the runs modal) - flip the radio so the picker
   // is shown and the selection is visible.
@@ -431,13 +441,13 @@ export function RunSetup(props: RunSetupProps) {
               </div>
             )}
           </Field>
-          {/* `agy` takes no model, permission or effort flag. */}
-          {props.tool !== "antigravity" && (
+          {/* A catalog tool takes no model, permission or effort flag. */}
+          {!catalogTool && (
             <Field label={t("fields.model")}>
               <ModelPicker value={props.model} onChange={props.onModelChange} tool={props.tool} />
             </Field>
           )}
-          {props.tool === "antigravity" ? null : props.tool === "codex" ? (
+          {catalogTool ? null : props.tool === "codex" ? (
             <>
               <Field label={t("fields.sandbox")}>
                 <Select<CodexSandbox>
@@ -476,7 +486,7 @@ export function RunSetup(props: RunSetupProps) {
               />
             </Field>
           )}
-          {props.tool !== "antigravity" && (
+          {!catalogTool && (
             <Field label={t("fields.effort")}>
               <Select<EffortLevel>
                 value={props.effort}
@@ -490,23 +500,25 @@ export function RunSetup(props: RunSetupProps) {
             </Field>
           )}
         </div>
-        <div className="flex shrink-0 items-center rounded-md border border-border bg-surface-2 p-0.5 text-[11.5px]">
-          <Seg
-            active={!resumePicked}
-            label={t("resume.freshOption")}
-            title={t("resume.freshHint")}
-            onClick={() => {
-              setResumePicked(false);
-              props.onResumeSessionChange(null);
-            }}
-          />
-          <Seg
-            active={resumePicked}
-            label={t("resume.resumeOption")}
-            title={t("resume.resumeHint")}
-            onClick={() => setResumePicked(true)}
-          />
-        </div>
+        {canResume && (
+          <div className="flex shrink-0 items-center rounded-md border border-border bg-surface-2 p-0.5 text-[11.5px]">
+            <Seg
+              active={!resumePicked}
+              label={t("resume.freshOption")}
+              title={t("resume.freshHint")}
+              onClick={() => {
+                setResumePicked(false);
+                props.onResumeSessionChange(null);
+              }}
+            />
+            <Seg
+              active={resumePicked}
+              label={t("resume.resumeOption")}
+              title={t("resume.resumeHint")}
+              onClick={() => setResumePicked(true)}
+            />
+          </div>
+        )}
       </div>
 
       {resumePicked && (
@@ -520,7 +532,7 @@ export function RunSetup(props: RunSetupProps) {
                   // Pass the picked session explicitly: the parent's state
                   // update has not landed yet on this tick, so reading
                   // props.resumeSession here would resume nothing.
-                  if (s && !props.busy) handleStart(props, s);
+                  if (s && !props.busy) handleStart(props, s, bypass);
                 }}
                 // Fall back to the typed cwd when no lane is selected — otherwise
                 // an unfiltered picker lists every session from every repo.
@@ -528,7 +540,7 @@ export function RunSetup(props: RunSetupProps) {
               />
             ) : (
               <button
-                onClick={() => props.onResumeLast()}
+                onClick={() => props.onResumeLast(canBypass && bypass ? true : undefined)}
                 disabled={props.busy}
                 className="px-3 py-1.5 text-[11px] rounded-md bg-surface-2 border border-border hover:border-accent/50 text-fg-primary hover:text-accent transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
               >
@@ -547,8 +559,8 @@ export function RunSetup(props: RunSetupProps) {
         <PromptEditor
           value={props.prompt}
           onChange={props.onPromptChange}
-          onSubmit={() => handleStart(props)}
-          placeholder={t("fields.promptPlaceholderTerminal", { tool: LANE_TOOL_LABEL[props.tool] })}
+          onSubmit={() => handleStart(props, undefined, canBypass && bypass)}
+          placeholder={t("fields.promptPlaceholderTerminal", { tool: aiTools.label(props.tool) })}
           rows={5}
           slash={props.tool === "claude"}
           fileCwd={props.resumeSession?.cwd || props.cwd}
@@ -558,7 +570,27 @@ export function RunSetup(props: RunSetupProps) {
         </div>
       </div>
 
-      {props.tool === "codex" && props.sandbox === "danger-full-access" && (
+      {canBypass && (
+        <div className="px-4 pb-3">
+          <label className="inline-flex items-center gap-2 text-[11.5px] text-status-danger cursor-pointer">
+            <input
+              type="checkbox"
+              checked={bypass}
+              onChange={(e) => setBypass(e.target.checked)}
+              className="accent-[rgb(var(--status-danger))]"
+            />
+            {t("fields.bypass")}
+          </label>
+          {bypass && (
+            <div className="mt-2 rounded-md border border-status-danger/40 bg-status-danger/10 px-3 py-2 text-[11px] text-status-danger flex items-start gap-2">
+              <ShieldAlert className="w-3.5 h-3.5 flex-shrink-0 mt-0.5" />
+              <span>{t("hint.bypassWarning", { tool: aiTools.label(props.tool) })}</span>
+            </div>
+          )}
+        </div>
+      )}
+
+      {props.tool === "codex" && !bypass && props.sandbox === "danger-full-access" && (
         <div className="mx-4 mb-3 rounded-md border border-status-danger/40 bg-status-danger/10 px-3 py-2 text-[11px] text-status-danger flex items-start gap-2">
           <ShieldAlert className="w-3.5 h-3.5 flex-shrink-0 mt-0.5" />
           <span>{t("hint.sandboxWarning")}</span>
@@ -583,7 +615,7 @@ export function RunSetup(props: RunSetupProps) {
           ) : null}
         </div>
         <button
-          onClick={() => handleStart(props)}
+          onClick={() => handleStart(props, undefined, canBypass && bypass)}
           disabled={
             !props.binaryFound ||
             // A resume needs no prompt — the session it continues is the input.
@@ -612,25 +644,27 @@ export function RunSetup(props: RunSetupProps) {
 
 /** `session` overrides `props.resumeSession` for the auto-start fired straight
  *  out of the picker, before the parent's state has caught up. */
-function handleStart(props: RunSetupProps, session?: Session) {
+function handleStart(props: RunSetupProps, session?: Session, bypass?: boolean) {
   const resume = session ?? props.resumeSession;
   const codex = props.tool === "codex";
-  const agy = props.tool === "antigravity";
+  // Any catalog tool: none of Claude's or Codex's own flags apply.
+  const other = props.tool !== "claude" && !codex;
   props.onStart({
     laneId: props.laneId,
     // A resume is pinned to its own session's folder — that's what the locked
     // cwd field shows, so it's what gets sent.
     cwd: resume?.cwd || props.cwd || undefined,
-    model: agy ? undefined : props.model || undefined,
-    permissionMode: codex || agy ? undefined : props.permissionMode || undefined,
+    model: other ? undefined : props.model || undefined,
+    permissionMode: codex || other ? undefined : props.permissionMode || undefined,
     sandbox: codex ? props.sandbox : undefined,
     approval: codex ? props.approval : undefined,
-    effort: agy ? undefined : props.effort || undefined,
-    resumeSessionId: codex || agy ? undefined : resume?.id || undefined,
+    effort: other ? undefined : props.effort || undefined,
+    resumeSessionId: codex || other ? undefined : resume?.id || undefined,
     // A resume continues a session that already has its own history — sending
     // whatever is sitting in the prompt box would fire an extra turn nobody
     // asked for, so a resume carries no prompt at all.
     initialPrompt: resume ? undefined : props.prompt || undefined,
+    bypass: bypass || undefined,
   });
 }
 
diff --git a/client/src/components/run/__tests__/RunSetup.test.tsx b/client/src/components/run/__tests__/RunSetup.test.tsx
index afcb15dd..da8869d8 100644
--- a/client/src/components/run/__tests__/RunSetup.test.tsx
+++ b/client/src/components/run/__tests__/RunSetup.test.tsx
@@ -25,6 +25,17 @@ vi.mock("../../../lib/api", async (importOriginal) => {
   return {
     ...actual,
     api: {
+      aiTools: {
+        list: r({
+          default: "claude",
+          tools: [
+            { id: "claude", label: "Claude Code", resume: false, bypass: false },
+            { id: "codex", label: "Codex", resume: false, bypass: true },
+            { id: "antigravity", label: "Antigravity", resume: true, bypass: true },
+            { id: "gemini", label: "Gemini", resume: false, bypass: false },
+          ].map((x) => ({ ...x, installed: true, enabled: true, command: x.id })),
+        }),
+      },
       run: { files: r({ items: [] }) },
       sessions: { list: r({ sessions: [], total: 0, limit: 100, offset: 0 }) },
       ccConfig: {
@@ -443,6 +454,41 @@ describe("RunSetup — codex lanes", () => {
     const { spies } = renderSetup({ tool: "codex" });
     fireEvent.click(screen.getByText(i18n.t("run:actions.start")));
     expect(spies.onStart).toHaveBeenCalledOnce();
-    expect(spies.onStart.mock.calls[0][0].resumeLast).toBeUndefined();
+    expect(spies.onStart.mock.calls[0]?.[0].resumeLast).toBeUndefined();
+  });
+});
+
+describe("RunSetup — catalog tools", () => {
+  it("offers a per-run bypass switch with a warning, and sends it", async () => {
+    const { spies } = renderSetup({ tool: "antigravity", prompt: "go" });
+    const box = await screen.findByRole("checkbox", { name: i18n.t("run:fields.bypass") });
+    expect(box).not.toBeChecked();
+    expect(screen.queryByText(/without asking/)).toBeNull();
+    fireEvent.click(box);
+    expect(screen.getByText(/Antigravity will run every command/)).toBeTruthy();
+    fireEvent.click(screen.getByText(i18n.t("run:actions.start")));
+    expect(spies.onStart.mock.calls[0]?.[0].bypass).toBe(true);
+    // Resume is offered because the catalog gives the tool a resume flag.
+    expect(screen.getByText(i18n.t("run:resume.resumeOption"))).toBeTruthy();
+  });
+
+  it("leaves out resume and bypass for a tool with neither", async () => {
+    const { spies } = renderSetup({ tool: "gemini", prompt: "go" });
+    expect(await screen.findByPlaceholderText("Ask Gemini anything…")).toBeTruthy();
+    expect(screen.queryByRole("checkbox", { name: i18n.t("run:fields.bypass") })).toBeNull();
+    expect(screen.queryByText(i18n.t("run:resume.resumeOption"))).toBeNull();
+    fireEvent.click(screen.getByText(i18n.t("run:actions.start")));
+    expect(spies.onStart.mock.calls[0]?.[0].bypass).toBeUndefined();
+  });
+
+  it("gives Codex the switch but not Claude", async () => {
+    renderSetup({ tool: "codex" });
+    expect(await screen.findByRole("checkbox", { name: i18n.t("run:fields.bypass") })).toBeTruthy();
+  });
+
+  it("gives Claude no bypass switch (it has the bypassPermissions mode)", async () => {
+    renderSetup({ tool: "claude" });
+    await screen.findByPlaceholderText("Ask Claude Code anything…");
+    expect(screen.queryByRole("checkbox", { name: i18n.t("run:fields.bypass") })).toBeNull();
   });
 });
diff --git a/client/src/components/settings/AiToolsSettings.tsx b/client/src/components/settings/AiToolsSettings.tsx
new file mode 100644
index 00000000..0e1509c7
--- /dev/null
+++ b/client/src/components/settings/AiToolsSettings.tsx
@@ -0,0 +1,184 @@
+/**
+ * @file AiToolsSettings.tsx
+ * @description Settings → AI Tools: every AI coding CLI in the server's catalog
+ * (GET /api/ai-tools), split into the ones found on PATH — each with
+ * Enabled/Disabled and Set default — and the ones available to install, which
+ * only link to their homepage. Refresh re-reads the login shell's PATH and
+ * re-detects. A disabled tool is hidden from Add lane and the server refuses a
+ * new lane for it; existing lanes keep working.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Bot, ExternalLink, RefreshCw } from "lucide-react";
+import { useAiTools } from "../../hooks/useAiTools";
+import type { AiTool } from "../../lib/api";
+
+function Avatar({ label }: { label: string }) {
+  return (
+    <span className="flex h-7 w-7 shrink-0 items-center justify-center rounded-md bg-surface-4 text-xs font-semibold text-fg-secondary">
+      {label.charAt(0).toUpperCase()}
+    </span>
+  );
+}
+
+function Homepage({ tool }: { tool: AiTool }) {
+  const { t } = useTranslation("settings");
+  if (!tool.homepageUrl) return null;
+  return (
+    <a
+      href={tool.homepageUrl}
+      target="_blank"
+      rel="noreferrer noopener"
+      title={t("aiTools.homepage")}
+      aria-label={t("aiTools.homepageOf", { tool: tool.label })}
+      className="text-fg-muted hover:text-accent"
+    >
+      <ExternalLink className="w-3.5 h-3.5" />
+    </a>
+  );
+}
+
+export function AiToolsSettings() {
+  const { t } = useTranslation("settings");
+  const { tools, loaded, defaultId, refresh, update } = useAiTools();
+  const [busy, setBusy] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const sectionRef = useRef<HTMLElement | null>(null);
+
+  // The Add-lane modal links here as /settings#ai-tools; the section renders
+  // after the browser's own hash jump, so it has to scroll itself into view.
+  useEffect(() => {
+    if (window.location.hash === "#ai-tools") sectionRef.current?.scrollIntoView?.();
+  }, []);
+
+  const run = async (key: string, fn: () => Promise<void>) => {
+    setBusy(key);
+    setError(null);
+    try {
+      await fn();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  const installed = tools.filter((x) => x.installed);
+  const available = tools.filter((x) => !x.installed);
+
+  return (
+    <section id="ai-tools" ref={sectionRef} className="scroll-mt-24">
+      <h3 className="text-sm font-medium text-fg-secondary flex items-center gap-2 mb-1">
+        <Bot className="w-4 h-4 text-fg-muted" />
+        {t("aiTools.title")}
+      </h3>
+      <p className="text-xs text-fg-muted mb-4">{t("aiTools.description")}</p>
+
+      <div className="card p-5 space-y-5">
+        <div>
+          <div className="flex items-center justify-between gap-3 mb-2">
+            <p className="text-xs font-medium text-fg-secondary">
+              {t("aiTools.installed", { count: installed.length })}
+            </p>
+            <button
+              type="button"
+              onClick={() => void run("refresh", refresh)}
+              disabled={busy !== null}
+              className="inline-flex items-center gap-1.5 rounded-md border border-border px-2 py-1 text-xs text-fg-secondary hover:bg-surface-3 disabled:opacity-50"
+            >
+              <RefreshCw className={`w-3.5 h-3.5 ${busy === "refresh" ? "animate-spin" : ""}`} />
+              {t("aiTools.refresh")}
+            </button>
+          </div>
+          {error && <p className="mb-2 text-xs text-status-danger">{error}</p>}
+          {loaded && installed.length === 0 && (
+            <p className="text-xs text-fg-muted">{t("aiTools.noneInstalled")}</p>
+          )}
+          <ul className="divide-y divide-border rounded-md border border-border">
+            {installed.map((tool) => {
+              const isDefault = tool.id === defaultId;
+              return (
+                <li
+                  key={tool.id}
+                  data-testid={`ai-tool-${tool.id}`}
+                  className={`flex items-center gap-3 px-3 py-2 ${tool.enabled ? "" : "opacity-60"}`}
+                >
+                  <Avatar label={tool.label} />
+                  <div className="min-w-0 flex-1">
+                    <div className="flex items-center gap-1.5 text-sm text-fg-primary">
+                      {tool.label}
+                      <Homepage tool={tool} />
+                    </div>
+                    <div
+                      className="truncate font-mono text-[11px] text-fg-muted"
+                      title={tool.path ?? ""}
+                    >
+                      {tool.command}
+                    </div>
+                  </div>
+                  {isDefault ? (
+                    <span className="text-xs text-accent">✓ {t("aiTools.default")}</span>
+                  ) : (
+                    <button
+                      type="button"
+                      disabled={!tool.enabled || busy !== null}
+                      onClick={() => void run(tool.id, () => update(tool.id, { default: true }))}
+                      className="rounded-md border border-border px-2 py-1 text-xs text-fg-secondary hover:bg-surface-3 disabled:opacity-50"
+                    >
+                      {t("aiTools.setDefault")}
+                    </button>
+                  )}
+                  <button
+                    type="button"
+                    role="switch"
+                    aria-checked={tool.enabled}
+                    aria-label={t("aiTools.enabledOf", { tool: tool.label })}
+                    disabled={busy !== null}
+                    onClick={() =>
+                      void run(tool.id, () => update(tool.id, { enabled: !tool.enabled }))
+                    }
+                    className={`w-24 rounded-md border px-2 py-1 text-xs disabled:opacity-50 ${
+                      tool.enabled
+                        ? "border-status-success/40 bg-status-success/10 text-status-success"
+                        : "border-border bg-surface-2 text-fg-muted"
+                    }`}
+                  >
+                    {tool.enabled ? t("aiTools.enabled") : t("aiTools.disabled")}
+                  </button>
+                </li>
+              );
+            })}
+          </ul>
+        </div>
+
+        {available.length > 0 && (
+          <div>
+            <p className="text-xs font-medium text-fg-secondary mb-2">
+              {t("aiTools.available", { count: available.length })}
+            </p>
+            <ul className="grid grid-cols-1 gap-2 sm:grid-cols-2 lg:grid-cols-3">
+              {available.map((tool) => (
+                <li
+                  key={tool.id}
+                  data-testid={`ai-tool-${tool.id}`}
+                  className="flex items-center gap-2 rounded-md border border-border px-2.5 py-1.5"
+                >
+                  <Avatar label={tool.label} />
+                  <span className="min-w-0 flex-1 truncate text-xs text-fg-secondary">
+                    {tool.label}
+                    <span className="ml-1.5 font-mono text-[10px] text-fg-muted">
+                      {tool.command}
+                    </span>
+                  </span>
+                  <Homepage tool={tool} />
+                </li>
+              ))}
+            </ul>
+          </div>
+        )}
+      </div>
+    </section>
+  );
+}
diff --git a/client/src/components/settings/__tests__/AiToolsSettings.test.tsx b/client/src/components/settings/__tests__/AiToolsSettings.test.tsx
new file mode 100644
index 00000000..230471af
--- /dev/null
+++ b/client/src/components/settings/__tests__/AiToolsSettings.test.tsx
@@ -0,0 +1,111 @@
+/**
+ * @file AiToolsSettings.test.tsx
+ * @description Settings → AI Tools: installed rows carry Enabled/Disabled and
+ * Set default, available rows only a homepage link, Refresh re-detects, and a
+ * disabled tool's Settings tab disappears from the hub.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { MemoryRouter } from "react-router-dom";
+import { render, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import i18n from "i18next";
+import { AiToolsSettings } from "../AiToolsSettings";
+import { api, type AiTool, type AiToolsView } from "../../../lib/api";
+import { __resetAiTools } from "../../../hooks/useAiTools";
+
+vi.mock("../../../lib/api", async (importOriginal) => {
+  const actual = await importOriginal<Record<string, unknown>>();
+  return {
+    ...actual,
+    api: { aiTools: { list: vi.fn(), refresh: vi.fn(), update: vi.fn() } },
+  };
+});
+
+const tool = (id: string, label: string, over: Partial<AiTool> = {}): AiTool => ({
+  id,
+  label,
+  command: id,
+  homepageUrl: `https://${id}.example/`,
+  installed: true,
+  path: `/usr/bin/${id}`,
+  enabled: true,
+  source: "builtin",
+  launcher: null,
+  prompt: { mode: "argv" },
+  resume: false,
+  bypass: false,
+  routerCapable: false,
+  ...over,
+});
+const VIEW: AiToolsView = {
+  default: "claude",
+  tools: [
+    tool("claude", "Claude Code"),
+    tool("gemini", "Gemini"),
+    tool("grok", "Grok", { enabled: false }),
+    tool("aider", "Aider", { installed: false, path: null }),
+  ],
+};
+
+beforeEach(() => {
+  i18n.changeLanguage("en");
+  __resetAiTools();
+  vi.mocked(api.aiTools.list).mockReset().mockResolvedValue(VIEW);
+  vi.mocked(api.aiTools.update).mockReset().mockResolvedValue(VIEW);
+  vi.mocked(api.aiTools.refresh).mockReset().mockResolvedValue(VIEW);
+});
+
+describe("AiToolsSettings", () => {
+  it("splits installed tools from the ones available to install", async () => {
+    render(<AiToolsSettings />);
+    expect(await screen.findByText("Installed (3 detected)")).toBeInTheDocument();
+    expect(screen.getByText("Available to install (1)")).toBeInTheDocument();
+    const claude = screen.getByTestId("ai-tool-claude");
+    expect(within(claude).getByText(/Default/)).toBeInTheDocument();
+    const aider = screen.getByTestId("ai-tool-aider");
+    expect(within(aider).queryByRole("switch")).toBeNull();
+    expect(within(aider).queryByText("Set default")).toBeNull();
+    expect(within(aider).getByRole("link")).toHaveAttribute("href", "https://aider.example/");
+  });
+
+  it("toggles a tool and sets the default through the API", async () => {
+    const user = userEvent.setup();
+    render(<AiToolsSettings />);
+    const gemini = await screen.findByTestId("ai-tool-gemini");
+    await user.click(within(gemini).getByRole("switch", { name: "Gemini enabled" }));
+    expect(api.aiTools.update).toHaveBeenCalledWith("gemini", { enabled: false });
+    await user.click(within(gemini).getByText("Set default"));
+    expect(api.aiTools.update).toHaveBeenCalledWith("gemini", { default: true });
+    // A disabled tool cannot become the default.
+    const grok = screen.getByTestId("ai-tool-grok");
+    expect(within(grok).getByText("Set default")).toBeDisabled();
+    expect(within(grok).getByRole("switch")).toHaveTextContent("Disabled");
+  });
+
+  it("refreshes detection", async () => {
+    const user = userEvent.setup();
+    render(<AiToolsSettings />);
+    await user.click(await screen.findByRole("button", { name: "Refresh" }));
+    expect(api.aiTools.refresh).toHaveBeenCalledOnce();
+  });
+});
+
+describe("SettingsHub — AI tool tabs", () => {
+  it("hides the Codex tab while Codex is disabled", async () => {
+    vi.mocked(api.aiTools.list).mockResolvedValue({
+      default: "claude",
+      tools: [tool("claude", "Claude Code"), tool("codex", "Codex", { enabled: false })],
+    });
+    vi.doMock("../../../pages/Settings", () => ({ Settings: () => null }));
+    const { SettingsHub } = await import("../../../pages/SettingsHub");
+    render(
+      <MemoryRouter>
+        <SettingsHub />
+      </MemoryRouter>
+    );
+    expect(await screen.findByRole("tab", { name: /Claude Code/ })).toBeInTheDocument();
+    expect(screen.queryByRole("tab", { name: /^Codex/ })).toBeNull();
+  });
+});
diff --git a/client/src/hooks/useAiTools.ts b/client/src/hooks/useAiTools.ts
new file mode 100644
index 00000000..92c1df1c
--- /dev/null
+++ b/client/src/hooks/useAiTools.ts
@@ -0,0 +1,80 @@
+/**
+ * @file useAiTools — the AI Tools catalog (GET /api/ai-tools) shared by every
+ * component that names a lane's tool or offers one: the Add-lane modal, the
+ * run form, the lane strip and Settings → AI Tools. One module-level copy, so
+ * N components mean one request; refetched on window focus and after every
+ * change made through `update`/`refresh`.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useEffect, useSyncExternalStore } from "react";
+import { api, type AiTool, type AiToolsView } from "../lib/api";
+
+let view: AiToolsView | null = null;
+let inflight: Promise<void> | null = null;
+const listeners = new Set<() => void>();
+
+function publish(next: AiToolsView) {
+  view = next;
+  listeners.forEach((l) => l());
+}
+
+function load(): Promise<void> {
+  if (!inflight) {
+    inflight = Promise.resolve()
+      .then(() => api.aiTools.list())
+      .then(publish)
+      // Unreachable server: keep what we had; every caller has a fallback.
+      .catch(() => undefined)
+      .finally(() => {
+        inflight = null;
+      });
+  }
+  return inflight;
+}
+
+function subscribe(l: () => void) {
+  listeners.add(l);
+  if (listeners.size === 1) window.addEventListener("focus", onFocus);
+  return () => {
+    listeners.delete(l);
+    if (listeners.size === 0) window.removeEventListener("focus", onFocus);
+  };
+}
+function onFocus() {
+  void load();
+}
+
+/** Built-in names for the three tools a lane may carry before the catalog loads. */
+const FALLBACK: Record<string, string> = {
+  claude: "Claude",
+  codex: "Codex",
+  antigravity: "Antigravity",
+};
+
+/** Test seam: forget the cached catalog. */
+export function __resetAiTools() {
+  view = null;
+  inflight = null;
+}
+
+export function useAiTools() {
+  const v = useSyncExternalStore(subscribe, () => view);
+  useEffect(() => {
+    if (!view) void load();
+  }, []);
+  const tools: AiTool[] = v?.tools ?? [];
+  const byId = (id: string) => tools.find((t) => t.id === id) ?? null;
+  return {
+    tools,
+    loaded: v !== null,
+    defaultId: v?.default ?? null,
+    byId,
+    /** A tool's display name; the id itself for a tool the catalog no longer knows. */
+    label: (id: string) => byId(id)?.label ?? FALLBACK[id] ?? id,
+    reload: load,
+    refresh: async () => publish(await api.aiTools.refresh()),
+    update: async (id: string, body: { enabled?: boolean; default?: true }) =>
+      publish(await api.aiTools.update(id, body)),
+  };
+}
diff --git a/client/src/i18n/locales/en/lanes.json b/client/src/i18n/locales/en/lanes.json
index 3125daab..0cd414af 100644
--- a/client/src/i18n/locales/en/lanes.json
+++ b/client/src/i18n/locales/en/lanes.json
@@ -45,7 +45,6 @@
   "addLaneRouterHint": "Native talks to the vendor's own API. An AI Router profile is written into this lane's own config when it is created.",
   "addLaneRouterLabel": "Model endpoint",
   "addLaneRouterLoading": "Loading router profiles…",
-  "addLaneRouterNative": "Native",
   "addLaneRouterProfileLabel": "Router profile",
   "addLaneSetupClose": "Close",
   "addLaneSetupMcp": "MCP servers",
@@ -54,9 +53,11 @@
   "addLaneSetupTitle": "Setup",
   "addLaneTitleLabel": "Title",
   "addLaneTitlePlaceholder": "Optional",
-  "addLaneToolClaude": "Claude Code",
-  "addLaneToolCodex": "Codex",
-  "addLaneToolAntigravity": "Antigravity",
+  "addLaneToolDefault": "Default ({{tool}})",
+  "addLaneToolOther": "Other…",
+  "addLaneNoTools": "No AI tool is installed and enabled.",
+  "addLaneNoToolsLink": "Open Settings → AI Tools",
+  "addLaneRouterNativeTool": "Native ({{tool}})",
   "addLaneToolHint": "Which CLI drives this lane. Cannot be changed later.",
   "addLaneWorktreeDetached": "(detached)",
   "addLaneWorktreesMore": "+{{count}} more",
@@ -218,6 +219,8 @@
   "renameLabel": "Rename this lane",
   "reorderHint": "Drag to reorder · Alt+←/→",
   "router.applied": "Applied.",
+  "router.native": "Native ({{tool}})",
+  "router.nativeOnly": "{{tool}} runs on its own settings — AI Router profiles work with Claude Code and Codex only.",
   "router.appliedRestart": "Applied, but the session running in this lane still uses the old models — restart it to take effect.",
   "router.label": "Model",
   "router.restart": "Restart",
diff --git a/client/src/i18n/locales/en/run.json b/client/src/i18n/locales/en/run.json
index 80581378..d2d4456a 100644
--- a/client/src/i18n/locales/en/run.json
+++ b/client/src/i18n/locales/en/run.json
@@ -76,6 +76,7 @@
     "permissionAcceptEdits": "acceptEdits (file edits without asking)",
     "permissionAuto": "auto (recommended - asks only for risky actions)",
     "permissionBypass": "bypassPermissions (DANGER - allows everything without asking)",
+    "bypass": "Bypass permissions for this run",
     "permissionDefault": "default (interactive prompts - sessions may hang headlessly)",
     "permissionMode": "Permission mode",
     "permissionPlan": "plan (read-only planning)",
@@ -97,6 +98,7 @@
   "hint": {
     "headlessExplain": "Headless mode is best for scripted tasks where you know exactly what you want. The session can't ask follow-up questions and will hang on permission prompts unless you stay in acceptEdits.",
     "permissionWarning": "bypassPermissions allows ALL tool invocations without confirming. Only use for trusted prompts.",
+    "bypassWarning": "{{tool}} will run every command and edit every file without asking. Only for a prompt and a folder you trust.",
     "sandboxWarning": "Codex will run commands with no sandbox.",
     "shortcut": "Enter to send · Shift+Enter for newline"
   },
diff --git a/client/src/i18n/locales/en/settings.json b/client/src/i18n/locales/en/settings.json
index 540397c4..4ddd385b 100644
--- a/client/src/i18n/locales/en/settings.json
+++ b/client/src/i18n/locales/en/settings.json
@@ -495,6 +495,21 @@
     "testOk": "The endpoint answered — {{model}} is reachable with this key.",
     "testFailed": "No answer ({{status}}): {{message}}"
   },
+  "aiTools": {
+    "title": "AI Tools",
+    "description": "AI coding CLIs AgentHub can run in a lane. Detected on this machine's PATH; a disabled tool is hidden from Add lane.",
+    "installed": "Installed ({{count}} detected)",
+    "available": "Available to install ({{count}})",
+    "refresh": "Refresh",
+    "noneInstalled": "No AI tool found on PATH. Install one, then press Refresh.",
+    "default": "Default",
+    "setDefault": "Set default",
+    "enabled": "Enabled",
+    "disabled": "Disabled",
+    "enabledOf": "{{tool}} enabled",
+    "homepage": "Homepage",
+    "homepageOf": "{{tool}} homepage"
+  },
   "appearance": {
     "title": "Appearance",
     "description": "Colour mode and theme. Saved in this browser only.",
diff --git a/client/src/i18n/locales/vi/lanes.json b/client/src/i18n/locales/vi/lanes.json
index 53cdf5ba..5ba1f031 100644
--- a/client/src/i18n/locales/vi/lanes.json
+++ b/client/src/i18n/locales/vi/lanes.json
@@ -45,7 +45,6 @@
   "addLaneRouterHint": "Native là gọi thẳng API của hãng. Chọn profile AI Router thì cấu hình được ghi vào config riêng của lane này lúc tạo.",
   "addLaneRouterLabel": "Endpoint model",
   "addLaneRouterLoading": "Đang tải danh sách router…",
-  "addLaneRouterNative": "Native",
   "addLaneRouterProfileLabel": "Profile router",
   "addLaneSetupClose": "Đóng",
   "addLaneSetupMcp": "MCP server",
@@ -54,9 +53,11 @@
   "addLaneSetupTitle": "Thiết lập",
   "addLaneTitleLabel": "Tiêu đề",
   "addLaneTitlePlaceholder": "Không bắt buộc",
-  "addLaneToolClaude": "Claude Code",
-  "addLaneToolCodex": "Codex",
-  "addLaneToolAntigravity": "Antigravity",
+  "addLaneToolDefault": "Mặc định ({{tool}})",
+  "addLaneToolOther": "Khác…",
+  "addLaneNoTools": "Chưa có AI tool nào được cài và bật.",
+  "addLaneNoToolsLink": "Mở Cài đặt → AI Tools",
+  "addLaneRouterNativeTool": "Native ({{tool}})",
   "addLaneToolHint": "CLI nào điều khiển lane này. Không thể thay đổi sau này.",
   "addLaneWorktreeDetached": "(detached)",
   "addLaneWorktreesMore": "+{{count}} nữa",
@@ -218,6 +219,8 @@
   "renameLabel": "Đổi tên làn đường này",
   "reorderHint": "Kéo để sắp xếp · Alt+←/→",
   "router.applied": "Đã áp dụng.",
+  "router.native": "Native ({{tool}})",
+  "router.nativeOnly": "{{tool}} chạy bằng cấu hình riêng — hồ sơ AI Router chỉ dùng được với Claude Code và Codex.",
   "router.appliedRestart": "Đã áp dụng, nhưng phiên đang chạy trong lane này vẫn dùng model cũ — khởi động lại phiên để có hiệu lực.",
   "router.label": "Model",
   "router.restart": "Khởi động lại",
diff --git a/client/src/i18n/locales/vi/run.json b/client/src/i18n/locales/vi/run.json
index 4150ccfa..072c8cd4 100644
--- a/client/src/i18n/locales/vi/run.json
+++ b/client/src/i18n/locales/vi/run.json
@@ -75,6 +75,7 @@
     "permissionAcceptEdits": "acceptEdits (sửa file không hỏi)",
     "permissionAuto": "auto (khuyên dùng - chỉ hỏi khi hành động rủi ro)",
     "permissionBypass": "bypassPermissions (NGUY HIỂM - cho phép tất cả mà không hỏi)",
+    "bypass": "Bỏ qua xin quyền cho lần chạy này",
     "permissionDefault": "default (prompt tương tác - headless sẽ treo)",
     "permissionMode": "Permission mode",
     "permissionPlan": "plan (chỉ đọc, lập kế hoạch)",
@@ -96,6 +97,7 @@
   "hint": {
     "headlessExplain": "Headless phù hợp cho tác vụ tự động. Phiên không thể hỏi lại, sẽ treo ở prompt xin quyền nếu bạn không giữ acceptEdits.",
     "permissionWarning": "bypassPermissions cho phép gọi mọi tool không cần xác nhận. Chỉ dùng cho prompt bạn tin tưởng.",
+    "bypassWarning": "{{tool}} sẽ chạy mọi lệnh và sửa mọi file mà không hỏi. Chỉ dùng với prompt và thư mục bạn tin tưởng.",
     "sandboxWarning": "Codex sẽ chạy lệnh mà không có sandbox.",
     "shortcut": "Enter để gửi · Shift+Enter xuống dòng"
   },
diff --git a/client/src/i18n/locales/vi/settings.json b/client/src/i18n/locales/vi/settings.json
index 98e26729..9077b91b 100644
--- a/client/src/i18n/locales/vi/settings.json
+++ b/client/src/i18n/locales/vi/settings.json
@@ -495,6 +495,21 @@
     "testOk": "Endpoint đã trả lời — {{model}} dùng được với key này.",
     "testFailed": "Không trả lời ({{status}}): {{message}}"
   },
+  "aiTools": {
+    "title": "AI Tools",
+    "description": "Các CLI lập trình AI mà AgentHub chạy được trong lane. Nhận diện qua PATH của máy; tool bị tắt sẽ ẩn khỏi Add lane.",
+    "installed": "Đã cài ({{count}} tool)",
+    "available": "Có thể cài ({{count}})",
+    "refresh": "Làm mới",
+    "noneInstalled": "Chưa tìm thấy AI tool nào trong PATH. Cài một tool rồi bấm Làm mới.",
+    "default": "Mặc định",
+    "setDefault": "Đặt mặc định",
+    "enabled": "Đang bật",
+    "disabled": "Đang tắt",
+    "enabledOf": "Bật {{tool}}",
+    "homepage": "Trang chủ",
+    "homepageOf": "Trang chủ {{tool}}"
+  },
   "appearance": {
     "title": "Giao diện",
     "description": "Chế độ màu và theme. Chỉ lưu trong trình duyệt này.",
diff --git a/client/src/lib/api.ts b/client/src/lib/api.ts
index f993bc07..20b64309 100644
--- a/client/src/lib/api.ts
+++ b/client/src/lib/api.ts
@@ -1939,6 +1939,18 @@ export const api = {
         { method: "DELETE" }
       ),
   },
+  aiTools: {
+    /** GET /api/ai-tools - the catalog, what is installed, enabled, and the default. */
+    list: () => request<AiToolsView>("/ai-tools"),
+    /** POST /api/ai-tools/refresh - re-read the login shell's PATH and re-detect. */
+    refresh: () => request<AiToolsView>("/ai-tools/refresh", { method: "POST" }),
+    /** PUT /api/ai-tools/:id - enable/disable a tool, or make it the default. */
+    update: (id: string, body: { enabled?: boolean; default?: true }) =>
+      request<AiToolsView>(`/ai-tools/${encodeURIComponent(id)}`, {
+        method: "PUT",
+        body: JSON.stringify(body),
+      }),
+  },
   aiRouters: {
     /** GET /api/ai-routers - every profile, the built-in `native` one first. */
     list: () => request<{ items: AiRouter[] }>("/ai-routers"),
@@ -1987,7 +1999,7 @@ export const api = {
       if (options?.laneId !== undefined) qs.set("laneId", String(options.laneId));
       return request<{ items: DashboardRunHistoryItem[] }>(`/run/history?${qs.toString()}`);
     },
-    /** GET /api/run/binary - whether the lane's CLI (`claude` or `codex`) was found on PATH. */
+    /** GET /api/run/binary - whether the lane tool's CLI was found on PATH (fresh look). */
     binary: (tool: LaneTool = "claude") =>
       request<{ found: boolean; path: string | null }>(`/run/binary?tool=${tool}`),
     /** GET /api/run/tmux - whether the `tmux` binary was found on PATH. */
@@ -2963,6 +2975,34 @@ export interface GitAuthNeeded {
   rejected: boolean;
 }
 
+/** One AI coding CLI from the server's AI Tools catalog (GET /api/ai-tools). */
+export interface AiTool {
+  id: string;
+  label: string;
+  /** The command that was found (or would be looked for) on PATH. */
+  command: string | null;
+  homepageUrl: string | null;
+  installed: boolean;
+  path: string | null;
+  enabled: boolean;
+  source: "builtin" | "custom";
+  /** `claude` / `codex` keep their own run form; null for every other tool. */
+  launcher: "claude" | "codex" | null;
+  prompt: { mode: "argv" | "flag" | "after-start" } | null;
+  /** Offers "Resume last session". */
+  resume: boolean;
+  /** Offers the per-run "Bypass permissions" switch. */
+  bypass: boolean;
+  /** Can use an AI Router profile (Claude, Codex); others are native only. */
+  routerCapable: boolean;
+}
+
+export interface AiToolsView {
+  tools: AiTool[];
+  /** The effective default tool id, or null when nothing is installed and enabled. */
+  default: string | null;
+}
+
 export interface AiRouter {
   /** Identifier, derived from the label. Stable: a lane stores this. */
   name: string;
@@ -3667,8 +3707,10 @@ export interface RunStartArgs {
   sandbox?: CodexSandbox;
   /** Codex only: `-a`. Ignored by a claude lane. */
   approval?: CodexApproval;
-  /** Codex only: `codex resume --last` instead of picking a session id. */
+  /** Continue the tool's last session: Codex `resume --last`, a catalog tool's `resume` args. */
   resumeLast?: boolean;
+  /** Turn off the tool's permission prompts for THIS run (its catalog bypass args). */
+  bypass?: boolean;
 }
 
 /** A lane's tmux-backed terminal run — one per lane, id is the tmux session
diff --git a/client/src/lib/types.ts b/client/src/lib/types.ts
index bba93819..b441baf4 100644
--- a/client/src/lib/types.ts
+++ b/client/src/lib/types.ts
@@ -2409,15 +2409,12 @@ export interface ProofFeature {
   mtime: number;
 }
 
-/** Which CLI drives a lane's pane. Fixed at lane creation and never patched. */
-export type LaneTool = "claude" | "codex" | "antigravity";
-
-/** How each CLI is named on screen (strip tag, console title, prompt box). */
-export const LANE_TOOL_LABEL: Record<LaneTool, string> = {
-  claude: "Claude",
-  codex: "Codex",
-  antigravity: "Antigravity",
-};
+/**
+ * Which CLI drives a lane's pane: an AI Tools catalog id (`claude`, `codex`,
+ * `antigravity`, `gemini`, …). Fixed at lane creation and never patched. Its
+ * label comes from `useAiTools().label(id)`.
+ */
+export type LaneTool = string;
 
 export interface Lane {
   id: number;
diff --git a/client/src/pages/Settings.tsx b/client/src/pages/Settings.tsx
index 3ed6e978..9a0f9d27 100644
--- a/client/src/pages/Settings.tsx
+++ b/client/src/pages/Settings.tsx
@@ -60,6 +60,7 @@ import { useTranslation } from "react-i18next";
 import {
   DollarSign,
   Palette,
+  Bot,
   Plus,
   Pencil,
   Trash2,
@@ -120,6 +121,7 @@ import { RemoteSources } from "../components/RemoteSources";
 import { Skeleton } from "../components/Skeleton";
 import { AlertsNotifications } from "../components/AlertsNotifications";
 import { AppearanceSettings } from "../components/settings/AppearanceSettings";
+import { AiToolsSettings } from "../components/settings/AiToolsSettings";
 import type { ModelPricing, WSMessage } from "../lib/types";
 
 // In-page navigation for the (dense) Settings screen. Each entry maps to a
@@ -131,6 +133,7 @@ const SETTINGS_SECTIONS: {
   Icon: typeof DollarSign;
 }[] = [
   { id: "appearance", labelKey: "appearance.title", Icon: Palette },
+  { id: "ai-tools", labelKey: "aiTools.title", Icon: Bot },
   { id: "pricing", labelKey: "pricing.title", Icon: DollarSign },
   { id: "hooks", labelKey: "hooks.title", Icon: Plug },
   { id: "lanes", labelKey: "lanesSection.title", Icon: GitBranch },
@@ -1081,6 +1084,8 @@ export function Settings() {
 
       <AppearanceSettings />
 
+      <AiToolsSettings />
+
       {/* ─── MODEL PRICING ─── */}
       <section id="pricing" className="scroll-mt-24">
         <div className="flex flex-wrap items-center justify-between gap-3 mb-4">
diff --git a/client/src/pages/SettingsHub.tsx b/client/src/pages/SettingsHub.tsx
index 2b4df274..1d7accf1 100644
--- a/client/src/pages/SettingsHub.tsx
+++ b/client/src/pages/SettingsHub.tsx
@@ -1,6 +1,6 @@
 /**
  * @file SettingsHub.tsx
- * @description Tabbed shell for /settings that hosts the dashboard's own settings plus one configuration panel per AI tool (Claude Code and Codex) plus the AI Router profiles they can be pointed at and the git logins dashboard fetch/pull/push use, with the active tab kept in the `?tool=` query param.
+ * @description Tabbed shell for /settings that hosts the dashboard's own settings plus one configuration panel per AI tool (Claude Code and Codex) plus the AI Router profiles they can be pointed at and the git logins dashboard fetch/pull/push use, with the active tab kept in the `?tool=` query param. A tool's tab is hidden while that tool is disabled in Settings → AI Tools.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import type { ComponentType } from "react";
@@ -13,12 +13,15 @@ import { CcConfig } from "./CcConfig";
 import { CodexConfig } from "./CodexConfig";
 import { AiRouterConfig } from "./AiRouterConfig";
 import { GitCredentialsConfig } from "./GitCredentialsConfig";
+import { useAiTools } from "../hooks/useAiTools";
 
 interface ToolTab {
   id: string;
   labelKey: string;
   Icon: ComponentType<{ className?: string }>;
   Panel: ComponentType;
+  /** The AI Tools catalog id this tab configures; hidden while it is disabled. */
+  aiTool?: string;
 }
 
 const DASHBOARD_TAB: ToolTab = {
@@ -31,8 +34,20 @@ const DASHBOARD_TAB: ToolTab = {
 /** Add a tool here to give it a tab; that is the whole extension point. */
 const TOOL_TABS: ToolTab[] = [
   DASHBOARD_TAB,
-  { id: "claude-code", labelKey: "tools.claudeCode", Icon: Boxes, Panel: CcConfig },
-  { id: "codex", labelKey: "tools.codex", Icon: SquareTerminal, Panel: CodexConfig },
+  {
+    id: "claude-code",
+    labelKey: "tools.claudeCode",
+    Icon: Boxes,
+    Panel: CcConfig,
+    aiTool: "claude",
+  },
+  {
+    id: "codex",
+    labelKey: "tools.codex",
+    Icon: SquareTerminal,
+    Panel: CodexConfig,
+    aiTool: "codex",
+  },
   { id: "ai-router", labelKey: "tools.aiRouter", Icon: Router, Panel: AiRouterConfig },
   {
     id: "git-credentials",
@@ -50,7 +65,11 @@ export function SettingsHub() {
   const { t } = useTranslation("settings");
   const [params, setParams] = useSearchParams();
   const requested = params.get("tool");
-  const active = TOOL_TABS.find((tab) => tab.id === requested) ?? DASHBOARD_TAB;
+  const aiTools = useAiTools();
+  const tabs = TOOL_TABS.filter(
+    (tab) => !tab.aiTool || aiTools.byId(tab.aiTool)?.enabled !== false
+  );
+  const active = tabs.find((tab) => tab.id === requested) ?? DASHBOARD_TAB;
 
   return (
     <div className="space-y-6">
@@ -58,7 +77,7 @@ export function SettingsHub() {
         ariaLabel={t("tools.label", "Tools")}
         activeId={active.id}
         onSelect={(id) => setParams(id === DASHBOARD_TAB.id ? {} : { tool: id }, { replace: true })}
-        tabs={TOOL_TABS.map(({ id, labelKey, Icon }) => ({
+        tabs={tabs.map(({ id, labelKey, Icon }) => ({
           id,
           Icon,
           label: t(labelKey),
diff --git a/client/src/pages/Workspace.tsx b/client/src/pages/Workspace.tsx
index faa2d4d7..c00bf230 100644
--- a/client/src/pages/Workspace.tsx
+++ b/client/src/pages/Workspace.tsx
@@ -56,7 +56,7 @@ import {
 } from "lucide-react";
 import { api } from "../lib/api";
 import type { CwdSuggestion, RunListResponse } from "../lib/api";
-import type { Lane, LaneFeature, ProofFeature, Session, WSMessage, LaneTool } from "../lib/types";
+import type { Lane, LaneFeature, ProofFeature, Session, WSMessage } from "../lib/types";
 import { eventBus } from "../lib/eventBus";
 import { keepIfSame } from "../lib/keepIfSame";
 import {
@@ -175,7 +175,7 @@ function ConsoleArea({
   selectedLaneId: number | null;
   splitView: SplitViewState;
   setLayout: (layout: SplitLayout) => void;
-  binaryStatus: Record<LaneTool, { found: boolean; path: string | null }> | null;
+  binaryStatus: Record<string, { found: boolean; path: string | null }> | null;
   cwdSuggestions: CwdSuggestion[];
   activeRuns: RunListResponse | null;
   externalSessions: Session[];
@@ -296,7 +296,7 @@ export function Workspace() {
   // would otherwise show nothing while two agents are working.
   const [externalSessions, setExternalSessions] = useState<Session[]>([]);
   const [binaryStatus, setBinaryStatus] = useState<Record<
-    LaneTool,
+    string,
     { found: boolean; path: string | null }
   > | null>(null);
   const [cwdSuggestions, setCwdSuggestions] = useState<CwdSuggestion[]>([]);
@@ -394,13 +394,25 @@ export function Workspace() {
     );
   }, [lanes, searchParams, setSearchParams]);
 
+  // Probe the CLI of every tool a lane uses — fresh on the server, so a CLI
+  // installed since the page loaded clears its missing-binary banner. Claude is
+  // always probed: the console's no-lane state runs it.
+  const laneToolsKey = Array.from(new Set(["claude", ...lanes.map((l) => l.tool || "claude")]))
+    .sort()
+    .join(",");
   useEffect(() => {
-    Promise.all([api.run.binary("claude"), api.run.binary("codex"), api.run.binary("antigravity")])
-      .then(([claude, codex, antigravity]) => setBinaryStatus({ claude, codex, antigravity }))
+    const tools = laneToolsKey.split(",");
+    Promise.all(tools.map((tool) => api.run.binary(tool)))
+      .then((found) =>
+        setBinaryStatus(Object.fromEntries(tools.map((tool, i) => [tool, found[i]!])))
+      )
       // Fetch failure (server unreachable, proxy misrouted, etc.) isn't proof
-      // `claude` or `codex` is missing from PATH — leave the probe unresolved rather than
+      // a CLI is missing from PATH — leave the probe unresolved rather than
       // showing a misleading "binary missing" banner for an unrelated fault.
       .catch(() => undefined);
+  }, [laneToolsKey]);
+
+  useEffect(() => {
     api.lanes
       .pipelines()
       .then((r) => setPipelineTemplates(r.pipelines))
@@ -860,7 +872,7 @@ export function Workspace() {
                       </select>
                     )}
                     {/* `agy` has no endpoint to point at a router. */}
-                    {currentLane.tool !== "antigravity" && <LaneRouterRow lane={currentLane} />}
+                    <LaneRouterRow lane={currentLane} />
                     {/* No stage chip and no "auto: <stage>" chip here: the
                         PipelineMap right below this header already draws both
                         — the declared node as the current ring, the detected
diff --git a/client/src/pages/__tests__/Workspace.laneRouter.test.tsx b/client/src/pages/__tests__/Workspace.laneRouter.test.tsx
index 5eb29d4a..4db01f7c 100644
--- a/client/src/pages/__tests__/Workspace.laneRouter.test.tsx
+++ b/client/src/pages/__tests__/Workspace.laneRouter.test.tsx
@@ -41,7 +41,7 @@ const lane = (id: number, title: string): LaneFixture => ({
 const h = vi.hoisted(() => {
   const nativeProfile = {
     name: "native",
-    label: "Native (Claude / Codex)",
+    label: "Native",
     builtin: true,
     baseUrl: "",
     hasKey: false,
@@ -205,10 +205,10 @@ describe("Workspace — the lane Model picker across a lane switch", () => {
     const user = userEvent.setup();
 
     await selectLane(user, "Lane A");
-    expect(await screen.findByDisplayValue("Native (Claude / Codex)")).toBeInTheDocument();
+    expect(await screen.findByDisplayValue("Native (Claude)")).toBeInTheDocument();
 
     await selectLane(user, "Lane B");
-    await user.selectOptions(screen.getByDisplayValue("Native (Claude / Codex)"), ["9router"]);
+    await user.selectOptions(screen.getByDisplayValue("Native (Claude)"), ["9router"]);
     await waitFor(() => expect(routerApply).toHaveBeenCalledWith(2, "9router"));
     await settle();
     expect(screen.getByDisplayValue("9Router")).toBeInTheDocument();
@@ -216,7 +216,7 @@ describe("Workspace — the lane Model picker across a lane switch", () => {
     // Back to the lane that was never switched. It is still native server-side,
     // so the picker must say so — the row is one instance shared by every lane.
     await selectLane(user, "Lane A");
-    expect(screen.getByDisplayValue("Native (Claude / Codex)")).toBeInTheDocument();
+    expect(screen.getByDisplayValue("Native (Claude)")).toBeInTheDocument();
     // And nothing may have been written to lane A on the way.
     expect(routerApply).not.toHaveBeenCalledWith(1, expect.anything());
   });
diff --git a/client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap b/client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap
index d731a17f..5a9ab545 100644
--- a/client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap
+++ b/client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap
@@ -6996,6 +6996,47 @@ exports[`screen snapshots > Settings 1`] = `
           </svg>
           Appearance
         </button>
+        <button
+          class="inline-flex items-center gap-1.5 text-xs whitespace-nowrap px-2.5 py-1.5 rounded-lg border transition-colors flex-shrink-0 border-border text-fg-secondary hover:text-fg-primary hover:bg-surface-3"
+          type="button"
+        >
+          <svg
+            class="lucide lucide-bot w-3.5 h-3.5"
+            fill="none"
+            height="24"
+            stroke="currentColor"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            stroke-width="2"
+            viewBox="0 0 24 24"
+            width="24"
+            xmlns="http://www.w3.org/2000/svg"
+          >
+            <path
+              d="M12 8V4H8"
+            />
+            <rect
+              height="12"
+              rx="2"
+              width="16"
+              x="4"
+              y="8"
+            />
+            <path
+              d="M2 14h2"
+            />
+            <path
+              d="M20 14h2"
+            />
+            <path
+              d="M15 13v2"
+            />
+            <path
+              d="M9 13v2"
+            />
+          </svg>
+          AI Tools
+        </button>
         <button
           class="inline-flex items-center gap-1.5 text-xs whitespace-nowrap px-2.5 py-1.5 rounded-lg border transition-colors flex-shrink-0 bg-accent/15 border-accent/30 text-accent"
           type="button"
@@ -8089,6 +8130,105 @@ exports[`screen snapshots > Settings 1`] = `
         </div>
       </div>
     </section>
+    <section
+      class="scroll-mt-24"
+      id="ai-tools"
+    >
+      <h3
+        class="text-sm font-medium text-fg-secondary flex items-center gap-2 mb-1"
+      >
+        <svg
+          class="lucide lucide-bot w-4 h-4 text-fg-muted"
+          fill="none"
+          height="24"
+          stroke="currentColor"
+          stroke-linecap="round"
+          stroke-linejoin="round"
+          stroke-width="2"
+          viewBox="0 0 24 24"
+          width="24"
+          xmlns="http://www.w3.org/2000/svg"
+        >
+          <path
+            d="M12 8V4H8"
+          />
+          <rect
+            height="12"
+            rx="2"
+            width="16"
+            x="4"
+            y="8"
+          />
+          <path
+            d="M2 14h2"
+          />
+          <path
+            d="M20 14h2"
+          />
+          <path
+            d="M15 13v2"
+          />
+          <path
+            d="M9 13v2"
+          />
+        </svg>
+        AI Tools
+      </h3>
+      <p
+        class="text-xs text-fg-muted mb-4"
+      >
+        AI coding CLIs AgentHub can run in a lane. Detected on this machine's PATH; a disabled tool is hidden from Add lane.
+      </p>
+      <div
+        class="card p-5 space-y-5"
+      >
+        <div>
+          <div
+            class="flex items-center justify-between gap-3 mb-2"
+          >
+            <p
+              class="text-xs font-medium text-fg-secondary"
+            >
+              Installed (0 detected)
+            </p>
+            <button
+              class="inline-flex items-center gap-1.5 rounded-md border border-border px-2 py-1 text-xs text-fg-secondary hover:bg-surface-3 disabled:opacity-50"
+              type="button"
+            >
+              <svg
+                class="lucide lucide-refresh-cw w-3.5 h-3.5"
+                fill="none"
+                height="24"
+                stroke="currentColor"
+                stroke-linecap="round"
+                stroke-linejoin="round"
+                stroke-width="2"
+                viewBox="0 0 24 24"
+                width="24"
+                xmlns="http://www.w3.org/2000/svg"
+              >
+                <path
+                  d="M3 12a9 9 0 0 1 9-9 9.75 9.75 0 0 1 6.74 2.74L21 8"
+                />
+                <path
+                  d="M21 3v5h-5"
+                />
+                <path
+                  d="M21 12a9 9 0 0 1-9 9 9.75 9.75 0 0 1-6.74-2.74L3 16"
+                />
+                <path
+                  d="M8 16H3v5"
+                />
+              </svg>
+              Refresh
+            </button>
+          </div>
+          <ul
+            class="divide-y divide-border rounded-md border border-border"
+          />
+        </div>
+      </div>
+    </section>
     <section
       class="scroll-mt-24"
       id="pricing"
diff --git a/docs/API.md b/docs/API.md
index 46ed0066..84d63b1f 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -2075,14 +2075,16 @@ GET    /api/run/history?limit=&laneId=  Persisted run history; laneId narrows to
 GET    /api/run/files?cwd=&q=         Fuzzy file search inside cwd for the @-file autocomplete
 POST   /api/run/drop-image            Raw image body (png/jpeg/gif/webp, ≤20 MB) → {path}: saved 0600 under <tmpdir>/agenthub-drops-<uid>/ with a random name, pruned after a day; the terminal pastes the path
                                        (skips node_modules, .git, dist, build, .next, .cache, coverage, vendor)
-POST   /api/run                       Start/attach run — Body: { laneId, cwd?, model?, permissionMode?, effort?, resumeSessionId?, initialPrompt? }
+POST   /api/run                       Start/attach run — Body: { laneId, cwd?, model?, permissionMode?, effort?, resumeSessionId?, initialPrompt?, sandbox?, approval?, resumeLast?, bypass? }
 GET    /api/run/:id                   Run handle (returns live run state)
 DELETE /api/run/:id                   Kill (SIGTERM → SIGKILL after 5 s)
 ```
 
 `:id` must be a lane pane name, `agenthub-lane-<n>`; anything else answers 404 without reaching tmux, so these two routes can never touch a tmux session the dashboard did not start.
 
-**`GET /api/run/binary`:** Probes for the binary (`claude`, `codex` or `agy`). Optional query parameter `?tool=codex` probes for Codex and `?tool=antigravity` for Antigravity's `agy`; omitted or `?tool=claude` probes for Claude. Returns `{ found: bool, path: string | null }`.
+**`GET /api/run/binary`:** Probes PATH for a lane tool's CLI, looked up in the AI Tools catalog (`?tool=<id>`, default `claude`; an unknown id is `400 EBADTOOL`). Always a fresh look, not the catalog's cached detection. Returns `{ found: bool, path: string | null }`.
+
+**`bypass: true`** (both `POST /api/run` and `POST /api/lanes/:id/start`) appends the lane tool's catalog bypass args/env for that run only; Codex's replaces `-s`/`-a`, Claude has none. A lane whose tool is no longer in the catalog answers `400 ENOTOOL`.
 
 **`POST /api/run` (start/attach):** Requires `laneId` (the lane this run belongs to). Creates or attaches an existing tmux session named `agenthub-lane-<id>` in the lane's working directory. If that session already exists and its pane is idling at a shell prompt, the appropriate command line (including `--resume` and any initial prompt) is typed into that pane instead of being dropped; if the pane is running a program, the request adopts the session unchanged. Optionally accepts `initialPrompt` to immediately type/send into the session (if empty or omitted, the session is created/attached with no initial input). Returns `{ id, laneId, status, cwd, model, permissionMode, effort, resumeSessionId, sessionId, startedAt, promptPreview }` where `id` is the tmux session name. The dashboard self-heals a lane's `run_id`/`status` on every read if the tmux session has been killed externally.
 
@@ -2094,6 +2096,16 @@ Every history row carries `lane_id` (the lane whose run it belongs to) and `tool
 
 ---
 
+### AI Tools
+
+```
+GET    /api/ai-tools                  Catalog + detection — { tools: [...], default }
+POST   /api/ai-tools/refresh          Re-read the login shell's PATH, re-detect, same body
+PUT    /api/ai-tools/:id              Body: { enabled?: boolean, default?: true } — same body
+```
+
+Each tool: `{ id, label, command, homepageUrl, installed, path, enabled, source: "builtin"|"custom", launcher, prompt: { mode }, resume: bool, bypass: bool, routerCapable: bool }` — flags only, never the arg arrays. `default` is the effective default: the stored one if installed and enabled, else `claude` if installed and enabled, else the first installed enabled tool, else `null`. `PUT` answers `404 ENOTOOL` for an unknown id, `400 EBADDEFAULT` for a default that is not installed or disabled, `400 EBADFIELD` for a non-boolean `enabled`; disabling the default clears it. Writes are same-origin only. State lives in `<data dir>/ai-tools.json`.
+
 ### AI Router profiles
 
 ```
diff --git a/docs/CLI.md b/docs/CLI.md
index 446de7e0..3410812a 100644
--- a/docs/CLI.md
+++ b/docs/CLI.md
@@ -232,8 +232,8 @@ A lane is a durable unit of parallel agent work — one working directory, many
 | Command | Description |
 | ------- | ----------- |
 | `agenthub lanes` | List lanes with stage, status, liveness and progress |
-| `agenthub lanes add --cwd <path> --title <text>` | Adopt an existing directory as a lane |
-| `agenthub lanes add --repo <path> [--title <text>] [--base <branch>] [--slug <slug>]` | Provision a dashboard-managed git worktree as a new lane |
+| `agenthub lanes add --cwd <path> --title <text> [--tool <id>]` | Adopt an existing directory as a lane; `--tool` is an AI Tools id (default `claude`) |
+| `agenthub lanes add --repo <path> [--title <text>] [--base <branch>] [--slug <slug>] [--tool <id>]` | Provision a dashboard-managed git worktree as a new lane |
 | `agenthub lanes profile init <repo> [--force]` | Detect a Node.js project (single-service or backend+frontend monorepo) and scaffold `.agenthub/profile/`. Refuses to overwrite an existing one without `--force` |
 | `agenthub lanes pipeline [<template-id>] [<id>]` | Show which pipeline template a lane renders against, plus the available templates and their node counts (none until you install one in `DASHBOARD_PIPELINES_DIR`); pass a template id to switch. An unknown id is refused (`400 EBADPIPELINE`), and a switch that leaves the lane's current stage unresolvable warns |
 | `agenthub lanes profile check [<path>]` | Validate a profile — parses, every referenced hook exists and is executable, no leftover `TODO:`, declared ports free. `<path>` defaults to the current directory (not a lane id) |
@@ -259,7 +259,7 @@ A lane is a durable unit of parallel agent work — one working directory, many
 
 Omit `<id>` and the command addresses the lane owning the current directory, so a session running inside a lane never needs to know its own id. Only a leading all-digits argument is read as an id — `agenthub lanes logs web --tail 4096` addresses the lane by directory, not lane 4096.
 
-Resolution order, shared by every cwd-resolving command: `--lane`/leading id → `AGENTHUB_LANE_ID` (exported into every tmux pane the dashboard starts) → `--tool claude|codex`, else the harness's marker (`CLAUDECODE` means claude; Codex has no equivalent marker, so a codex session outside a dashboard pane passes `--tool codex`) → the lane owning the directory. One directory can back a `claude` lane and a `codex` lane at once, so when two candidates remain the command fails and names both instead of picking one — see [Which lane a CLI command addresses](LANES.md#which-lane-a-cli-command-addresses).
+Resolution order, shared by every cwd-resolving command: `--lane`/leading id → `AGENTHUB_LANE_ID` (exported into every tmux pane the dashboard starts) → `--tool <id>`, else the harness's marker (`CLAUDECODE` means claude; Codex has no equivalent marker, so a codex session outside a dashboard pane passes `--tool codex`) → the lane owning the directory. One directory can back a `claude` lane and a `codex` lane at once, so when two candidates remain the command fails and names both instead of picking one — see [Which lane a CLI command addresses](LANES.md#which-lane-a-cli-command-addresses).
 
 Because a lane's services are fully detached, restarting the dashboard (or `agenthub update`) never stops a running stack.
 
diff --git a/docs/LANES.md b/docs/LANES.md
index f4bc915e..8d2f9aa9 100644
--- a/docs/LANES.md
+++ b/docs/LANES.md
@@ -448,7 +448,7 @@ curl -X POST http://localhost:4820/api/lanes/ensure \
 }
 ```
 
-- If a lane already owns the `cwd` **for the requested `tool`**, returns that lane with `created: false` and HTTP `200`. `tool` (`claude`, `codex` or `antigravity`, default `claude`) is part of the identity: adopting the same `cwd` with a different `tool` creates a second, sibling lane rather than adopting the existing one — one `cwd` can back at most one `claude` lane and one `codex` lane at a time. This applies to Repo/Adopt mode only; Worktree mode always gets its own directory.
+- If a lane already owns the `cwd` **for the requested `tool`**, returns that lane with `created: false` and HTTP `200`. `tool` (an AI Tools catalog id — `claude`, `codex`, `antigravity`, `gemini`, … — default `claude`) is part of the identity: adopting the same `cwd` with a different `tool` creates a second, sibling lane rather than adopting the existing one — one `cwd` can back at most one lane per tool. An unknown id answers `400 EBADTOOL`; creating a NEW lane for a tool disabled in Settings → AI Tools answers `400 EDISABLED` (an existing lane is still found). This applies to Repo/Adopt mode only; Worktree mode always gets its own directory.
 - If the `cwd` is a subdirectory of an existing lane with that same tool, returns the parent lane that owns it. Pass `"exact": true` to skip that: only a lane on this very directory is returned, and a nested one is created as its own lane — the Add-lane modal does this, and shows which lane already owns the folder when the answer is `created: false`.
 - If no lane owns the `(cwd, tool)` pair, creates an **adopted** lane and returns it with `created: true` and HTTP `201`.
 - A relative or missing `cwd` returns `400 EBADCWD`.
@@ -866,7 +866,7 @@ This command:
 ### Full command signature
 
 ```bash
-agenthub stage <stage> [--lane <id>] [--cwd <path>] [--tool claude|codex] [--status <s>] [--evidence <text>] [--note <text>] [--result pass|fail]
+agenthub stage <stage> [--lane <id>] [--cwd <path>] [--tool <id>] [--status <s>] [--evidence <text>] [--note <text>] [--result pass|fail]
 ```
 
 **Parameters:**
@@ -890,7 +890,7 @@ agenthub stage <stage> [--lane <id>] [--cwd <path>] [--tool claude|codex] [--sta
 
 - `--cwd <path>` (optional): working directory to match against a lane's cwd. If omitted, uses the current working directory. Useful when calling from outside the repo.
 
-- `--tool claude|codex` (optional): which tool's lane to address when one directory backs both (see "Which lane a CLI command addresses" below).
+- `--tool <id>` (optional): which tool's lane to address when one directory backs both (see "Which lane a CLI command addresses" below).
 
 - `--status <s>` (optional): the lane's overall status (`running`, `idle`, `provisioning`). Allows bundling a status update with the stage report.
 
@@ -953,7 +953,7 @@ activate`, `lanes up/down/logs`, …) shares one resolver, `resolveLaneArg` in
    carries it (`tmux new-session -e`, or an assignment prefix when the argv is
    typed into a pane already at a shell prompt). A session inside a
    dashboard-started pane therefore never has to guess.
-3. `--tool claude|codex`, then the harness's own marker: Claude Code exports
+3. `--tool <id>`, then the harness's own marker: Claude Code exports
    `CLAUDECODE`/`CLAUDE_CODE_ENTRYPOINT`, so a Claude session identifies itself
    for free. **Codex has no equivalent marker** (it only reads `CODEX_HOME`, and
    sets `CODEX_SANDBOX*` under a sandbox policy), so a codex session outside a
@@ -1657,3 +1657,23 @@ agenthub stage <stage> [--evidence "..."]         # Report the current stage
 - `server/routes/lanes.js` — REST API surface
 - `bin/agenthub.js` — CLI commands for lanes and stage reporting
 - `server/routes/hooks.js` — hook-to-lane binding by cwd, and where detection is invoked
+
+## Lanes on any AI tool
+
+A lane can run any AI coding CLI in the AI Tools catalog (`server/data/ai-tools/*.json`, plus any `*.json` in `DASHBOARD_AI_TOOLS_DIR`, which replaces a built-in file with the same `id` but may not set `launcher`). Settings → Dashboard → **AI Tools** lists what is installed (found on PATH; **Refresh** re-reads the login shell's PATH first) with **Enabled/Disabled** and **Set default**, and what is available to install with a homepage link. The Add-lane modal offers **Default (<tool>)** and **Other…**; `agenthub lanes add --tool <id>` does the same from a terminal.
+
+A catalog file:
+
+```json
+{
+  "id": "antigravity",
+  "label": "Antigravity",
+  "detect": ["agy"],
+  "homepageUrl": "https://antigravity.google/docs/cli/overview",
+  "prompt": { "mode": "flag", "flag": "-i" },
+  "resume": ["--continue"],
+  "bypass": ["--dangerously-skip-permissions"]
+}
+```
+
+`detect` lists bare command names (the first found on PATH is what runs), `requires` other commands that must be present, `args` fixed leading args, `prompt.mode` one of `argv` (optional `separator: "--"`), `flag` (`flag`), or `after-start` (`delayMs`, default 3000 — the prompt is pasted into the pane once the CLI is up). `resume` enables **Resume last session**; `bypass`/`bypassEnv` enable the run form's per-run **Bypass permissions** switch, which is off every time the form opens. Every non-Claude lane has no pipeline, no agents install and no AI Router (native only, except Codex); running/idle comes from the exited-pane heal sweep.
diff --git a/openapi.yaml b/openapi.yaml
index 6b7b1590..2609831d 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -60,6 +60,8 @@ tags:
     description: Durable parallel-work lanes and dashboard-managed git worktrees
   - name: Push
     description: Web Push notification subscriptions and broadcast (VAPID); also fires native Electron notifications when hosted in the desktop app
+  - name: AI Tools
+    description: The catalog of AI coding CLIs a lane can run (server/data/ai-tools/*.json + DASHBOARD_AI_TOOLS_DIR), what is installed on PATH, and the user's enable/default choice
 components:
   parameters:
     SessionIdPath:
@@ -4078,6 +4080,91 @@ components:
                 type: string
                 description: Response body or error message, truncated to 200 characters.
                 example: UnauthorizedRegistration
+    AiToolsTool:
+      type: object
+      required:
+        - id
+        - label
+        - installed
+        - enabled
+        - source
+      properties:
+        id:
+          type: string
+          example: antigravity
+        label:
+          type: string
+          example: Antigravity
+        command:
+          type: string
+          nullable: true
+          example: agy
+        homepageUrl:
+          type: string
+          nullable: true
+        installed:
+          type: boolean
+        path:
+          type: string
+          nullable: true
+          example: /home/u/.local/bin/agy
+        enabled:
+          type: boolean
+        source:
+          type: string
+          enum:
+            - builtin
+            - custom
+        launcher:
+          type: string
+          nullable: true
+          enum:
+            - claude
+            - codex
+            - null
+        prompt:
+          type: object
+          nullable: true
+          properties:
+            mode:
+              type: string
+              enum:
+                - argv
+                - flag
+                - after-start
+        resume:
+          type: boolean
+          description: Offers Resume last session
+        bypass:
+          type: boolean
+          description: Offers the per-run Bypass permissions switch
+        routerCapable:
+          type: boolean
+          description: Can use an AI Router profile
+    AiToolsView:
+      type: object
+      required:
+        - tools
+        - default
+      properties:
+        tools:
+          type: array
+          items:
+            $ref: '#/components/schemas/AiToolsTool'
+        default:
+          type: string
+          nullable: true
+          description: Effective default tool id
+    AiToolsError:
+      type: object
+      properties:
+        error:
+          type: object
+          properties:
+            code:
+              type: string
+            message:
+              type: string
     SessionsFacetsResponse:
       type: object
       description: 'Facet values for the Sessions page filter UI: the distinct working directories (cwd) and the distinct data-source ids seen across all sessions.'
@@ -11442,6 +11529,79 @@ paths:
               example:
                 error:
                   message: Push service unavailable
+  /api/ai-tools:
+    get:
+      tags:
+        - AI Tools
+      summary: List the AI Tools catalog
+      description: Every catalog tool with whether it was found on PATH, whether it is enabled, and the effective default (stored default if installed+enabled, else claude, else the first installed enabled tool, else null). Arg arrays are never returned.
+      operationId: aiToolsList
+      responses:
+        '200':
+          description: The catalog with detection and the effective default
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AiToolsView'
+  /api/ai-tools/refresh:
+    post:
+      tags:
+        - AI Tools
+      summary: Re-detect installed tools
+      description: Merges the login shell's PATH ($SHELL -ilc, 5 s timeout, off with AGENTHUB_SHELL_PATH=0) into the server's, re-reads the catalog and re-detects. Same-origin only.
+      operationId: aiToolsRefresh
+      responses:
+        '200':
+          description: The catalog with detection and the effective default
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AiToolsView'
+  /api/ai-tools/{id}:
+    put:
+      tags:
+        - AI Tools
+      summary: Enable/disable a tool or make it the default
+      description: A disabled tool is hidden from Add lane and a NEW lane for it answers 400 EDISABLED; existing lanes keep working. Disabling the default clears it. Same-origin only.
+      operationId: aiToolsUpdate
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                enabled:
+                  type: boolean
+                default:
+                  type: boolean
+                  enum:
+                    - true
+      responses:
+        '200':
+          description: The catalog with detection and the effective default
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AiToolsView'
+        '400':
+          description: EBADDEFAULT (not installed or disabled) or EBADFIELD
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AiToolsError'
+        '404':
+          description: ENOTOOL — unknown id
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AiToolsError'
   /api/sessions/facets:
     get:
       tags:
diff --git a/server/README.md b/server/README.md
index f2d4aa58..9baac6ae 100644
--- a/server/README.md
+++ b/server/README.md
@@ -535,6 +535,9 @@ Request body shape:
 | `GET` | `/api/git-credentials` | AgentHub's own git logins (one per host, shared by every user), `hasToken` only — never a password. |
 | `POST` | `/api/git-credentials` | Same-origin guarded save/replace: `{protocol, host, username, password}`. `400 EBADHOST`/`EBADCRED`. |
 | `DELETE` | `/api/git-credentials/:protocol/:host` | Same-origin guarded delete. `404 ENOTFOUND`. |
+| `GET` | `/api/ai-tools` | The AI Tools catalog (`server/lib/ai-tools.js`: `server/data/ai-tools/*.json` + `DASHBOARD_AI_TOOLS_DIR`) with detection, enabled flag and the effective default. Flags only, never arg arrays. |
+| `POST` | `/api/ai-tools/refresh` | Same-origin guarded: merge the login shell's PATH (`server/lib/shell-path.js`), re-detect. |
+| `PUT` | `/api/ai-tools/:id` | Same-origin guarded `{enabled?, default?: true}`. `404 ENOTOOL`, `400 EBADDEFAULT`/`EBADFIELD`. |
 | `POST` | `/api/lanes/:id/git/:action` | Same-origin guarded git write, serialized under the lane lock: `fetch`, `pull` (always `--ff-only`), `push` (`-u origin HEAD`), `stage`/`unstage`/`discard` (per file; a path must be one git reports changed, and `discard` needs `confirm:true`), `stage-hunk`/`discard-hunk` (one hunk by its `@@` line, re-read fresh — `409 EHUNKGONE` when it moved; `discard-hunk` needs `confirm:true`), `commit` (`add -A` + `-m`, or `only:"staged"`), `switch` (refuses a dirty tree), `branch-create` (never switches) `branch-delete` (`-d`, refuses protected/current/busy branches) and `publish` (`{url}`: `remote add origin` + `push -u origin HEAD`, only when the repo has no remote; URL allowlisted to https-without-userinfo/ssh/scp-like; remote rolled back on a failed push). `merge` (clean tree, repo-root lane, a ref that exists; conflicts come back as `conflicts[]`), `resolve` (`side: ours|theirs|done`, conflicted paths only, `done` refuses leftover markers), `merge-commit`, `merge-abort` (`confirm:true`); `EMERGING` blocks pull/switch/merge/hunk actions mid-merge. No rebase/reset/stash by design. A remote wanting a login is `409 EGITAUTH` with `auth: {protocol, host, username, rejected}`; resend with `credentials: {protocol, host, username, password, remember}` (a repo remote's host only, else `400 EBADHOST`; saved only after git succeeds and `remember` is set). |
 
 The route accepts `{ sourceRepo, title, base?, slug? }`. `sourceRepo` must be
@@ -679,7 +682,7 @@ Reads — and carefully gated mutations for low-risk text-file artifacts — for
 
 ### Run a lane's CLI (`/api/run`)
 
-HTTP surface for the tmux-backed terminal run: one session per lane, named `agenthub-lane-<laneId>`, running the CLI that lane declares (`claude`, `codex`, or `agy` for an `antigravity` lane). There is no in-memory handle map — every read is computed from `tmux list-sessions`, so a session killed out-of-band self-corrects on the next call. Every route enforces a same-origin / loopback-Origin guard against browser CSRF.
+HTTP surface for the tmux-backed terminal run: one session per lane, named `agenthub-lane-<laneId>`, running the CLI that lane declares — any AI Tools catalog id: `claude`/`codex` through their own argv builders, every other tool by its detected absolute path with the args its catalog file gives (an `after-start` prompt is pasted into the pane through a tmux buffer once the CLI is up; `bypass: true` adds the file's bypass args for that run only). There is no in-memory handle map — every read is computed from `tmux list-sessions`, so a session killed out-of-band self-corrects on the next call. Every route enforces a same-origin / loopback-Origin guard against browser CSRF.
 
 | Method   | Path                          | Description |
 | -------- | ----------------------------- | ----------- |
@@ -1516,6 +1519,10 @@ DASHBOARD_ALLOWED_HOSTS=           # Extra Host-header names to allow (comma-sep
 # Database
 DASHBOARD_DB_PATH=./data/dashboard.db  # SQLite database path
 
+# AI Tools
+DASHBOARD_AI_TOOLS_DIR=            # Extra AI Tools catalog JSON files; an id here replaces the built-in one
+AGENTHUB_SHELL_PATH=1              # 0 = never run the login shell to read its PATH (startup + Refresh)
+
 # Background services
 DASHBOARD_SESSION_SYNC_MS=30000    # Continuous project-sync poll interval (ms); 0 disables the poll (watcher stays)
 DASHBOARD_LIVENESS_PROBE=1         # 0 disables the dead-session liveness reap (use when hooks arrive from another machine)
diff --git a/server/openapi-extra.js b/server/openapi-extra.js
index f016701a..bf219231 100644
--- a/server/openapi-extra.js
+++ b/server/openapi-extra.js
@@ -15,6 +15,7 @@ const codexConfig = require("./openapi-extra/codex-config");
 const run = require("./openapi-extra/run");
 const lanes = require("./openapi-extra/lanes");
 const push = require("./openapi-extra/push");
+const aiTools = require("./openapi-extra/ai-tools");
 const misc = require("./openapi-extra/misc");
 // Enriched overrides of already-documented endpoints — same operationId, tags,
 // and request/response `$ref` schemas as the base, with added examples and
@@ -49,6 +50,7 @@ module.exports = combine(
   run,
   lanes,
   push,
+  aiTools,
   misc,
   overrideSessionsAgents,
   overrideCore,
diff --git a/server/openapi-extra/ai-tools.js b/server/openapi-extra/ai-tools.js
new file mode 100644
index 00000000..f351382a
--- /dev/null
+++ b/server/openapi-extra/ai-tools.js
@@ -0,0 +1,128 @@
+/**
+ * @file Supplementary OpenAPI 3.0 fragments for the AI Tools routes mounted at
+ * `/api/ai-tools` (see server/routes/ai-tools.js + server/lib/ai-tools.js):
+ * list the catalog with detection, re-detect after hydrating PATH, and
+ * enable/disable a tool or make it the default. Exports `{ tags, schemas,
+ * paths }` for server/openapi-extra.js; schemas are prefixed `AiTools`.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const tags = [
+  {
+    name: "AI Tools",
+    description:
+      "The catalog of AI coding CLIs a lane can run (server/data/ai-tools/*.json + DASHBOARD_AI_TOOLS_DIR), what is installed on PATH, and the user's enable/default choice",
+  },
+];
+
+const errorRef = { $ref: "#/components/schemas/AiToolsError" };
+
+const schemas = {
+  AiToolsTool: {
+    type: "object",
+    required: ["id", "label", "installed", "enabled", "source"],
+    properties: {
+      id: { type: "string", example: "antigravity" },
+      label: { type: "string", example: "Antigravity" },
+      command: { type: "string", nullable: true, example: "agy" },
+      homepageUrl: { type: "string", nullable: true },
+      installed: { type: "boolean" },
+      path: { type: "string", nullable: true, example: "/home/u/.local/bin/agy" },
+      enabled: { type: "boolean" },
+      source: { type: "string", enum: ["builtin", "custom"] },
+      launcher: { type: "string", nullable: true, enum: ["claude", "codex", null] },
+      prompt: {
+        type: "object",
+        nullable: true,
+        properties: { mode: { type: "string", enum: ["argv", "flag", "after-start"] } },
+      },
+      resume: { type: "boolean", description: "Offers Resume last session" },
+      bypass: { type: "boolean", description: "Offers the per-run Bypass permissions switch" },
+      routerCapable: { type: "boolean", description: "Can use an AI Router profile" },
+    },
+  },
+  AiToolsView: {
+    type: "object",
+    required: ["tools", "default"],
+    properties: {
+      tools: { type: "array", items: { $ref: "#/components/schemas/AiToolsTool" } },
+      default: { type: "string", nullable: true, description: "Effective default tool id" },
+    },
+  },
+  AiToolsError: {
+    type: "object",
+    properties: {
+      error: {
+        type: "object",
+        properties: { code: { type: "string" }, message: { type: "string" } },
+      },
+    },
+  },
+};
+
+const ok = {
+  200: {
+    description: "The catalog with detection and the effective default",
+    content: { "application/json": { schema: { $ref: "#/components/schemas/AiToolsView" } } },
+  },
+};
+
+const paths = {
+  "/api/ai-tools": {
+    get: {
+      tags: ["AI Tools"],
+      summary: "List the AI Tools catalog",
+      description:
+        "Every catalog tool with whether it was found on PATH, whether it is enabled, and the effective default (stored default if installed+enabled, else claude, else the first installed enabled tool, else null). Arg arrays are never returned.",
+      operationId: "aiToolsList",
+      responses: ok,
+    },
+  },
+  "/api/ai-tools/refresh": {
+    post: {
+      tags: ["AI Tools"],
+      summary: "Re-detect installed tools",
+      description:
+        "Merges the login shell's PATH ($SHELL -ilc, 5 s timeout, off with AGENTHUB_SHELL_PATH=0) into the server's, re-reads the catalog and re-detects. Same-origin only.",
+      operationId: "aiToolsRefresh",
+      responses: ok,
+    },
+  },
+  "/api/ai-tools/{id}": {
+    put: {
+      tags: ["AI Tools"],
+      summary: "Enable/disable a tool or make it the default",
+      description:
+        "A disabled tool is hidden from Add lane and a NEW lane for it answers 400 EDISABLED; existing lanes keep working. Disabling the default clears it. Same-origin only.",
+      operationId: "aiToolsUpdate",
+      parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }],
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              properties: {
+                enabled: { type: "boolean" },
+                default: { type: "boolean", enum: [true] },
+              },
+            },
+          },
+        },
+      },
+      responses: {
+        ...ok,
+        400: {
+          description: "EBADDEFAULT (not installed or disabled) or EBADFIELD",
+          content: { "application/json": { schema: errorRef } },
+        },
+        404: {
+          description: "ENOTOOL — unknown id",
+          content: { "application/json": { schema: errorRef } },
+        },
+      },
+    },
+  },
+};
+
+module.exports = { tags, schemas, paths };