Remote clients (docs/plans/remote-clients/README.md, B1–B3 for the Claude pool):
- server/hub/ holds the hub-only code (devices, remote sessions, upload ingest,
LAN gateway), required only in server mode; hub-boundary.test.js keeps local
code from importing it.
- A local install enrolls with `agenthub remote login` or Settings → AI tools →
Company hub; the "Company account" AI Proxy (reserved name agenthub.company)
sends a session through the hub's gateway, which adds a pool account's token —
no credential reaches the machine. Only those sessions are uploaded, hourly
and at their end; secret-shaped strings are redacted on the client.
- Gateway refuses: unknown device (401), a message without a session id, an
unregistered session under AGENTHUB_REMOTE_GATE=block, a user over quota
(EQUOTA), a purged session (410). Device tokens 90 days, conversations 30.
- New alert rule type remote_unmonitored: a company-account session its device
never registered; a late registration clears the flag instead.
- The hub imports a session once per upload round (chunks carry `more`),
not once per chunk.
Artifacts:
- Share an artifact with chosen people (artifact_shares, PATCH sharedWith,
GET /api/artifacts/people) besides everyone; a "Shared with you" tab.
Only the owner or an admin sees or edits who it is shared with; audited.
- Folders: each account's own arrangement (agenthub.artifacts.folders pref).
- A claude.ai page keeps a copy viewable without the publishing account: its
HTML file (and supporting files) snapshotted at publish, or the copy Claude
saves for a Doc / Slides / Design in artifacts-export/ (a synchronous
PostToolUse hint hook, scripts/artifact-export-hint.js, admin switch),
attached to the page at Stop. Viewed in HtmlFrame's sandbox, Markdown, or
pdf.js (pdfjs-dist 6.4.299, legacy build, loaded only for a PDF).
Fixes:
- tmux: a cached /proc/<pid>/exe of an exited server falls back to PATH's
tmux (stop the last pane, start again within 10 s failed with ENOENT).
- shelves: a shelf restores beside changes in other files.
- chat: a finished reply ends the turn even with no hook at all.
- Settings → AI tools: profile list display tweaks.
Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.
EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.
- S3 core: provisioning, per-member tmux servers, the proxy key
gateway, shared tools in /opt, dropped capabilities for children
(P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
test: symlink/TOCTOU-safe member reads, no host writes in a member
home, credentials and the data dir never served, owner and folder
account must agree, pane tokens bound to the pane's uid, bounded
sudo/tmux/git calls and member reads (no hang or crash from a member),
async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules
Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.
Co-Authored-By: Claude <noreply@anthropic.com>
AI Proxy (was AI Router):
- server/lib/ai-proxies.js, proxy-apply.js, routes/ai-proxies.js mounted at
/api/ai-proxies and the old /api/ai-routers; `router` still accepted on the
start routes; profiles move to <CLAUDE_HOME>/agenthub-proxies/
- dashboard_runs.router renamed in place to proxy: an older build on the same
DB fails on that column, so dev and prod sharing one DB update together
- a proxy's baseUrl stored as its root (a typed /v1 made /v1/v1/messages);
Test probes Claude /v1/messages and Codex /v1/responses
- Settings → AI Proxy (/settings/ai-router redirects), ProxyPicker
Updates:
- every tab reloads onto the new UI build when its WebSocket reconnects to a
server of another version (lib/newBuildReload.ts, once per version)
- Update now stops waiting on a plugin chain that failed or pulled nothing
(the old server never goes down), and reloads as soon as a new version answers
Also:
- a pane whose command exits at once says so (EPANEEXITED) instead of
"Command failed: tmux set-option … mouse on"
- the pane drag preview draws where the pane actually lands
nntrivi2001