Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
AuthGate), roles admin / analyst / member, accounts made only from the
host's shell: `agenthub server setup|off|status`, `agenthub users
list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
staff reads of a member's session are audited (server/lib/audit.js);
Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/
Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
chip), sent by its saved path (POST /api/run/drop-file); files dragged from
the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md
Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.
Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.
Measured on a copy of a real 1.2 GB / 253K-event database, 10 simulated
browsers + 10 hooks/s for 90 s: event-loop delay p99 1239 ms → 32 ms (max
2.0 s → 94 ms), 266 failed requests → 0, 74 → 111 requests/s served, server
RSS 633 → 346 MB. Entry bundle 975 KB raw → 394 KB (106 KB brotli).
Server
- /api/analytics: the events-table scans run in the read worker
(scoped-stats eventAggregates, read-pool job analyticsEvents); runRead takes
maxAgeMs — analytics 10 s, /api/workflows 30 s — keyed by the args
- /api/workflows/skill-usage: +event_type and a tool_name range instead of
LIKE, so it uses idx_events_tool (784 ms → a few ms)
- idx_events_session_type_tool (session_id, event_type, tool_name,
created_at) replaces idx_events_session_type: covering reads for session
stats, the hook dedupes and the import resume point (1.2 s → 20 ms); 64 MB
cache_size and 256 MB mmap_size on both connections
- WAL: the server sets wal_autocheckpoint = 0 and checkpoints PASSIVE every
DASHBOARD_WAL_CHECKPOINT_MS (5 s) from the read worker's own writable
connection; a failed checkpoint restores the automatic one (hook COMMIT p95
109 ms → 15 ms at 100 hooks/s)
- tmux: one list-sessions answers a whole GET /api/lanes and the heal beat
(liveSessions), shared for 1 s and cleared by this process's new/kill —
GET /api/run's sync spawns had blocked 60 s of a 90 s run; the heal beat
skips tmux when nothing runs; attach options chained into 2 spawns
- hooks: TurnDuration/APIError deduped against one read per hook instead of a
query per transcript entry (23 ms/hook on a 763-turn session); one lane
scan per hook; hourly upserts skip rows that did not grow; frames are sent
after the transaction commits (and after the pane binding); new_event
carries its row id; a split pane's (slot 1–9) hooks no longer rebind the
lane's session_id
- watchdog liveness probe runs ps asynchronously; transcript newline scan via
indexOf; startup subagent backfill fingerprints the files it already checked
- pty attach: backpressure (pause past 1 MB unsent, resume under 256 KB)
- static: hashed assets served from their pre-compressed .br/.gz sibling
Client
- hidden tabs neither refetch on WS events nor poll (useLiveRefresh, panes,
lane cards, git header, changes panel, settings); no per-tab hourly
/updates/check (the server already checks)
- refetch storms throttled (workspace tree/session list 3 s, /api/run only on
a run-key change, notification pane lookup only when shown); WS reconnect
jitter; terminal retry backoff 1.5 → 30 s, stops on 1008
- heavier throttles for aggregates (15 s) and detail views; Monitor keepIfSame;
GET in-flight dedupe in request()
- lazy Dashboard/History, xterm (with the first terminal), lane modals, Sagi
(only while enabled); only the active locale loads; Workspace chunk
prefetched on a /workspace deep link
- Sagi: no work while disabled, pupil via CSS variables, memo avatar
- build: .br/.gz siblings, sourcemap hidden; service worker no longer caches
/assets/ (cache v3 drops the old one)
Tests: scripts/test-server.js drops the GIT_DIR-family variables a hook
exports, so a suite run from a linked worktree's pre-commit can no longer
commit into the real repository or set core.bare.
Docs: ARCHITECTURE, DATABASE, API, DEPLOYMENT, client README,
docs/plans/perf/README.md (audit, checklist, results).
Analytics parity phases 2–7 (docs/plans/analytics-parity/), built on
138e706 and ported onto v2.3.1:
- Cost by AI tool (?tool= on cost/analytics/stats/workflows, by_tool,
Codex fast/priority and flex tiers, agenthub_cost_usd_total{tool,model})
- Date ranges (from/to) on cost/analytics/workflows; Analytics range select
with Today / This week (Monday) / This month (1st) / 7d / 30d / 90d / All /
Custom; workflow filters carried into workflow-stats.js (read worker)
- Budgets and cost alerts as alert rule types (alert_rules rebuilt without
its rule_type CHECK), GET /api/budgets/status, rule preview, spend pace,
status-bar budget chip; rules stay editable in place
- Query Explorer (/query, allowlisted sort, CSV/JSON export) and scheduled
reports (report_definitions/report_runs, Settings → Reports)
- Session Replay tab and immutable snapshots (session_snapshots, /snapshot/:token)
- Remote Codex sync, push ingest with a hashed token, privacy redaction and
ignored folders (Settings → Data), Cursor sessions (no cost)
- Read-only MCP server, statusline, Grafana/Prometheus files
Also: resizable sidebar, pet run/wave animations, the workspace home keeps a
half-typed prompt, and the pre-commit hook runs only the related tests for a
small commit.
- GET /api/workflows: one LEAD() window pass in a read worker (read-pool.js,
workflow-stats.js); idx_events_session restored, idx_events_tool added
- compat-sqlite gains function/pluck/readonly so a plugin install without a
better-sqlite3 build boots again; antigravity-usage uses db.js's Database
- install-hooks adds no checkout hooks while the agenthub plugin is enabled
(events were doubled)
- terminal attach runs the live tmux server's own binary; the pane scrollbar
gets a visible 2-column style, and claude panes start with
CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1 so tmux keeps history to scroll
- Codex sessions' conversation in GET /api/sessions/:id/transcript
- Codex/Antigravity sessions claimed by their workspace without hooks
- UI-audit follow-ups, docs and OpenAPI
nntrivi2001