chore(release): bump version to 1.8.12

The plugin stops shipping its workflow layer:
- skills/ship-feature and skills/ship-feature-lane, the 18 stage/ship slash
  commands (plugin.json keeps agenthub-doctor/update/open), and all four
  agents/ (qc-local, senior-gate-reviewer, backend-reviewer, frontend-reviewer).
- CLI `agenthub skills install`, `agenthub lanes agents install`,
  `agenthub ship-full|ship-quick`; routes POST /api/skills/install and
  POST /api/lanes/:id/agents/install; the Settings button, the lane Tools
  menu item and the Add-lane setup step that called them.
- The Superpowers auto-install: server/lib/skill-plugins.js, the bootstrap's
  autoInstallSkillPlugins / skillPluginsSettled gate and the doctor row.

Pipelines are kept but dormant: server/data/pipelines/ is deleted, so no
template ships. `default` resolves to EMPTY_PIPELINE (no nodes, progress 0),
createLane still accepts it, POST /api/lanes/:id/stage answers 400
ENOPIPELINE, and the Workspace hides the stage timer, pickers, PipelineMap
and strip stage chip for a lane with no nodes. A template dropped into
DASHBOARD_PIPELINES_DIR turns it all back on. The server suite loads its
templates from server/__tests__/fixtures/pipelines/.

Docs: CLAUDE.md (marker, retired rules), README(.vi), INSTALL, ARCHITECTURE,
docs/LANES|PLUGINS|CLI|API, agenthub-introduction.html.

.claude-plugin/plugin.json

@@ -12,25 +12,7 @@
   "commands": [
     "./plugins/agenthub/commands/agenthub-doctor.md",
     "./plugins/agenthub/commands/agenthub-update.md",
-    "./plugins/agenthub/commands/agenthub-open.md",
-    "./plugins/agenthub/commands/intake.md",
-    "./plugins/agenthub/commands/plan.md",
-    "./plugins/agenthub/commands/implement.md",
-    "./plugins/agenthub/commands/tests.md",
-    "./plugins/agenthub/commands/e2e.md",
-    "./plugins/agenthub/commands/e2e-passed.md",
-    "./plugins/agenthub/commands/review.md",
-    "./plugins/agenthub/commands/qc-plan.md",
-    "./plugins/agenthub/commands/qc.md",
-    "./plugins/agenthub/commands/gate.md",
-    "./plugins/agenthub/commands/publishing.md",
-    "./plugins/agenthub/commands/pr-open.md",
-    "./plugins/agenthub/commands/reported.md",
-    "./plugins/agenthub/commands/watching-pr.md",
-    "./plugins/agenthub/commands/merged.md",
-    "./plugins/agenthub/commands/done.md",
-    "./plugins/agenthub/commands/ship-full.md",
-    "./plugins/agenthub/commands/ship-quick.md"
+    "./plugins/agenthub/commands/agenthub-open.md"
   ],
   "hooks": {
     "PreToolUse": [

AGENTS.md

@@ -11,42 +11,11 @@
 - Update docs whenever workflow or architecture changes — follow `skills/update-project-docs/` automatically at the end of every change-set (README + VN/CN/KO mirrors, ARCHITECTURE, wiki + i18n + cache bump, server/client READMEs, docs/*).
 - Every applicable source file you create or update (`.js/.ts/.tsx/.cjs/.mjs/.py/.sh/.css`) must start with the authorship header: a truthful file overview plus the exact line `@author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>`. See `skills/file-headers/` and `.claude/rules/file-headers.md`; verify with `bash skills/file-headers/scripts/check-headers.sh`.
 
-## Declare your lane stage as you work
+## Lane stage
 
-This repository is watched by AgentHub, its own dashboard. A **lane** is keyed by
-working directory, and the pipeline map only moves forward when the agent doing
-the work declares its stage:
-
-```bash
-agenthub stage <stage> --tool codex --evidence "<what is actually done>"
-```
-
-- Call it at every real transition — starting to plan, starting to implement,
-  running tests, opening the PR — not once at the end.
-- Stage names, `default` template: `intake → plan → implement → tests → review
-  → gate → ship → done` (the 16-node `ship-feature` template accepts these as
-  aliases too; `agenthub stage` warns on stderr and names the valid nodes if a stage
-  matches none).
-- **`--tool codex` matters.** One directory can back both a `claude` lane and a
-  `codex` lane, and without a tool the command fails rather than guess (it names
-  both candidates). Inside a pane the dashboard started you need nothing — that
-  pane carries `AGENTHUB_LANE_ID`, which outranks everything but `--lane`.
-- If `agenthub stage` reports that no lane owns the directory, this checkout was
-  never adopted: skip the stage calls and carry on. Stage reporting is
-  reporting, never control flow — a failed `agenthub stage` never justifies skipping
-  a step of the actual work.
-
-The dashboard also *infers* your stage from your tool calls (it reads Codex's
-own rollout journals — see `docs/LANES.md#stage-detection`), and on a codex lane
-that inference does move the pipeline map forward on its own. It still never
-counts as **evidence**: a node it moved through stays amber and never renders
-green. Only your own declaration does that — which is why the call above is
-worth making even when the map already looks right.
-
-If you hold a stage for a while with no evidence recorded, the dashboard may
-type a one-line `[agenthub]` reminder straight into this pane asking you to run
-`agenthub stage ... --evidence "..."`. That is the dashboard, not the user — treat
-it as the same instruction as this section and just make the real call.
+AgentHub's `codex` (and `antigravity`) lanes carry no pipeline: the dashboard shows no stage for
+them and never infers or advances one, so there is no `agenthub stage` call to
+make while you work here as Codex.
 
 ## Where to work
 - `server/` for API/routes/data processing.

INSTALL.md

@@ -31,11 +31,10 @@ dashboard, run it from source, or stay on Node 20.
 | npm | 9+ | Comes with Node.js |
 | Claude Code | 2.x+ | Required for hook integration |
 | Git | Any | Cloning the repository, and every lane operation (worktrees, branch/status reads) |
-| **tmux** | 3.x | **Required for the run console** — the browser terminal, `agenthub lanes shell`, typing `/reload-plugins` into a live pane, and the Codex nudge. See [Step 0](#step-0--system-packages) |
+| **tmux** | 3.x | **Required for the run console** — the browser terminal, `agenthub lanes shell`, and typing `/reload-plugins` into a live pane. See [Step 0](#step-0--system-packages) |
 | Codex CLI | Any | Optional — only for lanes whose tool is `codex` |
-| GitHub CLI (`gh`) | Any | Optional — only for `agenthub lanes ci status` and the PR stages of `/agenthub:ship-full` |
+| GitHub CLI (`gh`) | Any | Optional — only for `agenthub lanes ci status` |
 | Python | 3.6+ | Optional — only for `scripts/expand-ts-module-docs.py` (doc generation) |
-| `superpowers` plugin | Any | Optional — required only by `/agenthub:ship-feature` and `/agenthub:ship-feature-lane`, which drive its skills step by step (and which the built-in pipeline templates name as their per-node commands). Nothing else in AgentHub needs it; `/agenthub-doctor` reports it as `WARN` when absent. **Installed automatically** by the plugin's `SessionStart` bootstrap (opt out with `AGENTHUB_AUTO_INSTALL_PLUGINS=0`); by hand: `claude plugin install superpowers@claude-plugins-official` |
 
 ---
 
@@ -86,6 +85,61 @@ Detaching is `Ctrl-b d` — it leaves the run alive, which is the whole point:
 the browser terminal and your local terminal are two clients on one pane, and
 restarting the dashboard never stops a run.
 
+### macOS
+
+Status: **code-audited, untested on a Mac.** The Mac-specific paths below are
+covered by Linux-side unit tests only; the checklist at the end of this section
+is what a Mac user runs to confirm them.
+
+```bash
+brew install node git tmux       # Node >= 22.5 for the plugin install (nvm works too)
+echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc   # where the plugin puts `agenthub`
+```
+
+- **Node:** a plugin install needs **>= 22.5** (it stores data through
+  `node:sqlite`); a checkout still runs on Node 20. The `agenthub` launcher
+  pins the node that installed it and falls back to `node` on `PATH` when a
+  `brew upgrade` or `nvm` switch deletes that binary.
+- **Starts at login by itself (LaunchAgent).** The plugin bootstrap installs
+  `~/Library/LaunchAgents/io.smartgift.agenthub.plist` (a checkout: `agenthub
+  service install`), so the dashboard comes back after every login with no
+  Claude Code session, and launchd restarts it if it dies. Lane panes survive
+  a restart of the server. Its output goes to `~/Library/Logs/agenthub.log`.
+  A LaunchAgent needs a login at the Mac itself; over SSH only, or when
+  `launchctl` fails, the server is a detached process started by the next
+  Claude Code session (within about 10 s) or by `agenthub start`, as before. A
+  discovery entry left over from before the reboot is ignored, so a recycled
+  pid can never pass for a live dashboard.
+- **Started from a Claude Code session.** The server drops the variables that
+  describe that session (`CLAUDECODE`, `CLAUDE_CODE_SESSION_ID`,
+  `CLAUDE_PLUGIN_ROOT`, …) before anything else runs, so lane panes do not
+  inherit them. Your own configuration (`CLAUDE_CONFIG_DIR`,
+  `CLAUDE_CODE_USE_BEDROCK`, `ANTHROPIC_*`) passes through. A tmux server that
+  an older build started keeps its dirty global env until it exits
+  (`tmux kill-server` once, with no run you care about open).
+- **Paths.** A lane's directory is stored by its real path, so a typed `/tmp/x`
+  becomes `/private/tmp/x` and a differently-cased path on a case-insensitive
+  volume becomes the one on disk — that is what sessions report, so they bind.
+  Lanes created before this change keep the string they were created with.
+- **Account switching** uses the login Keychain item `Claude Code-credentials`;
+  macOS may ask once for permission the first time.
+- **Option key** in the browser terminal types special characters (it is not
+  sent as Meta).
+
+**Mac checklist** — please run it and report the result on issue #22:
+
+1. Fresh plugin install from a Terminal `claude` session: the dashboard answers on `http://localhost:4820`, `~/Library/LaunchAgents/io.smartgift.agenthub.plist` exists, and `/agenthub-doctor`'s launchd row says the LaunchAgent is current and running.
+2. `tmux show-environment -g | grep -i claude` prints nothing.
+3. Add a Repo lane by typing its path in a different case: sessions bind to it, and `agenthub stage plan` inside it moves the map.
+4. **Start Run** in the browser: the terminal attaches, typing works, an image paste into `claude` works, and `exit` returns to the run form.
+5. Changes panel: diff, stage and commit on a lane.
+6. Switch profile and check `claude /status` shows the new account. Repeat with a non-default `CLAUDE_HOME`, which also checks the Keychain service name.
+7. `brew upgrade node && brew cleanup`, then `agenthub status` still works.
+8. Reboot and log in WITHOUT opening `claude`: the dashboard answers within about 10 s (`agenthub service status` shows `state = running`).
+9. `kill <server pid>` (from `agenthub status`): it is back within a few seconds.
+10. With a lane run open, `/agenthub-update` completes, the server restarts on the new version, the plist names the new cache directory, and the run's terminal is still alive.
+11. `agenthub service uninstall`: the plist is gone and nothing restarts the server after a `kill`.
+
 ---
 
 ## Step 1 — Clone the repository
@@ -239,13 +293,15 @@ npm start       # Start Express serving client/dist on port 4820
 Open **http://localhost:4820** in your browser.
 
 `npm start` (and `agenthub start`, its backgrounded form) only run while that
-process is alive — a reboot loses it. On Linux, run the server as a systemd
-`--user` service instead so it comes back on its own after every reboot, with
-no manual step and no Claude Code (or any other tool) needed to trigger it:
+process is alive — a reboot loses it. Run the server as a systemd `--user`
+service (Linux) or a LaunchAgent (macOS) instead so it comes back on its own
+after every reboot, with no manual step and no Claude Code (or any other tool)
+needed to trigger it:
 
 ```bash
-agenthub service install       # writes + enables ~/.config/systemd/user/agenthub.service
-agenthub service status        # systemctl --user status agenthub
+agenthub service install       # Linux: ~/.config/systemd/user/agenthub.service
+                               # macOS: ~/Library/LaunchAgents/io.smartgift.agenthub.plist
+agenthub service status        # systemctl --user status / launchctl print
 agenthub service uninstall     # disable and remove it
 ```
 
@@ -262,7 +318,6 @@ This repository includes extension packs for both Claude Code and Codex.
   - `CLAUDE.md`
   - `.claude/rules/`
   - `skills/` (shipped as the `agenthub` plugin's skills)
-  - `agents/` (shipped as the `agenthub` plugin's agents)
 - Codex project packs live under `.codex/`:
   - `AGENTS.md`
   - `.codex/rules/`

README.md

@@ -3,7 +3,7 @@
 Internal SmartGift build. Local-first **control surface** for Claude Code agents —
 monitoring is one part of it, not the whole. Hooks POST every tool call to an
 Express + SQLite server and a React UI updates over WebSocket; **lanes** track
-parallel agent work through a pipeline; and the `agenthub` CLI drives real terminal
+parallel agent work, one working directory each; and the `agenthub` CLI drives real terminal
 sessions, lane runtimes, and Claude Code's own configuration.
 
 AgentHub records and shows — it does not orchestrate. The session in control makes
@@ -31,11 +31,13 @@ Internal build — all rights reserved.
 
 **Drive**
 
-- **Lanes.** One lane per working directory, surviving session restarts. A lane
-  moves through pipeline stages and the dashboard shows where it is.
-- **Stage detection.** The stage is inferred from the tool stream, so a session
-  that never calls `agenthub stage` still shows progress — rendered dashed amber and
-  never as done, because an inference is not evidence.
+- **Lanes.** One lane per working directory, surviving session restarts. Once you
+  install a pipeline template (none ships), a lane moves through its stages and
+  the dashboard shows where it is.
+- **Stage detection.** With a template installed, the stage is inferred from the
+  tool stream, so a session that never calls `agenthub stage` still shows
+  progress — rendered dashed amber and never as done, because an inference is
+  not evidence.
 - **Run Claude Code or Codex from the browser.** A real terminal (tmux + a real
   PTY, rendered with xterm.js) attached to a lane's directory — the exact TUI
   you'd see locally, fully interactive, resumable, and attachable from a real
@@ -51,8 +53,6 @@ Internal build — all rights reserved.
   merge/rebase/reset button by design: recovery from those needs a terminal.
 - **Per-lane app stacks.** A repo that declares `.agenthub/profile/` gets its own
   slot, ports and services per lane (`agenthub lanes up|down|logs`).
-- **Ship pipelines.** `/agenthub:ship-full` and `/agenthub:ship-quick` drive a
-  feature from intake to PR, declaring every stage to the dashboard as it goes.
 
 **Configure**
 
@@ -78,10 +78,10 @@ Internal build — all rights reserved.
 | **Node.js** | >= 20 (>= 22.5 for a plugin install) | Everything. Both suites are verified green on **24** and **26** |
 | **npm** | 9+ | Ships with Node |
 | **git** | any | Cloning, and every lane operation (worktrees, branch/status reads) |
-| **tmux** | 3.x | The browser run console, `agenthub lanes shell`, typing `/reload-plugins` into a live pane, the Codex nudge |
+| **tmux** | 3.x | The browser run console, `agenthub lanes shell`, typing `/reload-plugins` into a live pane |
 | **Claude Code** | 2.x | Hook ingestion — the whole monitoring side |
 | **Codex CLI** | any | Optional — only for `codex` lanes |
-| **GitHub CLI (`gh`)** | any | Optional — only for `agenthub lanes ci status` and the PR stages of the ship pipelines |
+| **GitHub CLI (`gh`)** | any | Optional — only for `agenthub lanes ci status` |
 | **systemd (user)** | — | Optional — only for `agenthub service install` (Linux auto-start on boot) |
 
 Node **25** is the one version to avoid: it breaks 6 server tests through a
@@ -104,6 +104,12 @@ sudo pacman -S tmux          # Arch
 
 Windows has no native tmux — run AgentHub under WSL2 and install it there.
 
+macOS (code-audited, untested on a Mac): `brew install node git tmux` (Node
+>= 22.5 for the plugin), add `~/.local/bin` to `PATH` in `~/.zshrc`. There is
+no systemd, so the dashboard runs until logout/reboot and comes back at the
+next Claude Code session, or by hand with `agenthub start`. Details and a
+checklist to verify it: [INSTALL.md § macOS](INSTALL.md#macos).
+
 Verify, both from your shell and from the server's point of view:
 
 ```bash
@@ -116,34 +122,6 @@ terminal and a local `tmux attach -t agenthub-lane-<id>` (or `agenthub lanes
 shell`) are two clients on the same pane — they stay in sync, and killing the
 dashboard never kills the run.
 
-### The superpowers plugin
-
-The **`superpowers` plugin is required by the ship-feature pipelines only**, not
-by the dashboard. `/agenthub:ship-feature` and `/agenthub:ship-feature-lane` drive
-`superpowers:brainstorming`, `writing-plans`, `test-driven-development`,
-`requesting-code-review` and `verification-before-completion` phase by phase,
-and both built-in pipeline templates name those same slash commands as their
-per-node drivers. Without it the dashboard, hooks and CLI all work
-normally — the two pipeline skills are what stop partway. `/agenthub-doctor` reports
-it as a `WARN` row.
-
-**You do not normally have to install it.** The plugin's `SessionStart`
-bootstrap installs it for you, once, in its detached worker — so a session never
-waits on the clone, and the current session needs `/reload-plugins` before the
-skills resolve (any later session picks them up on its own). The outcome is
-logged to `~/.claude/agenthub/runtime/bootstrap.log`, and `/agenthub-update`
-retries a failed one. To install it by hand instead, or after opting out:
-
-```bash
-claude plugin install superpowers@claude-plugins-official
-```
-
-Set `AGENTHUB_AUTO_INSTALL_PLUGINS=0` to opt out of the automatic install. Only the
-plugins on a fixed allowlist in `server/lib/skill-plugins.js` are ever installed
-this way — `superpowers` today. A custom pipeline template naming some other
-plugin's command is *reported* by `/agenthub-doctor` and never installed, because a
-template is a file anyone can drop into `DASHBOARD_PIPELINES_DIR`.
-
 ## Install as a Claude Code plugin
 
 Two commands on a machine that has nothing but Claude Code, no clone and no
@@ -187,19 +165,20 @@ every event is counted twice.
 ### Run as a service (auto-start on boot)
 
 `npm start` only runs while that terminal (or `agenthub start`'s background
-process) is alive — a reboot loses it. On Linux, `agenthub service install` sets
-up a systemd `--user` service instead, so `:4820` is up again on its own after
+process) is alive — a reboot loses it. `agenthub service install` sets up a
+systemd `--user` service (Linux) or a LaunchAgent (macOS) instead, so `:4820` is up again on its own after
 every reboot, with no manual step and no Claude Code (or any AI tool) needed
 to trigger it:
 
 ```bash
 npm run build              # the service serves the built client, same as npm start
-agenthub service install       # writes + enables ~/.config/systemd/user/agenthub.service
-agenthub service status        # systemctl --user status agenthub
+agenthub service install       # Linux: ~/.config/systemd/user/agenthub.service
+                               # macOS: ~/Library/LaunchAgents/io.smartgift.agenthub.plist
+agenthub service status        # systemctl --user status / launchctl print
 agenthub service uninstall     # disable and remove it
 ```
 
-`agenthub service install` also tries `loginctl enable-linger` so the service
+On Linux, `agenthub service install` also tries `loginctl enable-linger` so the service
 starts on a cold boot, before anyone logs in; if that needs elevated rights on
 your machine it prints the `sudo loginctl enable-linger <user>` command to run
 once yourself. Plugin installs get the same persistence automatically — see
@@ -217,7 +196,6 @@ agenthub sessions          # recent sessions
 agenthub lanes             # lanes with stage and progress
 agenthub lanes pipeline    # this lane's pipeline template, or switch it
 agenthub lanes node <id>   # run ONE pipeline node's own command (no id: list them)
-#                        (in a session: /intake, /qc, /ship-full, /ship-quick …)
 agenthub stage <name>      # declare the current lane's stage
 agenthub tail              # live event feed
 ```
@@ -246,20 +224,17 @@ Every lane also carries the CLI that drives it — `claude` (the default) or
 Codex lane's run panel offers Codex's own sandbox, approval and reasoning-effort
 choices, and resumes with `codex resume --last`. Codex emits none of this
 dashboard's hooks, so a Codex lane records its runs but stays absent from
-Sessions and Analytics. Its **stage detection** works anyway, from Codex's own
-rollout journals on disk (`$CODEX_HOME/sessions/**/rollout-*.jsonl`, polled every
-`DASHBOARD_CODEX_POLL_MS` ms, default 15000), and on a Codex lane a detection
-also **advances the declared stage** — the one place an inference moves the blue
-`current` ring, because a Codex session has no hook and nothing else would ever
-move it. What a Codex lane cannot get for free is *evidence*: an auto-advanced
-node stays amber (`passed-no-evidence`), never green, since only the session
-itself can say what it finished. Two things help it get there (the run console
-no longer pre-fills anything into the prompt box — that box is the user's to
-type): `agenthub lanes agents install` writes the stage-declaration
-instructions as a marker-delimited block in the lane's `AGENTS.md`, and a 60s
-sweep (`DASHBOARD_CODEX_NUDGE_MS`, `0` disables) types a one-line reminder into
-a lane's pane if its current stage sits without evidence for more than two
-minutes.
+Sessions and Analytics. A Codex lane also carries **no pipeline** — no stage,
+no pipeline map, nothing inferred or advanced; the dashboard only mirrors its
+running/idle status from Codex's own rollout journals on disk
+(`$CODEX_HOME/sessions/**/rollout-*.jsonl`, polled every
+`DASHBOARD_CODEX_POLL_MS` ms, default 15000).
+
+**Pipelines are dormant.** AgentHub ships no pipeline template, so a lane has no
+stages until you drop a template JSON into `DASHBOARD_PIPELINES_DIR` (see
+[`docs/LANES.md`](docs/LANES.md#custom-pipeline-templates)); until then
+`agenthub stage` answers `ENOPIPELINE` and the Workspace hides the pipeline map.
+Further development is planned.
 
 The declared stage comes from `agenthub stage`. The inferred stage comes from tool
 events and expires after `DETECTION_TTL_MS` (default 5 minutes), so a lane can

README.vi.md

@@ -3,7 +3,7 @@
 Bản build nội bộ SmartGift. **Bàn điều khiển** local-first cho agent Claude Code —
 monitoring chỉ là một phần, không phải tất cả. Hooks POST mỗi tool call lên server
 Express + SQLite và React UI cập nhật qua WebSocket; **lane** (làn đường) theo dõi
-công việc song song của agent qua một pipeline; còn CLI `agenthub` điều khiển phiên
+công việc song song của agent, mỗi working directory một lane; còn CLI `agenthub` điều khiển phiên
 terminal thật, runtime của lane, và cả cấu hình của chính Claude Code.
 
 AgentHub ghi nhận và trình bày — nó không điều phối. Phiên đang chạy mới là nơi ra
@@ -31,10 +31,12 @@ Internal build — all rights reserved.
 
 **Điều khiển**
 
-- **Lane.** Mỗi working directory một lane, sống sót qua session restart. Lane
-  đi qua các pipeline stage và dashboard hiển thị nó đang ở đâu.
-- **Stage detection.** Stage được suy luận (infer) từ tool stream, nên một
-  session không bao giờ gọi `agenthub stage` vẫn hiển thị progress — render dạng
+- **Lane.** Mỗi working directory một lane, sống sót qua session restart. Khi bạn
+  cài một pipeline template (không có template nào đi kèm), lane đi qua các
+  stage của nó và dashboard hiển thị nó đang ở đâu.
+- **Stage detection.** Khi đã cài template, stage được suy luận (infer) từ tool
+  stream, nên một session không bao giờ gọi `agenthub stage` vẫn hiển thị
+  progress — render dạng
   viền chấm màu hổ phách (amber) và không bao giờ hiện `done`, vì suy luận
   không phải bằng chứng.
 - **Chạy Claude Code hoặc Codex từ trình duyệt.** Một terminal thật (tmux + PTY
@@ -44,8 +46,6 @@ Internal build — all rights reserved.
   chính là phần cần cài `tmux`** — xem [Yêu cầu hệ thống](#yêu-cầu-hệ-thống).
 - **App stack riêng cho từng lane.** Repo khai báo `.agenthub/profile/` thì mỗi
   lane được cấp slot, port và service riêng (`agenthub lanes up|down|logs`).
-- **Ship pipeline.** `/agenthub:ship-full` và `/agenthub:ship-quick` đưa một
-  feature từ intake tới PR, khai báo từng stage về dashboard trên đường đi.
 
 **Cấu hình**
 
@@ -67,10 +67,10 @@ Internal build — all rights reserved.
 | **Node.js** | >= 20 (>= 22.5 nếu cài qua plugin) | Tất cả. Cả hai test suite verify xanh trên Node **24** và **26** |
 | **npm** | 9+ | Đi kèm Node |
 | **git** | bất kỳ | Clone repo, và mọi thao tác lane (worktree, đọc branch/status) |
-| **tmux** | 3.x | Run console trên trình duyệt, `agenthub lanes shell`, gõ `/reload-plugins` vào pane đang sống, nhắc nhở Codex |
+| **tmux** | 3.x | Run console trên trình duyệt, `agenthub lanes shell`, gõ `/reload-plugins` vào pane đang sống |
 | **Claude Code** | 2.x | Hook ingestion — toàn bộ phần monitoring |
 | **Codex CLI** | bất kỳ | Tùy chọn — chỉ cho lane dùng `codex` |
-| **GitHub CLI (`gh`)** | bất kỳ | Tùy chọn — chỉ cho `agenthub lanes ci status` và các stage PR của ship pipeline |
+| **GitHub CLI (`gh`)** | bất kỳ | Tùy chọn — chỉ cho `agenthub lanes ci status` |
 | **systemd (user)** | — | Tùy chọn — chỉ cho `agenthub service install` (tự khởi động khi boot, Linux) |
 
 Node **25** là bản duy nhất nên tránh: nó làm gãy 6 test server do lệch ABI
@@ -92,6 +92,12 @@ sudo pacman -S tmux          # Arch
 
 Windows không có tmux native — chạy AgentHub trong WSL2 và cài tmux ở trong đó.
 
+macOS (đã rà soát code, chưa kiểm thử trên máy Mac): `brew install node git tmux`
+(Node >= 22.5 cho bản plugin), thêm `~/.local/bin` vào `PATH` trong `~/.zshrc`.
+Không có systemd, nên dashboard chạy đến khi đăng xuất/khởi động lại và tự lên
+lại ở phiên Claude Code kế tiếp, hoặc chạy tay bằng `agenthub start`. Chi tiết
+và checklist kiểm tra: [INSTALL.md § macOS](INSTALL.md#macos).
+
 Kiểm tra, cả từ shell của bạn lẫn từ góc nhìn của server:
 
 ```bash
@@ -104,23 +110,6 @@ trên trình duyệt và `tmux attach -t agenthub-lane-<id>` (hoặc `agenthub l
 shell`) ở máy là hai client trên cùng một pane — chúng đồng bộ với nhau, và tắt
 dashboard không bao giờ giết run đang chạy. Detach bằng `Ctrl-b d`.
 
-### Plugin superpowers
-
-Plugin **`superpowers` chỉ cần cho ship-feature pipeline**, không cần cho
-dashboard. `/agenthub:ship-feature` và `/agenthub:ship-feature-lane` lái các skill
-của nó theo từng phase. Thiếu nó thì dashboard, hook và CLI vẫn chạy bình thường
-— chỉ hai skill pipeline là dừng giữa chừng; `/agenthub-doctor` báo dòng `WARN`.
-
-**Bình thường bạn không phải tự cài.** Bootstrap `SessionStart` của plugin cài
-giúp một lần trong worker chạy nền, và session hiện tại cần `/reload-plugins`
-thì skill mới resolve được (session sau tự nhận). Cài tay:
-
-```bash
-claude plugin install superpowers@claude-plugins-official
-```
-
-Đặt `AGENTHUB_AUTO_INSTALL_PLUGINS=0` để tắt cài tự động.
-
 ## Cài như Claude Code plugin
 
 Hai lệnh, trên máy chỉ có Claude Code, không cần clone repo, không cần
@@ -194,7 +183,6 @@ agenthub sessions            # session gần đây
 agenthub lanes                # danh sách lane kèm stage và progress
 agenthub lanes pipeline      # pipeline template của lane này, hoặc đổi nó
 agenthub lanes node <id>     # chạy riêng command của MỘT node (không có id: liệt kê)
-#                          (trong session: /intake, /qc, /ship-full, /ship-quick …)
 agenthub stage <name>        # khai báo stage hiện tại của lane
 agenthub tail                 # xem live event feed
 ```
@@ -222,10 +210,17 @@ chọn trong modal Add lane và cố định suốt vòng đời của lane. Lan
 chạy với các lựa chọn riêng của Codex (sandbox, approval, reasoning effort) và
 resume bằng `codex resume --last`. Codex không bắn hook của dashboard này, nên
 lane Codex vẫn ghi lịch sử chạy nhưng không xuất hiện ở Sessions và Analytics.
-**Stage detection thì vẫn chạy**, đọc từ rollout journal của chính Codex trên đĩa
-(`$CODEX_HOME/sessions/**/rollout-*.jsonl`, poll mỗi `DASHBOARD_CODEX_POLL_MS` ms,
-mặc định 15000) — thứ lane Codex không tự có là stage **khai báo**, vì chỉ chính
-session đó mới gọi được `agenthub stage`.
+Lane Codex cũng **không có pipeline** — không stage, không pipeline map, không
+suy luận hay tự nhảy stage; dashboard chỉ phản ánh trạng thái running/idle từ
+rollout journal của chính Codex trên đĩa (`$CODEX_HOME/sessions/**/rollout-*.jsonl`,
+poll mỗi `DASHBOARD_CODEX_POLL_MS` ms, mặc định 15000).
+
+**Pipeline đang tạm ngưng (dormant).** AgentHub không đi kèm pipeline template
+nào, nên lane không có stage cho tới khi bạn thả một file template JSON vào
+`DASHBOARD_PIPELINES_DIR` (xem
+[`docs/LANES.md`](docs/LANES.md#custom-pipeline-templates)); trước đó
+`agenthub stage` trả về `ENOPIPELINE` và trang Workspace ẩn pipeline map. Phần
+này sẽ được phát triển tiếp.
 
 Stage khai báo (declared) đến từ `agenthub stage`. Stage suy luận (inferred) đến
 từ tool event và hết hạn sau `DETECTION_TTL_MS` (mặc định 5 phút), nên lane có

agents/backend-reviewer.md

@@ -1,27 +0,0 @@
----
-name: backend-reviewer
-description: Review backend route and hook logic for regressions, data integrity risks, and missing tests.
-tools: Read, Grep, Glob, Bash
-model: sonnet
-memory: project
----
-
-You are a backend reviewer for this repository. Review ONLY files under `server/` in the diff you are given — ignore `client/`, `mcp/`, or any other path even if it appears in the same diff range; another reviewer covers those.
-
-Focus on:
-- Hook event lifecycle correctness.
-- Session/agent state-machine regressions.
-- API contract compatibility.
-- Transaction and persistence correctness.
-- Missing or weak verification coverage.
-
-## Output (MANDATORY — the caller parses your last line)
-
-- Findings as `path:line — severity — problem — suggested fix`, most severe first.
-- End with exactly one of:
-  - `BACKEND-REVIEW: CLEAN`
-  - `BACKEND-REVIEW: FINDINGS — <n>`
-
-## Agent memory
-
-Record recurring backend defect patterns and false-positive traps you find here (e.g. hook shapes that look wrong but aren't, common state-machine edge cases). Future backend-reviewer runs read this.

agents/frontend-reviewer.md

@@ -1,27 +0,0 @@
----
-name: frontend-reviewer
-description: Review React UI changes for behavior regressions, state consistency, and UX breakage.
-tools: Read, Grep, Glob, Bash
-model: sonnet
-memory: project
----
-
-You are a frontend reviewer for this repository. Review ONLY files under `client/` in the diff you are given — ignore `server/`, `mcp/`, or any other path even if it appears in the same diff range; another reviewer covers those.
-
-Focus on:
-- Routing and navigation consistency.
-- State updates from websocket and API responses.
-- Loading/empty/error state correctness.
-- Breaking visual or interaction regressions.
-- Missing tests for changed UI behavior.
-
-## Output (MANDATORY — the caller parses your last line)
-
-- Findings as `path:line — severity — problem — suggested fix`, most severe first.
-- End with exactly one of:
-  - `FRONTEND-REVIEW: CLEAN`
-  - `FRONTEND-REVIEW: FINDINGS — <n>`
-
-## Agent memory
-
-Record recurring frontend defect patterns and false-positive traps you find here (e.g. websocket race conditions that look wrong but aren't, sibling components that should stay in sync). Future frontend-reviewer runs read this.

agents/qc-local.md

@@ -1,74 +0,0 @@
----
-name: "qc-local"
-description: "Local browser-QC agent for the ship-feature-lane pipeline in AgentHub. Launched by the ship-feature-lane skill at Stage 6 (foreground — it gates the pipeline) after e2e, against the lane's OWN feature-branch stack (booted via `agenthub lanes up --qc`; the branch is cut from origin/development, so the stack is development + this feature). Exercises the feature + smoke + reload/re-login coverage via the lane's local-QC Playwright MCP, saves every screenshot to `proof/<feature-slug>/qc-local/` (the AgentHub proof gallery's canonical path), and returns a parseable LOCAL-QC: PASS/FAIL verdict that doubles as the feature user-flow review for the senior gate. <example>Context: ship-feature-lane in a lane finished Stage 3's e2e green. assistant: 'e2e is green — launching the qc-local agent to browser-QC the feature-branch stack and capture the proof gallery.' <commentary>Stage-6 browser QC is the qc-local agent's job; the main session stays off the browser.</commentary></example>"
-model: opus
-color: green
-memory: project
----
-
-You are an elite QA automation engineer validating ONE lane's feature on that lane's OWN local stack (isolated FE/API/DB, nothing shared with other lanes), right after the feature branch's e2e passed (the branch is cut from `origin/development`, so this stack IS development + the feature as of the branch point). You are rigorous, evidence-driven, and autonomous: every claim in your report is backed by a screenshot. You never commit, push, or fix code — you verify, capture proof, and report. Your report IS the feature user-flow review the senior gate reads.
-
-## Context you will be given (by the ship-feature-lane skill)
-
-- **The lane's working directory** (your cwd — AgentHub resolves the lane from it automatically; there is no marker file to check).
-- **Feature slug** (the `<slug>` of `feat/<slug>`), feature title, and the acceptance points to verify (from the lane spec at `docs/superpowers/specs/lane-<slug>.md` — read it yourself if the summary is thin; `git diff origin/development...HEAD` shows the change surface).
-
-Setup: your cwd is the lane clone. You do NOT write `stage`/`status`/`notes` — the main session owns all state; you have no heartbeat call to make (you run as a synchronous subagent inside the driving session's own turn, so the lane is never seen as stalled while you work).
-
-## Target environment
-
-- **App**: the lane's own booted frontend — check `agenthub lanes runtime` (or the `FE_PORT`/equivalent env the skill already resolved) for the actual port; it is isolated per lane. If it's down, don't boot it yourself blindly — return `LOCAL-QC: FAIL — lane stack down (re-run: agenthub lanes up --no-build)`.
-- **QC boot env**: the QC stack boots via `agenthub lanes up --qc`, which applies the profile's `QC_BOOT_ENV` (typically mock/stub flags) — LLM/paid-backend features then return CANNED responses. Canned/stub content is EXPECTED there, not a bug; judge the surrounding UX (loading states, rendering, persistence), not the stub text itself.
-- **Account / login.** Two paths:
-  - **If a credentials block is embedded at the TOP of this agent** ("⚙ This lane's local-QC credentials"): those ARE your login — type them into the form yourself (`browser_type`, submit) when you hit a login page. You already have them; never read a file/script to fetch them.
-  - **If there is NO embedded block:** the app should already be in a usable/logged-in state (or requires no login for the flows you're testing). If you hit a login page you cannot get past, this profile has no seeded QC account configured yet — return `LOCAL-QC: FAIL — login required, no seed-account mechanism configured for this profile`. Do not guess at credentials or invent a login flow.
-- **Tooling**: the **dedicated local-QC Playwright MCP server** (isolated Chromium profile — e.g. `playwright-qa-local` if the profile names it that). You MUST use that server's `mcp__<name>__browser_*` tool family for ALL browser interaction — never the unscoped `mcp__playwright__browser_*` or any other Playwright server (other agents/sessions own those browsers concurrently). If the tools aren't available, return `LOCAL-QC: FAIL — local-QC Playwright MCP not loaded (configure it in .mcp.json and restart the lane session — see the ship-feature-lane skill's Setup section)`.
-- **Upload fixtures**: if an **"Upload fixtures dir"** line is injected at the TOP of this agent, use the files in that dir for any data-upload scenario (quote the path; it may contain spaces). If no such line is present, no fixture dataset is configured for this stack — skip data-upload-only scenarios and note that in the report. Put ad-hoc non-fixture files in the lane's `.playwright-mcp/` dir; never source uploads from `/tmp/`.
-
-## Procedure
-
-1. **Load the QC Plan, then execute against it.** The ship-feature-lane skill wrote a `## QC Plan` section into the lane spec (`docs/superpowers/specs/lane-<slug>.md`) at Stage 5 — it is the authoritative scope. Read it first.
-   - **Cover every in-scope scenario** in the plan — skip none.
-   - **Stay in scope** — don't wander into the plan's out-of-scope areas (that over-testing is exactly what the plan exists to prevent); the only unaffected areas you touch are the plan's smoke set.
-   - **If the plan is missing or thin**, derive scenarios yourself from the acceptance points + `git diff origin/development...HEAD` and proceed, covering the same shape: **primary** (each acceptance point, positive AND negative — invalid input, empty state, permission edges), **adjacent** flows sharing routes/components/data, **smoke** (login + main nav + ≥3 unaffected major areas), and **state coverage** (a reload (Cmd+R) on every stateful screen touched, one logout → re-login cycle, back-and-forth navigation between key pages).
-   - **When you discover a real scenario the plan missed** (a genuine risk it didn't anticipate), TEST it AND list it in your report under **"Scenarios discovered during QC"** so the skill folds it into the plan. Do NOT edit the plan file yourself — the skill is its single writer.
-   - **UI/UX & layout rigor — apply to EVERY form/screen the feature touches** (never just a representative one; sibling forms drift):
-     - **Overflow in BOTH axes.** Resize the window NARROWER (width) AND SHORTER (height — e.g. ~560px then ~350px tall), and ALSO grow the content by opening every expandable thing (dropdowns, collapsible sections, "add row" repeaters, multi-select pickers) so a step becomes taller than the viewport. Then confirm: nothing is cut off at the **top** or bottom; any fixed/sticky chrome (page header, wizard **stepper/tabs**, toolbars) stays visible and is NOT clipped; the scroll container actually scrolls; and the primary actions (Save/Next/Submit/Cancel) stay reachable and clickable. A form taller than the page must never hide its header, its step nav, or its buttons.
-     - **Every control has a visible label.** Each input/toggle/select/picker shows a field label. Compare sibling forms — if one labels a control and the other doesn't, that's a defect.
-     - **Visual hierarchy is correct.** Section/group headers are MORE prominent than the field labels inside them (size/weight/color); field labels are consistent across steps and across sibling forms; helper text is least prominent. Flag any inverted or inconsistent hierarchy.
-     - No text truncation/overlap; spacing, alignment, and contrast are reasonable; the form reads as natural, polished UI.
-2. **Execute with the local-QC MCP's tools**:
-   - Use `browser_type` for React controlled inputs — never direct DOM value assignment (it doesn't fire onChange).
-   - After each meaningful action: `browser_snapshot` to verify state, then screenshot (see proof convention).
-   - Don't trust `browser_network_requests` alone for HTTP verification (it double-lists requests); prefer the lane's own backend/service logs if the profile exposes them (`agenthub lanes logs <svc>`).
-   - **Failure triage**: capture a failure screenshot + `browser_snapshot` + `browser_console_messages`, note repro steps, expected vs actual, severity (blocker/major/minor/cosmetic) — then CONTINUE with remaining scenarios unless the app is unusable.
-3. **Proof convention (mandatory — the path is fixed infrastructure, NOT your choice):** EVERY screenshot via `browser_take_screenshot` with `filename: "proof/<feature-slug>/qc-local/<NN>-<what>.png"`, numbered in flow order (e.g. `proof/edit-report/qc-local/03-dialog-open.png`). The MCP server's pinned `--output-dir` lands these in `<lane clone>/.playwright-mcp/proof/...` — the ONLY place the dashboard's gallery reads (`agenthub lanes proof-link` converges a stray `proof/` symlink if needed). Absolute paths, other folders, or invented layouts = the proof is lost.
-
-## Checkpoint & resume  *(rate-limits and crashes must not zero your work)*
-
-- **Checkpoint as you go:** after EACH scenario, append one line to `proof/<feature-slug>/qc-local/RESULTS.partial.md` (via the Write/Edit tools on `<lane clone>/.playwright-mcp/proof/...`): `<NN> <scenario> — ✅|❌ — <proof file> — <HEAD sha>`. A mid-run tool error or rate-limit then leaves a resumable trail instead of zeroing the run.
-- **Resume on start:** if `RESULTS.partial.md` already exists for this feature AND its HEAD sha matches the tree you're QCing, treat its ✅ scenarios as done (spot-check one) and continue from the first unfinished one. Sha differs → start fresh (delete the stale partial).
-- **Bounded stalls:** a single browser step hanging >2 min → close the browser, reload, retry that step ONCE; still stuck → record ❌ with proof and move on. If the run approaches ~45 min, finish the current scenario, mark the rest ⚠️ not-run, and return honestly rather than stalling silently.
-
-## Quality bar (verify before returning)
-
-- [ ] Every in-scope QC-Plan item was executed (or marked N/A with a reason); any discovered scenarios are listed for fold-back.
-- [ ] Every primary scenario has a screenshot of its end state (pass or fail).
-- [ ] Reload tested on every stateful screen touched; one full logout → re-login cycle done.
-- [ ] Smoke covered login, navigation, and ≥3 unaffected areas.
-- [ ] UI/UX pass done on EACH touched form: tested at narrow AND short viewports AND with dropdowns/expandables open (content taller than the page) — fixed header/stepper/buttons never cut off, scroll works, actions reachable; every control labeled; section headers more prominent than field labels; consistent label styling; no overlap/truncation; natural polished layout.
-- [ ] All screenshots under `proof/<feature-slug>/qc-local/` (check with `ls .playwright-mcp/proof/<feature-slug>/qc-local/`).
-- [ ] No commits made; password never echoed anywhere.
-
-## Output format (MANDATORY — the skill parses your last line)
-
-A scannable report (this doubles as the user-flow review for the senior gate): a **QC-Plan coverage** view (each in-scope plan item → ✅/❌/⚠️), a **Scenarios discovered during QC** list (anything you tested that wasn't in the plan, for the skill to fold back), issues with severity + repro + which proof file shows each, proof filename list, reload/re-login coverage note, UX observations worth fixing. Then end with exactly one of:
-
-- `LOCAL-QC: PASS`
-- `LOCAL-QC: FAIL — <comma-separated reasons>`
-
-A FAIL must be specific enough for the lane's fix-loop to act on (page/flow + what broke + proof file).
-
-## Agent memory
-
-Record local-stack QA knowledge as you find it: flaky selectors/flows, features that break after reload or re-login, stub-mode quirks (what canned responses look like per feature), data-setup prerequisites, upload-fixture behaviors, noise-vs-real console errors. Future qc-local runs (any lane) read this.

agents/senior-gate-reviewer.md

@@ -1,52 +0,0 @@
----
-name: "senior-gate-reviewer"
-description: "Final GO/NO-GO publish-readiness gate for the ship-feature-lane pipeline in AgentHub. Invoke AFTER the code-review and feature-user-flow-review (qc-local) and AFTER local CI gates + e2e + QC have passed, immediately BEFORE the feature branch is pushed and its PR is opened (base `development`). Returns a single GO or NO-GO verdict with a required-fix list. A GO is the sole authorization to publish the PR. <example>Context: ship-feature-lane in a lane has finished implementation, gates, and reviews and is about to publish the PR. assistant: 'I'll launch the senior-gate-reviewer agent to make the final go/no-go decision before pushing the branch and opening the PR.' <commentary>This is the publish gate — it decides whether the feature is allowed in front of reviewers.</commentary></example>"
-model: opus
-color: red
-memory: project
----
-
-You are the **Senior Gate Reviewer** — the final, independent publish-readiness authority for the ship-feature-lane pipeline. Nothing is pushed or PR'd without your **GO**; the PR a human later merges into `development` is exactly what you approved. You are deliberately skeptical: when in doubt, you return **NO-GO** with a precise, actionable fix list. You do NOT make fixes yourself — you judge, decide, and report.
-
-## Context you will be given (by the ship-feature-lane skill)
-
-- **The lane's working directory** (your cwd — AgentHub resolves the lane from it automatically).
-- **The original requirement** and the **upfront Q&A answers** (acceptance criteria).
-- The **feature branch name** (cut from `origin/development` — the PR base it will target).
-- A summary of the **two prior reviews** (code-review + the qc-local user-flow review) and which findings were resolved.
-- The **`agenthub lanes sync-base --check` preflight output** (migration-collision check + how far `origin/development` moved since the branch's merge-base).
-- Confirmation that **local CI gates** (the profile's lint / test / contract checks), **e2e**, and **browser QC** already passed.
-
-If any of this context is missing, gather it yourself (read the lane spec file the skill wrote, run `git -C <lane> log/diff`).
-
-## Your checks
-
-**Review the PR the reviewers will see.** The PR is `<feature-branch>` based on `origin/development` — judge the change against **the PR diff**: `git -C <lane> diff origin/development...<feature-branch>` (`<feature-branch>` is in your context). There is NO local integration tree in this flow — the branch itself is what ships, and the first combined validation after a human merges it is dev CI + dev-QC; your merge-safety check (#3) is what stands between this branch and that merge. Run checks with `git -C <lane> ...`, `Read`, `Grep`, `make` as needed.
-
-1. **Acceptance** — Does the implementation actually satisfy the original requirement + every upfront Q&A answer? Inspect **the PR diff** (defined above) and, where feasible, confirm the acceptance criteria are met in code. Missing/partial requirement coverage ⇒ NO-GO.
-
-2. **Findings resolved** — Were the PR-code-review and user-flow-review findings actually addressed (not just acknowledged)? Spot-check **the PR diff** for each claimed fix. Unresolved material findings ⇒ NO-GO.
-
-3. **Merge-safety** — Independently verify the branch is safe for a human to merge into `development`. **General principle (any stack):** "the branch is green standalone" is NOT proof the MERGE will be — check for collisions that DON'T surface as git conflicts — duplicate migration identifiers, duplicate fixture/test IDs, API/schema-contract drift, lockfile divergence — in whatever form this stack expresses them, comparing the branch against the CURRENT `origin/development`. Re-run the deterministic preflight yourself if the provided output is stale: `git -C <lane> fetch origin && agenthub lanes sync-base --check <feature-branch>` (exit 5 = collision ⇒ NO-GO with the printed rename; also read its `DEV_DELTA`/`DEV_OVERLAP` — a large overlapping upstream delta means the locally-QC'd behavior may not match post-merge dev, weigh it).
-   - **Stack-specific checks (from the active profile):** read `<lane>/.agenthub/profile/review-checks.md` with the Read tool if it exists, and apply every check it lists (e.g. migration-identifier collisions, API/contract regeneration). Missing or empty → derive the equivalents yourself from the general principle by inspecting the branch vs `origin/development`.
-   - **Obvious regressions / scope creep**: scan **the PR diff** for debug code, secrets, commented-out blocks, unrelated churn, `console.log`/`print` debugging, TODO/FIXME left in critical paths.
-
-4. **UI/UX diligence (when the feature touches any form/screen)** — don't rubber-stamp the QC report; confirm it actually exercised layout rigor, because these defects slip through happy-path QC:
-   - **Overflow** was tested at narrow AND **short** viewports, AND with dropdowns/collapsibles/repeaters **open** so content exceeds the viewport — and no fixed chrome (page header, wizard **stepper/tabs**, action bar) is cut off (especially at the **top**), scroll works, and primary actions stay reachable. A report that only shows one viewport / the happy path has NOT verified this.
-   - Every control is **labeled**, and **section headers are more prominent than field labels** (no inverted hierarchy); labels are consistent across **sibling forms** (if the feature changed two similar forms, they must match).
-   - Spot-check **the PR diff** yourself for UI/UX regressions in these classes (a scroll container that lost `min-h-0`, a removed/altered label, a muted section header, a form-wide container that scrolls the whole page instead of an inner region).
-   If the feature is UI-heavy and the QC didn't demonstrably check the above ⇒ NO-GO with a specific "re-QC: verify <X> at short viewport / with <dropdown> open" instruction.
-
-5. **QC-plan coverage** — read the `## QC Plan` section of the lane spec and the qc-local report (the user-flow review; on a follow-up fix run, also the parent's dev-QC findings the follow-up exists to fix). Confirm every **in-scope** plan item has a result (pass/fail, with proof) — any uncovered in-scope item ⇒ NO-GO ("re-QC: cover <item>"). If a QC report spent effort on the plan's **out-of-scope** areas while leaving in-scope items thin, flag it. Scenarios the agents discovered mid-run should appear folded into the plan.
-
-## Output format (MANDATORY — the skill parses your last line)
-
-Write a short report (acceptance ✓/✗, findings ✓/✗, merge-safety ✓/✗ with one line each), then end with **exactly one** of these as the FINAL line:
-
-- `VERDICT: GO`
-- `VERDICT: NO-GO — <comma-separated required fixes>`
-
-Rules:
-- Only return `GO` when all three checks pass with high confidence.
-- A NO-GO fix list must be specific and actionable (file/area + what to do), so the skill's fix-loop can act and re-submit.
-- Never push, merge, commit, or modify files. You are read-only. Your verdict is the deliverable.

bin/agenthub.js

@@ -1463,16 +1463,24 @@ async function cmdStart(flags) {
 }
 
 /**
- * Installs/removes a systemd `--user` service so the dashboard survives
- * reboots without anything (Claude Code included) needing to start it first.
- * Linux/systemd only; other platforms are told to keep using `agenthub start`.
+ * Installs/removes a systemd `--user` service (Linux) or a LaunchAgent
+ * (macOS) so the dashboard survives reboots without anything (Claude Code
+ * included) needing to start it first. Elsewhere, `agenthub start` by hand.
  */
 async function cmdService(sub, flags) {
-  const svc = require(path.join(REPO_ROOT, "scripts", "systemd-service.js"));
+  const svc = require(path.join(REPO_ROOT, "scripts", "service-manager.js"));
   if (!svc.systemctlAvailable()) {
-    console.error(c.red("✖ systemd --user is not available on this machine."));
     console.error(
-      c.dim("  Auto-start on boot needs Linux + systemd. Use `agenthub start` manually instead.")
+      c.red(
+        `✖ ${svc.kind === "launchd" ? "launchd (a GUI login session)" : "systemd --user"} is not available here.`
+      )
+    );
+    console.error(
+      c.dim(
+        svc.kind === "launchd"
+          ? "  A LaunchAgent needs the user logged in at the Mac itself, not only over SSH. Use `agenthub start` meanwhile."
+          : "  Auto-start on boot needs Linux + systemd. Use `agenthub start` manually instead."
+      )
     );
     process.exit(1);
   }
@@ -1493,24 +1501,27 @@ async function cmdService(sub, flags) {
       description: "AgentHub dashboard server",
       workingDir: REPO_ROOT,
       execStart: `${process.execPath} ${path.join(REPO_ROOT, "server", "index.js")}`,
+      argv: [process.execPath, path.join(REPO_ROOT, "server", "index.js")],
       env,
     });
     if (result === "foreign") {
       console.error(
-        c.red(
-          `✖ ~/.config/systemd/user/${name}.service already exists and wasn't written by agenthub.`
-        )
+        c.red(`✖ ${svc.unitPath(name)} already exists and wasn't written by agenthub.`)
       );
       console.error(c.dim("  Remove or rename it, then re-run `agenthub service install`."));
       process.exit(1);
     }
     if (result === "failed") {
-      console.error(c.red("✖ Failed to write/enable the systemd unit."));
+      console.error(c.red(`✖ Failed to write/enable the ${svc.label}.`));
       process.exit(1);
     }
     console.log(
-      `${c.green("✔")} systemd --user service '${name}' ${result === "unchanged" ? "already up to date" : "installed"} and enabled.`
+      `${c.green("✔")} ${svc.label} '${name}' ${result === "unchanged" ? "already up to date" : "installed"} and enabled.`
     );
+    if (svc.kind === "launchd") {
+      console.log(c.dim(`  It starts at every login. Server log: ${svc.logPath()}`));
+      return;
+    }
     const lingered = svc.enableLinger();
     if (lingered) {
       console.log(
@@ -1531,20 +1542,24 @@ async function cmdService(sub, flags) {
   if (sub === "uninstall") {
     const result = svc.uninstallUserService(name);
     if (result === "foreign") {
-      console.error(
-        c.red(
-          `✖ ~/.config/systemd/user/${name}.service wasn't written by agenthub — not touching it.`
-        )
-      );
+      console.error(c.red(`✖ ${svc.unitPath(name)} wasn't written by agenthub — not touching it.`));
       process.exit(1);
     }
     console.log(
-      `${c.green("✔")} systemd service ${result === "absent" ? "was not installed" : "removed"}.`
+      `${c.green("✔")} ${svc.label} ${result === "absent" ? "was not installed" : "removed"}.`
     );
     return;
   }
   if (sub === "status") {
-    spawn("systemctl", ["--user", "status", `${name}.service`, "--no-pager"], { stdio: "inherit" });
+    if (svc.kind === "launchd") {
+      spawn("launchctl", ["print", `gui/${process.getuid()}/io.smartgift.${name}`], {
+        stdio: "inherit",
+      });
+    } else {
+      spawn("systemctl", ["--user", "status", `${name}.service`, "--no-pager"], {
+        stdio: "inherit",
+      });
+    }
     return;
   }
   console.error(c.red("✖ Usage: agenthub service install|uninstall|status [--port N]"));
@@ -1639,27 +1654,6 @@ async function cmdLanesAdd(args) {
   console.log(`${c.green("✔")} Created lane #${lane.id}: ${lane.title}`);
 }
 
-/**
- * `agenthub skills install` — copy this checkout's `skills/ship-feature-lane/`
- * into `~/.claude/skills/ship-feature-lane/`, so `/ship-feature-lane` is
- * discoverable from a session running inside any lane's own working
- * directory, not just inside this repo. Pure filesystem action; does not
- * talk to the dashboard server at all. Reinstall, not merge — overwrites an
- * existing global copy with the current one.
- */
-function cmdSkillsInstall() {
-  const { installShipFeatureLaneSkill } = require(
-    path.join(REPO_ROOT, "server", "lib", "skills-install.js")
-  );
-  try {
-    const result = installShipFeatureLaneSkill({ repoRoot: REPO_ROOT });
-    console.log(`${c.green("✔")} installed ship-feature-lane skill -> ${result.path}`);
-  } catch (err) {
-    console.error(`✖ ${err.message}`);
-    process.exitCode = 1;
-  }
-}
-
 /**
  * `agenthub lanes gc [--dry-run]` — reap orphaned Playwright MCP processes
  * (owning session died) and cap oversized hook logs, across every lane on
@@ -2402,25 +2396,6 @@ async function cmdLanesProofLink(args) {
   );
 }
 
-/** `agenthub lanes agents install [<id>] [--cwd path]` — write the ship-feature-lane
- *  agent templates (qc-local, senior-gate-reviewer) into <lane>/.claude/agents/,
- *  git-excluded. Never run automatically; a session calls it explicitly. */
-async function cmdLanesAgentsInstall(args) {
-  const resolved = await resolveLaneArg(args);
-  if (!resolved) return;
-  const result = await post(
-    `/api/lanes/${resolved.laneId}/agents/install`,
-    {},
-    { allowError: true }
-  );
-  if (result.status) {
-    console.error(`✖ agents install → ${result.data?.error?.message || result.status}`);
-    process.exitCode = 1;
-    return;
-  }
-  console.log(`${c.green("✔")} installed: ${result.installed.join(", ")}`);
-}
-
 /** `agenthub lanes mcp sync [<id>] [--cwd path]` — relocate the source repo's
  *  already-configured MCP servers into <lane>/.mcp.json and seed Chromium
  *  profiles. Never run automatically; a session calls it explicitly. */
@@ -2499,8 +2474,7 @@ async function cmdLanesCi(args) {
  * was display-only: the dashboard rendered a copy button and the operator
  * pasted it into a session by hand. This runs it, in the lane's own cwd:
  *
- *   - a slash command (`/superpowers:brainstorming`) starts `claude` with it
- *     as the prompt, exactly like `agenthub ship-full` does with the whole skill;
+ *   - a slash command starts `claude` with it as the prompt;
  *   - anything else (`npm test`, `agenthub lanes hook ci-gate`) is spawned directly.
  *
  * With no node id it lists the nodes and their commands, which is also the
@@ -2663,88 +2637,6 @@ async function cmdLanesShell(args) {
   });
 }
 
-/**
- * Start a `claude` session in this lane driven by a pipeline's own skill.
- * Two commands, two depths of work:
- *
- *   agenthub ship-full   → the 16-node `ship-feature` template, `/agenthub:ship-feature-lane`
- *                      — autonomous to a published PR, then watched until a
- *                        human merges it.
- *   agenthub ship-quick  → the 8-node `default` template, `/agenthub:ship-feature`
- *                      — in-repo feature work that stops at review/gate.
- *
- * Each command puts the lane on its own template, so the choice is the command
- * you type; the skill string itself lives in the template's `skill` field and
- * is never duplicated here.
- *
- * The prompt is passed as ONE argv element to `claude`, never through a shell —
- * a requirement containing quotes, `$`, or `;` is text, not code. `--print`
- * shows the exact command, switches nothing, and runs nothing.
- */
-const SHIP_TEMPLATES = {
-  "ship-full": "ship-feature",
-  "ship-quick": "default",
-};
-
-async function cmdShip(command, args) {
-  const templateId = SHIP_TEMPLATES[command];
-  const { flags, positional } = parseArgs(args);
-  const resolved = await resolveLaneArg(args);
-  if (!resolved) return;
-  let { lane } = await get(`/api/lanes/${resolved.laneId}`);
-
-  const { pipelines } = await get("/api/lanes/pipelines");
-  const skill = pipelines.find((p) => p.id === templateId)?.skill;
-  if (!skill) {
-    console.error(
-      `✖ pipeline template "${templateId}" declares no driving skill — ` +
-        `add a "skill" field to it (see docs/LANES.md § Custom template format)`
-    );
-    process.exitCode = 1;
-    return;
-  }
-
-  // `resolveLaneArg` only strips a leading bare lane id; the rest of the
-  // positionals are the requirement, joined back into one prompt line.
-  const requirement = positional
-    .filter((p) => p !== String(resolved.laneId))
-    .join(" ")
-    .trim();
-  const prompt = requirement ? `${skill} ${requirement}` : skill;
-
-  if (flags.print || !requirement) {
-    // `--print` shows what would run, so it switches nothing.
-    if (!requirement) console.error(`usage: agenthub ${command} "<requirement>" [<id>] [--print]`);
-    console.log(`cd ${lane.cwd} && claude ${JSON.stringify(prompt)}`);
-    if (!requirement) process.exitCode = 1;
-    return;
-  }
-
-  // The command picks the pipeline, not the lane's current setting: put the
-  // lane on the matching template first so the dashboard renders the right
-  // node count from the start rather than after the skill self-corrects.
-  if (lane.pipeline !== templateId) {
-    ({ lane } = await patch(`/api/lanes/${lane.id}`, { pipeline: templateId }));
-  }
-
-  console.log(
-    `${c.dim(`lane #${lane.id} · pipeline ${lane.pipeline} (${lane.pipeline_nodes.length} nodes)`)}\n` +
-      `${c.cyan("→")} claude ${JSON.stringify(prompt)}`
-  );
-  const child = spawn("claude", [prompt], { stdio: "inherit", cwd: lane.cwd });
-  await new Promise((resolve) => {
-    child.on("close", (code) => {
-      if (code) process.exitCode = code;
-      resolve();
-    });
-    child.on("error", (err) => {
-      console.error(c.red(`✖ ${err?.message || err}`));
-      process.exitCode = 1;
-      resolve();
-    });
-  });
-}
-
 async function cmdFeatureShow(args) {
   const slug = args.find((arg) => !arg.startsWith("--"));
   if (!slug) {
@@ -2923,16 +2815,6 @@ const COMMAND_GROUPS = [
         "[<node-id>] [extra…] [<id>] [--print]",
         "Run ONE pipeline node's own command in the lane's cwd (no id: list every node and its command)",
       ],
-      [
-        "ship-full",
-        '"<requirement>" [<id>] [--print]',
-        "Run the 16-stage lane pipeline: implement → gates → e2e → review → QC → senior gate → PR, watched until a human merges (--print: show the command, run nothing)",
-      ],
-      [
-        "ship-quick",
-        '"<requirement>" [<id>] [--print]',
-        "Run the 8-stage in-repo pipeline: plan → implement → tests → review → gate → ship. No PR, no browser QC",
-      ],
       [
         "lanes shell",
         "[<id>]",
@@ -2961,11 +2843,6 @@ const COMMAND_GROUPS = [
         "[<id>]",
         "Converge clone-root proof/ onto .playwright-mcp/proof (idempotent, never automatic)",
       ],
-      [
-        "lanes agents install",
-        "[<id>]",
-        "Write the ship-feature-lane agent templates (qc-local, senior-gate-reviewer) into <lane>/.claude/agents/, git-excluded",
-      ],
       [
         "lanes mcp sync",
         "[<id>]",
@@ -2986,11 +2863,6 @@ const COMMAND_GROUPS = [
         "[--dry-run]",
         "Reap orphaned Playwright MCP processes + cap oversized hook logs, across every lane",
       ],
-      [
-        "skills install",
-        "",
-        "Install skills/ship-feature-lane/ into ~/.claude/skills/ so /ship-feature-lane works from any lane",
-      ],
       [
         "lock status|acquire|release",
         "[<name>] [--holder X] [--timeout N]",
@@ -3817,9 +3689,6 @@ async function runCommand(argv) {
         return cmdLanesRuntime(rest[0], rest.slice(1));
       }
       if (rest[0] === "proof-link") return cmdLanesProofLink(rest.slice(1));
-      if (rest[0] === "agents" && rest[1] === "install") {
-        return cmdLanesAgentsInstall(rest.slice(2));
-      }
       if (rest[0] === "mcp" && rest[1] === "sync") {
         return cmdLanesMcpSync(rest.slice(2));
       }
@@ -3842,12 +3711,6 @@ async function runCommand(argv) {
         return cmdLanesGc(rest.slice(1));
       }
       return cmdLanes();
-    case "skills": {
-      if (rest[0] === "install") return cmdSkillsInstall();
-      console.error("usage: agenthub skills install");
-      process.exitCode = 1;
-      return;
-    }
     case "lock": {
       const sub = rest[0];
       if (sub === "status") return cmdLockStatus(rest.slice(1));
@@ -3861,9 +3724,6 @@ async function runCommand(argv) {
     }
     case "stage":
       return cmdStage(rest);
-    case "ship-full":
-    case "ship-quick":
-      return cmdShip(cmd, rest);
     case "feature": {
       const sub = rest[0];
       if (sub === "list") return cmdFeatureList(rest.slice(1));

client/src/components/Tooltip.tsx

@@ -9,10 +9,13 @@
  * touching every one of those call sites to get a designed bubble, and the
  * next `title=` someone writes would be back to the browser's grey box.
  * {@link GlobalTooltip} instead listens once at the document: on hover or
- * keyboard focus it takes the element's `title`, suppresses the native tooltip
+ * keyboard focus (`:focus-visible`, not the focus a click gives) it takes the element's `title`, suppresses the native tooltip
  * by removing the attribute for as long as the bubble is up, and restores it
  * on the way out. Nothing else in the app has to know it exists, and a control
  * keeps its native tooltip (and its accessible name) when JS has not run.
+ * While the title is parked, a control with no other name (icon-only) carries
+ * it as a temporary `aria-label`, so focusing it never leaves it nameless; the
+ * bubble goes away with its control if that is removed from the page.
  *
  * ## The look
  * Anchored to the CONTROL, not the cursor — a bubble that chases the mouse is
@@ -39,8 +42,10 @@ const SHOW_DELAY_MS = 350;
 /** Gap between the control and the bubble, and the minimum viewport margin. */
 const GAP = 8;
 
-/** Opt an element (or a subtree) out: `data-tip-off` keeps the native title. */
-const SELECTOR = "[title]:not([data-tip-off])";
+/** Opt an element (or a subtree) out: `data-tip-off` keeps the native title.
+ *  `[data-tip]` matches the control whose title is parked, so moving between
+ *  its own children still resolves to it instead of re-opening the bubble. */
+const SELECTOR = "[title]:not([data-tip-off]), [data-tip]";
 
 type Anchored = { text: string; rect: DOMRect };
 type Placed = { left: number; top: number; arrow: number; above: boolean };
@@ -58,16 +63,29 @@ export function GlobalTooltip() {
   // that unmounts it, Escape).
   const parked = useRef<HTMLElement | null>(null);
   const timer = useRef<number | undefined>(undefined);
+  // The element whose delay is running, so re-entering it does not restart it.
+  const pending = useRef<HTMLElement | null>(null);
 
   const restore = useCallback(() => {
     window.clearTimeout(timer.current);
+    pending.current = null;
     const el = parked.current;
     if (el) {
+      // Drop the instance shim `open` installed; the prototype method is back.
+      delete (el as { removeAttribute?: unknown }).removeAttribute;
       const text = el.dataset.tip;
       if (text !== undefined) {
-        el.setAttribute("title", text);
+        // React re-set `title` while it was parked (a poll flipped the hint):
+        // that value is current, the parked copy is stale. React never
+        // re-applies an unchanged prop, so writing the old one back would win
+        // for good.
+        if (!el.hasAttribute("title")) el.setAttribute("title", text);
         delete el.dataset.tip;
       }
+      if (el.dataset.tipAria !== undefined) {
+        el.removeAttribute("aria-label");
+        delete el.dataset.tipAria;
+      }
       parked.current = null;
     }
     setTip(null);
@@ -79,7 +97,9 @@ export function GlobalTooltip() {
       const text = (el.getAttribute("title") || "").trim();
       if (!text) return;
       restore();
+      pending.current = el;
       timer.current = window.setTimeout(() => {
+        pending.current = null;
         // Re-read at fire time: the control may have been re-rendered, removed
         // or had its title changed while the delay was running.
         if (!el.isConnected) return;
@@ -87,6 +107,29 @@ export function GlobalTooltip() {
         if (!current) return;
         el.dataset.tip = current;
         el.removeAttribute("title");
+        // React removing `title` while it is parked calls removeAttribute on an
+        // attribute that is already gone: no MutationRecord, nothing to see —
+        // and `restore` would write the stale text back for good. So, on THIS
+        // element and only while parked, that call is taken as React's intent:
+        // the parked copy is dropped and the bubble hides. (React DOM calls
+        // `node.removeAttribute`, the instance method; `restore` deletes the
+        // shim.) No global prototype is touched.
+        el.removeAttribute = (name: string) => {
+          if (name.toLowerCase() === "title" && el.dataset.tip !== undefined) {
+            delete el.dataset.tip;
+            restore();
+          }
+          Element.prototype.removeAttribute.call(el, name);
+        };
+        // The title was an icon-only control's ONLY name; keep it named.
+        if (
+          !el.hasAttribute("aria-label") &&
+          !el.hasAttribute("aria-labelledby") &&
+          !el.textContent?.trim()
+        ) {
+          el.setAttribute("aria-label", current);
+          el.dataset.tipAria = "";
+        }
         parked.current = el;
         setTip({ text: current, rect: el.getBoundingClientRect() });
       }, delay);
@@ -101,7 +144,10 @@ export function GlobalTooltip() {
     };
     const onOver = (e: PointerEvent) => {
       const el = target(e);
-      if (el) open(el, SHOW_DELAY_MS);
+      // Already showing or already counting down for this control: a pointer
+      // crossing its children must neither hide nor restart it.
+      if (!el || el === parked.current || el === pending.current) return;
+      open(el, SHOW_DELAY_MS);
     };
     const onOut = (e: PointerEvent) => {
       // Moving between children of the same control must not flicker.
@@ -112,9 +158,14 @@ export function GlobalTooltip() {
     };
     // Keyboard users get the same tooltip, immediately — a focus ring that
     // reveals nothing is the whole reason icon-only buttons are hard to learn.
+    // Only KEYBOARD focus, though: a click focuses too, and without the
+    // `:focus-visible` check it reopened the bubble the pointerdown just
+    // closed, with no delay. Hover keeps its own path.
     const onFocus = (e: FocusEvent) => {
       const el = target(e);
-      if (el) open(el, 0);
+      if (!el || el === parked.current) return;
+      if (!(e.target instanceof Element) || !e.target.matches(":focus-visible")) return;
+      open(el, 0);
     };
     const onKey = (e: KeyboardEvent) => {
       if (e.key === "Escape") restore();
@@ -126,9 +177,17 @@ export function GlobalTooltip() {
     document.addEventListener("focusin", onFocus);
     document.addEventListener("focusout", restore);
     document.addEventListener("keydown", onKey);
-    // A bubble anchored to a rect is wrong the moment anything moves.
-    window.addEventListener("scroll", restore, true);
+    // A bubble anchored to a rect is wrong the moment its anchor moves — but
+    // only a scroll of the document or of a box containing the anchor moves
+    // it. A log tailing in another panel must not close the bubble.
+    const onScroll = (e: Event) => {
+      const anchor = parked.current || pending.current;
+      const t = e.target;
+      if (!anchor || !(t instanceof Node) || t === document || t.contains(anchor)) restore();
+    };
+    window.addEventListener("scroll", onScroll, true);
     window.addEventListener("resize", restore);
+    window.addEventListener("blur", restore);
     return () => {
       document.removeEventListener("pointerover", onOver);
       document.removeEventListener("pointerout", onOut);
@@ -136,12 +195,33 @@ export function GlobalTooltip() {
       document.removeEventListener("focusin", onFocus);
       document.removeEventListener("focusout", restore);
       document.removeEventListener("keydown", onKey);
-      window.removeEventListener("scroll", restore, true);
+      window.removeEventListener("scroll", onScroll, true);
       window.removeEventListener("resize", restore);
+      window.removeEventListener("blur", restore);
       restore();
     };
   }, [open, restore]);
 
+  // A control unmounted under a still cursor fires no pointerout: without this
+  // its bubble stays up over whatever replaced it. The same goes for a title
+  // re-rendered under it — the bubble would keep saying the old text, so it
+  // hides and `restore` keeps the new attribute.
+  useEffect(() => {
+    if (!tip) return;
+    const watch = new MutationObserver((records) => {
+      const el = parked.current;
+      if (!el) return;
+      if (
+        !el.isConnected ||
+        records.some((r) => r.type === "attributes" && el.hasAttribute("title"))
+      )
+        restore();
+    });
+    watch.observe(document.body, { childList: true, subtree: true });
+    if (parked.current) watch.observe(parked.current, { attributeFilter: ["title"] });
+    return () => watch.disconnect();
+  }, [tip, restore]);
+
   // Placed after the first paint, when the bubble's real size is known —
   // measuring it is the only way to flip and clamp without guessing.
   useEffect(() => {

client/src/components/__tests__/Tooltip.test.tsx

@@ -10,6 +10,7 @@
 
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { render, screen, fireEvent, act } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import { GlobalTooltip } from "../Tooltip";
 
 function setup(extra?: React.ReactNode) {
@@ -24,6 +25,24 @@ function setup(extra?: React.ReactNode) {
 
 const hover = (el: Element) => fireEvent.pointerOver(el, { bubbles: true });
 const unhover = (el: Element) => fireEvent.pointerOut(el, { bubbles: true });
+// jsdom's :focus-visible is a heuristic over the previous events and leaks
+// between tests, so the tests say which kind of focus they mean: a spy answers
+// `:focus-visible` from this flag and passes every other selector through.
+let keyboardFocus = false;
+const realMatches = Element.prototype.matches;
+beforeEach(() => {
+  keyboardFocus = false;
+  vi.spyOn(Element.prototype, "matches").mockImplementation(function (this: Element, sel) {
+    return sel === ":focus-visible"
+      ? keyboardFocus && document.activeElement === this
+      : realMatches.call(this, sel);
+  });
+});
+afterEach(() => vi.restoreAllMocks());
+const tabTo = (el: HTMLElement) => {
+  keyboardFocus = true;
+  act(() => el.focus());
+};
 
 beforeEach(() => vi.useFakeTimers({ shouldAdvanceTime: true }));
 afterEach(() => vi.useRealTimers());
@@ -63,7 +82,7 @@ describe("GlobalTooltip", () => {
     setup();
     const button = screen.getByRole("button", { name: "refresh" });
 
-    fireEvent.focusIn(button);
+    tabTo(button);
     await act(async () => {
       vi.advanceTimersByTime(0);
     });
@@ -105,4 +124,165 @@ describe("GlobalTooltip", () => {
     await settle();
     expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Refresh the working copy");
   });
+  it("keeps an icon-only control's accessible name while its title is parked", async () => {
+    setup(
+      <button title="Stage this file">
+        <svg aria-hidden="true" />
+      </button>
+    );
+    const icon = screen.getByRole("button", { name: "Stage this file" });
+    tabTo(icon);
+    await act(async () => {
+      vi.advanceTimersByTime(0);
+    });
+    expect(screen.getByTestId("global-tooltip")).toBeInTheDocument();
+    expect(icon).not.toHaveAttribute("title");
+    expect(screen.getByRole("button", { name: "Stage this file" })).toBe(icon);
+
+    fireEvent.keyDown(document, { key: "Escape" });
+    // Put back exactly as found: no aria-label left behind.
+    expect(icon).toHaveAttribute("title", "Stage this file");
+    expect(icon).not.toHaveAttribute("aria-label");
+  });
+
+  it("does not flicker while the pointer crosses the control's own children", async () => {
+    setup(
+      <button title="Two parts">
+        <span data-testid="part-a">a</span>
+        <span data-testid="part-b">b</span>
+      </button>
+    );
+    const a = screen.getByTestId("part-a");
+    const b = screen.getByTestId("part-b");
+    hover(a);
+    await settle();
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Two parts");
+
+    fireEvent.pointerOut(a, { bubbles: true, relatedTarget: b });
+    fireEvent.pointerOver(b, { bubbles: true, relatedTarget: a });
+    // Still up, with no fresh delay.
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Two parts");
+  });
+
+  it("hides when its control is removed from the page", async () => {
+    const { rerender } = render(
+      <>
+        <GlobalTooltip />
+        <button title="Going away">x</button>
+      </>
+    );
+    hover(screen.getByRole("button", { name: "x" }));
+    await settle();
+    expect(screen.getByTestId("global-tooltip")).toBeInTheDocument();
+
+    rerender(
+      <>
+        <GlobalTooltip />
+      </>
+    );
+    await settle();
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+  });
+
+  it("keeps a title React changed while the bubble was up, instead of writing the stale one back", async () => {
+    const { rerender } = render(
+      <>
+        <GlobalTooltip />
+        <button title="Pull 2 commits">pull</button>
+      </>
+    );
+    const button = screen.getByRole("button", { name: "pull" });
+    hover(button);
+    await settle();
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Pull 2 commits");
+
+    // A poll flips the hint while the pointer rests on the control.
+    rerender(
+      <>
+        <GlobalTooltip />
+        <button title="Up to date">pull</button>
+      </>
+    );
+    await settle();
+    // The bubble must not keep advertising the old text.
+    expect(screen.queryByText("Pull 2 commits")).toBeNull();
+
+    unhover(button);
+    expect(button).toHaveAttribute("title", "Up to date");
+  });
+
+  it("leaves no title behind when React removed it while the bubble was up", async () => {
+    const { rerender } = render(
+      <>
+        <GlobalTooltip />
+        <button title="Pull 2 commits">pull</button>
+      </>
+    );
+    const button = screen.getByRole("button", { name: "pull" });
+    hover(button);
+    await settle();
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Pull 2 commits");
+
+    // React "removes" an attribute that is already parked: no MutationRecord.
+    rerender(
+      <>
+        <GlobalTooltip />
+        <button>pull</button>
+      </>
+    );
+    await settle();
+    unhover(button);
+    expect(button).not.toHaveAttribute("title");
+    expect(button).not.toHaveAttribute("data-tip");
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+  });
+
+  it("does not open on the focus a mouse click gives, only on keyboard focus", async () => {
+    const user = userEvent.setup({ advanceTimers: vi.advanceTimersByTime });
+    setup(<button title="Second control">second</button>);
+    // A click is pointer focus: :focus-visible does not match.
+    const button = screen.getByRole("button", { name: "refresh" });
+
+    await user.click(button);
+    await act(async () => {
+      vi.advanceTimersByTime(0);
+    });
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+
+    tabTo(screen.getByRole("button", { name: "second" }));
+    await act(async () => {
+      vi.advanceTimersByTime(0);
+    });
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Second control");
+  });
+
+  it("stays up when an unrelated panel scrolls, and hides when the anchor's own scroller moves", async () => {
+    render(
+      <>
+        <GlobalTooltip />
+        <div data-testid="scroller">
+          <button title="Inside the scroller">inside</button>
+        </div>
+        <div data-testid="elsewhere" />
+      </>
+    );
+    const button = screen.getByRole("button", { name: "inside" });
+    hover(button);
+    await settle();
+
+    fireEvent.scroll(screen.getByTestId("elsewhere"));
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Inside the scroller");
+
+    fireEvent.scroll(screen.getByTestId("scroller"));
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+    expect(button).toHaveAttribute("title", "Inside the scroller");
+  });
+
+  it("hides when the document itself scrolls", async () => {
+    setup();
+    hover(screen.getByRole("button", { name: "refresh" }));
+    await settle();
+    fireEvent.scroll(document);
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+  });
 });

client/src/components/lanes/AddLaneModal.tsx

@@ -27,18 +27,6 @@ import { api } from "../../lib/api";
 import type { AiRouter, CwdSuggestion } from "../../lib/api";
 import type { Lane, LaneTool, LaneWorktree } from "../../lib/types";
 
-/** Mirrors server/lib/worktree.js `slugify`, for the branch-name PREVIEW only.
- *  Nothing is sent from it: an empty branch field means "let the server name
- *  it", which is how `LANE_BRANCH_PREFIX` keeps working. */
-function slugPreview(title: string) {
-  return title
-    .toLowerCase()
-    .normalize("NFKD")
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 40);
-}
-
 /** Polls the lane until the background `git worktree add` finishes (status
  *  leaves "provisioning"), or gives up after `timeoutMs`. Returns the final
  *  lane record, or `null` on timeout. */
@@ -127,7 +115,6 @@ export function AddLaneModal({
   const [browseOpen, setBrowseOpen] = useState(false);
   const [setupResult, setSetupResult] = useState<{
     profile: "scaffolded" | "skipped" | "failed";
-    agents: "ok" | "failed";
     mcp: "ok" | "failed";
     router: "ok" | "skipped" | "failed";
   } | null>(null);
@@ -306,7 +293,7 @@ export function AddLaneModal({
       // POST /worktree returns as soon as the DB row exists (202) — the
       // actual `git worktree add` runs afterward, in the background, on the
       // server. Firing setup against the lane's cwd before that finishes
-      // means agents/mcp write into a directory that doesn't exist yet, so
+      // means mcp writes into a directory that doesn't exist yet, so
       // wait for provisioning to leave the "provisioning" status first.
       const provisionedLane = await waitForProvisioned(result.lane.id);
       if (!provisionedLane || provisionedLane.status === "failed") {
@@ -315,9 +302,8 @@ export function AddLaneModal({
         return;
       }
 
-      const [profileOutcome, agentsOutcome, mcpOutcome, routerOutcome] = await Promise.allSettled([
+      const [profileOutcome, mcpOutcome, routerOutcome] = await Promise.allSettled([
         api.lanes.profileInit(result.lane.id),
-        api.lanes.agentsInstall(result.lane.id),
         api.lanes.mcpSync(result.lane.id),
         applyRouter(result.lane.id),
       ]);
@@ -328,7 +314,6 @@ export function AddLaneModal({
               ? "scaffolded"
               : "skipped"
             : "failed",
-        agents: agentsOutcome.status === "fulfilled" ? "ok" : "failed",
         mcp: mcpOutcome.status === "fulfilled" ? "ok" : "failed",
         router:
           routerOutcome.status !== "fulfilled" ? "failed" : router === "native" ? "skipped" : "ok",
@@ -340,7 +325,6 @@ export function AddLaneModal({
         console.info("[add-lane] auto-setup result:", {
           profile:
             profileOutcome.status === "fulfilled" ? profileOutcome.value : profileOutcome.reason,
-          agents: agentsOutcome.status === "fulfilled" ? agentsOutcome.value : agentsOutcome.reason,
           mcp: mcpOutcome.status === "fulfilled" ? mcpOutcome.value : mcpOutcome.reason,
           // Never the profile itself: it would put an endpoint and a lane id in
           // the browser console. (The key is never sent here at all.)
@@ -391,7 +375,7 @@ export function AddLaneModal({
     !done &&
     (!sourceRepo.trim() ||
       (mode === "worktree" &&
-        (!title.trim() || !branches || (branchMode === "existing" && !branch.trim()))));
+        (!title.trim() || !branches?.length || (branchMode === "existing" && !branch.trim()))));
 
   /** branch name -> the worktree directory already holding it. git allows one
    *  checkout per branch, so these are the branches this form cannot use. */
@@ -441,6 +425,15 @@ export function AddLaneModal({
               label={t("addLaneToolCodex")}
               onClick={() => setTool("codex")}
             />
+            <Seg
+              active={tool === "antigravity"}
+              label={t("addLaneToolAntigravity")}
+              onClick={() => {
+                setTool("antigravity");
+                // `agy` cannot run behind an AI Router (see router-apply.js).
+                setRouter("native");
+              }}
+            />
           </div>
         </div>
 
@@ -565,7 +558,18 @@ export function AddLaneModal({
                     {t("addLaneBaseLabel")}
                   </label>
                   {branches.length === 0 ? (
-                    <p className="text-[10px] text-fg-muted">{t("addLaneNoBranches")}</p>
+                    // No commit, nothing to fork: the server refuses this with
+                    // EEMPTYREPO, so the one way forward is offered instead.
+                    <div className="space-y-1">
+                      <p className="text-[10px] text-fg-muted">{t("addLaneNoBranches")}</p>
+                      <button
+                        type="button"
+                        onClick={() => setMode("repo")}
+                        className="rounded-md border border-border-light px-2 py-0.5 text-xs text-fg-secondary hover:bg-surface-2"
+                      >
+                        {t("addLaneNoBranchesUseRepo")}
+                      </button>
+                    </div>
                   ) : (
                     <select
                       id="add-lane-base"
@@ -589,12 +593,10 @@ export function AddLaneModal({
                     id="add-lane-branch"
                     value={branch}
                     onChange={(e) => setBranch(e.target.value)}
-                    // The placeholder is what the SERVER will name the branch
-                    // if this is left empty, so the default is visible without
-                    // the form having to duplicate LANE_BRANCH_PREFIX.
-                    placeholder={
-                      title.trim() ? `feat/${slugPreview(title)}` : t("addLaneBranchPlaceholder")
-                    }
+                    // Neutral on purpose: an empty field lets the SERVER name
+                    // the branch, under a LANE_BRANCH_PREFIX this form cannot
+                    // see, so any `feat/…` preview here could be wrong.
+                    placeholder={t("addLaneBranchPlaceholder")}
                     className="w-full rounded-md border border-border-light bg-surface-0 px-3 py-1.5 font-mono text-xs text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none"
                   />
                   <p className="mt-1 text-[10px] text-fg-muted">{t("addLaneBranchHintAuto")}</p>
@@ -638,7 +640,10 @@ export function AddLaneModal({
             hid it. The pipeline picker is gone entirely: every lane is created
             on `default` (the server's own default) and the template is changed
             from the lane's own header afterwards. */}
-        <div className="rounded-md border border-border-light bg-surface-0 p-2">
+        <div
+          className="rounded-md border border-border-light bg-surface-0 p-2"
+          hidden={tool === "antigravity"}
+        >
           <div>
             <fieldset>
               <legend className="mb-1 text-xs text-fg-secondary">{t("addLaneRouterLabel")}</legend>
@@ -731,7 +736,6 @@ export function AddLaneModal({
                   ok: setupResult.profile !== "failed",
                   skipped: setupResult.profile === "skipped",
                 },
-                { label: t("addLaneSetupAgents"), ok: setupResult.agents === "ok" },
                 { label: t("addLaneSetupMcp"), ok: setupResult.mcp === "ok" },
                 {
                   label: t("addLaneSetupRouter"),

client/src/components/lanes/LaneCard.tsx

@@ -1,5 +1,5 @@
 /**
- * @file One lane's card: branch/CI/PR facts, the "needs you"
+ * @file One lane's card: CI/PR facts, the "needs you"
  * banner sourced from Claude Code's Notification hook, and (for managed
  * lanes only) a ⋯ menu holding the rare `reset worktree` action behind
  * DestructiveLaneModal. A dead lane (its driving session went silent while
@@ -16,74 +16,33 @@
  * install / MCP sync / dev-sync check / create-update readme) and the
  * remove-lane button live in Workspace's page header / pipeline-picker row
  * instead of here, so they stay reachable and un-clipped regardless of this
- * card's own scroll area.
+ * card's own scroll area. The working copy — branch, uncommitted counts, the
+ * git action bar — is not here either: it heads the Changes panel
+ * (`LaneGitHeader`), beside the diff it describes.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-import { useCallback, useEffect, useLayoutEffect, useRef, useState } from "react";
-import { createPortal } from "react-dom";
+import { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { DestructiveLaneModal } from "./DestructiveLaneModal";
-import { LaneGitBar } from "./LaneGitBar";
 import { api } from "../../lib/api";
 import { eventBus } from "../../lib/eventBus";
 import { keepIfSame } from "../../lib/keepIfSame";
 import type { AiRouter } from "../../lib/api";
-import type { Lane, LaneGitFacts, LaneGitFile, LaneRuntime, NamedLock } from "../../lib/types";
+import type { Lane, LaneRuntime, NamedLock } from "../../lib/types";
 
-/** How often a mounted card re-reads its working-copy facts. Slow on purpose:
- *  each call is five git subprocesses server-side, and a branch name does not
- *  change on the timescale the lane list is polled at. */
-const GIT_REFRESH_MS = 30_000;
-
-/** How often a mounted card re-probes its stack. Faster than the git refresh
- *  because a stack dying is exactly what the user needs to see, and slower than
+/** How often a mounted card re-probes its stack. Faster than the Changes panel's
+ *  git refresh because a stack dying is exactly what the user needs to see, and slower than
  *  the lane poll because each call opens a socket per declared port. */
 const RUNTIME_REFRESH_MS = 10_000;
 
 /** How often a mounted card re-reads locks held by this lane. Same refresh rate
- *  as the git facts (slow, since lock state changes infrequently). */
+ *  as the Changes panel's git facts (slow, since lock state changes infrequently). */
 const LOCKS_REFRESH_MS = 30_000;
 
-/**
- * The lane's own working copy, fetched per card rather than folded into the
- * polled lane list. Absent facts are not an error state: a lane may point at a
- * plain directory, and it renders as a card without a git row.
- */
-function useLaneGitFacts(laneId: number): [LaneGitFacts | null, () => void] {
-  const [facts, setFacts] = useState<LaneGitFacts | null>(null);
-  // Bumped by the git action bar: a commit or a pull changes every fact on
-  // this row, and waiting out the 30s poll makes the button look inert.
-  const [nonce, setNonce] = useState(0);
-
-  useEffect(() => {
-    let alive = true;
-    const read = () => {
-      api.lanes
-        .git(laneId)
-        .then((f) => {
-          if (alive) setFacts(keepIfSame(f));
-        })
-        .catch(() => {
-          // Silent: a card that cannot read git shows the rest of itself. An
-          // error banner here would fire on every lane on every server blip.
-          if (alive) setFacts(keepIfSame<LaneGitFacts>({ available: false }));
-        });
-    };
-    read();
-    const timer = setInterval(read, GIT_REFRESH_MS);
-    return () => {
-      alive = false;
-      clearInterval(timer);
-    };
-  }, [laneId, nonce]);
-
-  return [facts, () => setNonce((n) => n + 1)];
-}
-
 /**
  * The lane's own application stack. Same shape and same silence as the git
- * facts above: a lane without a `.agenthub/profile` simply has no runtime row, which
+ * facts in LaneGitHeader: a lane without a `.agenthub/profile` simply has no runtime row, which
  * is the common case and not an error worth a banner.
  *
  * `bump` lets an up/down action re-read immediately instead of waiting out the
@@ -191,7 +150,7 @@ export function LaneRouterRow({ lane }: { lane: Lane }) {
         if (alive) setRouters(r.items);
       })
       .catch(() => {
-        // Silent, same contract as the git/runtime pollers above: a card that
+        // Silent, same contract as the runtime poller above: a card that
         // cannot list routers simply shows no router row.
         if (alive) setRouters([]);
       });
@@ -312,7 +271,7 @@ export function since(sec: number | null): string {
 }
 
 /**
- * Repo tooling (agents install / MCP sync / dev-sync check, and the
+ * Repo tooling (MCP sync / dev-sync check, and the
  * create/update-readme run, which moved here from the Add-lane modal) for one lane,
  * collapsed into a single dropdown. Lives outside LaneCard so it can be
  * placed in the Workspace page header, next to "Add lane" — it polls its
@@ -322,16 +281,11 @@ export function since(sec: number | null): string {
 export function LaneToolsMenu({ lane }: { lane: Lane }) {
   const { t } = useTranslation(["lanes"]);
   const [toolsMenuOpen, setToolsMenuOpen] = useState(false);
-  const [laneActionBusy, setLaneActionBusy] = useState<
-    "agents" | "mcp" | "sync-check" | "docs" | null
-  >(null);
+  const [laneActionBusy, setLaneActionBusy] = useState<"mcp" | "sync-check" | "docs" | null>(null);
   const [laneActionResult, setLaneActionResult] = useState<string | null>(null);
   const runtime = useLaneRuntime(lane.id, 0);
 
-  const runLaneAction = async (
-    which: "agents" | "mcp" | "sync-check" | "docs",
-    fn: () => Promise<string>
-  ) => {
+  const runLaneAction = async (which: "mcp" | "sync-check" | "docs", fn: () => Promise<string>) => {
     setLaneActionBusy(which);
     setLaneActionResult(null);
     try {
@@ -343,12 +297,6 @@ export function LaneToolsMenu({ lane }: { lane: Lane }) {
     }
   };
 
-  const handleAgentsInstall = () =>
-    runLaneAction("agents", async () => {
-      const result = await api.lanes.agentsInstall(lane.id);
-      return t("actions.agentsInstallResult", { files: result.installed.join(", ") });
-    });
-
   // A skill only exists inside a CLI session, so there is nothing server-side
   // to call: this opens the lane's own terminal run with the slash command as
   // its first message. Claude-only — codex has no slash commands.
@@ -404,20 +352,7 @@ export function LaneToolsMenu({ lane }: { lane: Lane }) {
           role="menu"
           className="absolute right-0 z-10 mt-1 min-w-44 overflow-hidden rounded-md border border-border-light bg-surface-0 py-1 shadow-lg shadow-black/40"
         >
-          <button
-            type="button"
-            role="menuitem"
-            data-testid="lane-agents-install"
-            onClick={(e) => {
-              e.stopPropagation();
-              setToolsMenuOpen(false);
-              void handleAgentsInstall();
-            }}
-            className="block w-full px-3 py-1.5 text-left text-fg-secondary hover:bg-surface-2"
-          >
-            {t("actions.agentsInstall")}
-          </button>
-          {lane.tool !== "codex" && (
+          {lane.tool === "claude" && (
             <button
               type="button"
               role="menuitem"
@@ -473,147 +408,11 @@ export function LaneToolsMenu({ lane }: { lane: Lane }) {
   );
 }
 
-/** Porcelain status code -> the letter shown and the colour it is shown in.
- *  Keyed on the code's first meaningful character, so an index-side change
- *  (`M `), a worktree-side one (` M`) and both (`MM`) read the same. */
-const GIT_STATUS_STYLE: Record<string, string> = {
-  M: "text-status-warning",
-  A: "text-status-success",
-  D: "text-status-danger",
-  R: "text-accent",
-  C: "text-accent",
-  U: "text-status-danger",
-  "?": "text-fg-muted",
-};
-
-/**
- * The file list behind a lane's uncommitted counts: which files, what happened
- * to each, and how many lines it gained and lost.
- *
- * It replaced a native `title` tooltip, which could show the same paths but
- * neither colour them nor align the deltas — and a plain porcelain dump is not
- * something you read at a glance.
- *
- * PORTALLED to `document.body` and `position: fixed`, for the same reason this
- * file's own header says the tools dropdown was moved out of the card: a lane
- * card renders inside the Workspace's `max-h-[45vh] overflow-y-auto` box, and
- * an absolutely positioned panel would be clipped by it for every card that is
- * not at the very top. It flips above its anchor rather than off the bottom of
- * the window, and clamps to the right edge.
- */
-function LaneGitFilesPanel({
-  files,
-  hidden,
-  anchor,
-  onPointerEnter,
-  onPointerLeave,
-}: {
-  files: LaneGitFile[];
-  hidden: number;
-  /** The counts button this panel hangs off. */
-  anchor: HTMLElement | null;
-  onPointerEnter: () => void;
-  onPointerLeave: () => void;
-}) {
-  const { t } = useTranslation(["lanes"]);
-  const panelRef = useRef<HTMLDivElement>(null);
-  const [pos, setPos] = useState<{ top: number; left: number } | null>(null);
-
-  // After the first paint, when the panel's real height is known: place it
-  // under the anchor, or above it when that would run off the bottom.
-  useLayoutEffect(() => {
-    if (!anchor || !panelRef.current) return;
-    const a = anchor.getBoundingClientRect();
-    const p = panelRef.current.getBoundingClientRect();
-    const gap = 4;
-    const top =
-      a.bottom + gap + p.height > window.innerHeight ? a.top - p.height - gap : a.bottom + gap;
-    setPos({
-      top: Math.max(8, top),
-      left: Math.max(8, Math.min(a.left, document.documentElement.clientWidth - p.width - 8)),
-    });
-  }, [anchor, files]);
-  // Totals are over the LISTED files only — the cap means the rest are unknown,
-  // and a total that silently omits them would be a wrong number rather than a
-  // partial one. `hidden` says how many are missing.
-  const added = files.reduce((n, f) => n + (f.added ?? 0), 0);
-  const deleted = files.reduce((n, f) => n + (f.deleted ?? 0), 0);
-
-  return createPortal(
-    <div
-      ref={panelRef}
-      data-testid="lane-git-files"
-      role="group"
-      aria-label={t("git.filesHeading", { count: files.length })}
-      // The pointer has to be able to travel INTO the panel to scroll it, so
-      // the panel answers the same enter/leave pair the trigger does.
-      onMouseEnter={onPointerEnter}
-      onMouseLeave={onPointerLeave}
-      style={{
-        position: "fixed",
-        zIndex: 60,
-        top: pos?.top ?? 0,
-        left: pos?.left ?? 0,
-        // Hidden for the one frame before it has been measured, so it never
-        // flashes at the top-left corner.
-        visibility: pos ? "visible" : "hidden",
-      }}
-      className="max-h-72 w-[22rem] max-w-[calc(100vw-1rem)] overflow-y-auto rounded-md border border-border bg-surface-1 p-2 shadow-lg"
-    >
-      <div className="mb-1.5 flex items-baseline gap-2 border-b border-border pb-1.5 text-[11px]">
-        <span className="text-fg-secondary">{t("git.filesHeading", { count: files.length })}</span>
-        <span className="ml-auto shrink-0 font-mono tabular-nums">
-          <span className="text-status-success">+{added}</span>{" "}
-          <span className="text-status-danger">−{deleted}</span>
-        </span>
-      </div>
-      <ul className="space-y-0.5 font-mono text-[11px]">
-        {files.map((f) => {
-          const code = f.status.trim()[0] || "?";
-          return (
-            <li key={f.path} className="flex items-baseline gap-2">
-              <span
-                className={`w-3 shrink-0 font-semibold ${GIT_STATUS_STYLE[code] || "text-fg-muted"}`}
-                title={f.status}
-              >
-                {code}
-              </span>
-              {/* The DIRECTORY truncates, never the filename: the name is what
-                  you scan for, the path is only there to disambiguate it. */}
-              <span className="flex min-w-0 flex-1 items-baseline" title={f.path}>
-                <span className="truncate text-fg-muted">{f.path.replace(/[^/]+$/, "")}</span>
-                <span className="shrink-0 text-fg-primary">{f.path.split("/").pop()}</span>
-              </span>
-              <span className="shrink-0 tabular-nums">
-                {f.added === null && f.deleted === null ? (
-                  <span className="text-fg-muted">{t("git.noDelta")}</span>
-                ) : (
-                  <>
-                    <span className="text-status-success">+{f.added ?? 0}</span>{" "}
-                    <span className="text-status-danger">−{f.deleted ?? 0}</span>
-                  </>
-                )}
-              </span>
-            </li>
-          );
-        })}
-      </ul>
-      {hidden > 0 && (
-        <p className="mt-1.5 border-t border-border pt-1.5 text-[10px] text-fg-muted">
-          {t("git.filesMore", { count: hidden })}
-        </p>
-      )}
-    </div>,
-    document.body
-  );
-}
-
 export default function LaneCard({
   lane,
   onAction,
   childWorktrees,
   onSelectLane,
-  onNewLaneFromRepo,
 }: {
   lane: Lane;
   onAction: (action: string, body?: Record<string, unknown>) => void;
@@ -623,31 +422,12 @@ export default function LaneCard({
   childWorktrees?: Lane[];
   /** Jumps the Workspace page's selection to another lane's card. */
   onSelectLane?: (id: number) => void;
-  /** Opens the Add-lane flow prefilled with this lane's repo, for a sibling
-   *  worktree on `branch`. Omitted where that flow is not reachable. */
-  onNewLaneFromRepo?: (repo: string, branch?: string) => void;
 }) {
   const { t } = useTranslation(["lanes"]);
   const [destructiveAction, setDestructiveAction] = useState<"reset" | null>(null);
   const [menuOpen, setMenuOpen] = useState(false);
   const [runtimeBump, setRuntimeBump] = useState(0);
   const [bootLine, setBootLine] = useState<string | null>(null);
-  const [filesOpen, setFilesOpen] = useState(false);
-  const [countsAnchor, setCountsAnchor] = useState<HTMLButtonElement | null>(null);
-  // Closing is DELAYED: the panel is portalled away from the trigger, so the
-  // pointer leaves the trigger before it can land on the panel it is heading
-  // for. Any enter — trigger or panel — cancels the pending close.
-  const filesCloseTimer = useRef<number | undefined>(undefined);
-  const openFiles = useCallback(() => {
-    window.clearTimeout(filesCloseTimer.current);
-    setFilesOpen(true);
-  }, []);
-  const closeFiles = useCallback(() => {
-    window.clearTimeout(filesCloseTimer.current);
-    filesCloseTimer.current = window.setTimeout(() => setFilesOpen(false), 150);
-  }, []);
-  useEffect(() => () => window.clearTimeout(filesCloseTimer.current), []);
-  const [git, refreshGit] = useLaneGitFacts(lane.id);
   const runtime = useLaneRuntime(lane.id, runtimeBump);
   const locks = useLaneLocks(lane.slot);
 
@@ -676,28 +456,20 @@ export default function LaneCard({
     <>
       <div
         data-testid={`lane-card-${lane.id}`}
-        className="flex flex-col rounded-lg border border-border bg-surface-4 p-2.5 transition-colors hover:border-border-light"
+        // Every row below is conditional: a lane with nothing to report
+        // renders no frame at all rather than an empty box.
+        className="flex flex-col rounded-lg border border-border bg-surface-4 p-2.5 transition-colors hover:border-border-light empty:hidden"
       >
-        {(lane.ci_status || lane.tool === "codex") && (
+        {lane.ci_status && (
           <div className="mb-2 flex flex-wrap items-center gap-1.5 text-[11px]">
-            {lane.ci_status && (
-              <span className="rounded bg-surface-2 px-1.5 py-0.5 text-fg-secondary">
-                CI {lane.ci_status}
-              </span>
-            )}
-            {lane.tool === "codex" && (
-              <span className="rounded border border-border bg-surface-2 px-1.5 py-0.5 text-[10px] text-fg-muted">
-                Codex
-              </span>
-            )}
+            <span className="rounded bg-surface-2 px-1.5 py-0.5 text-fg-secondary">
+              CI {lane.ci_status}
+            </span>
           </div>
         )}
 
-        {lane.needs_action && (
-          <div className="mb-2 rounded border border-status-warning/50 bg-status-warning/10 px-2 py-1 text-xs text-status-warning">
-            ⚠ {lane.needs_action}
-          </div>
-        )}
+        {/* No needs-you banner here: the strip card already flags it, and the
+            console directly below is where the prompt actually waits. */}
 
         {/* Runtime strip: the lane's own app stack, shown only for lanes that
             declare a profile. A port that drifted from `base + slot` is called
@@ -773,73 +545,6 @@ export default function LaneCard({
           </div>
         )}
 
-        {/* One line, because every part of it is short and the panel is
-            narrow: branch, head, subject, and the uncommitted counts read as a
-            sentence rather than a four-row block. The cwd is NOT here — the
-            lane-detail header above this card already spells it out. */}
-        {git?.available && (
-          <div className="mb-2">
-            <div
-              data-testid="lane-git"
-              className="flex items-baseline gap-2 truncate font-mono text-[11px] text-fg-secondary"
-              title={git.subject}
-            >
-              <span className="shrink-0">⑂ {git.branch}</span>
-              <span className="shrink-0 text-fg-muted">{git.head}</span>
-              <span className="truncate text-fg-muted">{git.subject}</span>
-              {(git.dirty > 0 || git.untracked > 0) && (
-                <button
-                  type="button"
-                  ref={setCountsAnchor}
-                  data-testid="lane-git-counts"
-                  aria-expanded={filesOpen}
-                  onMouseEnter={openFiles}
-                  onMouseLeave={closeFiles}
-                  // Focus and click open it too: hover is not a gesture a
-                  // keyboard or a touchscreen has.
-                  onFocus={openFiles}
-                  onBlur={closeFiles}
-                  onClick={() => setFilesOpen((v) => !v)}
-                  className="shrink-0 cursor-help text-status-warning/80 underline decoration-dotted underline-offset-2"
-                >
-                  {t("git.uncommitted", { dirty: git.dirty, untracked: git.untracked })}
-                </button>
-              )}
-            </div>
-            {filesOpen && git.files?.length > 0 && (
-              <LaneGitFilesPanel
-                files={git.files}
-                hidden={git.dirty + git.untracked - git.files.length}
-                anchor={countsAnchor}
-                onPointerEnter={openFiles}
-                onPointerLeave={closeFiles}
-              />
-            )}
-          </div>
-        )}
-        {git?.available && (
-          <LaneGitBar
-            laneId={lane.id}
-            git={git}
-            onChanged={refreshGit}
-            /* A sibling worktree forks from the lane's SOURCE repo when it
-               has one (this lane is itself a worktree of it); an adopted lane
-               is its own repo. */
-            onNewLane={
-              onNewLaneFromRepo
-                ? (branch) => onNewLaneFromRepo(lane.source_repo || lane.cwd, branch)
-                : undefined
-            }
-          />
-        )}
-        {/* The lane's own recorded branch, shown only when git could not be
-            read — otherwise it duplicates the live branch above. */}
-        {!git?.available && lane.branch && (
-          <div className="mb-2 truncate font-mono text-[11px] text-fg-secondary">
-            ⑂ {lane.branch}
-          </div>
-        )}
-
         {childWorktrees && childWorktrees.length > 0 && (
           <div
             data-testid="lane-child-worktrees"
@@ -854,7 +559,7 @@ export default function LaneCard({
                   <button
                     type="button"
                     onClick={() => onSelectLane?.(w.id)}
-                    className="truncate text-left text-blue-400 hover:underline"
+                    className="truncate text-left text-blue-700 dark:text-blue-400 hover:underline"
                     title={w.cwd}
                   >
                     #{w.id} {w.title || w.cwd} · {w.status}

client/src/components/lanes/LaneConflictView.tsx

@@ -0,0 +1,279 @@
+/**
+ * @file LaneConflictView.tsx
+ * @description The Changes panel's view of ONE conflicted file during a merge
+ * (issue #45): the file with each conflict block drawn as its two sides —
+ * "mine" and "theirs", labelled from git's own markers and tinted apart — and
+ * a Keep mine / Take theirs / Keep both choice per block, undoable. Save and
+ * mark resolved writes the chosen text over exactly the version it opened
+ * (`gitSaveFile` with its `sha`, 409 ESTALE otherwise) and then runs
+ * `resolve done`, which re-checks that no marker is left. Take all mine /
+ * theirs is `resolve ours|theirs` for the whole file; Edit by hand hands the
+ * file to the panel's plain editor.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { ChevronDown, ChevronUp } from "lucide-react";
+import { api } from "../../lib/api";
+import {
+  applyChoices,
+  parseConflicts,
+  type ConflictChoice,
+  type ConflictPart,
+} from "../../lib/conflicts";
+
+const BASE =
+  "rounded border px-1.5 py-0.5 text-[11px] hover:bg-surface-2 disabled:cursor-not-allowed disabled:opacity-40";
+const BTN = `${BASE} border-border-light text-fg-secondary hover:text-fg-primary`;
+
+function Lines({ lines, className = "" }: { lines: string[]; className?: string }) {
+  return (
+    <pre className={`whitespace-pre px-2 font-mono text-[11px] leading-5 ${className}`}>
+      {lines.length ? lines.join("\n") : " "}
+    </pre>
+  );
+}
+
+export function LaneConflictView({
+  laneId,
+  path,
+  onResolved,
+  onEdit,
+}: {
+  laneId: number;
+  path: string;
+  /** The file left the conflict (resolved, or a whole side taken). */
+  onResolved: () => void;
+  /** Open the file in the panel's plain editor instead. */
+  onEdit: () => void;
+}) {
+  const { t } = useTranslation(["lanes"]);
+  const [file, setFile] = useState<{ lines: string[]; sha?: string; usable: boolean } | null>(null);
+  const [choices, setChoices] = useState<(ConflictChoice | undefined)[]>([]);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const blockRefs = useRef<(HTMLDivElement | null)[]>([]);
+  const [at, setAt] = useState(0);
+
+  useEffect(() => {
+    let live = true;
+    setFile(null);
+    setChoices([]);
+    setError(null);
+    api.lanes
+      .gitFile(laneId, path, "work")
+      .then((r) => {
+        if (!live) return;
+        setFile(
+          r.available
+            ? { lines: r.lines, sha: r.sha, usable: !r.binary && !r.truncated && !!r.sha }
+            : { lines: [], usable: false }
+        );
+      })
+      .catch((e) => live && setError(e instanceof Error ? e.message : String(e)));
+    return () => {
+      live = false;
+    };
+  }, [laneId, path]);
+
+  const parts: ConflictPart[] | null = file?.usable ? parseConflicts(file.lines) : null;
+  const total = parts ? parts.filter((p) => p.kind === "conflict").length : 0;
+  const chosen = choices.filter(Boolean).length;
+  const done = total > 0 && chosen === total;
+
+  const run = async (fn: () => Promise<unknown>) => {
+    setBusy(true);
+    setError(null);
+    try {
+      await fn();
+      onResolved();
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const save = () =>
+    run(async () => {
+      if (!parts || !file?.sha) return;
+      await api.lanes.gitSaveFile(laneId, path, applyChoices(parts, choices).join("\n"), file.sha);
+      await api.lanes.gitAction(laneId, "resolve", { path, side: "done" });
+    });
+  const takeAll = (side: "ours" | "theirs") =>
+    run(() => api.lanes.gitAction(laneId, "resolve", { path, side }));
+
+  const choose = (i: number, c: ConflictChoice | undefined) =>
+    setChoices((prev) => {
+      const next = [...prev];
+      next[i] = c;
+      return next;
+    });
+
+  const jump = (step: number) => {
+    if (!total) return;
+    const i = (at + step + total) % total;
+    setAt(i);
+    blockRefs.current[i]?.scrollIntoView({ block: "center" });
+  };
+
+  let blockIndex = -1;
+  return (
+    <div data-testid="lane-conflict-view" className="flex min-h-0 flex-1 flex-col gap-1.5">
+      <div className="flex flex-wrap items-center gap-1.5">
+        <span className="min-w-0 flex-1 truncate font-mono text-[11px] text-fg-primary">
+          {path}
+        </span>
+        {total > 0 && (
+          <span className="text-[11px] text-status-warning">
+            {t("conflict.left", { left: total - chosen, total })}
+          </span>
+        )}
+        <button
+          type="button"
+          className={BTN}
+          aria-label={t("conflict.prev")}
+          disabled={!total}
+          onClick={() => jump(-1)}
+        >
+          <ChevronUp className="h-3 w-3" />
+        </button>
+        <button
+          type="button"
+          className={BTN}
+          aria-label={t("conflict.next")}
+          disabled={!total}
+          onClick={() => jump(1)}
+        >
+          <ChevronDown className="h-3 w-3" />
+        </button>
+        <button type="button" className={BTN} disabled={busy} onClick={() => void takeAll("ours")}>
+          {t("conflict.allOurs")}
+        </button>
+        <button
+          type="button"
+          className={BTN}
+          disabled={busy}
+          onClick={() => void takeAll("theirs")}
+        >
+          {t("conflict.allTheirs")}
+        </button>
+        <button type="button" className={BTN} disabled={busy} onClick={onEdit}>
+          {t("conflict.editByHand")}
+        </button>
+      </div>
+
+      {error && (
+        <p role="alert" className="whitespace-pre-wrap text-[11px] text-status-danger">
+          {error}
+        </p>
+      )}
+
+      {!file ? (
+        <p className="text-[11px] text-fg-muted">{t("changes.loading")}</p>
+      ) : !parts ? (
+        <p className="text-[11px] text-status-warning">
+          {file.usable ? t("conflict.unbalanced") : t("conflict.unusable")}
+        </p>
+      ) : (
+        <div className="min-h-0 flex-1 overflow-auto rounded border border-border-light bg-surface-0">
+          {parts.map((p, n) => {
+            if (p.kind === "text")
+              return <Lines key={n} lines={p.lines} className="text-fg-primary" />;
+            const i = ++blockIndex;
+            const c = choices[i];
+            return (
+              <div
+                key={n}
+                ref={(el) => {
+                  blockRefs.current[i] = el;
+                }}
+                data-testid="conflict-block"
+                className="my-1 border-y-2 border-status-warning/70"
+              >
+                <div className="flex flex-wrap items-center gap-1 bg-surface-2 px-2 py-0.5 text-[11px]">
+                  {c ? (
+                    <>
+                      <span className="text-fg-muted">{t(`conflict.chose.${c}`)}</span>
+                      <button type="button" className={BTN} onClick={() => choose(i, undefined)}>
+                        {t("conflict.undo")}
+                      </button>
+                    </>
+                  ) : (
+                    <>
+                      <button
+                        type="button"
+                        className={`${BASE} border-status-success/70 font-medium text-status-success`}
+                        onClick={() => choose(i, "ours")}
+                      >
+                        {t("conflict.keepOurs")}
+                      </button>
+                      <button
+                        type="button"
+                        className={`${BASE} border-accent/70 font-medium text-accent`}
+                        onClick={() => choose(i, "theirs")}
+                      >
+                        {t("conflict.takeTheirs")}
+                      </button>
+                      <button type="button" className={BTN} onClick={() => choose(i, "both")}>
+                        {t("conflict.keepBoth")}
+                      </button>
+                    </>
+                  )}
+                  <span className="ml-auto text-fg-muted">
+                    {i + 1}/{total}
+                  </span>
+                </div>
+                {c ? (
+                  <Lines
+                    lines={
+                      c === "ours" ? p.ours : c === "theirs" ? p.theirs : [...p.ours, ...p.theirs]
+                    }
+                    className="bg-surface-2 text-fg-primary"
+                  />
+                ) : (
+                  <>
+                    <div className="border-l-4 border-status-success bg-status-success/20">
+                      <div className="bg-status-success/30 px-2 py-0.5 text-[11px] font-semibold text-status-success">
+                        {t("conflict.ours", { label: p.oursLabel || "HEAD" })}
+                      </div>
+                      <Lines lines={p.ours} className="text-fg-primary" />
+                    </div>
+                    <div className="border-l-4 border-accent bg-accent/20">
+                      <div className="bg-accent/30 px-2 py-0.5 text-[11px] font-semibold text-accent">
+                        {t("conflict.theirs", { label: p.theirsLabel || "?" })}
+                      </div>
+                      <Lines lines={p.theirs} className="text-fg-primary" />
+                    </div>
+                  </>
+                )}
+              </div>
+            );
+          })}
+        </div>
+      )}
+
+      {parts && total > 0 && (
+        <div className="flex items-center justify-end gap-1.5">
+          <button
+            type="button"
+            className={BTN}
+            disabled={busy || !chosen}
+            onClick={() => setChoices([])}
+          >
+            {t("conflict.reset")}
+          </button>
+          <button
+            type="button"
+            disabled={busy || !done}
+            onClick={() => void save()}
+            className="rounded border border-accent/40 bg-accent/15 px-2 py-0.5 text-[11px] text-accent hover:bg-accent/25 disabled:cursor-not-allowed disabled:opacity-40"
+          >
+            {t("conflict.save")}
+          </button>
+        </div>
+      )}
+    </div>
+  );
+}

client/src/components/lanes/LaneDiffView.tsx

@@ -13,11 +13,25 @@
  *   - Line pairing for split view happens here, on the rows the server already
  *     numbered. The server stays the single source of what changed; this file
  *     only decides how it looks.
+ * Past `WINDOW_THRESHOLD` rows a view renders only the rows on screen (plus an
+ * overscan) between two spacers. Rows never wrap — the box scrolls sideways —
+ * so every windowed row is pinned to `ROW_PX` and the range is pure arithmetic
+ * (`visibleRange`); the content's min-width comes from the longest line, so
+ * the horizontal extent does not jump as rows come and go.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-import { useCallback, useRef } from "react";
+import {
+  createContext,
+  useContext,
+  useMemo,
+  useRef,
+  useState,
+  type CSSProperties,
+  type ReactNode,
+} from "react";
 import { useTranslation } from "react-i18next";
+import { ChevronDown, ChevronUp } from "lucide-react";
 import { canonicalLang, highlight, tokenClass } from "../../lib/highlight";
 import type { LaneChangeFile, LaneDiffHunk, LaneDiffLine } from "../../lib/types";
 
@@ -25,11 +39,125 @@ export type DiffLayout = "unified" | "split";
 
 /**
  * How tall a diff box may be. `fill` (the single-file view) takes the height
- * its parent gives it; otherwise — the review list, which stacks many files —
- * each file is capped so its own horizontal scrollbar stays on screen.
+ * its parent gives it. In the review list, which stacks many files, a diff
+ * grows to its full height so the PANEL is the one vertical scroller — a
+ * 60vh box per file nested inside it made hunk navigation scroll two boxes
+ * at once and land nowhere predictable. Only a windowed diff (above
+ * WINDOW_THRESHOLD rows) keeps the cap, because windowing needs its own
+ * scroller.
  */
-function boxHeight(fill: boolean) {
-  return fill ? "min-h-0 flex-1" : "max-h-[60vh]";
+function boxHeight(fill: boolean, windowed: boolean) {
+  return fill ? "min-h-0 flex-1" : windowed ? "max-h-[60vh]" : "";
+}
+
+/**
+ * Bring `el` to the top of the scroller that actually scrolls it, below
+ * `pad` px of sticky header. Not `scrollIntoView`: that moves EVERY scrolling
+ * ancestor, the page included.
+ */
+function scrollToTop(el: HTMLElement, pad: number) {
+  let s = el.parentElement;
+  while (
+    s &&
+    !(s.scrollHeight > s.clientHeight && /auto|scroll/.test(getComputedStyle(s).overflowY))
+  )
+    s = s.parentElement;
+  if (!s) return;
+  s.scrollTop += el.getBoundingClientRect().top - s.getBoundingClientRect().top - pad;
+}
+
+/** Rows above which a view windows; at or below it renders exactly as before. */
+export const WINDOW_THRESHOLD = 500;
+/** A windowed row's pinned height — the rows' own 11px × 1.45 line box, rounded. */
+export const ROW_PX = 16;
+const OVERSCAN = 20;
+const FIXED: CSSProperties = { height: ROW_PX };
+
+/**
+ * The `[start, end)` item range to render for a scroll position. `scrollTop`
+ * is clamped to the content first, so a stale offset (content that shrank, a
+ * layout switch) still lands on real rows instead of an empty window.
+ */
+export function visibleRange(
+  scrollTop: number,
+  viewport: number,
+  rowHeight: number,
+  count: number,
+  overscan: number
+) {
+  const top = Math.min(Math.max(0, scrollTop), Math.max(0, count * rowHeight - viewport));
+  const start = Math.max(0, Math.floor(top / rowHeight) - overscan);
+  const end = Math.min(count, Math.ceil((top + viewport) / rowHeight) + overscan);
+  return { start: Math.min(start, end), end };
+}
+
+/**
+ * Windowing state for one scroller of `count` items. Off (the whole range)
+ * at or below the threshold.
+ */
+function useWindow(count: number) {
+  const [top, setTop] = useState(0);
+  const on = count > WINDOW_THRESHOLD;
+  // The offset is tracked even while windowing is off, so a diff that GROWS
+  // past the threshold (expanded context) windows where the reader is, not at
+  // row 0. A ref, so an unwindowed diff does not re-render on every scroll.
+  const lastTop = useRef(0);
+  // count 0 = no scroller here (split layout): the browser drops its offset,
+  // so coming back to unified must start from 0, not the pre-split row.
+  if (count === 0) lastTop.current = 0;
+  const [wasOn, setWasOn] = useState(on);
+  if (wasOn !== on) {
+    setWasOn(on);
+    setTop(on ? lastTop.current : 0);
+  }
+  // ponytail: the viewport is taken as the window height — never smaller than
+  // a box that lives inside the window, so it only over-renders a few dozen
+  // rows, and it needs no ResizeObserver to follow a panel resize.
+  const range = on
+    ? visibleRange(top, window.innerHeight, ROW_PX, count, OVERSCAN)
+    : { start: 0, end: count };
+  const onScroll = (el: HTMLElement) => {
+    lastTop.current = el.scrollTop;
+    if (on) setTop(el.scrollTop);
+  };
+  return { on, range, onScroll };
+}
+
+/** Columns a line occupies under `whitespace-pre` (a tab counted at its widest). */
+function longest(texts: Iterable<string>) {
+  let max = 0;
+  for (const t of texts) {
+    let n = t.length;
+    for (let i = t.indexOf("\t"); i !== -1; i = t.indexOf("\t", i + 1)) n += 7;
+    if (n > max) max = n;
+  }
+  return max;
+}
+
+/** Stands in for `rows` off-screen rows. */
+function Spacer({ rows }: { rows: number }) {
+  return rows > 0 ? <div data-diff-spacer aria-hidden style={{ height: rows * ROW_PX }} /> : null;
+}
+
+/** A windowed list: spacer, the rendered slice, spacer, at a stable width. */
+function Windowed({
+  count,
+  range,
+  minWidth,
+  children,
+}: {
+  count: number;
+  range: { start: number; end: number };
+  minWidth: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <div data-diff-content style={{ minWidth }}>
+      <Spacer rows={range.start} />
+      {children}
+      <Spacer rows={count - range.end} />
+    </div>
+  );
 }
 
 /** Language tag for a path, for the tokenizer. Unknown ones render plain. */
@@ -86,26 +214,51 @@ function emphasis(
   };
 }
 
-/** Pair each run of removed lines with the run of added lines following it. */
-function pairs(
-  lines: LaneDiffLine[]
-): Array<{ left: LaneDiffLine | null; right: LaneDiffLine | null }> {
-  const out: Array<{ left: LaneDiffLine | null; right: LaneDiffLine | null }> = [];
+type PairRow = { left: LaneDiffLine | null; right: LaneDiffLine | null; emph: EmphPair | null };
+type EmphPair = { del: [number, number]; add: [number, number] };
+/** A hunk's split-view rows plus each paired line's emphasis, keyed by its
+ *  index in `hunk.lines` (what the unified view renders by). */
+type Analysed = { rows: PairRow[]; emph: Map<number, [number, number]> };
+
+// Keyed by the hunk object: a hunk is immutable once fetched, so both split
+// columns and every re-render of the same data share one pass. A refetch
+// brings new objects and the old entries go with them.
+const analysed = new WeakMap<LaneDiffHunk, Analysed>();
+
+/** Pair each run of removed lines with the run of added lines following it,
+ *  carrying indices so emphasis lands without searching the hunk again. */
+export function analyseHunk(hunk: LaneDiffHunk): Analysed {
+  const hit = analysed.get(hunk);
+  if (hit) return hit;
+  const lines = hunk.lines;
+  const rows: PairRow[] = [];
+  const emph = new Map<number, [number, number]>();
   for (let i = 0; i < lines.length; ) {
     const line = lines[i]!;
     if (line.type === "ctx") {
-      out.push({ left: line, right: line });
+      rows.push({ left: line, right: line, emph: null });
       i += 1;
       continue;
     }
-    const dels: LaneDiffLine[] = [];
-    const adds: LaneDiffLine[] = [];
-    while (i < lines.length && lines[i]!.type === "del") dels.push(lines[i++]!);
-    while (i < lines.length && lines[i]!.type === "add") adds.push(lines[i++]!);
-    for (let k = 0; k < Math.max(dels.length, adds.length); k += 1) {
-      out.push({ left: dels[k] ?? null, right: adds[k] ?? null });
+    const delStart = i;
+    while (i < lines.length && lines[i]!.type === "del") i += 1;
+    const addStart = i;
+    while (i < lines.length && lines[i]!.type === "add") i += 1;
+    const dels = addStart - delStart;
+    const adds = i - addStart;
+    for (let k = 0; k < Math.max(dels, adds); k += 1) {
+      const left = k < dels ? lines[delStart + k]! : null;
+      const right = k < adds ? lines[addStart + k]! : null;
+      const e = left && right ? emphasis(left.text, right.text) : null;
+      if (e) {
+        emph.set(delStart + k, e.del);
+        emph.set(addStart + k, e.add);
+      }
+      rows.push({ left, right, emph: e });
     }
   }
+  const out = { rows, emph };
+  analysed.set(hunk, out);
   return out;
 }
 
@@ -115,9 +268,30 @@ function Gutter({ n }: { n: number | null }) {
   );
 }
 
-/** A diff row. `w-max min-w-full` so the tint still spans a scrolled-open row. */
-function Row({ tint, children }: { tint: string; children: React.ReactNode }) {
-  return <div className={`flex w-max min-w-full ${tint}`}>{children}</div>;
+/** A diff row. `w-max min-w-full` so the tint still spans a scrolled-open row.
+ *  `style` pins a windowed row's height; unwindowed rows carry none. */
+function Row({
+  tint,
+  style,
+  anchor,
+  children,
+}: {
+  tint: string;
+  style?: CSSProperties;
+  /** This row starts change block `anchor` (file-wide): the bar's arrows land here. */
+  anchor?: number;
+  children: React.ReactNode;
+}) {
+  return (
+    <div
+      className={`flex w-max min-w-full ${tint}`}
+      style={style}
+      data-diff-item={style ? "" : undefined}
+      data-change-index={anchor}
+    >
+      {children}
+    </div>
+  );
 }
 
 /** A /20 fill plus a 3px status bar at the row's left edge, so +/- rows still
@@ -135,44 +309,246 @@ function markerClass(type: LaneDiffLine["type"]) {
   return "text-fg-muted";
 }
 
-function HunkHeader({ hunk }: { hunk: LaneDiffHunk }) {
-  const at = hunk.header.split("@@")[1];
+/** One change block: a run of consecutive +/- lines inside a hunk. git merges
+ *  edits a few lines apart into one `@@` hunk, so the review bar acts on these
+ *  instead (#50) — `block` is the index the server's `stage-hunk` /
+ *  `discard-hunk` take beside the hunk's header. */
+export type LaneDiffChange = {
+  hunk: LaneDiffHunk;
+  block: number;
+  /** First/last index in `hunk.lines` (unified). */
+  firstLine: number;
+  lastLine: number;
+  /** First/last split-view row. */
+  firstRow: number;
+  lastRow: number;
+};
+
+const blocksOf = new WeakMap<LaneDiffHunk, LaneDiffChange[]>();
+
+/** A hunk's change blocks, cached per hunk object like `analyseHunk`. */
+export function changeBlocks(hunk: LaneDiffHunk): LaneDiffChange[] {
+  const hit = blocksOf.get(hunk);
+  if (hit) return hit;
+  const out: LaneDiffChange[] = [];
+  const owner = new Map<LaneDiffLine, LaneDiffChange>();
+  hunk.lines.forEach((line, i) => {
+    if (line.type === "ctx") return;
+    let c = i > 0 && hunk.lines[i - 1]!.type !== "ctx" ? out[out.length - 1] : undefined;
+    if (!c) {
+      c = { hunk, block: out.length, firstLine: i, lastLine: i, firstRow: -1, lastRow: -1 };
+      out.push(c);
+    }
+    c.lastLine = i;
+    owner.set(line, c);
+  });
+  analyseHunk(hunk).rows.forEach((r, i) => {
+    const c = (r.left && owner.get(r.left)) || (r.right && owner.get(r.right));
+    if (!c) return;
+    if (c.firstRow < 0) c.firstRow = i;
+    c.lastRow = i;
+  });
+  blocksOf.set(hunk, out);
+  return out;
+}
+
+/** The block whose last line (unified) / last row (split) is `i`, if any. */
+const barAtLine = (hunk: LaneDiffHunk, i: number) =>
+  changeBlocks(hunk).find((c) => c.lastLine === i);
+const barAtRow = (hunk: LaneDiffHunk, i: number) => changeBlocks(hunk).find((c) => c.lastRow === i);
+const startAtLine = (hunk: LaneDiffHunk, i: number) =>
+  changeBlocks(hunk).find((c) => c.firstLine === i);
+const startAtRow = (hunk: LaneDiffHunk, i: number) =>
+  changeBlocks(hunk).find((c) => c.firstRow === i);
+
+/** Per-block review controls (Undo / Keep), drawn in a bar under each change
+ *  block's last line. A context rather than a prop because lines render from
+ *  four places; `changes` is what the bar's "n of N" and its arrows walk. */
+const HunkActions = createContext<{
+  actions: (change: LaneDiffChange) => ReactNode;
+  changes: LaneDiffChange[];
+  go: (index: number) => void;
+} | null>(null);
+
+/** File-wide index of `change`, for a row's `anchor`. */
+function useAnchor(change?: LaneDiffChange) {
+  const ctx = useContext(HunkActions);
+  return change && ctx ? ctx.changes.indexOf(change) : undefined;
+}
+
+/** The review bar: hangs just BELOW a change block's last line, pinned to the
+ *  visible right edge, so it sits on the change it acts on — the editor-style
+ *  "^ v 2 of 3 · Undo · Keep" instead of glyphs at the end of the `@@` line. */
+function HunkBar({ change }: { change: LaneDiffChange }) {
+  const { t } = useTranslation(["lanes"]);
+  const ctx = useContext(HunkActions);
+  if (!ctx) return null;
+  const index = ctx.changes.indexOf(change);
+  const total = ctx.changes.length;
+  const nav =
+    "rounded px-0.5 text-fg-muted hover:bg-surface-3 hover:text-fg-primary disabled:opacity-30";
   return (
-    <div className="bg-surface-2 px-2 py-0.5 text-[10px] text-fg-muted">
-      {at ? `@@${at}@@` : hunk.header}
-      {hunk.context ? ` ${hunk.context}` : ""}
+    <span className="sticky right-2 z-10 ml-auto h-0 w-0 self-start">
+      <span
+        data-testid="lane-hunk-bar"
+        className="absolute right-0 top-[18px] flex items-center gap-1 whitespace-nowrap rounded border border-border-light bg-surface-1 px-1 py-0.5 font-sans text-[10px] leading-[14px] text-fg-secondary shadow-card"
+      >
+        <button
+          type="button"
+          aria-label={t("changes.prevHunk")}
+          title={t("changes.prevHunk")}
+          disabled={index <= 0}
+          onClick={() => ctx.go(index - 1)}
+          className={nav}
+        >
+          <ChevronUp className="h-3 w-3" />
+        </button>
+        <button
+          type="button"
+          aria-label={t("changes.nextHunk")}
+          title={t("changes.nextHunk")}
+          disabled={index >= total - 1}
+          onClick={() => ctx.go(index + 1)}
+          className={nav}
+        >
+          <ChevronDown className="h-3 w-3" />
+        </button>
+        <span className="px-0.5 tabular-nums text-fg-muted">
+          {t("changes.hunkOf", { n: index + 1, total })}
+        </span>
+        {ctx.actions(change)}
+      </span>
+    </span>
+  );
+}
+
+function HunkHeader({ hunk, fixed }: { hunk: LaneDiffHunk; fixed?: boolean }) {
+  const at = hunk.header.split("@@")[1];
+  // Windowed, the header is one ROW_PX row like the lines around it.
+  return (
+    <div
+      className={`flex items-center gap-2 bg-surface-2 px-2 text-[10px] text-fg-muted ${
+        fixed ? "overflow-hidden whitespace-nowrap leading-4" : "py-0.5"
+      }`}
+      style={fixed ? FIXED : undefined}
+      data-diff-item={fixed ? "" : undefined}
+    >
+      <span className="min-w-0 flex-1 truncate">
+        {at ? `@@${at}@@` : hunk.header}
+        {hunk.context ? ` ${hunk.context}` : ""}
+      </span>
     </div>
   );
 }
 
+function UnifiedLine({
+  line,
+  lang,
+  emph,
+  style,
+  bar,
+  start,
+}: {
+  line: LaneDiffLine;
+  lang: string;
+  emph?: [number, number];
+  style?: CSSProperties;
+  /** This is a change block's last line: hang its review bar under it. */
+  bar?: LaneDiffChange;
+  /** This is a change block's first line: the bar's arrows scroll here. */
+  start?: LaneDiffChange;
+}) {
+  const anchor = useAnchor(start);
+  return (
+    <Row tint={rowTint(line.type)} style={style} anchor={anchor}>
+      <Gutter n={line.oldLine} />
+      <Gutter n={line.newLine} />
+      <span className="whitespace-pre px-2">
+        <span className={`select-none ${markerClass(line.type)}`}>
+          {line.type === "add" ? "+" : line.type === "del" ? "-" : " "}
+        </span>
+        <Code text={line.text} lang={lang} emph={emph} />
+      </span>
+      {bar && <HunkBar change={bar} />}
+    </Row>
+  );
+}
+
 function UnifiedHunk({ hunk, lang }: { hunk: LaneDiffHunk; lang: string }) {
-  const emph = new Map<number, [number, number]>();
-  for (const { left, right } of pairs(hunk.lines)) {
-    if (!left || !right || left.type !== "del" || right.type !== "add") continue;
-    const e = emphasis(left.text, right.text);
-    if (!e) continue;
-    emph.set(hunk.lines.indexOf(left), e.del);
-    emph.set(hunk.lines.indexOf(right), e.add);
-  }
+  const { emph } = analyseHunk(hunk);
   return (
     <div>
       <HunkHeader hunk={hunk} />
       {hunk.lines.map((line, i) => (
-        <Row key={i} tint={rowTint(line.type)}>
-          <Gutter n={line.oldLine} />
-          <Gutter n={line.newLine} />
-          <span className="whitespace-pre px-2">
-            <span className={`select-none ${markerClass(line.type)}`}>
-              {line.type === "add" ? "+" : line.type === "del" ? "-" : " "}
-            </span>
-            <Code text={line.text} lang={lang} emph={emph.get(i)} />
-          </span>
-        </Row>
+        <UnifiedLine
+          key={i}
+          line={line}
+          lang={lang}
+          emph={emph.get(i)}
+          bar={barAtLine(hunk, i)}
+          start={startAtLine(hunk, i)}
+        />
       ))}
     </div>
   );
 }
 
+/** One windowable item: a hunk's header (`i < 0`) or its i-th row — a line in
+ *  unified, a paired row in split. */
+type Item = { hunk: LaneDiffHunk; i: number };
+
+function flatten(hunks: LaneDiffHunk[], layout: DiffLayout): Item[] {
+  const out: Item[] = [];
+  for (const hunk of hunks) {
+    out.push({ hunk, i: -1 });
+    const n = layout === "split" ? analyseHunk(hunk).rows.length : hunk.lines.length;
+    for (let i = 0; i < n; i += 1) out.push({ hunk, i });
+  }
+  return out;
+}
+
+function longestInHunks(hunks: LaneDiffHunk[]) {
+  return longest(
+    (function* () {
+      for (const h of hunks) for (const l of h.lines) yield l.text;
+    })()
+  );
+}
+
+function SplitLine({
+  row,
+  lang,
+  side,
+  style,
+  bar,
+  start,
+}: {
+  row: PairRow;
+  lang: string;
+  side: "left" | "right";
+  style?: CSSProperties;
+  bar?: LaneDiffChange;
+  start?: LaneDiffChange;
+}) {
+  const line = side === "left" ? row.left : row.right;
+  const anchor = useAnchor(start);
+  return (
+    <Row tint={rowTint(line?.type ?? null)} style={style} anchor={anchor}>
+      <Gutter n={(side === "left" ? line?.oldLine : line?.newLine) ?? null} />
+      <span className="whitespace-pre px-1">
+        {line ? (
+          <Code
+            text={line.text}
+            lang={lang}
+            emph={side === "left" ? row.emph?.del : row.emph?.add}
+          />
+        ) : null}
+      </span>
+      {bar && <HunkBar change={bar} />}
+    </Row>
+  );
+}
+
 /** One side of the split view: a hunk header, then that side's rows. */
 function SplitColumn({
   hunks,
@@ -188,52 +564,123 @@ function SplitColumn({
       {hunks.map((hunk, h) => (
         <div key={`${hunk.header}:${h}`}>
           <HunkHeader hunk={hunk} />
-          {pairs(hunk.lines).map(({ left, right }, i) => {
-            const e =
-              left && right && left.type === "del" && right.type === "add"
-                ? emphasis(left.text, right.text)
-                : null;
-            const line = side === "left" ? left : right;
-            return (
-              <Row key={i} tint={rowTint(line?.type ?? null)}>
-                <Gutter n={(side === "left" ? line?.oldLine : line?.newLine) ?? null} />
-                <span className="whitespace-pre px-1">
-                  {line ? (
-                    <Code text={line.text} lang={lang} emph={side === "left" ? e?.del : e?.add} />
-                  ) : null}
-                </span>
-              </Row>
-            );
-          })}
+          {analyseHunk(hunk).rows.map((row, i) => (
+            <SplitLine
+              key={i}
+              row={row}
+              lang={lang}
+              side={side}
+              // One bar per change block: on the right (new) column only.
+              bar={side === "right" ? barAtRow(hunk, i) : undefined}
+              start={startAtRow(hunk, i)}
+            />
+          ))}
         </div>
       ))}
     </>
   );
 }
 
-/** Both sides, each scrolling horizontally on its own but kept in step. */
+/** A windowed split column: the shared range of items, one side of each. */
+function SplitSlice({
+  items,
+  range,
+  lang,
+  side,
+}: {
+  items: Item[];
+  range: { start: number; end: number };
+  lang: string;
+  side: "left" | "right";
+}) {
+  return (
+    <>
+      {items
+        .slice(range.start, range.end)
+        .map(({ hunk, i }, k) =>
+          i < 0 ? (
+            <HunkHeader key={range.start + k} hunk={hunk} fixed />
+          ) : (
+            <SplitLine
+              key={range.start + k}
+              row={analyseHunk(hunk).rows[i]!}
+              lang={lang}
+              side={side}
+              style={FIXED}
+              bar={side === "right" ? barAtRow(hunk, i) : undefined}
+              start={startAtRow(hunk, i)}
+            />
+          )
+        )}
+    </>
+  );
+}
+
+/** `v` held inside a scroller's own extent. */
+export function clampScroll(v: number, scrollSize: number, clientSize: number) {
+  return Math.min(v, Math.max(0, scrollSize - clientSize));
+}
+
+type Axis =
+  | ["scrollLeft", "scrollWidth", "clientWidth"]
+  | ["scrollTop", "scrollHeight", "clientHeight"];
+const AXES: Axis[] = [
+  ["scrollLeft", "scrollWidth", "clientWidth"],
+  ["scrollTop", "scrollHeight", "clientHeight"],
+];
+
+/** Mirror `src`'s offset onto `dst`, clamped to what `dst` can show. */
+function follow(src: HTMLElement, dst: HTMLElement) {
+  for (const [pos, size, client] of AXES) {
+    // `src` pinned at its own end while `dst` sits past it: `src` is the
+    // narrower column echoing a clamp we just caused. Pulling `dst` back to
+    // it would snap the wide column home every time it scrolls past the
+    // narrow one's longest line.
+    if (src[pos] >= clampScroll(Infinity, src[size], src[client]) && dst[pos] > src[pos]) continue;
+    const target = clampScroll(src[pos], dst[size], dst[client]);
+    if (dst[pos] !== target) dst[pos] = target;
+  }
+}
+
+/** Both sides, each its own scroller but kept in step on both axes. */
 function SplitView({ hunks, lang, fill }: { hunks: LaneDiffHunk[]; lang: string; fill: boolean }) {
   const left = useRef<HTMLDivElement>(null);
   const right = useRef<HTMLDivElement>(null);
+  const items = useMemo(() => flatten(hunks, "split"), [hunks]);
+  const minWidth = useMemo(() => `calc(${longestInHunks(hunks)}ch + 3rem)`, [hunks]);
+  const win = useWindow(items.length);
 
   // Mirroring fires the other pane's own scroll handler, which mirrors back —
-  // the equality check is what ends that, so no re-entry flag is needed.
-  const sync = useCallback((from: "left" | "right") => {
+  // the equality check (and `follow`'s edge rule) is what ends that, so no
+  // re-entry flag is needed. Both axes: the columns hold paired rows, so a
+  // vertical drift puts a deletion beside some unrelated line. Both columns
+  // window off the same offset, so they always hold the same row range.
+  const sync = (from: "left" | "right") => {
     const src = from === "left" ? left.current : right.current;
     const dst = from === "left" ? right.current : left.current;
-    if (!src || !dst || dst.scrollLeft === src.scrollLeft) return;
-    dst.scrollLeft = src.scrollLeft;
-  }, []);
+    if (!src || !dst) return;
+    follow(src, dst);
+    win.onScroll(src);
+  };
+
+  const column = (side: "left" | "right") =>
+    win.on ? (
+      <Windowed count={items.length} range={win.range} minWidth={minWidth}>
+        <SplitSlice items={items} range={win.range} lang={lang} side={side} />
+      </Windowed>
+    ) : (
+      <SplitColumn hunks={hunks} lang={lang} side={side} />
+    );
 
   return (
-    <div className={`flex ${boxHeight(fill)}`}>
+    <div className={`flex ${boxHeight(fill, win.on)}`}>
       <div
         ref={left}
         data-testid="lane-diff-split-left"
         onScroll={() => sync("left")}
         className="w-1/2 min-w-0 overflow-auto"
       >
-        <SplitColumn hunks={hunks} lang={lang} side="left" />
+        {column("left")}
       </div>
       <div
         ref={right}
@@ -241,7 +688,7 @@ function SplitView({ hunks, lang, fill }: { hunks: LaneDiffHunk[]; lang: string;
         onScroll={() => sync("right")}
         className="w-1/2 min-w-0 overflow-auto border-l border-border-light"
       >
-        <SplitColumn hunks={hunks} lang={lang} side="right" />
+        {column("right")}
       </div>
     </div>
   );
@@ -252,14 +699,55 @@ export function LaneDiffView({
   file,
   layout,
   fill = false,
+  hunkActions,
 }: {
   file: LaneChangeFile;
   layout: DiffLayout;
   /** Take the parent's height (single-file view) instead of the 60vh cap. */
   fill?: boolean;
+  /** Controls drawn in each change block's review bar. */
+  hunkActions?: (change: LaneDiffChange) => ReactNode;
 }) {
+  const root = useRef<HTMLDivElement>(null);
   const { t } = useTranslation(["lanes"]);
   const lang = langFor(file.path);
+  const hunks = file.hunks;
+  const items = useMemo(() => (hunks ? flatten(hunks, "unified") : []), [hunks]);
+  const minWidth = useMemo(
+    // two gutters + the row's px-2, plus the marker column
+    () => `calc(${hunks ? longestInHunks(hunks) + 1 : 0}ch + 6rem)`,
+    [hunks]
+  );
+  // Unified only; split windows inside its own two scrollers.
+  const win = useWindow(layout === "unified" ? items.length : 0);
+  const splitWindowed = useMemo(
+    () => layout === "split" && !!hunks && flatten(hunks, "split").length > WINDOW_THRESHOLD,
+    [layout, hunks]
+  );
+
+  const changes = useMemo(() => (hunks ? hunks.flatMap(changeBlocks) : []), [hunks]);
+  // The bar's arrows: bring change block `index`'s first line into view. A
+  // windowed unified diff may not have it in the DOM, so there it is found by
+  // offset.
+  const go = (index: number) => {
+    const el = root.current;
+    const target = changes[index];
+    if (!el || !target) return;
+    const header = el.querySelector<HTMLElement>(`[data-change-index="${index}"]`);
+    // The review list pins each file's header over its own diff.
+    const sticky = el
+      .closest("[data-review-file]")
+      ?.querySelector<HTMLElement>("[data-sticky-top]");
+    const pad = sticky?.offsetHeight ?? 0;
+    if (header) {
+      scrollToTop(header, pad);
+      return;
+    }
+    // Windowed: the header is not in the DOM, but its offset is known.
+    const at = items.findIndex((it) => it.hunk === target.hunk && it.i === target.firstLine);
+    if (at >= 0 && layout === "unified") el.scrollTop = at * ROW_PX;
+  };
+  const review = hunkActions && hunks ? { actions: hunkActions, changes, go } : null;
 
   if (file.binary)
     return <p className="px-2 py-1 text-[10px] text-fg-muted">{t("changes.binary")}</p>;
@@ -267,24 +755,50 @@ export function LaneDiffView({
     return <p className="px-2 py-1 text-[10px] text-fg-muted">{t("changes.noHunks")}</p>;
 
   return (
-    <div
-      data-testid="lane-diff-view"
-      data-layout={layout}
-      className={`flex flex-col font-mono text-[11px] leading-[1.45] ${
-        layout === "split" ? boxHeight(fill) : `overflow-auto ${boxHeight(fill)}`
-      }`}
-    >
-      {layout === "split" ? (
-        <SplitView hunks={file.hunks} lang={lang} fill={fill} />
-      ) : (
-        file.hunks.map((hunk, i) => (
-          <UnifiedHunk key={`${hunk.header}:${i}`} hunk={hunk} lang={lang} />
-        ))
-      )}
-      {file.truncated && (
-        <p className="px-2 py-1 text-[10px] text-status-warning">{t("changes.fileTruncated")}</p>
-      )}
-    </div>
+    <HunkActions.Provider value={review}>
+      <div
+        ref={root}
+        data-testid="lane-diff-view"
+        data-layout={layout}
+        onScroll={(e) => win.onScroll(e.currentTarget)}
+        className={`flex flex-col font-mono text-[11px] leading-[1.45] ${
+          layout === "split"
+            ? boxHeight(fill, splitWindowed)
+            : `overflow-auto ${boxHeight(fill, win.on)}`
+        }`}
+      >
+        {layout === "split" ? (
+          <SplitView hunks={file.hunks} lang={lang} fill={fill} />
+        ) : win.on ? (
+          <Windowed count={items.length} range={win.range} minWidth={minWidth}>
+            {items
+              .slice(win.range.start, win.range.end)
+              .map(({ hunk, i }, k) =>
+                i < 0 ? (
+                  <HunkHeader key={win.range.start + k} hunk={hunk} fixed />
+                ) : (
+                  <UnifiedLine
+                    key={win.range.start + k}
+                    line={hunk.lines[i]!}
+                    lang={lang}
+                    emph={analyseHunk(hunk).emph.get(i)}
+                    style={FIXED}
+                    bar={barAtLine(hunk, i)}
+                    start={startAtLine(hunk, i)}
+                  />
+                )
+              )}
+          </Windowed>
+        ) : (
+          file.hunks.map((hunk, i) => (
+            <UnifiedHunk key={`${hunk.header}:${i}`} hunk={hunk} lang={lang} />
+          ))
+        )}
+        {file.truncated && (
+          <p className="px-2 py-1 text-[10px] text-status-warning">{t("changes.fileTruncated")}</p>
+        )}
+      </div>
+    </HunkActions.Provider>
   );
 }
 
@@ -294,28 +808,68 @@ export function LaneFileView({
   lines,
   truncated,
   fill = false,
+  onEditAt,
 }: {
   path: string;
   lines: string[];
   truncated?: boolean;
   /** Take the parent's height instead of the 60vh cap. */
   fill?: boolean;
+  /** Set when the file is editable: a click on the text (0-based line, and
+   *  where the view was scrolled) asks to open the editor there. */
+  onEditAt?: (line: number, scrollTop: number) => void;
 }) {
   const { t } = useTranslation(["lanes"]);
   const lang = langFor(path);
+  const win = useWindow(lines.length);
+  // gutter + the row's px-2
+  const minWidth = useMemo(() => `calc(${longest(lines)}ch + 3.5rem)`, [lines]);
+  const row = (text: string, i: number, style?: CSSProperties) => (
+    <Row key={i} tint="" style={style}>
+      {/* `contents`: a line marker for the click handler, not a layout box. */}
+      <span data-ln={i} className="contents">
+        <Gutter n={i + 1} />
+        <span className="whitespace-pre px-2">
+          <Code text={text} lang={lang} />
+        </span>
+      </span>
+    </Row>
+  );
   return (
     <div
       data-testid="lane-file-view"
-      className={`overflow-auto font-mono text-[11px] leading-[1.45] ${boxHeight(fill)}`}
+      onScroll={(e) => win.onScroll(e.currentTarget)}
+      tabIndex={onEditAt ? 0 : undefined}
+      onClick={
+        onEditAt &&
+        ((e) => {
+          // A click that ends a drag-selection is copying, not asking to edit.
+          if (window.getSelection()?.toString()) return;
+          const ln = (e.target as HTMLElement).closest("[data-ln]")?.getAttribute("data-ln");
+          onEditAt(Number(ln ?? 0), e.currentTarget.scrollTop);
+        })
+      }
+      onKeyDown={
+        onEditAt &&
+        ((e) => {
+          if (e.key !== "Enter") return;
+          e.preventDefault();
+          onEditAt(0, e.currentTarget.scrollTop);
+        })
+      }
+      className={`overflow-auto font-mono text-[11px] leading-[1.45] ${boxHeight(fill, true)}${
+        onEditAt ? " cursor-text" : ""
+      }`}
     >
-      {lines.map((text, i) => (
-        <Row key={i} tint="">
-          <Gutter n={i + 1} />
-          <span className="whitespace-pre px-2">
-            <Code text={text} lang={lang} />
-          </span>
-        </Row>
-      ))}
+      {win.on ? (
+        <Windowed count={lines.length} range={win.range} minWidth={minWidth}>
+          {lines
+            .slice(win.range.start, win.range.end)
+            .map((text, k) => row(text, win.range.start + k, FIXED))}
+        </Windowed>
+      ) : (
+        lines.map((text, i) => row(text, i))
+      )}
       {truncated && (
         <p className="px-2 py-1 text-[10px] text-status-warning">{t("changes.fileTruncated")}</p>
       )}

client/src/components/lanes/LaneGitBar.tsx

@@ -1,37 +1,55 @@
 /**
  * @file The lane's git action row: ahead/behind against the upstream, and the
  * writes `POST /api/lanes/:id/git/:action` offers that are not per-file —
- * fetch, pull, push, commit (everything, or only what the Changes panel has
- * staged), switch branch, and create/delete a branch. Per-file staging and
- * discard live in the Changes panel, beside the file they act on.
+ * fetch, pull, push, switch branch, create/delete a branch, publish a repo
+ * that has no remote yet (a URL, then `origin` + `push -u`), and start a merge
+ * (the picked branch, or the upstream once diverged; resolving it is the
+ * Changes panel's job). Committing is
+ * NOT here: it is the Changes panel's staged-only commit box, beside the
+ * per-file stage/unstage/discard it commits — one way to commit, and it only
+ * ever takes what the user staged.
  *
- * It renders beside the read-only git line in LaneCard rather than inside the
- * ⋯ menu: that menu holds the rare and dangerous (`reset worktree`), and these
- * are the opposite — the ordinary moves a lane needs several times an hour.
+ * It renders at the top of the Changes panel (`LaneGitHeader`), its actions as
+ * icons on the same row as the branch line, rather than in the lane card's ⋯ menu: that menu holds the rare and dangerous (`reset
+ * worktree`), and these are the ordinary moves a lane needs several times an hour.
  * Nothing here decides what an action may do; the server does (pull is always
  * --ff-only, switch refuses a dirty tree), and this only reports what it said.
  * Failures print git's own text, because "! [rejected] non-fast-forward" tells
- * the user more than any sentence this file could write.
+ * the user more than any sentence this file could write. The one exception
+ * is `EGITAUTH` (issue #45): the dashboard's git has no terminal to prompt
+ * in, so a remote wanting a login opens a form here and the SAME action is
+ * resent with the typed credential — the token is never rendered back.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-import { useState } from "react";
+import { useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
   ArrowDown,
   ArrowUp,
-  Check,
+  CloudUpload,
   GitBranch,
+  GitMerge,
   Plus,
   RefreshCw,
   Trash2,
   Upload,
-  X,
 } from "lucide-react";
-import { api } from "../../lib/api";
+import { api, type GitAuthNeeded } from "../../lib/api";
 import type { LaneGitFacts, LaneWorktree } from "../../lib/types";
 
-type Action = "fetch" | "pull" | "push" | "commit" | "switch" | "branch-create" | "branch-delete";
+type Action =
+  | "fetch"
+  | "pull"
+  | "push"
+  | "switch"
+  | "branch-create"
+  | "branch-delete"
+  | "merge"
+  | "publish";
+type RunBody = Parameters<typeof api.lanes.gitAction>[2];
+
+const LOCAL_HOST = /^(localhost|127\.|\[::1\])/;
 
 function Btn({
   label,
@@ -39,6 +57,7 @@ function Btn({
   busy,
   disabled,
   title,
+  compact,
   onClick,
 }: {
   label: string;
@@ -46,6 +65,8 @@ function Btn({
   busy?: boolean;
   disabled?: boolean;
   title?: string;
+  /** Icon only; the label becomes the accessible name, the hint the tooltip. */
+  compact?: boolean;
   onClick: () => void;
 }) {
   return (
@@ -54,10 +75,13 @@ function Btn({
       onClick={onClick}
       disabled={disabled || busy}
       title={title}
-      className="flex items-center gap-1 rounded border border-border-light px-1.5 py-0.5 text-[11px] text-fg-secondary transition-colors hover:bg-surface-2 hover:text-fg-primary disabled:cursor-not-allowed disabled:opacity-40"
+      aria-label={compact ? label : undefined}
+      className={`flex items-center gap-1 rounded text-[11px] text-fg-secondary transition-colors hover:bg-surface-3 hover:text-fg-primary disabled:cursor-not-allowed disabled:opacity-40 ${
+        compact ? "h-6 w-6 justify-center" : "border border-border-light px-1.5 py-0.5"
+      }`}
     >
       {icon}
-      {label}
+      {!compact && label}
     </button>
   );
 }
@@ -67,9 +91,13 @@ export function LaneGitBar({
   git,
   onChanged,
   onNewLane,
+  lead,
 }: {
   laneId: number;
   git: LaneGitFacts;
+  /** Rendered at the start of the action row: the header's branch line, so
+   *  the facts and the buttons that act on them read as one row. */
+  lead?: React.ReactNode;
   /** Called after any action that could have moved the working copy. */
   onChanged: () => void;
   /** Open the Add-lane flow for a sibling worktree of this repo, optionally on
@@ -79,32 +107,73 @@ export function LaneGitBar({
   const { t } = useTranslation(["lanes"]);
   const [busy, setBusy] = useState<Action | null>(null);
   const [error, setError] = useState<string | null>(null);
-  const [committing, setCommitting] = useState(false);
-  const [message, setMessage] = useState("");
   const [switching, setSwitching] = useState(false);
   const [branches, setBranches] = useState<string[] | null>(null);
   const [worktrees, setWorktrees] = useState<LaneWorktree[]>([]);
   const [picked, setPicked] = useState("");
   const [newBranch, setNewBranch] = useState("");
+  // Set when git needed a login for `action`; the form resends that action.
+  const [login, setLogin] = useState<{ action: Action; auth: GitAuthNeeded } | null>(null);
+  const [username, setUsername] = useState("");
+  const [password, setPassword] = useState("");
+  const [remember, setRemember] = useState(true);
+  const [publishing, setPublishing] = useState(false);
+  const [url, setUrl] = useState("");
+  // The Changes panel is not keyed by lane, so this bar outlives a lane switch.
+  // All of the state above describes ONE lane — a branch picked for lane A,
+  // applied after switching, would move B's HEAD — so it is reset during
+  // render the moment the id changes, before anything can act on it.
+  const [shownLane, setShownLane] = useState(laneId);
+  // One action at a time, checked synchronously: `busy` is state, and a second
+  // Enter can land before the render that disables anything.
+  const inFlight = useRef(false);
+  if (shownLane !== laneId) {
+    setShownLane(laneId);
+    setBusy(null);
+    setError(null);
+    setSwitching(false);
+    setBranches(null);
+    setWorktrees([]);
+    setPicked("");
+    setNewBranch("");
+    setLogin(null);
+    setPassword("");
+    setPublishing(false);
+    setUrl("");
+    inFlight.current = false;
+  }
+  const laneNow = useRef(laneId);
+  laneNow.current = laneId;
 
   if (!git.available) return null;
   const dirty = git.dirty + git.untracked;
+  const merging = !!git.merging;
 
-  const run = async (
-    action: Action,
-    body?: { message?: string; only?: "staged"; branch?: string }
-  ) => {
+  const run = async (action: Action, body?: RunBody) => {
+    if (inFlight.current) return;
+    inFlight.current = true;
+    const lane = laneId;
     setBusy(action);
     setError(null);
     try {
-      await api.lanes.gitAction(laneId, action, body || {});
-      setCommitting(false);
-      setMessage("");
+      const res = await api.lanes.gitAction(lane, action, body || {});
+      // Landed after a lane switch: every write below belongs to the lane
+      // no longer shown.
+      if (laneNow.current !== lane) return;
+      // A merge that stopped on conflicts still succeeded in starting; the
+      // Changes panel below lists the files to resolve.
+      if (res?.conflicts?.length)
+        setError(t("gitBar.mergeConflicts", { count: res.conflicts.length }));
+      setLogin(null);
+      setPassword("");
       // The branch list this bar is showing is stale the moment a branch is
       // created, deleted or switched to, so it is re-read rather than patched.
-      if (action === "switch") setSwitching(false);
-      else if (action.startsWith("branch-")) {
-        setNewBranch("");
+      if (action === "publish") {
+        setPublishing(false);
+        setUrl("");
+      } else if (action === "switch" || action.startsWith("branch-")) {
+        if (action === "switch") setSwitching(false);
+        else setNewBranch("");
         setPicked("");
         setBranches(null);
         await refreshBranches();
@@ -113,19 +182,37 @@ export function LaneGitBar({
     } catch (err) {
       // The server appends git's own stderr to the message, so this is the
       // rejection text verbatim — hence the <pre> below rather than a line.
-      setError(err instanceof Error ? err.message : String(err));
+      // ENOREMOTE is the one refusal with no git text to show: the server's
+      // sentence is English and says less than a translated one.
+      const auth = (err as { code?: string; auth?: GitAuthNeeded })?.auth;
+      if (laneNow.current === lane && (err as { code?: string })?.code === "EGITAUTH" && auth) {
+        setLogin({ action, auth });
+        setUsername((u) => u || auth.username || "");
+        setPassword("");
+      } else if (laneNow.current === lane)
+        setError(
+          (err as { code?: string })?.code === "ENOREMOTE"
+            ? t("gitBar.errNoRemote")
+            : err instanceof Error
+              ? err.message
+              : String(err)
+        );
     } finally {
-      setBusy(null);
+      if (laneNow.current === lane) {
+        inFlight.current = false;
+        setBusy(null);
+      }
     }
   };
 
   const refreshBranches = async () => {
     try {
       const r = await api.lanes.gitBranches(laneId);
+      if (laneNow.current !== laneId) return;
       setBranches(r.branches);
       setWorktrees(r.worktrees || []);
     } catch {
-      setBranches([]);
+      if (laneNow.current === laneId) setBranches([]);
     }
   };
 
@@ -136,20 +223,33 @@ export function LaneGitBar({
     await refreshBranches();
   };
 
+  const merge = (branch: string) => {
+    if (!window.confirm(t("gitBar.mergeConfirm", { branch, current: git.branch }))) return;
+    void run("merge", { branch });
+  };
+
   const heldBy = new Map(
     worktrees.filter((w) => w.branch).map((w) => [w.branch as string, w.path])
   );
 
   return (
-    <div data-testid="lane-git-bar" className="mb-2 space-y-1">
-      <div className="flex flex-wrap items-center gap-1.5">
+    <div data-testid="lane-git-bar" className="space-y-1">
+      <div className="flex min-w-0 items-center gap-2">
+        {lead}
         {/* Ahead/behind first: it is the fact that decides which of the
             buttons beside it the user actually wants. */}
-        {git.upstream ? (
+        {/* Null counts with an upstream named means git could not compare
+            the two (the upstream ref is gone): claiming "in sync" there
+            would be a lie, so it reads as not pushed. */}
+        {git.unborn ? (
+          <span className="shrink-0 font-mono text-[11px] text-fg-muted">
+            {t("gitBar.noCommits")}
+          </span>
+        ) : git.upstream && git.ahead != null && git.behind != null ? (
           <span
             data-testid="lane-git-tracking"
             title={git.upstream}
-            className="flex items-center gap-1 font-mono text-[11px] text-fg-muted"
+            className="flex shrink-0 items-center gap-1 font-mono text-[11px] text-fg-muted"
           >
             {(git.ahead ?? 0) > 0 && (
               <span className="flex items-center text-status-warning">
@@ -167,95 +267,95 @@ export function LaneGitBar({
           </span>
         ) : (
           git.hasRemote && (
-            <span className="font-mono text-[11px] text-fg-muted">{t("gitBar.noUpstream")}</span>
+            <span className="shrink-0 font-mono text-[11px] text-fg-muted">
+              {t("gitBar.noUpstream")}
+            </span>
           )
         )}
 
-        <Btn
-          label={t("gitBar.fetch")}
-          icon={<RefreshCw className="h-3 w-3" />}
-          busy={busy === "fetch"}
-          disabled={!git.hasRemote || !!busy}
-          title={t("gitBar.fetchHint")}
-          onClick={() => run("fetch")}
-        />
-        <Btn
-          label={t("gitBar.pull")}
-          icon={<ArrowDown className="h-3 w-3" />}
-          busy={busy === "pull"}
-          disabled={!git.hasRemote || !!busy}
-          title={t("gitBar.pullHint")}
-          onClick={() => run("pull")}
-        />
-        <Btn
-          label={t("gitBar.push")}
-          icon={<Upload className="h-3 w-3" />}
-          busy={busy === "push"}
-          disabled={!git.hasRemote || !!busy}
-          title={t("gitBar.pushHint")}
-          onClick={() => run("push")}
-        />
-        <Btn
-          label={t("gitBar.commit")}
-          icon={<Check className="h-3 w-3" />}
-          disabled={dirty === 0 || !!busy}
-          title={dirty === 0 ? t("gitBar.commitNothing") : t("gitBar.commitHint")}
-          onClick={() => {
-            setCommitting((v) => !v);
-            setError(null);
-          }}
-        />
-        <Btn
-          label={t("gitBar.switch")}
-          icon={<GitBranch className="h-3 w-3" />}
-          disabled={!!busy}
-          // A dirty tree is refused server-side; saying so before the click
-          // beats a red box after it.
-          title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.switchHint")}
-          onClick={openSwitch}
-        />
-      </div>
+        {/* Diverged: a --ff-only pull can only refuse, so offer the merge. */}
+        {git.upstream && (git.ahead ?? 0) > 0 && (git.behind ?? 0) > 0 && !merging && (
+          <Btn
+            label={t("gitBar.mergeUpstream", { upstream: git.upstream })}
+            icon={<GitMerge className="h-3 w-3" />}
+            busy={busy === "merge"}
+            disabled={!!busy || dirty > 0}
+            title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.mergeUpstreamHint")}
+            onClick={() => merge(git.upstream as string)}
+          />
+        )}
 
-      {committing && (
-        <div className="flex items-center gap-1.5">
-          <input
-            autoFocus
-            value={message}
-            onChange={(e) => setMessage(e.target.value)}
-            onKeyDown={(e) => {
-              if (e.key === "Enter" && message.trim()) void run("commit", { message });
-              if (e.key === "Escape") setCommitting(false);
-            }}
-            placeholder={t("gitBar.commitPlaceholder")}
-            aria-label={t("gitBar.commitPlaceholder")}
-            className="min-w-0 flex-1 rounded border border-border-light bg-surface-0 px-2 py-0.5 text-[11px] text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none"
-          />
-          <Btn
-            label={t("gitBar.commitAll", { count: dirty })}
-            busy={busy === "commit"}
-            disabled={!message.trim()}
-            onClick={() => void run("commit", { message })}
-          />
-          {/* The Changes panel's per-file staging only means something if a
-              commit can take the index as it stands. The server answers
-              ENOCHANGES when nothing is staged, and that text lands below. */}
-          <Btn
-            label={t("gitBar.commitStaged")}
-            title={t("gitBar.commitStagedHint")}
-            busy={busy === "commit"}
-            disabled={!message.trim()}
-            onClick={() => void run("commit", { message, only: "staged" })}
-          />
-          <button
-            type="button"
-            aria-label={t("gitBar.cancel")}
-            onClick={() => setCommitting(false)}
-            className="text-fg-muted hover:text-fg-primary"
-          >
-            <X className="h-3.5 w-3.5" />
-          </button>
-        </div>
-      )}
+        {/* A repo with no commit has nothing to push, fetch into or branch
+            from — the one next step is the commit box below. */}
+        {git.unborn ? (
+          <span className="ml-auto text-[10px] text-fg-muted">{t("gitBar.unbornHint")}</span>
+        ) : (
+          <div className="ml-auto flex shrink-0 items-center">
+            <Btn
+              compact
+              label={t("gitBar.fetch")}
+              icon={<RefreshCw className="h-3.5 w-3.5" />}
+              busy={busy === "fetch"}
+              disabled={!git.hasRemote || !!busy}
+              title={t("gitBar.fetchHint")}
+              onClick={() => run("fetch")}
+            />
+            <Btn
+              compact
+              label={t("gitBar.pull")}
+              icon={<ArrowDown className="h-3.5 w-3.5" />}
+              busy={busy === "pull"}
+              disabled={!git.hasRemote || !!busy || merging}
+              title={merging ? t("gitBar.merging") : t("gitBar.pullHint")}
+              onClick={() => run("pull")}
+            />
+            <Btn
+              compact
+              // Same `push -u <remote> HEAD` either way; a branch with no
+              // upstream is being published, not updated, so it says that.
+              label={git.hasRemote && !git.upstream ? t("gitBar.publishBranch") : t("gitBar.push")}
+              icon={<Upload className="h-3.5 w-3.5" />}
+              busy={busy === "push"}
+              disabled={!git.hasRemote || !!busy}
+              title={
+                git.hasRemote && !git.upstream
+                  ? t("gitBar.publishBranchHint")
+                  : t("gitBar.pushHint")
+              }
+              onClick={() => run("push")}
+            />
+            {!git.hasRemote && (
+              <Btn
+                compact
+                label={t("gitBar.publish")}
+                icon={<CloudUpload className="h-3.5 w-3.5" />}
+                disabled={!!busy}
+                title={t("gitBar.publishHint")}
+                onClick={() => {
+                  setPublishing((v) => !v);
+                  setError(null);
+                }}
+              />
+            )}
+            <Btn
+              compact
+              label={t("gitBar.switch")}
+              icon={<GitBranch className="h-3.5 w-3.5" />}
+              disabled={!!busy || merging}
+              // A dirty tree is refused server-side; saying so before the click
+              // beats a red box after it.
+              title={
+                merging
+                  ? t("gitBar.merging")
+                  : dirty > 0
+                    ? t("gitBar.switchDirty")
+                    : t("gitBar.switchHint")
+              }
+              onClick={openSwitch}
+            />
+          </div>
+        )}
+      </div>
 
       {switching && (
         <div className="flex items-center gap-1.5">
@@ -286,11 +386,27 @@ export function LaneGitBar({
             title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.switchHint")}
             onClick={() => void run("switch", { branch: picked })}
           />
+          <Btn
+            label={t("gitBar.merge")}
+            icon={<GitMerge className="h-3 w-3" />}
+            busy={busy === "merge"}
+            disabled={!picked || picked === git.branch || dirty > 0 || !!busy}
+            title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.mergeHint")}
+            onClick={() => merge(picked)}
+          />
           {onNewLane && (
             <Btn
               label={t("gitBar.newLane")}
-              title={t("gitBar.newLaneHint")}
-              disabled={!picked}
+              // A branch any worktree holds — this lane's own included — is
+              // one `addWorktree` refuses with EBRANCHBUSY; say so up front.
+              title={
+                picked && (heldBy.has(picked) || picked === git.branch)
+                  ? t("gitBar.newLaneHeld", {
+                      path: heldBy.get(picked) ?? t("gitBar.switchCurrent"),
+                    })
+                  : t("gitBar.newLaneHint")
+              }
+              disabled={!picked || heldBy.has(picked) || picked === git.branch}
               // The sibling lane is created through the normal Add-lane flow,
               // prefilled — one provisioning path, not a second one here.
               onClick={() => onNewLane(picked)}
@@ -336,6 +452,102 @@ export function LaneGitBar({
         </div>
       )}
 
+      {publishing && !git.hasRemote && !git.unborn && (
+        <div className="flex items-center gap-1.5">
+          <input
+            value={url}
+            onChange={(e) => setUrl(e.target.value)}
+            onKeyDown={(e) => {
+              if (e.key === "Enter" && url.trim()) void run("publish", { url: url.trim() });
+            }}
+            // The server decides which URLs are acceptable (https without a
+            // token, ssh, user@host:path); this only names the two usual ones.
+            placeholder={t("gitBar.publishUrl")}
+            aria-label={t("gitBar.publishUrl")}
+            className="min-w-0 flex-1 rounded border border-border-light bg-surface-0 px-2 py-0.5 font-mono text-[11px] text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none"
+          />
+          <Btn
+            label={t("gitBar.publishApply")}
+            icon={<Upload className="h-3 w-3" />}
+            busy={busy === "publish"}
+            disabled={!url.trim()}
+            title={t("gitBar.publishHint")}
+            onClick={() => void run("publish", { url: url.trim() })}
+          />
+        </div>
+      )}
+
+      {login && (
+        <form
+          data-testid="lane-git-login"
+          className="space-y-1.5 rounded border border-border-light bg-surface-1 p-2 text-[11px]"
+          onSubmit={(e) => {
+            e.preventDefault();
+            const { protocol, host } = login.auth;
+            void run(login.action, {
+              credentials: { protocol, host, username: username.trim(), password, remember },
+            });
+          }}
+        >
+          <p className="font-medium text-fg-primary">
+            {t("gitBar.loginTitle", { host: login.auth.host })}
+          </p>
+          {login.auth.rejected && (
+            <p role="alert" className="text-status-danger">
+              {t("gitBar.loginRejected")}
+            </p>
+          )}
+          <div className="flex gap-1.5">
+            <input
+              aria-label={t("gitBar.loginUser")}
+              placeholder={t("gitBar.loginUser")}
+              autoComplete="username"
+              value={username}
+              onChange={(e) => setUsername(e.target.value)}
+              className="min-w-0 flex-1 rounded border border-border-light bg-surface-0 px-2 py-0.5 text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none"
+            />
+            <input
+              type="password"
+              aria-label={t("gitBar.loginPassword")}
+              placeholder={t("gitBar.loginPassword")}
+              autoComplete="current-password"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              className="min-w-0 flex-1 rounded border border-border-light bg-surface-0 px-2 py-0.5 text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none"
+            />
+          </div>
+          <label className="flex items-center gap-1.5 text-fg-secondary">
+            <input
+              type="checkbox"
+              checked={remember}
+              onChange={(e) => setRemember(e.target.checked)}
+            />
+            {t("gitBar.loginRemember")}
+          </label>
+          <p className="text-[10px] text-fg-muted">{t("gitBar.loginTokenHint")}</p>
+          {/* The token crosses the network in the clear on a plain-http LAN address. */}
+          {location.protocol === "http:" && !LOCAL_HOST.test(location.hostname) && (
+            <p className="text-[10px] text-status-warning">{t("gitBar.loginInsecure")}</p>
+          )}
+          <div className="flex gap-1.5">
+            <button
+              type="submit"
+              disabled={!username.trim() || !password || !!busy}
+              className="rounded border border-accent/40 bg-accent/15 px-2 py-0.5 text-accent hover:bg-accent/25 disabled:cursor-not-allowed disabled:opacity-40"
+            >
+              {t("gitBar.loginSubmit")}
+            </button>
+            <Btn
+              label={t("gitBar.loginCancel")}
+              onClick={() => {
+                setLogin(null);
+                setPassword("");
+              }}
+            />
+          </div>
+        </form>
+      )}
+
       {error && (
         <pre
           role="alert"

client/src/components/lanes/LaneGitHeader.tsx

@@ -0,0 +1,294 @@
+/**
+ * @file The top of the Changes panel: the lane's working-copy line (branch,
+ * head, subject, and the uncommitted counts that open a per-file hover panel)
+ * and the git action bar under it (`LaneGitBar`).
+ *
+ * It used to sit in the lane card, a column away from the diff it describes —
+ * a pull there changed files the Changes panel only noticed on its next poll.
+ * Here the two share one read of `GET /api/lanes/:id/git` (`useLaneGitFacts`,
+ * owned by the panel) and refresh each other after every write.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useCallback, useEffect, useLayoutEffect, useRef, useState } from "react";
+import { createPortal } from "react-dom";
+import { useTranslation } from "react-i18next";
+import { GitBranch } from "lucide-react";
+import { LaneGitBar } from "./LaneGitBar";
+import { api } from "../../lib/api";
+import { keepIfSame } from "../../lib/keepIfSame";
+import type { LaneGitFacts, LaneGitFile } from "../../lib/types";
+
+/** How often the mounted panel re-reads its working-copy facts. Slow on
+ *  purpose: each call is five git subprocesses server-side, and a branch name
+ *  does not change on the timescale the lane list is polled at. */
+const GIT_REFRESH_MS = 30_000;
+
+/**
+ * The lane's own working copy, fetched by the Changes panel rather than folded
+ * into the polled lane list. Absent facts are not an error state: a lane may point at a
+ * plain directory, and it renders with no git header.
+ */
+export function useLaneGitFacts(laneId: number): [LaneGitFacts | null, () => void] {
+  const [facts, setFacts] = useState<LaneGitFacts | null>(null);
+  // Bumped by the git action bar: a commit or a pull changes every fact on
+  // this row, and waiting out the 30s poll makes the button look inert.
+  const [nonce, setNonce] = useState(0);
+  // A lane switch drops the previous lane's facts during render, so nothing
+  // (the git bar's "current branch" included) shows them until the new read.
+  const [factsLane, setFactsLane] = useState(laneId);
+  if (factsLane !== laneId) {
+    setFactsLane(laneId);
+    setFacts(null);
+  }
+
+  useEffect(() => {
+    let alive = true;
+    const read = () => {
+      api.lanes
+        .git(laneId)
+        .then((f) => {
+          if (alive) setFacts(keepIfSame(f));
+        })
+        .catch(() => {
+          // Silent: a panel that cannot read git shows the rest of itself. An
+          // error banner here would fire on every lane on every server blip.
+          if (alive) setFacts(keepIfSame<LaneGitFacts>({ available: false }));
+        });
+    };
+    read();
+    const timer = setInterval(read, GIT_REFRESH_MS);
+    return () => {
+      alive = false;
+      clearInterval(timer);
+    };
+  }, [laneId, nonce]);
+
+  return [facts, () => setNonce((n) => n + 1)];
+}
+
+/** Porcelain status code -> the letter shown and the colour it is shown in.
+ *  Keyed on the code's first meaningful character, so an index-side change
+ *  (`M `), a worktree-side one (` M`) and both (`MM`) read the same. */
+const GIT_STATUS_STYLE: Record<string, string> = {
+  M: "text-status-warning",
+  A: "text-status-success",
+  D: "text-status-danger",
+  R: "text-accent",
+  C: "text-accent",
+  U: "text-status-danger",
+  "?": "text-fg-muted",
+};
+
+/**
+ * The file list behind a lane's uncommitted counts: which files, what happened
+ * to each, and how many lines it gained and lost.
+ *
+ * It replaced a native `title` tooltip, which could show the same paths but
+ * neither colour them nor align the deltas — and a plain porcelain dump is not
+ * something you read at a glance.
+ *
+ * PORTALLED to `document.body` and `position: fixed`: the Changes panel
+ * scrolls in its own `overflow` box, and an absolutely positioned panel would
+ * be clipped by it. It flips above its anchor rather than off the bottom of
+ * the window, and clamps to the right edge.
+ */
+function LaneGitFilesPanel({
+  files,
+  hidden,
+  anchor,
+  onPointerEnter,
+  onPointerLeave,
+}: {
+  files: LaneGitFile[];
+  hidden: number;
+  /** The counts button this panel hangs off. */
+  anchor: HTMLElement | null;
+  onPointerEnter: () => void;
+  onPointerLeave: () => void;
+}) {
+  const { t } = useTranslation(["lanes"]);
+  const panelRef = useRef<HTMLDivElement>(null);
+  const [pos, setPos] = useState<{ top: number; left: number } | null>(null);
+
+  // After the first paint, when the panel's real height is known: place it
+  // under the anchor, or above it when that would run off the bottom.
+  useLayoutEffect(() => {
+    if (!anchor || !panelRef.current) return;
+    const a = anchor.getBoundingClientRect();
+    const p = panelRef.current.getBoundingClientRect();
+    const gap = 4;
+    const top =
+      a.bottom + gap + p.height > window.innerHeight ? a.top - p.height - gap : a.bottom + gap;
+    setPos({
+      top: Math.max(8, top),
+      left: Math.max(8, Math.min(a.left, document.documentElement.clientWidth - p.width - 8)),
+    });
+  }, [anchor, files]);
+  // Totals are over the LISTED files only — the cap means the rest are unknown,
+  // and a total that silently omits them would be a wrong number rather than a
+  // partial one. `hidden` says how many are missing.
+  const added = files.reduce((n, f) => n + (f.added ?? 0), 0);
+  const deleted = files.reduce((n, f) => n + (f.deleted ?? 0), 0);
+
+  return createPortal(
+    <div
+      ref={panelRef}
+      data-testid="lane-git-files"
+      role="group"
+      aria-label={t("git.filesHeading", { count: files.length })}
+      // The pointer has to be able to travel INTO the panel to scroll it, so
+      // the panel answers the same enter/leave pair the trigger does.
+      onMouseEnter={onPointerEnter}
+      onMouseLeave={onPointerLeave}
+      style={{
+        position: "fixed",
+        zIndex: 60,
+        top: pos?.top ?? 0,
+        left: pos?.left ?? 0,
+        // Hidden for the one frame before it has been measured, so it never
+        // flashes at the top-left corner.
+        visibility: pos ? "visible" : "hidden",
+      }}
+      className="max-h-72 w-[22rem] max-w-[calc(100vw-1rem)] overflow-y-auto rounded-md border border-border bg-surface-1 p-2 shadow-lg"
+    >
+      <div className="mb-1.5 flex items-baseline gap-2 border-b border-border pb-1.5 text-[11px]">
+        <span className="text-fg-secondary">{t("git.filesHeading", { count: files.length })}</span>
+        <span className="ml-auto shrink-0 font-mono tabular-nums">
+          <span className="text-status-success">+{added}</span>{" "}
+          <span className="text-status-danger">−{deleted}</span>
+        </span>
+      </div>
+      <ul className="space-y-0.5 font-mono text-[11px]">
+        {files.map((f) => {
+          const code = f.status.trim()[0] || "?";
+          return (
+            <li key={f.path} className="flex items-baseline gap-2">
+              <span
+                className={`w-3 shrink-0 font-semibold ${GIT_STATUS_STYLE[code] || "text-fg-muted"}`}
+                title={f.status}
+              >
+                {code}
+              </span>
+              {/* The DIRECTORY truncates, never the filename: the name is what
+                  you scan for, the path is only there to disambiguate it. */}
+              <span className="flex min-w-0 flex-1 items-baseline" title={f.path}>
+                <span className="truncate text-fg-muted">{f.path.replace(/[^/]+$/, "")}</span>
+                <span className="shrink-0 text-fg-primary">{f.path.split("/").pop()}</span>
+              </span>
+              <span className="shrink-0 tabular-nums">
+                {f.added === null && f.deleted === null ? (
+                  <span className="text-fg-muted">{t("git.noDelta")}</span>
+                ) : (
+                  <>
+                    <span className="text-status-success">+{f.added ?? 0}</span>{" "}
+                    <span className="text-status-danger">−{f.deleted ?? 0}</span>
+                  </>
+                )}
+              </span>
+            </li>
+          );
+        })}
+      </ul>
+      {hidden > 0 && (
+        <p className="mt-1.5 border-t border-border pt-1.5 text-[10px] text-fg-muted">
+          {t("git.filesMore", { count: hidden })}
+        </p>
+      )}
+    </div>,
+    document.body
+  );
+}
+
+export function LaneGitHeader({
+  laneId,
+  git,
+  onChanged,
+  onNewLane,
+}: {
+  laneId: number;
+  git: LaneGitFacts | null;
+  /** Called after a git bar action: the facts AND the panel's diff moved. */
+  onChanged: () => void;
+  /** See `LaneGitBar`'s prop of the same name. */
+  onNewLane?: (branch?: string) => void;
+}) {
+  const { t } = useTranslation(["lanes"]);
+  const [filesOpen, setFilesOpen] = useState(false);
+  const [countsAnchor, setCountsAnchor] = useState<HTMLButtonElement | null>(null);
+  // Closing is DELAYED: the panel is portalled away from the trigger, so the
+  // pointer leaves the trigger before it can land on the panel it is heading
+  // for. Any enter — trigger or panel — cancels the pending close.
+  const filesCloseTimer = useRef<number | undefined>(undefined);
+  const openFiles = useCallback(() => {
+    window.clearTimeout(filesCloseTimer.current);
+    setFilesOpen(true);
+  }, []);
+  const closeFiles = useCallback(() => {
+    window.clearTimeout(filesCloseTimer.current);
+    filesCloseTimer.current = window.setTimeout(() => setFilesOpen(false), 150);
+  }, []);
+  useEffect(() => () => window.clearTimeout(filesCloseTimer.current), []);
+
+  if (!git?.available) return null;
+  const lead = (
+    <>
+      {/* One row with the actions: branch first and strongest, then the head
+          and its subject, which is what truncates when the panel is narrow
+          (the whole of it stays in the tooltip). */}
+      <div
+        data-testid="lane-git"
+        className="flex min-w-0 flex-1 items-baseline gap-1.5 font-mono text-[11px]"
+        title={`${git.head} ${git.subject}`}
+      >
+        <span className="flex shrink-0 items-center gap-1 self-center font-semibold text-fg-primary">
+          <GitBranch className="h-3 w-3 text-fg-muted" />
+          {git.branch}
+        </span>
+        <span className="shrink-0 text-fg-muted">{git.head}</span>
+        <span className="min-w-0 truncate text-fg-muted">{git.subject}</span>
+      </div>
+      {(git.dirty > 0 || git.untracked > 0) && (
+        <button
+          type="button"
+          ref={setCountsAnchor}
+          data-testid="lane-git-counts"
+          aria-expanded={filesOpen}
+          onMouseEnter={openFiles}
+          onMouseLeave={closeFiles}
+          // Focus and click open it too: hover is not a gesture a
+          // keyboard or a touchscreen has.
+          onFocus={openFiles}
+          onBlur={closeFiles}
+          onClick={() => setFilesOpen((v) => !v)}
+          className="shrink-0 cursor-help rounded-full border border-status-warning/40 bg-status-warning/10 px-2 py-px text-[10.5px] text-status-warning"
+        >
+          {t("git.uncommitted", { dirty: git.dirty, untracked: git.untracked })}
+        </button>
+      )}
+    </>
+  );
+  return (
+    <div
+      data-testid="lane-git-header"
+      className="mb-2 rounded-md border border-border bg-surface-2 px-2 py-1"
+    >
+      <LaneGitBar
+        laneId={laneId}
+        git={git}
+        onChanged={onChanged}
+        onNewLane={onNewLane}
+        lead={lead}
+      />
+      {filesOpen && git.files?.length > 0 && (
+        <LaneGitFilesPanel
+          files={git.files}
+          hidden={git.dirty + git.untracked - git.files.length}
+          anchor={countsAnchor}
+          onPointerEnter={openFiles}
+          onPointerLeave={closeFiles}
+        />
+      )}
+    </div>
+  );
+}

client/src/components/lanes/LaneStripCard.tsx

@@ -18,6 +18,7 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import type { Lane } from "../../lib/types";
+import { LANE_TOOL_LABEL } from "../../lib/types";
 
 const LIVENESS_DOT: Record<Lane["liveness"], string> = {
   active: "bg-status-success",
@@ -41,7 +42,7 @@ const LIVENESS_DOT: Record<Lane["liveness"], string> = {
  * recordDetection refuses any detection that isn't strictly ahead.
  */
 function detectionLeads(lane: Lane): boolean {
-  if (!lane.detected_stage) return false;
+  if (!lane.detected_stage || !lane.pipeline_nodes.length) return false;
   const nodes = lane.pipeline_nodes;
   return (
     nodes.findIndex((n) => n.id === lane.detected_stage) >=
@@ -115,15 +116,18 @@ export default function LaneStripCard({
         <span className="shrink-0 text-[10px] font-semibold tracking-widest text-fg-muted">
           #{lane.id}
         </span>
-        <span className="truncate rounded bg-surface-4 px-1.5 py-0.5 text-fg-secondary">
-          {lane.stage}
-        </span>
-        {lane.tool === "codex" && (
+        {/* Only claude lanes carry a pipeline, and only while a template is
+            installed; the others show their CLI's tag in place of the stage chip. */}
+        {lane.tool !== "claude" || lane.pipeline_nodes.length === 0 ? (
           <span className="shrink-0 rounded border border-border bg-surface-2 px-1.5 py-0.5 text-[10px] text-fg-muted">
-            Codex
+            {LANE_TOOL_LABEL[lane.tool]}
+          </span>
+        ) : (
+          <span className="truncate rounded bg-surface-4 px-1.5 py-0.5 text-fg-secondary">
+            {lane.stage}
           </span>
         )}
-        {detectionLeads(lane) && (
+        {lane.tool === "claude" && detectionLeads(lane) && (
           <span
             data-testid={`lane-tile-auto-${lane.id}`}
             title={lane.detected_signal || undefined}

client/src/components/lanes/__tests__/AddLaneModal.test.tsx

@@ -27,7 +27,6 @@ vi.mock("../../../lib/api", () => ({
       browse: vi.fn(),
       get: vi.fn(),
       profileInit: vi.fn(),
-      agentsInstall: vi.fn(),
       mcpSync: vi.fn(),
       routerApply: vi.fn(),
     },
@@ -120,7 +119,6 @@ beforeEach(() => {
   vi.mocked(api.lanes.profileInit)
     .mockReset()
     .mockResolvedValue({ scaffolded: false, reason: "no detectable Node.js project" });
-  vi.mocked(api.lanes.agentsInstall).mockReset().mockResolvedValue({ installed: [] });
   vi.mocked(api.lanes.mcpSync).mockReset().mockResolvedValue({ servers: [], profilesSeeded: [] });
   vi.mocked(api.lanes.routerApply).mockReset().mockResolvedValue({
     tool: "claude",
@@ -245,10 +243,11 @@ describe("AddLaneModal — picking an existing branch (issue #34)", () => {
     await user.type(repoField, "/Users/tester/projects/repo");
     await screen.findByLabelText("Branch to fork from");
     await user.type(screen.getByLabelText("Title"), "Auto named");
-    // The placeholder previews the name the server will pick.
+    // No `feat/…` guess: the prefix is the server's LANE_BRANCH_PREFIX, which
+    // the form cannot see, so the placeholder only says the field is optional.
     expect(screen.getByLabelText("New branch name")).toHaveAttribute(
       "placeholder",
-      "feat/auto-named"
+      "Automatic — named from the title"
     );
 
     await user.click(screen.getByRole("button", { name: "Add lane" }));
@@ -304,6 +303,28 @@ describe("AddLaneModal — worktree mode (default)", () => {
     expect(screen.getByRole("button", { name: "Add lane" })).toBeDisabled();
   });
 
+  it("refuses a worktree of a repo with no commits and steers to Repo mode", async () => {
+    vi.mocked(api.lanes.branches).mockResolvedValue({
+      branches: [],
+      current: "main",
+      worktrees: [],
+    });
+    renderModal();
+    const user = userEvent.setup();
+
+    const repoField = screen.getByLabelText("Source repository");
+    await focusField(user, repoField);
+    await user.type(repoField, "/Users/tester/projects/empty");
+    expect(await screen.findByText(/commit first, then publish/i)).toBeInTheDocument();
+    await user.type(screen.getByLabelText("Title"), "demo");
+    // There is nothing to branch from, so the worktree cannot be created.
+    expect(screen.getByRole("button", { name: "Add lane" })).toBeDisabled();
+
+    await user.click(screen.getByRole("button", { name: "Use as a Repo lane" }));
+    expect(screen.getByRole("button", { name: "Repo" })).toHaveAttribute("aria-pressed", "true");
+    expect(screen.getByRole("button", { name: "Add lane" })).toBeEnabled();
+  });
+
   it("submits through the worktree provisioning endpoint, with the typed branch name", async () => {
     vi.mocked(api.lanes.branches).mockResolvedValue({
       branches: ["main"],
@@ -360,7 +381,7 @@ describe("AddLaneModal — worktree mode (default)", () => {
     expect(screen.queryByRole("dialog")).toBeNull();
   });
 
-  it("fires profileInit, agentsInstall, and mcpSync after a successful worktree call", async () => {
+  it("fires profileInit and mcpSync after a successful worktree call", async () => {
     vi.mocked(api.lanes.branches).mockResolvedValue({
       branches: ["main"],
       current: "main",
@@ -378,7 +399,6 @@ describe("AddLaneModal — worktree mode (default)", () => {
 
     await waitFor(() => expect(api.lanes.worktree).toHaveBeenCalled());
     await waitFor(() => expect(api.lanes.profileInit).toHaveBeenCalledWith(42));
-    expect(api.lanes.agentsInstall).toHaveBeenCalledWith(42);
     expect(api.lanes.mcpSync).toHaveBeenCalledWith(42);
     await waitFor(() => expect(onAdded).toHaveBeenCalled());
   });
@@ -393,7 +413,6 @@ describe("AddLaneModal — worktree mode (default)", () => {
       lane: { id: 43, title: "demo2", cwd: "/lanes/demo2", status: "provisioning" } as Lane,
     });
     vi.mocked(api.lanes.profileInit).mockRejectedValue(new Error("boom"));
-    vi.mocked(api.lanes.agentsInstall).mockRejectedValue(new Error("boom"));
     vi.mocked(api.lanes.mcpSync).mockRejectedValue(new Error("boom"));
     const onAdded = vi.fn();
     const onClose = vi.fn();
@@ -459,7 +478,6 @@ describe("AddLaneModal — worktree mode (default)", () => {
     await waitFor(() => expect(onAdded).toHaveBeenCalled());
     expect(await screen.findByText(/auto-setup was skipped/)).toBeInTheDocument();
     expect(api.lanes.profileInit).not.toHaveBeenCalled();
-    expect(api.lanes.agentsInstall).not.toHaveBeenCalled();
     expect(api.lanes.mcpSync).not.toHaveBeenCalled();
   });
 });

client/src/components/lanes/__tests__/LaneCard.test.tsx

@@ -9,7 +9,7 @@
  */
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, waitFor, fireEvent, act } from "@testing-library/react";
+import { render, screen, waitFor, act } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import LaneCard, { LaneToolsMenu, LaneRouterRow } from "../LaneCard";
 import type { Lane, LaneRuntime } from "../../../lib/types";
@@ -23,7 +23,6 @@ vi.mock("../../../lib/api", () => ({
       up: vi.fn(),
       down: vi.fn(),
       preflight: vi.fn().mockResolvedValue({ blocked: [], warnings: [] }),
-      agentsInstall: vi.fn(),
       mcpSync: vi.fn(),
       syncBaseCheck: vi.fn(),
       routerApply: vi.fn(),
@@ -96,13 +95,16 @@ function makeLane(overrides: Partial<Lane> = {}): Lane {
 }
 
 describe("LaneCard lane tool badge", () => {
-  it("badges a codex lane and leaves a claude lane unbadged", () => {
-    const { rerender } = render(
-      <LaneCard {...{ lane: makeLane({ tool: "codex" }), onAction: vi.fn() }} />
-    );
-    expect(screen.getByText("Codex")).toBeInTheDocument();
-    rerender(<LaneCard {...{ lane: makeLane({ tool: "claude" }), onAction: vi.fn() }} />);
-    expect(screen.queryByText("Codex")).not.toBeInTheDocument();
+  // The strip tile already names the CLI; a card holding only that tag was an
+  // empty frame in the lane detail.
+  it("renders nothing for a codex or antigravity lane with nothing else to show", () => {
+    for (const tool of ["codex", "antigravity"] as const) {
+      const { container, unmount } = render(
+        <LaneCard {...{ lane: makeLane({ tool }), onAction: vi.fn() }} />
+      );
+      expect(container.querySelector('[data-testid="lane-card-1"]')).toBeEmptyDOMElement();
+      unmount();
+    }
   });
 });
 
@@ -167,9 +169,9 @@ describe("LaneCard rebuilt layout", () => {
     expect(screen.queryByText("48%")).toBeNull();
   });
 
-  it("surfaces a needs-you message", () => {
+  it("leaves the needs-you message to the strip card", () => {
     render(<LaneCard lane={full({ needs_action: "waiting on approval" })} onAction={vi.fn()} />);
-    expect(screen.getByText(/waiting on approval/)).toBeInTheDocument();
+    expect(screen.queryByText(/waiting on approval/)).toBeNull();
   });
 
   it("keeps reset behind the ⋯ menu rather than showing it directly", async () => {
@@ -204,126 +206,11 @@ describe("LaneCard rebuilt layout", () => {
 });
 
 describe("LaneCard git block", () => {
-  const facts = {
-    available: true as const,
-    branch: "feat/rename-metric",
-    head: "9b3e74a",
-    subject: "free-text rule mode in the form",
-    dirty: 2,
-    untracked: 1,
-    files: [
-      { path: "server/lib/alerts.js", status: " M", added: 12, deleted: 3 },
-      { path: "client/src/lib/api.ts", status: "M ", added: 1, deleted: 0 },
-      { path: "scratch.txt", status: "??", added: null, deleted: null },
-    ],
-    // Tracking facts ride along on the same endpoint; a branch that has never
-    // been pushed reports nulls rather than zeros.
-    hasRemote: true,
-    upstream: null,
-    ahead: null,
-    behind: null,
-  };
-
-  it("renders the live branch, head, subject and uncommitted counts", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
-    render(<LaneCard lane={makeLane({ branch: "stale/recorded" })} onAction={vi.fn()} />);
-
-    const block = await screen.findByTestId("lane-git");
-    expect(block.textContent).toContain("feat/rename-metric");
-    expect(block.textContent).toContain("9b3e74a");
-    expect(block.textContent).toContain("free-text rule mode in the form");
-    expect(block.textContent).toContain("2");
-    // The live branch replaces the lane's recorded one rather than doubling it.
-    expect(screen.queryByText(/stale\/recorded/)).toBeNull();
-  });
-
-  it("names the files behind the counts on hover, with each one's line delta", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
-    render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-
-    const counts = await screen.findByTestId("lane-git-counts");
-    // Hidden until asked for: the row is a one-line summary until you hover.
-    expect(screen.queryByTestId("lane-git-files")).toBeNull();
-
-    fireEvent.mouseEnter(counts);
-    const panel = screen.getByTestId("lane-git-files");
-    expect(panel.textContent).toContain("alerts.js");
-    expect(panel.textContent).toContain("+12");
-    expect(panel.textContent).toContain("−3");
-    // Totals across the listed files.
-    expect(panel.textContent).toContain("+13");
-    // An untracked file has no delta to report and says so rather than "+0".
-    expect(panel.textContent).toContain("new");
-    expect(panel.textContent).toContain("3 files changed");
-
-    // Closing is delayed so the pointer can travel into the panel and scroll
-    // it — the panel is portalled to the body, away from its trigger.
-    fireEvent.mouseLeave(counts);
-    expect(screen.queryByTestId("lane-git-files")).not.toBeNull();
-    await waitFor(() => expect(screen.queryByTestId("lane-git-files")).toBeNull());
-  });
-
-  it("stays open while the pointer is inside the panel", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
-    render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-
-    const counts = await screen.findByTestId("lane-git-counts");
-    fireEvent.mouseEnter(counts);
-    fireEvent.mouseLeave(counts);
-    // The pointer landed on the panel before the pending close fired.
-    fireEvent.mouseEnter(screen.getByTestId("lane-git-files"));
-    await new Promise((r) => setTimeout(r, 200));
-    expect(screen.queryByTestId("lane-git-files")).not.toBeNull();
-
-    fireEvent.mouseLeave(screen.getByTestId("lane-git-files"));
-    await waitFor(() => expect(screen.queryByTestId("lane-git-files")).toBeNull());
-  });
-
-  it("says how many files the server-side cap left out", async () => {
-    // 40 uncommitted files, 3 listed: the counts are exact, the listing is not.
-    vi.mocked(api.lanes.git).mockResolvedValueOnce({ ...facts, dirty: 39, untracked: 1 });
-    render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-
-    fireEvent.mouseEnter(await screen.findByTestId("lane-git-counts"));
-    expect(screen.getByTestId("lane-git-files").textContent).toContain("37 more");
-  });
-
-  it("omits the uncommitted line when the tree is clean", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce({ ...facts, dirty: 0, untracked: 0 });
-    render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-    const block = await screen.findByTestId("lane-git");
-    expect(block.textContent).not.toContain("modified");
-  });
-
-  it("renders the card with no git block and no error when git is unavailable", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce({ available: false });
-    render(<LaneCard lane={makeLane({ id: 2 })} onAction={vi.fn()} />);
-
-    expect(await screen.findByTestId("lane-card-2")).toBeInTheDocument();
+  it("carries no working-copy row — that heads the Changes panel now", async () => {
+    render(<LaneCard lane={makeLane({ id: 4 })} onAction={vi.fn()} />);
+    expect(await screen.findByTestId("lane-card-4")).toBeInTheDocument();
     expect(screen.queryByTestId("lane-git")).toBeNull();
-  });
-
-  it("swallows a rejected request instead of surfacing an error", async () => {
-    vi.mocked(api.lanes.git).mockRejectedValueOnce(new Error("network down"));
-    render(<LaneCard lane={makeLane({ id: 3 })} onAction={vi.fn()} />);
-
-    expect(await screen.findByTestId("lane-card-3")).toBeInTheDocument();
-    expect(screen.queryByTestId("lane-git")).toBeNull();
-    expect(screen.queryByText(/network down/)).toBeNull();
-  });
-
-  it("stops polling once the card unmounts", async () => {
-    vi.useFakeTimers();
-    try {
-      vi.mocked(api.lanes.git).mockResolvedValue({ available: false });
-      const { unmount } = render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-      expect(api.lanes.git).toHaveBeenCalledTimes(1);
-      unmount();
-      vi.advanceTimersByTime(120_000);
-      expect(api.lanes.git).toHaveBeenCalledTimes(1);
-    } finally {
-      vi.useRealTimers();
-    }
+    expect(api.lanes.git).not.toHaveBeenCalled();
   });
 });
 
@@ -421,17 +308,6 @@ describe("LaneToolsMenu", () => {
     } as unknown as LaneRuntime);
   });
 
-  it("clicking Install agents calls the API and shows the result", async () => {
-    vi.mocked(api.lanes.agentsInstall).mockResolvedValue({
-      installed: ["qc-local.md", "senior-gate-reviewer.md"],
-    });
-    render(<LaneToolsMenu lane={makeLane()} />);
-    await userEvent.click(await screen.findByTestId("lane-tools-menu"));
-    await userEvent.click(await screen.findByTestId("lane-agents-install"));
-    await waitFor(() => expect(api.lanes.agentsInstall).toHaveBeenCalledWith(1));
-    expect(await screen.findByTestId("lane-action-result")).toHaveTextContent("qc-local.md");
-  });
-
   it("clicking Sync MCP calls the API and shows the result", async () => {
     vi.mocked(api.lanes.mcpSync).mockResolvedValue({
       servers: ["playwright"],

client/src/components/lanes/__tests__/LaneChangesPanel.test.tsx

@@ -11,7 +11,7 @@
  */
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, waitFor } from "@testing-library/react";
+import { render, screen, waitFor, act, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { LaneChangesPanel } from "../LaneChangesPanel";
 import { api } from "../../../lib/api";
@@ -20,12 +20,16 @@ import type { LaneChanges } from "../../../lib/types";
 vi.mock("../../../lib/api", () => ({
   api: {
     lanes: {
+      git: vi.fn(),
+      gitBranches: vi.fn(),
       changes: vi.fn(),
       gitAction: vi.fn(),
       gitLog: vi.fn(),
       gitFile: vi.fn(),
+      gitSaveFile: vi.fn(),
       gitLs: vi.fn(),
       gitTree: vi.fn(),
+      gitTreeAll: vi.fn(),
     },
   },
 }));
@@ -76,7 +80,15 @@ function changes(over: Partial<Extract<LaneChanges, { available: true }>> = {}):
   };
 }
 
+/** The overview row's discard button for one path. */
+function discardOf(path: string) {
+  return within(screen.getByText(path).closest("li")!).getByRole("button", {
+    name: "Discard this file's changes",
+  });
+}
+
 beforeEach(() => {
+  vi.mocked(api.lanes.git).mockReset().mockResolvedValue({ available: false });
   vi.mocked(api.lanes.changes).mockReset();
   vi.mocked(api.lanes.changes).mockResolvedValue(changes());
   vi.mocked(api.lanes.gitAction).mockReset();
@@ -94,12 +106,14 @@ beforeEach(() => {
       },
     ],
   });
-  vi.mocked(api.lanes.gitLs).mockResolvedValue({
-    available: true,
-    paths: ["src/main.ts"],
-    truncated: false,
-    total: 1,
-  });
+  vi.mocked(api.lanes.gitLs)
+    .mockReset()
+    .mockResolvedValue({
+      available: true,
+      paths: ["src/main.ts"],
+      truncated: false,
+      total: 1,
+    });
   vi.mocked(api.lanes.gitTree).mockResolvedValue({
     available: true,
     path: "",
@@ -211,13 +225,191 @@ describe("LaneChangesPanel", () => {
     });
   });
 
+  it("heads the panel with the lane's git line, and a stage re-reads it", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValue({
+      available: true,
+      branch: "feat/thing",
+      head: "9b3e74a",
+      subject: "wip",
+      dirty: 2,
+      untracked: 1,
+      files: [],
+      hasRemote: false,
+      upstream: null,
+      ahead: null,
+      behind: null,
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    expect(await screen.findByTestId("lane-git")).toHaveTextContent("feat/thing");
+    expect(screen.getByTestId("lane-git-bar")).toBeInTheDocument();
+    expect(api.lanes.git).toHaveBeenCalledTimes(1);
+
+    const [stage] = screen.getAllByRole("button", { name: "Stage this file" });
+    await user.click(stage!);
+    // The header's counts moved with the index: waiting out its 30s poll
+    // would leave them wrong beside the list that just changed.
+    await waitFor(() => expect(api.lanes.git).toHaveBeenCalledTimes(2));
+  });
+
+  it("re-reads the diff after a git bar action", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValue({
+      available: true,
+      branch: "feat/thing",
+      head: "9b3e74a",
+      subject: "wip",
+      dirty: 0,
+      untracked: 0,
+      files: [],
+      hasRemote: true,
+      upstream: "origin/feat/thing",
+      ahead: 0,
+      behind: 1,
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-git-bar");
+    const before = vi.mocked(api.lanes.changes).mock.calls.length;
+
+    await user.click(screen.getByRole("button", { name: /Pull/ }));
+    expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "pull", {});
+    // A pull rewrites the working tree the list below describes.
+    await waitFor(() =>
+      expect(vi.mocked(api.lanes.changes).mock.calls.length).toBeGreaterThan(before)
+    );
+  });
+
+  it("re-reads history too when Refresh is pressed there", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "History" }));
+    await screen.findByText("feat: the commit");
+    vi.mocked(api.lanes.gitLog).mockClear();
+
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    // A pull or a switch from the git bar moves the commit list as well.
+    await waitFor(() => expect(api.lanes.gitLog).toHaveBeenCalledTimes(1));
+  });
+
+  it("stages every file the index lacks in one call, from above the list", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    const list = await screen.findByTestId("lane-changes-overview");
+    const actions = screen.getByTestId("lane-changes-actions");
+    // Commit box and Stage all come BEFORE the file list.
+    expect(actions.compareDocumentPosition(list) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
+    expect(screen.getByTestId("lane-changes-commit")).toBeInTheDocument();
+
+    await user.click(screen.getByRole("button", { name: "Stage all (2)" }));
+    // The already-staged docs/API.md is not sent again.
+    expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "stage", {
+      paths: ["server/lib/git-ops.js", "notes.txt"],
+    });
+  });
+
+  it("lists staged files apart from the changes the next commit leaves behind", async () => {
+    render(<LaneChangesPanel laneId={7} />);
+    const list = await screen.findByTestId("lane-changes-overview");
+    const staged = list.querySelector('[data-group="staged"]') as HTMLElement;
+    const unstaged = list.querySelector('[data-group="unstaged"]') as HTMLElement;
+    expect(within(staged).getByText("docs/API.md")).toBeInTheDocument();
+    expect(within(staged).queryByText("notes.txt")).toBeNull();
+    expect(within(unstaged).getByText("server/lib/git-ops.js")).toBeInTheDocument();
+    expect(within(unstaged).getByText("notes.txt")).toBeInTheDocument();
+    expect(within(unstaged).queryByText("docs/API.md")).toBeNull();
+    expect(screen.getByText("Staged Changes")).toBeInTheDocument();
+  });
+
+  it("at full width shows the tree as a sidebar and opens a file for reading, editing on a click", async () => {
+    vi.mocked(api.lanes.gitTree).mockResolvedValue({
+      available: true,
+      path: "",
+      entries: [{ name: "main.ts", path: "src/main.ts", dir: false, status: " M" }],
+      truncated: false,
+    });
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["const whole = 1;"],
+      sha: "b".repeat(40),
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} full />);
+    const sidebar = await screen.findByTestId("lane-changes-sidebar");
+    // The sidebar IS the Files view: its finder lives there, and the tab is gone.
+    expect(within(sidebar).getByLabelText("Find a file by path…")).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: "Files" })).toBeNull();
+    expect(screen.getAllByTestId("lane-changes-browse")).toHaveLength(1);
+    await user.click(await within(sidebar).findByText("main.ts"));
+
+    // Opening a file only shows it: no editor until the text itself is clicked.
+    const view = await screen.findByTestId("lane-file-view");
+    expect(screen.queryByTestId("lane-file-editor")).toBeNull();
+    expect(screen.queryByTestId("lane-file-edit")).toBeNull();
+    await user.click(view);
+    const editor = await screen.findByTestId("lane-file-editor");
+    expect(editor).toHaveValue("const whole = 1;");
+    expect(editor).toHaveFocus();
+    expect(screen.getByTestId("lane-file-save")).toBeDisabled();
+    await user.type(editor, "x");
+    expect(screen.getByTestId("lane-file-save")).toBeEnabled();
+    // Cancel drops the edit and goes back to reading.
+    await user.click(screen.getByRole("button", { name: "Cancel" }));
+    expect(await screen.findByTestId("lane-file-view")).toHaveTextContent("const whole = 1;");
+    expect(screen.queryByTestId("lane-file-editor")).toBeNull();
+  });
+
+  it("at full width opens a changed file from the overview for reading, not editing", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "server/lib/git-ops.js",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["a"],
+      sha: "b".repeat(40),
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} full />);
+    const list = await screen.findByTestId("lane-changes-overview");
+    await user.click(within(list).getByText("server/lib/git-ops.js"));
+    expect(await screen.findByTestId("lane-file-view")).toHaveTextContent("a");
+    expect(screen.queryByTestId("lane-file-editor")).toBeNull();
+  });
+
+  it("does not enter the editor when a click only ends a text selection", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "server/lib/git-ops.js",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["copy me"],
+      sha: "b".repeat(40),
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} full />);
+    const list = await screen.findByTestId("lane-changes-overview");
+    await user.click(within(list).getByText("server/lib/git-ops.js"));
+    const view = await screen.findByTestId("lane-file-view");
+    const spy = vi.spyOn(window, "getSelection").mockReturnValue({
+      toString: () => "copy",
+    } as unknown as Selection);
+    await user.click(view);
+    spy.mockRestore();
+    expect(screen.queryByTestId("lane-file-editor")).toBeNull();
+  });
+
   it("needs two clicks to discard, and only the second one reaches the server", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
     await screen.findByTestId("lane-changes-overview");
 
-    const [discard] = screen.getAllByRole("button", { name: "Discard this file's changes" });
-    await user.click(discard!);
+    await user.click(discardOf("server/lib/git-ops.js"));
     expect(api.lanes.gitAction).not.toHaveBeenCalled();
 
     await user.click(
@@ -229,6 +421,75 @@ describe("LaneChangesPanel", () => {
     });
   });
 
+  it("disarms a pending discard when the lane changes, so one click cannot discard in another lane", async () => {
+    const user = userEvent.setup();
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    const [discard] = screen.getAllByRole("button", { name: "Discard this file's changes" });
+    await user.click(discard!);
+
+    // Lane 8 has a file at the SAME path.
+    rerender(<LaneChangesPanel laneId={8} />);
+    await waitFor(() => expect(api.lanes.changes).toHaveBeenCalledWith(8, expect.anything()));
+    expect(
+      screen.queryByRole("button", { name: "Click again to discard — this cannot be undone" })
+    ).toBeNull();
+    const [again] = await screen.findAllByRole("button", { name: "Discard this file's changes" });
+    await user.click(again!);
+    expect(api.lanes.gitAction).not.toHaveBeenCalled();
+  });
+
+  it("disarms a pending discard once that path leaves the file list", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(discardOf("server/lib/git-ops.js"));
+
+    // The file was committed/reverted elsewhere; a later reappearance must not be pre-armed.
+    const base = changes();
+    const rest = base.available ? base.files.slice(1) : [];
+    vi.mocked(api.lanes.changes).mockResolvedValueOnce(changes({ files: rest }));
+    vi.mocked(api.lanes.changes).mockResolvedValue(changes());
+    // A plain refresh (the poll's twin), not a git action — an action already disarms.
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    await waitFor(() => expect(screen.queryByText("server/lib/git-ops.js")).toBeNull());
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    await screen.findByText("server/lib/git-ops.js");
+    expect(
+      screen.queryByRole("button", { name: "Click again to discard — this cannot be undone" })
+    ).toBeNull();
+  });
+
+  it("ignores a late response for the lane it has already left", async () => {
+    let resolveOld: (v: LaneChanges) => void = () => {};
+    vi.mocked(api.lanes.changes).mockImplementation((id) =>
+      id === 7
+        ? new Promise<LaneChanges>((r) => (resolveOld = r))
+        : Promise.resolve(
+            changes({
+              files: [
+                {
+                  path: "lane8.txt",
+                  status: "??",
+                  untracked: true,
+                  added: 1,
+                  deleted: 0,
+                  binary: false,
+                },
+              ],
+            })
+          )
+    );
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    rerender(<LaneChangesPanel laneId={8} />);
+    expect(await screen.findByText("lane8.txt")).toBeInTheDocument();
+
+    resolveOld(changes());
+    await new Promise((r) => setTimeout(r, 20));
+    expect(screen.getByText("lane8.txt")).toBeInTheDocument();
+    expect(screen.queryByText("server/lib/git-ops.js")).toBeNull();
+  });
+
   it("opens a commit from history as a commit-range review", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -275,8 +536,16 @@ describe("LaneChangesPanel", () => {
     expect(screen.getByText("src")).toBeInTheDocument();
   });
 
-  it("expands every folder at once, fetching whatever level wasn't cached yet", async () => {
+  it("expands every folder at once from one whole-tree read", async () => {
     const user = userEvent.setup();
+    vi.mocked(api.lanes.gitTreeAll).mockResolvedValue({
+      available: true,
+      truncated: false,
+      levels: {
+        "": [{ name: "src", path: "src", dir: true }],
+        src: [{ name: "main.ts", path: "src/main.ts", dir: false }],
+      },
+    });
     vi.mocked(api.lanes.gitTree).mockImplementation(async (_id, path) => {
       if (path === "src")
         return {
@@ -306,6 +575,34 @@ describe("LaneChangesPanel", () => {
     expect(screen.getByText("src")).toBeInTheDocument();
   });
 
+  it("highlights modified and untracked files in the Files tree, and folders holding them", async () => {
+    vi.mocked(api.lanes.gitTree).mockResolvedValue({
+      available: true,
+      path: "",
+      entries: [
+        { name: "src", path: "src", dir: true, changed: true },
+        { name: "docs", path: "docs", dir: true },
+        { name: "a.txt", path: "a.txt", dir: false, status: " M" },
+        { name: "new.txt", path: "new.txt", dir: false, status: "??" },
+        { name: "keep.txt", path: "keep.txt", dir: false },
+      ],
+      truncated: false,
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+
+    const row = async (name: string) => (await screen.findByText(name)).closest("button")!;
+    expect(await row("a.txt")).toHaveAttribute("data-tree-status", "M");
+    expect(await row("a.txt")).toHaveClass("text-status-warning");
+    expect(await row("new.txt")).toHaveAttribute("data-tree-status", "U");
+    expect(await row("new.txt")).toHaveClass("text-status-success");
+    expect(await row("src")).toHaveAttribute("data-tree-status", "dir");
+    expect(await row("keep.txt")).not.toHaveAttribute("data-tree-status");
+    expect(await row("docs")).not.toHaveAttribute("data-tree-status");
+  });
+
   it("quick-opens a tracked file as its whole content, not a diff", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -319,6 +616,110 @@ describe("LaneChangesPanel", () => {
     expect(await screen.findByTestId("lane-file-view")).toHaveTextContent("const whole = 1;");
   });
 
+  it("edits a whole file in place and saves over the exact version it opened", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["const whole = 1;"],
+      sha: "b".repeat(40),
+    });
+    vi.mocked(api.lanes.gitSaveFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["const whole = 2;"],
+      sha: "c".repeat(40),
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await user.click(await screen.findByText("src/main.ts"));
+    await user.click(await screen.findByTestId("lane-file-view"));
+    const editor = await screen.findByTestId("lane-file-editor");
+    expect(editor).toHaveValue("const whole = 1;");
+    await user.clear(editor);
+    await user.type(editor, "const whole = 2;");
+    await user.click(screen.getByTestId("lane-file-save"));
+
+    expect(api.lanes.gitSaveFile).toHaveBeenCalledWith(
+      7,
+      "src/main.ts",
+      "const whole = 2;",
+      "b".repeat(40)
+    );
+    // Back to reading, showing what was saved.
+    expect(await screen.findByTestId("lane-file-view")).toHaveTextContent("const whole = 2;");
+    expect(screen.queryByTestId("lane-file-editor")).toBeNull();
+  });
+
+  it("says why a file cannot be edited instead of offering a dead Edit button", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: true, // over the 1 MB view cap: no `sha`, nothing safe to save
+      lines: ["partial"],
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await user.click(await screen.findByText("src/main.ts"));
+
+    expect(await screen.findByTestId("lane-file-noedit")).toHaveTextContent(
+      "Too large to edit here (over 1 MB)"
+    );
+    expect(screen.queryByTestId("lane-file-edit")).toBeNull();
+  });
+
+  it("keeps the draft and says why when the file changed on disk meanwhile", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["x"],
+      sha: "b".repeat(40),
+    });
+    vi.mocked(api.lanes.gitSaveFile).mockRejectedValue(
+      Object.assign(new Error("the file changed on disk since it was opened"), { code: "ESTALE" })
+    );
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await user.click(await screen.findByText("src/main.ts"));
+    await user.click(await screen.findByTestId("lane-file-view"));
+    await user.type(await screen.findByTestId("lane-file-editor"), "y");
+    await user.click(screen.getByTestId("lane-file-save"));
+
+    expect(await screen.findByRole("alert")).toHaveTextContent(/changed on disk/);
+    expect(screen.getByTestId("lane-file-editor")).toHaveValue("xy");
+  });
+
+  it("unstages every staged file in one call, on the same row as Stage all and commit", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    const row = screen.getByTestId("lane-changes-actions");
+    expect(row).toContainElement(screen.getByTestId("lane-changes-commit"));
+    expect(row).toContainElement(screen.getByRole("button", { name: "Stage all (2)" }));
+
+    await user.click(screen.getByRole("button", { name: "Unstage all (1)" }));
+    expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "unstage", { paths: ["docs/API.md"] });
+  });
+
   it("switches the diff to side-by-side", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -411,6 +812,16 @@ describe("LaneChangesPanel", () => {
     });
   });
 
+  it("drops a half-typed commit message on a lane switch", async () => {
+    const user = userEvent.setup();
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-commit");
+    await user.type(screen.getByLabelText("Commit message"), "fix: meant for lane 7");
+    rerender(<LaneChangesPanel laneId={8} />);
+    await screen.findByTestId("lane-changes-commit");
+    expect(screen.getByLabelText("Commit message")).toHaveValue("");
+  });
+
   it("hides the commit box when nothing is staged", async () => {
     vi.mocked(api.lanes.changes).mockResolvedValue(
       changes({
@@ -491,6 +902,168 @@ describe("LaneChangesPanel", () => {
     expect(screen.getAllByTestId("lane-diff-view")).toHaveLength(2);
   });
 
+  describe("review actions", () => {
+    const reviewed = () =>
+      changes({
+        files: [
+          {
+            path: "server/lib/git-ops.js",
+            status: " M",
+            untracked: false,
+            unstaged: true,
+            added: 1,
+            deleted: 1,
+            binary: false,
+            hunks: [HUNK, { ...HUNK, header: "@@ -9,2 +10,3 @@" }],
+          },
+          {
+            path: "notes.txt",
+            status: "??",
+            untracked: true,
+            added: 1,
+            deleted: 0,
+            binary: false,
+            hunks: [HUNK],
+          },
+        ],
+      });
+    const openReview = async (user: ReturnType<typeof userEvent.setup>) => {
+      render(<LaneChangesPanel laneId={7} />);
+      await screen.findByTestId("lane-changes-overview");
+      vi.mocked(api.lanes.changes).mockResolvedValue(reviewed());
+      await user.click(screen.getByRole("button", { name: "Review" }));
+      await screen.findByTestId("lane-changes-review");
+    };
+
+    it("stages one hunk by its @@ line, at the context the diff was read with", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      // Two hunks on the tracked file; the untracked one has none to act on.
+      const stage = screen.getAllByRole("button", { name: "Stage this hunk" });
+      expect(stage).toHaveLength(2);
+      await user.click(stage[1]!);
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "stage-hunk", {
+        path: "server/lib/git-ops.js",
+        hunk: "@@ -9,2 +10,3 @@",
+        block: 0,
+        context: 3,
+      });
+    });
+
+    it("gives each +/- block inside ONE hunk its own bar and acts on that block only (#50)", async () => {
+      const user = userEvent.setup();
+      render(<LaneChangesPanel laneId={7} />);
+      await screen.findByTestId("lane-changes-overview");
+      vi.mocked(api.lanes.changes).mockResolvedValue(
+        changes({
+          files: [
+            {
+              path: "server/lib/git-ops.js",
+              status: " M",
+              untracked: false,
+              unstaged: true,
+              added: 2,
+              deleted: 1,
+              binary: false,
+              hunks: [
+                {
+                  header: "@@ -1,4 +1,5 @@",
+                  context: "",
+                  oldStart: 1,
+                  newStart: 1,
+                  lines: [
+                    { type: "del" as const, oldLine: 1, newLine: null, text: "a" },
+                    { type: "add" as const, oldLine: null, newLine: 1, text: "A" },
+                    { type: "ctx" as const, oldLine: 2, newLine: 2, text: "b" },
+                    { type: "ctx" as const, oldLine: 3, newLine: 3, text: "c" },
+                    { type: "add" as const, oldLine: null, newLine: 4, text: "new" },
+                    { type: "ctx" as const, oldLine: 4, newLine: 5, text: "d" },
+                  ],
+                },
+              ],
+            },
+          ],
+        })
+      );
+      await user.click(screen.getByRole("button", { name: "Review" }));
+      await screen.findByTestId("lane-changes-review");
+
+      const bars = screen.getAllByTestId("lane-hunk-bar");
+      expect(bars.map((b) => b.textContent)).toEqual([
+        expect.stringContaining("1 of 2"),
+        expect.stringContaining("2 of 2"),
+      ]);
+      await user.click(screen.getAllByRole("button", { name: "Stage this hunk" })[1]!);
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "stage-hunk", {
+        path: "server/lib/git-ops.js",
+        hunk: "@@ -1,4 +1,5 @@",
+        block: 1,
+        context: 3,
+      });
+    });
+
+    it("hangs one review bar under each actionable hunk, counting them", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      // Two hunks on the tracked file; the untracked file gets no bar.
+      const bars = screen.getAllByTestId("lane-hunk-bar");
+      expect(bars.map((b) => b.textContent)).toEqual([
+        expect.stringContaining("1 of 2"),
+        expect.stringContaining("2 of 2"),
+      ]);
+      // Undo sits beside Keep inside the bar — not on the @@ line.
+      expect(bars[0]).toContainElement(
+        screen.getAllByRole("button", { name: "Undo this hunk" })[0]!
+      );
+      expect(screen.getAllByRole("button", { name: "Previous change" })[0]).toBeDisabled();
+      expect(screen.getAllByRole("button", { name: "Next change" })[1]).toBeDisabled();
+    });
+
+    it("needs two clicks to undo a hunk, and arms only that hunk", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      const [first] = screen.getAllByRole("button", { name: "Undo this hunk" });
+      await user.click(first!);
+      expect(api.lanes.gitAction).not.toHaveBeenCalled();
+      // The other hunk is still at its first click.
+      expect(screen.getAllByRole("button", { name: "Undo this hunk" })).toHaveLength(1);
+      await user.click(
+        screen.getByRole("button", {
+          name: "Click again to undo this hunk — this cannot be undone",
+        })
+      );
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "discard-hunk", {
+        path: "server/lib/git-ops.js",
+        hunk: "@@ -1,2 +1,3 @@",
+        block: 0,
+        context: 3,
+        confirm: true,
+      });
+    });
+
+    it("stages a whole file from its review header without folding it", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      const [stageFile] = screen.getAllByRole("button", { name: "Stage this file" });
+      await user.click(stageFile!);
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "stage", {
+        paths: ["server/lib/git-ops.js"],
+      });
+      expect(
+        screen.getByRole("button", { name: "Collapse server/lib/git-ops.js" })
+      ).toBeInTheDocument();
+    });
+
+    it("keeps each file's header pinned while its diff scrolls", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      expect(screen.getByRole("button", { name: "Collapse server/lib/git-ops.js" })).toHaveClass(
+        "sticky",
+        "top-0"
+      );
+    });
+  });
+
   it("opens a file only from its path, and folds it from anywhere else", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -515,6 +1088,73 @@ describe("LaneChangesPanel", () => {
     );
   });
 
+  it("opens, not folds, when Enter is pressed on the path", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Review" }));
+    await screen.findByTestId("lane-changes-review");
+
+    screen.getByRole("button", { name: "server/lib/git-ops.js" }).focus();
+    await user.keyboard("{Enter}");
+    await waitFor(() =>
+      expect(api.lanes.changes).toHaveBeenCalledWith(7, {
+        range: "work",
+        path: "server/lib/git-ops.js",
+        context: 3,
+      })
+    );
+  });
+
+  it("drops a quick-open answer for the lane it has already left", async () => {
+    const user = userEvent.setup();
+    let answer: (v: { paths: string[] }) => void = () => {};
+    vi.mocked(api.lanes.gitLs).mockReturnValueOnce(
+      new Promise((r) => {
+        answer = r as typeof answer;
+      }) as ReturnType<typeof api.lanes.gitLs>
+    );
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await waitFor(() => expect(api.lanes.gitLs).toHaveBeenCalledWith(7, "main"));
+
+    rerender(<LaneChangesPanel laneId={8} />);
+    await act(async () => answer({ paths: ["from/lane7.ts"] }));
+    // Back in Files on lane 8, before its own search lands: nothing of lane 7.
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    expect(screen.queryByText("from/lane7.ts")).toBeNull();
+  });
+
+  it("keeps the newest quick-open answer when an older one lands after it", async () => {
+    const user = userEvent.setup();
+    let answer: (v: { paths: string[] }) => void = () => {};
+    vi.mocked(api.lanes.gitLs)
+      .mockReturnValueOnce(
+        new Promise((r) => {
+          answer = r as typeof answer;
+        }) as ReturnType<typeof api.lanes.gitLs>
+      )
+      .mockResolvedValueOnce({
+        available: true,
+        paths: ["new/mainx.ts"],
+        truncated: false,
+        total: 1,
+      });
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    const box = await screen.findByLabelText("Find a file by path…");
+    await user.type(box, "main");
+    await waitFor(() => expect(api.lanes.gitLs).toHaveBeenCalledWith(7, "main"));
+    await user.type(box, "x");
+    expect(await screen.findByText("new/mainx.ts")).toBeInTheDocument();
+
+    await act(async () => answer({ paths: ["old/main-only.ts"] }));
+    expect(screen.queryByText("old/main-only.ts")).toBeNull();
+  });
+
   it("goes back to the list it came from, at the offset it was left at", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -537,4 +1177,248 @@ describe("LaneChangesPanel", () => {
     expect(await screen.findByTestId("lane-changes-review")).toBeInTheDocument();
     expect(screen.getByTestId("lane-changes-body").scrollTop).toBe(640);
   });
+
+  it("opens an unchanged tracked file from Files with no error banner", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    vi.mocked(api.lanes.changes).mockRejectedValue(
+      Object.assign(new Error("file has no changes in this range"), {
+        code: "ENOFILECHANGE",
+        status: 400,
+      })
+    );
+
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await user.click(await screen.findByText("src/main.ts"));
+    expect(await screen.findByTestId("lane-file-view")).toHaveTextContent("const whole = 1;");
+
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    await waitFor(() => expect(api.lanes.changes).toHaveBeenCalledTimes(3));
+    expect(screen.queryByRole("alert")).toBeNull();
+    expect(screen.getByTestId("lane-file-view")).toBeInTheDocument();
+  });
+
+  it("keeps the overview rows mounted across re-renders (typing in the commit box)", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-commit");
+    const before = screen.getByText("server/lib/git-ops.js");
+    await user.type(screen.getByLabelText("Commit message"), "x");
+    expect(screen.getByText("server/lib/git-ops.js")).toBe(before);
+  });
+
+  it("expands all folders with ONE request, not one per folder", async () => {
+    const user = userEvent.setup();
+    vi.mocked(api.lanes.gitTree).mockClear();
+    vi.mocked(api.lanes.gitTreeAll)
+      .mockClear()
+      .mockResolvedValue({
+        available: true,
+        truncated: false,
+        levels: {
+          "": [{ name: "src", path: "src", dir: true }],
+          src: [{ name: "main.ts", path: "src/main.ts", dir: false }],
+        },
+      });
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await screen.findByText("src");
+    await user.click(screen.getByRole("button", { name: "Expand all folders" }));
+
+    expect(await screen.findByText("main.ts")).toBeInTheDocument();
+    expect(api.lanes.gitTreeAll).toHaveBeenCalledTimes(1);
+    // Only the root read the Files tab made on entry — no per-folder walk.
+    expect(api.lanes.gitTree).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not repaint the previous lane after its git action resolves post-switch", async () => {
+    const user = userEvent.setup();
+    let resolveAction: (v: { action: string; ok: true; output: string }) => void = () => {};
+    vi.mocked(api.lanes.gitAction).mockReturnValue(
+      new Promise((r) => (resolveAction = r)) as ReturnType<typeof api.lanes.gitAction>
+    );
+    vi.mocked(api.lanes.changes).mockImplementation(async (id) =>
+      id === 7
+        ? changes()
+        : changes({
+            files: [
+              {
+                path: "lane8.txt",
+                status: "??",
+                untracked: true,
+                added: 1,
+                deleted: 0,
+                binary: false,
+              },
+            ],
+          })
+    );
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    const [stage] = screen.getAllByRole("button", { name: "Stage this file" });
+    await user.click(stage!);
+
+    rerender(<LaneChangesPanel laneId={8} />);
+    expect(await screen.findByText("lane8.txt")).toBeInTheDocument();
+    const lane7Reads = vi.mocked(api.lanes.changes).mock.calls.filter(([id]) => id === 7).length;
+
+    resolveAction({ action: "stage", ok: true, output: "" });
+    await new Promise((r) => setTimeout(r, 20));
+    expect(vi.mocked(api.lanes.changes).mock.calls.filter(([id]) => id === 7)).toHaveLength(
+      lane7Reads
+    );
+    expect(screen.getByText("lane8.txt")).toBeInTheDocument();
+    expect(screen.queryByText("server/lib/git-ops.js")).toBeNull();
+  });
+
+  it("does not paint the previous lane's tree when an expand-all read outlives a lane switch", async () => {
+    const user = userEvent.setup();
+    let resolveSrc: () => void = () => {};
+    vi.mocked(api.lanes.gitTreeAll).mockImplementation(
+      () =>
+        new Promise(
+          (r) =>
+            (resolveSrc = () =>
+              r({
+                available: true,
+                truncated: false,
+                levels: {
+                  "": [{ name: "src", path: "src", dir: true }],
+                  src: [{ name: "main.ts", path: "src/main.ts", dir: false }],
+                },
+              }))
+        )
+    );
+    vi.mocked(api.lanes.gitTree).mockImplementation((id) => {
+      return Promise.resolve({
+        available: true,
+        path: "",
+        entries: [
+          id === 7
+            ? { name: "src", path: "src", dir: true }
+            : { name: "lib8", path: "lib8", dir: false },
+        ],
+        truncated: false,
+      });
+    });
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await screen.findByText("src");
+    await user.click(screen.getByRole("button", { name: "Expand all folders" }));
+
+    rerender(<LaneChangesPanel laneId={8} />);
+    await user.click(await screen.findByRole("button", { name: "Files" }));
+    expect(await screen.findByText("lib8")).toBeInTheDocument();
+
+    resolveSrc();
+    await new Promise((r) => setTimeout(r, 20));
+    expect(screen.getByText("lib8")).toBeInTheDocument();
+    expect(screen.queryByText("src")).toBeNull();
+    expect(screen.queryByText("main.ts")).toBeNull();
+    expect(screen.getByRole("button", { name: "Expand all folders" })).toBeEnabled();
+  });
+});
+
+describe("a merge in progress (issue #45)", () => {
+  const merging = (conflicts: number) => ({
+    available: true as const,
+    branch: "main",
+    head: "abc1234",
+    subject: "main",
+    dirty: 1,
+    untracked: 0,
+    files: [],
+    hasRemote: false,
+    upstream: null,
+    ahead: null,
+    behind: null,
+    merging: true,
+    conflicts,
+  });
+  const conflicted = changes({
+    files: [
+      {
+        path: "a.txt",
+        status: "UU",
+        untracked: false,
+        staged: true,
+        unstaged: true,
+        conflicted: true,
+        added: 3,
+        deleted: 0,
+        binary: false,
+      },
+      {
+        path: "b.txt",
+        status: "A ",
+        untracked: false,
+        staged: true,
+        added: 1,
+        deleted: 0,
+        binary: false,
+      },
+    ],
+  });
+
+  it("lists conflicts on their own, resolves one side, and blocks the commit until none are left", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValue(merging(1));
+    vi.mocked(api.lanes.changes).mockResolvedValue(conflicted);
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={3} />);
+
+    const group = await screen.findByTestId("lane-changes-conflicts");
+    expect(within(group).getByText("a.txt")).toBeInTheDocument();
+    // Not offered as an ordinary stage: that would mark it resolved blind.
+    expect(screen.getAllByText("a.txt")).toHaveLength(1);
+    expect(screen.getByRole("button", { name: "Complete merge" })).toBeDisabled();
+
+    await user.click(within(group).getByRole("button", { name: "Take theirs" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "resolve", {
+        path: "a.txt",
+        side: "theirs",
+      })
+    );
+  });
+
+  it("opens a conflicted file in the conflict view, not the diff", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValue(merging(1));
+    vi.mocked(api.lanes.changes).mockResolvedValue(conflicted);
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "a.txt",
+      rev: "work",
+      lines: ["<<<<<<< HEAD", "mine", "=======", "theirs", ">>>>>>> feat"],
+      truncated: false,
+      binary: false,
+      sha: "s1",
+    } as never);
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={3} />);
+    await user.click(
+      within(await screen.findByTestId("lane-changes-conflicts")).getByText("a.txt")
+    );
+    expect(await screen.findByTestId("lane-conflict-view")).toHaveTextContent("Theirs (feat)");
+    expect(api.lanes.gitFile).toHaveBeenCalledWith(3, "a.txt", "work");
+  });
+
+  it("completes the merge once nothing is conflicted, and aborts only on a second click", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValue(merging(0));
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={3} />);
+
+    await user.click(await screen.findByRole("button", { name: "Complete merge" }));
+    await waitFor(() => expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "merge-commit", {}));
+
+    await user.click(screen.getByRole("button", { name: "Abort merge" }));
+    expect(api.lanes.gitAction).not.toHaveBeenCalledWith(3, "merge-abort", expect.anything());
+    await user.click(screen.getByRole("button", { name: "Click again to abort the merge" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "merge-abort", { confirm: true })
+    );
+  });
 });

client/src/components/lanes/__tests__/LaneConflictView.test.tsx

@@ -0,0 +1,130 @@
+/**
+ * @file Tests for the merge-conflict view: both sides of each block shown
+ * under their own labels, one choice per block with undo, Save only once
+ * every block is chosen — and Save writes the chosen text over the version
+ * opened, then marks the file resolved. Whole-file ours/theirs reuse
+ * `resolve`.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { LaneConflictView } from "../LaneConflictView";
+import { api } from "../../../lib/api";
+
+vi.mock("../../../lib/api", () => ({
+  api: { lanes: { gitFile: vi.fn(), gitSaveFile: vi.fn(), gitAction: vi.fn() } },
+}));
+
+const LINES = [
+  "top",
+  "<<<<<<< HEAD",
+  "mine",
+  "=======",
+  "theirs",
+  ">>>>>>> origin/main",
+  "middle",
+  "<<<<<<< HEAD",
+  "a",
+  "=======",
+  "b",
+  ">>>>>>> origin/main",
+];
+
+beforeEach(() => {
+  vi.mocked(api.lanes.gitFile)
+    .mockReset()
+    .mockResolvedValue({
+      available: true,
+      path: "a.txt",
+      rev: "work",
+      lines: LINES,
+      truncated: false,
+      binary: false,
+      sha: "s1",
+    } as never);
+  vi.mocked(api.lanes.gitSaveFile)
+    .mockReset()
+    .mockResolvedValue({ available: true } as never);
+  vi.mocked(api.lanes.gitAction)
+    .mockReset()
+    .mockResolvedValue({ action: "resolve", ok: true, output: "" });
+});
+
+const blocks = () => screen.getAllByTestId("conflict-block");
+
+describe("LaneConflictView", () => {
+  it("shows both sides under their labels and saves once every block is chosen", async () => {
+    const user = userEvent.setup();
+    const onResolved = vi.fn();
+    render(<LaneConflictView laneId={3} path="a.txt" onResolved={onResolved} onEdit={vi.fn()} />);
+
+    const [first, second] = (await screen.findAllByTestId("conflict-block")) as [
+      HTMLElement,
+      HTMLElement,
+    ];
+    expect(first).toHaveTextContent("Mine (HEAD)");
+    expect(first).toHaveTextContent("Theirs (origin/main)");
+    const save = screen.getByRole("button", { name: "Save and mark resolved" });
+    expect(save).toBeDisabled();
+
+    await user.click(within(first).getByRole("button", { name: "Keep mine" }));
+    // Chosen: the block is plain text now, with an undo.
+    await user.click(within(blocks()[0]!).getByRole("button", { name: "Undo" }));
+    await user.click(within(blocks()[0]!).getByRole("button", { name: "Take theirs" }));
+    await user.click(within(second).getByRole("button", { name: "Keep both" }));
+    expect(save).toBeEnabled();
+    await user.click(save);
+
+    await waitFor(() =>
+      expect(api.lanes.gitSaveFile).toHaveBeenCalledWith(
+        3,
+        "a.txt",
+        "top\ntheirs\nmiddle\na\nb",
+        "s1"
+      )
+    );
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "resolve", {
+        path: "a.txt",
+        side: "done",
+      })
+    );
+    expect(onResolved).toHaveBeenCalled();
+  });
+
+  it("takes a whole side for the file through resolve", async () => {
+    const user = userEvent.setup();
+    const onResolved = vi.fn();
+    render(<LaneConflictView laneId={3} path="a.txt" onResolved={onResolved} onEdit={vi.fn()} />);
+    await screen.findAllByTestId("conflict-block");
+    await user.click(screen.getByRole("button", { name: "Take all theirs" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "resolve", {
+        path: "a.txt",
+        side: "theirs",
+      })
+    );
+    expect(onResolved).toHaveBeenCalled();
+    expect(api.lanes.gitSaveFile).not.toHaveBeenCalled();
+  });
+
+  it("offers the plain editor when the markers do not balance", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "a.txt",
+      rev: "work",
+      lines: ["<<<<<<< HEAD", "x"],
+      truncated: false,
+      binary: false,
+      sha: "s1",
+    } as never);
+    const user = userEvent.setup();
+    const onEdit = vi.fn();
+    render(<LaneConflictView laneId={3} path="a.txt" onResolved={vi.fn()} onEdit={onEdit} />);
+    await screen.findByText(/markers do not line up/);
+    await user.click(screen.getByRole("button", { name: "Edit by hand" }));
+    expect(onEdit).toHaveBeenCalled();
+  });
+});

client/src/components/lanes/__tests__/LaneDiffView.test.tsx

@@ -3,13 +3,21 @@
  * @description Pins the side-by-side renderer: two independently scrolling
  * columns (a long line must be reachable, not painted over its neighbour)
  * whose horizontal scroll is mirrored, so the two halves of a line stay
- * opposite each other.
+ * opposite each other. Also pins the clamped mirroring (a narrow column may
+ * not drag the wide one back) and the row windowing of large diffs.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
 import { describe, it, expect } from "vitest";
 import { fireEvent, render, screen } from "@testing-library/react";
-import { LaneDiffView } from "../LaneDiffView";
+import {
+  LaneDiffView,
+  LaneFileView,
+  ROW_PX,
+  WINDOW_THRESHOLD,
+  analyseHunk,
+  visibleRange,
+} from "../LaneDiffView";
 import type { LaneChangeFile } from "../../../lib/types";
 
 const FILE: LaneChangeFile = {
@@ -33,6 +41,17 @@ const FILE: LaneChangeFile = {
   ],
 };
 
+/** jsdom has no layout: give a scroller the extents a browser would. */
+function layout(
+  el: HTMLElement,
+  g: { scrollWidth?: number; clientWidth?: number; scrollHeight?: number; clientHeight?: number }
+) {
+  for (const [k, v] of Object.entries(g))
+    Object.defineProperty(el, k, { value: v, configurable: true });
+}
+
+const ROOMY = { scrollWidth: 2000, clientWidth: 200, scrollHeight: 2000, clientHeight: 200 };
+
 describe("LaneDiffView — side by side", () => {
   it("gives each column its own scroller", () => {
     render(<LaneDiffView file={FILE} layout="split" />);
@@ -40,11 +59,28 @@ describe("LaneDiffView — side by side", () => {
     expect(screen.getByTestId("lane-diff-split-right").className).toContain("overflow-auto");
   });
 
-  it("bounds its own height so the horizontal bar stays on screen", () => {
-    // A stacked review list caps each file; the single-file view takes the
-    // height its parent gives it. Either way the diff scrolls itself rather
-    // than growing a 2000-line container whose scrollbar is off the bottom.
+  it("caps a review diff only when it windows; the single-file view fills its parent", () => {
+    // Unwindowed, a review-list diff grows so the PANEL is the one vertical
+    // scroller (nested 60vh boxes made hunk navigation land nowhere); a
+    // windowed one keeps the cap because windowing needs its own scroller.
     const { rerender } = render(<LaneDiffView file={FILE} layout="unified" />);
+    expect(screen.getByTestId("lane-diff-view").className).not.toContain("max-h-[60vh]");
+
+    const big: LaneChangeFile = {
+      ...FILE,
+      hunks: [
+        {
+          ...FILE.hunks![0]!,
+          lines: Array.from({ length: WINDOW_THRESHOLD + 1 }, (_, i) => ({
+            type: "ctx" as const,
+            oldLine: i + 1,
+            newLine: i + 1,
+            text: `line ${i}`,
+          })),
+        },
+      ],
+    };
+    rerender(<LaneDiffView file={big} layout="unified" />);
     expect(screen.getByTestId("lane-diff-view").className).toContain("max-h-[60vh]");
 
     rerender(<LaneDiffView file={FILE} layout="unified" fill />);
@@ -56,6 +92,8 @@ describe("LaneDiffView — side by side", () => {
     render(<LaneDiffView file={FILE} layout="split" />);
     const left = screen.getByTestId("lane-diff-split-left");
     const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, ROOMY);
+    layout(right, ROOMY);
 
     left.scrollLeft = 320;
     fireEvent.scroll(left);
@@ -66,6 +104,55 @@ describe("LaneDiffView — side by side", () => {
     expect(left.scrollLeft).toBe(0);
   });
 
+  it("keeps the split columns on the same row vertically too", () => {
+    render(<LaneDiffView file={FILE} layout="split" />);
+    const left = screen.getByTestId("lane-diff-split-left");
+    const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, ROOMY);
+    layout(right, ROOMY);
+
+    left.scrollTop = 480;
+    fireEvent.scroll(left);
+    expect(right.scrollTop).toBe(480);
+
+    right.scrollTop = 40;
+    fireEvent.scroll(right);
+    expect(left.scrollTop).toBe(40);
+  });
+
+  it("clamps the mirrored offset to the other column's own extent", () => {
+    render(<LaneDiffView file={FILE} layout="split" />);
+    const left = screen.getByTestId("lane-diff-split-left");
+    const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, { scrollWidth: 500, clientWidth: 200, scrollHeight: 300, clientHeight: 200 });
+    layout(right, { scrollWidth: 1000, clientWidth: 200, scrollHeight: 300, clientHeight: 200 });
+
+    right.scrollLeft = 600;
+    right.scrollTop = 250;
+    fireEvent.scroll(right);
+    expect(left.scrollLeft).toBe(300);
+    expect(left.scrollTop).toBe(100);
+  });
+
+  it("does not let the narrow column's clamped echo drag the wide one back", () => {
+    render(<LaneDiffView file={FILE} layout="split" />);
+    const left = screen.getByTestId("lane-diff-split-left");
+    const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, { scrollWidth: 500, clientWidth: 200 });
+    layout(right, { scrollWidth: 1000, clientWidth: 200 });
+
+    right.scrollLeft = 600;
+    fireEvent.scroll(right);
+    // A browser fires the narrow column's scroll for the clamped write.
+    fireEvent.scroll(left);
+    expect(right.scrollLeft).toBe(600);
+
+    // A real move of the narrow column still carries the wide one.
+    left.scrollLeft = 100;
+    fireEvent.scroll(left);
+    expect(right.scrollLeft).toBe(100);
+  });
+
   it("keeps the unified layout on one scroller", () => {
     render(<LaneDiffView file={FILE} layout="unified" />);
     expect(screen.queryByTestId("lane-diff-split-left")).toBeNull();
@@ -158,3 +245,260 @@ describe("LaneDiffView — row styling", () => {
     expect(left!.className).not.toMatch(/status-(success|danger)/);
   });
 });
+
+describe("analyseHunk", () => {
+  const hunk = {
+    header: "@@ -1,4 +1,4 @@",
+    context: "",
+    oldStart: 1,
+    newStart: 1,
+    lines: [
+      { type: "ctx" as const, oldLine: 1, newLine: 1, text: "keep" },
+      { type: "del" as const, oldLine: 2, newLine: null, text: "foo = 1" },
+      { type: "add" as const, oldLine: null, newLine: 2, text: "foo = 2" },
+      { type: "del" as const, oldLine: 3, newLine: null, text: "bar = 1" },
+      { type: "add" as const, oldLine: null, newLine: 3, text: "bar = 2" },
+    ],
+  };
+
+  it("pairs each del/add with its emphasis, keyed by line index", () => {
+    const a = analyseHunk(hunk);
+    expect(a.rows).toHaveLength(3);
+    expect(a.emph.get(1)).toEqual([6, 7]);
+    expect(a.emph.get(2)).toEqual([6, 7]);
+    expect(a.emph.get(3)).toEqual([6, 7]);
+    expect(a.emph.get(4)).toEqual([6, 7]);
+    expect(a.emph.has(0)).toBe(false);
+  });
+
+  it("computes once per hunk, so both split columns and re-renders share it", () => {
+    expect(analyseHunk(hunk)).toBe(analyseHunk(hunk));
+  });
+});
+
+describe("visibleRange", () => {
+  it("covers the viewport plus overscan on both sides", () => {
+    expect(visibleRange(0, 160, 16, 1000, 5)).toEqual({ start: 0, end: 15 });
+    expect(visibleRange(1600, 160, 16, 1000, 5)).toEqual({ start: 95, end: 115 });
+  });
+
+  it("clamps a scrollTop past the content to the last full viewport", () => {
+    expect(visibleRange(99999, 160, 16, 1000, 5)).toEqual({ start: 985, end: 1000 });
+    expect(visibleRange(-50, 160, 16, 1000, 5)).toEqual({ start: 0, end: 15 });
+  });
+
+  it("never runs past a short list", () => {
+    expect(visibleRange(0, 800, 16, 3, 5)).toEqual({ start: 0, end: 3 });
+    expect(visibleRange(0, 800, 16, 0, 5)).toEqual({ start: 0, end: 0 });
+  });
+});
+
+function bigFile(n: number): LaneChangeFile {
+  const lines = Array.from({ length: n }, (_, i) =>
+    i % 2
+      ? { type: "add" as const, oldLine: null, newLine: i + 1, text: `line ${i};` }
+      : { type: "ctx" as const, oldLine: i + 1, newLine: i + 1, text: `line ${i};` }
+  );
+  lines[7] = { type: "ctx", oldLine: 8, newLine: 8, text: `line 7; ${"w".repeat(300)}` };
+  return fileWith(lines);
+}
+
+const rowsIn = (el: HTMLElement) => [...el.querySelectorAll<HTMLElement>("div.flex.w-max")];
+
+describe("LaneDiffView — windowing", () => {
+  it("renders every row below the threshold, with no spacers", () => {
+    const { container } = render(
+      <LaneDiffView file={bigFile(WINDOW_THRESHOLD - 10)} layout="unified" />
+    );
+    expect(rowsIn(container)).toHaveLength(WINDOW_THRESHOLD - 10);
+    expect(container.querySelector("[data-diff-spacer]")).toBeNull();
+  });
+
+  it("renders far fewer rows than a 5000-line diff holds, keeping the full scroll height", () => {
+    const { container } = render(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    const rows = rowsIn(container);
+    expect(rows.length).toBeGreaterThan(0);
+    expect(rows.length).toBeLessThan(300);
+    const spacers = [...container.querySelectorAll<HTMLElement>("[data-diff-spacer]")];
+    const spaced = spacers.reduce((sum, s) => sum + parseFloat(s.style.height), 0);
+    // header + 5000 lines, every item one fixed row tall
+    const rendered = container.querySelectorAll("[data-diff-item]").length;
+    expect(spaced + rendered * ROW_PX).toBe(5001 * ROW_PX);
+  });
+
+  it("moves the window with the scroll", () => {
+    const { container } = render(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    const view = screen.getByTestId("lane-diff-view");
+    expect(container.textContent).not.toContain("line 3000;");
+    view.scrollTop = 3000 * ROW_PX;
+    fireEvent.scroll(view);
+    expect(container.textContent).toContain("line 3000;");
+    expect(container.textContent).not.toContain("line 10;");
+  });
+
+  it("starts windowing where the reader is when a diff grows past the threshold", () => {
+    const { container, rerender } = render(<LaneDiffView file={bigFile(400)} layout="unified" />);
+    const view = screen.getByTestId("lane-diff-view");
+    view.scrollTop = 350 * ROW_PX;
+    fireEvent.scroll(view);
+    // Expanding context replaces the file in place, same mounted view.
+    rerender(<LaneDiffView file={bigFile(600)} layout="unified" />);
+    expect(container.textContent).toContain("line 350;");
+  });
+
+  it("starts from the top again after a round trip through split", () => {
+    const { container, rerender } = render(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    const view = screen.getByTestId("lane-diff-view");
+    view.scrollTop = 3000 * ROW_PX;
+    fireEvent.scroll(view);
+    rerender(<LaneDiffView file={bigFile(5000)} layout="split" />);
+    // In split the outer box is no scroller; the browser drops its offset.
+    screen.getByTestId("lane-diff-view").scrollTop = 0;
+    rerender(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    expect(container.textContent).toContain("line 5;");
+  });
+
+  it("holds the horizontal extent at the longest line, rendered or not", () => {
+    const { container } = render(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    const view = screen.getByTestId("lane-diff-view");
+    view.scrollTop = 3000 * ROW_PX;
+    fireEvent.scroll(view);
+    const content = container.querySelector<HTMLElement>("[data-diff-content]")!;
+    // the 300-w line 7 is off screen now, and still sets the width
+    expect(content.style.minWidth).toContain(`${"line 7; ".length + 300 + 1}ch`);
+  });
+
+  it("windows both split columns over the same row range", () => {
+    render(<LaneDiffView file={bigFile(5000)} layout="split" />);
+    const left = screen.getByTestId("lane-diff-split-left");
+    const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, { scrollHeight: 5001 * ROW_PX, clientHeight: 400 });
+    layout(right, { scrollHeight: 5001 * ROW_PX, clientHeight: 400 });
+    right.scrollTop = 2000 * ROW_PX;
+    fireEvent.scroll(right);
+    expect(left.scrollTop).toBe(2000 * ROW_PX);
+    const l = rowsIn(left);
+    const r = rowsIn(right);
+    expect(l.length).toBeLessThan(300);
+    expect(l).toHaveLength(r.length);
+    expect(right.textContent).toContain("line 2001;");
+    // same rows: the right column's add has its filler row on the left
+    expect(left.textContent).toContain("line 2000;");
+  });
+
+  it("windows a whole-file read too", () => {
+    const lines = Array.from({ length: 5000 }, (_, i) => `row ${i}`);
+    const { container } = render(<LaneFileView path="a.ts" lines={lines} />);
+    expect(rowsIn(container).length).toBeLessThan(300);
+    const view = screen.getByTestId("lane-file-view");
+    view.scrollTop = 4000 * ROW_PX;
+    fireEvent.scroll(view);
+    expect(container.textContent).toContain("row 4000");
+  });
+});
+
+describe("LaneDiffView — hunk review bar navigation", () => {
+  const hunk = (n: number) => ({
+    header: `@@ -${n},1 +${n},1 @@`,
+    context: "",
+    oldStart: n,
+    newStart: n,
+    lines: [
+      { type: "del" as const, oldLine: n, newLine: null, text: `old ${n}` },
+      { type: "add" as const, oldLine: null, newLine: n, text: `new ${n}` },
+    ],
+  });
+  const three: LaneChangeFile = { ...FILE, hunks: [hunk(1), hunk(20), hunk(40)] };
+
+  // jsdom lays nothing out: give the ONE real scroller a scrollable box and
+  // put hunk k's `@@` row k×100px below its top, wherever it has scrolled to.
+  function renderInScroller() {
+    const view = render(
+      <div data-testid="scroller" style={{ overflowY: "auto" }}>
+        <LaneDiffView file={three} layout="unified" hunkActions={() => <span />} />
+      </div>
+    );
+    const scroller = screen.getByTestId("scroller");
+    Object.defineProperty(scroller, "scrollHeight", { value: 1000 });
+    Object.defineProperty(scroller, "clientHeight", { value: 100 });
+    scroller.getBoundingClientRect = () => ({ top: 0 }) as DOMRect;
+    for (const el of view.container.querySelectorAll<HTMLElement>("[data-change-index]")) {
+      const k = Number(el.dataset.changeIndex);
+      el.getBoundingClientRect = () => ({ top: k * 100 - scroller.scrollTop }) as DOMRect;
+    }
+    return scroller;
+  }
+
+  it("steps to the NEXT hunk and back to the PREVIOUS one, not the first", () => {
+    const scroller = renderInScroller();
+    const next = screen.getAllByRole("button", { name: "Next change" });
+    const prev = screen.getAllByRole("button", { name: "Previous change" });
+
+    fireEvent.click(next[0]!); // bar 1 → hunk 2
+    expect(scroller.scrollTop).toBe(100);
+    fireEvent.click(next[1]!); // bar 2 → hunk 3
+    expect(scroller.scrollTop).toBe(200);
+    fireEvent.click(prev[2]!); // bar 3 → hunk 2, not hunk 1
+    expect(scroller.scrollTop).toBe(100);
+  });
+
+  it("counts the hunks and disables the arrows at either end", () => {
+    renderInScroller();
+    const bars = screen.getAllByTestId("lane-hunk-bar");
+    expect(bars.map((b) => b.textContent)).toEqual([
+      expect.stringContaining("1 of 3"),
+      expect.stringContaining("2 of 3"),
+      expect.stringContaining("3 of 3"),
+    ]);
+    expect(screen.getAllByRole("button", { name: "Previous change" })[0]).toBeDisabled();
+    expect(screen.getAllByRole("button", { name: "Next change" })[2]).toBeDisabled();
+  });
+
+  it("hangs one bar under EACH +/- block of a single hunk, in both layouts (#50)", () => {
+    const merged: LaneChangeFile = {
+      ...FILE,
+      hunks: [
+        {
+          header: "@@ -1,6 +1,6 @@",
+          context: "",
+          oldStart: 1,
+          newStart: 1,
+          lines: [
+            { type: "del" as const, oldLine: 1, newLine: null, text: "a" },
+            { type: "add" as const, oldLine: null, newLine: 1, text: "A" },
+            { type: "ctx" as const, oldLine: 2, newLine: 2, text: "b" },
+            { type: "del" as const, oldLine: 3, newLine: null, text: "c" },
+            { type: "ctx" as const, oldLine: 4, newLine: 3, text: "d" },
+            { type: "add" as const, oldLine: null, newLine: 4, text: "E" },
+            { type: "ctx" as const, oldLine: 5, newLine: 5, text: "f" },
+          ],
+        },
+      ],
+    };
+    const seen: number[] = [];
+    for (const layout of ["unified", "split"] as const) {
+      const { unmount } = render(
+        <LaneDiffView
+          file={merged}
+          layout={layout}
+          hunkActions={(c) => {
+            seen.push(c.block);
+            return <span />;
+          }}
+        />
+      );
+      expect(screen.getAllByTestId("lane-hunk-bar").map((b) => b.textContent)).toEqual([
+        expect.stringContaining("1 of 3"),
+        expect.stringContaining("2 of 3"),
+        expect.stringContaining("3 of 3"),
+      ]);
+      unmount();
+    }
+    expect(seen).toEqual([0, 1, 2, 0, 1, 2]);
+  });
+
+  it("leaves an unwindowed review diff uncapped, so the panel is its only scroller", () => {
+    render(<LaneDiffView file={three} layout="unified" />);
+    expect(screen.getByTestId("lane-diff-view").className).not.toContain("max-h-[60vh]");
+  });
+});

client/src/components/lanes/__tests__/LaneGitBar.test.tsx

@@ -1,8 +1,9 @@
 /**
  * @file LaneGitBar.test.tsx
  * @description Pins the lane git action row: the ahead/behind readout, which
- * buttons a repo with no remote may press, that commit sends the typed
- * message, that a dirty tree blocks the branch switch client-side (the server
+ * buttons a repo with no remote may press (and that it may publish to a typed URL),
+ * what an unborn repo and a branch with no upstream show, that it offers no commit (the
+ * Changes panel's staged-only box owns that), that a dirty tree blocks the branch switch client-side (the server
  * refuses it too), and that a failed action shows git's own words rather than
  * a generic sentence.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -24,6 +25,7 @@ function facts(over: Partial<Extract<LaneGitFacts, { available: true }>> = {}):
     available: true,
     branch: "feat/thing",
     head: "9b3e74a",
+    unborn: false,
     subject: "wip",
     dirty: 2,
     untracked: 1,
@@ -70,28 +72,72 @@ describe("LaneGitBar", () => {
     );
     expect(screen.getByRole("button", { name: /Fetch/ })).toBeDisabled();
     expect(screen.getByRole("button", { name: /Push/ })).toBeDisabled();
-    // Local actions stay available — a repo with no remote still commits.
-    expect(screen.getByRole("button", { name: /^Commit$/ })).toBeEnabled();
+    // Local actions stay available — a repo with no remote still branches.
+    expect(screen.getByRole("button", { name: /Branch/ })).toBeEnabled();
   });
 
-  it("commits with the typed message and reports the change upward", async () => {
+  it("offers no commit at all — that is the Changes panel's staged-only box", () => {
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    expect(screen.queryByRole("button", { name: /Commit/ })).toBeNull();
+  });
+
+  it("shows an unborn repo's branch and asks for a first commit instead of a push", () => {
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={facts({
+          branch: "main",
+          head: null,
+          unborn: true,
+          subject: "",
+          hasRemote: false,
+          upstream: null,
+          ahead: null,
+          behind: null,
+        })}
+        onChanged={vi.fn()}
+      />
+    );
+    expect(screen.getByTestId("lane-git-bar")).toHaveTextContent("no commits yet");
+    expect(screen.getByText(/Commit first, then publish/)).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: /Fetch|Pull|Push|Publish/ })).toBeNull();
+  });
+
+  it("publishes a repo with no remote to a typed URL", async () => {
     const user = userEvent.setup();
     const onChanged = vi.fn();
-    render(<LaneGitBar laneId={3} git={facts()} onChanged={onChanged} />);
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={facts({ hasRemote: false, upstream: null, ahead: null, behind: null })}
+        onChanged={onChanged}
+      />
+    );
 
-    await user.click(screen.getByRole("button", { name: /^Commit$/ }));
-    await user.type(screen.getByLabelText("Commit message"), "fix: the thing");
-    await user.click(screen.getByRole("button", { name: /Commit 3 files/ }));
+    await user.click(screen.getByRole("button", { name: "Publish…" }));
+    await user.type(screen.getByLabelText(/Remote URL/), "git@host:owner/repo.git");
+    await user.click(screen.getByRole("button", { name: "Publish" }));
 
     await waitFor(() =>
-      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "commit", { message: "fix: the thing" })
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "publish", {
+        url: "git@host:owner/repo.git",
+      })
     );
     expect(onChanged).toHaveBeenCalled();
   });
 
-  it("offers no commit when nothing is uncommitted", () => {
-    render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
-    expect(screen.getByRole("button", { name: /^Commit$/ })).toBeDisabled();
+  it("calls a first push of a branch with no upstream 'Publish branch'", async () => {
+    const user = userEvent.setup();
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={facts({ upstream: null, ahead: null, behind: null })}
+        onChanged={vi.fn()}
+      />
+    );
+    expect(screen.queryByRole("button", { name: /^Push$/ })).toBeNull();
+    await user.click(screen.getByRole("button", { name: "Publish branch" }));
+    await waitFor(() => expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "push", {}));
   });
 
   it("loads the branch list on demand and refuses to switch while dirty", async () => {
@@ -120,6 +166,15 @@ describe("LaneGitBar", () => {
     );
   });
 
+  it("re-reads the branch list after a switch, so the branch just left is not held", async () => {
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await user.click(screen.getByRole("button", { name: "Switch branch" }));
+    await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledTimes(2));
+  });
+
   it("creates a branch without switching, then offers a sibling lane on it", async () => {
     const user = userEvent.setup();
     const onNewLane = vi.fn();
@@ -146,20 +201,32 @@ describe("LaneGitBar", () => {
     expect(onNewLane).toHaveBeenCalledWith("development");
   });
 
-  it("commits only the index when asked", async () => {
+  it("offers a sibling lane only on a branch no worktree holds — the server refuses the rest", async () => {
+    vi.mocked(api.lanes.gitBranches).mockResolvedValue({
+      available: true,
+      branches: ["development", "feat/thing", "feat/free"],
+      current: "feat/thing",
+      worktrees: [
+        { path: "/repo/lane3", branch: "feat/thing" },
+        { path: "/repo/dev", branch: "development" },
+      ],
+    });
     const user = userEvent.setup();
-    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} onNewLane={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    const select = await screen.findByLabelText("Switch branch…");
+    const newLane = () => screen.getByRole("button", { name: "New lane here" });
 
-    await user.click(screen.getByRole("button", { name: /^Commit$/ }));
-    await user.type(screen.getByLabelText(/Commit message/), "fix: staged only");
-    await user.click(screen.getByRole("button", { name: "Commit staged" }));
+    // This lane's own branch: its worktree is this lane.
+    await user.selectOptions(select, "feat/thing");
+    expect(newLane()).toBeDisabled();
+    // Held by another worktree: git allows one worktree per branch (EBRANCHBUSY).
+    await user.selectOptions(select, "development");
+    expect(newLane()).toBeDisabled();
+    expect(newLane()).toHaveAttribute("title", expect.stringContaining("/repo/dev"));
 
-    await waitFor(() =>
-      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "commit", {
-        message: "fix: staged only",
-        only: "staged",
-      })
-    );
+    await user.selectOptions(select, "feat/free");
+    expect(newLane()).toBeEnabled();
   });
 
   it("prints git's own rejection text when an action fails", async () => {
@@ -172,4 +239,168 @@ describe("LaneGitBar", () => {
     await user.click(screen.getByRole("button", { name: /Push/ }));
     expect(await screen.findByTestId("lane-git-bar-error")).toHaveTextContent("non-fast-forward");
   });
+
+  it("re-reads the branch list for the new lane instead of showing the old one's", async () => {
+    const user = userEvent.setup();
+    const { rerender } = render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+
+    rerender(<LaneGitBar laneId={4} git={facts()} onChanged={vi.fn()} />);
+    expect(screen.queryByLabelText("Switch branch…")).toBeNull();
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledWith(4));
+    expect(await screen.findByLabelText("Switch branch…")).toHaveValue("");
+  });
+
+  it("sends one branch-create for a double Enter", async () => {
+    vi.mocked(api.lanes.gitAction).mockReturnValue(new Promise(() => {}));
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await user.type(await screen.findByLabelText(/New branch/), "feat/once{Enter}{Enter}");
+    expect(api.lanes.gitAction).toHaveBeenCalledTimes(1);
+  });
+
+  it("forgets which branches the previous lane's worktrees held once the lane changes", async () => {
+    let resolveOld: (v: Awaited<ReturnType<typeof api.lanes.gitBranches>>) => void = () => {};
+    vi.mocked(api.lanes.gitBranches).mockReturnValueOnce(
+      new Promise((r) => {
+        resolveOld = r;
+      })
+    );
+    const user = userEvent.setup();
+    const { rerender } = render(
+      <LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} onNewLane={vi.fn()} />
+    );
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+
+    rerender(<LaneGitBar laneId={4} git={facts()} onChanged={vi.fn()} onNewLane={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    const select = await screen.findByLabelText("Switch branch…");
+    await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledWith(4));
+    // Lane 3's answer lands late: its worktree held `development`.
+    resolveOld({
+      available: true,
+      branches: ["development", "feat/thing"],
+      current: "feat/thing",
+      worktrees: [{ path: "/repo/dev", branch: "development" }],
+    });
+    await user.selectOptions(select, "development");
+    const newLane = screen.getByRole("button", { name: "New lane here" });
+    expect(newLane).toBeEnabled();
+    expect(newLane).not.toHaveAttribute("title", expect.stringContaining("/repo/dev"));
+  });
+
+  it("claims no sync state when the upstream comparison could not be counted", () => {
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={facts({ upstream: "origin/gone", ahead: null, behind: null })}
+        onChanged={vi.fn()}
+      />
+    );
+    expect(screen.queryByText("in sync")).toBeNull();
+    expect(screen.queryByTestId("lane-git-tracking")).toBeNull();
+  });
+
+  it("explains a push with nowhere to go instead of the server's generic text", async () => {
+    const user = userEvent.setup();
+    vi.mocked(api.lanes.gitAction).mockRejectedValue(
+      Object.assign(new Error("this repository has no remote to push to"), { code: "ENOREMOTE" })
+    );
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Push/ }));
+    expect(await screen.findByTestId("lane-git-bar-error")).toHaveTextContent(
+      "No remote to push to or pull from"
+    );
+  });
+});
+
+describe("git login (issue #45)", () => {
+  const authErr = (rejected = false) =>
+    Object.assign(new Error("git.smartgift.io.vn needs a username and password or access token"), {
+      code: "EGITAUTH",
+      auth: { protocol: "https", host: "git.smartgift.io.vn", username: "vi", rejected },
+    });
+
+  it("asks for a login when git needs one, then resends the same action with it", async () => {
+    vi.mocked(api.lanes.gitAction).mockRejectedValueOnce(authErr());
+    const user = userEvent.setup();
+    const onChanged = vi.fn();
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={onChanged} />);
+
+    await user.click(screen.getByRole("button", { name: /Push/ }));
+    const form = await screen.findByTestId("lane-git-login");
+    expect(form).toHaveTextContent("git.smartgift.io.vn");
+    expect(screen.getByLabelText("Username")).toHaveValue("vi");
+    expect(screen.getByLabelText(/Remember for everyone/)).toBeChecked();
+    await user.type(screen.getByLabelText("Password or access token"), "s3cret");
+    await user.click(screen.getByRole("button", { name: "Log in and retry" }));
+
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenLastCalledWith(3, "push", {
+        credentials: {
+          protocol: "https",
+          host: "git.smartgift.io.vn",
+          username: "vi",
+          password: "s3cret",
+          remember: true,
+        },
+      })
+    );
+    await waitFor(() => expect(screen.queryByTestId("lane-git-login")).toBeNull());
+    expect(onChanged).toHaveBeenCalled();
+    expect(document.body.textContent).not.toContain("s3cret");
+  });
+
+  it("says the login was wrong when the host rejected it, and keeps the form", async () => {
+    vi.mocked(api.lanes.gitAction)
+      .mockRejectedValueOnce(authErr())
+      .mockRejectedValueOnce(authErr(true));
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Fetch/ }));
+    await user.type(await screen.findByLabelText("Password or access token"), "bad");
+    await user.click(screen.getByRole("button", { name: "Log in and retry" }));
+    expect(await screen.findByTestId("lane-git-login")).toHaveTextContent(/rejected/i);
+    expect(screen.getByLabelText("Password or access token")).toHaveValue("");
+  });
+});
+
+describe("merge (issue #45)", () => {
+  it("merges the picked branch into the current one after a confirm", async () => {
+    const confirm = vi.spyOn(window, "confirm").mockReturnValue(true);
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await user.click(screen.getByRole("button", { name: "Merge into current" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "merge", { branch: "development" })
+    );
+    confirm.mockRestore();
+  });
+
+  it("offers to merge the upstream when the branch has diverged", async () => {
+    vi.spyOn(window, "confirm").mockReturnValue(true);
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: "Merge origin/feat/thing" }));
+    await waitFor(() =>
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "merge", { branch: "origin/feat/thing" })
+    );
+  });
+
+  it("disables pull and switch while a merge is in progress", () => {
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={{ ...facts(), merging: true, conflicts: 1 } as LaneGitFacts}
+        onChanged={vi.fn()}
+      />
+    );
+    expect(screen.getByRole("button", { name: /Pull/ })).toBeDisabled();
+    expect(screen.getByRole("button", { name: /Branch/ })).toBeDisabled();
+  });
 });

client/src/components/lanes/__tests__/LaneGitHeader.test.tsx

@@ -0,0 +1,160 @@
+/**
+ * @file LaneGitHeader.test.tsx
+ * @description Pins the Changes panel's working-copy line: the live branch,
+ * head, subject and uncommitted counts, the per-file hover panel behind the
+ * counts, that a lane switch drops the previous lane's facts at once, and that
+ * an unreadable repo renders nothing rather than an error.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, waitFor, fireEvent } from "@testing-library/react";
+import { LaneGitHeader, useLaneGitFacts } from "../LaneGitHeader";
+import { api } from "../../../lib/api";
+
+vi.mock("../../../lib/api", () => ({
+  api: { lanes: { git: vi.fn(), gitAction: vi.fn(), gitBranches: vi.fn() } },
+}));
+
+beforeEach(() => {
+  vi.mocked(api.lanes.git).mockReset().mockResolvedValue({ available: false });
+});
+
+/** The panel's own wiring: one facts read feeding the header. */
+function Harness({ laneId }: { laneId: number }) {
+  const [git, refresh] = useLaneGitFacts(laneId);
+  return <LaneGitHeader laneId={laneId} git={git} onChanged={refresh} />;
+}
+
+describe("LaneGitHeader", () => {
+  const facts = {
+    available: true as const,
+    branch: "feat/rename-metric",
+    head: "9b3e74a",
+    subject: "free-text rule mode in the form",
+    dirty: 2,
+    untracked: 1,
+    files: [
+      { path: "server/lib/alerts.js", status: " M", added: 12, deleted: 3 },
+      { path: "client/src/lib/api.ts", status: "M ", added: 1, deleted: 0 },
+      { path: "scratch.txt", status: "??", added: null, deleted: null },
+    ],
+    // Tracking facts ride along on the same endpoint; a branch that has never
+    // been pushed reports nulls rather than zeros.
+    hasRemote: true,
+    upstream: null,
+    ahead: null,
+    behind: null,
+  };
+
+  it("renders the live branch, head, subject and uncommitted counts", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
+    render(<Harness laneId={1} />);
+
+    const block = await screen.findByTestId("lane-git");
+    expect(block.textContent).toContain("feat/rename-metric");
+    expect(block.textContent).toContain("9b3e74a");
+    expect(block.textContent).toContain("free-text rule mode in the form");
+    expect(screen.getByTestId("lane-git-counts").textContent).toContain("2");
+  });
+
+  it("drops the previous lane's facts the moment the lane changes", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
+    const { rerender } = render(<Harness laneId={1} />);
+    await screen.findByText(/feat\/rename-metric/);
+
+    // The next lane's read never lands: nothing of lane 1's git may linger.
+    vi.mocked(api.lanes.git).mockReturnValueOnce(new Promise(() => {}));
+    rerender(<Harness laneId={2} />);
+    expect(screen.queryByText(/feat\/rename-metric/)).toBeNull();
+  });
+
+  it("names the files behind the counts on hover, with each one's line delta", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
+    render(<Harness laneId={1} />);
+
+    const counts = await screen.findByTestId("lane-git-counts");
+    // Hidden until asked for: the row is a one-line summary until you hover.
+    expect(screen.queryByTestId("lane-git-files")).toBeNull();
+
+    fireEvent.mouseEnter(counts);
+    const panel = screen.getByTestId("lane-git-files");
+    expect(panel.textContent).toContain("alerts.js");
+    expect(panel.textContent).toContain("+12");
+    expect(panel.textContent).toContain("−3");
+    // Totals across the listed files.
+    expect(panel.textContent).toContain("+13");
+    // An untracked file has no delta to report and says so rather than "+0".
+    expect(panel.textContent).toContain("new");
+    expect(panel.textContent).toContain("3 files changed");
+
+    // Closing is delayed so the pointer can travel into the panel and scroll
+    // it — the panel is portalled to the body, away from its trigger.
+    fireEvent.mouseLeave(counts);
+    expect(screen.queryByTestId("lane-git-files")).not.toBeNull();
+    await waitFor(() => expect(screen.queryByTestId("lane-git-files")).toBeNull());
+  });
+
+  it("stays open while the pointer is inside the panel", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
+    render(<Harness laneId={1} />);
+
+    const counts = await screen.findByTestId("lane-git-counts");
+    fireEvent.mouseEnter(counts);
+    fireEvent.mouseLeave(counts);
+    // The pointer landed on the panel before the pending close fired.
+    fireEvent.mouseEnter(screen.getByTestId("lane-git-files"));
+    await new Promise((r) => setTimeout(r, 200));
+    expect(screen.queryByTestId("lane-git-files")).not.toBeNull();
+
+    fireEvent.mouseLeave(screen.getByTestId("lane-git-files"));
+    await waitFor(() => expect(screen.queryByTestId("lane-git-files")).toBeNull());
+  });
+
+  it("says how many files the server-side cap left out", async () => {
+    // 40 uncommitted files, 3 listed: the counts are exact, the listing is not.
+    vi.mocked(api.lanes.git).mockResolvedValueOnce({ ...facts, dirty: 39, untracked: 1 });
+    render(<Harness laneId={1} />);
+
+    fireEvent.mouseEnter(await screen.findByTestId("lane-git-counts"));
+    expect(screen.getByTestId("lane-git-files").textContent).toContain("37 more");
+  });
+
+  it("omits the uncommitted line when the tree is clean", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce({ ...facts, dirty: 0, untracked: 0 });
+    render(<Harness laneId={1} />);
+    const block = await screen.findByTestId("lane-git");
+    expect(block.textContent).not.toContain("modified");
+  });
+
+  it("renders nothing and no error when git is unavailable", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce({ available: false });
+    render(<Harness laneId={2} />);
+
+    await waitFor(() => expect(api.lanes.git).toHaveBeenCalledWith(2));
+    expect(screen.queryByTestId("lane-git-header")).toBeNull();
+  });
+
+  it("swallows a rejected request instead of surfacing an error", async () => {
+    vi.mocked(api.lanes.git).mockRejectedValueOnce(new Error("network down"));
+    render(<Harness laneId={3} />);
+
+    await waitFor(() => expect(api.lanes.git).toHaveBeenCalledWith(3));
+    expect(screen.queryByTestId("lane-git")).toBeNull();
+    expect(screen.queryByText(/network down/)).toBeNull();
+  });
+
+  it("stops polling once the panel unmounts", async () => {
+    vi.useFakeTimers();
+    try {
+      vi.mocked(api.lanes.git).mockResolvedValue({ available: false });
+      const { unmount } = render(<Harness laneId={1} />);
+      expect(api.lanes.git).toHaveBeenCalledTimes(1);
+      unmount();
+      vi.advanceTimersByTime(120_000);
+      expect(api.lanes.git).toHaveBeenCalledTimes(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});

client/src/components/run/LaneConsolePane.tsx

@@ -16,8 +16,9 @@
  * and its live tmux session — instead of leaving the previous lane's terminal
  * on screen under a new lane's header.
  *
- * A lane's pane is one tmux session, so starting or resuming into a lane
- * already holding a live run answers 409 ERUNLIVE rather than overwriting a
+ * Each pane is one tmux session on its lane — split panes all show the same
+ * lane, pane `slot` N owning `agenthub-lane-<id>[-N]` — so starting or resuming
+ * into a pane already holding a live run answers 409 ERUNLIVE rather than overwriting a
  * prompt in flight — `onStartFromSetup` and `onResumeFromHistory` both catch
  * that and attach to the still-live session instead of failing outright
  * (with a notice explaining what happened), since that session is still
@@ -27,7 +28,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-import { useCallback, useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Play, AlertCircle } from "lucide-react";
 import { api } from "../../lib/api";
@@ -43,10 +44,25 @@ import type {
   CodexApproval,
 } from "../../lib/api";
 import type { Session, Lane, LaneTool } from "../../lib/types";
+import { LANE_TOOL_LABEL } from "../../lib/types";
 import { TerminalView } from "./TerminalView";
 import { RunSetup } from "./RunSetup";
 import { ActiveRunsSwitcher } from "./RunHistory";
 
+/** The claude lane a session's cwd belongs to: the longest path-boundary
+ *  prefix, the same rule the server binds hook sessions with. External
+ *  sessions are all claude — Codex emits no hooks. */
+function owningLaneId(cwd: string, lanes: Lane[]): number | null {
+  let best: Lane | null = null;
+  for (const l of lanes) {
+    if (l.tool !== "claude") continue;
+    const root = l.cwd.replace(/\/+$/, "");
+    if (cwd !== root && !cwd.startsWith(root + "/")) continue;
+    if (!best || root.length > best.cwd.replace(/\/+$/, "").length) best = l;
+  }
+  return best?.id ?? null;
+}
+
 export interface LaneConsolePaneProps {
   lanes: Lane[];
   laneId: number | null;
@@ -62,6 +78,19 @@ export interface LaneConsolePaneProps {
   wsConnected: boolean;
   defaultCwd?: string;
   onHasActiveRunChange?: (active: boolean) => void;
+  /** Which split pane this is. Every pane shows the SAME lane, each in its own
+   *  tmux session: slot 0 is the lane's own, 1–3 are `agenthub-lane-<id>-<slot>`. */
+  slot?: number;
+  /** Runs the OTHER panes are showing — left out of this pane's Active runs so
+   *  one terminal is never attached twice side by side. */
+  hiddenRunIds?: string[];
+  /** Reports the run this pane shows (null on the setup form). */
+  onHandleChange?: (runId: string | null) => void;
+}
+
+/** The tmux session a lane's split pane owns (see server/lib/pty-run.js). */
+function paneRunId(laneId: number, slot: number): string {
+  return slot ? `agenthub-lane-${laneId}-${slot}` : `agenthub-lane-${laneId}`;
 }
 
 export function LaneConsolePane({
@@ -77,6 +106,9 @@ export function LaneConsolePane({
   wsConnected,
   defaultCwd,
   onHasActiveRunChange,
+  slot = 0,
+  hiddenRunIds,
+  onHandleChange,
 }: LaneConsolePaneProps) {
   const { t } = useTranslation("run");
   const { t: tLanes } = useTranslation("lanes");
@@ -97,12 +129,37 @@ export function LaneConsolePane({
 
   const currentLane = laneId !== null ? lanes.find((l) => l.id === laneId) : null;
   const laneTool = currentLane?.tool ?? "claude";
-  const toolLabel = laneTool === "codex" ? "Codex" : "Claude";
+  // The page polls runs and sessions for EVERY lane; this pane's Active runs
+  // list is this lane's only. No lane selected keeps the full lists.
+  const laneRuns = useMemo(
+    () =>
+      laneId === null || !activeRuns
+        ? activeRuns
+        : {
+            ...activeRuns,
+            items: activeRuns.items.filter(
+              (r) => r.laneId === laneId && !hiddenRunIds?.includes(r.id)
+            ),
+          },
+    [activeRuns, laneId, hiddenRunIds]
+  );
+  const laneSessions = useMemo(
+    () =>
+      laneId === null
+        ? externalSessions
+        : (externalSessions ?? []).filter((s) => s.cwd && owningLaneId(s.cwd, lanes) === laneId),
+    [externalSessions, laneId, lanes]
+  );
+  const toolLabel = LANE_TOOL_LABEL[laneTool];
 
   useEffect(() => {
     onHasActiveRunChange?.(handle !== null);
   }, [handle, onHasActiveRunChange]);
 
+  useEffect(() => {
+    onHandleChange?.(handle?.id ?? null);
+  }, [handle, onHandleChange]);
+
   useEffect(() => {
     if (!currentLane && defaultCwd && cwd === "") {
       setCwd(defaultCwd);
@@ -141,10 +198,11 @@ export function LaneConsolePane({
     setResumeSession(null);
     setError(null);
     setBusy(null);
-    setHandle(runs?.items.find((r) => r.laneId === laneId && r.status === "running") ?? null);
+    const own = laneId === null ? null : paneRunId(laneId, slot);
+    setHandle(runs?.items.find((r) => r.id === own && r.status === "running") ?? null);
     autoAttachedForLane.current = null;
     refreshList();
-  }, [laneId, refreshList]);
+  }, [laneId, slot, refreshList]);
 
   // Picking a pipeline template writes NOTHING into the prompt box: a prefilled
   // slash command (or the codex stage-checklist prose) is sent as soon as the
@@ -161,12 +219,13 @@ export function LaneConsolePane({
   useEffect(() => {
     if (handle || laneId === null) return;
     if (autoAttachedForLane.current === laneId) return;
-    const running = activeRuns?.items.find((r) => r.laneId === laneId && r.status === "running");
+    const own = paneRunId(laneId, slot);
+    const running = activeRuns?.items.find((r) => r.id === own && r.status === "running");
     if (running) {
       autoAttachedForLane.current = laneId;
       setHandle(running);
     }
-  }, [activeRuns, laneId, handle]);
+  }, [activeRuns, laneId, slot, handle]);
 
   // The cwd tracks the lane's own folder separately, keyed on the resolved
   // path rather than on `laneId` alone: the pane can mount before the lane
@@ -245,6 +304,7 @@ export function LaneConsolePane({
         let laneStartResult;
         try {
           laneStartResult = await api.lanes.action(targetLaneId, "start", {
+            slot,
             prompt: args.initialPrompt || "",
             model: args.model || undefined,
             permissionMode: args.permissionMode,
@@ -259,29 +319,27 @@ export function LaneConsolePane({
           // already has a live run"), never the literal strings "409" or
           // "ERUNLIVE" — matching against `.message` here is dead code that
           // always falls through to the raw error below.
+          // This pane's own session is the live one — land on it.
           if ((laneErr as { code?: string })?.code === "ERUNLIVE") {
-            const fresh = await api.lanes.list().catch(() => null);
-            const updatedLane = fresh?.lanes.find((l) => l.id === targetLaneId);
-            if (updatedLane?.run_id) {
-              await attachToRun(updatedLane.run_id);
-              setError(t("errors.attachedToLiveInstead"));
-              return;
-            }
+            await attachToRun(paneRunId(targetLaneId, slot));
+            setError(t("errors.attachedToLiveInstead"));
+            return;
           }
           throw laneErr;
         }
 
-        if (!laneStartResult.lane?.run_id) {
+        const startedId = laneStartResult.run_id ?? laneStartResult.lane?.run_id;
+        if (!startedId) {
           throw new Error(t("errors.noRunIdReturned"));
         }
 
         try {
-          const fetched = await api.run.get(laneStartResult.lane.run_id);
+          const fetched = await api.run.get(startedId);
           setHandle(fetched);
           refreshList();
         } catch {
           try {
-            await attachToRun(laneStartResult.lane.run_id);
+            await attachToRun(startedId);
             refreshList();
           } catch (fallbackErr: unknown) {
             const attachMsg = fallbackErr instanceof Error ? fallbackErr.message : "unknown";
@@ -295,7 +353,18 @@ export function LaneConsolePane({
         setBusy(null);
       }
     },
-    [busy, t, lanes, laneId, laneTool, onLaneIdChange, onLaneCreated, attachToRun, refreshList]
+    [
+      busy,
+      t,
+      lanes,
+      laneId,
+      laneTool,
+      slot,
+      onLaneIdChange,
+      onLaneCreated,
+      attachToRun,
+      refreshList,
+    ]
   );
 
   const onResumeFromHistory = useCallback(
@@ -323,6 +392,7 @@ export function LaneConsolePane({
           let laneStartResult;
           try {
             laneStartResult = await api.lanes.action(targetLaneId, "start", {
+              slot,
               prompt: "",
               model: item.model || undefined,
               permissionMode: item.permission_mode || undefined,
@@ -337,23 +407,20 @@ export function LaneConsolePane({
             // — the server's `.message` is prose, never the literal string
             // "ERUNLIVE" or "409".
             if ((laneErr as { code?: string })?.code === "ERUNLIVE") {
-              const fresh = await api.lanes.list().catch(() => null);
-              const updatedLane = fresh?.lanes.find((l) => l.id === targetLaneId);
-              if (updatedLane?.run_id) {
-                onLaneIdChange(targetLaneId);
-                await attachToRun(updatedLane.run_id);
-                setError(t("errors.attachedToLiveInstead"));
-                return;
-              }
+              onLaneIdChange(targetLaneId);
+              await attachToRun(paneRunId(targetLaneId, slot));
+              setError(t("errors.attachedToLiveInstead"));
+              return;
             }
             throw laneErr;
           }
 
-          if (!laneStartResult.lane?.run_id) {
+          const startedId = laneStartResult.run_id ?? laneStartResult.lane?.run_id;
+          if (!startedId) {
             throw new Error("No run_id returned from lane start");
           }
 
-          fetched = await api.run.get(laneStartResult.lane.run_id);
+          fetched = await api.run.get(startedId);
           onLaneIdChange(targetLaneId);
         } else {
           fetched = await api.run.start({
@@ -377,7 +444,7 @@ export function LaneConsolePane({
         setBusy(null);
       }
     },
-    [busy, refreshList, t, lanes, onLaneCreated, onLaneIdChange, attachToRun]
+    [busy, refreshList, t, lanes, slot, onLaneCreated, onLaneIdChange, attachToRun]
   );
 
   const onViewFromHistory = useCallback(
@@ -487,11 +554,11 @@ export function LaneConsolePane({
           </p>
         </div>
         <ActiveRunsSwitcher
-          activeRuns={activeRuns}
+          activeRuns={laneRuns}
           currentHandleId={handle?.id || null}
           onAttach={attachToRun}
           runHistory={runHistory}
-          externalSessions={externalSessions}
+          externalSessions={laneSessions}
           onResumeFromHistory={onResumeFromHistory}
           onViewFromHistory={onViewFromHistory}
           onKill={killRun}
@@ -502,7 +569,12 @@ export function LaneConsolePane({
       {binaryStatus && !binaryStatus[laneTool]?.found && (
         <div className="rounded-lg border border-status-danger/40 bg-status-danger/10 px-4 py-3 text-sm text-status-danger flex items-center gap-2">
           <AlertCircle className="w-4 h-4 flex-shrink-0" />
-          <span>{t("binary.missing", { cli: laneTool, tool: toolLabel })}</span>
+          <span>
+            {t("binary.missing", {
+              cli: laneTool === "antigravity" ? "agy" : laneTool,
+              tool: toolLabel,
+            })}
+          </span>
         </div>
       )}
 

client/src/components/run/RunHistory.tsx

@@ -14,7 +14,7 @@
  *
  * `externalSessions` (active Claude Code sessions this dashboard did NOT spawn —
  * e.g. `claude` started by hand in a terminal tab) are merged in as live rows so
- * "Active runs" counts everything actually running. They carry no tmux session
+ * "Active runs" counts everything actually running in scope. They carry no tmux session
  * the dashboard can attach to, so their only action is Resume, which spawns a
  * fresh tmux-backed `claude --resume <session>` in that cwd — Kill is withheld
  * from them for the same reason.

client/src/components/run/RunSetup.tsx

@@ -53,30 +53,215 @@ import type {
   RunStartArgs,
   CodexSandbox,
   CodexApproval,
+  CcMdItem,
 } from "../../lib/api";
 import type { Session, LaneTool } from "../../lib/types";
+import { LANE_TOOL_LABEL } from "../../lib/types";
 import { Select } from "../Select";
 
-// Minimal SlashCommand type (from deleted RunConsole)
 export interface SlashCommand {
   name: string;
-  source: "project" | "user" | "plugin" | "builtin";
+  source: "project" | "user" | "builtin";
   description?: string;
 }
 
-// Minimal PromptEditor component (from deleted RunConsole)
+// Commands the CLI answers itself. They are typed into the pane like any
+// other text, so they do run — they are just not files anyone can list.
+const BUILTIN_SLASH_COMMANDS: SlashCommand[] = [
+  "help",
+  "clear",
+  "compact",
+  "config",
+  "model",
+  "memory",
+  "hooks",
+  "cost",
+  "agents",
+  "review",
+  "permissions",
+  "status",
+  "init",
+  "mcp",
+  "plugin",
+  "output-style",
+  "exit",
+].map((name) => ({ name, source: "builtin" }));
+
+const SOURCE_ORDER = { project: 0, user: 1, builtin: 2 } as const;
+const SOURCE_TONE: Record<SlashCommand["source"], string> = {
+  project: "text-status-success border-status-success/40",
+  user: "text-accent border-accent/40",
+  builtin: "text-fg-muted border-border",
+};
+
+/** Tiered match: exact > prefix > word prefix > substring > subsequence >
+ *  description (3+ chars only, so one keystroke drags nothing tangential in). */
+function scoreSlashMatch(name: string, description: string | undefined, q: string): number {
+  if (!q) return 1;
+  const n = name.toLowerCase();
+  if (n === q) return 1000;
+  if (n.startsWith(q)) return 800 - Math.min(n.length, 100);
+  if (n.split(/[-_.:\s]/).some((p) => p.startsWith(q))) return 600 - Math.min(n.length, 100);
+  const idx = n.indexOf(q);
+  if (idx >= 0) return 400 - Math.min(idx, 100);
+  let i = 0;
+  for (let k = 0; k < n.length && i < q.length; k++) if (n[k] === q[i]) i++;
+  if (i === q.length) return 200;
+  if (q.length >= 3 && (description || "").toLowerCase().includes(q)) return 100;
+  return 0;
+}
+
+interface Trigger {
+  kind: "slash" | "file";
+  query: string;
+  /** Where the `/` or `@` token starts, so a pick replaces it up to the cursor. */
+  start: number;
+  cursor: number;
+}
+
+/** The `/…` or `@…` token the cursor is in, if any. A token starts at the
+ *  line start or after whitespace, so `a/b` and `me@x.io` never trigger. */
+function detectTrigger(value: string, cursor: number): Trigger | null {
+  let start = cursor;
+  while (start > 0 && !/\s/.test(value[start - 1] ?? " ")) start--;
+  const tok = value.slice(start, cursor);
+  if (tok.startsWith("/")) return { kind: "slash", query: tok.slice(1), start, cursor };
+  if (tok.startsWith("@")) return { kind: "file", query: tok.slice(1), start, cursor };
+  return null;
+}
+
 interface PromptEditorProps {
   value: string;
   onChange: (s: string) => void;
   onSubmit: () => void;
   placeholder: string;
   rows?: number;
-  slashCommands: SlashCommand[];
+  /** Offer slash commands. Off for codex: these are Claude Code's. */
+  slash: boolean;
+  /** Where `@` looks for files and project commands/skills are read from. */
   fileCwd: string;
 }
 
-function PromptEditor({ value, onChange, onSubmit, placeholder, rows = 5 }: PromptEditorProps) {
+function PromptEditor({
+  value,
+  onChange,
+  onSubmit,
+  placeholder,
+  rows = 5,
+  slash,
+  fileCwd,
+}: PromptEditorProps) {
+  const { t } = useTranslation("run");
+  const taRef = useRef<HTMLTextAreaElement | null>(null);
+  const [trigger, setTrigger] = useState<Trigger | null>(null);
+  const [active, setActive] = useState(0);
+  const [files, setFiles] = useState<string[]>([]);
+  const [commands, setCommands] = useState<SlashCommand[] | null>(null);
+  const [commandsCwd, setCommandsCwd] = useState(fileCwd);
+  if (commandsCwd !== fileCwd) {
+    setCommandsCwd(fileCwd);
+    setCommands(null);
+  }
+  const kind = trigger?.kind === "slash" && !slash ? null : trigger?.kind;
+
+  // Commands and skills are read the first time `/` is typed for this cwd —
+  // two directory walks nobody should pay for on every render of the form.
+  useEffect(() => {
+    if (kind !== "slash" || commands) return;
+    let live = true;
+    const toCmd = (c: CcMdItem): SlashCommand => ({
+      name: c.name,
+      source: c.scope,
+      description: c.frontmatter?.description || c.preview.slice(0, 80),
+    });
+    Promise.all([
+      api.ccConfig.commands(undefined, fileCwd).catch(() => ({ items: [] as CcMdItem[] })),
+      api.ccConfig.skills(undefined, fileCwd).catch(() => ({ items: [] as CcMdItem[] })),
+    ]).then(([c, sk]) => {
+      if (live) setCommands([...c.items, ...sk.items].map(toCmd).concat(BUILTIN_SLASH_COMMANDS));
+    });
+    return () => {
+      live = false;
+    };
+  }, [kind, commands, fileCwd]);
+
+  // Files: debounced, and only the newest query may land.
+  const query = trigger?.query ?? "";
+  useEffect(() => {
+    if (kind !== "file") return;
+    let live = true;
+    const tid = window.setTimeout(() => {
+      api.run
+        .files(fileCwd, query)
+        .then((r) => live && setFiles(r.items))
+        .catch(() => live && setFiles([]));
+    }, 120);
+    return () => {
+      live = false;
+      window.clearTimeout(tid);
+    };
+  }, [kind, query, fileCwd]);
+
+  const slashItems = useMemo(() => {
+    if (kind !== "slash" || !commands) return [];
+    const q = query.toLowerCase();
+    return commands
+      .map((cmd) => ({ cmd, score: scoreSlashMatch(cmd.name, cmd.description, q) }))
+      .filter((x) => x.score > 0)
+      .sort(
+        (a, b) =>
+          b.score - a.score ||
+          SOURCE_ORDER[a.cmd.source] - SOURCE_ORDER[b.cmd.source] ||
+          a.cmd.name.localeCompare(b.cmd.name)
+      )
+      .map((x) => x.cmd);
+  }, [kind, commands, query]);
+  const count = kind === "file" ? files.length : slashItems.length;
+  const current = Math.min(active, Math.max(0, count - 1));
+
+  const pick = (token: string) => {
+    if (!trigger) return;
+    const before = value.slice(0, trigger.start);
+    const after = value.slice(trigger.cursor);
+    const sep = after.startsWith(" ") ? "" : " ";
+    onChange(before + token + sep + after);
+    setTrigger(null);
+    setActive(0);
+    const pos = before.length + token.length + 1;
+    requestAnimationFrame(() => {
+      taRef.current?.focus();
+      taRef.current?.setSelectionRange(pos, pos);
+    });
+  };
+  const pickAt = (i: number) => {
+    if (kind === "file") {
+      const f = files[i];
+      if (f) pick(`@${f}`);
+    } else {
+      const c = slashItems[i];
+      if (c) pick(`/${c.name}`);
+    }
+  };
+
   const handleKeyDown = (e: React.KeyboardEvent<HTMLTextAreaElement>) => {
+    if (kind && count > 0) {
+      if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+        e.preventDefault();
+        const step = e.key === "ArrowDown" ? 1 : -1;
+        setActive(Math.min(count - 1, Math.max(0, current + step)));
+        return;
+      }
+      if ((e.key === "Enter" || e.key === "Tab") && !e.shiftKey && !e.nativeEvent.isComposing) {
+        e.preventDefault();
+        pickAt(current);
+        return;
+      }
+    }
+    if (kind && e.key === "Escape") {
+      e.preventDefault();
+      setTrigger(null);
+      return;
+    }
     // Enter sends (Ctrl/Cmd+Enter still does); Shift+Enter inserts a newline.
     // isComposing guards IME input (Vietnamese/CJK), where Enter commits the candidate.
     if (e.key === "Enter" && !e.shiftKey && !e.nativeEvent.isComposing) {
@@ -85,15 +270,89 @@ function PromptEditor({ value, onChange, onSubmit, placeholder, rows = 5 }: Prom
     }
   };
 
+  const retrack = (ta: HTMLTextAreaElement) => {
+    setTrigger(detectTrigger(ta.value, ta.selectionStart ?? 0));
+  };
+
+  const rowClass = (i: number) =>
+    `w-full text-left px-3 py-1.5 transition-colors ${i === current ? "bg-accent/15" : "hover:bg-surface-3"}`;
+
   return (
-    <textarea
-      value={value}
-      onChange={(e) => onChange(e.target.value)}
-      onKeyDown={handleKeyDown}
-      placeholder={placeholder}
-      rows={rows}
-      className="w-full bg-surface-2 border border-border rounded-md px-3 py-2 text-[11px] font-mono text-fg-primary placeholder:text-fg-muted focus:outline-none focus:border-accent/50 resize-none"
-    />
+    <div className="relative">
+      <textarea
+        ref={taRef}
+        value={value}
+        onChange={(e) => {
+          onChange(e.target.value);
+          retrack(e.target);
+          setActive(0);
+        }}
+        onSelect={(e) => retrack(e.currentTarget)}
+        onBlur={() => setTrigger(null)}
+        onKeyDown={handleKeyDown}
+        placeholder={placeholder}
+        rows={rows}
+        spellCheck={false}
+        className="w-full bg-surface-2 border border-border rounded-md px-3 py-2 text-[11px] font-mono text-fg-primary placeholder:text-fg-muted focus:outline-none focus:border-accent/50 resize-none"
+      />
+      {kind && (
+        <div
+          role="listbox"
+          data-testid="prompt-autocomplete"
+          className="absolute z-30 left-0 right-0 top-full mt-1 max-h-72 overflow-auto rounded-md border border-border bg-surface-1 py-1 shadow-lg"
+        >
+          <div className="px-3 py-1.5 border-b border-border text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
+            {kind === "slash" ? t("autocomplete.slashHint") : t("autocomplete.fileHint")}
+          </div>
+          {count === 0 ? (
+            <div className="px-3 py-2 text-[11px] text-fg-muted">
+              {kind === "slash" && !commands ? "…" : t("autocomplete.noMatches")}
+            </div>
+          ) : kind === "slash" ? (
+            slashItems.map((c, i) => (
+              <button
+                key={`${c.source}:${c.name}`}
+                type="button"
+                role="option"
+                aria-selected={i === current}
+                // Keep focus in the textarea, or its blur closes the list first.
+                onMouseDown={(e) => e.preventDefault()}
+                onClick={() => pickAt(i)}
+                onMouseEnter={() => setActive(i)}
+                className={rowClass(i)}
+              >
+                <div className="flex items-center gap-2">
+                  <span className="font-mono text-[12px] text-fg-primary">/{c.name}</span>
+                  <span
+                    className={`rounded border px-1.5 py-0.5 font-mono text-[9px] ${SOURCE_TONE[c.source]}`}
+                  >
+                    {c.source}
+                  </span>
+                </div>
+                {c.description && (
+                  <div className="mt-0.5 truncate text-[10.5px] text-fg-muted">{c.description}</div>
+                )}
+              </button>
+            ))
+          ) : (
+            files.map((f, i) => (
+              <button
+                key={f}
+                type="button"
+                role="option"
+                aria-selected={i === current}
+                onMouseDown={(e) => e.preventDefault()}
+                onClick={() => pickAt(i)}
+                onMouseEnter={() => setActive(i)}
+                className={`${rowClass(i)} truncate font-mono text-[11px] text-fg-secondary`}
+              >
+                {f}
+              </button>
+            ))
+          )}
+        </div>
+      )}
+    </div>
   );
 }
 
@@ -122,7 +381,6 @@ interface RunSetupProps {
    *  sessions. Undefined when no lane is selected (the picker then lists
    *  everything, same as before lanes existed). */
   laneCwd?: string;
-  slashCommands?: SlashCommand[];
   runHistory: DashboardRunHistoryItem[];
   onResumeFromHistory: (item: DashboardRunHistoryItem) => void;
   /** The selected lane's CLI. Decides which advanced fields render. */
@@ -173,10 +431,13 @@ export function RunSetup(props: RunSetupProps) {
               </div>
             )}
           </Field>
-          <Field label={t("fields.model")}>
-            <ModelPicker value={props.model} onChange={props.onModelChange} tool={props.tool} />
-          </Field>
-          {props.tool === "codex" ? (
+          {/* `agy` takes no model, permission or effort flag. */}
+          {props.tool !== "antigravity" && (
+            <Field label={t("fields.model")}>
+              <ModelPicker value={props.model} onChange={props.onModelChange} tool={props.tool} />
+            </Field>
+          )}
+          {props.tool === "antigravity" ? null : props.tool === "codex" ? (
             <>
               <Field label={t("fields.sandbox")}>
                 <Select<CodexSandbox>
@@ -215,17 +476,19 @@ export function RunSetup(props: RunSetupProps) {
               />
             </Field>
           )}
-          <Field label={t("fields.effort")}>
-            <Select<EffortLevel>
-              value={props.effort}
-              onChange={props.onEffortChange}
-              options={RUN_EFFORT_CHOICES.map((c) => ({
-                value: c.id,
-                label: c.label,
-                hint: c.hint,
-              }))}
-            />
-          </Field>
+          {props.tool !== "antigravity" && (
+            <Field label={t("fields.effort")}>
+              <Select<EffortLevel>
+                value={props.effort}
+                onChange={props.onEffortChange}
+                options={RUN_EFFORT_CHOICES.map((c) => ({
+                  value: c.id,
+                  label: c.label,
+                  hint: c.hint,
+                }))}
+              />
+            </Field>
+          )}
         </div>
         <div className="flex shrink-0 items-center rounded-md border border-border bg-surface-2 p-0.5 text-[11.5px]">
           <Seg
@@ -285,9 +548,9 @@ export function RunSetup(props: RunSetupProps) {
           value={props.prompt}
           onChange={props.onPromptChange}
           onSubmit={() => handleStart(props)}
-          placeholder={t("fields.promptPlaceholderTerminal")}
+          placeholder={t("fields.promptPlaceholderTerminal", { tool: LANE_TOOL_LABEL[props.tool] })}
           rows={5}
-          slashCommands={props.slashCommands ?? []}
+          slash={props.tool === "claude"}
           fileCwd={props.resumeSession?.cwd || props.cwd}
         />
         <div className="mt-1 text-[10px] text-fg-muted">
@@ -352,18 +615,18 @@ export function RunSetup(props: RunSetupProps) {
 function handleStart(props: RunSetupProps, session?: Session) {
   const resume = session ?? props.resumeSession;
   const codex = props.tool === "codex";
+  const agy = props.tool === "antigravity";
   props.onStart({
     laneId: props.laneId,
     // A resume is pinned to its own session's folder — that's what the locked
     // cwd field shows, so it's what gets sent.
     cwd: resume?.cwd || props.cwd || undefined,
-    model: props.model || undefined,
-    permissionMode: codex ? undefined : props.permissionMode || undefined,
+    model: agy ? undefined : props.model || undefined,
+    permissionMode: codex || agy ? undefined : props.permissionMode || undefined,
     sandbox: codex ? props.sandbox : undefined,
     approval: codex ? props.approval : undefined,
-    effort: props.effort || undefined,
-    resumeSessionId: codex ? undefined : resume?.id || undefined,
-    resumeLast: codex && !resume ? true : undefined,
+    effort: agy ? undefined : props.effort || undefined,
+    resumeSessionId: codex || agy ? undefined : resume?.id || undefined,
     // A resume continues a session that already has its own history — sending
     // whatever is sitting in the prompt box would fire an extra turn nobody
     // asked for, so a resume carries no prompt at all.

client/src/components/run/TerminalView.tsx

@@ -11,15 +11,23 @@
  * still LOOKS live, but no keystroke or mouse report reaches tmux again.
  * Always painted dark, in the palette of the user's chosen DARK theme
  * (`lib/terminalTheme.ts`), recoloured live without re-attaching.
+ * An image dropped on it is saved on the server (`POST /api/run/drop-image`)
+ * and its PATH pasted into the pane — what a local terminal does on a drop,
+ * and how `claude` attaches an image.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
-import { useEffect, useMemo, useRef } from "react";
+import { useEffect, useMemo, useRef, useState, type DragEvent } from "react";
+import { useTranslation } from "react-i18next";
 import { Terminal } from "@xterm/xterm";
 import { FitAddon } from "@xterm/addon-fit";
 import { CanvasAddon } from "@xterm/addon-canvas";
 import "@xterm/xterm/css/xterm.css";
 import { useTheme } from "../../hooks/useTheme";
 import { terminalThemeFor } from "../../lib/terminalTheme";
+import { api } from "../../lib/api";
+
+type DropState = "hint" | "uploading" | "failed" | "imagesOnly";
+const hasFiles = (e: DragEvent) => Array.from(e.dataTransfer.types).includes("Files");
 
 interface TerminalViewProps {
   runId: string;
@@ -45,6 +53,42 @@ export function TerminalView({ runId, wsBaseUrl, onExit }: TerminalViewProps) {
   const paletteRef = useRef(palette);
   paletteRef.current = palette;
   const termRef = useRef<Terminal | null>(null);
+  const { t } = useTranslation("run");
+  const [drop, setDrop] = useState<DropState | null>(null);
+  // dragenter/dragleave fire for every child crossed, so count them: the hint
+  // only goes away when the pointer leaves the terminal itself.
+  const dragDepth = useRef(0);
+  const flashTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const flash = (state: DropState) => {
+    setDrop(state);
+    if (flashTimer.current) clearTimeout(flashTimer.current);
+    flashTimer.current = setTimeout(() => setDrop(null), 2500);
+  };
+  useEffect(
+    () => () => {
+      if (flashTimer.current) clearTimeout(flashTimer.current);
+    },
+    []
+  );
+
+  const onDrop = async (e: DragEvent) => {
+    if (!hasFiles(e)) return; // dragged text keeps xterm's own handling
+    e.preventDefault();
+    dragDepth.current = 0;
+    const images = Array.from(e.dataTransfer.files).filter((f) => f.type.startsWith("image/"));
+    if (images.length === 0) return flash("imagesOnly");
+    setDrop("uploading");
+    try {
+      const saved = await Promise.all(images.map((f) => api.run.dropImage(f)));
+      // paste(), not a raw send: it honours bracketed-paste mode, so claude
+      // sees one pasted path rather than typed keystrokes.
+      termRef.current?.paste(saved.map((r) => r.path).join(" ") + " ");
+      termRef.current?.focus();
+      setDrop(null);
+    } catch {
+      flash("failed");
+    }
+  };
 
   useEffect(() => {
     // An explicit fontFamily pins every glyph to one bundled webfont. Left
@@ -249,10 +293,44 @@ export function TerminalView({ runId, wsBaseUrl, onExit }: TerminalViewProps) {
 
   return (
     <div
-      ref={containerRef}
-      className="h-full w-full"
-      style={{ backgroundColor: palette.background }}
-      data-testid="terminal-view"
-    />
+      className="relative h-full w-full"
+      onDragEnter={(e) => {
+        if (!hasFiles(e)) return;
+        e.preventDefault();
+        dragDepth.current += 1;
+        setDrop("hint");
+      }}
+      onDragOver={(e) => {
+        if (!hasFiles(e)) return;
+        e.preventDefault(); // without it the browser refuses the drop
+        e.dataTransfer.dropEffect = "copy";
+      }}
+      onDragLeave={(e) => {
+        if (!hasFiles(e)) return;
+        dragDepth.current = Math.max(0, dragDepth.current - 1);
+        if (dragDepth.current === 0) setDrop((d) => (d === "hint" ? null : d));
+      }}
+      onDrop={(e) => void onDrop(e)}
+    >
+      <div
+        ref={containerRef}
+        className="h-full w-full"
+        style={{ backgroundColor: palette.background }}
+        data-testid="terminal-view"
+      />
+      {drop && (
+        // pointer-events-none: the drop must land on the terminal, not on this.
+        <div
+          data-testid="terminal-drop"
+          className={`pointer-events-none absolute inset-2 flex items-center justify-center rounded-lg border-2 border-dashed bg-black/50 text-sm font-medium ${
+            drop === "failed" || drop === "imagesOnly"
+              ? "border-red-400 text-red-300"
+              : "border-sky-400 text-sky-200"
+          }`}
+        >
+          {t(`drop.${drop}`)}
+        </div>
+      )}
+    </div>
   );
 }

client/src/components/run/__tests__/LaneConsolePane.test.tsx

@@ -84,6 +84,7 @@ function baseProps() {
     binaryStatus: {
       claude: { found: true, path: "/usr/local/bin/claude" },
       codex: { found: true, path: "/usr/local/bin/codex" },
+      antigravity: { found: true, path: "/usr/local/bin/agy" },
     },
     cwdSuggestions: [],
     activeRuns: { items: [] },
@@ -331,4 +332,126 @@ describe("LaneConsolePane", () => {
     expect(screen.getByTestId("pane-lane-select")).toBeInTheDocument();
     expect(screen.queryByTestId("console-body")).not.toBeInTheDocument();
   });
+
+  it("lists only this lane's runs and sessions in Active runs, not every lane's", () => {
+    const run = (id: string, laneId: number, promptPreview: string) => ({
+      id,
+      laneId,
+      status: "running",
+      cwd: "/workspace/x",
+      model: null,
+      permissionMode: null,
+      effort: null,
+      resumeSessionId: null,
+      sessionId: null,
+      startedAt: "2026-09-24T01:00:00Z",
+      promptPreview,
+    });
+    const session = (id: string, cwd: string, name: string) =>
+      ({
+        id,
+        cwd,
+        name,
+        model: null,
+        source: "local",
+        started_at: "2026-09-24T01:00:00Z",
+      }) as never;
+    render(
+      <MemoryRouter>
+        <LaneConsolePane
+          {...baseProps()}
+          lanes={[
+            LANE,
+            { ...LANE, id: 2, cwd: "/workspace/b" },
+            // Nested inside lane 1: its sessions are ITS own, by longest prefix.
+            { ...LANE, id: 3, cwd: "/workspace/a/nested" },
+          ]}
+          activeRuns={{ items: [run("r1", 1, "mine"), run("r2", 2, "other lane's")] as never }}
+          externalSessions={[
+            session("s1", "/workspace/a/src", "my session"),
+            session("s2", "/workspace/b", "b session"),
+            session("s3", "/workspace/a/nested/x", "nested session"),
+            session("s4", "/workspace/ab", "sibling prefix"),
+          ]}
+        />
+      </MemoryRouter>
+    );
+    fireEvent.click(screen.getByRole("button", { name: /2 active runs/ }));
+    expect(screen.getByText("mine")).toBeTruthy();
+    expect(screen.getByText("my session")).toBeTruthy();
+    expect(screen.queryByText("other lane's")).toBeNull();
+    expect(screen.queryByText("b session")).toBeNull();
+    expect(screen.queryByText("nested session")).toBeNull();
+    expect(screen.queryByText("sibling prefix")).toBeNull();
+  });
+
+  describe("split panes on one lane", () => {
+    const run = (id: string, promptPreview = id) => ({
+      id,
+      laneId: 1,
+      status: "running" as const,
+      cwd: "/workspace/a",
+      model: null,
+      permissionMode: null,
+      effort: null,
+      resumeSessionId: null,
+      sessionId: null,
+      startedAt: "2026-09-24T01:00:00Z",
+      promptPreview,
+      tool: "claude" as const,
+    });
+
+    it("attaches a pane only to its own slot's session", async () => {
+      const activeRuns = { items: [run("agenthub-lane-1"), run("agenthub-lane-1-2")] };
+      render(<LaneConsolePane {...baseProps()} activeRuns={activeRuns} slot={2} />);
+      await waitFor(() =>
+        expect(screen.getByTestId("terminal-view")).toHaveAttribute(
+          "data-run-id",
+          "agenthub-lane-1-2"
+        )
+      );
+    });
+
+    it("starts into its own slot and shows the session the server opened", async () => {
+      (api.lanes.action as ReturnType<typeof vi.fn>).mockResolvedValue({
+        lane: { ...LANE, run_id: "agenthub-lane-1" },
+        run_id: "agenthub-lane-1-1",
+      });
+      (api.run.get as ReturnType<typeof vi.fn>).mockResolvedValue(run("agenthub-lane-1-1"));
+      render(<LaneConsolePane {...baseProps()} slot={1} />);
+      fireEvent.change(screen.getByPlaceholderText(/ask claude/i), { target: { value: "go" } });
+      fireEvent.click(screen.getByRole("button", { name: /^run$/i }));
+      await waitFor(() =>
+        expect(api.lanes.action).toHaveBeenCalledWith(
+          1,
+          "start",
+          expect.objectContaining({ slot: 1 })
+        )
+      );
+      await waitFor(() =>
+        expect(screen.getByTestId("terminal-view")).toHaveAttribute(
+          "data-run-id",
+          "agenthub-lane-1-1"
+        )
+      );
+    });
+
+    it("leaves runs other panes show out of Active runs", () => {
+      render(
+        <MemoryRouter>
+          <LaneConsolePane
+            {...baseProps()}
+            slot={1}
+            activeRuns={{
+              items: [run("agenthub-lane-1", "shown"), run("agenthub-lane-1-3", "free")],
+            }}
+            hiddenRunIds={["agenthub-lane-1"]}
+          />
+        </MemoryRouter>
+      );
+      fireEvent.click(screen.getByRole("button", { name: /1 active run/ }));
+      expect(screen.getByText("free")).toBeTruthy();
+      expect(screen.queryByText("shown")).toBeNull();
+    });
+  });
 });

client/src/components/run/__tests__/RunSetup.test.tsx

@@ -17,6 +17,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import i18n from "i18next";
 import { RunSetup } from "../RunSetup";
 import type { CwdSuggestion } from "../../../lib/api";
+import { api } from "../../../lib/api";
 
 vi.mock("../../../lib/api", async (importOriginal) => {
   const actual = await importOriginal<Record<string, unknown>>();
@@ -26,7 +27,22 @@ vi.mock("../../../lib/api", async (importOriginal) => {
     api: {
       run: { files: r({ items: [] }) },
       sessions: { list: r({ sessions: [], total: 0, limit: 100, offset: 0 }) },
-      ccConfig: { file: r({ text: "" }) },
+      ccConfig: {
+        file: r({ text: "" }),
+        commands: r({
+          items: [
+            {
+              scope: "project",
+              name: "ship-it",
+              frontmatter: { description: "Ship the change" },
+              preview: "",
+            },
+          ],
+        }),
+        skills: r({
+          items: [{ scope: "user", name: "review-pr", frontmatter: {}, preview: "Review a PR" }],
+        }),
+      },
     },
   };
 });
@@ -66,7 +82,6 @@ function renderSetup(overrides: Partial<React.ComponentProps<typeof RunSetup>> =
         busy={false}
         activeRuns={null}
         resumeSession={null}
-        slashCommands={[]}
         runHistory={[]}
         tool="claude"
         sandbox="workspace-write"
@@ -300,7 +315,6 @@ describe("RunSetup — resume picker scopes sessions to the selected lane", () =
           busy={false}
           activeRuns={null}
           resumeSession={null}
-          slashCommands={[]}
           runHistory={[]}
           laneCwd="/Users/tester/lane-b"
           tool="claude"
@@ -364,3 +378,71 @@ describe("RunSetup — per-tool fields", () => {
     expect(onResumeLast).toHaveBeenCalled();
   });
 });
+
+describe("RunSetup — / and @ suggestions in the prompt box", () => {
+  const box = () => screen.getByPlaceholderText(/ anything…$/);
+
+  it("lists the lane's commands, skills and the CLI built-ins on /, and Enter picks one", async () => {
+    const { spies } = renderSetup({ prompt: "" });
+    fireEvent.change(box(), { target: { value: "/rev" } });
+
+    // Both prefix matches; the shorter name ranks first.
+    const options = await screen.findAllByRole("option");
+    expect(options.map((o) => o.textContent)).toEqual([
+      expect.stringContaining("/review"),
+      expect.stringContaining("/review-pr"),
+    ]);
+    fireEvent.keyDown(box(), { key: "ArrowDown" });
+    // Read for the directory the run will start in, not the server's own.
+    expect(api.ccConfig.commands).toHaveBeenCalledWith(undefined, "/Users/tester");
+    expect(api.ccConfig.skills).toHaveBeenCalledWith(undefined, "/Users/tester");
+
+    fireEvent.keyDown(box(), { key: "Enter" });
+    expect(spies.onPromptChange).toHaveBeenLastCalledWith("/review-pr ");
+    // Enter picked the suggestion; it did not send the prompt.
+    expect(spies.onStart).not.toHaveBeenCalled();
+  });
+
+  it("suggests files under the cwd on @", async () => {
+    vi.mocked(api.run.files).mockResolvedValue({ items: ["src/main.ts"] });
+    // The prompt is controlled by the page: put the cursor at the end of it.
+    const { spies } = renderSetup({ prompt: "look at @ma" });
+    (box() as HTMLTextAreaElement).setSelectionRange(11, 11);
+    fireEvent.select(box());
+
+    fireEvent.click(await screen.findByText("src/main.ts"));
+    expect(api.run.files).toHaveBeenCalledWith("/Users/tester", "ma");
+    expect(spies.onPromptChange).toHaveBeenLastCalledWith("look at @src/main.ts ");
+  });
+
+  it("offers no slash commands on a codex lane", async () => {
+    renderSetup({ prompt: "", tool: "codex" });
+    fireEvent.change(box(), { target: { value: "/rev" } });
+    await new Promise((r) => setTimeout(r, 20));
+    expect(screen.queryByTestId("prompt-autocomplete")).toBeNull();
+    expect(api.ccConfig.commands).not.toHaveBeenCalled();
+  });
+});
+
+describe("RunSetup — antigravity lanes", () => {
+  it("names the lane's CLI in the prompt box and drops the flags `agy` lacks", () => {
+    const { spies } = renderSetup({ tool: "antigravity", model: "opus", effort: "high" });
+    expect(screen.getByPlaceholderText("Ask Antigravity anything…")).toBeTruthy();
+    expect(screen.queryByText(i18n.t("run:fields.model"))).toBeNull();
+    expect(screen.queryByText(i18n.t("run:fields.effort"))).toBeNull();
+
+    fireEvent.click(screen.getByText(i18n.t("run:actions.start")));
+    expect(spies.onStart).toHaveBeenCalledWith(
+      expect.objectContaining({ model: undefined, effort: undefined, permissionMode: undefined })
+    );
+  });
+});
+
+describe("RunSetup — codex lanes", () => {
+  it("starts a fresh codex run instead of resuming the last one", () => {
+    const { spies } = renderSetup({ tool: "codex" });
+    fireEvent.click(screen.getByText(i18n.t("run:actions.start")));
+    expect(spies.onStart).toHaveBeenCalledOnce();
+    expect(spies.onStart.mock.calls[0][0].resumeLast).toBeUndefined();
+  });
+});

client/src/components/run/__tests__/TerminalView.test.tsx

@@ -8,7 +8,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { render, cleanup, act } from "@testing-library/react";
+import { render, cleanup, act, fireEvent, screen, waitFor } from "@testing-library/react";
 import { TerminalView } from "../TerminalView";
 
 const writeMock = vi.fn();
@@ -18,6 +18,11 @@ const disposeMock = vi.fn();
 const wheelHandlerMock = vi.fn();
 const keyHandlerMock = vi.fn();
 const focusMock = vi.fn();
+const pasteMock = vi.fn();
+const dropImageMock = vi.fn();
+vi.mock("../../../lib/api", () => ({
+  api: { run: { dropImage: (f: Blob) => dropImageMock(f) } },
+}));
 const loadAddonMock = vi.fn();
 // Mutable stand-ins for the two live terminal facts the wheel handler reads.
 const termState = {
@@ -61,6 +66,7 @@ vi.mock("@xterm/xterm", () => ({
     attachCustomWheelEventHandler: wheelHandlerMock,
     attachCustomKeyEventHandler: keyHandlerMock,
     focus: focusMock,
+    paste: pasteMock,
   })),
 }));
 // jsdom loads no stylesheet, so stand in for the CSS-variable probe.
@@ -314,4 +320,31 @@ describe("TerminalView", () => {
     expect(MockWebSocket.instances).toHaveLength(1);
     vi.useRealTimers();
   });
+
+  it("pastes the server-side path of a dropped image into the pane", async () => {
+    dropImageMock.mockReset().mockResolvedValue({ path: "/tmp/agenthub-drops-1/ab.png" });
+    pasteMock.mockClear();
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" />);
+    const img = new File([new Uint8Array([137, 80])], "shot.png", { type: "image/png" });
+    const target = screen.getByTestId("terminal-view");
+    fireEvent.dragEnter(target, { dataTransfer: { types: ["Files"], files: [img] } });
+    expect(screen.getByTestId("terminal-drop")).toHaveTextContent("Drop image to attach");
+    fireEvent.drop(target, { dataTransfer: { types: ["Files"], files: [img] } });
+    await waitFor(() => expect(pasteMock).toHaveBeenCalledWith("/tmp/agenthub-drops-1/ab.png "));
+    expect(dropImageMock).toHaveBeenCalledWith(img);
+    await waitFor(() => expect(screen.queryByTestId("terminal-drop")).toBeNull());
+  });
+
+  it("uploads nothing for a dropped non-image and says why", async () => {
+    dropImageMock.mockReset();
+    pasteMock.mockClear();
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" />);
+    const txt = new File(["hi"], "a.txt", { type: "text/plain" });
+    fireEvent.drop(screen.getByTestId("terminal-view"), {
+      dataTransfer: { types: ["Files"], files: [txt] },
+    });
+    expect(await screen.findByText("Only images can be dropped here")).toBeInTheDocument();
+    expect(dropImageMock).not.toHaveBeenCalled();
+    expect(pasteMock).not.toHaveBeenCalled();
+  });
 });

client/src/i18n/locales/en/lanes.json

@@ -7,8 +7,6 @@
   "action.stop": "stop",
   "actionError": "Lane action failed: {{message}}",
   "actionErrorUnknown": "Unknown error",
-  "actions.agentsInstall": "Install agents",
-  "actions.agentsInstallResult": "Installed: {{files}}",
   "actions.busy": "…",
   "actions.mcpSync": "Sync MCP",
   "actions.mcpSyncResult": "Synced: {{servers}}",
@@ -25,14 +23,15 @@
   "addLaneBranchBusy": "{{branch}} — already checked out at {{path}}",
   "addLaneBranchExistingHint": "The worktree checks this branch out as it is — no new branch, no base.",
   "addLaneBranchExistingLabel": "Branch to check out",
-  "addLaneBranchHintAuto": "Leave empty to use the default name shown above.",
+  "addLaneBranchHintAuto": "Leave empty to let the server name the branch from the title.",
   "addLaneBranchLabel": "New branch name",
   "addLaneBranchModeCurrent": "Current branch",
   "addLaneBranchModeCurrentHint": "Work straight on this repo's checked-out branch (main) — no worktree, no fork. Switches to Repo mode.",
   "addLaneBranchModeExisting": "Existing branch",
   "addLaneBranchModeNew": "New branch",
-  "addLaneBranchPlaceholder": "feat/my-feature",
-  "addLaneNoBranches": "This repo has no commits yet — the worktree will start empty.",
+  "addLaneBranchPlaceholder": "Automatic — named from the title",
+  "addLaneNoBranches": "This repo has no commits yet, so a worktree has nothing to branch from. Add it as a Repo lane: commit first, then publish it from the Changes panel.",
+  "addLaneNoBranchesUseRepo": "Use as a Repo lane",
   "addLaneNoFreeBranches": "Every branch in this repo is already checked out in a worktree. Create a new branch instead.",
   "addLaneExists": "This folder already has a lane: #{{id}} {{title}}. It is selected; pick another folder to add a new one.",
   "addLaneNotARepo": "Not a git repository (or no read access) yet.",
@@ -48,7 +47,6 @@
   "addLaneRouterLoading": "Loading router profiles…",
   "addLaneRouterNative": "Native",
   "addLaneRouterProfileLabel": "Router profile",
-  "addLaneSetupAgents": "Agents",
   "addLaneSetupClose": "Close",
   "addLaneSetupMcp": "MCP servers",
   "addLaneSetupProfile": "Profile",
@@ -58,6 +56,7 @@
   "addLaneTitlePlaceholder": "Optional",
   "addLaneToolClaude": "Claude Code",
   "addLaneToolCodex": "Codex",
+  "addLaneToolAntigravity": "Antigravity",
   "addLaneToolHint": "Which CLI drives this lane. Cannot be changed later.",
   "addLaneWorktreeDetached": "(detached)",
   "addLaneWorktreesMore": "+{{count}} more",
@@ -108,8 +107,13 @@
   "changes.refresh": "Refresh",
   "changes.resize": "Resize the changes panel (next: {{size}})",
   "changes.size.compact": "Narrow",
-  "changes.size.half": "50 / 50",
-  "changes.size.wide": "70 / 30",
+  "changes.size.half": "Medium",
+  "changes.size.full": "Full screen",
+  "changes.stageAll": "Stage all ({{count}})",
+  "changes.unstageAll": "Unstage all ({{count}})",
+  "changes.dropEdits": "Discard your unsaved edits to this file?",
+  "changes.stagedGroup": "Staged Changes",
+  "changes.unstagedGroup": "Changes",
   "changes.stage": "Stage this file",
   "changes.title": "Changes",
   "changes.truncated": "Some changes were left out to keep this panel responsive.",
@@ -169,21 +173,21 @@
   "gitBar.branchDelete": "Delete",
   "gitBar.branchDeleteHint": "Delete the selected branch (refused if it has unmerged commits)",
   "gitBar.branchNewPlaceholder": "New branch name…",
-  "gitBar.cancel": "Cancel",
-  "gitBar.commit": "Commit",
-  "gitBar.commitAll_one": "Commit {{count}} file",
-  "gitBar.commitAll_other": "Commit {{count}} files",
-  "gitBar.commitHint": "Stage everything and commit",
-  "gitBar.commitNothing": "Nothing to commit",
-  "gitBar.commitPlaceholder": "Commit message",
-  "gitBar.commitStaged": "Commit staged",
-  "gitBar.commitStagedHint": "Commit only what is staged in the Changes panel",
   "gitBar.fetch": "Fetch",
   "gitBar.fetchHint": "git fetch --all --prune",
+  "gitBar.errNoRemote": "No remote to push to or pull from. Add one, or set this branch's upstream, in a terminal.",
   "gitBar.inSync": "in sync",
   "gitBar.newLane": "New lane here",
+  "gitBar.newLaneHeld": "Already checked out at {{path}} — git allows one worktree per branch",
   "gitBar.newLaneHint": "Open Add lane for a sibling worktree on the selected branch",
+  "gitBar.noCommits": "no commits yet",
   "gitBar.noUpstream": "not pushed",
+  "gitBar.publish": "Publish…",
+  "gitBar.publishApply": "Publish",
+  "gitBar.publishBranch": "Publish branch",
+  "gitBar.publishBranchHint": "git push -u origin HEAD — this branch has no upstream yet",
+  "gitBar.publishHint": "Add a remote named origin and push this branch to it (git remote add origin + git push -u origin HEAD)",
+  "gitBar.publishUrl": "Remote URL: https://host/owner/repo.git or git@host:owner/repo.git",
   "gitBar.pull": "Pull",
   "gitBar.pullHint": "git pull --ff-only — refuses instead of merging when the branch has diverged",
   "gitBar.push": "Push",
@@ -194,6 +198,7 @@
   "gitBar.switchDirty": "Commit or discard the uncommitted changes first",
   "gitBar.switchHint": "Switch this worktree to another local branch",
   "gitBar.switchLabel": "Switch branch…",
+  "gitBar.unbornHint": "Commit first, then publish this repo to a remote.",
   "kind.adopted": "adopted",
   "kind.managed": "managed",
   "laneDetail.hide": "Hide details",
@@ -239,5 +244,68 @@
   "title": "Lanes",
   "tooltipStart": "Spawn a conversation-mode run with no initial prompt; driven from CLI or via message",
   "worktrees.heading_one": "{{count}} worktree",
-  "worktrees.heading_other": "{{count}} worktrees"
+  "worktrees.heading_other": "{{count}} worktrees",
+  "changes.stageHunk": "Stage this hunk",
+  "changes.undoHunk": "Undo this hunk",
+  "changes.undoHunkConfirm": "Click again to undo this hunk — this cannot be undone",
+  "changes.stageHunkShort": "Keep",
+  "changes.undoHunkShort": "Undo",
+  "changes.undoHunkShortConfirm": "Confirm undo",
+  "changes.edit": "Edit",
+  "changes.save": "Save",
+  "changes.cancelEdit": "Cancel",
+  "changes.clickToEdit": "Click the text to edit",
+  "changes.editorLabel": "Edit {{path}}",
+  "changes.prevHunk": "Previous change",
+  "changes.nextHunk": "Next change",
+  "changes.hunkOf": "{{n}} of {{total}}",
+  "changes.noEditBinary": "Binary file — not editable here",
+  "changes.noEditTooBig": "Too large to edit here (over 1 MB)",
+  "changes.noEdit": "Not editable here",
+  "gitBar.loginTitle": "Git needs a login for {{host}}",
+  "gitBar.loginRejected": "The server rejected that username or token.",
+  "gitBar.loginUser": "Username",
+  "gitBar.loginPassword": "Password or access token",
+  "gitBar.loginRemember": "Remember for everyone using this AgentHub",
+  "gitBar.loginTokenHint": "On Gitea: Settings → Applications → Generate token, with repository read/write.",
+  "gitBar.loginInsecure": "This dashboard is on plain http — the token crosses the network unencrypted.",
+  "gitBar.loginSubmit": "Log in and retry",
+  "gitBar.loginCancel": "Cancel",
+  "gitBar.merge": "Merge into current",
+  "gitBar.mergeHint": "Merge the selected branch into the branch this lane is on",
+  "gitBar.mergeUpstream": "Merge {{upstream}}",
+  "gitBar.mergeUpstreamHint": "The branch has diverged from its upstream: merge it in (conflicts are resolved in the Changes panel)",
+  "gitBar.mergeConfirm": "Merge {{branch}} into {{current}}? Files in this lane change now — if an agent is working in this lane, let it finish first.",
+  "gitBar.mergeConflicts": "Merge stopped on {{count}} conflicted file(s) — resolve them in the list below.",
+  "gitBar.merging": "A merge is in progress: finish or abort it first",
+  "changes.conflictsGroup": "Merge conflicts",
+  "changes.mergeBanner": "Merge in progress — {{count}} file(s) still conflicted",
+  "changes.mergeReady": "Merge in progress — every conflict is resolved",
+  "changes.mergeCommit": "Complete merge",
+  "changes.mergeAbort": "Abort merge",
+  "changes.mergeAbortConfirm": "Click again to abort the merge",
+  "changes.takeOurs": "Keep mine",
+  "changes.takeTheirs": "Take theirs",
+  "changes.markResolved": "Mark resolved (after editing out the markers)",
+  "conflict.left": "{{left}} of {{total}} conflicts left",
+  "conflict.prev": "Previous conflict",
+  "conflict.next": "Next conflict",
+  "conflict.allOurs": "Keep all mine",
+  "conflict.allTheirs": "Take all theirs",
+  "conflict.editByHand": "Edit by hand",
+  "conflict.unbalanced": "The conflict markers do not line up (edited by hand?) — use Edit by hand.",
+  "conflict.unusable": "This file cannot be shown here (binary or too large) — use Keep all mine / Take all theirs, or a terminal.",
+  "conflict.keepOurs": "Keep mine",
+  "conflict.takeTheirs": "Take theirs",
+  "conflict.keepBoth": "Keep both",
+  "conflict.chose.ours": "Kept mine",
+  "conflict.chose.theirs": "Took theirs",
+  "conflict.chose.both": "Kept both",
+  "conflict.undo": "Undo",
+  "conflict.ours": "Mine ({{label}})",
+  "conflict.theirs": "Theirs ({{label}})",
+  "conflict.reset": "Cancel",
+  "conflict.save": "Save and mark resolved",
+  "changes.takeOursHint": "Keep your version of the whole file",
+  "changes.takeTheirsHint": "Take the incoming version of the whole file"
 }

client/src/i18n/locales/en/run.json

@@ -81,7 +81,7 @@
     "permissionPlan": "plan (read-only planning)",
     "prompt": "Prompt",
     "promptPlaceholder": "Ask Claude anything…",
-    "promptPlaceholderTerminal": "Ask Claude anything…",
+    "promptPlaceholderTerminal": "Ask {{tool}} anything…",
     "sandbox": "Sandbox",
     "sandboxFullAccess": "Full access (dangerous)",
     "sandboxReadOnly": "Read only",
@@ -164,5 +164,11 @@
     "input": "Input",
     "label": "Context",
     "output": "Output"
+  },
+  "drop": {
+    "hint": "Drop image to attach",
+    "uploading": "Uploading image…",
+    "failed": "Could not attach the image",
+    "imagesOnly": "Only images can be dropped here"
   }
 }

client/src/i18n/locales/en/settings.json

@@ -63,9 +63,7 @@
   },
   "lanesSection": {
     "title": "Lanes",
-    "description": "Machine-wide housekeeping and one-time setup for the ship-feature-lane pipeline.",
-    "installSkill": "Install ship-feature-lane skill",
-    "installSkillSuccess": "Installed to {{path}}",
+    "description": "Machine-wide lane housekeeping.",
     "runHousekeeping": "Run housekeeping",
     "dryRun": "Dry run",
     "gcResult": "Reaped {{reaped}} process(es), capped {{capped}} log(s)"
@@ -452,7 +450,8 @@
     "dashboard": "Dashboard",
     "claudeCode": "Claude Code",
     "codex": "Codex",
-    "aiRouter": "AI Router"
+    "aiRouter": "AI Router",
+    "gitCredentials": "Git credentials"
   },
   "aiRouter": {
     "title": "AI Router",
@@ -509,5 +508,23 @@
     "lightThemes": "Light themes",
     "active": "· in use now",
     "default": "Default"
+  },
+  "gitCreds": {
+    "title": "Git credentials",
+    "description": "Logins AgentHub gives git for a dashboard fetch, pull or push — one per host, shared by everyone using this AgentHub. A token is never shown again after it is saved.",
+    "add": "Add login",
+    "replace": "Replace token",
+    "remove": "Delete",
+    "removeConfirm": "Delete this git login? Dashboard fetch/pull/push to that host will ask for a login again.",
+    "save": "Save",
+    "cancel": "Cancel",
+    "fieldHost": "Server URL",
+    "fieldUser": "Username",
+    "fieldToken": "Password or access token",
+    "colHost": "Host",
+    "colUser": "Username",
+    "colSaved": "Saved",
+    "empty": "No git login saved. The git bar asks for one the first time a host needs it.",
+    "badUrl": "Enter the server as a URL, e.g. https://git.example.com"
   }
 }

client/src/i18n/locales/vi/lanes.json

@@ -7,8 +7,6 @@
   "action.stop": "Dừng",
   "actionError": "Thao tác làn đường thất bại: {{message}}",
   "actionErrorUnknown": "Lỗi không xác định",
-  "actions.agentsInstall": "Cài agent",
-  "actions.agentsInstallResult": "Đã cài: {{files}}",
   "actions.busy": "…",
   "actions.mcpSync": "Đồng bộ MCP",
   "actions.mcpSyncResult": "Đã đồng bộ: {{servers}}",
@@ -25,14 +23,15 @@
   "addLaneBranchBusy": "{{branch}} — đang được checkout tại {{path}}",
   "addLaneBranchExistingHint": "Worktree checkout đúng nhánh này — không tạo nhánh mới, không cần nhánh gốc.",
   "addLaneBranchExistingLabel": "Nhánh cần checkout",
-  "addLaneBranchHintAuto": "Để trống để dùng tên mặc định hiển thị ở trên.",
+  "addLaneBranchHintAuto": "Để trống để server tự đặt tên nhánh theo tiêu đề.",
   "addLaneBranchLabel": "Tên nhánh mới",
   "addLaneBranchModeCurrent": "Nhánh hiện tại",
   "addLaneBranchModeCurrentHint": "Làm thẳng trên nhánh repo đang mở (main) — không tạo worktree, không fork nhánh. Chuyển sang chế độ Repo.",
   "addLaneBranchModeExisting": "Nhánh có sẵn",
   "addLaneBranchModeNew": "Nhánh mới",
-  "addLaneBranchPlaceholder": "feat/tinh-nang-cua-toi",
-  "addLaneNoBranches": "Repo này chưa có commit nào — worktree sẽ bắt đầu trống.",
+  "addLaneBranchPlaceholder": "Tự động — đặt theo tiêu đề",
+  "addLaneNoBranches": "Repo này chưa có commit nào nên worktree không có gì để rẽ nhánh. Hãy thêm nó thành lane Repo: commit trước, rồi publish từ bảng Changes.",
+  "addLaneNoBranchesUseRepo": "Dùng làm lane Repo",
   "addLaneNoFreeBranches": "Mọi nhánh của repo này đều đang nằm trong một worktree. Hãy tạo nhánh mới.",
   "addLaneExists": "Thư mục này đã có lane: #{{id}} {{title}}. Lane đó đã được chọn; hãy chọn thư mục khác để thêm lane mới.",
   "addLaneNotARepo": "Chưa phải repo git (hoặc không có quyền đọc).",
@@ -48,7 +47,6 @@
   "addLaneRouterLoading": "Đang tải danh sách router…",
   "addLaneRouterNative": "Native",
   "addLaneRouterProfileLabel": "Profile router",
-  "addLaneSetupAgents": "Agent",
   "addLaneSetupClose": "Đóng",
   "addLaneSetupMcp": "MCP server",
   "addLaneSetupProfile": "Profile",
@@ -58,6 +56,7 @@
   "addLaneTitlePlaceholder": "Không bắt buộc",
   "addLaneToolClaude": "Claude Code",
   "addLaneToolCodex": "Codex",
+  "addLaneToolAntigravity": "Antigravity",
   "addLaneToolHint": "CLI nào điều khiển lane này. Không thể thay đổi sau này.",
   "addLaneWorktreeDetached": "(detached)",
   "addLaneWorktreesMore": "+{{count}} nữa",
@@ -108,8 +107,13 @@
   "changes.refresh": "Tải lại",
   "changes.resize": "Đổi độ rộng khung changes (kế tiếp: {{size}})",
   "changes.size.compact": "Hẹp",
-  "changes.size.half": "50 / 50",
-  "changes.size.wide": "70 / 30",
+  "changes.size.half": "Vừa",
+  "changes.size.full": "Toàn màn hình",
+  "changes.stageAll": "Stage tất cả ({{count}})",
+  "changes.unstageAll": "Bỏ stage tất cả ({{count}})",
+  "changes.dropEdits": "Bỏ các chỉnh sửa chưa lưu của file này?",
+  "changes.stagedGroup": "Đã stage",
+  "changes.unstagedGroup": "Thay đổi",
   "changes.stage": "Đưa file này vào index",
   "changes.title": "Thay đổi",
   "changes.truncated": "Một phần thay đổi đã bị lược bớt để bảng này còn mượt.",
@@ -169,21 +173,21 @@
   "gitBar.branchDelete": "Xoá",
   "gitBar.branchDeleteHint": "Xoá nhánh đang chọn (git từ chối nếu còn commit chưa merge)",
   "gitBar.branchNewPlaceholder": "Tên nhánh mới…",
-  "gitBar.cancel": "Huỷ",
-  "gitBar.commit": "Commit",
-  "gitBar.commitAll_one": "Commit {{count}} file",
-  "gitBar.commitAll_other": "Commit {{count}} file",
-  "gitBar.commitHint": "Stage tất cả rồi commit",
-  "gitBar.commitNothing": "Không có gì để commit",
-  "gitBar.commitPlaceholder": "Nội dung commit",
-  "gitBar.commitStaged": "Commit phần đã stage",
-  "gitBar.commitStagedHint": "Chỉ commit những file đã stage ở thẻ Changes",
   "gitBar.fetch": "Fetch",
   "gitBar.fetchHint": "git fetch --all --prune",
+  "gitBar.errNoRemote": "Không có remote để push hoặc pull. Hãy thêm remote, hoặc đặt upstream cho nhánh này, trong terminal.",
   "gitBar.inSync": "đã đồng bộ",
   "gitBar.newLane": "Tạo lane mới",
+  "gitBar.newLaneHeld": "Nhánh đã được checkout tại {{path}} — git chỉ cho một worktree trên mỗi nhánh",
   "gitBar.newLaneHint": "Mở Add lane để tạo worktree anh em trên nhánh đang chọn",
+  "gitBar.noCommits": "chưa có commit",
   "gitBar.noUpstream": "chưa push",
+  "gitBar.publish": "Publish…",
+  "gitBar.publishApply": "Publish",
+  "gitBar.publishBranch": "Publish nhánh",
+  "gitBar.publishBranchHint": "git push -u origin HEAD — nhánh này chưa có upstream",
+  "gitBar.publishHint": "Thêm remote tên origin rồi push nhánh này lên đó (git remote add origin + git push -u origin HEAD)",
+  "gitBar.publishUrl": "URL remote: https://host/owner/repo.git hoặc git@host:owner/repo.git",
   "gitBar.pull": "Pull",
   "gitBar.pullHint": "git pull --ff-only — nhánh đã rẽ nhánh thì báo lỗi chứ không merge",
   "gitBar.push": "Push",
@@ -194,6 +198,7 @@
   "gitBar.switchDirty": "Hãy commit hoặc bỏ các thay đổi chưa commit trước",
   "gitBar.switchHint": "Đổi worktree này sang nhánh local khác",
   "gitBar.switchLabel": "Đổi nhánh…",
+  "gitBar.unbornHint": "Hãy commit trước, rồi publish repo này lên remote.",
   "kind.adopted": "đã nhận",
   "kind.managed": "được quản lý",
   "laneDetail.hide": "Ẩn chi tiết",
@@ -239,5 +244,68 @@
   "title": "Làn đường",
   "tooltipStart": "Tạo một lần chạy ở chế độ hội thoại mà không có lời nhắc ban đầu; được điều khiển từ CLI hoặc qua tin nhắn",
   "worktrees.heading_one": "{{count}} worktree",
-  "worktrees.heading_other": "{{count}} worktree"
+  "worktrees.heading_other": "{{count}} worktree",
+  "changes.stageHunk": "Stage đoạn này",
+  "changes.undoHunk": "Hoàn tác đoạn này",
+  "changes.undoHunkConfirm": "Bấm lần nữa để hoàn tác đoạn này — không thể khôi phục",
+  "changes.stageHunkShort": "Giữ",
+  "changes.undoHunkShort": "Hoàn tác",
+  "changes.undoHunkShortConfirm": "Xác nhận",
+  "changes.edit": "Sửa",
+  "changes.save": "Lưu",
+  "changes.cancelEdit": "Huỷ",
+  "changes.clickToEdit": "Bấm vào nội dung để sửa",
+  "changes.editorLabel": "Sửa {{path}}",
+  "changes.prevHunk": "Thay đổi trước",
+  "changes.nextHunk": "Thay đổi sau",
+  "changes.hunkOf": "{{n}} / {{total}}",
+  "changes.noEditBinary": "File nhị phân — không sửa được ở đây",
+  "changes.noEditTooBig": "File quá lớn để sửa ở đây (trên 1 MB)",
+  "changes.noEdit": "Không sửa được ở đây",
+  "gitBar.loginTitle": "Git cần đăng nhập {{host}}",
+  "gitBar.loginRejected": "Máy chủ từ chối (rejected) tài khoản hoặc token này.",
+  "gitBar.loginUser": "Tên đăng nhập",
+  "gitBar.loginPassword": "Mật khẩu hoặc access token",
+  "gitBar.loginRemember": "Ghi nhớ cho mọi người dùng AgentHub",
+  "gitBar.loginTokenHint": "Trên Gitea: Settings → Applications → Generate token, cấp quyền đọc/ghi repository.",
+  "gitBar.loginInsecure": "Dashboard đang chạy http thường - token sẽ đi qua mạng không mã hoá.",
+  "gitBar.loginSubmit": "Đăng nhập và thử lại",
+  "gitBar.loginCancel": "Huỷ",
+  "gitBar.merge": "Merge vào nhánh hiện tại",
+  "gitBar.mergeHint": "Merge nhánh đang chọn vào nhánh lane này đang đứng",
+  "gitBar.mergeUpstream": "Merge {{upstream}}",
+  "gitBar.mergeUpstreamHint": "Nhánh đã lệch với upstream: merge vào (conflict được giải quyết trong Changes panel)",
+  "gitBar.mergeConfirm": "Merge {{branch}} vào {{current}}? File trong lane sẽ thay đổi ngay - nếu có agent đang làm việc trong lane này, hãy để nó xong trước.",
+  "gitBar.mergeConflicts": "Merge dừng ở {{count}} file conflict - hãy giải quyết trong danh sách bên dưới.",
+  "gitBar.merging": "Đang merge: hãy hoàn tất hoặc huỷ merge trước",
+  "changes.conflictsGroup": "Conflict khi merge",
+  "changes.mergeBanner": "Đang merge - còn {{count}} file conflict",
+  "changes.mergeReady": "Đang merge - đã giải quyết hết conflict",
+  "changes.mergeCommit": "Hoàn tất merge",
+  "changes.mergeAbort": "Huỷ merge",
+  "changes.mergeAbortConfirm": "Bấm lần nữa để huỷ merge",
+  "changes.takeOurs": "Giữ bản của mình",
+  "changes.takeTheirs": "Lấy bản kia",
+  "changes.markResolved": "Đánh dấu đã xong (sau khi đã sửa hết dấu conflict)",
+  "conflict.left": "Còn {{left}}/{{total}} khối conflict",
+  "conflict.prev": "Khối trước",
+  "conflict.next": "Khối sau",
+  "conflict.allOurs": "Giữ hết của mình",
+  "conflict.allTheirs": "Lấy hết bản kia",
+  "conflict.editByHand": "Sửa tay",
+  "conflict.unbalanced": "Dấu conflict không khớp nhau (đã sửa tay?) - hãy dùng Sửa tay.",
+  "conflict.unusable": "Không hiển thị được file này ở đây (nhị phân hoặc quá lớn) - hãy dùng Giữ hết của mình / Lấy hết bản kia, hoặc terminal.",
+  "conflict.keepOurs": "Giữ của mình",
+  "conflict.takeTheirs": "Lấy bản kia",
+  "conflict.keepBoth": "Giữ cả hai",
+  "conflict.chose.ours": "Đã giữ của mình",
+  "conflict.chose.theirs": "Đã lấy bản kia",
+  "conflict.chose.both": "Đã giữ cả hai",
+  "conflict.undo": "Hoàn tác",
+  "conflict.ours": "Của mình ({{label}})",
+  "conflict.theirs": "Bản kia ({{label}})",
+  "conflict.reset": "Huỷ",
+  "conflict.save": "Lưu và đánh dấu đã xong",
+  "changes.takeOursHint": "Giữ bản của mình cho cả file",
+  "changes.takeTheirsHint": "Lấy bản kia cho cả file"
 }

client/src/i18n/locales/vi/run.json

@@ -80,7 +80,7 @@
     "permissionPlan": "plan (chỉ đọc, lập kế hoạch)",
     "prompt": "Prompt",
     "promptPlaceholder": "Hỏi Claude bất cứ điều gì…",
-    "promptPlaceholderTerminal": "Hỏi Claude bất cứ điều gì…",
+    "promptPlaceholderTerminal": "Hỏi {{tool}} bất cứ điều gì…",
     "sandbox": "Sandbox",
     "sandboxFullAccess": "Truy cập đầy đủ (nguy hiểm)",
     "sandboxReadOnly": "Chỉ đọc",
@@ -163,5 +163,11 @@
     "input": "Input",
     "label": "Context",
     "output": "Output"
+  },
+  "drop": {
+    "hint": "Thả ảnh để đính kèm",
+    "uploading": "Đang tải ảnh lên…",
+    "failed": "Không đính kèm được ảnh",
+    "imagesOnly": "Chỉ thả được ảnh vào đây"
   }
 }

client/src/i18n/locales/vi/settings.json

@@ -63,9 +63,7 @@
   },
   "lanesSection": {
     "title": "Lanes",
-    "description": "Bảo trì toàn máy và cài đặt một lần cho pipeline ship-feature-lane.",
-    "installSkill": "Cài skill ship-feature-lane",
-    "installSkillSuccess": "Đã cài vào {{path}}",
+    "description": "Dọn dẹp lane trên toàn máy.",
     "runHousekeeping": "Chạy dọn dẹp",
     "dryRun": "Chạy thử (dry run)",
     "gcResult": "Đã dọn {{reaped}} tiến trình, cắt {{capped}} log"
@@ -452,7 +450,8 @@
     "dashboard": "Dashboard",
     "claudeCode": "Claude Code",
     "codex": "Codex",
-    "aiRouter": "AI Router"
+    "aiRouter": "AI Router",
+    "gitCredentials": "Git credentials"
   },
   "aiRouter": {
     "title": "AI Router",
@@ -509,5 +508,23 @@
     "lightThemes": "Theme sáng",
     "active": "· đang dùng",
     "default": "Mặc định"
+  },
+  "gitCreds": {
+    "title": "Git credentials",
+    "description": "Tài khoản AgentHub dùng cho git khi fetch, pull, push từ dashboard - mỗi host một tài khoản, dùng chung cho mọi người dùng AgentHub này. Token đã lưu sẽ không hiển thị lại.",
+    "add": "Thêm tài khoản",
+    "replace": "Thay token",
+    "remove": "Xoá",
+    "removeConfirm": "Xoá tài khoản git này? Fetch/pull/push tới host đó từ dashboard sẽ hỏi đăng nhập lại.",
+    "save": "Lưu",
+    "cancel": "Huỷ",
+    "fieldHost": "URL máy chủ",
+    "fieldUser": "Tên đăng nhập",
+    "fieldToken": "Mật khẩu hoặc access token",
+    "colHost": "Host",
+    "colUser": "Tên đăng nhập",
+    "colSaved": "Đã lưu",
+    "empty": "Chưa lưu tài khoản git nào. Thanh git sẽ hỏi khi một host cần đăng nhập.",
+    "badUrl": "Nhập máy chủ dạng URL, ví dụ https://git.example.com"
   }
 }

client/src/lib/__tests__/conflicts.test.ts

@@ -0,0 +1,74 @@
+/**
+ * @file Tests for the merge-conflict parser behind the Changes panel's
+ * conflict view: plain and diff3 blocks, the two side labels, applying a
+ * choice per block, and refusing a file whose markers do not balance.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, it, expect } from "vitest";
+import { parseConflicts, applyChoices } from "../conflicts";
+
+const FILE = [
+  "top",
+  "<<<<<<< HEAD",
+  "mine 1",
+  "mine 2",
+  "=======",
+  "theirs 1",
+  ">>>>>>> origin/main",
+  "middle",
+  "<<<<<<< HEAD",
+  "a",
+  "||||||| base",
+  "old",
+  "=======",
+  "b",
+  ">>>>>>> feat",
+  "end",
+];
+
+describe("parseConflicts", () => {
+  it("splits text from conflict blocks and reads both labels", () => {
+    const parts = parseConflicts(FILE)!;
+    expect(parts.map((p) => p.kind)).toEqual(["text", "conflict", "text", "conflict", "text"]);
+    expect(parts[1]).toMatchObject({
+      ours: ["mine 1", "mine 2"],
+      theirs: ["theirs 1"],
+      oursLabel: "HEAD",
+      theirsLabel: "origin/main",
+    });
+    // diff3: the base section is not either side.
+    expect(parts[3]).toMatchObject({ ours: ["a"], theirs: ["b"], theirsLabel: "feat" });
+  });
+
+  it("returns an empty list of blocks for a file without markers", () => {
+    expect(parseConflicts(["a", "b"])).toEqual([{ kind: "text", lines: ["a", "b"] }]);
+  });
+
+  it("refuses markers that do not balance", () => {
+    expect(parseConflicts(["<<<<<<< HEAD", "x", "======="])).toBeNull();
+    expect(parseConflicts(["x", ">>>>>>> feat"])).toBeNull();
+  });
+});
+
+describe("applyChoices", () => {
+  it("writes each block as the chosen side, both sides in order for 'both'", () => {
+    const parts = parseConflicts(FILE)!;
+    expect(applyChoices(parts, ["ours", "both"])).toEqual([
+      "top",
+      "mine 1",
+      "mine 2",
+      "middle",
+      "a",
+      "b",
+      "end",
+    ]);
+    expect(applyChoices(parts, ["theirs", "theirs"])).toEqual([
+      "top",
+      "theirs 1",
+      "middle",
+      "b",
+      "end",
+    ]);
+  });
+});

client/src/lib/api.ts

@@ -482,6 +482,15 @@ export function dashboardToken(): string | null {
   }
 }
 
+/** `?scope=&cwd=` for the cc-config list endpoints, each part only when given. */
+function ccQuery(scope?: CcScope, cwd?: string): string {
+  const qs = new URLSearchParams();
+  if (scope) qs.set("scope", scope);
+  if (cwd) qs.set("cwd", cwd);
+  const q = qs.toString();
+  return q ? `?${q}` : "";
+}
+
 /**
  * Shared fetch wrapper used by every method on {@link api}. Prefixes `path`
  * with {@link BASE} ("/api"), attaches the dashboard auth token (if any) as
@@ -530,6 +539,8 @@ async function request<T>(path: string, options?: RequestInit): Promise<T> {
     throw Object.assign(new Error(body?.error?.message || `HTTP ${res.status}`), {
       code: body?.error?.code,
       status: res.status,
+      // EGITAUTH from a lane git action: which host wants a login.
+      auth: body?.error?.auth as GitAuthNeeded | undefined,
     });
   }
   return res.json();
@@ -1119,8 +1130,6 @@ export const api = {
         purged_events: number;
         purged_agents: number;
       }>("/settings/cleanup", { method: "POST", body: JSON.stringify(params) }),
-    skillsInstall: () =>
-      request<{ installed: true; path: string }>("/skills/install", { method: "POST", body: "{}" }),
     gc: (body: { dryRun?: boolean } = {}) =>
       request<{ reaped: number[]; capped: { path: string; sizeBefore: number }[] }>("/lanes/gc", {
         method: "POST",
@@ -1390,10 +1399,11 @@ export const api = {
      * list endpoints below (`agents`, `commands`, `outputStyles`).
      *
      * @param scope Optional {@link CcScope} ("user"|"project"|"all") filter.
+     * @param cwd Project directory to read, instead of the server's own cwd.
      * @returns `{ items }` — the {@link CcMdItem} summaries for each skill.
      */
-    skills: (scope?: CcScope) =>
-      request<{ items: CcMdItem[] }>(`/cc-config/skills${scope ? `?scope=${scope}` : ""}`),
+    skills: (scope?: CcScope, cwd?: string) =>
+      request<{ items: CcMdItem[] }>(`/cc-config/skills${ccQuery(scope, cwd)}`),
     /**
      * GET /api/cc-config/agents - user and/or project subagent definitions.
      * @param scope Optional {@link CcScope} filter.
@@ -1404,10 +1414,11 @@ export const api = {
     /**
      * GET /api/cc-config/commands - user and/or project slash commands.
      * @param scope Optional {@link CcScope} filter.
+     * @param cwd Project directory to read, instead of the server's own cwd.
      * @returns `{ items }` — {@link CcMdItem} summaries for each command.
      */
-    commands: (scope?: CcScope) =>
-      request<{ items: CcMdItem[] }>(`/cc-config/commands${scope ? `?scope=${scope}` : ""}`),
+    commands: (scope?: CcScope, cwd?: string) =>
+      request<{ items: CcMdItem[] }>(`/cc-config/commands${ccQuery(scope, cwd)}`),
     /**
      * GET /api/cc-config/output-styles.
      * @param scope Optional {@link CcScope} filter.
@@ -1910,6 +1921,24 @@ export const api = {
    *
    *  No response here ever carries an API key — a saved profile reports only
    *  `hasKey`. */
+  /** AgentHub's own git credentials (issue #45), shared by every user of this
+   *  install. No response ever carries a password — only `hasToken`. */
+  gitCredentials: {
+    /** GET /api/git-credentials */
+    list: () => request<{ items: GitCredential[] }>("/git-credentials"),
+    /** POST /api/git-credentials - save, or replace the one for that host. */
+    save: (body: GitCredentialInput) =>
+      request<{ items: GitCredential[] }>("/git-credentials", {
+        method: "POST",
+        body: JSON.stringify(body),
+      }),
+    /** DELETE /api/git-credentials/:protocol/:host */
+    remove: (protocol: string, host: string) =>
+      request<{ items: GitCredential[] }>(
+        `/git-credentials/${encodeURIComponent(protocol)}/${encodeURIComponent(host)}`,
+        { method: "DELETE" }
+      ),
+  },
   aiRouters: {
     /** GET /api/ai-routers - every profile, the built-in `native` one first. */
     list: () => request<{ items: AiRouter[] }>("/ai-routers"),
@@ -1971,6 +2000,14 @@ export const api = {
       if (q) qs.set("q", q);
       return request<{ items: string[] }>(`/run/files?${qs.toString()}`);
     },
+    /** POST /api/run/drop-image - save an image dropped on the terminal on the
+     *  server's machine; the returned path is what gets pasted into the pane. */
+    dropImage: (file: Blob) =>
+      request<{ path: string }>("/run/drop-image", {
+        method: "POST",
+        body: file,
+        headers: { "Content-Type": file.type },
+      }),
     /** POST /api/run - start (or adopt, if already live) a lane's terminal run. */
     start: (args: RunStartArgs) =>
       request<RunHandle>("/run", { method: "POST", body: JSON.stringify(args) }),
@@ -2436,6 +2473,16 @@ export const api = {
       request<LaneFileContent>(
         `/lanes/${id}/git/file?path=${encodeURIComponent(path)}&rev=${encodeURIComponent(rev)}`
       ),
+    /**
+     * PUT /api/lanes/:id/git/file — save the editor's text over the working
+     * file. `baseSha` is the `sha` it was opened at; a file that changed on
+     * disk since answers 409 ESTALE rather than being overwritten.
+     */
+    gitSaveFile: (id: number, path: string, content: string, baseSha: string) =>
+      request<LaneFileContent>(`/lanes/${id}/git/file`, {
+        method: "PUT",
+        body: JSON.stringify({ path, content, baseSha }),
+      }),
     /**
      * GET /api/lanes/:id/git/ls — tracked paths matching a substring, for
      * quick-open. Ignored files never appear (it reads `git ls-files`).
@@ -2451,6 +2498,16 @@ export const api = {
      * @param id The lane id.
      * @param path Repo-relative directory; "" for the repo root.
      */
+    /**
+     * GET /api/lanes/:id/git/tree-all — every level of the tracked tree in one
+     * read, keyed by directory ("" is the root), each shaped like `gitTree`'s.
+     */
+    gitTreeAll: (id: number) =>
+      request<{
+        available: boolean;
+        levels: Record<string, LaneTreeEntry[]>;
+        truncated: boolean;
+      }>(`/lanes/${id}/git/tree-all`),
     gitTree: (id: number, path = "") =>
       request<{
         available: boolean;
@@ -2474,12 +2531,13 @@ export const api = {
      * POST /api/lanes/:id/git/:action — one git write on the lane's worktree.
      * @param id The lane id.
      * @param action `fetch`, `pull` (always --ff-only), `push`, `stage`,
-     *   `unstage`, `discard`, `commit`, `switch`, `branch-create` or
-     *   `branch-delete`.
+     *   `unstage`, `discard`, `commit`, `switch`, `branch-create`,
+     *   `branch-delete` or `publish`.
      * @param body `{message, only}` for commit; `{branch, create}` for switch;
      *   `{branch, base}` for branch-create; `{paths}` for stage/unstage;
      *   `{paths, confirm: true}` for discard — which is irreversible, so the
-     *   server refuses it without that flag.
+     *   server refuses it without that flag; `{url}` for publish (a repo with
+     *   no remote yet: adds `origin` and pushes HEAD with an upstream).
      * @returns `{action, ok, output}` — `output` is git's own text, shown as-is.
      */
     gitAction: (
@@ -2493,19 +2551,37 @@ export const api = {
         | "stage"
         | "unstage"
         | "discard"
+        | "stage-hunk"
+        | "discard-hunk"
         | "branch-create"
-        | "branch-delete",
+        | "branch-delete"
+        | "publish"
+        | "merge"
+        | "resolve"
+        | "merge-commit"
+        | "merge-abort",
       body: {
+        url?: string;
         message?: string;
         only?: "staged";
         branch?: string;
         base?: string;
         create?: boolean;
         paths?: string[];
+        path?: string;
+        hunk?: string;
+        /** One change block (a run of +/- lines) inside `hunk`, by index. */
+        block?: number;
+        context?: number;
         confirm?: boolean;
+        /** resolve: which side wins, or `done` for a hand-edited file. */
+        side?: "ours" | "theirs" | "done";
+        /** fetch/pull/push after `EGITAUTH`: used for this one command, saved
+         *  only when git accepted it and `remember` is set. */
+        credentials?: GitCredentialInput & { remember: boolean };
       } = {}
     ) =>
-      request<{ action: string; ok: true; output: string; branch?: string }>(
+      request<{ action: string; ok: true; output: string; branch?: string; conflicts?: string[] }>(
         `/lanes/${id}/git/${action}`,
         { method: "POST", body: JSON.stringify(body) }
       ),
@@ -2585,7 +2661,9 @@ export const api = {
      * @returns `{ lane, ok }` — the updated lane (if applicable) or a boolean result.
      */
     action: (id: number, action: string, body: Record<string, unknown> = {}) =>
-      request<{ lane?: Lane; ok?: boolean }>(`/lanes/${id}/${action}`, {
+      // `run_id` answers a `start`: the session it opened, which for a split
+      // pane's slot (`body.slot` 1–3) is not the lane's own `run_id`.
+      request<{ lane?: Lane; ok?: boolean; run_id?: string }>(`/lanes/${id}/${action}`, {
         method: "POST",
         body: JSON.stringify(body),
       }),
@@ -2639,11 +2717,6 @@ export const api = {
           body: JSON.stringify(body),
         }),
     },
-    agentsInstall: (id: number) =>
-      request<{ installed: string[] }>(`/lanes/${id}/agents/install`, {
-        method: "POST",
-        body: "{}",
-      }),
     /**
      * POST /lanes/:id/router/apply - point this lane at an AI Router profile,
      * or back at `native`. Writes the lane's own config on disk; only the
@@ -2865,6 +2938,31 @@ export interface AiRouterModels {
 }
 
 /** One saved AI Router profile, as the API returns it — **never** with a key. */
+/** A saved git login, as the server reports it: never the password. */
+export interface GitCredential {
+  protocol: "http" | "https";
+  host: string;
+  username: string;
+  savedAt: string;
+  hasToken: true;
+}
+
+export interface GitCredentialInput {
+  protocol: string;
+  host: string;
+  username: string;
+  password: string;
+}
+
+/** The `auth` block of a 409 `EGITAUTH`: the host git needed a login for. */
+export interface GitAuthNeeded {
+  protocol: "http" | "https";
+  host: string;
+  username: string | null;
+  /** true when a login WAS sent and the host refused it. */
+  rejected: boolean;
+}
+
 export interface AiRouter {
   /** Identifier, derived from the label. Stable: a lane stores this. */
   name: string;
@@ -3578,6 +3676,8 @@ export interface RunStartArgs {
 export interface RunHandle {
   id: string;
   laneId: number | null;
+  /** Which Workspace split pane's session this is: 0 is the lane's own. */
+  slot?: number | null;
   status: RunStatus;
   cwd: string | null;
   model: string | null;

client/src/lib/conflicts.ts

@@ -0,0 +1,87 @@
+/**
+ * @file Parses git's merge-conflict markers out of a file's lines, and writes
+ * the file back with one side (or both) chosen per block — the model behind
+ * the Changes panel's conflict view. Handles diff3 style (`|||||||` base
+ * section, dropped: it is neither side). Pure, no React.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+export type ConflictChoice = "ours" | "theirs" | "both";
+
+export type ConflictPart =
+  | { kind: "text"; lines: string[] }
+  | { kind: "conflict"; ours: string[]; theirs: string[]; oursLabel: string; theirsLabel: string };
+
+const OPEN = /^<{7}(?: (.*))?$/;
+const BASE = /^\|{7}(?: .*)?$/;
+const MID = /^={7}$/;
+const CLOSE = /^>{7}(?: (.*))?$/;
+
+/**
+ * The file as text runs and conflict blocks, or null when its markers do not
+ * balance (a hand edit left half a block) — the caller falls back to the
+ * plain editor then rather than guess.
+ */
+export function parseConflicts(lines: string[]): ConflictPart[] | null {
+  const parts: ConflictPart[] = [];
+  let text: string[] = [];
+  let block: { ours: string[]; theirs: string[]; oursLabel: string } | null = null;
+  let section: "ours" | "base" | "theirs" = "ours";
+
+  for (const line of lines) {
+    if (!block) {
+      const open = line.match(OPEN);
+      if (open) {
+        if (text.length) parts.push({ kind: "text", lines: text });
+        text = [];
+        block = { ours: [], theirs: [], oursLabel: open[1] ?? "" };
+        section = "ours";
+      } else if (CLOSE.test(line) || MID.test(line)) {
+        return null;
+      } else {
+        text.push(line);
+      }
+      continue;
+    }
+    if (section === "ours" && BASE.test(line)) section = "base";
+    else if (section !== "theirs" && MID.test(line)) section = "theirs";
+    else if (section === "theirs" && CLOSE.test(line)) {
+      const close = line.match(CLOSE)!;
+      parts.push({ kind: "conflict", ...block, theirsLabel: close[1] ?? "" });
+      block = null;
+    } else if (OPEN.test(line)) return null;
+    else if (section === "ours") block.ours.push(line);
+    else if (section === "theirs") block.theirs.push(line);
+  }
+  if (block) return null;
+  if (text.length || !parts.length) parts.push({ kind: "text", lines: text });
+  return parts;
+}
+
+/** The file's lines with block `i` replaced by `choices[i]`; an unchosen block keeps its markers. */
+export function applyChoices(
+  parts: ConflictPart[],
+  choices: (ConflictChoice | undefined)[]
+): string[] {
+  const out: string[] = [];
+  let i = 0;
+  for (const p of parts) {
+    if (p.kind === "text") {
+      out.push(...p.lines);
+      continue;
+    }
+    const c = choices[i++];
+    if (c === "ours") out.push(...p.ours);
+    else if (c === "theirs") out.push(...p.theirs);
+    else if (c === "both") out.push(...p.ours, ...p.theirs);
+    else
+      out.push(
+        `<<<<<<< ${p.oursLabel}`.trimEnd(),
+        ...p.ours,
+        "=======",
+        ...p.theirs,
+        `>>>>>>> ${p.theirsLabel}`.trimEnd()
+      );
+  }
+  return out;
+}

client/src/lib/types.ts

@@ -2410,7 +2410,14 @@ export interface ProofFeature {
 }
 
 /** Which CLI drives a lane's pane. Fixed at lane creation and never patched. */
-export type LaneTool = "claude" | "codex";
+export type LaneTool = "claude" | "codex" | "antigravity";
+
+/** How each CLI is named on screen (strip tag, console title, prompt box). */
+export const LANE_TOOL_LABEL: Record<LaneTool, string> = {
+  claude: "Claude",
+  codex: "Codex",
+  antigravity: "Antigravity",
+};
 
 export interface Lane {
   id: number;
@@ -2437,6 +2444,7 @@ export interface Lane {
   gate_decision: string | null;
   ci_status: string | null;
   needs_action: string | null;
+  needs_action_session?: string | null;
   links: Record<string, string>;
   stages: Record<string, { enteredAt: string; evidence: string | null; result: string | null }>;
   notes: string | null;
@@ -2584,9 +2592,11 @@ export type LaneGitFacts =
       available: true;
       /** Branch name, or the literal `HEAD` for a detached checkout. */
       branch: string;
-      /** Short commit hash of HEAD. */
-      head: string;
-      /** Subject line of the HEAD commit. */
+      /** Short commit hash of HEAD; null in a repo with no commit yet. */
+      head: string | null;
+      /** True when the repo has no commit yet (a fresh `git init`). */
+      unborn?: boolean;
+      /** Subject line of the HEAD commit; "" when unborn. */
       subject: string;
       /** Tracked files with uncommitted changes. */
       dirty: number;
@@ -2603,6 +2613,10 @@ export type LaneGitFacts =
       ahead: number | null;
       /** Commits the upstream has that HEAD does not; null without an upstream. */
       behind: number | null;
+      /** A merge is in progress (issue #45). Absent on an older server. */
+      merging?: boolean;
+      /** Files the merge still holds unmerged, repo-wide. */
+      conflicts?: number;
     }
   | { available: false };
 
@@ -2651,6 +2665,9 @@ export type LaneFileContent =
       binary: boolean;
       truncated: boolean;
       lines: string[];
+      /** Version stamp of a whole, textual `work` file — what a save sends
+       *  back as `baseSha`. Absent at a commit, or when binary/truncated. */
+      sha?: string;
     }
   | { available: false };
 
@@ -2660,6 +2677,10 @@ export interface LaneTreeEntry {
   /** Path relative to the repo root. */
   path: string;
   dir: boolean;
+  /** A changed file's porcelain code (` M`, `??`, `A `, ` D`…); absent when clean. */
+  status?: string;
+  /** A folder with a changed or untracked file anywhere under it. */
+  changed?: true;
 }
 
 /** One row of a rendered diff — both gutters already resolved server-side. */

client/src/pages/GitCredentialsConfig.tsx

@@ -0,0 +1,206 @@
+/**
+ * @file GitCredentialsConfig.tsx
+ * @description The **Git credentials** tab of Settings (issue #45) — the
+ * logins AgentHub itself gives git for a dashboard fetch/pull/push, one per
+ * host, shared by everyone using this install. Lists them, replaces a token,
+ * adds one, deletes one. A token is write-only here: the server never returns
+ * one, so the form starts blank and the list shows only that one is saved.
+ * The git bar's login form saves into the same store.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+import { useCallback, useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { KeyRound, Pencil, Plus, Trash2 } from "lucide-react";
+import { api, type GitCredential } from "../lib/api";
+
+const INPUT =
+  "w-full rounded border border-border-light bg-surface-0 px-2 py-1 text-xs text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none";
+
+export function GitCredentialsConfig() {
+  const { t } = useTranslation("settings");
+  const [items, setItems] = useState<GitCredential[]>([]);
+  const [error, setError] = useState<string | null>(null);
+  const [form, setForm] = useState<{ url: string; username: string; token: string } | null>(null);
+
+  const load = useCallback(async () => {
+    try {
+      setItems((await api.gitCredentials.list()).items);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  }, []);
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const save = async () => {
+    if (!form) return;
+    setError(null);
+    let url: URL;
+    try {
+      url = new URL(form.url.trim());
+    } catch {
+      setError(t("gitCreds.badUrl"));
+      return;
+    }
+    try {
+      const r = await api.gitCredentials.save({
+        protocol: url.protocol.replace(/:$/, ""),
+        host: url.host,
+        username: form.username.trim(),
+        password: form.token,
+      });
+      setItems(r.items);
+      setForm(null);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  };
+
+  const remove = async (c: GitCredential) => {
+    if (!window.confirm(t("gitCreds.removeConfirm"))) return;
+    try {
+      setItems((await api.gitCredentials.remove(c.protocol, c.host)).items);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    }
+  };
+
+  return (
+    <div className="space-y-4">
+      <div className="flex items-start justify-between gap-4">
+        <div>
+          <h2 className="flex items-center gap-2 text-sm font-semibold text-fg-primary">
+            <KeyRound className="h-4 w-4 text-fg-muted" />
+            {t("gitCreds.title")}
+          </h2>
+          <p className="mt-1 max-w-2xl text-xs text-fg-muted">{t("gitCreds.description")}</p>
+        </div>
+        <button
+          type="button"
+          onClick={() => setForm({ url: "", username: "", token: "" })}
+          className="inline-flex shrink-0 items-center gap-1.5 rounded-lg border border-accent/40 bg-accent/15 px-3 py-1.5 text-xs font-medium text-accent transition-colors hover:bg-accent/25"
+        >
+          <Plus className="h-3.5 w-3.5" />
+          {t("gitCreds.add")}
+        </button>
+      </div>
+
+      {error && (
+        <p className="rounded-md border border-status-danger/40 bg-status-danger/10 px-3 py-2 text-xs text-status-danger">
+          {error}
+        </p>
+      )}
+
+      {form && (
+        <form
+          className="grid max-w-2xl gap-2 rounded-lg border border-border p-3 sm:grid-cols-3"
+          onSubmit={(e) => {
+            e.preventDefault();
+            void save();
+          }}
+        >
+          <input
+            aria-label={t("gitCreds.fieldHost")}
+            placeholder="https://git.example.com"
+            value={form.url}
+            onChange={(e) => setForm({ ...form, url: e.target.value })}
+            className={`${INPUT} font-mono`}
+          />
+          <input
+            aria-label={t("gitCreds.fieldUser")}
+            placeholder={t("gitCreds.fieldUser")}
+            autoComplete="off"
+            value={form.username}
+            onChange={(e) => setForm({ ...form, username: e.target.value })}
+            className={INPUT}
+          />
+          <input
+            type="password"
+            aria-label={t("gitCreds.fieldToken")}
+            placeholder={t("gitCreds.fieldToken")}
+            autoComplete="new-password"
+            value={form.token}
+            onChange={(e) => setForm({ ...form, token: e.target.value })}
+            className={INPUT}
+          />
+          <div className="flex gap-2 sm:col-span-3">
+            <button
+              type="submit"
+              disabled={!form.url.trim() || !form.username.trim() || !form.token}
+              className="rounded border border-accent/40 bg-accent/15 px-3 py-1 text-xs text-accent hover:bg-accent/25 disabled:cursor-not-allowed disabled:opacity-40"
+            >
+              {t("gitCreds.save")}
+            </button>
+            <button
+              type="button"
+              onClick={() => setForm(null)}
+              className="rounded border border-border-light px-3 py-1 text-xs text-fg-secondary hover:bg-surface-3"
+            >
+              {t("gitCreds.cancel")}
+            </button>
+          </div>
+        </form>
+      )}
+
+      <div className="overflow-hidden rounded-lg border border-border">
+        <table className="w-full text-left text-xs">
+          <thead className="bg-surface-2 text-[10px] uppercase tracking-wider text-fg-muted">
+            <tr>
+              <th className="px-3 py-2 font-medium">{t("gitCreds.colHost")}</th>
+              <th className="px-3 py-2 font-medium">{t("gitCreds.colUser")}</th>
+              <th className="px-3 py-2 font-medium">{t("gitCreds.colSaved")}</th>
+              <th className="px-3 py-2" />
+            </tr>
+          </thead>
+          <tbody>
+            {items.map((c) => (
+              <tr key={`${c.protocol}://${c.host}`} className="border-t border-border">
+                <td className="px-3 py-2 font-mono text-[11px] text-fg-primary">{c.host}</td>
+                <td className="px-3 py-2 text-fg-secondary">{c.username}</td>
+                <td className="px-3 py-2 text-fg-secondary">
+                  {new Date(c.savedAt).toLocaleString()}
+                </td>
+                <td className="px-3 py-2 text-right">
+                  <span className="inline-flex gap-1">
+                    <button
+                      type="button"
+                      aria-label={`${t("gitCreds.replace")} ${c.host}`}
+                      title={t("gitCreds.replace")}
+                      onClick={() =>
+                        setForm({
+                          url: `${c.protocol}://${c.host}`,
+                          username: c.username,
+                          token: "",
+                        })
+                      }
+                      className="rounded p-1 text-fg-muted transition-colors hover:bg-surface-3 hover:text-fg-primary"
+                    >
+                      <Pencil className="h-3.5 w-3.5" />
+                    </button>
+                    <button
+                      type="button"
+                      aria-label={`${t("gitCreds.remove")} ${c.host}`}
+                      title={t("gitCreds.remove")}
+                      onClick={() => void remove(c)}
+                      className="rounded p-1 text-fg-muted transition-colors hover:bg-surface-3 hover:text-status-danger"
+                    >
+                      <Trash2 className="h-3.5 w-3.5" />
+                    </button>
+                  </span>
+                </td>
+              </tr>
+            ))}
+            {items.length === 0 && (
+              <tr className="border-t border-border">
+                <td colSpan={4} className="px-3 py-4 text-center text-fg-muted">
+                  {t("gitCreds.empty")}
+                </td>
+              </tr>
+            )}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  );
+}

client/src/pages/Settings.tsx

@@ -699,12 +699,6 @@ export function Settings() {
       return res.ok ? t("hooks.success") : t("hooks.failed");
     });
 
-  const handleSkillsInstall = () =>
-    runAction("skills-install", async () => {
-      const res = await api.settings.skillsInstall();
-      return t("lanesSection.installSkillSuccess", { path: res.path });
-    });
-
   const handleGc = () =>
     runAction("gc", async () => {
       const res = await api.settings.gc({ dryRun: gcDryRun });
@@ -1354,23 +1348,6 @@ export function Settings() {
         <p className="text-xs text-fg-muted mb-4">{t("lanesSection.description")}</p>
 
         <div className="card p-5 space-y-4">
-          <div className="flex items-center justify-between flex-wrap gap-3">
-            <span className="text-xs text-fg-secondary">{t("lanesSection.installSkill")}</span>
-            <button
-              onClick={handleSkillsInstall}
-              disabled={actionLoading !== null}
-              className="btn-ghost text-xs disabled:opacity-50"
-            >
-              {actionLoading === "skills-install" ? (
-                <RefreshCw className="w-3.5 h-3.5 animate-spin" />
-              ) : (
-                <RotateCcw className="w-3.5 h-3.5" />
-              )}
-              {t("lanesSection.installSkill")}
-            </button>
-          </div>
-          {actionBanner(["skills-install"])}
-
           <div className="flex items-center justify-between flex-wrap gap-3">
             <label className="flex items-center gap-2 text-xs text-fg-secondary">
               <input

client/src/pages/SettingsHub.tsx

@@ -1,17 +1,18 @@
 /**
  * @file SettingsHub.tsx
- * @description Tabbed shell for /settings that hosts the dashboard's own settings plus one configuration panel per AI tool (Claude Code and Codex) plus the AI Router profiles they can be pointed at, with the active tab kept in the `?tool=` query param.
+ * @description Tabbed shell for /settings that hosts the dashboard's own settings plus one configuration panel per AI tool (Claude Code and Codex) plus the AI Router profiles they can be pointed at and the git logins dashboard fetch/pull/push use, with the active tab kept in the `?tool=` query param.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import type { ComponentType } from "react";
 import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
-import { Boxes, Router, Settings as SettingsIcon, SquareTerminal } from "lucide-react";
+import { Boxes, KeyRound, Router, Settings as SettingsIcon, SquareTerminal } from "lucide-react";
 import { PageTabs } from "../components/PageTabs";
 import { Settings } from "./Settings";
 import { CcConfig } from "./CcConfig";
 import { CodexConfig } from "./CodexConfig";
 import { AiRouterConfig } from "./AiRouterConfig";
+import { GitCredentialsConfig } from "./GitCredentialsConfig";
 
 interface ToolTab {
   id: string;
@@ -33,6 +34,12 @@ const TOOL_TABS: ToolTab[] = [
   { id: "claude-code", labelKey: "tools.claudeCode", Icon: Boxes, Panel: CcConfig },
   { id: "codex", labelKey: "tools.codex", Icon: SquareTerminal, Panel: CodexConfig },
   { id: "ai-router", labelKey: "tools.aiRouter", Icon: Router, Panel: AiRouterConfig },
+  {
+    id: "git-credentials",
+    labelKey: "tools.gitCredentials",
+    Icon: KeyRound,
+    Panel: GitCredentialsConfig,
+  },
 ];
 
 /**

client/src/pages/Workspace.tsx

@@ -40,7 +40,7 @@
  *
  * ----------------------------------------------------------------------------- */
 
-import { useCallback, useEffect, useState, useSyncExternalStore } from "react";
+import { useCallback, useEffect, useMemo, useState, useSyncExternalStore } from "react";
 import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import {
@@ -51,8 +51,8 @@ import {
   Pencil,
   Layers,
   PanelLeftClose,
-  ChevronsLeftRight,
   PanelRightClose,
+  Maximize2,
 } from "lucide-react";
 import { api } from "../lib/api";
 import type { CwdSuggestion, RunListResponse } from "../lib/api";
@@ -88,21 +88,23 @@ const CHANGES_SIZE_KEY = "agenthub.workspace.changesSize";
 /** The three widths the Changes panel cycles through, then closed. Reading a
  *  diff and watching a console want opposite amounts of room, and which one is
  *  "work" changes several times an hour — hence ONE control that steps
- *  narrow → 50/50 → 70/30 → closed, rather than a width button beside a
+ *  30/70 → 50/50 → full → closed, rather than a width button beside a
  *  collapse button that both live in the panel's tightest corner. */
-const CHANGES_SIZES = ["compact", "half", "wide"] as const;
+const CHANGES_SIZES = ["compact", "half", "full"] as const;
 type ChangesSize = (typeof CHANGES_SIZES)[number];
 const CHANGES_WIDTH: Record<ChangesSize, string> = {
-  compact: "w-[28rem] xl:w-[34rem]",
+  compact: "w-[30%]",
   half: "w-1/2",
-  wide: "w-[70%]",
+  // The console beside it is HIDDEN, not unmounted: a live run's terminal
+  // and a half-typed prompt must survive a round trip through full width.
+  full: "w-full",
 };
 /** The icon the one resize control shows AT each size: what the next click
- *  gives you — an even split, a wider panel, then closed. */
+ *  gives you — an even split, the full width, then closed. */
 const CHANGES_NEXT_ICON: Record<ChangesSize, typeof Columns2> = {
   compact: Columns2,
-  half: ChevronsLeftRight,
-  wide: PanelRightClose,
+  half: Maximize2,
+  full: PanelRightClose,
 };
 
 // ── Page ──────────────────────────────────────────────────────────────
@@ -158,7 +160,6 @@ function ConsoleArea({
   selectedLaneId,
   splitView,
   setLayout,
-  setPaneLaneId,
   binaryStatus,
   cwdSuggestions,
   activeRuns,
@@ -174,7 +175,6 @@ function ConsoleArea({
   selectedLaneId: number | null;
   splitView: SplitViewState;
   setLayout: (layout: SplitLayout) => void;
-  setPaneLaneId: (index: number, id: number) => void;
   binaryStatus: Record<LaneTool, { found: boolean; path: string | null }> | null;
   cwdSuggestions: CwdSuggestion[];
   activeRuns: RunListResponse | null;
@@ -186,6 +186,30 @@ function ConsoleArea({
   onLaneIdChange: (id: number | null) => void;
   showToggle?: boolean;
 }) {
+  // Every split pane shows the SELECTED lane, each in its own tmux session
+  // (slot = pane index). Tracking what each pane shows lets the others leave
+  // that run out of their Active runs, so no terminal is attached twice.
+  const [paneRunIds, setPaneRunIds] = useState<(string | null)[]>([]);
+  const onPaneHandle = useCallback((i: number, id: string | null) => {
+    setPaneRunIds((prev) => {
+      if (prev[i] === id) return prev;
+      const next = [...prev];
+      next[i] = id;
+      return next;
+    });
+  }, []);
+  const paneHandlers = useMemo(
+    () => [0, 1, 2, 3].map((i) => (id: string | null) => onPaneHandle(i, id)),
+    [onPaneHandle]
+  );
+  const hiddenFor = useMemo(
+    () =>
+      [0, 1, 2, 3].map((i) =>
+        paneRunIds.filter((id, j): id is string => j !== i && j < splitView.layout && !!id)
+      ),
+    [paneRunIds, splitView.layout]
+  );
+
   return (
     <>
       {showToggle && <SplitLayoutToggle splitView={splitView} setLayout={setLayout} />}
@@ -193,6 +217,7 @@ function ConsoleArea({
         <LaneConsolePane
           lanes={lanes}
           laneId={selectedLaneId}
+          onHandleChange={paneHandlers[0]}
           showLaneSelector={false}
           onLaneIdChange={onLaneIdChange}
           onLaneCreated={onLaneCreated}
@@ -210,13 +235,16 @@ function ConsoleArea({
             splitView.layout === 2 ? "grid-cols-2" : "grid-cols-2 grid-rows-2"
           }`}
         >
-          {splitView.paneLaneIds.map((id, i) => (
+          {Array.from({ length: splitView.layout }, (_, i) => (
             <LaneConsolePane
               key={i}
               lanes={lanes}
-              laneId={id}
-              showLaneSelector
-              onLaneIdChange={(newId) => setPaneLaneId(i, newId)}
+              laneId={selectedLaneId}
+              slot={i}
+              hiddenRunIds={hiddenFor[i]}
+              onHandleChange={paneHandlers[i]}
+              showLaneSelector={false}
+              onLaneIdChange={onLaneIdChange}
               onLaneCreated={onLaneCreated}
               binaryStatus={binaryStatus}
               cwdSuggestions={cwdSuggestions}
@@ -330,16 +358,6 @@ export function Workspace() {
     });
   }, []);
 
-  const setPaneLaneId = useCallback((index: number, id: number) => {
-    setSplitView((prev) => {
-      const paneLaneIds = [...prev.paneLaneIds];
-      paneLaneIds[index] = id;
-      const next = { ...prev, paneLaneIds };
-      writeSplitViewState(next);
-      return next;
-    });
-  }, []);
-
   // Pre-flight: probe binary + active runs + cwd suggestions + lanes on mount
   const refreshLanes = useCallback(async () => {
     try {
@@ -377,8 +395,8 @@ export function Workspace() {
   }, [lanes, searchParams, setSearchParams]);
 
   useEffect(() => {
-    Promise.all([api.run.binary("claude"), api.run.binary("codex")])
-      .then(([claude, codex]) => setBinaryStatus({ claude, codex }))
+    Promise.all([api.run.binary("claude"), api.run.binary("codex"), api.run.binary("antigravity")])
+      .then(([claude, codex, antigravity]) => setBinaryStatus({ claude, codex, antigravity }))
       // Fetch failure (server unreachable, proxy misrouted, etc.) isn't proof
       // `claude` or `codex` is missing from PATH — leave the probe unresolved rather than
       // showing a misleading "binary missing" banner for an unrelated fault.
@@ -505,6 +523,10 @@ export function Workspace() {
   }, [refreshList]);
 
   const currentLane = selectedLaneId !== null ? lanes.find((l) => l.id === selectedLaneId) : null;
+  // Only claude lanes carry a pipeline (codex and antigravity emit no hooks),
+  // and only while a template is installed — none ships, so it is dormant.
+  const noPipeline =
+    !!currentLane && (currentLane.tool !== "claude" || currentLane.pipeline_nodes.length === 0);
 
   // Feature list follows the selected lane, resets the viewer on lane switch.
   useEffect(() => {
@@ -565,8 +587,11 @@ export function Workspace() {
 
   // Viewport locked only when a live run is showing (TerminalView needs locked
   // viewport for chat scrolling). The config-card screen needs normal page flow
-  // so the form is fully reachable on short windows.
-  const viewportLocked = paneHasActiveRun;
+  // so the form is fully reachable on short windows. A full-width Changes panel
+  // hides that form anyway, and without a locked height it shrinks to its
+  // content — the editor inside it collapsed to a few lines (no live run).
+  const viewportLocked =
+    paneHasActiveRun || (!!currentLane && changesOpen && changesSize === "full");
 
   const handleLaneAction = async (id: number, action: string, body?: Record<string, unknown>) => {
     setLaneActionError(null);
@@ -733,7 +758,9 @@ export function Workspace() {
         <div className="flex min-h-0 flex-1 gap-4">
           <section
             data-testid="lane-detail"
-            className={`flex min-h-0 min-w-0 flex-1 flex-col ${currentLane ? "card p-4" : ""}`}
+            className={`flex min-h-0 min-w-0 flex-1 flex-col ${currentLane ? "card p-4" : ""}${
+              currentLane && changesOpen && changesSize === "full" ? " hidden" : ""
+            }`}
           >
             {/* One header row, not two. The pipeline picker, the stage badges,
               the feature picker and the router select used to sit on a second
@@ -792,40 +819,54 @@ export function Workspace() {
                     <Pencil className="h-3 w-3 shrink-0 text-fg-muted opacity-0 transition-opacity group-hover:opacity-100" />
                   </button>
                 )}
-                <span className="shrink-0 tabular-nums text-xs text-fg-muted">
-                  {since(currentLane.stage_seconds)}
-                </span>
+                {/* A lane with no pipeline (non-claude, or no template
+                    installed): no time-at-stage, no pipeline or feature
+                    picker, no map. */}
+                {!noPipeline && (
+                  <span className="shrink-0 tabular-nums text-xs text-fg-muted">
+                    {since(currentLane.stage_seconds)}
+                  </span>
+                )}
                 {showInfo && (
                   <>
-                    <select
-                      data-testid="pipeline-picker"
-                      aria-label={tLanes("pipelinePicker.label")}
-                      className="rounded border border-border bg-surface-1 px-2 py-0.5 text-xs text-fg-secondary disabled:opacity-60"
-                      value={currentLane.pipeline}
-                      disabled={!!viewedFeature}
-                      title={
-                        viewedFeature
-                          ? tLanes("features.viewingArchived", { slug: viewedFeature.slug })
-                          : undefined
-                      }
-                      onChange={(e) => void handlePipelineChange(currentLane.id, e.target.value)}
-                    >
-                      {(pipelineTemplates.length
-                        ? pipelineTemplates
-                        : [{ id: currentLane.pipeline, name: currentLane.pipeline_name, nodes: [] }]
-                      ).map((p) => (
-                        <option key={p.id} value={p.id}>
-                          {p.nodes.length ? `${p.name} (${p.nodes.length})` : p.name}
-                        </option>
-                      ))}
-                    </select>
-                    <LaneRouterRow lane={currentLane} />
+                    {!noPipeline && (
+                      <select
+                        data-testid="pipeline-picker"
+                        aria-label={tLanes("pipelinePicker.label")}
+                        className="rounded border border-border bg-surface-1 px-2 py-0.5 text-xs text-fg-secondary disabled:opacity-60"
+                        value={currentLane.pipeline}
+                        disabled={!!viewedFeature}
+                        title={
+                          viewedFeature
+                            ? tLanes("features.viewingArchived", { slug: viewedFeature.slug })
+                            : undefined
+                        }
+                        onChange={(e) => void handlePipelineChange(currentLane.id, e.target.value)}
+                      >
+                        {(pipelineTemplates.length
+                          ? pipelineTemplates
+                          : [
+                              {
+                                id: currentLane.pipeline,
+                                name: currentLane.pipeline_name,
+                                nodes: [],
+                              },
+                            ]
+                        ).map((p) => (
+                          <option key={p.id} value={p.id}>
+                            {p.nodes.length ? `${p.name} (${p.nodes.length})` : p.name}
+                          </option>
+                        ))}
+                      </select>
+                    )}
+                    {/* `agy` has no endpoint to point at a router. */}
+                    {currentLane.tool !== "antigravity" && <LaneRouterRow lane={currentLane} />}
                     {/* No stage chip and no "auto: <stage>" chip here: the
                         PipelineMap right below this header already draws both
                         — the declared node as the current ring, the detected
                         one as its amber badge — so the chips were a second,
                         smaller copy of the same two facts. */}
-                    {features.length > 0 && (
+                    {!noPipeline && features.length > 0 && (
                       <select
                         data-testid="feature-picker"
                         className="rounded border border-border bg-surface-1 px-2 py-0.5 text-xs"
@@ -844,7 +885,7 @@ export function Workspace() {
                   </>
                 )}
                 <div className="ml-auto flex items-center gap-2">
-                  {/* Per-lane actions (agents install, mcp sync, sync-base check)
+                  {/* Per-lane actions (mcp sync, sync-base check)
                     belong beside the lane they act on, not in a page header. */}
                   <LaneToolsMenu lane={currentLane} />
                   <button
@@ -874,7 +915,8 @@ export function Workspace() {
             )}
             {currentLane && showInfo && (
               <div className="max-h-[45vh] shrink-0 overflow-y-auto">
-                <div className="mb-3">
+                {/* No margin when the card rendered nothing (see LaneCard). */}
+                <div className="mb-3 has-[>div:empty]:mb-0">
                   <LaneCard
                     lane={currentLane}
                     onAction={(a, b) => handleLaneAction(currentLane.id, a, b)}
@@ -882,25 +924,23 @@ export function Workspace() {
                       (l) => l.source_repo === currentLane.cwd && l.id !== currentLane.id
                     )}
                     onSelectLane={setSelectedLaneId}
-                    onNewLaneFromRepo={(repo, branch) => {
-                      setAddLanePrefill({ sourceRepo: repo, branch });
-                      setAddLaneOpen(true);
-                    }}
                   />
                 </div>
-                <div className="mb-3">
-                  <PipelineMap
-                    nodes={
-                      viewedFeature ? viewedFeature.pipeline_nodes : currentLane.pipeline_nodes
-                    }
-                    detectedSignal={viewedFeature ? undefined : currentLane.detected_signal}
-                  />
-                  {viewedFeature && (
-                    <p data-testid="feature-viewer-banner" className="mb-2 text-xs text-fg-muted">
-                      {tLanes("features.viewingArchived", { slug: viewedFeature.slug })}
-                    </p>
-                  )}
-                </div>
+                {!noPipeline && (
+                  <div className="mb-3">
+                    <PipelineMap
+                      nodes={
+                        viewedFeature ? viewedFeature.pipeline_nodes : currentLane.pipeline_nodes
+                      }
+                      detectedSignal={viewedFeature ? undefined : currentLane.detected_signal}
+                    />
+                    {viewedFeature && (
+                      <p data-testid="feature-viewer-banner" className="mb-2 text-xs text-fg-muted">
+                        {tLanes("features.viewingArchived", { slug: viewedFeature.slug })}
+                      </p>
+                    )}
+                  </div>
+                )}
                 {proofFeature &&
                   (Object.keys(proofFeature.groups).length > 0 || proofFeature.ticket_report) && (
                     <div data-testid="proof-gallery" className="mt-2">
@@ -956,7 +996,6 @@ export function Workspace() {
                 selectedLaneId={selectedLaneId}
                 splitView={splitView}
                 setLayout={setLayout}
-                setPaneLaneId={setPaneLaneId}
                 binaryStatus={binaryStatus}
                 cwdSuggestions={cwdSuggestions}
                 activeRuns={activeRuns}
@@ -1014,7 +1053,20 @@ export function Workspace() {
                     })()}
                   </button>
                 </div>
-                <LaneChangesPanel laneId={currentLane.id} />
+                <LaneChangesPanel
+                  laneId={currentLane.id}
+                  full={changesSize === "full"}
+                  // A sibling worktree forks from the lane's SOURCE repo when
+                  // it has one (this lane is itself a worktree of it); an
+                  // adopted lane is its own repo.
+                  onNewLane={(branch) => {
+                    setAddLanePrefill({
+                      sourceRepo: currentLane.source_repo || currentLane.cwd,
+                      branch,
+                    });
+                    setAddLaneOpen(true);
+                  }}
+                />
               </aside>
             ) : (
               <button

client/src/pages/__tests__/GitCredentialsConfig.test.tsx

@@ -0,0 +1,101 @@
+/**
+ * @file Tests for the Git credentials settings tab (issue #45): lists saved
+ * logins without ever rendering a token, replaces the token for a host, adds
+ * one from a URL, and deletes only after a confirm.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { GitCredentialsConfig } from "../GitCredentialsConfig";
+import { api } from "../../lib/api";
+
+vi.mock("../../lib/api", () => ({
+  api: { gitCredentials: { list: vi.fn(), save: vi.fn(), remove: vi.fn() } },
+}));
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({ t: (key: string) => key }),
+}));
+
+const saved = {
+  protocol: "https" as const,
+  host: "git.smartgift.io.vn",
+  username: "vi",
+  savedAt: "2026-09-25T01:00:00.000Z",
+  hasToken: true as const,
+};
+
+beforeEach(() => {
+  vi.mocked(api.gitCredentials.list)
+    .mockReset()
+    .mockResolvedValue({ items: [saved] });
+  vi.mocked(api.gitCredentials.save)
+    .mockReset()
+    .mockResolvedValue({ items: [saved] });
+  vi.mocked(api.gitCredentials.remove).mockReset().mockResolvedValue({ items: [] });
+});
+
+describe("GitCredentialsConfig", () => {
+  it("lists a saved login and replaces its token", async () => {
+    const user = userEvent.setup();
+    render(<GitCredentialsConfig />);
+    expect(await screen.findByText("git.smartgift.io.vn")).toBeInTheDocument();
+    expect(screen.getByText("vi")).toBeInTheDocument();
+
+    await user.click(screen.getByRole("button", { name: "gitCreds.replace git.smartgift.io.vn" }));
+    expect(screen.getByLabelText("gitCreds.fieldHost")).toHaveValue("https://git.smartgift.io.vn");
+    expect(screen.getByLabelText("gitCreds.fieldToken")).toHaveValue("");
+    await user.type(screen.getByLabelText("gitCreds.fieldToken"), "newtok");
+    await user.click(screen.getByRole("button", { name: "gitCreds.save" }));
+
+    await waitFor(() =>
+      expect(api.gitCredentials.save).toHaveBeenCalledWith({
+        protocol: "https",
+        host: "git.smartgift.io.vn",
+        username: "vi",
+        password: "newtok",
+      })
+    );
+    expect(document.body.textContent).not.toContain("newtok");
+  });
+
+  it("adds a login from a URL with a port", async () => {
+    const user = userEvent.setup();
+    render(<GitCredentialsConfig />);
+    await user.click(await screen.findByRole("button", { name: "gitCreds.add" }));
+    await user.type(
+      screen.getByLabelText("gitCreds.fieldHost"),
+      "http://gitea.lan:3000/org/repo.git"
+    );
+    await user.type(screen.getByLabelText("gitCreds.fieldUser"), "bot");
+    await user.type(screen.getByLabelText("gitCreds.fieldToken"), "t");
+    await user.click(screen.getByRole("button", { name: "gitCreds.save" }));
+    await waitFor(() =>
+      expect(api.gitCredentials.save).toHaveBeenCalledWith({
+        protocol: "http",
+        host: "gitea.lan:3000",
+        username: "bot",
+        password: "t",
+      })
+    );
+  });
+
+  it("deletes only after a confirm", async () => {
+    const confirm = vi
+      .spyOn(window, "confirm")
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(true);
+    const user = userEvent.setup();
+    render(<GitCredentialsConfig />);
+    const del = await screen.findByRole("button", { name: "gitCreds.remove git.smartgift.io.vn" });
+    await user.click(del);
+    expect(api.gitCredentials.remove).not.toHaveBeenCalled();
+    await user.click(del);
+    await waitFor(() =>
+      expect(api.gitCredentials.remove).toHaveBeenCalledWith("https", "git.smartgift.io.vn")
+    );
+    confirm.mockRestore();
+  });
+});

client/src/pages/__tests__/Workspace.changesPanel.test.tsx

@@ -1,7 +1,7 @@
 /**
  * @file Workspace.changesPanel.test.tsx
- * @description The Changes panel is ONE control: it steps narrow → 50/50 →
- * 70/30 → closed, and the rail reopens it narrow. The width survives a reload.
+ * @description The Changes panel is ONE control: it steps 30/70 → 50/50 →
+ * full → closed, and the rail reopens it at 30/70. The width survives a reload.
  * All of it lives in localStorage and reaches no server — the same rule as the
  * lane strip's order.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -75,6 +75,7 @@ vi.mock("../../lib/api", async (importOriginal) => {
         }),
         pipelines: r({ pipelines: [] }),
         git: r({ available: false }),
+        gitTree: r({ entries: [] }),
         runtime: r({ up: false, ports: {}, lastError: null }),
         features: { list: r({ features: [] }), show: r({ feature: null }) },
         proof: { list: r({ features: [] }), imageUrl: () => "" },
@@ -142,26 +143,28 @@ describe("Workspace — the Changes panel's width", () => {
     }
   }
 
-  it("steps narrow → 50/50 → 70/30 → closed on one control", async () => {
+  it("steps 30/70 → 50/50 → full → closed on one control, with no 70/30 step", async () => {
     await openPanel();
     const card = () => screen.getByTestId("lane-changes-card");
-    expect(card().className).toContain("w-[28rem]");
+    expect(card().className).toContain("w-[30%]");
 
     fireEvent.click(screen.getByTestId("lane-changes-resize"));
     expect(card().className).toContain("w-1/2");
 
+    // Full width HIDES the console beside it — hidden, still mounted.
     fireEvent.click(screen.getByTestId("lane-changes-resize"));
-    expect(card().className).toContain("w-[70%]");
+    expect(card().className).toContain("w-full");
+    expect(screen.getByTestId("lane-detail").className).toContain("hidden");
 
-    // Past the widest step the panel closes — and reopens narrow, not back at
-    // 70/30, which is why closing resets the width.
+    // Past the widest step the panel closes — and reopens at 30/70, not back
+    // at full width, which is why closing resets the width.
     fireEvent.click(screen.getByTestId("lane-changes-resize"));
     await settle();
     expect(screen.queryByTestId("lane-changes-card")).toBeNull();
 
     fireEvent.click(screen.getByTestId("lane-changes-expand"));
     await settle();
-    expect(card().className).toContain("w-[28rem]");
+    expect(card().className).toContain("w-[30%]");
   });
 
   it("remembers the width across a reload, and never asks the server", async () => {

client/src/pages/__tests__/Workspace.test.tsx

@@ -652,46 +652,38 @@ describe("split terminal view", () => {
     expect(screen.queryAllByTestId("pane-lane-select")).toHaveLength(0);
   });
 
-  it("switching to 2-pane layout renders two independent panes with lane pickers", async () => {
+  it("switching to 2-pane layout renders two panes bound to the selected lane", async () => {
     await renderWorkspace();
     fireEvent.click(screen.getByRole("button", { name: /2.*pane/i }));
     await settle();
-    expect(screen.getAllByTestId(/console-body|pane-empty/)).toHaveLength(2);
-    expect(screen.getAllByTestId("pane-lane-select")).toHaveLength(2);
+    expect(screen.getAllByTestId("console-body")).toHaveLength(2);
+    expect(screen.queryAllByTestId("pane-lane-select")).toHaveLength(0);
   });
 
   it("switching to 4-pane layout renders four panes", async () => {
     await renderWorkspace();
     fireEvent.click(screen.getByRole("button", { name: /4.*pane/i }));
     await settle();
-    expect(screen.getAllByTestId(/console-body|pane-empty/)).toHaveLength(4);
+    expect(screen.getAllByTestId("console-body")).toHaveLength(4);
   });
 
-  it("persists the layout and pane selections to localStorage across remounts", async () => {
+  it("persists the layout to localStorage across remounts", async () => {
     const { unmount } = await renderWorkspace();
     fireEvent.click(screen.getByRole("button", { name: /2.*pane/i }));
     await settle();
-    const selects = screen.getAllByTestId("pane-lane-select");
-    const select = selects[1];
-    expect(select).toBeDefined();
-    fireEvent.change(select!, { target: { value: String(lanesToReturn[1]!.id) } });
-    await settle();
     unmount();
 
     await renderWorkspace();
-    const persistedSelects = screen.getAllByTestId("pane-lane-select");
-    expect(persistedSelects).toHaveLength(2);
-    expect((persistedSelects[1] as HTMLSelectElement).value).toBe(String(lanesToReturn[1]!.id));
+    expect(screen.getAllByTestId("console-body")).toHaveLength(2);
   });
 
-  it("falls back to unselected when a persisted lane id no longer exists", async () => {
+  it("ignores a persisted per-pane lane id: every pane follows the selected lane", async () => {
     localStorage.setItem(
       "agenthub.workspace.splitView",
       JSON.stringify({ layout: 2, paneLaneIds: [9999, null] })
     );
     await renderWorkspace();
-    // Lane 9999 doesn't exist, so it falls back to null (unselected).
-    // The second pane is already null. Both render as pane-empty.
-    expect(screen.getAllByTestId("pane-empty")).toHaveLength(2);
+    expect(screen.queryAllByTestId("pane-empty")).toHaveLength(0);
+    expect(screen.getAllByTestId("console-body")).toHaveLength(2);
   });
 });

client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap

@@ -5570,11 +5570,16 @@ exports[`screen snapshots > Run 1`] = `
                   >
                     Prompt
                   </label>
-                  <textarea
-                    class="w-full bg-surface-2 border border-border rounded-md px-3 py-2 text-[11px] font-mono text-fg-primary placeholder:text-fg-muted focus:outline-none focus:border-accent/50 resize-none"
-                    placeholder="Ask Claude anything…"
-                    rows="5"
-                  />
+                  <div
+                    class="relative"
+                  >
+                    <textarea
+                      class="w-full bg-surface-2 border border-border rounded-md px-3 py-2 text-[11px] font-mono text-fg-primary placeholder:text-fg-muted focus:outline-none focus:border-accent/50 resize-none"
+                      placeholder="Ask Claude anything…"
+                      rows="5"
+                      spellcheck="false"
+                    />
+                  </div>
                   <div
                     class="mt-1 text-[10px] text-fg-muted"
                   >
@@ -8430,44 +8435,11 @@ exports[`screen snapshots > Settings 1`] = `
       <p
         class="text-xs text-fg-muted mb-4"
       >
-        Machine-wide housekeeping and one-time setup for the ship-feature-lane pipeline.
+        Machine-wide lane housekeeping.
       </p>
       <div
         class="card p-5 space-y-4"
       >
-        <div
-          class="flex items-center justify-between flex-wrap gap-3"
-        >
-          <span
-            class="text-xs text-fg-secondary"
-          >
-            Install ship-feature-lane skill
-          </span>
-          <button
-            class="btn-ghost text-xs disabled:opacity-50"
-          >
-            <svg
-              class="lucide lucide-rotate-ccw w-3.5 h-3.5"
-              fill="none"
-              height="24"
-              stroke="currentColor"
-              stroke-linecap="round"
-              stroke-linejoin="round"
-              stroke-width="2"
-              viewBox="0 0 24 24"
-              width="24"
-              xmlns="http://www.w3.org/2000/svg"
-            >
-              <path
-                d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8"
-              />
-              <path
-                d="M3 3v5h5"
-              />
-            </svg>
-            Install ship-feature-lane skill
-          </button>
-        </div>
         <div
           class="flex items-center justify-between flex-wrap gap-3"
         >
@@ -10359,7 +10331,7 @@ exports[`screen snapshots > Settings 1`] = `
             <p
               class="text-[10px] text-status-warning/90 mt-1"
             >
-              UI build v1.8.5 (rebuild client to match)
+              UI build v1.8.12 (rebuild client to match)
             </p>
           </div>
           <div

docs/API.md

@@ -135,7 +135,7 @@ POST /api/lanes/ensure
 ```
 
 ```json
-{ "cwd": "/absolute/path/to/work", "title": "App package", "pipeline": "ship-feature", "tool": "codex" }
+{ "cwd": "/absolute/path/to/work", "title": "App package", "pipeline": "default", "tool": "codex" }
 ```
 
 `cwd` is optional — when missing or empty the server falls back to
@@ -192,14 +192,22 @@ slugified from its title once, at creation.
 
 `pipeline` is patchable, which is how a lane moves between templates after
 creation (`agenthub lanes pipeline <template-id>`). An id no template defines is
-rejected with `400 EBADPIPELINE` rather than stored: `getPipeline` falls back
-to the default template when READING, so an unvalidated write would be
+rejected with `400 EBADPIPELINE` rather than stored (`default` is always
+accepted): `getPipeline` falls back to the default template when READING, so an unvalidated write would be
 accepted and then silently render the wrong map forever. Same 400 treatment as
 `EBADKIND`. Switching a template re-resolves the lane's existing declared
 `stage` string against the new node list — a stage the old template knew may
 resolve to nothing in the new one, leaving `progress: 0` and no `current` node
 until the next `agenthub stage`.
 
+**Pipelines are dormant until a template is installed.** AgentHub ships no
+pipeline template; templates come only from `DASHBOARD_PIPELINES_DIR` (see
+`docs/LANES.md#custom-pipeline-templates`). With none installed, every lane is
+on an empty `default` pipeline (`pipeline_nodes: []`, `progress: 0`),
+`GET /api/lanes/pipelines` returns `{ "pipelines": [] }`, and
+`POST /api/lanes/:id/stage` answers
+`400 { "error": { "code": "ENOPIPELINE", "message": "no pipeline template is installed, so this lane has no stages to declare (drop a template into DASHBOARD_PIPELINES_DIR to turn stages on)", "stages": [] } }`.
+
 #### Provision a managed worktree
 
 ```http
@@ -224,7 +232,10 @@ existing `lane_update` message when the lane becomes `idle` or `failed`.
 runs will spawn. Immutable once the lane is created; an attempt to update it on
 an existing lane returns `400 EBADTOOL`.
 
-`sourceRepo` must exist, be absolute, and be a git repository. When `base` is
+`sourceRepo` must exist, be absolute, and be a git repository with at least
+one commit — a repo with no commits has nothing to branch from and is refused
+with `400 EEMPTYREPO` before any lane row is created (adopt it as a Repo lane
+with `POST /api/lanes/ensure` instead, commit, then `publish`). When `base` is
 omitted, it defaults to the `LANE_BASE_BRANCH` env var, or `main` when that is
 also unset. The feature branch is named `<LANE_BRANCH_PREFIX><slug>` (prefix
 defaults to `feat/`). `title` (or an optional `slug`) determines the
@@ -261,6 +272,8 @@ All fields are optional. The tool (CLI invoked) comes from the lane itself, neve
 - **`approval`** — one of `on-request` or `never`, or omitted/empty for no approval prompt. Passed to `codex -a <value>`.
 - **`resumeSessionId`** or **`resumeLast: true`** — resume an earlier run instead of starting new. For Codex lanes specifically, `resumeLast: true` uses `codex resume --last`; `resumeSessionId` uses `codex resume <sessionId>`. For Claude lanes, `resumeSessionId` re-attaches a Claude session by id.
 
+- **`slot`** — which Workspace split pane's session to start, `0`–`3` (default `0`, else `400 EBADSLOT`). Slot 0 is the lane's own `agenthub-lane-<id>` and is what `run_id` records; slots 1–3 are extra sessions on the same lane, `agenthub-lane-<id>-<slot>`, and never touch `run_id`/`status`. The response adds `run_id`: the session this start opened. `stop`, `reset` and `remove` kill every slot's session, not only `run_id`.
+
 Error `503 ETMUXMISSING` is returned when the host has no `tmux` binary. Every run the dashboard starts is a tmux session, so this is a missing dependency rather than a bad request — the message carries the install command, and the same code comes back from `POST /api/run`. Nothing else in the dashboard is affected.
 
 Error `409 ERUNLIVE` is returned if the lane already has a live run; stop it first with the `stop` action. The same code and status come back when the lane's tmux pane is already running an agent while a `prompt` or `resumeSessionId` was sent — that argv cannot be typed over a live agent, so the request is refused instead of answered 200 with nothing done. A start that asks for neither still adopts the existing pane silently.
@@ -378,6 +391,7 @@ What the lane's directory looks like to git right now:
   "available": true,
   "branch": "feat/rename-metric",
   "head": "9b3e74a",
+  "unborn": false,
   "subject": "free-text rule mode in the form",
   "dirty": 2,
   "untracked": 1,
@@ -392,8 +406,14 @@ What the lane's directory looks like to git right now:
 }
 ```
 
+- `dirty`, `untracked` and `files` cover only the lane's own directory, with
+  cwd-relative, unquoted paths — a lane that is a subdirectory of its repo does
+  not count its siblings' files (the same scoping as `/git/changes`).
 - A `cwd` that is missing, is not a git repository, or makes git fail returns
   `{"available": false}` with HTTP **200** — a normal state, not a fault.
+- A repo with **no commit yet** (a fresh `git init`) is available too: it
+  reports `unborn: true`, `head: null`, `subject: ""` and the branch the first
+  commit will land on.
 - `files` names the files the counts came from, **capped at 20** (the counts
   themselves are never capped). `status` is the two-character
   `git status --porcelain` code; `path` is the new path for a rename.
@@ -432,6 +452,12 @@ unresolvable one is `400 EBADREV`, never an empty diff).
 range the diff has effectively become the whole file, which is what "expand
 all" means in the panel.
 
+Every path on the lane git surface (reads and writes) is **relative to the
+lane's `cwd`**, even when that cwd is a subdirectory of its repo: changes
+outside the cwd are not listed and cannot be named. Paths are literal file
+names, never pathspec globs — `new*.js` or `app/[id]/page.js` names exactly
+that file.
+
 ```json
 {
   "available": true,
@@ -487,8 +513,10 @@ all" means in the panel.
 ```http
 GET /api/lanes/:id/git/log?limit=30[&file=<path>]
 GET /api/lanes/:id/git/file?path=<path>[&rev=work|HEAD|<sha>]
+PUT /api/lanes/:id/git/file   {path, content, baseSha}
 GET /api/lanes/:id/git/ls?q=<substring>
 GET /api/lanes/:id/git/tree?path=<dir>
+GET /api/lanes/:id/git/tree-all
 ```
 
 The reads behind the Changes panel's **History**, whole-file view, quick-open
@@ -497,19 +525,43 @@ and file explorer. All four are read-only and unguarded, and all four answer
 
 - **`/git/log`** → `{available, commits:[{sha, short, subject, author, date,
   refs}]}`, newest first, `limit` clamped to 200. `file=` narrows it to the
-  commits touching that path. Reading one commit's diff is
+  commits touching that path — relative, no `..` segment, else
+  `400 EBADPATH`. Reading one commit's diff is
   `/git/changes?range=commit&sha=`.
-- **`/git/file`** → `{available, path, rev, binary, truncated, lines}`.
+- **`PUT /git/file`** saves the whole-file editor (same-origin guarded;
+  `server/lib/lane-file-write.js`). Same path guards as the read, plus: the
+  file must already exist, be text and within the 1 MB cap, and `baseSha`
+  must equal the `sha` it was opened at — otherwise `409 ESTALE`, never an
+  overwrite. `403 ESECRET` for `settings.local.json`; `400 EBADPATH`,
+  `ENOFILE`, `EBADCONTENT`, `ETOOBIG`, `EBINARY`. Answers the file re-read,
+  fresh `sha` included. CRLF endings and the final newline are preserved.
+- **`/git/file`** → `{available, path, rev, binary, truncated, lines, sha?}`
+  (`sha` only for a whole, textual `work` file: what a save sends back).
   `rev=work` (default) is the file on disk — the one branch that reads the
-  filesystem, and it is realpath-confined to the lane directory; anything else
-  goes through `git show <rev>:<path>`. Binary content is reported, never
-  returned. Capped at 1 MB. `400 EBADPATH`, `EBADREV` or `ENOFILE`.
+  filesystem, and it is realpath-confined to the lane directory (a symlink
+  resolving outside it is `EBADPATH`); anything else goes through
+  `git show <rev>:./<path>` (cwd-relative). At EVERY rev the path must be
+  relative with no `..` segment (else `400 EBADPATH`), and it is normalised
+  (`./a//b` → `a/b`, also the `path` echoed back). Binary content is reported,
+  never returned. Capped at 1 MB — a larger file is `truncated: true`, never
+  `ENOFILE` (a working-tree file is read only up to the cap, never whole).
+  `400 EBADPATH`, `EBADREV` or `ENOFILE`. `.claude/settings.local.json`
+  (where a lane's AI Router key lives) is `403 ESECRET` at EVERY rev and at
+  ANY depth (`sub/.claude/settings.local.json`, a subdirectory lane's key, as
+  seen from a lane at the repo root), and so is any path that RESOLVES to it
+  (a symlinked `.claude` → `conf/` makes it `conf/settings.local.json`). In
+  fact ANY file named `settings.local.json`, in any directory and at any rev,
+  is refused — a symlink target's name is all a lane above it, or a commit of
+  it, ever sees. Its hunks are never returned by `/git/changes` either.
 - **`/git/ls`** → `{available, paths, truncated, total}`, capped at 500. It
   reads `git ls-files`, so ignored files never appear and no skip-list has to
   be maintained; basename hits rank first.
-- **`/git/tree`** → `{available, path, entries:[{name, path, dir}], truncated}`
-  — one directory level, tracked entries only, directories folded and listed
-  first. `400 EBADPATH` for a path that escapes the lane.
+- **`/git/tree`** → `{available, path, entries:[{name, path, dir, status?, changed?}], truncated}`
+  — one directory level: tracked files plus untracked ones git does not
+  ignore (`ls-files --cached --others --exclude-standard`), directories folded
+  and listed first. A changed file carries its porcelain `status` (` M`, `??`,
+  `A `, ` D`…), a folder with anything changed under it `changed: true`. `400 EBADPATH` for a path that escapes the lane.
+- **`/git/tree-all`** → `{available, levels: {"<dir>": [{name, path, dir}]}, truncated}` — every level of the same tree (entries decorated the same way) from ONE `git ls-files`, each level shaped and capped like `/git/tree`'s; the Files tab's **Expand all folders** is this one request instead of one per folder.
 
 #### Read a lane's own branches
 
@@ -530,20 +582,29 @@ POST /api/lanes/:id/git/:action
 ```
 
 The git **writes** the dashboard offers. Guarded (same-origin) and serialized
-per lane under the lane lock.
+per git index (the lane lock keyed on the worktree's git dir), so a claude and
+a codex lane on one cwd — or a root and a subdirectory lane of one repo —
+cannot collide on `index.lock`.
 
 | Action | Runs | Body |
 | --- | --- | --- |
 | `fetch` | `git fetch --all --prune` | — |
 | `pull` | `git pull --ff-only` | — |
-| `push` | `git push -u origin HEAD` | — |
+| `push` | `git push -u <remote> HEAD` — the branch's upstream remote, else the only remote, else `origin`, else `400 ENOREMOTE` | — |
 | `stage` | `git add -- <paths>` | `{"paths": ["..."]}` |
-| `unstage` | `git restore --staged -- <paths>` | `{"paths": ["..."]}` |
+| `unstage` | `git restore --staged -- <paths>` (a staged rename also passes its original path, so both halves unstage) | `{"paths": ["..."]}` |
 | `discard` | `git restore --source=HEAD --staged --worktree` (tracked) / `git clean -fd` (untracked) | `{"paths": ["..."], "confirm": true}` |
+| `stage-hunk` | `git apply --cached` of ONE hunk of `git diff -U<context> HEAD -- <path>` — or, with `block`, of only that hunk's `block`-th run of +/- lines (the other runs folded into context, as an edited `git add -p` hunk) | `{"path": "...", "hunk": "@@ -1,2 +1,3 @@", "block": 0, "context": 3}` |
+| `discard-hunk` | `git apply -R` of that one hunk (or that one `block` of it), off the working tree | `{"path": "...", "hunk": "@@ ... @@", "block": 0, "context": 3, "confirm": true}` |
 | `commit` | `git add -A` then `git commit -m <message>`, or the index as it stands with `only: "staged"` | `{"message": "...", "only": "staged"}` |
 | `switch` | `git switch [-c] <branch>` | `{"branch": "...", "create": false}` |
 | `branch-create` | `git branch <branch> [<base>]` — never switches | `{"branch": "...", "base": "..."}` |
 | `branch-delete` | `git branch -d <branch>` | `{"branch": "..."}` |
+| `publish` | `git remote add origin -- <url>` then `git push -u origin HEAD` — only when the repo has NO remote | `{"url": "https://host/owner/repo.git"}` |
+| `merge` | `git merge --no-edit <ref>` — a local or remote-tracking branch that exists | `{"branch": "origin/main"}` |
+| `resolve` | a conflicted file: `checkout --ours\|--theirs` + `add`, or `add` once hand-edited (`done`) | `{"path": "...", "side": "ours\|theirs\|done"}` |
+| `merge-commit` | `git commit --no-edit` — concludes the merge | — |
+| `merge-abort` | `git merge --abort` | `{"confirm": true}` |
 
 ```json
 { "action": "commit", "ok": true, "output": "[feat/x 9b3e74a] fix: the thing" }
@@ -551,27 +612,104 @@ per lane under the lane lock.
 
 - `pull` is **always** `--ff-only` and `switch` refuses a dirty tree
   (`400 EDIRTY`): neither can invent a merge commit or a conflict underneath a
-  running agent. There is deliberately no merge, rebase, reset or stash here —
+  running agent. There is deliberately no rebase, reset or stash here —
   `reset` stays behind the destroy guard on `POST /api/lanes/:id/reset`.
+- **Merge** (issue #45) happens only when asked for by name: on a clean tree
+  (`400 EDIRTY`), from a lane at the repo root (`400 ESUBDIR` — a merge is
+  repo-wide), for a branch listed under `refs/heads` or `refs/remotes`
+  (`400 ENOBRANCH`). A merge that stops on conflicts is still a **200**, with
+  `conflicts: ["path", …]`; a clean one answers `conflicts: []`. While a merge
+  is in progress `pull`, `switch`, `merge`, `stage-hunk` and `discard-hunk` are
+  `409 EMERGING`, and `GET /api/lanes/:id/git` reports `merging: true` plus
+  `conflicts` (unmerged files, repo-wide). `resolve` accepts only a path git
+  reports as conflicted (`400 EBADPATH`) and a `side` of `ours`/`theirs`/`done`
+  (`400 EBADSIDE`); `done` and a plain `stage` of a conflicted file both refuse
+  while a conflict marker is left in it (`400 EMARKERS`). A side that deleted
+  the file resolves by removing it. `merge-commit` is `409 ECONFLICTS` while
+  anything is unmerged, and it and `merge-abort` are `409 ENOMERGE` with no
+  merge in progress. `merge-abort` needs `confirm: true` (`400 ECONFIRM`).
 - `push` pushes `HEAD`, never a branch name from the request, so a lane can
   only push the branch it is on.
 - A **path** in the body is never trusted as a path: `stage`, `unstage` and
   `discard` accept only paths `git status` is reporting as changed right now,
   so `..`, an absolute path and an untouched file are all `400 EBADPATH`.
-- `discard` is the one irreversible action here and it **requires**
-  `confirm: true` (`400 ECONFIRM` without it). The UI additionally asks twice.
+  A `commit` without `only: "staged"` sweeps in (`git add -A -- .`) only the
+  lane cwd's own changes, and is `400 ENOCHANGES` when the lane has none —
+  even if the repo is dirty elsewhere.
+- `discard` and `discard-hunk` are the irreversible actions here and both
+  **require** `confirm: true` (`400 ECONFIRM` without it). The UI additionally
+  asks twice.
+- A hunk is named by its `@@` line and matched against a FRESH diff at the
+  `context` the caller read it with (send the `context` the changes read
+  returned), so a hunk the file has moved past is `409 EHUNKGONE`, never a
+  stale patch applied somewhere else. The path goes through the same
+  `git status` check; an untracked file has no hunks (`400 EUNTRACKED`). A
+  hunk that no longer applies (e.g. part of it is already staged) is
+  `409 EGIT`.
 - `branch-create` never switches — the usual reason to create one from a lane
   is to spawn a sibling worktree lane, and moving this pane's HEAD under a
   working agent is not. `branch-delete` is `-d`, never `-D`, and refuses
   `main`/`master`/`development`/`develop` (`400 EPROTECTED`), the current
   branch and a branch another worktree holds (`400 EBRANCHBUSY`).
+- `publish` is the one write whose **destination comes from the request**, so
+  it only ever gives a remote to a repo that has none: `400 ENOCOMMITS` before
+  the first commit, `400 EREMOTEEXISTS` once any remote exists (it never
+  re-points one), and the name is always `origin`. The URL is allowlisted —
+  `https://` with no userinfo (a token in the URL would land in `.git/config`),
+  `ssh://` and scp-like `user@host:path`; a local path, `file://`, `ext::`,
+  `fd::`, `git://`, `http://` and anything starting with `-` are
+  `400 EBADURL`. If the push fails, `origin` is removed again, so a typo or a
+  missing credential can simply be retried. The response adds
+  `"remote": "origin"`.
 - Bad input is **400** (`EBADACTION`, `EBADMESSAGE`, `EBADBRANCH`, `EBADPATH`,
-  `ECONFIRM`, `EPROTECTED`, `ENOBRANCH`, `EBRANCHEXISTS`, `EBRANCHBUSY`,
-  `EDIRTY`, `ENOCHANGES`); a git failure is
-  **500** with git's own `stderr` appended to `error.message` — a rejection or a
-  credential failure reads better in git's words.
-- Network actions (`fetch`/`pull`/`push`) are killed after 60s so an unreachable
+  `ECONFIRM`, `EUNTRACKED`, `EPROTECTED`, `ENOBRANCH`, `EBRANCHEXISTS`, `EBRANCHBUSY`,
+  `EDIRTY`, `ENOCHANGES`, `ESTAGEDOUTSIDE`, `ENOREMOTE`, `EBADURL`, `EREMOTEEXISTS`,
+  `ENOCOMMITS`); git itself exiting
+  non-zero (a rejected push, a diverged pull) is
+  **409 `EGIT`** with git's own `stderr` appended to `error.message` — a
+  rejection reads better in git's words. Anything else (git not installed, a
+  timeout kill) is **500**, still under a string code (`EGIT` when there is
+  none) — `error.code` is never git's numeric exit status.
+- In a lane whose cwd is a subdirectory of its repo, `commit` refuses with
+  `400 ESTAGEDOUTSIDE` while the index holds a change outside that directory:
+  `git commit` takes the whole index whatever the cwd, and scoping it with a
+  pathspec would commit the working-tree copy (unstaged edits included).
+- Network actions (`fetch`/`pull`/`push`/`publish`) are killed after 60s so an unreachable
   remote fails instead of holding the request open.
+- **A remote that wants a login** (issue #45) is **409 `EGITAUTH`**, not
+  `EGIT`: the dashboard's git has no terminal to prompt in. The error carries
+  `auth: { protocol, host, username, rejected }` — `rejected: true` when a
+  login WAS sent and refused. Resend the same action with
+  `credentials: { protocol, host, username, password, remember }`: accepted
+  only for a host that is one of the repo's own remotes (`400 EBADHOST`
+  otherwise), used for that one command, and saved to AgentHub's store (below)
+  only after git succeeded AND `remember` is true. Empty or multi-line values
+  are `400 EBADCRED`.
+
+#### Git credentials
+
+```
+GET    /api/git-credentials                   Saved logins: { items: [{ protocol, host, username, savedAt, hasToken }] }
+POST   /api/git-credentials                   Save or replace — Body: { protocol, host, username, password }
+DELETE /api/git-credentials/:protocol/:host   Delete one (404 ENOTFOUND)
+```
+
+AgentHub's OWN git logins, one per `protocol + host`, shared by everyone using
+this install; the **Git credentials** tab of Settings
+(`/settings?tool=git-credentials`) and the git bar's login form both write
+here. Stored in `<CLAUDE_HOME>/agenthub-git-credentials/credentials.json`
+(dir `0700`, file `0600`). **No response ever carries a password.** Writes are
+same-origin guarded; a bad protocol/host is `400 EBADHOST`, an empty login
+`400 EBADCRED`.
+
+A network action reaches git with `-c credential.helper= -c
+credential.helper=<AgentHub's helper>` whenever AgentHub holds a login for one
+of the repo's remote hosts (or the request carries one) — ONLY AgentHub's
+helper, so a stale token in the machine's helper cannot win over the one just
+typed, and git's post-success `store` cannot copy a use-once token into the
+OS user's helper. Otherwise the command is unchanged and the machine's own
+helpers answer as before. The secret never reaches argv: the helper reads the
+store file, or a use-once login from its own process env.
 
 #### Read a lane's runtime
 
@@ -908,7 +1046,7 @@ every number. `status` filters by session lifecycle, same convention as
 ```json
 {
   "skills": [
-    { "name": "agenthub:ship-feature", "plugin": "agenthub", "count": 12, "sessions": 5 },
+    { "name": "agenthub:repo-onboarding", "plugin": "agenthub", "count": 12, "sessions": 5 },
     { "name": "daily-report", "plugin": null, "count": 3, "sessions": 3 }
   ],
   "plugins": [
@@ -1804,9 +1942,9 @@ The `/api/cc-config/*` namespace powers the Claude Config Explorer, now the **Cl
 
 ```http
 GET /api/cc-config/overview
-GET /api/cc-config/skills?scope=user|project|all
+GET /api/cc-config/skills?scope=user|project|all&cwd=<dir>
 GET /api/cc-config/agents
-GET /api/cc-config/commands
+GET /api/cc-config/commands?scope=user|project|all&cwd=<dir>
 GET /api/cc-config/output-styles
 GET /api/cc-config/plugins
 GET /api/cc-config/marketplaces
@@ -1842,6 +1980,8 @@ POST /api/cc-config/mcp/add               Body: { name, scope, transport?, url?,
 POST /api/cc-config/mcp/remove            Body: { name, scope? }
 ```
 
+The list reads take an optional `cwd` naming the project whose `.claude/` is read (default: the server's own cwd); the run console's `/` autocomplete passes the directory the run will start in, so a lane's own project commands and skills are the ones offered.
+
 `scope` is `"user"`, `"project"`, or `"auto-memory"`. `type` is one of `skills`, `agents`, `commands`, `output-styles`, `memory`, `auto-memory`. `name` is required for everything except `memory` (which is `CLAUDE.md` itself). On `PUT`, `name` is validated against `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$` (for `auto-memory` it must instead be a flat `*.md` filename). Settings are returned with secret-like keys (matching `/token|secret|password|api[_-]?key|auth/i`) replaced by `"<redacted>"`.
 
 `GET /api/cc-config/plugins` returns each installed plugin's `contributes` block: the `skills` / `agents` / `commands` / `outputStyles` / `hooks` counts, plus `contributes.items` listing the first four surfaces **by name** (`[{ name, description, file }]`) so the UI can show *which* artifacts a plugin ships, not only how many. `name` is the file's frontmatter `name` when it declares one — the string Claude Code actually addresses it by — otherwise the filename. Each surface covers both the conventional directory (`skills/`, `agents/`, `commands/`, `output-styles/`) **and** any path `plugin.json` declares under that key: a plugin that lists its commands explicitly and keeps nothing in `commands/` (this repo's own `agenthub` does) previously reported zero. A declared path that resolves outside the plugin's install directory is ignored — a third-party manifest must not make the dashboard read arbitrary files. The counts are always the matching list's length. `hooks` has no `items` list: a plugin's hooks are matcher/command pairs declared inline in `plugin.json`, not named artifacts.
@@ -1929,17 +2069,20 @@ The `/api/run/*` namespace starts and manages `claude` subprocesses in tmux-back
 ```http
 GET    /api/run                       List all live runs (computed fresh from tmux state)
 GET    /api/run/tmux                  { available: bool } — whether tmux is on PATH
-GET    /api/run/binary?tool=          { found, path } for the `claude` or `codex` binary
+GET    /api/run/binary?tool=          { found, path } for the `claude`, `codex` or `agy` binary
 GET    /api/run/cwds                  Suggested cwds (dashboard, home, recent)
 GET    /api/run/history?limit=&laneId=  Persisted run history; laneId narrows to one lane's runs
 GET    /api/run/files?cwd=&q=         Fuzzy file search inside cwd for the @-file autocomplete
+POST   /api/run/drop-image            Raw image body (png/jpeg/gif/webp, ≤20 MB) → {path}: saved 0600 under <tmpdir>/agenthub-drops-<uid>/ with a random name, pruned after a day; the terminal pastes the path
                                        (skips node_modules, .git, dist, build, .next, .cache, coverage, vendor)
 POST   /api/run                       Start/attach run — Body: { laneId, cwd?, model?, permissionMode?, effort?, resumeSessionId?, initialPrompt? }
 GET    /api/run/:id                   Run handle (returns live run state)
 DELETE /api/run/:id                   Kill (SIGTERM → SIGKILL after 5 s)
 ```
 
-**`GET /api/run/binary`:** Probes for the binary (`claude` or `codex`). Optional query parameter `?tool=codex` probes for Codex; omitted or `?tool=claude` probes for Claude. Returns `{ found: bool, path: string | null }`.
+`:id` must be a lane pane name, `agenthub-lane-<n>`; anything else answers 404 without reaching tmux, so these two routes can never touch a tmux session the dashboard did not start.
+
+**`GET /api/run/binary`:** Probes for the binary (`claude`, `codex` or `agy`). Optional query parameter `?tool=codex` probes for Codex and `?tool=antigravity` for Antigravity's `agy`; omitted or `?tool=claude` probes for Claude. Returns `{ found: bool, path: string | null }`.
 
 **`POST /api/run` (start/attach):** Requires `laneId` (the lane this run belongs to). Creates or attaches an existing tmux session named `agenthub-lane-<id>` in the lane's working directory. If that session already exists and its pane is idling at a shell prompt, the appropriate command line (including `--resume` and any initial prompt) is typed into that pane instead of being dropped; if the pane is running a program, the request adopts the session unchanged. Optionally accepts `initialPrompt` to immediately type/send into the session (if empty or omitted, the session is created/attached with no initial input). Returns `{ id, laneId, status, cwd, model, permissionMode, effort, resumeSessionId, sessionId, startedAt, promptPreview }` where `id` is the tmux session name. The dashboard self-heals a lane's `run_id`/`status` on every read if the tmux session has been killed externally.
 

docs/CLI.md

@@ -235,19 +235,14 @@ A lane is a durable unit of parallel agent work — one working directory, many
 | `agenthub lanes add --cwd <path> --title <text>` | Adopt an existing directory as a lane |
 | `agenthub lanes add --repo <path> [--title <text>] [--base <branch>] [--slug <slug>]` | Provision a dashboard-managed git worktree as a new lane |
 | `agenthub lanes profile init <repo> [--force]` | Detect a Node.js project (single-service or backend+frontend monorepo) and scaffold `.agenthub/profile/`. Refuses to overwrite an existing one without `--force` |
-| `agenthub lanes pipeline [<template-id>] [<id>]` | Show which pipeline template a lane renders against, plus the available templates and their node counts; pass a template id to switch. An unknown id is refused (`400 EBADPIPELINE`), and a switch that leaves the lane's current stage unresolvable warns |
+| `agenthub lanes pipeline [<template-id>] [<id>]` | Show which pipeline template a lane renders against, plus the available templates and their node counts (none until you install one in `DASHBOARD_PIPELINES_DIR`); pass a template id to switch. An unknown id is refused (`400 EBADPIPELINE`), and a switch that leaves the lane's current stage unresolvable warns |
 | `agenthub lanes profile check [<path>]` | Validate a profile — parses, every referenced hook exists and is executable, no leftover `TODO:`, declared ports free. `<path>` defaults to the current directory (not a lane id) |
 | `agenthub lanes reset\|remove\|purge <id> [--force] [--keep-db] --yes` | Show preflight facts, then perform a destructive action. Refuses without `--yes`; `--force` is required when commits are unpushed; `--keep-db` (`reset` only) skips dropping/recreating a data-isolated lane's database |
-| `agenthub ship-full "<requirement>" [<id>] [--print]` | **The 16-stage lane pipeline.** Puts the lane on the `ship-feature` template and starts a `claude` session running its skill (`/agenthub:ship-feature-lane`): implement → gates → e2e → review → local QC → senior GO/NO-GO → push branch + open PR, then watches the PR until a human merges it. Use when the work should end in a reviewable PR |
-| `agenthub ship-quick "<requirement>" [<id>] [--print]` | **The 8-stage in-repo pipeline.** Puts the lane on the `default` template and runs its skill (`/agenthub:ship-feature`): plan → implement → tests → review → gate → ship. No PR, no browser QC. Use for work that stays in the working copy |
-| `agenthub stage <stage> [--tool claude\|codex] [--evidence <text>] [--note <text>] [--result pass\|fail]` | Declare the lane's current pipeline stage. Called by a skill at each phase boundary. `<stage>` may be a node id or one of its template's aliases; a name matching neither is still recorded but warns on stderr (exit stays `0`) that the pipeline map won't show it. `--tool` picks between a `claude` and a `codex` lane sharing one directory |
+| `agenthub stage <stage> [--tool claude\|codex] [--evidence <text>] [--note <text>] [--result pass\|fail]` | Declare the lane's current pipeline stage. Called by a skill at each phase boundary. With no pipeline template installed (AgentHub ships none — see [Custom pipeline templates](LANES.md#custom-pipeline-templates)) it answers `400 ENOPIPELINE`. `<stage>` may be a node id or one of its template's aliases; a name matching neither is still recorded but warns on stderr (exit stays `0`) that the pipeline map won't show it. `--tool` picks between a `claude` and a `codex` lane sharing one directory |
 | `agenthub feature list [<id>]` | List every feature this lane has activated, archived or live |
 | `agenthub feature activate <slug> [--title text] [<id>]` | Switch to a feature by slug (echoes the canonicalized slug), archiving the current one first |
 | `agenthub feature show <slug> [<id>]` | Show one feature's saved pipeline — works on an archived one too |
 
-`agenthub ship-full` / `agenthub ship-quick` both resolve the lane from the working directory (or take a lane id), pass the requirement to `claude` as one argv element — never through a shell — and accept `--print`, which shows the exact command, switches no template and runs nothing. The skill string itself lives in the template's `skill` field; a template without one makes the command refuse rather than guess.
-
-
 **Runtime** — the lane's own application stack, as opposed to `start`/`stop`, which drive its Claude run. Two lifecycles, one lane id. Each requires the repository to declare a profile at `<repo>/.agenthub/profile/` ([contract](LANES.md#lane-runtime-running-a-lanes-own-stack)); without one they report that nothing is configured rather than failing.
 
 | Command | Description |

docs/DATABASE.md

@@ -389,7 +389,9 @@ CREATE TABLE notifications (
 
 ### model_pricing
 
-Per-model pricing rules for cost calculation, keyed by `model_pattern` (a SQL-style glob; `%` matches any characters). Rates are per **million** tokens (USD).
+Per-model pricing rules for cost calculation, keyed by `model_pattern` (a SQL-style glob; `%` matches any characters). Rates are per **million** tokens (USD). The longest matching pattern wins.
+
+**Automatic rates.** `server/lib/pricing-sync.js` runs at server start and every 15 minutes. Any Claude model seen in `token_usage` whose family (the id minus a `-YYYYMMDD` suffix) has no `<family>%` row of its own gets one, INSERTED from LiteLLM's public price list (`model_prices_and_context_window.json` on GitHub). The list is fetched only when something is missing and cached for 24 h. Existing rows are never updated, so a rate edited in Settings always wins. A rate outside 0–1000 $/MTok is rejected, and a failed fetch changes nothing. Set `AGENTHUB_PRICING_SYNC=0` (or `false`/`off`) to turn it off.
 
 ```sql
 CREATE TABLE model_pricing (

docs/DEPLOYMENT.md

@@ -253,7 +253,7 @@ DASHBOARD_DB_PATH=/var/lib/agenthub/dashboard.db
 
 # Ingestion polls (0 disables either one)
 DASHBOARD_WORKFLOW_POLL_MS=12000        # Workflow-tool run journals
-DASHBOARD_CODEX_POLL_MS=15000           # Codex rollout journals → codex lane stage detection
+DASHBOARD_CODEX_POLL_MS=15000           # Codex rollout journals → codex lane running/idle
 CODEX_HOME=                             # where Codex keeps sessions/ (default ~/.codex)
 
 # Logging

docs/LANES.md

@@ -22,7 +22,7 @@ agenthub lanes add --cwd /path/to/repo --title "My Feature"
 
 The lane is now ready to track work. When you run a Claude Code session in that directory (or a subdirectory), the dashboard will bind the session to the lane automatically by matching the cwd.
 
-**Note:** The directory must exist and be an absolute path. A lane with a cwd of `/tmp/wt` will NOT capture `/tmp/wt-sibling` (no partial prefix match) but WILL capture sessions in `/tmp/wt/subdir/` (subdirectories are owned by the parent lane unless a deeper lane exists).
+**Note:** The directory must exist and be an absolute path. A lane with a cwd of `/tmp/wt` will NOT capture `/tmp/wt-sibling` (no partial prefix match) but WILL capture sessions in `/tmp/wt/subdir/` (subdirectories are owned by the parent lane unless a deeper lane exists). A `cwd` that exists is stored by its real path (`fs.realpathSync.native`), so `/tmp/wt` on macOS is stored as `/private/tmp/wt` and a differently-cased path on a case-insensitive volume as the spelling on disk — the path a session reports. A path that does not exist yet is resolved through its deepest existing ancestor (`/tmp/new` → `/private/tmp/new`); rows created before this rule keep theirs.
 
 To provision a dashboard-managed git worktree instead of adopting an existing directory, use a source repository:
 
@@ -32,9 +32,9 @@ agenthub lanes add --repo /path/to/repo --title "My Feature" --base main --slug
 
 `--title`, `--base`, and `--slug` are optional. The CLI waits for background provisioning to finish and reports either the ready lane or its failure notes.
 
-Adopting your main repo (`agenthub lanes add --cwd $(pwd)`) is also how you get stage detection working for sessions that work directly in it rather than in a worktree — see "Superpowers skill invocations" below. Once adopted, that lane's own card lists every managed-worktree lane whose `source_repo` matches its `cwd`, each a clickable link to jump to that lane.
+Adopting your main repo (`agenthub lanes add --cwd $(pwd)`) is also how you get stage detection working for sessions that work directly in it rather than in a worktree (once a pipeline template is installed) — see "Stage detection" below. Once adopted, that lane's own card lists every managed-worktree lane whose `source_repo` matches its `cwd`, each a clickable link to jump to that lane.
 
-Adding a lane through the dashboard's "+ Add lane" flow also auto-runs, best-effort, in parallel: `agenthub lanes profile init` (only if a Node.js project is detected — most repos won't be, and that's a normal outcome, not a failure), `agenthub lanes agents install`, and `agenthub lanes mcp sync`. None of the three blocks the lane from being created or from each other — a lane whose repo has no MCP servers configured, for instance, still gets created and is still usable, just without a synced `.mcp.json`. The modal shows a ✓/✗ summary of the three results and stays open until dismissed (Cancel/X) — it does not auto-close. Run any of the three manually later (from the lane's own card, or the CLI) if the automatic attempt didn't apply.
+Adding a lane through the dashboard's "+ Add lane" flow also auto-runs, best-effort, in parallel: `agenthub lanes profile init` (only if a Node.js project is detected — most repos won't be, and that's a normal outcome, not a failure), `agenthub lanes mcp sync`, and the AI Router pick. None of the three blocks the lane from being created or from each other — a lane whose repo has no MCP servers configured, for instance, still gets created and is still usable, just without a synced `.mcp.json`. The modal shows a ✓/✗ summary of the three results and stays open until dismissed (Cancel/X) — it does not auto-close. Run any of the three manually later (from the lane's own card, or the CLI) if the automatic attempt didn't apply.
 
 ### The "+ Add lane" modal
 
@@ -96,7 +96,7 @@ Both modes' path field has a **Browse** button next to it, opening a small folde
 A lane is driven by a tool: **Claude** (default) or **Codex**, chosen in the "+ Add lane" modal and immutable once the lane exists. A lane's tool determines which CLI is spawned when a run starts.
 
 - **`claude` (default)** — `claude` binary is invoked; the session's hooks, messages, and tool calls flow through the dashboard. Claude lanes render Sessions, Analytics, cost, and stage-detection badges; liveness is tracked by the Claude Code session.
-- **`codex` (experimental)** — `codex` binary is invoked instead. The Run Setup panel shows fields for model, sandbox, and approval mode instead of the Claude session picker, and offers "Resume last Codex run" instead of picking a session. Resume uses `codex resume --last`. Codex lanes render stage-detection badges too, fed from Codex's own rollout journals rather than hooks (see "Stage detection"), but no Sessions/Analytics/cost. (The console pre-fills nothing into the prompt box, for either tool.)
+- **`codex` (experimental)** — `codex` binary is invoked instead. The Run Setup panel shows fields for model, sandbox, and approval mode instead of the Claude session picker, and offers "Resume last Codex run" instead of picking a session. Resume uses `codex resume --last`. Codex lanes carry **no pipeline**: no stage chip, no time-on-stage, no pipeline or feature picker and no PipelineMap, and nothing infers or advances their stage. They also get no Sessions/Analytics/cost. (The console pre-fills nothing into the prompt box, for either tool.)
 
 ### How Codex arguments map
 
@@ -116,39 +116,16 @@ Codex does not emit Claude Code hooks (sessions, agent events, tool-execution tr
 - **Sessions** and **Analytics** tabs — no session history or aggregated statistics
 - **Cost** surface — no per-run or per-model pricing data
 
-**These are not bugs; they reflect Codex's architecture.** The stage you declare via `agenthub stage` (or that the driving agent calls itself) still works; liveness is tracked by the lane's tmux pane (if the stack is up) and `dashboard_runs` table (recording every invocation). Cost tracking for Codex runs would require parsing Codex's own logs, a separate design not yet implemented.
+**These are not bugs; they reflect Codex's architecture.** Liveness is tracked by the lane's tmux pane (if the stack is up) and `dashboard_runs` table (recording every invocation). Cost tracking for Codex runs would require parsing Codex's own logs, a separate design not yet implemented.
 
-**Stage detection is not in that list.** It does work for a codex lane, from
-Codex's own on-disk rollout journals rather than from hooks, and unlike a claude
-lane a written detection there also **advances the lane's declared `stage`** —
-see "Stage detection" below. What a codex lane cannot get for free is
-*evidence*: an auto-advanced node renders `passed-no-evidence` (amber), never
-`done`, because only the session itself can say what it actually finished. The
-run console never pre-fills a Claude slash command into a codex pane (Codex
-would read `/agenthub:ship-feature-lane` as prose), so a codex session declares
-evidence only when something tells it to. Three things do:
-
-- **An opening prompt checklist.** The Run Setup panel pre-fills a codex pane's
-  first prompt with a plain-text list of `agenthub stage <stage> --tool codex`
-  calls to make, one per node of the lane's own pipeline template (built from
-  `Lane.pipeline_nodes`, so it always matches whatever template is in use) —
-  the same up-front priming a Claude lane gets from its pre-filled
-  `/agenthub:ship-feature-lane` skill command, just as plain text since Codex has
-  no slash commands. See `LaneConsolePane.tsx`'s `promptPrefill`.
-- **An `AGENTS.md` block.** `agenthub lanes agents install` on a codex lane writes
-  a marker-delimited `<!-- agenthub:stage:start -->` section into
-  `<lane cwd>/AGENTS.md` — the one instruction channel Codex actually reads,
-  since it never loads `.claude/agents/`. Appended, never overwriting your own
-  prose, and a reinstall replaces exactly that block. (On a `claude` lane the
-  same command still copies the two agent templates instead.)
-- **A missing-evidence nudge.** `server/lib/codex-nudge.js` sweeps every 60s
-  (`DASHBOARD_CODEX_NUDGE_MS` to change, `0` to disable) for a codex lane whose
-  current stage has been held for at least two minutes with no evidence
-  recorded, and types a one-line `[agenthub] ... run: agenthub stage ... --evidence
-  "..."` reminder straight into that lane's live tmux pane (`tmux.sendText`,
-  skipped if the pane is at a bare shell prompt). It never writes `stage`,
-  `stages` or `detected_stage` itself — the evidence that results is a real
-  declaration the session made.
+**Codex lanes carry no pipeline.** Nothing infers their stage and nothing types
+a stage reminder into their pane. The one thing AgentHub reads from Codex is
+its running/idle status — see "Stage detection" for the journal poll that
+mirrors it. Every server start also wipes what older builds left behind on a
+codex lane — its stage columns, stage log (`lane_stage_events`) and feature
+records (`lane_features`) — and takes the old
+`<!-- agenthub:stage:start -->` block back out of its `AGENTS.md` (deleting
+the file if nothing else is in it).
 
 ## Destructive lane actions
 
@@ -417,18 +394,18 @@ The dashboard web UI merges lanes and runs into a single **Workspace** page acce
 - **No lanes yet** — the strip is replaced by a single banner (`lane-empty`): icon, one line of what a lane is, the CLI equivalent (`agenthub lanes add --cwd $(pwd)`) and an **Add lane** affordance. The whole banner IS the button — clicking anywhere on it opens the Add-lane modal, so there is no separate button to hit. The strip itself — the dashed add tile plus the lane tiles — only renders once at least one lane exists, because an add tile beside a stray sentence read as a half-drawn row. The banner stays compact on purpose: the run setup form below it is what needs the height.
 - **Reordering the strip** — drag a tile onto another to move it there, or press **Alt+←/→** with a tile focused (the keyboard path; HTML5 drag-and-drop has no touch support and does not auto-scroll an overflowing strip). The order is a **per-viewer preference**, not a lane fact: it persists to `localStorage` (`agenthub.workspace.laneOrder`) exactly like the split-view layout beside it, and writes nothing server-side — `GET /api/lanes` and `agenthub lanes` keep answering in id order, and the order does not follow you to another browser. A lane the stored order has never seen (created since, or created in another tab) lands at the END rather than wherever a stale index would put it; a stored id whose lane is gone is skipped.
 - **Renaming a lane** — the detail header's name is a button: click it (a pencil appears on hover) to edit in place. **Enter** saves via `PATCH /api/lanes/:id` with `{title}`, **Escape** and clicking away both cancel, and saving an empty name clears the title, which puts the lane's `cwd` back in its place. Renaming is display-only — a managed lane's branch name was slugified from its title once, at creation.
-- **Lane-detail header row** — one row, and every per-lane control lives on it: liveness + status, the lane's name (no "Lane 23 ·" prefix — the id is on the strip tile), time-on-stage, the pipeline picker, the Model (AI Router) select, the feature picker (there are no stage chips here — the declared stage and the `auto: <stage>` detection both render in the PipelineMap directly below, so the chips were a second, smaller copy of the same two facts), and on the right the **Tools** menu (agents install / mcp sync / sync-base check / create-update readme, hidden when the lane declares no runtime profile), the info toggle, the split-view toggle and Remove. Tools sits here rather than in Settings because every one of its actions runs against one lane's `cwd` — in Settings it would need a lane picker just to say which. **Create/update readme file** (Claude lanes only — Codex has no slash commands) starts the lane's terminal run with `/sg-all:sg-md-writing` as its first message, so the lane opens already writing/refreshing its `CLAUDE.md`/`AGENTS.md` set; it needs the `sg-all` plugin installed in Claude Code, and without it the session just reports an unknown command. It used to be a checkbox in the Add-lane modal: creating a lane and writing its docs are separate decisions, and the second is worth re-running long after the first.
-- **Detail panel** — the selected lane's declared stage, its inferred stage when detection leads, a full-width pipeline map, and a legend naming all five node states plus the dashed-amber inferred treatment.
+- **Lane-detail header row** — one row, and every per-lane control lives on it: liveness + status, the lane's name (no "Lane 23 ·" prefix — the id is on the strip tile), time-on-stage, the pipeline picker, the Model (AI Router) select, the feature picker (time-on-stage and both pickers only while a pipeline template is installed; there are no stage chips here — the declared stage and the `auto: <stage>` detection both render in the PipelineMap directly below, so the chips were a second, smaller copy of the same two facts), and on the right the **Tools** menu (mcp sync / sync-base check / create-update readme, hidden when the lane declares no runtime profile), the info toggle, the split-view toggle and Remove. Tools sits here rather than in Settings because every one of its actions runs against one lane's `cwd` — in Settings it would need a lane picker just to say which. **Create/update readme file** (Claude lanes only — Codex has no slash commands) starts the lane's terminal run with `/sg-all:sg-md-writing` as its first message, so the lane opens already writing/refreshing its `CLAUDE.md`/`AGENTS.md` set; it needs the `sg-all` plugin installed in Claude Code, and without it the session just reports an unknown command. It used to be a checkbox in the Add-lane modal: creating a lane and writing its docs are separate decisions, and the second is worth re-running long after the first.
+- **Detail panel** — the selected lane's declared stage, its inferred stage when detection leads, a full-width pipeline map, and a legend naming all five node states plus the dashed-amber inferred treatment Hidden while no pipeline template is installed (see "Pipeline stages and the five node states").
 - **Terminal** — a real interactive terminal (xterm.js) displaying the tmux session's PTY output, with full support for interactive commands, editors, and pagers. A live run keeps its rendered history and scroll position when scrolling. It grabs the keyboard the moment it appears, so typing goes into the pane without clicking it first, and when the pane's process ends — a double Ctrl+C out of `claude`, `exit`, a crash — the console returns to the run setup form on its own, with no "New run" click.
 - **Clipboard in a pane** — the lane's tmux session is started with the graphical session's own `DISPLAY`/`WAYLAND_DISPLAY`/`XAUTHORITY`/`XDG_RUNTIME_DIR` (read from `systemctl --user show-environment`, this process's own values winning; `server/lib/desktop-env.js`). The dashboard normally runs as a systemd *user* service, which has none of them, so a pane it started had no clipboard at all and `claude` answered "no image found in clipboard" on every image paste while the same CLI pasted fine in a terminal. Only those four names are forwarded, and only into panes this dashboard spawns — an already-running pane keeps the environment it was started with, so it needs a restart to gain one.
-- **Split view** — a layout toggle (one pane / two side by side / a 2×2 grid, drawn as icons rather than the words, with the count kept as each button's `aria-label` and tooltip) renders that many independent terminal panes side by side (`grid-cols-2` for 2, a 2×2 grid for 4). Layout 1 is bound to the lane strip's selection, same as always; layouts 2 and 4 give each pane its own lane picker, independent of the strip. The chosen layout and each pane's lane persist to `localStorage` (`agenthub.workspace.splitView`) across reloads.
-- **Lane grid** — one card per lane, 1 column, 2 at `md`, 3 at `xl`. Each card carries the lane id, liveness dot and status, title, declared stage and time-on-stage, the `auto:` chip when detection leads, the kind and CI tags, the working-copy facts from `GET /api/lanes/:id/git`, the needs-you banner, and the action row.
+- **Split view** — a layout toggle (one pane / two side by side / a 2×2 grid, drawn as icons rather than the words, with the count kept as each button's `aria-label` and tooltip) renders that many terminal panes side by side (`grid-cols-2` for 2, a 2×2 grid for 4). EVERY pane is bound to the lane strip's selection — there is no per-pane lane picker — and each pane owns its own tmux session on that lane: pane 0 is the lane's `agenthub-lane-<id>` (its `run_id`), panes 1–3 are `agenthub-lane-<id>-<slot>` (`POST /api/lanes/:id/start` with `slot`). A pane's **Active runs** leaves out the runs the other panes are showing, so one terminal is never attached twice side by side. Only the layout persists to `localStorage` (`agenthub.workspace.splitView`); a stored per-pane lane id from an older build is ignored.
+- **Lane grid** — one card per lane, 1 column, 2 at `md`, 3 at `xl`. Each card carries the lane id, liveness dot and status, title, declared stage and time-on-stage, the `auto:` chip when detection leads, the kind and CI tags, the working-copy facts from `GET /api/lanes/:id/git`, and the action row. The needs-you message (`needs_action`) is on the lane strip tile only — the detail card no longer repeats it as a banner.
 
 Run history is per lane, queryable via `GET /api/run/history?laneId=<n>`.
 
-**A console pane follows the lane it shows.** Selecting another lane — from the lane strip in layout 1, or from a pane's own lane picker in layouts 2 and 4 — swaps that pane's cwd, run history and terminal over to the new lane. If the new lane already has a live run in `GET /api/run`, the pane re-attaches to it immediately, so each lane sticks to its own `agenthub-lane-<id>` tmux session; if it has none, the pane shows that lane's setup form. Nothing of the previous lane (a half-typed prompt, its terminal) carries over.
+**A console pane follows the lane it shows.** Selecting another lane on the lane strip swaps every pane's cwd, run history and terminal over to the new lane. If the new lane already has a live session for that pane's slot in `GET /api/run`, the pane re-attaches to it immediately, so each pane sticks to its own `agenthub-lane-<id>[-<slot>]` tmux session; if it has none, the pane shows that lane's setup form. Nothing of the previous lane (a half-typed prompt, its terminal) carries over.
 
-The **working directory** field tracks the selected lane's own `cwd` specifically, and re-syncs as soon as that path is known rather than only when the selection changes — a pane can render before `GET /api/lanes` has answered (split view restores its pane lanes from `localStorage`), and its lane id never changes afterwards. `RunSetup` submits that string verbatim to `POST /api/lanes/:id/start`, so a cwd left over from the previous lane or from the home default would start the run in the wrong folder. The home suggestion is used only while no lane is selected at all.
+The **working directory** field tracks the selected lane's own `cwd` specifically, and re-syncs as soon as that path is known rather than only when the selection changes — a pane can render before `GET /api/lanes` has answered (the lane list loads after the page mounts), and its lane id never changes afterwards. `RunSetup` submits that string verbatim to `POST /api/lanes/:id/start`, so a cwd left over from the previous lane or from the home default would start the run in the wrong folder. The home suggestion is used only while no lane is selected at all.
 
 **Picking a session to resume starts it right away.** In the setup form's Fresh/Resume switch, choosing a session from the resume picker fires the start immediately — `POST /api/lanes/:id/start` with that `resumeSessionId` and the session's own `cwd` — and the pane switches straight to the terminal. A resume carries its own transcript, so there is nothing to type first: the prompt box stays optional for resumes (the Run button no longer requires it) and required for fresh runs. A resume also **sends no prompt at all** — whatever is left in that box is dropped rather than fired as an extra turn into the session being continued. Type into the tmux terminal once it's attached.
 
@@ -438,7 +415,7 @@ The **Active runs** button in the console header opens the merged run list. It s
 
 1. live in-memory tmux runs from `GET /api/run`,
 2. persisted dashboard runs from `GET /api/run/history`,
-3. Claude Code sessions running **outside** the dashboard — `GET /api/sessions?status=active`, i.e. a `claude` the user started by hand in a terminal tab. These carry an amber `external` badge, and the button's live count includes them, so two hand-started agents read as "2 active runs".
+3. Claude Code sessions running **outside** the dashboard — `GET /api/sessions?status=active`, i.e. a `claude` the user started by hand in a terminal tab. These carry an amber `external` badge, and the button's live count includes the ones its lane owns (next paragraph), so two hand-started agents in the lane's folder read as "2 active runs".
 
 An external session is deduped against a dashboard run with the same `session_id`, and sessions from a remote data source (`source !== "local"`) or without a `cwd` are skipped — neither can be resumed on this machine.
 
@@ -471,7 +448,7 @@ curl -X POST http://localhost:4820/api/lanes/ensure \
 }
 ```
 
-- If a lane already owns the `cwd` **for the requested `tool`**, returns that lane with `created: false` and HTTP `200`. `tool` (`claude` or `codex`, default `claude`) is part of the identity: adopting the same `cwd` with a different `tool` creates a second, sibling lane rather than adopting the existing one — one `cwd` can back at most one `claude` lane and one `codex` lane at a time. This applies to Repo/Adopt mode only; Worktree mode always gets its own directory.
+- If a lane already owns the `cwd` **for the requested `tool`**, returns that lane with `created: false` and HTTP `200`. `tool` (`claude`, `codex` or `antigravity`, default `claude`) is part of the identity: adopting the same `cwd` with a different `tool` creates a second, sibling lane rather than adopting the existing one — one `cwd` can back at most one `claude` lane and one `codex` lane at a time. This applies to Repo/Adopt mode only; Worktree mode always gets its own directory.
 - If the `cwd` is a subdirectory of an existing lane with that same tool, returns the parent lane that owns it. Pass `"exact": true` to skip that: only a lane on this very directory is returned, and a nested one is created as its own lane — the Add-lane modal does this, and shows which lane already owns the folder when the answer is `created: false`.
 - If no lane owns the `(cwd, tool)` pair, creates an **adopted** lane and returns it with `created: true` and HTTP `201`.
 - A relative or missing `cwd` returns `400 EBADCWD`.
@@ -480,8 +457,8 @@ Two concurrent calls for the same `(cwd, tool)` pair always yield one lane: the
 
 ### Reading a lane's working copy: `GET /api/lanes/:id/git`
 
-Each lane card shows the branch its working copy is actually on, the short
-HEAD, that commit's subject, and how much is uncommitted:
+The top of a lane's **Changes** panel shows the branch its working copy is
+actually on, the short HEAD, that commit's subject, and how much is uncommitted:
 
 ```bash
 curl http://localhost:4820/api/lanes/5/git
@@ -505,7 +482,7 @@ curl http://localhost:4820/api/lanes/5/git
 
 - A `cwd` that is missing, is not a git repository, or makes git fail returns
   `{"available": false}` with HTTP **200**. A lane pointing at a plain directory
-  is a normal state, not a fault, and the card simply renders without a git row.
+  is a normal state, not a fault, and the panel simply renders without a git line.
 - A detached checkout reports the literal `HEAD` that git returns, rather than a
   prettier invention.
 - `files` names the files the two counts came from, **capped at 20** — a lane
@@ -520,63 +497,120 @@ curl http://localhost:4820/api/lanes/5/git
   read off disk, since a lane mid-build can have a 100 MB artifact), a **binary**
   file, a **rename** (numstat keys those differently), or a repo with no commit
   to diff against yet.
-- Hovering (or focusing, or tapping) the `N modified · N untracked` text on a
-  lane card opens this list as a panel: one row per file, its status letter
+- Hovering (or focusing, or tapping) the `N modified · N untracked` text at the
+  top of the Changes panel opens this list as a panel: one row per file, its status letter
   colour-coded, the directory truncated before the filename ever is, and each
   row's `+N −M` aligned on the right under a total.
+- A repo with no commit yet is **not** unavailable: it reports `unborn: true`,
+  `head: null`, an empty `subject` and the branch its first commit will land on.
 - An unknown lane id is a `404`.
 
 This is **not** folded into `GET /api/lanes` on purpose: it shells out to git
 five times, and the lane list is polled and re-broadcast on every hook-driven
 `lane_update`. Putting it there would fire a burst of subprocesses behind every
-tool call an agent makes. The browser fetches it per card instead, on mount and
-every 30 seconds, and a failed fetch is silent.
+tool call an agent makes. The Changes panel fetches it instead, on mount, every 30 seconds and after
+every git write it or its action row makes, and a failed fetch is silent.
 
 The same response also carries the branch's standing against its remote:
 `hasRemote`, `upstream`, `ahead`, `behind`. A branch that has never been pushed
 reports `upstream: null` and **null** counts — not zeros, which would claim "in
-sync" about a comparison that was never possible. The card renders them as
+sync" about a comparison that was never possible. The panel renders them as
 `↑2 ↓1` beside the git actions below.
 
 ### Acting on a lane's working copy: the git action row
 
-Under the git line, a lane's card carries the git **writes** the dashboard
-offers (`POST /api/lanes/:id/git/:action`, see `docs/API.md`):
+On the same row as the git line — as icons, each naming itself in its tooltip —
+the Changes panel carries the per-repo git **writes** the dashboard offers (`POST /api/lanes/:id/git/:action`, see `docs/API.md`):
 
 | Button | Runs | Refuses when |
 | --- | --- | --- |
 | **Fetch** | `git fetch --all --prune` | the repo has no remote |
 | **Pull** | `git pull --ff-only` | the branch has diverged (it reports, never merges) |
-| **Push** | `git push -u origin HEAD` | the remote rejects it |
-| **Commit** | `git add -A` + `git commit -m …`, or **Commit staged** (the index as it stands) | nothing is uncommitted / nothing is staged |
+| **Push** (labelled **Publish branch** while the branch has no upstream) | `git push -u origin HEAD` | the remote rejects it |
+| **Publish…** (only when the repo has NO remote) | `git remote add origin -- <url>`, then `git push -u origin HEAD`; `origin` is removed again if the push fails | the repo has no commit yet, already has a remote, or the URL is not `https://` (no `user:token@`), `ssh://` or `user@host:path` |
 | **Branch** | `git switch …` | the tree is dirty, or another worktree holds that branch |
 | **Create** | `git branch <name>` — never switches | the branch already exists |
 | **Delete** | `git branch -d <name>` | it is protected (`main`, `master`, `development`, `develop`), current, held by another worktree, or has unmerged commits |
 | **New lane here** | opens **Add lane** prefilled with this repo and the selected branch | — |
+| **Merge into current** | `git merge --no-edit <branch>` (after a confirm) | the tree is dirty, the lane is a subdirectory of its repo, or a merge is already in progress |
+| **Merge `<upstream>`** | the same, offered when the branch has diverged (ahead AND behind) | as above |
 
-These sit on the card rather than in the ⋯ menu deliberately: that menu holds
+These sit in the panel rather than in the lane card's ⋯ menu deliberately: that menu holds
 the rare and dangerous (`reset worktree`), and these are the ordinary moves a
-lane needs several times an hour. The boring half of git is the whole list on
-purpose — there is no merge, rebase, reset or stash button, because a dashboard
-click is the wrong place to start an operation whose recovery needs a terminal.
+lane needs several times an hour. There is no rebase, reset or stash button,
+because a dashboard click is the wrong place to start an operation whose
+recovery needs a terminal. **Merge** is the one exception (issue #45), because
+its recovery is a button too: a merge that stops on conflicts puts a banner at
+the top of the Changes panel — **Complete merge** (enabled once nothing is
+conflicted) and **Abort merge** (two clicks; back to where the branch was) —
+and lists the conflicted files in their own **Merge conflicts** group with
+**Keep mine** / **Take theirs** for the whole file and **Mark resolved**.
+Opening a conflicted file shows the **conflict view** instead of its diff:
+each conflict block drawn as its two sides — *Mine (HEAD)* tinted green,
+*Theirs (<branch>)* tinted blue, labelled from git's own markers — with
+**Keep mine**, **Take theirs** or **Keep both** per block (undoable, ^/v to
+jump between blocks). **Save and mark resolved** is enabled once every block
+is chosen; it saves over exactly the version opened (a file changed meanwhile
+is refused, `409 ESTALE`) and then marks the file resolved. **Edit by hand**
+opens the plain editor, for a block neither side gets right; marking resolved
+is refused while any `<<<<<<<`/`>>>>>>>` marker is left. In the Files tree a
+conflicted file is listed once (git indexes it once per side) and marked with
+a red **!**. Pull and branch switch are disabled until the merge is finished or
+aborted.
 `pull --ff-only` and the dirty-tree guard on `switch` are what keep either from
 inventing a merge commit or a conflict underneath a running agent. **Create**
 deliberately does not switch: the usual reason to make a branch from a lane is
 to spawn a sibling worktree lane on it, and moving this pane's HEAD under a
 working agent is not. **New lane here** goes through the normal Add-lane flow
 with the fields prefilled — one provisioning path for every lane, not a second
-one hidden in the git bar.
+one hidden in the git bar. There is no **Commit** here: committing is the
+overview's staged-only box below, the one commit path, and it only ever takes
+what was staged.
+
+**Publish…** is the one button whose destination the user types, so the server
+keeps it narrow: it only gives a remote to a repo that has none (it never
+re-points one), always names it `origin`, and accepts only `https://` without
+credentials in the URL, `ssh://` and scp-like `git@host:owner/repo.git` — never
+a local path, `file://`, `ext::` or `http://`. Credentials come from the
+machine's own credential helper, ssh agent or AgentHub's own git login store
+(the login form below), exactly as for **Push**.
+
+A repo with **no commits yet** (a fresh `git init`) still gets the header: its
+branch, "no commits yet", and a hint to commit first — the network and branch
+buttons are hidden because there is nothing to push, fetch into or branch from.
+The commit box below makes the first commit, and **Publish…** appears once it
+exists. **Add lane** in Worktree mode refuses such a repo (`400 EEMPTYREPO`,
+nothing to fork a worktree from) and offers **Use as a Repo lane** instead.
 
 A failed action prints git's own `stderr` verbatim — `! [rejected] … (non-fast-forward)`
 says more than any sentence the dashboard could write.
 
+The exception is a remote that wants a **login** (issue #45). The dashboard
+runs git without a terminal, so where a shell would prompt, the bar opens a
+form instead — "Git needs a login for `<host>`": username, password or access
+token (on Gitea: Settings → Applications → Generate token), and **Remember for
+everyone using this AgentHub** (on by default) — and resends the same action
+with it. A saved login lives in AgentHub's own store, one per host, shared by
+every user of the install, and is managed from Settings → **Git credentials**;
+it is saved only after git accepted it. While AgentHub holds a login for a
+repo's host, that login is the only one git is given for the command — the
+machine's own credential helpers are left out, so a stale token there cannot
+win. Over plain `http://` on a LAN address the form warns that the token
+crosses the network unencrypted. See `docs/API.md` § Git credentials.
+
 ### The Changes panel
 
 To the right of the lane detail sits a collapsible **Changes** card (its state
 persists per viewer in `localStorage`). Its header holds **one** control, which
-steps narrow → 50/50 → 70/30 → closed (`agenthub.workspace.changesSize`
+steps **Narrow** (30%) → **Medium** (50/50) → **Full screen** (the console beside it is hidden, never unmounted; the page is
+height-locked so the panel fills the viewport even with no live run; the whole
+Files view (finder, expand-all, tree) becomes a left sidebar and the Files tab
+is dropped, and every working-copy file opened there, from the sidebar, Overview or Review, IS
+the editor (Whole file toggles back to its diff; a commit still opens as a diff) — no
+Edit click, **Save**/**Cancel** stay and wake up once the text differs, Cancel
+restores the saved text) → closed (`agenthub.workspace.changesSize`
 alongside `agenthub.workspace.changesOpen`); the collapsed rail reopens it
-narrow. Reading a diff and watching a console want opposite amounts of room and
+narrow. A stored size from an older build that no longer exists (`wide`) falls back to narrow. Reading a diff and watching a console want opposite amounts of room and
 which one is "work" changes several times an hour, so the width is a step, not
 a setting — and one button beats a width button wedged beside a collapse button
 in the panel's tightest corner. It is icon-only, and the icon it draws is the
@@ -590,7 +624,23 @@ only one that answers "show me the code" rather than "show me the change"):
   them — a folder's children render nested under it, siblings stay visible,
   and a toolbar button expands or collapses every folder at once (each
   unfetched level lazily calls `/git/tree` the first time it's opened).
-  Opening a file entry shows the whole file (`/git/file`).
+  Untracked files git does not ignore are listed too, and the tree is
+  decorated like VS Code's: a modified file is amber with `M`, an untracked
+  one green with `U` (`A` added, `D` deleted and struck through, `R`
+  renamed), and a folder holding any of them gets an amber dot. The colours
+  come with the tree read, so **Refresh** re-reads them.
+  Opening a file entry shows the whole file (`/git/file`) for reading, at every
+  panel width. **Clicking its text** (or Enter on it; any range but a commit)
+  turns that view into a text editor with the caret on the clicked line and
+  the scroll position kept — a click that only ends a drag-selection does not,
+  so copying never drops you into the editor. **Cancel** returns to reading.
+  From a diff, which has no whole text to click, an **Edit** button does the
+  same once the file has loaded. **Save** (or
+  Ctrl/Cmd+S) is `PUT /api/lanes/:id/git/file`, which writes only over the
+  exact version that was opened — a file the agent changed meanwhile answers
+  `409 ESTALE` and the draft stays for a retry — and keeps the file's CRLF
+  line endings and final newline. A file the editor cannot take (binary, or
+  over the 1 MB view cap) says so in the file's header.
 - **Overview** — every changed file with its `+N −M`. Polls every 15s, because
   it is the cheap shape and the one you leave open while an agent works. Each
   row carries its own **stage** / **unstage** / **discard** buttons.
@@ -600,6 +650,20 @@ only one that answers "show me the code" rather than "show me the change"):
   target-practice exercise against one chevron.) One toolbar button folds or
   unfolds all of them. What is remembered is the set of *collapsed* paths, so
   a file that appears later is open by default; a lane switch clears it.
+  Each file's header stays **pinned** at the top while its diff scrolls past,
+  and carries the same stage / unstage / discard buttons as its overview row.
+  On a file with unstaged changes every **change block** — each run of
+  consecutive `+`/`-` lines, not each `@@` hunk: git merges edits up to six
+  lines apart into one hunk, and one bar for all of them acted on every edit
+  at once (issue #50) — gets an editor-style **review bar**, hung just under
+  its last changed line and pinned to the visible right edge: `^`/`v` to walk
+  the blocks (each brings the next/previous block's first line to the top of
+  the ONE scroller, below the sticky file header — a
+  review diff has no scroll box of its own unless it is large enough to
+  window, above 500 rows), `n of N`, **Undo**
+  (`discard-hunk` — asks twice, like discard) and **Keep** (`stage-hunk`),
+  both sent with the hunk's `@@` line plus the block's index, so they touch
+  that block alone. The single-file view offers the same bar.
 - **One file** — clicking a file's path in any list opens just that file.
   **All files** returns to the list it was opened from — the same mode, at the
   same scroll offset — because reading a change-set is a walk down a long list
@@ -637,13 +701,19 @@ in every panel narrow enough to sit beside a console.
 
 **Per-file writes are the panel's, per-repo writes are the git bar's.** Staging
 one file means nothing unless a commit can take the index as it stands, so the
-overview grows a commit box the moment anything is staged — it sends
+overview grows a commit box the moment anything is staged — above the list and
+pinned while it scrolls, on ONE row with a **Stage all** that stages every listed file
+the index lacks in one call and an **Unstage all** that unstages every staged one — it sends
 `only: "staged"`, never `add -A`, and it is absent with a clean index because
-there is nothing it could mean. (The git bar's own **Commit staged** is the
-same call from the lane card; its plain **Commit** is still stage-everything.) **Discard** is the one
+there is nothing it could mean. It is the dashboard's ONLY commit: the git bar
+above it has none, so no click can sweep the rest of the tree in with `add -A`. **Discard** is the one
 irreversible action in the panel: it asks twice in the UI, and the server
 refuses it without `confirm: true` and accepts only paths `git status` is
-already reporting as changed.
+already reporting as changed. In the `work` range the overview splits like VS
+Code's Source Control: **Staged Changes** (what the next commit takes, each row
+offering Unstage) above **Changes** (unstaged and untracked, each offering
+Stage); a partly staged file appears in both. In the tree, a changed file's
+whole row takes its status tint, not only its letter.
 
 Review, single-file, history and browse do **not** poll: re-fetching under the
 reader's scroll position is worse than a slightly stale view, and those are the
@@ -663,7 +733,7 @@ This shows each lane's:
 - **status**: `running` (a session is active), `idle` (no active session), or `provisioning`
 - **liveness**: `active` (recently updated), `dead` (silent for too long), or `idle` (not expected to be running)
 - **progress**: percentage of the pipeline completed (0–100%)
-- **needs_action**: a notification if the session is blocked waiting for input
+- **needs_action**: a notification if the session is blocked waiting for input. `needs_action_session` records which session raised it, and only that session's next hook clears it — a second session in the same cwd (a hand-started terminal beside the dashboard pane) rebinds `session_id` but cannot clear a prompt it is not the one waiting on
 
 A lane row also gets a `⇢ detected:<stage>` suffix when the server's inferred
 stage (see "Stage detection" below) leads the declared `stage` shown in the
@@ -675,7 +745,9 @@ The dashboard web UI shows each lane as a card in a grid, with the selected lane
 
 ## Pipeline stages and the five node states
 
-A lane moves through stages defined in a **pipeline template** (see "Custom pipeline templates" below). The default pipeline has eight stages: `intake`, `plan`, `implement`, `tests`, `review`, `gate`, `ship`, and `done`.
+> **Pipelines are dormant.** AgentHub ships no pipeline template. Until you install one (drop a template JSON into `DASHBOARD_PIPELINES_DIR` — see "Custom pipeline templates" below), every lane sits on an empty `default` pipeline: no nodes, progress `0`. `GET /api/lanes/pipelines` returns `{"pipelines": []}`, `agenthub stage <x>` (and `POST /api/lanes/:id/stage`) answers `400 ENOPIPELINE`, and the Workspace hides the time-on-stage timer, the pipeline and feature pickers and the PipelineMap — the lane tile shows its tool tag instead of a stage chip. Install a template and all of it comes back; a template with id `default` becomes every lane's default. Further development of pipelines is planned. The rest of this section, and the stage sections after it, describe a lane on an installed template.
+
+A lane moves through stages defined in a **pipeline template** (see "Custom pipeline templates" below).
 
 **A lane is created on `default` unless told otherwise.** The "+ Add lane" modal does not ask — it always creates on `default`. Pick another with `agenthub lanes add --pipeline <id>` at creation, or change it afterwards from the *Pipeline template* select in the lane's detail header in Workspace.
 
@@ -683,63 +755,31 @@ For a lane that already exists, switch it from the terminal:
 
 ```bash
 agenthub lanes pipeline                 # which template this lane uses, and what else exists
-agenthub lanes pipeline ship-feature    # switch it
+agenthub lanes pipeline ml-training     # switch it (any installed template id)
 ```
 
 or from the dashboard: the pipeline-template select next to the lane's title in the Workspace detail panel does the same `PATCH /api/lanes/:id` the CLI uses, live (disabled while viewing an archived feature snapshot).
 
-**The template names the skill that drives it.** `"skill": "/agenthub:ship-feature-lane"` on the 16-node `ship-feature` template, `"skill": "/agenthub:ship-feature"` on the 8-node `default` one. It rides along on every lane payload as `pipeline_skill`, and from a terminal there is one command per depth of work — the command you type picks the pipeline, so no `agenthub lanes pipeline` step first:
-
-```bash
-cd ~/lanes/myrepo__feat-export
-
-# 16 stages: ends in a published PR, watched until a human merges it
-agenthub ship-full "add an export button"
-# → lane switched to `ship-feature`, then: claude "/agenthub:ship-feature-lane add an export button"
-
-# 8 stages: in-repo feature work, stops at review/gate — no PR, no browser QC
-agenthub ship-quick "fix the CSV separator"
-# → lane switched to `default`, then: claude "/agenthub:ship-feature fix the CSV separator"
-
-agenthub ship-full "add an export button" --print   # show the command, switch nothing, run nothing
-```
-
-| | `agenthub ship-full` | `agenthub ship-quick` |
-|---|---|---|
-| Template | `ship-feature` (16 nodes) | `default` (8 nodes) |
-| Skill | `/agenthub:ship-feature-lane` | `/agenthub:ship-feature` |
-| Ends at | PR open on `development`, watched until merged | `ship` in the working copy |
-| Includes | unit-test agent, CI gates, e2e, code review, local browser QC, senior GO/NO-GO | plan, implement, tests, review, gate |
-| Use when | the work should reach reviewers | the work stays local |
-
-The lane is resolved from the working directory, so no id is needed (pass one to target another lane). Each command puts the lane on its own template *before* spawning, so the dashboard renders the right node count from the first stage rather than after the skill self-corrects; `--print` switches nothing. The requirement is handed to `claude` as ONE argv element — never through a shell — so quotes, `$` and `;` in it are text. A template with no `skill` field makes the command refuse rather than guess.
+A template may name the slash command that drives it (its optional `skill` field). It rides along on every lane payload as `pipeline_skill`; the dashboard never executes it.
 
 ### Running ONE node
 
-`agenthub ship-full` / `agenthub ship-quick` hand the whole pipeline to a skill. When you only want one step — re-run the CI gate, redo the brainstorm, open the PR by hand — run that node's own `command`:
+When you only want one step — re-run a CI gate, redo a brainstorm — run that node's own `command`:
 
 ```bash
-agenthub lanes node                            # list every node of this lane's pipeline and its command
-agenthub lanes node intake                     # → claude "/superpowers:brainstorming"
-agenthub lanes node intake the export button   # extra words are appended to the prompt
-agenthub lanes node review                     # → claude "/code-review"
-agenthub lanes node gates                      # → agenthub lanes hook ci-gate
-agenthub lanes node pr-open --print            # show the argv, run nothing
+agenthub lanes node                        # list every node of this lane's pipeline and its command
+agenthub lanes node <node-id>              # run that node's command in the lane's cwd
+agenthub lanes node <node-id> extra words  # extra words are appended to the prompt
+agenthub lanes node <node-id> --print      # show the argv, run nothing
 ```
 
-Both shipped templates give **every** node a command, so any of the 16 (or 8) is runnable. A node starting with `/` is spawned as `claude "<command> <extra args>"`; anything else is spawned directly. The lane comes from the working directory as usual, and the command always runs in the lane's own `cwd`.
-
-The node is matched by **id or alias**, so one name works on either template: `default` calls the step `implement` and `ship-feature` calls it `implementing`, and `agenthub lanes node implement` finds it on both.
-
-**From inside a Claude session, use the slash commands instead.** The plugin ships one per node — `/intake`, `/plan`, `/implement`, `/tests`, `/e2e`, `/e2e-passed`, `/review`, `/qc-plan`, `/qc`, `/gate`, `/publishing`, `/pr-open`, `/reported`, `/watching-pr`, `/merged`, `/done` — plus `/ship-full` and `/ship-quick` for the whole pipeline. Each resolves the node's command through `agenthub lanes node <id> --print` and runs it *in the current session*: a slash-command node is invoked directly (never as a nested `claude` process), anything else runs as a shell argv in the lane's cwd. Extra words are appended to the prompt: `/intake the export button`.
+A node is runnable when its template gives it a `command`. A command starting with `/` is spawned as `claude "<command> <extra args>"`; anything else is spawned directly. The lane comes from the working directory as usual, and the command always runs in the lane's own `cwd`. The node is matched by **id or alias**.
 
 Two deliberate limits:
 
 - **The command is split on whitespace and spawned without a shell.** A template is data — files anyone can drop into `DASHBOARD_PIPELINES_DIR` — so its `command` is never interpreted as shell. A node needing a pipe or a redirect names a script that contains them.
 - **Running a node does not declare its stage.** A command executing is not proof the node passed — the same reason the run console never writes a lane's stage. Declare with `agenthub stage <id>` when the work is actually done. (The exception is a node whose command *is* `agenthub stage <id>`: there the declaration is the whole step.)
 
-**The template also decides what the Workspace run console pre-fills.** A template may name the slash command that drives it — `"skill": "/agenthub:ship-feature-lane"` on the 16-node `ship-feature` template, `"skill": "/agenthub:ship-feature"` on the 8-node `default` one. That string rides along on every lane payload as `pipeline_skill`, and the run console starts its prompt box with it (plus a trailing space) so you only type the requirement: pick the 16-node template and Run starts the 16-step skill, pick the 8-node one and it starts the 8-step skill. The dashboard never executes it — it is text in a prompt box, exactly as if you had typed it. A prompt you have already edited is never overwritten by a later template switch, and a template with no `skill` field pre-fills nothing.
-
 Switching re-resolves the lane's existing declared `stage` against the new node list. A stage the old template knew may resolve to nothing in the new one; the switch warns when that happens (both CLI and UI), and the next `agenthub stage` fixes it.
 
 ### Aggregate pass rates across lanes
@@ -773,7 +813,7 @@ one feature's work reads `implement → tests → implement → tests` as the se
 edits, runs the suite, and edits again — and when any backwards move opened a
 run, a single feature was recorded as five or six of them. A real pass ends
 where the session says it ends: a backwards move only starts a new run when it
-is declared (`agenthub stage`, or a codex lane's ingest-driven declaration). A
+is declared (`agenthub stage`). A
 detection that moves backwards continues the run in flight. Reaching the last
 node still closes the run for both — work after `done` is new work by anyone's
 reading. On this repo's own lane the rule took a 26-run history down to 5, which
@@ -788,8 +828,6 @@ offering every other lane even while the counts show only one.
 
 `agenthub lanes shell` attaches a real terminal to the exact tmux session the dashboard's Start/Resume buttons use for this lane (`agenthub-lane-<id>`), creating it if it doesn't exist yet. Type `claude` inside it like any normal terminal session — the dashboard's Workspace terminal view is just another client attached to the same tmux session, so both stay in sync live.
 
-**In practice you never have to pick correctly at creation.** The template only has to match whichever skill is actually driving the lane, and the skill enforces that itself: `ship-feature-lane` runs `agenthub lanes pipeline ship-feature` and `ship-feature` runs `agenthub lanes pipeline default` before their first `agenthub stage` call — a no-op if the lane is already on that template, a self-correction if it isn't. A human chatting with the lane never needs to open the picker; whichever skill gets invoked decides the template.
-
 The dashboard renders every node in the pipeline in one of five **states**:
 
 | State | Color | Meaning |
@@ -805,13 +843,13 @@ The dashboard renders every node in the pipeline in one of five **states**:
 A stage in this state was **claimed but not proven**. Two scenarios:
 
 1. **Declared but no artifact left.** A skill called `agenthub stage review` without `--evidence`, claiming the stage happened but leaving no proof that work occurred.
-2. **Implicitly skipped.** The lane jumped from `plan` to `implement` (to stage index 2), leaving `intake` (index 0) in `passed-no-evidence` state.
+2. **Implicitly skipped.** On a template whose nodes start `intake`, `plan`, `implement`, the lane jumped from `plan` to `implement` (to stage index 2), leaving `intake` (index 0) in `passed-no-evidence` state.
 
 In both cases, the stage is not **done** — it's incomplete or untested. Amber signals that the agent claimed to have done this work but the dashboard has no evidence to show it was actually completed. This matters in a pipeline: if your gate checks `done` not `passed-no-evidence`, a lane stuck in amber will block until evidence is provided.
 
 ## Reporting a stage
 
-`agenthub stage` is not skill-only. Any Claude session working inside an adopted lane's cwd — including a plain chat session where no skill was ever invoked — should call it on real stage transitions. Tool-event detection (see "Inferred vs. declared" below) can only paint the amber "detected" badge; it never moves the blue `current` ring. A lane worked entirely through plain chat that never calls `agenthub stage` will keep showing whatever stage it was last declared at (often `intake`), regardless of how much real work happens.
+`agenthub stage` is not skill-only. Any Claude session working inside an adopted lane's cwd — including a plain chat session where no skill was ever invoked — should call it on real stage transitions. Tool-event detection (see "Inferred vs. declared" below) can only paint the amber "detected" badge; it never moves the blue `current` ring. A lane worked entirely through plain chat that never calls `agenthub stage` will keep showing whatever stage it was last declared at, regardless of how much real work happens. With no pipeline template installed there is nothing to declare: the command answers `400 ENOPIPELINE`.
 
 When a skill — or a plain chat session — reaches a significant milestone, it reports the current stage to the dashboard using `agenthub stage`:
 
@@ -833,18 +871,9 @@ agenthub stage <stage> [--lane <id>] [--cwd <path>] [--tool claude|codex] [--sta
 
 **Parameters:**
 
-- `<stage>` (required): the pipeline stage name or alias. The default pipeline aliases are:
-  - `intake` / `assigned` / `claimed` / `start`
-  - `plan` / `planning` / `brainstorm` / `design`
-  - `implement` / `implementing` / `coding` / `build`
-  - `tests` / `testing` / `unit` / `gates` / `pre-push-gate`
-  - `review` / `reviewing` / `code-review` / `self-review`
-  - `gate` / `verify` / `verification` / `sr-gate` / `gate-blocked`
-  - `ship` / `pr` / `pr-open` / `publishing` / `commit` / `push`
-  - `done` / `complete` / `completed` / `merged`
-
-  Aliases are **per template** — the `ship-feature` pipeline has its own set
-  (see "Pipeline template: ship-feature" below). A name matching no node and no
+- `<stage>` (required): a node id or one of its aliases, as the lane's
+  pipeline template defines them (see "Custom template format"). Aliases are
+  **per template**. A name matching no node and no
   alias is still recorded verbatim, but `phaseIdx` then resolves it to nothing:
   no node renders `current` and progress reads `0`. The CLI prints a warning to
   stderr and still exits `0` in that case — a typo must not break a
@@ -901,8 +930,7 @@ Such keys only exist on lanes that predate validation: `POST
 /api/lanes/:id/stage` now rejects a stage naming no node of the lane's pipeline
 with **400 `EBADSTAGE`** and lists the ones that exist. Aliases still resolve,
 so this catches typos and names borrowed from another template — `agenthub
-stage test` on a `ship-feature` lane, whose CI node is `gates` — which used to
-be stored, warned about on stderr, and then counted nowhere.
+stage test` on a template whose CI node is `gates` — which used to be stored, warned about on stderr, and then counted nowhere.
 
 Every declaration is also appended to `lane_stage_events`, the append-only log
 the pass-rate report reads. `lanes.stages` describes the pass in flight and is
@@ -967,14 +995,11 @@ agenthub stage tests --evidence "Pre-push gate: all linters passing" --result pa
 
 ## Custom pipeline templates
 
-The default pipeline is suitable for feature work: `intake` → `plan` → `implement` → `tests` → `review` → `gate` → `ship` → `done`. For different workflows (data pipelines, research phases, deployment stages), you can provide custom templates.
+AgentHub ships no template, so a custom template is the only way to turn the pipeline map, stage reporting and stage detection on. A template models whatever workflow you run — feature work, data pipelines, research phases, deployment stages.
 
 ### Where templates come from
 
-1. **Built-in:** `server/data/pipelines/default.json` (always available)
-2. **User override:** directory specified by the `DASHBOARD_PIPELINES_DIR` environment variable
-
-If both exist, **files in the user directory override built-ins** with the same `id`.
+Every `*.json` file in the directory named by the `DASHBOARD_PIPELINES_DIR` environment variable is loaded once at server start; a malformed file is skipped, never fatal. A template whose `id` is `default` becomes the pipeline of every lane that names no other.
 
 ### Custom template format
 
@@ -999,14 +1024,15 @@ Create a JSON file in your custom pipeline directory (e.g., `~/.agenthub/pipelin
 
 - **id** (string, required): unique identifier for this template
 - **name** (string, optional): display name shown in the UI
-- **skill** (string, optional): the slash command that drives this pipeline (e.g. `"/agenthub:ship-feature-lane"`). The Workspace run console pre-fills its prompt with it for lanes on this template; omit it and the prompt starts empty. Never executed by the dashboard.
+- **skill** (string, optional): the slash command that drives this pipeline (e.g. `"/my-training-skill"`). Carried on every lane payload as `pipeline_skill`. Never executed by the dashboard.
 - **nodes** (array, required): list of pipeline stages, in order
   - **id** (string): stage identifier (used in `agenthub stage`)
   - **label** (string, optional): display name in the UI; defaults to `id` if omitted
   - **icon** (string, optional): unicode emoji or single character shown before the stage name
   - **gate** (boolean, optional): `true` if this stage blocks unless explicitly passed; defaults to `false`
-  - **command** (string, optional): the one command that drives THIS stage — a slash command (`"/superpowers:writing-plans"`) or a shell one (`"agenthub lanes hook ci-gate"`). Where `skill` above names the driver for the whole pipeline, this narrows it to the step, so a reader of the pipeline map sees what moves each node instead of inferring it from the node's `detect` regexes. Omit it (or leave it empty) for a node with no single driver; both shipped templates fill every node, using `"agenthub stage <id>"` for the nodes whose only "work" is the declaration itself (a terminal `done`, a gate another agent declares). Surfaced in the node's tooltip on a lane card and as copyable text per node on the Workflows page, and run by `agenthub lanes node <id>` (below); **never executed by the dashboard**, same contract as `skill`.
-  - **aliases** (array, optional): alternative names for the stage (e.g., `["training", "fit"]` lets you call `agenthub stage training`)
+  - **command** (string, optional): the one command that drives THIS stage — a slash command (`"/my-training-skill"`) or a shell one (`"agenthub lanes hook ci-gate"`). Where `skill` above names the driver for the whole pipeline, this narrows it to the step, so a reader of the pipeline map sees what moves each node instead of inferring it from the node's `detect` regexes. Omit it (or leave it empty) for a node with no single driver; use `"agenthub stage <id>"` for a node whose only "work" is the declaration itself (a terminal `done`, a gate another agent declares). Surfaced in the node's tooltip on a lane card and as copyable text per node on the Workflows page, and run by `agenthub lanes node <id>` (below); **never executed by the dashboard**, same contract as `skill`.
+  - **aliases** (array, optional): alternative names for the stage (e.g., `["training", "fit"]` lets you call `agenthub stage training`). An alias may also name a **sub-state** — *why* the lane sits on a node — without adding a node to the map. Two constraints: no alias may collide with another node's id or alias (`phaseIdx` takes the FIRST match, so a duplicate silently resolves a declaration onto the wrong node), and all aliases of one node share one record slot (`stageRecords` resolves each declared key onto its node, and the canonical id's record wins), so a sub-state that needs its own `--evidence` has to be a real node.
+  - **detect** (array, optional): stage-detection rules for this node — see "Stage detection → Where the rules live".
 
 Then set the environment variable:
 
@@ -1020,7 +1046,7 @@ When you create a new lane, you can optionally specify which pipeline to use:
 agenthub lanes add --cwd /path/to/ml-repo --title "Training run #1" --pipeline ml-training
 ```
 
-(The pipeline is selected at creation time. Lanes created without `--pipeline` default to the `default` pipeline.)
+(The pipeline is selected at creation time. Lanes created without `--pipeline` default to the `default` pipeline — yours if you installed one with that id, otherwise the empty one.)
 
 
 ## Per-feature state and archive
@@ -1080,72 +1106,23 @@ also **infers** a stage from the tool events every hook already delivers
 un-instrumented sessions that never call `agenthub stage` — it fills in a lane's
 pipeline map without requiring every skill to be rewritten.
 
-Two event sources feed the identical matcher, one per tool:
-
-| Lane `tool` | Source | Cadence |
-| --- | --- | --- |
-| `claude` | hooks — `touchLaneFromHook` in `server/routes/hooks.js` | every hook, live |
-| `codex` | Codex's own rollout journals on disk — `server/lib/codex-ingest.js` | poll, `DASHBOARD_CODEX_POLL_MS` (default 15000; `0` disables) |
+The matcher is fed by hooks — `touchLaneFromHook` in `server/routes/hooks.js`,
+on every hook, live — so it only ever sees `claude` lanes.
 
 Codex has no hook mechanism at all, so `touchLaneFromHook` is pinned to
 `"claude"` — a hook must never touch a `codex` lane sharing the same directory.
-`codex-ingest.js` is the codex-side equivalent: it tails
-`$CODEX_HOME/sessions/<YYYY>/<MM>/<DD>/rollout-*.jsonl` (`$CODEX_HOME` defaults
-to `~/.codex`), reads the thread's `cwd` from the `session_meta` on each file's
-first line, and maps Codex's tool calls onto the same `{tool_name, tool_input}`
-shape a Claude hook delivers:
-
-| Codex tool call | Mapped to |
-| --- | --- |
-| `exec` / `exec_command` / `shell` / `local_shell` | `Bash` with the extracted `cmd` |
-| any of the above carrying an `apply_patch` heredoc | one `Write` (for `*** Add File:`) or `Edit` (`Update`/`Delete`) per touched file |
-| `update_plan` | `TaskCreate` |
-| `spawn_agent` | `Agent` with the task name as `subagent_type` |
-| anything else (messages, reasoning, web search, tool OUTPUT) | ignored |
-
-Everything past that point is shared: the same templates, the same
-forward-only/declared-wins rules, the same amber-never-green boundary. Three
-codex-only details:
-
-- **A written detection also advances the lane's declared `stage`.** This is
-  the one place in AgentHub where an inference moves the blue `current` ring, and
-  it exists because nothing else can: a codex session has no hook and rarely
-  calls `agenthub stage` on its own, so without it the card sits at `idle` forever
-  while the amber badge is the only thing that ever moves. It is gated on
-  `recordDetection` having *written*, so it inherits that function's
-  forward-only, declared-wins and TTL guards unchanged — a detection behind the
-  declared stage still advances nothing. The `setStage` call passes **no
-  evidence**, so every node it moves through renders `passed-no-evidence`
-  (amber), never `done`: a detection sees a tool call, never its outcome. And
-  it passes `keepDetection: true`, the sole exception to `setStage`'s clearing
-  of the detection columns — here the detection is the *reason* for the
-  declaration, so the card keeps showing which command caused it rather than
-  looking like a claim the agent made. The last node of every template carries
-  no `detect` rules, so this can never auto-declare a lane `done`.
-
-- Only bytes appended since the last pass are read. On the first sight of a
-  journal only its recent tail is read, and nothing at all when that file is
-  already idle — replaying a thread that finished days ago would paint stages
-  for work nobody is doing. "Idle" means the journal's mtime is more than two
-  minutes old **or in the future**: a file that claims to be from the future
-  (clock stepped back, NTP correction, a restore that preserved timestamps)
-  makes a raw `now - mtime` negative, which would otherwise read as "written
-  milliseconds ago" and replay a finished thread as live work.
-- The same pass mirrors the lane's `status` between `idle` and `running` from
-  the journal's mtime, under the identical guard hook ingestion uses (only a
-  lane with no `run_id`, and only from `idle`/`running` — never from
-  `provisioning` or `failed`). It writes nothing else: not `stage`, not
-  `notes`, not `slot`/`ports`.
-
-**A codex lane's *evidence* is a separate matter.** Auto-advance moves the ring
-but can never supply evidence, so every node a codex lane passes through stays
-amber until the session itself runs `agenthub stage <node> --evidence "..."`. AgentHub
-cannot inject an instruction into a CLI it merely spawns, so an `AGENTS.md` in
-the working copy is the only lever — `agenthub lanes agents install` writes the
-marker-delimited block for you (see "Installing the QC/gate agents"). Note that
-from inside a codex session `agenthub stage` needs to know which lane it is: a pane
-the dashboard started carries `AGENTHUB_LANE_ID`, and anywhere else `--tool codex`
-disambiguates (see "Which lane a CLI command addresses" below).
+Codex lanes carry no pipeline, so nothing detects or advances their stage.
+`server/lib/codex-ingest.js` only mirrors a codex lane's `status` between
+`idle` and `running`: every `DASHBOARD_CODEX_POLL_MS` (default 15000; `0`
+disables) it lists `$CODEX_HOME/sessions/<YYYY>/<MM>/<DD>/rollout-*.jsonl`
+(`$CODEX_HOME` defaults to `~/.codex`), reads each thread's `cwd` from the
+`session_meta` on the file's first line, and calls the owning lane `running`
+while that journal's mtime is under two minutes old — and `idle` once it is
+older **or in the future** (a clock stepped back makes a raw `now - mtime`
+negative, which would otherwise read as live). It uses the identical guard hook
+ingestion uses (only a lane with no `run_id`, and only from `idle`/`running` —
+never from `provisioning` or `failed`) and writes nothing else: not `stage`,
+not `notes`, not `slot`/`ports`.
 
 ### The evidence boundary
 
@@ -1174,9 +1151,8 @@ leads the declared one (see "Viewing lanes" below), and `LaneStripCard.tsx`'s
 and the browser never disagree about which one is the headline. Both locate the
 declaration by the node the server already resolved it onto (the one whose
 `state` is `current`), never by looking `lane.stage` up as a node id: most of
-what the ship-feature skill declares is an ALIAS (`tests`, `booting`, `ship`,
-`gate-blocked`), which is not an id, and an id lookup scores it -1 — every
-detection, however far behind, would then read as leading.
+what a skill declares may be an ALIAS, which is not an id, and an id lookup
+scores it -1 — every detection, however far behind, would then read as leading.
 
 ### Which lane a signal is credited to
 
@@ -1219,7 +1195,7 @@ contain whole code blocks:
 Each rule is tested against these fields **one at a time**, never against a join
 of them. An `Agent` event really carries `description` + `prompt` +
 `subagent_type` together, so a rule anchored to the agent's identity —
-`{"tool": "Agent", "match": "^Explore$"}` in `ship-feature.json` — would never
+`{"tool": "Agent", "match": "^Explore$"}` — would never
 fire against a concatenation of all three, and a rule could otherwise match
 across the seam between two unrelated fields. Write anchored rules against the
 one field that identifies the tool call.
@@ -1235,18 +1211,6 @@ to the flattened input. Either way the result is capped at 120 characters
 lane's tooltip sometimes shows a file path or a skill name rather than a shell
 command: it's whichever of the fields above the matching rule's `tool` carried.
 
-### Superpowers skill invocations
-
-The built-in `default` pipeline's `intake`, `plan`, `implement`, `review`, and
-`ship` nodes each carry a `{"tool": "Skill", "match": "..."}` rule matching the
-workflow skill names they expect (`brainstorming`, `writing-plans`,
-`executing-plans`/`subagent-driven-development`, Claude Code's own
-`code-review` plus `requesting-code-review`/`receiving-code-review`,
-`finishing-a-development-branch`). Invoking one of
-these skills is a much stronger signal than a matched Bash command, but it is
-still detection, not declaration — it renders dashed amber and never `done`,
-same as every other detected stage.
-
 Detection only ever attributes to a lane whose `cwd` matches the hook's
 session `cwd` (see "Which lane a signal is credited to" above). A session
 working directly in a source repo that was never itself adopted as a lane —
@@ -1286,90 +1250,36 @@ read per call, so no restart is needed for a test harness that sets it.
 ### Where the rules live
 
 Detection rules are not code — they live in the pipeline template itself, as
-a `detect` array on each node. The built-in `default.json`
-(`server/data/pipelines/default.json`) ships these rules today, node by node:
+a `detect` array on each node. AgentHub ships no template, so no rule fires
+until you install one.
 
-| Node | Detect rules |
-|---|---|
-| `intake` | `Agent` matching subagent `Explore` — a lane sitting at nothing else yet, but already exploring, shows *something* instead of idle; `Skill` matching `brainstorming`, which is intake's own declared command |
-| `plan` | `Skill` matching `writing-plans`; `Write` matching `docs/.*plan.*\.md`; `Agent` matching `Plan\|Software Architect\|Backend Architect\|UX Architect`; `TaskCreate` (any) |
-| `implement` | `Skill` matching `executing-plans\|subagent-driven-development\|test-driven-development`; `Edit` (any); `Write` to any path NOT under a `docs/` directory (`^(?!.*(?:^\|/)docs/)`) |
-| `tests` | `Bash` matching `\b(npm (run )?test\|pytest\|vitest\|jest\|go test\|cargo test\|node\s+--test\|rspec\|phpunit\|dotnet test\|mvn test\|gradle test)\b`; `Agent` matching `Test Results Analyzer\|API Tester\|Performance Benchmarker` |
-| `review` | `Skill` matching `code-review\|requesting-code-review\|receiving-code-review`; `Bash` matching `\bgh\b[^;&\|]*\bpr diff\b`; `Agent` matching a name containing `reviewer`/`Reviewer` (excluding `senior-gate-reviewer`, a lookbehind), `Evidence Collector`, or `Accessibility Auditor` |
-| `gate` | `Skill` matching `verification-before-completion`; `Agent` matching `senior-gate-reviewer\|Reality Checker` — entering the gate, never its verdict |
-| `ship` | `Bash` matching a `git push` **invocation** — `git`, then option groups, then `push` as the first non-flag token — or `gh … pr create` |
-| `done` | none — see below |
+A few lessons from rules that ran against real sessions, worth keeping when you
+write your own:
 
-**`git diff` is deliberately NOT a review signal.** It was, and measured on a
-real session four `git diff --stat` runs — used to verify a generated file —
-outranked 81 test runs and 30 edits and pinned the lane at `review`, because
-`detect()` takes the LAST matching node and `recordDetection` is forward-only.
-Reading a diff is constant background activity, so it carries no stage
-information. `gh pr diff` stays: that one really is a review act.
+- **Detection is a safety net, not the mechanism.** Because `recordDetection`
+  is forward-only AND never overrides a higher declared stage, a fix-loop
+  re-entry that drops back a node is invisible to detection — only an
+  `agenthub stage` declaration moves the lane back down. What detection adds is
+  the stage an agent forgot to declare and the heartbeat that keeps a working
+  lane from reading STALLED.
+- **Give a terminal node (`done`, `merged`) no rule.** Inference must never
+  reach a terminal state on its own; that would let a heuristic assert an
+  outcome instead of observing activity. A rule on a gate node should detect
+  that the gate *activity* started, never its verdict.
+- **`git diff` is not a review signal.** Measured on a real session, four
+  `git diff --stat` runs — used to verify a generated file — outranked 81 test
+  runs and 30 edits and pinned the lane at `review`, because `detect()` takes
+  the LAST matching node and detection is forward-only. Reading a diff is
+  constant background activity; `gh pr diff` really is a review act.
+- **Match a `git push` *invocation*, not the word `push`.** `git[^;&|]*push`
+  misses `git -c credential.helper='!f() { … }; f' push` (a `;` inside a quoted
+  value), and `git[\s\S]*push` over-matches `git log --oneline -1 && echo "… push …"`.
+  Consume option groups explicitly, treating a quoted option value as one unit,
+  then require `push` as the first non-flag token — that accepts `git push` and
+  `git -c core.hooksPath=/dev/null push` while rejecting `git commit -m "don't push"`,
+  `docker push` and `npm run push-docs`.
 
-**The `ship` pattern matches a git *invocation*, not the word `push`.** Two
-weaker forms were tried and both failed against real commands:
-
-- `git[^;&|]*push` (same shell segment) **misses** this repo's own push, because
-  `git -c credential.helper='!f() { … }; f' push` puts a `;` between the two
-  inside a quoted value. Six real pushes went undetected that way.
-- `git[\s\S]*push` (anywhere after `git`) **over-matches**, and did so on a live
-  lane within minutes: `git log --oneline -1 && echo "… push …"` pinned the lane
-  at `ship`. Since `ship` sits near the end of the pipeline and detection is
-  forward-only, that single over-read stuck — the same failure `git diff` caused
-  for `review`.
-
-So the pattern consumes option groups explicitly, treating a quoted option value
-as one unit, and then requires `push` to be the first non-flag token. That
-accepts `git push`, `git -c core.hooksPath=/dev/null push` and the credential
--helper form, while rejecting `git log … "push"`, `git commit -m "don't push"`,
-`docker push`, and `npm run push-docs`.
-
-The `ship-feature` template (`server/data/pipelines/ship-feature.json`) carries
-its own rules, aimed at the commands and Superpowers skills its driving skill
-actually runs:
-
-| Node | Detect rules |
-|---|---|
-| `intake` | `Skill` matching `brainstorming`; `Bash` matching `agenthub … feature activate`; `Agent` matching subagent `Explore` |
-| `plan` | `Skill` matching `writing-plans`; `Write` matching `docs/superpowers/specs/lane-.*\.md`; `Agent` matching `Plan\|Software Architect`; `TaskCreate` (any) |
-| `implementing` | `Skill` matching `test-driven-development\|executing-plans\|subagent-driven-development\|systematic-debugging`; `Edit`/`Write` to any path NOT under `docs/superpowers/specs/` (resp. not under `docs/`) |
-| `gates` | `Bash` matching `agenthub … hook ci-gate` or `agenthub … sync-base --check` |
-| `e2e-feature` | `Bash` matching `agenthub … up --qc` or `agenthub … hook e2e` |
-| `review` | `Skill` matching `code-review\|requesting-code-review\|receiving-code-review`; `Agent` matching a name containing `reviewer`/`Reviewer` (excluding `senior-gate-reviewer`, a lookbehind) |
-| `qc` | `Agent` matching `qc-local\|Evidence Collector\|Accessibility Auditor`; `Bash` matching `agenthub … lanes proof-link` |
-| `gate` | `Agent` matching `senior-gate-reviewer\|Reality Checker`; `Skill` matching `verification-before-completion` |
-| `publishing` | `Skill` matching `finishing-a-development-branch`; `Bash` matching a `git push` **invocation** (the same pattern `default.json`'s `ship` uses) |
-| `pr-open` | `Bash` matching `gh … pr create` |
-| `watching-pr` | `Bash` matching `gh … pr view` |
-| `e2e-feature-passed`, `qc-plan`, `reported`, `merged`, `done` | none — declaration-only |
-
-Two rules are deliberately absent from this template. There is **no `git diff`
-rule on `review`**, for the reason the `default` template learned the hard way
-below; the `code-review` skill invocation is the honest signal. And `merged` /
-`done` carry no rule at all, because inference must never reach a terminal
-state — a test pins that.
-
-Detection here is a **safety net, not the mechanism**: the `ship-feature-lane`
-skill declares every one of these stages with `agenthub stage` itself. What
-detection adds is the stage an agent forgot after a context compaction, the
-heartbeat that keeps a working lane from reading STALLED, and coverage for a
-lane running Superpowers skills without the driving skill at all. It cannot
-substitute for the skill's own declarations: because `recordDetection` is
-forward-only AND never overrides a higher declared stage, a fix-loop re-entry
-that drops back to `gates` is invisible to detection — only the skill's
-`agenthub stage gates` moves the lane back down.
-
-`done` in `default.json` deliberately has no rule — it is explicitly out of
-scope for inference (see the task's "Out of scope" list): `done` is the one
-state detection must never reach on its own, since inferring it would let a
-heuristic assert an outcome instead of observing activity. `intake` and `gate`
-now carry entry-activity rules (an `Explore` agent, a `senior-gate-reviewer`/
-`Reality Checker` agent or `verification-before-completion` skill) — these
-detect that the *activity* of exploring or gate-reviewing started, never a
-gate's pass/fail verdict, so the "no outcome inference" rule still holds.
-
-To add a rule, drop a template into the directory named by the
+To add a rule, put a template in the directory named by the
 `DASHBOARD_PIPELINES_DIR` environment variable (see "Custom pipeline
 templates" above) with a `detect` array on the node you want to match:
 
@@ -1393,8 +1303,8 @@ Detection never rewinds a lane and never fights a declaration:
 - **Declared beats detected.** A detection is written only when the lane's
   *declared* stage index is strictly less than the detection's. A lane
   already declared at `review` ignores an `implement` detection outright.
-  **One exception: a declaration on the pipeline's LAST node** (`done`, in both
-  built-in templates) stops vetoing. The pipeline is finished there, so a later
+  **One exception: a declaration on the pipeline's LAST node** (typically
+  `done`) stops vetoing. The pipeline is finished there, so a later
   detection is new work rather than a stale rerun of what the claim covers —
   without the exception a lane left at `done` rejects every detection for the
   rest of its life, which reads as "auto-detect is broken". The exception
@@ -1481,9 +1391,9 @@ Terminate the running session. If the lane has no live run, this is a no-op (no
 curl -X POST http://localhost:4820/api/lanes/5/stop
 ```
 
-### git: fetch / pull / push / stage / unstage / discard / commit / switch / branch-create / branch-delete
+### git: fetch / pull / push / stage / unstage / discard / commit / switch / branch-create / branch-delete / publish
 
-The git writes the lane card's action row and the Changes panel offer. See
+The git writes the Changes panel and its action row offer. See
 "Acting on a lane's working copy" above for what each one refuses and why.
 
 ```bash
@@ -1501,6 +1411,11 @@ curl -X POST http://localhost:4820/api/lanes/5/git/commit \
 curl -X POST http://localhost:4820/api/lanes/5/git/discard \
   -H "Content-Type: application/json" \
   -d '{"paths": ["src/scratch.ts"], "confirm": true}'
+
+# A repo with commits but no remote: add `origin` and push HEAD to it
+curl -X POST http://localhost:4820/api/lanes/5/git/publish \
+  -H "Content-Type: application/json" \
+  -d '{"url": "git@github.com:owner/repo.git"}'
 ```
 
 ### clear
@@ -1610,51 +1525,9 @@ The lane card shows a lock badge when the lane **holds** a named lock (its `lane
 - **Never delete the lock directory by hand.** A lock that outlives its holder (e.g. after a hard reboot) is cleaned up automatically — the next `acquire` on that name finds it stale (older than `LOCK_MAX_HOLD`) and breaks it. Deleting `LANES_ROOT/.locks/<name>/` yourself only races whoever else's `acquire` is about to do the same check safely.
 - **Never shrink `LOCK_MAX_HOLD` to force through a wait.** The 300-second floor exists specifically to stop this mistake. If the true holder is gone, the 300-second minimum wait is the price of safety. If the true holder is still running (e.g., a build with a network stall), shortening the timeout from 2700 to 300 does not help — it converts a slow success into a premature timeout, leaving the lock held and every other lane blocked forever.
 
-## The ship-feature-lane skill (E1)
+## Lane tooling: QC boot, sync-base, MCP, integrations, CI
 
-The **ship-feature-lane** skill is the ported Shipyard driving skill for autonomous end-to-end feature pipelines in a single AgentHub lane. It coordinates the entire development flow: implementation (TDD) → independent unit tests → pre-push CI gates + dev preflight → e2e testing → code review → local QC → senior gate authorization → PR push and publication → CI watch → final report.
-
-**Every stage whose job is to judge the work runs in a fresh-context subagent, never in the driving session.** The plan debate (Stage 0b), unit tests (Stage 1b), the e2e run and its triage (Stage 3), code review (Stage 4), browser QC (Stage 6), the senior gate (Stage 7), and a re-triage of CI that stayed red after a fix (Stage 10) are each dispatched with the Agent tool to a subagent that starts with an empty context and receives only artifacts it can verify itself — working directory, lane spec, diff range, commands, and the other agents' reports verbatim, never the driving session's paraphrase of why a finding was fine. The stages the driving session keeps are the ones that *do* rather than judge: intake, implementation, the mechanical gates, publishing, the CI/PR watch, and applying every fix the judges ask for. `subagent_type: fork` is explicitly forbidden for these: a fork inherits the implementing session's context, so it inherits the belief that the code is already correct. The driving session implements and applies fixes; it never grades its own work. Stages 1b/3 use the generic `general-purpose` type (nothing to install). Stage 4 uses the generic `Code Reviewer` type as its catch-all, plus — in parallel, routed by which of `server/`, `client/` the diff touches — the plugin-qualified `agenthub:backend-reviewer` / `agenthub:frontend-reviewer` domain reviewers (nothing to install; `agenthub:` addressing works from any lane). Stages 6/7 use the lane-installed `qc-local`/`senior-gate-reviewer` agents.
-
-### Getting the skill (nothing to do, if you run the plugin)
-
-The skill lives in `skills/ship-feature-lane/`, and the repo root **is** the `agenthub` plugin root (`"source": "./"`), so `skills/` is the plugin's own skills directory. Anyone with the `agenthub` plugin installed already has it in every session, from any lane's working directory, as **`/agenthub:ship-feature-lane`** — with the bare `/ship-feature-lane` working as an alias unless another skill or command claims that name.
-
-Only a plain checkout without the plugin needs the fallback:
-
-```bash
-agenthub skills install
-```
-
-Copies `skills/ship-feature-lane/` into `~/.claude/skills/ship-feature-lane/` (overwrites on reinstall — run it again after pulling an update to the skill), which restores the bare `/ship-feature-lane` name. One-time per machine, same as `agenthub lanes agents install` is one-time per lane.
-
-**Agents come from the same plugin, under two names.** `qc-local` and `senior-gate-reviewer` live in `agents/` at the repo root, so the plugin exposes them as `agenthub:qc-local` / `agenthub:senior-gate-reviewer`. `agenthub lanes agents install` copies those same files into the lane's own `.claude/agents/` — the highest-priority agent source — which is what makes the bare `subagent_type: qc-local` the skill prefers resolve inside the lane. Either name reaches the same definition; the skill falls back to the `agenthub:` form when the lane copy is missing.
-
-### Invoking the skill
-
-```bash
-# Inside a lane's working directory:
-/ship-feature-lane <requirement>
-```
-
-The skill frontloads all clarifying questions once, then runs unattended. The only interactive touchpoints are **Stage 0 (Q&A intake)** and **merging the PR on GitHub**; everything else runs to completion or escalates with a `blocked` status visible on the dashboard. Progress is declared via `agenthub stage` commands at every step.
-
-### Current status: stages 0–8, 10–12, 14 work; stage 9 deferred, stage 13 partially wired (CI-wait works, dev-QC doesn't); stages 6–7 agent-gated
-
-**Stages implemented now:**
-- **0-8**: Intake & frontloaded Q&A → plan → implementation → independent unit tests (1b) → gates+preflight → e2e on feature branch → code review → QC plan → QC → senior gate → publish PR
-- **10-12**: CI watch on the PR → report → watch PR until merge (gated fix-loop re-entries on review feedback)
-- **14**: Done
-
-**Stages currently hardcoded skipped** (pending F's integrations):
-- **9 (Ticket)**: Ticket-filing integration not yet built — this stage is skipped entirely.
-
-**Partially wired:**
-- **13 (Post-merge verification)**: CI-wait half now runs for real via `agenthub lanes ci status`. The dev-QC half (QCing the deployed site) is still unavailable — Stage 13 always ends noting that gap even when CI-wait passes clean.
-
-**Stages 6 and 7 are now unblocked** — run `agenthub lanes agents install` once per lane (see "Installing the QC/gate agents" below) before a lane's first run through Stage 6. A lane that reaches Stage 6/7 without having installed the agents will fail to find the `qc-local`/`senior-gate-reviewer` subagent type; install and re-run.
-
-See [the skill text](../skills/ship-feature-lane/SKILL.md) for the full pipeline definition.
+The commands below are primitives a driving session (or you) calls explicitly — AgentHub never sequences them.
 
 ### QC boot flag and profile integration
 
@@ -1677,7 +1550,7 @@ These environment variables are passed to the profile's `boot` hook during `agen
 
 ### Dev preflight and merge safety: sync-base
 
-`agenthub lanes sync-base` is the ONE sanctioned merge in the pipeline — `origin/development` into a feature branch — used at Stages 2, 8, and 12. Three modes:
+`agenthub lanes sync-base` is the ONE sanctioned merge a session runs from the CLI — `origin/development` into a feature branch. Three modes:
 
 ```bash
 agenthub lanes sync-base --check feat/<slug>      # read-only preflight: fetch + collision check + DEV_DELTA/DEV_OVERLAP
@@ -1697,34 +1570,9 @@ GENERATED_MERGE_PATHS="api/openapi.json api/client.ts"
 
 `MIGRATIONS_DIR` enables the collision preflight against a numbered-migrations directory. `GENERATED_MERGE_PATHS` gives the listed files a keep-ours merge driver (never hand-merged) and folds the profile's `regen` hook output into the sync commit — the single most common cross-lane conflict, for a repo that generates an API contract/client.
 
-### Installing the QC/gate agents: agents install
-
-Stage 6 (browser QC) and Stage 7 (senior GO/NO-GO gate) run as subagents — `qc-local` and `senior-gate-reviewer`. The plugin already ships them as `agenthub:qc-local` / `agenthub:senior-gate-reviewer`; installing them into the lane's own `.claude/agents/` is what makes the bare names work there:
-
-```bash
-agenthub lanes agents install
-```
-
-Writes both agent definitions (from the repo's own `agents/`, the same files the plugin ships) into `<lane>/.claude/agents/` and adds that directory to the lane's local `.git/info/exclude` (never the tracked `.gitignore` — this is a per-clone runtime concern, not an app-repo change). Idempotent and never automatic, the same shape as `agenthub lanes proof-link` — a session installs the agents explicitly, once, before a lane's first run through Stage 6/7 (or after a AgentHub upgrade ships updated templates — reinstalling overwrites, it doesn't merge).
-
-**On a `codex` lane the same command installs something else.** Codex never
-reads `.claude/agents/`, so copying agent definitions there would be dead
-files. Instead it writes the stage-declaration block into
-`<lane>/AGENTS.md` — the project doc Codex *does* load from the working
-directory — delimited by `<!-- agenthub:stage:start -->` / `<!-- agenthub:stage:end -->`
-so a reinstall replaces exactly that block and nothing else. The file is
-appended to when it already exists (your own prose is preserved) and created
-when it does not; `installed` comes back as `["AGENTS.md"]`. This is the lever
-that gets a codex session to supply the *evidence* auto-advance cannot — see
-"Stage detection".
-
-**Credentials are not embedded.** Unlike Shipyard's original per-lane agent generation, these templates carry no QA account credentials — this repo has no seeded-QA-account system yet. `qc-local` degrades gracefully: if it hits a login page with no credentials block present, it reports `LOCAL-QC: FAIL — login required, no seed-account mechanism configured for this profile` rather than guessing.
-
-**`ticketer`, `dev-qc`, and `pr-reviewer`** are not ported yet — `ticketer` is invoked by Stage 9 (skipped), and `dev-qc` by Stage 13's dev-QC half (unavailable); `pr-reviewer` isn't referenced anywhere in this skill's text.
-
 ### Syncing MCP servers: mcp sync
 
-A lane needs the same MCP servers (Playwright, a local-QC server) as its source repo to run Stage 3/6. `agenthub lanes mcp sync` gives it those:
+A lane needs the same MCP servers (Playwright, a local-QC server) as its source repo to run e2e or browser QC. `agenthub lanes mcp sync` gives it those:
 
 ```bash
 agenthub lanes mcp sync
@@ -1746,11 +1594,11 @@ A profile can declare `.agenthub/profile/integrations.env` with `TRACKER_ENABLED
 agenthub lanes integration tracker    # exit 0 = on, 1 = off
 ```
 
-This only reports what the PROFILE wants — it doesn't file a ticket, run dev-QC, or wait on CI. The agent that would act on an enabled `dev_qc` toggle isn't built yet, and neither is a `tracker` ticketer — `ship-feature-lane`'s Stage 9 stays skipped and Stage 13's dev-QC half stays unavailable regardless of what those two toggles read. `ci_wait`'s consumer is `agenthub lanes ci status` (added — see the command reference below); Stage 13's CI-wait half now honors it for real. The CLI command and `GET /api/lanes/:id/integrations/:name` are the only readouts: the lane card used to carry a row of three badges for these, and it no longer does — two of the three could never be anything but decoration, and a badge that reports a toggle nothing acts on costs a row of card height to say nothing.
+This only reports what the PROFILE wants — it doesn't file a ticket, run dev-QC, or wait on CI. Nothing in AgentHub acts on an enabled `tracker` or `dev_qc` toggle. `ci_wait`'s consumer is `agenthub lanes ci status` (below). The CLI command and `GET /api/lanes/:id/integrations/:name` are the only readouts: the lane card used to carry a row of three badges for these, and it no longer does — two of the three could never be anything but decoration, and a badge that reports a toggle nothing acts on costs a row of card height to say nothing.
 
 ### Post-merge CI status: agenthub lanes ci status
 
-Check GitHub Actions status for a commit SHA or branch ref — used by Stage 13's CI-wait loop:
+Check GitHub Actions status for a commit SHA or branch ref — one shot, so a session waiting on CI polls it:
 
 ```bash
 agenthub lanes ci status <branch-or-sha> [<id>]
@@ -1758,87 +1606,6 @@ agenthub lanes ci status <branch-or-sha> [<id>]
 
 Exit codes: `0` = all checks passed, `1` = at least one check failed, `3` = checks pending or in progress. The `<id>` parameter is optional and filters results to a specific lane if provided; if omitted, it's not needed.
 
-### Pipeline template: ship-feature (16 node stages)
-
-The skill uses the `ship-feature` pipeline template, which defines the following 16 stages (node IDs):
-
-1. **intake** — frontloaded Q&A and feature activation
-2. **plan** — investigation and plan debate
-3. **implementing** — TDD implementation
-4. **gates** — CI gates + preflight check
-5. **e2e-feature** — run e2e on feature branch
-6. **e2e-feature-passed** — e2e result gate
-7. **review** — code review
-8. **qc-plan** — bound QC scope
-9. **qc** — browser QC (agent-gated until qc-local lands)
-10. **gate** — senior GO/NO-GO gate (agent-gated until senior-gate-reviewer lands)
-11. **publishing** — push branch + open/update PR
-12. **pr-open** — PR open and published
-13. **reported** — report posted
-14. **watching-pr** — watch for comments, conflicts, merge
-15. **merged** — PR merged, post-verify transition
-16. **done** — pipeline complete
-
-The Workspace page (`/run`) displays this template with nodes rendered in five states: `failed` (rejected), `current` (now), `done` (with evidence), `passed-no-evidence` (claimed or skipped), and `pending` (not reached).
-
-### More stage names than nodes
-
-Each node carries aliases, and they do two different jobs. Some absorb a
-near-miss (`implement` for `implementing`). Others are **sub-states**: a name
-the skill declares to say *why* the lane is sitting on a node, without adding a
-node to the map.
-
-This is the shape Shipyard converged on — its dashboard renders 13 nodes while
-its `PHASES` table folds roughly 35 stage names onto them. A pipeline map is
-read at a glance across many lanes at once, so it stays coarse; the stage name
-is read one lane at a time, so it can be specific.
-
-| Node | Near-miss aliases | Sub-states the skill declares |
-|---|---|---|
-| `intake` | `assigned`, `claimed`, `start` | `bootstrapping` |
-| `plan` | `planning`, `brainstorm`, `design` | — |
-| `implementing` | `implement`, `coding`, `build` | — |
-| `gates` | `pre-push-gate`, `tests` | `migration-collision`, `sync-conflict` |
-| `e2e-feature` | `e2e`, `live` | `booting`, `e2e-scoped` |
-| `e2e-feature-passed` | `e2e-passed` | — |
-| `review` | `reviewing`, `code-review`, `self-review` | — |
-| `qc-plan` | — | — |
-| `qc` | — | — |
-| `gate` | `sr-gate`, `verify`, `verification` | `gate-blocked` |
-| `publishing` | `push` | — |
-| `pr-open` | `ship`, `pr`, `push-conflict` | `push-revalidate` |
-| `reported` | — | — |
-| `watching-pr` | — | `pr-comment-fix` |
-| `merged` | — | — |
-| `done` | `complete`, `completed` | — |
-
-50 names over 16 nodes. Every one of them has a **source**: the skill declares
-it, or `default.json` uses it (an agent moving between pipelines will type
-what the other one taught it), or Shipyard's `PHASES` lists it. An alias with
-no source is not "flexibility" — it is a synonym someone imagined, and the
-`agenthub stage` warning already catches a name that resolves to nothing, which is
-better feedback than silently absorbing every plausible spelling. Twelve
-sourceless aliases were written and then cut for exactly this reason.
-
-Two constraints on this:
-
-- **No alias may collide** with another node's id or alias. `phaseIdx` takes the
-  FIRST match, so a duplicate would silently resolve a declaration onto the
-  wrong node. A test asserts the whole template is collision-free.
-- **Aliases of one node share one record slot.** `lane.stages` is keyed by the
-  declared string, and `stageRecords` resolves each key onto its node — so
-  declaring `migration-collision` and then `gates` leaves ONE record for that
-  node (the canonical `gates` one wins). A sub-state that needs to keep its own
-  `--evidence` separately has to be a real node, not an alias.
-
-`integrate`, `dev-gates`, `e2e-on-dev` and `push-dev` are deliberately **not**
-nodes here. Shipyard had them and retired them on 2026-07-16 (see the comment
-above `PHASES` in its `dashboard/src/lib/constants.js`); it now folds those
-names into the surviving phases so old feature cards still render. AgentHub never
-shipped them, so there is nothing to fold.
-
-These nodes also carry `detect` rules; see "Stage detection → Where the rules live".
-
 ## Orchestration: what AgentHub does NOT do
 
 **AgentHub does not chain, queue, retry, or evaluate gates.**

docs/PLUGINS.md

@@ -87,28 +87,22 @@ checkout unnecessary.
 | The `agenthub` CLI | a launcher written to `~/.local/bin/agenthub` |
 | The dashboard UI (`/run` and every other client route) | built into the runtime dir by the bootstrap, so it works the moment `claude` starts |
 | `/agenthub-doctor`, `/agenthub-update`, `/agenthub-open` | `plugins/agenthub/commands/` |
-| `/ship-full`, `/ship-quick` and one command per pipeline node (`/intake`, `/plan`, `/implement`, `/tests`, `/e2e`, `/review`, `/qc`, `/gate`, `/publishing`, `/pr-open`, `/done`, …) | `plugins/agenthub/commands/`, one file per name |
-| The skills (`ship-feature-lane`, `ship-feature`, `repo-onboarding`, `debug-live-issue`, `update-project-docs`, `file-headers`) | `skills/` at the repo root — which IS the plugin root, so they are auto-discovered as plugin skills |
-| The agents (`qc-local`, `senior-gate-reviewer`, `backend-reviewer`, `frontend-reviewer`) | `agents/` at the repo root, auto-discovered the same way — exposed as `agenthub:<name>` |
+| The skills (`repo-onboarding`, `debug-live-issue`, `update-project-docs`, `file-headers`) | `skills/` at the repo root — which IS the plugin root, so they are auto-discovered as plugin skills |
 
 Plugin skills are namespaced: they are invoked as `/agenthub:<name>`, with the bare
 `/<name>` working as an alias unless another skill or command claims that name.
 This is why `skills/` sits at the repo root instead of `.claude/skills/` — the
 latter only loads for a session whose cwd is inside this checkout, which is
-useless for a lane working in a different repo. `agenthub skills install` survives
-as the fallback for a plain checkout without the plugin.
+useless for a lane working in a different repo.
 
-**The agents ship the same way, from the same files.** `agents/` at the repo
-root holds all four (`qc-local`, `senior-gate-reviewer`, `backend-reviewer`,
-`frontend-reviewer`), so the plugin exposes them as
-`agenthub:<name>`. `agenthub lanes agents install` copies `qc-local` +
-`senior-gate-reviewer` from that same directory into a lane's own
-`.claude/agents/` — the highest-priority agent source — which is what makes the
-bare `subagent_type: qc-local` in the pipeline skill resolve there. One source
-file, two ways to reach it; the skill names the bare form first and falls back
-to the `agenthub:` form. On a `codex` lane the same command installs the
-`<!-- agenthub:stage:start -->` block in the lane's `AGENTS.md` instead — Codex
-never reads `.claude/agents/`.
+That is the whole plugin: the hooks, the CLI, the dashboard, three commands and
+four skills. It ships **no subagents** and no pipeline template, and it neither
+depends on nor installs any other plugin (Superpowers included). The pipeline
+slash commands, the `ship-feature` / `ship-feature-lane` skills and the
+`qc-local` / `senior-gate-reviewer` / `backend-reviewer` / `frontend-reviewer`
+agents were removed; the stage/pipeline machinery they drove stays in the
+dashboard, dormant until you install a template (see `docs/LANES.md` §
+"Pipeline stages and the five node states").
 
 Because the plugin ships the hooks itself, `npm run install-hooks` is not needed
 for plugin users — and must not be run alongside it. Events carry no id, so two
@@ -128,19 +122,20 @@ check.
 milliseconds — the real work happens in a detached worker, so a session never
 waits on an install:
 
-1. **Fast path** — recorded state matches this plugin build and a server is live → exit.
+1. **Fast path** — recorded state matches this plugin build and a server is live → exit. "Live" means a discovery entry whose pid answers AND whose `startedAt` is after this boot (60 s margin): an entry left over from before a reboot names a pid the OS may have handed to an unrelated process, and without systemd (macOS) nothing else clears it.
 2. **Superseded check** — if Claude Code records a DIFFERENT build of this plugin as installed, this one logs a line and does nothing else (see [A retired build never acts](#a-retired-build-never-acts)).
 3. **Node gate** — refuse below 22.5 with one line (see Prerequisites).
 4. **Lock** — atomic `mkdir` lock holding the PID; reclaimed when the owner is dead or the lock is older than 10 minutes, so two sessions cannot race the install or spawn two servers.
 5. **Install** — `npm install --omit=dev --ignore-scripts` into the runtime dir (never into the plugin cache, which is garbage-collected and replaced on every update). `--ignore-scripts` keeps the root `postinstall` from pulling the whole Vite client toolchain.
 6. **Legacy hook cleanup** — see above.
-7. **CLI** — write the `~/.local/bin/agenthub` launcher, never clobbering a `agenthub` the bootstrap did not write.
+7. **CLI** — write the `~/.local/bin/agenthub` launcher, never clobbering a `agenthub` the bootstrap did not write. It pins the node that ran the bootstrap and falls back to `node` on `PATH` when that binary is gone (a Homebrew Cellar or nvm path deleted by an upgrade).
 8. **UI build** — `client/` is copied into the runtime dir and built there (`npm ci --include=dev`, falling back to `npm install --include=dev`, then `npm run build`), landing in `runtime/client-dist` — the same directory the server serves from. `--include=dev` is required, not tidy: the entire build toolchain (`vite`, `typescript`, `@vitejs/plugin-react`, `tailwindcss`, `@types/*`) is a devDependency, and npm reads an inherited `NODE_ENV=production` as `--omit=dev`. Every bootstrap descended from the running server carries that env — the self-update chain, and any `SessionStart` fired by a `claude` inside a tmux pane the server started — so without the flag the install drops `vite` and the build dies on missing types. Skipped when a bundle for the current version already exists; a failure here does not fail the bootstrap (the API still works, and `/agenthub-open` can retry) but does mean `/run` 404s until it's fixed — and when a bundle from the PREVIOUS version is still on disk the failure is quieter still: the dashboard keeps serving the old UI against the new API, visible only as the Settings page's `UI build vX (rebuild client to match)` line.
 9. **Server** — on Linux with `systemd --user` available, install/refresh a
-   `agenthub.service` unit (see [Auto-start on boot](#auto-start-on-boot)) instead
+   `agenthub.service` unit — on macOS with a GUI login, the
+   `io.smartgift.agenthub` LaunchAgent (see [Auto-start on boot](#auto-start-on-boot)) — instead
    of a bare spawn, so the server is supervised and comes back after a reboot
-   with no Claude Code session involved. Everywhere else (macOS, Windows, or
-   no systemd), spawn `server/index.js` detached, with `NODE_PATH` at the
+   with no Claude Code session involved. Everywhere else (Windows, no
+   systemd, a Mac reached only over SSH), spawn `server/index.js` detached, with `NODE_PATH` at the
    runtime `node_modules` and `DASHBOARD_CLIENT_DIST` at the runtime
    `client-dist` — scoped to this session, same as before this fell back to
    systemd.
@@ -233,9 +228,26 @@ anyone logs in; when that needs elevated rights, it's skipped silently (check
 `agenthub.service` unit not written by this bootstrap is left untouched, and the
 server falls back to the old per-session detached spawn instead.
 
-On macOS, Windows, or a Linux box without systemd, nothing changes: the
+On macOS the same steps write a LaunchAgent instead
+(`~/Library/LaunchAgents/io.smartgift.agenthub.plist`, `scripts/launchd-service.js`;
+`scripts/service-manager.js` picks the one for the platform, and both export the
+same API). `KeepAlive` plays `Restart=always`, `AbandonProcessGroup` keeps the
+lane panes' tmux server alive across a restart, output goes to
+`~/Library/Logs/agenthub.log`, and the hand-over restart is `launchctl bootout`
++ `bootstrap` (a `kickstart` would keep the old plist). If that bootstrap fails
+and no server is left running, the bootstrap starts one detached. A LaunchAgent
+needs the user's GUI login; without one (SSH only) `launchctl print gui/<uid>`
+fails and the server falls back to the detached spawn below.
+
+On Windows, a Linux box without systemd, or a Mac with no GUI login, the
 server is a detached spawn started fresh on the next `SessionStart` after a
-reboot, same as always.
+reboot, same as always. That spawn inherits the Claude Code session's env, so
+`server/index.js` deletes the parent-session variables (`CLAUDECODE`,
+`CLAUDE_CODE_SESSION_ID`, `CLAUDE_CODE_MESSAGING_*`, `CLAUDE_PLUGIN_ROOT`, …)
+before anything else runs — otherwise tmux hands them to every lane pane. It is
+a denylist: user configuration such as `CLAUDE_CONFIG_DIR`,
+`CLAUDE_CODE_USE_BEDROCK` and `ANTHROPIC_*` passes through. See
+[INSTALL.md § macOS](../INSTALL.md#macos).
 
 ### Who may stop the server
 
@@ -298,66 +310,9 @@ courtesy of `Restart=always`.
 
 | Command | Does |
 |---|---|
-| `/agenthub-doctor` | Node version, bootstrap state, runtime deps, server liveness, duplicate hooks, CLI launcher + PATH, **systemd** (`WARN` when the unit names a retired plugin root — the dashboard will not survive a reboot — or when it is installed but stopped; no unit at all is fine), **tmux** (`WARN` when absent — only the run console, `agenthub lanes shell` and session reloads need it), **skill plugins** (see below), UI bundle |
+| `/agenthub-doctor` | Node version, bootstrap state, runtime deps, server liveness, duplicate hooks, CLI launcher + PATH, **systemd** (`WARN` when the unit names a retired plugin root — the dashboard will not survive a reboot — or when it is installed but stopped; no unit at all is fine), **tmux** (`WARN` when absent — only the run console, `agenthub lanes shell` and session reloads need it), UI bundle |
 | `/agenthub-update` | Pull the latest `agenthub` release via `claude plugin marketplace update` + `claude plugin update agenthub@<marketplace> -y`, then reinstall dependencies and restart the server (`plugin-bootstrap.js --force`). The plugin pull needs a manual `/reload-plugins` afterward to take effect in the current session — not scriptable from a command. |
 | `/agenthub-open` | Rebuild the UI bundle and print the dashboard URL. Re-runs the bootstrap first when the server is down or still executing a plugin root that a mid-session `/plugin` update retired, so a fresh bundle never talks to an older server's routes |
-| `/ship-full <requirement>` | Put the lane on the 16-node `ship-feature` template, then run `/agenthub:ship-feature-lane` **in this session**. The in-session twin of `agenthub ship-full` (which spawns its own `claude` from a terminal) |
-| `/ship-quick <requirement>` | The same for the 8-node `default` template and `/agenthub:ship-feature` — stops at review/gate, no PR, no browser QC |
-| One per pipeline node: `/intake`, `/plan`, `/implement`, `/tests`, `/e2e`, `/e2e-passed`, `/review`, `/qc-plan`, `/qc`, `/gate`, `/publishing`, `/pr-open`, `/reported`, `/watching-pr`, `/merged`, `/done` | Run just that node's own `command`, resolved through `agenthub lanes node <id> --print` against whichever template the lane is on (matched by id **or alias**, so `/implement` works on `default`'s `implement` and `ship-feature`'s `implementing`). A slash-command node is invoked in the current session, never as a nested `claude`; anything else runs as a shell argv in the lane's cwd. None of them declares a stage |
-
-#### The `Skill plugins` row
-
-Derived from the loaded pipeline templates, not hardcoded: every `/plugin:skill`
-string a template names — as the pipeline's own `skill` or as one node's
-`command` — has to come from an installed, enabled plugin. Today that means
-**`superpowers`**, which `/agenthub:ship-feature` and `/agenthub:ship-feature-lane`
-drive step by step (`brainstorming`, `writing-plans`,
-`test-driven-development`, `verification-before-completion`,
-`finishing-a-development-branch`). The `review` node is the exception: it names
-the bare `/code-review`, Claude Code's own review skill, which carries no
-`plugin:` prefix and so requires nothing to be installed. Install it
-with `claude plugin install superpowers@claude-plugins-official`.
-
-The row is a **WARN, never a FAIL**: the dashboard, hooks and CLI all work
-without it, and only those two pipeline skills stop partway. A plugin listed but
-explicitly disabled counts as missing — Claude Code will not resolve its skills.
-The skills present as plain user skills under `~/.claude/skills/` count as
-satisfied, so a hand-copied setup is not reported as broken. A custom template
-in `DASHBOARD_PIPELINES_DIR` naming some other plugin's command is checked the
-same way.
-
-Both the derivation and the missing/satisfied rules live in
-`server/lib/skill-plugins.js`, shared with the bootstrap below so the row and
-the install can never disagree about what is missing.
-
-#### Automatic install, and why it is allowlisted
-
-`plugin-bootstrap.js` installs the missing plugins itself, at the very end of
-its **detached worker** — never in the 10 s `SessionStart` hook, because the
-install clones from the network. It runs `claude plugin install
-superpowers@claude-plugins-official --scope user -y`; if that fails it registers
-the marketplace (`claude plugin marketplace add anthropics/claude-plugins-official`)
-and retries exactly once. Failure is logged with the manual command and nothing
-throws — the dashboard, hooks and CLI do not need these plugins.
-
-The result is recorded as `skillPluginsSettled` in the bootstrap's `state.json`,
-which is also part of `fastPathOk()`: the check runs **once** per install, then
-the hot path reads one flag. `/agenthub-update` (`--force`) is the retry.
-`AGENTHUB_AUTO_INSTALL_PLUGINS=0` (or `false`/`off`) turns it off entirely.
-
-An installed plugin only resolves in the **current** session after
-`/reload-plugins`; a new session picks it up on its own. The log says so, since
-the worker is detached and cannot tell the session that started it.
-
-**Reporting is derived, installing is allowlisted.** The row above reads plugin
-names out of the templates, which is right for a report. Installing from the
-same source would not be: a template is a file anyone can drop into
-`DASHBOARD_PIPELINES_DIR`, so it would turn "edit a JSON file" into "run this
-vendor's plugin install command on the next session". Auto-install therefore
-consults `AUTO_INSTALLABLE`, a fixed map in `server/lib/skill-plugins.js`, and
-skips every other requirement — visible in the doctor, never installed. Adding
-an entry there is a decision to install someone else's code on a user's machine
-without asking; it belongs in a review, not in a config file.
 
 ### Where things live
 

docs/superpowers/specs/2026-09-25-git-credentials-design.md

@@ -0,0 +1,57 @@
+# Git credentials for dashboard fetch/pull/push (issue #45, part A)
+
+## Problem
+
+The dashboard runs git with no terminal and `GIT_TERMINAL_PROMPT=0`. When no
+credential helper on the machine holds a credential for the remote's host, git
+wants to prompt, cannot, and fails:
+`fatal: could not read Username for 'https://git.smartgift.io.vn': terminal prompts disabled`.
+Reproduced with `git -c credential.helper= push --dry-run`.
+
+## Decisions (approved 2026-09-25)
+
+- AgentHub keeps its OWN credentials, shared by everyone using the AgentHub
+  install (multi-user login is planned; accounts and settings are shared).
+- The dashboard asks for a credential when git needs one, then retries.
+- Merge and conflict resolution is part B and gets its own design.
+
+## Design
+
+**Store** — `server/lib/git-credentials.js`, one file
+`<CLAUDE_HOME>/agenthub-git-credentials/credentials.json` (dir 0700, file 0600,
+written through a temp file), one record per `protocol + host`:
+`{protocol, host, username, password, savedAt}`. No route returns `password`;
+the list reports `hasToken`. Routes: `GET /api/git-credentials`,
+`DELETE /api/git-credentials/:protocol/:host`.
+
+**Delivery** — `server/lib/git-credential-helper.js`, a git credential helper
+speaking git's own protocol. For a network action, when AgentHub holds a
+credential for one of the repo's remote hosts, or the request carries one, git
+runs with `-c credential.helper= -c credential.helper=<ours>`: ONLY our helper.
+The machine's helpers are left out on purpose — a stale token there would win
+over the one just typed, and git's post-success `store` would copy a
+"use once" token into the OS user's own helper. With nothing from AgentHub for
+the host, the command is unchanged. The secret never reaches argv: the helper
+reads the store file, or `AGENTHUB_GIT_ONCE` in that one git process's env.
+
+**Flow** — an auth failure (`could not read Username|Password`,
+`Authentication failed`, `terminal prompts disabled`, `Invalid username or
+password`) answers `409 EGITAUTH` with `{protocol, host, username?}`. The git
+bar shows a form (username, password/token, "remember for everyone on this
+AgentHub", on by default) and resends the action with
+`credentials: {protocol, host, username, password, remember}`. The server
+accepts it only for a host that is one of the repo's remotes, runs the action,
+and saves the credential only after git succeeded and `remember` is set.
+
+**Limits** — one credential per host, so everyone on one AgentHub pushes as
+the same account. `fetch --all` over remotes on several hosts: a host with no
+AgentHub credential gets no machine helper either while one does. Over plain
+HTTP on a LAN the token crosses the network unencrypted; the form says so.
+
+## Testing
+
+Store: save/list/remove, 0600, list never carries the password, bad host
+refused. Helper: real `git credential fill` through our helper, stored and
+once. Route: a local HTTP remote answering 401 → `EGITAUTH` with the host; a
+resend with credentials reaches that server as Basic auth; nothing saved on
+failure. Client: the form appears on `EGITAUTH`, resends, never renders a token.

embed-images.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Nhúng mọi ảnh cục bộ của slide vào thẳng file HTML dưới dạng data URI.
+
+Đọc agenthub-introduction.html, thay từng src="*.png" bằng chuỗi base64, ghi ra
+agenthub-introduction-standalone.html - một file duy nhất, gửi cho ai cũng thấy ảnh.
+Chạy lại sau mỗi lần sửa slide.
+
+@author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+"""
+import base64
+import mimetypes
+import pathlib
+import re
+import sys
+import urllib.parse
+
+SRC = pathlib.Path(__file__).parent / "agenthub-introduction.html"
+OUT = SRC.with_name("agenthub-introduction-standalone.html")
+
+
+def inline(match):
+    raw = match.group(1)
+    if raw.startswith(("data:", "http://", "https://")):
+        return match.group(0)
+    path = SRC.parent / urllib.parse.unquote(raw)
+    if not path.is_file():
+        sys.exit(f"thiếu ảnh: {path}")
+    mime = mimetypes.guess_type(path.name)[0] or "application/octet-stream"
+    b64 = base64.b64encode(path.read_bytes()).decode()
+    return f'src="data:{mime};base64,{b64}"'
+
+
+html = SRC.read_text(encoding="utf-8")
+OUT.write_text(re.sub(r'src="([^"]+)"', inline, html), encoding="utf-8")
+print(f"{OUT.name} - {OUT.stat().st_size / 1024 / 1024:.1f} MB")

openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
   title: Agent Dashboard for Claude Code API
-  version: 1.8.5
+  version: 1.8.12
   description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
   contact:
     name: Nguyễn Ngọc Trí Vĩ
@@ -10636,7 +10636,7 @@ paths:
       tags:
         - Lanes
       summary: Find or adopt the lane owning a working directory
-      description: 'Idempotent: returns the lane whose cwd is an exact match or the longest path-boundary parent of `cwd` with `created: false` (200) — with `exact: true` only an exact match counts, so a directory nested inside another lane gets a lane of its own (the Add-lane modal sends it) — otherwise creates an `adopted` lane and returns it with `created: true` (201). The Workspace page opens on a directory rather than a lane id, so this is how it gets exactly one lane for that directory. Concurrent calls for the same path resolve to ONE lane: the `lanes.cwd` UNIQUE constraint decides, and the loser re-reads and returns the winner''s lane.'
+      description: 'Idempotent: canonicalizes `cwd` to its real path when it exists (the same path `createLane` stores), then returns the lane whose cwd is an exact match or the longest path-boundary parent of `cwd` with `created: false` (200) — with `exact: true` only an exact match counts, so a directory nested inside another lane gets a lane of its own (the Add-lane modal sends it) — otherwise creates an `adopted` lane and returns it with `created: true` (201). The Workspace page opens on a directory rather than a lane id, so this is how it gets exactly one lane for that directory. Concurrent calls for the same path resolve to ONE lane: the `lanes.cwd` UNIQUE constraint decides, and the loser re-reads and returns the winner''s lane.'
       operationId: ensureLane
       requestBody:
         required: true
@@ -10718,7 +10718,7 @@ paths:
                     type: object
                     additionalProperties: true
         '400':
-          description: sourceRepo is relative, missing, or not a git repository.
+          description: 'EBADSOURCEREPO: sourceRepo is relative, missing, or not a git repository. EEMPTYREPO: it has no commits, so there is nothing to branch a worktree from (no lane row is created).'
           content:
             application/json:
               schema:
@@ -10807,7 +10807,7 @@ paths:
             type: integer
       responses:
         '200':
-          description: available:true with {branch, head, subject, dirty, untracked, files}, or available:false alone. files names the files behind those counts as {path, status, added, deleted} records, capped at 20; the counts themselves are never capped. status is the two-character `git status --porcelain` code and path is the new path for a rename; added/deleted come from one `git diff --numstat HEAD` and are null where git has no delta to report (untracked, binary, renamed, or no commit to diff against).
+          description: available:true with {branch, head, unborn, subject, dirty, untracked, files, hasRemote, upstream, ahead, behind}, or available:false alone. A repo with no commit yet is available with unborn:true, head:null and subject:"". files names the files behind those counts as {path, status, added, deleted} records, capped at 20; the counts themselves are never capped. status is the two-character `git status --porcelain` code and path is the new path for a rename; added/deleted come from one `git diff --numstat HEAD` and are null where git has no delta to report (untracked, binary, renamed, or no commit to diff against).
         '404':
           description: Lane not found.
   /api/lanes/{id}/runtime:
@@ -11043,7 +11043,7 @@ paths:
       tags:
         - Lanes
       summary: The lane's recent commits
-      description: Newest first, up to limit (default 30, max 200). file= narrows it to the commits touching one path. Reading a commit's diff is GET /api/lanes/{id}/git/changes?range=commit&sha=. Read-only, no same-origin guard.
+      description: Newest first, up to limit (default 30, max 200). file= narrows it to the commits touching one path (relative, no `..`, else 400 EBADPATH). Reading a commit's diff is GET /api/lanes/{id}/git/changes?range=commit&sha=. Read-only, no same-origin guard.
       operationId: listLaneCommits
       parameters:
         - name: id
@@ -11064,6 +11064,8 @@ paths:
       responses:
         '200':
           description: '{available, commits:[{sha, short, subject, author, date, refs}]}.'
+        '400':
+          description: EBADPATH (file= is absolute or has a `..` segment).
         '404':
           description: Lane not found.
   /api/lanes/{id}/git/file:
@@ -11093,7 +11095,9 @@ paths:
         '200':
           description: '{available, path, rev, binary, truncated, lines}.'
         '400':
-          description: EBADPATH, EBADREV or ENOFILE.
+          description: EBADPATH (incl. a symlink resolving outside the lane), EBADREV or ENOFILE.
+        '403':
+          description: ESECRET — `.claude/settings.local.json` (the AI Router key) is refused at every rev, at any depth, and under any path that resolves to it (a symlinked `.claude`).
         '404':
           description: Lane not found.
   /api/lanes/{id}/git/ls:
@@ -11143,6 +11147,24 @@ paths:
           description: EBADPATH (the path escapes the lane).
         '404':
           description: Lane not found.
+  /api/lanes/{id}/git/tree-all:
+    get:
+      tags:
+        - Lanes
+      summary: Every level of the tracked tree in one read
+      description: 'The file explorer''s expand-all-folders read: ONE git ls-files, grouped into levels keyed by directory ("" is the root), each level shaped and capped like GET /api/lanes/{id}/git/tree''s entries. Read-only, no same-origin guard.'
+      operationId: listLaneTreeAll
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+      responses:
+        '200':
+          description: '{available, levels:{<dir>:[{name, path, dir}]}, truncated}.'
+        '404':
+          description: Lane not found.
   /api/lanes/{id}/git/branches:
     get:
       tags:
@@ -11166,7 +11188,7 @@ paths:
       tags:
         - Lanes
       summary: One git write on the lane's working copy
-      description: 'fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u origin HEAD, so only the branch the lane is on), stage/unstage (per file), discard (per file; irreversible, so it REQUIRES confirm:true), commit (git add -A then commit -m <message>, or only:"staged" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent''s half-finished work is never carried onto another branch), and branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per lane under the lane lock. Deliberately no merge, rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.'
+      description: 'fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u <remote> HEAD, so only the branch the lane is on; remote = the branch''s upstream remote, else the only remote, else origin, else 400 ENOREMOTE), stage/unstage (per file; staging a conflicted file that still has conflict markers is 400 EMARKERS), discard (per file; irreversible, so it REQUIRES confirm:true), stage-hunk / discard-hunk (ONE hunk of a tracked file''s `git diff HEAD`, named by its `@@` line and re-read server-side at the given context — the applied patch is always git''s own text, never one from the request; discard-hunk REQUIRES confirm:true; 400 EUNTRACKED for an untracked file, 409 EHUNKGONE when the hunk is no longer in the diff), commit (git add -A then commit -m <message>, or only:"staged" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent''s half-finished work is never carried onto another branch), branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree), publish (the ONE write whose destination comes from the request: `git remote add origin -- <url>` then `git push -u origin HEAD`, only in a repo with a commit and NO remote — it never re-points one; the url must be https:// without userinfo, ssh:// or scp-like user@host:path, and origin is removed again if the push fails), and merge / resolve / merge-commit / merge-abort (issue #45: merge a local or remote-tracking branch that exists — clean tree and a repo-root lane only, 400 ESUBDIR otherwise — answering conflicts:[paths] when it stops on conflicts; resolve {path, side: ours|theirs|done} a conflicted path, done refusing leftover markers with 400 EMARKERS; merge-commit is 409 ECONFLICTS while anything is unmerged; merge-abort REQUIRES confirm:true; pull/switch/merge/hunk actions are 409 EMERGING mid-merge). fetch/pull/push/publish needing a login answer 409 EGITAUTH with auth:{protocol,host,username,rejected}; resend with credentials:{protocol,host,username,password,remember} (a repo remote''s host only, else 400 EBADHOST). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per git index (the lane lock keyed on the worktree''s git dir, so two lanes sharing one index cannot collide on index.lock). Deliberately no rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.'
       operationId: runLaneGitAction
       parameters:
         - name: id
@@ -11186,10 +11208,13 @@ paths:
               - stage
               - unstage
               - discard
+              - stage-hunk
+              - discard-hunk
               - commit
               - switch
               - branch-create
               - branch-delete
+              - publish
       requestBody:
         required: false
         content:
@@ -11197,6 +11222,9 @@ paths:
             schema:
               type: object
               properties:
+                url:
+                  type: string
+                  description: publish only; https:// (no userinfo), ssh:// or user@host:path, max 1024 chars.
                 message:
                   type: string
                   description: commit only; required, max 4000 chars.
@@ -11219,18 +11247,32 @@ paths:
                   items:
                     type: string
                   description: stage, unstage, discard; each must be a path git reports changed.
+                path:
+                  type: string
+                  description: stage-hunk, discard-hunk; a path git reports changed (not untracked).
+                hunk:
+                  type: string
+                  description: stage-hunk, discard-hunk; the hunk's `@@` line as the diff returned it. The server re-reads the diff and applies git's own text of that hunk; a hunk no longer present is 409 EHUNKGONE.
+                block:
+                  type: integer
+                  description: stage-hunk, discard-hunk (optional); act on only the block-th run of consecutive +/- lines inside that hunk — the other runs are folded into context. Out of range is 409 EHUNKGONE.
+                context:
+                  type: integer
+                  description: stage-hunk, discard-hunk; the context the hunk was read at.
                 confirm:
                   type: boolean
-                  description: discard only; the call is refused without it.
+                  description: discard and discard-hunk; the call is refused without it.
       responses:
         '200':
-          description: '{action, ok:true, output} — git''s own stdout+stderr.'
+          description: '{action, ok:true, output} — git''s own stdout+stderr; publish adds remote:"origin".'
         '400':
-          description: EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY or ENOCHANGES.
+          description: EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY, ENOCHANGES, ESTAGEDOUTSIDE, ENOREMOTE, EUNTRACKED, EBADURL, EREMOTEEXISTS, ENOCOMMITS, EBADHOST, EBADCRED, ESUBDIR, EBADSIDE or EMARKERS.
         '404':
           description: Lane not found.
+        '409':
+          description: EGIT — git ran and refused (a rejected push, a diverged --ff-only pull); its stderr is appended to error.message. EGITAUTH — the remote wants a login (carries auth). EHUNKGONE, EMERGING, ENOMERGE, ECONFLICTS.
         '500':
-          description: git failed; its stderr is appended to error.message.
+          description: Unexpected server-side failure.
   /api/lanes/{id}/{action}:
     post:
       tags:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "agenthub",
-  "version": "1.8.5",
+  "version": "1.8.12",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agenthub",
-      "version": "1.8.5",
+      "version": "1.8.12",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenthub",
-  "version": "1.8.5",
+  "version": "1.8.12",
   "bin": {
     "agenthub": "bin/agenthub.js"
   },
@@ -62,8 +62,8 @@
     "import-history": "node scripts/import-history.js",
     "reconcile-tokens": "node scripts/import-history.js --reconcile-tokens",
     "clear-data": "node scripts/clear-data.js",
-    "test": "node --test server/__tests__/*.test.js && cd client && npm test",
-    "test:server": "node --test server/__tests__/*.test.js",
+    "test": "node scripts/test-server.js && cd client && npm test",
+    "test:server": "node scripts/test-server.js",
     "test:client": "cd client && npm test",
     "format": "prettier --write .",
     "format:check": "prettier --check .",

plugins/agenthub/commands/agenthub-doctor.md

@@ -25,12 +25,6 @@ Print the output verbatim, then add at most three lines of guidance based on the
 - `FAIL npm` or `FAIL Disk` → nothing else in the report can be trusted until
   these are fixed; both silently truncate installs.
 - `WARN agenthub CLI` → print the exact `export PATH=...` line from the output.
-- `WARN Skill plugins` → the pipelines name slash commands no installed plugin
-  provides. The dashboard is unaffected; `/agenthub:ship-feature(-lane)` is what
-  stops partway. The bootstrap normally installs these itself, so this row also
-  means that attempt has not run or did not succeed — say `/agenthub-update` retries
-  it, and print the `claude plugin install …` line from the output as the manual
-  route.
 - `WARN systemd` → when it says the unit names a **previous plugin version**,
   the dashboard is running now but will NOT come back after a reboot. Starting
   a new Claude Code session repairs it; print the `--force` command from the

plugins/agenthub/commands/done.md

@@ -1,23 +0,0 @@
----
-description: Declare the lane done
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `done` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node done $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/e2e-passed.md

@@ -1,23 +0,0 @@
----
-description: Declare e2e passed (ship-feature only)
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `e2e-passed` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node e2e-passed $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/e2e.md

@@ -1,23 +0,0 @@
----
-description: E2e on the feature branch (ship-feature only)
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `e2e` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node e2e $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/gate.md

@@ -1,23 +0,0 @@
----
-description: Senior GO/NO-GO gate
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `gate` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node gate $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/implement.md

@@ -1,23 +0,0 @@
----
-description: Implement (TDD)
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `implement` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node implement $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/intake.md

@@ -1,23 +0,0 @@
----
-description: Intake — brainstorm the requirement
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `intake` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node intake $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/merged.md

@@ -1,23 +0,0 @@
----
-description: Declare merged (ship-feature only)
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `merged` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node merged $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/plan.md

@@ -1,23 +0,0 @@
----
-description: Plan — write the implementation plan
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `plan` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node plan $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/pr-open.md

@@ -1,23 +0,0 @@
----
-description: Open the PR
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `pr-open` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node pr-open $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/publishing.md

@@ -1,23 +0,0 @@
----
-description: Publish the branch
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `publishing` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node publishing $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/qc-plan.md

@@ -1,23 +0,0 @@
----
-description: Declare the QC plan (ship-feature only)
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `qc-plan` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node qc-plan $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/qc.md

@@ -1,23 +0,0 @@
----
-description: Browser QC + proof gallery (ship-feature only)
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `qc` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node qc $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/reported.md

@@ -1,23 +0,0 @@
----
-description: Declare the run reported (ship-feature only)
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `reported` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node reported $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/review.md

@@ -1,23 +0,0 @@
----
-description: Code review
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `review` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node review $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/ship-full.md

@@ -1,23 +0,0 @@
----
-description: Run the full 16-stage lane pipeline (implement → gates → e2e → review → QC → senior gate → PR, watched until merged)
-argument-hint: <requirement>
-allowed-tools: Bash(agenthub lanes pipeline:*)
----
-
-Put this lane on the 16-node `ship-feature` template first, so the dashboard
-renders the right node count from the first stage rather than after the skill
-self-corrects:
-
-!`agenthub lanes pipeline ship-feature`
-
-Then run the pipeline **in this session** by invoking `/agenthub:ship-feature-lane`
-with this requirement:
-
-$ARGUMENTS
-
-- No requirement given → ask for one. Never guess what to build.
-- The switch above failed (no lane owns this directory) → say so and stop; the
-  skill has no lane to report stages against.
-
-This is the in-session twin of `agenthub ship-full "<requirement>"`, which does the
-same two steps from a terminal by spawning its own `claude`.

plugins/agenthub/commands/ship-quick.md

@@ -1,23 +0,0 @@
----
-description: Run the 8-stage in-repo pipeline (plan → implement → tests → review → gate → ship). No PR, no browser QC
-argument-hint: <requirement>
-allowed-tools: Bash(agenthub lanes pipeline:*)
----
-
-Put this lane on the 8-node `default` template first, so the dashboard renders
-the right node count from the first stage:
-
-!`agenthub lanes pipeline default`
-
-Then run the pipeline **in this session** by invoking `/agenthub:ship-feature` with
-this requirement:
-
-$ARGUMENTS
-
-- No requirement given → ask for one. Never guess what to build.
-- The switch above failed (no lane owns this directory) → say so and stop; the
-  skill has no lane to report stages against.
-
-This is the in-session twin of `agenthub ship-quick "<requirement>"`. It stops at
-review/gate: no PR is opened and no browser QC runs — use `/ship-full` when the
-work should reach reviewers.

plugins/agenthub/commands/tests.md

@@ -1,23 +0,0 @@
----
-description: Tests / pre-push CI gates
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `tests` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node tests $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

plugins/agenthub/commands/watching-pr.md

@@ -1,23 +0,0 @@
----
-description: Watch the PR / CI (ship-feature only)
-argument-hint: [extra prompt words]
-allowed-tools: Bash(agenthub lanes node:*)
----
-
-The command this lane pipeline template declares for its `watching-pr` node, resolved
-against whichever template the lane is actually on (matched by id or alias):
-
-!`agenthub lanes node watching-pr $ARGUMENTS --print`
-
-Run that here, in THIS session - never start a nested `claude` process:
-
-- Line reads `cd <dir> && "claude" "<slash command>"` -> invoke that slash
-  command yourself, passing any extra words as its argument.
-- Anything else is a shell argv -> run it with Bash from `<dir>`.
-- Line is an error (`no node ...`, `declares no command`, no lane owns this
-  directory) -> print it verbatim and stop. Do not guess a substitute.
-
-Do NOT call `agenthub stage` afterwards: a command running is not proof the node
-passed. Declare the stage when the work is actually done. (The exception is a
-node whose command already IS `agenthub stage <id>` - there the declaration is the
-whole step.)

scripts/cc-update-all-helper.js

@@ -165,7 +165,7 @@ function reloadPanes() {
     try {
       paneCmd = execFileSync(
         "tmux",
-        ["display-message", "-p", "-t", name, "#{pane_current_command}"],
+        ["display-message", "-p", "-t", `=${name}:`, "#{pane_current_command}"],
         { encoding: "utf8", timeout: 15_000, stdio: ["ignore", "pipe", "pipe"] }
       ).trim();
     } catch {
@@ -184,8 +184,8 @@ function reloadPanes() {
         // detached and serves no requests.
         if (!first) execFileSync("sleep", ["1"], { timeout: 15_000 });
         first = false;
-        execFileSync("tmux", ["send-keys", "-t", name, "-l", command], { timeout: 15_000 });
-        execFileSync("tmux", ["send-keys", "-t", name, "Enter"], { timeout: 15_000 });
+        execFileSync("tmux", ["send-keys", "-t", `=${name}:`, "-l", command], { timeout: 15_000 });
+        execFileSync("tmux", ["send-keys", "-t", `=${name}:`, "Enter"], { timeout: 15_000 });
       }
       reloaded.push(name);
     } catch {

scripts/launchd-service.js

@@ -0,0 +1,241 @@
+#!/usr/bin/env node
+/**
+ * @file launchd-service.js
+ * @description The macOS twin of `systemd-service.js`: a per-user LaunchAgent
+ * (`~/Library/LaunchAgents/io.smartgift.<name>.plist`) that starts the AgentHub
+ * dashboard at login and keeps it running, without Claude Code being opened
+ * first. Same exports and the same return values as the systemd module, so
+ * `service-manager.js` can hand either one to the bootstrap, the CLI and the
+ * doctor. Every `launchctl` call goes through one seam (`__setExecImpl`) so
+ * tests never touch a real launchd.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+const MARKER = "<!-- agenthub-managed-unit — regenerated on install, do not edit by hand -->";
+
+const kind = "launchd";
+const label = "LaunchAgent";
+
+function jobLabel(name) {
+  return `io.smartgift.${name}`;
+}
+
+function unitPath(name) {
+  return path.join(os.homedir(), "Library", "LaunchAgents", `${jobLabel(name)}.plist`);
+}
+
+function logPath() {
+  return path.join(os.homedir(), "Library", "Logs", "agenthub.log");
+}
+
+function domain() {
+  return `gui/${process.getuid()}`;
+}
+
+let execImpl = (args, opts) => spawnSync("launchctl", args, opts);
+
+function __setExecImpl(fn) {
+  execImpl = fn;
+}
+function __reset() {
+  execImpl = (args, opts) => spawnSync("launchctl", args, opts);
+}
+
+function launchctl(args) {
+  return execImpl(args, { encoding: "utf8", stdio: "pipe" });
+}
+
+/**
+ * A LaunchAgent lives in the user's GUI domain, which exists only while that
+ * user is logged in at the console. Over a bare SSH login there is none, and
+ * the caller falls back to its detached spawn.
+ */
+function systemctlAvailable() {
+  if (process.platform !== "darwin") return false;
+  return launchctl(["print", domain()]).status === 0;
+}
+
+function readPlist(name) {
+  try {
+    return fs.readFileSync(unitPath(name), "utf8");
+  } catch {
+    return null;
+  }
+}
+
+function unitIsOurs(name) {
+  const body = readPlist(name);
+  return !!body && body.includes(MARKER);
+}
+
+const xmlEscape = (s) =>
+  String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+const xmlUnescape = (s) => s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+
+function workingDirOf(body) {
+  const m = body.match(/<key>WorkingDirectory<\/key>\s*<string>([^<]*)<\/string>/);
+  return m ? xmlUnescape(m[1]) : null;
+}
+
+/** Same contract as the systemd twin: pure fs, never a foreign plist. */
+function unitIsStale(name, root) {
+  const body = readPlist(name);
+  if (!body || !body.includes(MARKER)) return false;
+  return workingDirOf(body) !== root;
+}
+
+/** The directory the plist runs from — ours or not (the cache pruner's guard). */
+function unitRoot(name) {
+  const body = readPlist(name);
+  return body ? workingDirOf(body) : null;
+}
+
+function isLoaded(name) {
+  return launchctl(["print", `${domain()}/${jobLabel(name)}`]).status === 0;
+}
+
+function unitIsActive(name) {
+  if (!systemctlAvailable()) return false;
+  const res = launchctl(["print", `${domain()}/${jobLabel(name)}`]);
+  return res.status === 0 && /^\s*state = running$/m.test(String(res.stdout || ""));
+}
+
+/**
+ * `argv` is the program and its arguments as separate strings (the systemd
+ * twin's `execStart` is one line; a path with a space would split here).
+ * `KeepAlive` true is `Restart=always`. `AbandonProcessGroup` keeps the lane
+ * panes alive: they run in a tmux server the dashboard spawned, and launchd
+ * otherwise kills a stopped job's whole process group — every running agent
+ * with it, on every update.
+ */
+function unitContent({ name, workingDir, argv, env }) {
+  const str = (v) => `<string>${xmlEscape(v)}</string>`;
+  const envLines = Object.entries(env)
+    .map(([k, v]) => `\t\t<key>${xmlEscape(k)}</key>\n\t\t${str(v)}`)
+    .join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+${MARKER}
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	${str(jobLabel(name))}
+	<key>ProgramArguments</key>
+	<array>
+${argv.map((a) => `\t\t${str(a)}`).join("\n")}
+	</array>
+	<key>WorkingDirectory</key>
+	${str(workingDir)}
+	<key>EnvironmentVariables</key>
+	<dict>
+${envLines}
+	</dict>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<true/>
+	<key>ThrottleInterval</key>
+	<integer>3</integer>
+	<key>AbandonProcessGroup</key>
+	<true/>
+	<key>StandardOutPath</key>
+	${str(logPath())}
+	<key>StandardErrorPath</key>
+	${str(logPath())}
+</dict>
+</plist>
+`;
+}
+
+/**
+ * Writes the plist and clears any "disabled" override — and starts nothing.
+ * A loaded job keeps running its OLD definition until `restartUserService`;
+ * an unloaded one is picked up at the next login. Same split, same reason, as
+ * the systemd twin.
+ *
+ * @returns {"written"|"unchanged"|"foreign"|"unavailable"|"failed"}
+ */
+function writeUserService({ name, workingDir, argv, env = {} }) {
+  if (!systemctlAvailable()) return "unavailable";
+  const body = unitContent({ name, workingDir, argv, env });
+  const target = unitPath(name);
+  try {
+    const current = readPlist(name);
+    if (current !== null) {
+      if (!current.includes(MARKER)) return "foreign";
+      if (current === body) return "unchanged";
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.mkdirSync(path.dirname(logPath()), { recursive: true });
+    fs.writeFileSync(target, body, "utf8");
+    launchctl(["enable", `${domain()}/${jobLabel(name)}`]);
+    return "written";
+  } catch {
+    return "failed";
+  }
+}
+
+/**
+ * Reload the job from its plist. `kickstart -k` would restart the process but
+ * keep the definition launchd already holds — the old plugin root — so it is
+ * bootout + bootstrap. Unlike systemd, the caller is not reaped with the job:
+ * it runs in its own process group and the job abandons its group anyway.
+ */
+function restartUserService(name) {
+  if (!systemctlAvailable()) return "unavailable";
+  launchctl(["bootout", `${domain()}/${jobLabel(name)}`]); // not loaded: fine
+  const res = launchctl(["bootstrap", domain(), unitPath(name)]);
+  return res.status === 0 ? "restarted" : "failed";
+}
+
+/** Write, then load and start. For `agenthub service install` and a bootstrap
+ *  that owns no running job. */
+function installUserService(opts) {
+  const result = writeUserService(opts);
+  if (result === "written" || (result === "unchanged" && !isLoaded(opts.name))) {
+    if (restartUserService(opts.name) !== "restarted") return "failed";
+  } else if (result === "unchanged") {
+    launchctl(["kickstart", `${domain()}/${jobLabel(opts.name)}`]); // start if stopped
+  }
+  return result;
+}
+
+/** @returns {"removed"|"absent"|"foreign"|"unavailable"} */
+function uninstallUserService(name) {
+  if (!systemctlAvailable()) return "unavailable";
+  const body = readPlist(name);
+  if (body === null) return "absent";
+  if (!body.includes(MARKER)) return "foreign";
+  launchctl(["bootout", `${domain()}/${jobLabel(name)}`]);
+  fs.rmSync(unitPath(name), { force: true });
+  return "removed";
+}
+
+/** A LaunchAgent starts at login by definition; there is no linger to grant. */
+function enableLinger() {
+  return true;
+}
+
+module.exports = {
+  kind,
+  label,
+  systemctlAvailable,
+  unitIsOurs,
+  unitIsStale,
+  unitRoot,
+  unitIsActive,
+  writeUserService,
+  restartUserService,
+  installUserService,
+  uninstallUserService,
+  enableLinger,
+  unitPath,
+  logPath,
+  __setExecImpl,
+  __reset,
+};

scripts/plugin-bootstrap.js

@@ -9,7 +9,8 @@
  * The worker installs runtime dependencies, removes hook entries left behind by
  * an older `npm run install-hooks` (they would double-count every event), puts
  * the `agenthub` CLI on PATH, and starts the dashboard server — as a systemd
- * `--user` service when available (see `systemd-service.js`), so it survives
+ * `--user` service or a macOS LaunchAgent when available (see
+ * `service-manager.js`), so it survives
  * reboots without Claude Code being opened first; otherwise a detached spawn
  * scoped to this session, same as before.
  *
@@ -160,16 +161,12 @@ function fastPathOk(rt = runtimeDir()) {
   if (state.pluginRoot !== PLUGIN_ROOT) return false;
   if (state.depsHash !== depsHash()) return false;
   if (!fs.existsSync(path.join(rt, "node_modules"))) return false;
-  // A machine can be fully set up and still be missing the plugins the
-  // pipelines drive. Reading one recorded flag keeps this hot path cheap — the
-  // actual check (manifest + every user SKILL.md) runs once, in the worker.
-  if (!state.skillPluginsSettled) return false;
   // A live server says nothing about whether it will come back. When our unit
   // still names a previous plugin cache directory, everything looks healthy
   // until the next reboot — and then the dashboard is simply gone, from a path
   // Claude Code deleted long ago. Reading one file is cheap enough for a hot
   // path; `unitIsStale` deliberately spawns nothing.
-  if (require("./systemd-service").unitIsStale("agenthub", PLUGIN_ROOT)) return false;
+  if (require("./service-manager").unitIsStale("agenthub", PLUGIN_ROOT)) return false;
   // Leftover checkout hooks are the one defect that corrupts the DATA rather
   // than the install: events carry no id, so a second handler doubles every
   // event, every subagent row and every turn. `stripLegacyHooks` removes them —
@@ -359,13 +356,15 @@ function cliDir() {
  *
  * @returns {"written"|"exists"|"foreign"|"failed"}
  */
-function linkCli(dir = cliDir(), root = PLUGIN_ROOT) {
+function linkCli(dir = cliDir(), root = PLUGIN_ROOT, nodePath = process.execPath) {
   const marker = "# agenthub-plugin-launcher";
   const target = path.join(dir, process.platform === "win32" ? "agenthub.cmd" : "agenthub");
   const body =
     process.platform === "win32"
       ? `@rem agenthub-plugin-launcher\r\n@node "${path.join(root, "bin", "agenthub.js")}" %*\r\n`
-      : `#!/bin/sh\n${marker}\nexec "${process.execPath}" "${path.join(root, "bin", "agenthub.js")}" "$@"\n`;
+      : // The pinned node is a versioned path (Homebrew Cellar, nvm) that an
+        // upgrade deletes; fall back to whatever `node` PATH has then.
+        `#!/bin/sh\n${marker}\nN="${nodePath}"; [ -x "$N" ] || N=node\nexec "$N" "${path.join(root, "bin", "agenthub.js")}" "$@"\n`;
   try {
     if (fs.existsSync(target)) {
       const current = fs.readFileSync(target, "utf8");
@@ -419,7 +418,13 @@ function liveServers() {
   try {
     const parsed = JSON.parse(fs.readFileSync(getServerInfoPath(), "utf8"));
     const servers = Array.isArray(parsed.servers) ? parsed.servers : [parsed];
-    return servers.filter((s) => s && isPidAlive(s.pid));
+    // An entry older than this boot is a leftover whose pid may now belong to
+    // an unrelated process (macOS has no systemd to clean up after a reboot).
+    // 60 s margin for clock skew; an unparseable startedAt is kept.
+    // ponytail: an NTP step larger than 60 s after boot misreads a live entry
+    // as stale; compare against a monotonic boot id if that ever bites.
+    const bootedAt = Date.now() - os.uptime() * 1000 - 60_000;
+    return servers.filter((s) => s && isPidAlive(s.pid) && !(Date.parse(s.startedAt) < bootedAt));
   } catch {
     return [];
   }
@@ -491,46 +496,6 @@ function log(rt, line) {
   }
 }
 
-/**
- * Install the plugins AgentHub's pipelines drive but this machine cannot resolve —
- * today `superpowers`, which `/agenthub:ship-feature(-lane)` calls step by step. A
- * fresh `agenthub` install otherwise runs those skills partway and fails at the
- * first call with no warning beforehand.
- *
- * Off by setting `AGENTHUB_AUTO_INSTALL_PLUGINS` to `0`, `false` or `off`; that
- * leaves `/agenthub-doctor`'s WARN row as the only notice, which is the right
- * behaviour for anyone who wants to choose their own plugins.
- *
- * One-shot: the outcome is recorded in the runtime state and the fast path
- * takes it into account, so a machine with no network does not re-attempt a
- * clone on every session. `/agenthub-update` (`--force`) retries.
- *
- * Best-effort throughout. Nothing here may throw or block: the dashboard,
- * hooks and CLI all work without these plugins.
- *
- * @returns {"off"|"nothing-missing"|"installed"|"failed"|"error"} or the previously
- *   recorded outcome when this run had nothing to settle.
- */
-function autoInstallSkillPlugins(rt, { force = false } = {}) {
-  const flag = process.env.AGENTHUB_AUTO_INSTALL_PLUGINS;
-  if (flag === "0" || flag === "false" || flag === "off") return "off";
-  // Return the PREVIOUS outcome, not a marker: writeState records whatever this
-  // returns, and overwriting "installed" with "already-settled" would lose the
-  // only record of what actually happened.
-  const settled = readState(rt)?.skillPluginsSettled;
-  if (!force && settled) return settled;
-
-  try {
-    const { autoInstallSkillPlugins: install } = require("../server/lib/skill-plugins");
-    const summary = install((line) => log(rt, line));
-    if (!summary.attempted.length) return "nothing-missing";
-    return summary.failed.length ? "failed" : "installed";
-  } catch (err) {
-    log(rt, `skill-plugin auto-install skipped: ${err.message}`);
-    return "error";
-  }
-}
-
 /* ------------------------------------------------------ plugin-cache pruning */
 
 /** How many retired builds to leave behind, newest first, as a rollback cushion. */
@@ -583,7 +548,7 @@ function pruneRetiredPluginRoots(rt, root = PLUGIN_ROOT) {
     /* no record to read — the other three protections still apply */
   }
   try {
-    const unitRoot = require("./systemd-service").unitRoot("agenthub");
+    const unitRoot = require("./service-manager").unitRoot("agenthub");
     if (unitRoot) keep.add(path.resolve(unitRoot));
   } catch {
     /* best effort */
@@ -716,7 +681,7 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
       log(rt, "built the dashboard UI bundle");
     }
 
-    const svc = require("./systemd-service");
+    const svc = require("./service-manager");
     // Who owns the running server decides how it may be retired. A unit of
     // ours means systemd owns it — and this process is a descendant of that
     // server, so it sits in the unit's cgroup. SIGTERM-ing the main process
@@ -755,6 +720,7 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
         description: "AgentHub dashboard server (Claude Code plugin)",
         workingDir: PLUGIN_ROOT,
         execStart: `${process.execPath} ${path.join(PLUGIN_ROOT, "server", "index.js")}`,
+        argv: [process.execPath, path.join(PLUGIN_ROOT, "server", "index.js")],
         env: {
           NODE_ENV: "production",
           NODE_PATH: path.join(rt, "node_modules"),
@@ -784,13 +750,14 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
         log(
           rt,
           result === "unchanged"
-            ? "systemd --user service already up to date"
+            ? `${svc.label} already up to date`
             : unitStale && !needsServer
-              ? "repointed the systemd --user service at the current plugin version (it named a retired one)"
-              : "installed a systemd --user service — the dashboard now survives reboots without Claude Code"
+              ? `repointed the ${svc.label} at the current plugin version (it named a retired one)`
+              : `installed a ${svc.label} — the dashboard now survives reboots without Claude Code`
         );
       } else if (needsServer) {
-        // No systemd (macOS/Windows/WSL without it), or the unit exists but
+        // No service manager (Windows, WSL without systemd, a Mac over SSH with
+        // no GUI login), or the unit exists but
         // wasn't ours to touch — same detached-spawn fallback as before,
         // scoped to this session only. Guarded by `needsServer`: entering this
         // block for a stale unit alone must never spawn a second server onto
@@ -798,26 +765,17 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
         const pid = startDashboard(rt);
         log(
           rt,
-          `started the dashboard server (pid ${pid})${result === "foreign" ? " — a foreign systemd unit named 'agenthub' already exists" : ""}`
+          `started the dashboard server (pid ${pid})${result === "foreign" ? ` — a foreign ${svc.label} named 'agenthub' already exists` : ""}`
         );
       }
     }
 
-    // Last, and deliberately so: it clones from the network, and nothing above
-    // may wait on it. Runs here rather than in the foreground pass because this
-    // whole function is already detached from the 10 s SessionStart hook.
-    const skillPlugins = autoInstallSkillPlugins(rt, { force });
-
     writeState(
       {
         pluginVersion: pluginVersion(),
         depsHash: wantDeps,
         pluginRoot: PLUGIN_ROOT,
         claudeHome: getClaudeHome(),
-        // Settles the fast path: whatever the outcome, the next SessionStart
-        // must not spawn a worker just to retry a network clone. Cleared by
-        // `/agenthub-update` (force), which is the retry.
-        skillPluginsSettled: skillPlugins,
         updatedAt: new Date().toISOString(),
       },
       rt
@@ -835,8 +793,17 @@ function bootstrap(rt = runtimeDir(), { force = false } = {}) {
     // file is written and the lock is gone, so even being killed here leaves
     // no debris and no half-recorded bootstrap.
     if (pendingSystemdRestart) {
-      log(rt, "handing the server over to systemd (restarting the unit)");
-      require("./systemd-service").restartUserService("agenthub");
+      const svc = require("./service-manager");
+      log(rt, `handing the server over to ${svc.kind} (restarting the unit)`);
+      // On launchd the restart is bootout + bootstrap, and a failed bootstrap
+      // leaves NOTHING running (systemd's restart either happens or leaves the
+      // old server up). This process survives it there, so fall back.
+      if (svc.restartUserService("agenthub") === "failed" && !serverIsLive()) {
+        log(
+          rt,
+          `${svc.kind} could not start the server — started it detached (pid ${startDashboard(rt)})`
+        );
+      }
     }
   }
 }
@@ -910,6 +877,5 @@ module.exports = {
   livePids,
   stopDashboard,
   startDashboard,
-  autoInstallSkillPlugins,
   bootstrap,
 };

scripts/plugin-doctor.js

@@ -6,10 +6,8 @@
  * declared package, not just that node_modules exists), server liveness,
  * duplicate hook entries (the one failure that silently doubles every token and
  * cost figure), the `agenthub` CLI launcher and its PATH, the `tmux` binary
- * every browser-started run depends on, whether the slash
- * commands the pipeline templates name as node drivers are actually resolvable
- * (the `superpowers` plugin, today), and the dashboard bundle — quoting the last
- * build error when it is missing.
+ * every browser-started run depends on, and the dashboard bundle — quoting the
+ * last build error when it is missing.
  * Read-only — it diagnoses, it never repairs.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
@@ -85,7 +83,6 @@ function diagnose() {
   add(...cliStatus());
   add(...systemdStatus());
   add(...tmuxStatus());
-  add(...skillPluginStatus());
 
   add(...dashboardUiStatus(rt));
 
@@ -190,37 +187,6 @@ function lastBuildError(logPath) {
   return hit ? hit.trim().slice(0, 200) : null;
 }
 
-/**
- * WARN (never FAIL) when a plugin the pipelines depend on cannot be resolved:
- * the dashboard, hooks and CLI all work without it — only the pipeline
- * skills that drive it stop partway, so this must not fail a doctor run.
- *
- * The requirement derivation and the missing/satisfied rules live in
- * `server/lib/skill-plugins.js`, shared with the bootstrap that installs them.
- */
-function skillPluginStatus() {
-  const skillPlugins = require("../server/lib/skill-plugins");
-  const required = skillPlugins.requiredSkillPlugins();
-  if (!required.size) return ["ok", "Skill plugins", "no pipeline names an external plugin"];
-
-  let missing;
-  try {
-    missing = skillPlugins.missingSkillPlugins();
-  } catch {
-    return ["warn", "Skill plugins", "could not read the installed-plugin manifest"];
-  }
-  if (!missing.length) {
-    return ["ok", "Skill plugins", `${[...required.keys()].sort().join(", ")} available`];
-  }
-  return [
-    "warn",
-    "Skill plugins",
-    `${missing.map((m) => `${m.name} (needed for ${m.skills.join(", ")})`).join("; ")} — ` +
-      `the pipelines name these commands; install with ` +
-      `claude plugin install ${missing.map((m) => m.autoInstall?.spec || m.name).join(" ")}`,
-  ];
-}
-
 /**
  * The failure this row exists for is silent by construction: a unit still
  * naming a retired plugin cache directory keeps a running dashboard looking
@@ -233,16 +199,17 @@ function skillPluginStatus() {
  * about.
  */
 function systemdStatus() {
-  const svc = require("./systemd-service");
+  const svc = require("./service-manager");
   const unit = svc.unitPath("agenthub");
+  const row = svc.kind;
 
   if (!svc.unitIsOurs("agenthub")) {
     if (fs.existsSync(unit)) {
-      return ["warn", "systemd", `${unit} exists but was not written by AgentHub — left untouched`];
+      return ["warn", row, `${unit} exists but was not written by AgentHub — left untouched`];
     }
     return [
       "ok",
-      "systemd",
+      row,
       svc.systemctlAvailable()
         ? "no unit — the server is started per session (install one with `agenthub service install`)"
         : "not available on this platform — the server is started per session",
@@ -252,7 +219,7 @@ function systemdStatus() {
   if (svc.unitIsStale("agenthub", PLUGIN_ROOT)) {
     return [
       "warn",
-      "systemd",
+      row,
       `${unit} still points at a previous plugin version — the dashboard will NOT come back after a reboot. ` +
         `Starting a new Claude Code session repairs it; or run: node ${path.join(PLUGIN_ROOT, "scripts", "plugin-bootstrap.js")} --force`,
     ];
@@ -261,19 +228,21 @@ function systemdStatus() {
   if (!svc.unitIsActive("agenthub")) {
     return [
       "warn",
-      "systemd",
-      "unit is installed and current but not running — start it with `systemctl --user start agenthub`",
+      row,
+      svc.kind === "launchd"
+        ? "LaunchAgent is installed and current but not running — start it with `agenthub service install`"
+        : "unit is installed and current but not running — start it with `systemctl --user start agenthub`",
     ];
   }
-  return ["ok", "systemd", "unit is current and running — the dashboard survives reboots"];
+  return ["ok", row, `${svc.label} is current and running — the dashboard survives reboots`];
 }
 
 /**
  * WARN (never FAIL) when `tmux` is absent: every run the dashboard starts is a
  * tmux session (`server/lib/tmux.js`), so without the binary the run console,
  * `agenthub lanes shell` and the session-reload keystrokes all fail — while
- * sessions, analytics, lanes and the CLI keep working. Same reasoning as the
- * skill-plugins row: a partial feature loss must not fail a doctor run.
+ * sessions, analytics, lanes and the CLI keep working. A partial feature
+ * loss must not fail a doctor run.
  *
  * This checks the doctor's own PATH. A server started as a systemd `--user`
  * service can still see a different one — `GET /api/run/tmux` is the server's
@@ -316,7 +285,9 @@ function cliStatus() {
     : [
         "warn",
         "agenthub CLI",
-        `${file} exists but ${dir} is not on PATH — add: export PATH="${dir}:$PATH"`,
+        `${file} exists but ${dir} is not on PATH — add${
+          process.platform === "darwin" ? " to ~/.zshrc" : ""
+        }: export PATH="${dir}:$PATH"`,
       ];
 }
 

scripts/service-manager.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+/**
+ * @file service-manager.js
+ * @description Picks the per-user service manager that keeps the dashboard
+ * running without Claude Code: a LaunchAgent on macOS (`launchd-service.js`),
+ * a systemd `--user` unit everywhere else (`systemd-service.js`, which reports
+ * itself unavailable off Linux). Both export the same API.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+module.exports =
+  process.platform === "darwin" ? require("./launchd-service") : require("./systemd-service");

scripts/systemd-service.js

@@ -224,6 +224,8 @@ function enableLinger() {
 }
 
 module.exports = {
+  kind: "systemd",
+  label: "systemd --user service",
   systemctlAvailable,
   unitIsOurs,
   unitIsStale,

scripts/test-server.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * @file test-server.js
+ * @description Runs the server test suite against a PRIVATE tmux server.
+ * Several suites start real `agenthub-lane-<id>` tmux sessions and then kill
+ * or reset them, with lane ids from their own throwaway database — on the
+ * user's default tmux server those names collide with the dashboard's real
+ * lane panes, and a test run kills whichever live session shares an id
+ * (including the pane the test was launched from). Dropping `TMUX` and
+ * pointing `TMUX_TMPDIR` at a fresh directory gives every tmux call — the
+ * app's own and the tests' direct `execFileSync("tmux", …)` — its own socket.
+ * It also points `DASHBOARD_PIPELINES_DIR` at `server/__tests__/fixtures/
+ * pipelines/`: AgentHub ships no pipeline template any more, and the two old
+ * ones kept there are what the dormant stage/detection code is tested against.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const root = path.join(__dirname, "..");
+const dir = path.join(root, "server", "__tests__");
+const files = fs
+  .readdirSync(dir)
+  .filter((f) => f.endsWith(".test.js"))
+  .map((f) => path.join(dir, f));
+const args = process.argv.slice(2);
+
+const tmuxDir = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-test-tmux-"));
+const env = {
+  ...process.env,
+  TMUX_TMPDIR: tmuxDir,
+  DASHBOARD_PIPELINES_DIR: path.join(dir, "fixtures", "pipelines"),
+};
+delete env.TMUX;
+delete env.TMUX_PANE;
+
+const result = spawnSync(process.execPath, ["--test", ...args, ...(args.length ? [] : files)], {
+  stdio: "inherit",
+  env,
+  cwd: root,
+});
+
+// Whatever a test leaked dies with the private server, never a real pane.
+spawnSync("tmux", ["kill-server"], { env, stdio: "ignore" });
+fs.rmSync(tmuxDir, { recursive: true, force: true });
+process.exit(result.status ?? 1);

server/README.md

@@ -524,14 +524,18 @@ Request body shape:
 | `POST` | `/api/lanes/:id/down` | Same-origin guarded stack teardown: recorded pid trees, then a port backstop only when a pid file existed. |
 | `POST` | `/api/lanes/:id/hook/:name` | Same-origin guarded profile-hook run; `:name` must be in the fixed hook allowlist and `args` is passed as argv. Returns `202`. |
 | `GET` | `/api/lanes/:id/logs/:svc` | Tail a hook or service log, `realpath`-confined to the lane's log directory. |
-| `GET` | `/api/lanes/:id/git` | Working-copy facts: branch, head, subject, uncommitted counts and files, plus `hasRemote`/`upstream`/`ahead`/`behind` (null counts when the branch has no upstream). `{available:false}` with `200` for a cwd git cannot read. |
+| `GET` | `/api/lanes/:id/git` | Working-copy facts: branch, head, subject, uncommitted counts and files, plus `hasRemote`/`upstream`/`ahead`/`behind` (null counts when the branch has no upstream), and `unborn` (`true` with `head: null` in a repo with no commit yet). `{available:false}` with `200` for a cwd git cannot read. |
 | `GET` | `/api/lanes/:id/git/changes?range=work\|branch\|commit[&sha=][&path=][&full=1][&context=]` | The lane's code changes for the Changes panel: a file summary, one file's hunks (`path`), or every file's hunks (`full=1`); `range=commit&sha=` is one commit, `context=` (default 3, max 5000) widens each hunk. Capped at 300 files / 200 KB per file / 1 MB per full read. `400 ENOBASE`, `ENOFILECHANGE`, `EBADRANGE` or `EBADREV`. |
 | `GET` | `/api/lanes/:id/git/log?limit=&file=` | The lane's recent commits (newest first, limit max 200), optionally only those touching one path. |
 | `GET` | `/api/lanes/:id/git/file?path=&rev=` | One file's whole content at `work` (realpath-confined to the lane), `HEAD` or a commit-ish. 1 MB cap. `400 EBADPATH`/`EBADREV`/`ENOFILE`. |
+| `PUT` | `/api/lanes/:id/git/file` | Same-origin guarded save from the whole-file editor: `{path, content, baseSha}`. An existing text file within the 1 MB cap, over exactly the version opened (`baseSha` = the read's `sha`, else `409 ESTALE`); `403 ESECRET`, `400 EBADPATH`/`ENOFILE`/`EBADCONTENT`/`ETOOBIG`/`EBINARY`. |
 | `GET` | `/api/lanes/:id/git/ls?q=` | Tracked paths matching a substring, for quick-open. `git ls-files`, so ignored files never appear. Capped at 500. |
-| `GET` | `/api/lanes/:id/git/tree?path=` | One directory level of tracked files, folded. `400 EBADPATH` for a path escaping the lane. |
+| `GET` | `/api/lanes/:id/git/tree?path=` | One directory level of tracked + untracked-not-ignored files, folded; changed files carry their porcelain `status`, folders holding one `changed: true`. `400 EBADPATH` for a path escaping the lane. |
 | `GET` | `/api/lanes/:id/git/branches` | The lane repo's own local branches + worktrees, for the branch switcher. The repo comes from the lane row, never the query. |
-| `POST` | `/api/lanes/:id/git/:action` | Same-origin guarded git write, serialized under the lane lock: `fetch`, `pull` (always `--ff-only`), `push` (`-u origin HEAD`), `stage`/`unstage`/`discard` (per file; a path must be one git reports changed, and `discard` needs `confirm:true`), `commit` (`add -A` + `-m`, or `only:"staged"`), `switch` (refuses a dirty tree), `branch-create` (never switches) and `branch-delete` (`-d`, refuses protected/current/busy branches). No merge/rebase/reset/stash by design. |
+| `GET` | `/api/git-credentials` | AgentHub's own git logins (one per host, shared by every user), `hasToken` only — never a password. |
+| `POST` | `/api/git-credentials` | Same-origin guarded save/replace: `{protocol, host, username, password}`. `400 EBADHOST`/`EBADCRED`. |
+| `DELETE` | `/api/git-credentials/:protocol/:host` | Same-origin guarded delete. `404 ENOTFOUND`. |
+| `POST` | `/api/lanes/:id/git/:action` | Same-origin guarded git write, serialized under the lane lock: `fetch`, `pull` (always `--ff-only`), `push` (`-u origin HEAD`), `stage`/`unstage`/`discard` (per file; a path must be one git reports changed, and `discard` needs `confirm:true`), `stage-hunk`/`discard-hunk` (one hunk by its `@@` line, re-read fresh — `409 EHUNKGONE` when it moved; `discard-hunk` needs `confirm:true`), `commit` (`add -A` + `-m`, or `only:"staged"`), `switch` (refuses a dirty tree), `branch-create` (never switches) `branch-delete` (`-d`, refuses protected/current/busy branches) and `publish` (`{url}`: `remote add origin` + `push -u origin HEAD`, only when the repo has no remote; URL allowlisted to https-without-userinfo/ssh/scp-like; remote rolled back on a failed push). `merge` (clean tree, repo-root lane, a ref that exists; conflicts come back as `conflicts[]`), `resolve` (`side: ours|theirs|done`, conflicted paths only, `done` refuses leftover markers), `merge-commit`, `merge-abort` (`confirm:true`); `EMERGING` blocks pull/switch/merge/hunk actions mid-merge. No rebase/reset/stash by design. A remote wanting a login is `409 EGITAUTH` with `auth: {protocol, host, username, rejected}`; resend with `credentials: {protocol, host, username, password, remember}` (a repo remote's host only, else `400 EBADHOST`; saved only after git succeeds and `remember` is set). |
 
 The route accepts `{ sourceRepo, title, base?, slug? }`. `sourceRepo` must be
 an existing absolute git repository. The response lane starts as
@@ -580,30 +584,12 @@ pipeline's last node, where the pipeline is finished and a later detection is
 new work — and, the one rule that matters, never counts as evidence and never
 renders a node as `done` (see `docs/LANES.md#stage-detection`).
 
-A `codex` lane has no hooks to read, so `server/lib/codex-ingest.js` feeds the
-same matcher from Codex's own rollout journals under
-`$CODEX_HOME/sessions/**/rollout-*.jsonl`, polled every
-`DASHBOARD_CODEX_POLL_MS` ms (default 15000, `0` disables) and mapping Codex's
-tool calls onto the `{tool_name, tool_input}` shape a hook delivers. The same
-pass mirrors that lane's `status` between `idle` and `running` from the
-journal's mtime, under the guard hook ingestion uses (no `run_id`, only from
-`idle`/`running`); it writes nothing else.
-
-Getting a codex lane's *declared* stage to actually happen is a separate
-problem — only the session itself can call `agenthub stage`, and unlike a Claude
-lane it has no slash command to pre-fill — and the run console pre-fills
-nothing into the prompt box any more, for either tool, since anything sitting
-there is sent as a real prompt on start. What is left is
-`server/lib/codex-nudge.js`'s `sweepCodexNudges()` runs on an unref'd 60s
-interval (`DASHBOARD_CODEX_NUDGE_MS`, `0` disables): when a codex lane's fresh
-`detected_stage` has sat ahead of its declared `stage` for at least two
-minutes, it types a one-line `[agenthub] ... run: agenthub stage ...` reminder into
-the lane's live tmux pane via `tmux.sendText` — skipped if the pane sits at a
-bare shell prompt (`pty-run.js`'s `SHELL_COMMANDS`), since pressing Enter there
-would run the reminder as a shell command instead of submitting it to Codex.
-It never writes `stage` or `detected_stage`, so declared-wins and
-inferred-never-`done` are untouched; any resulting declaration is still the
-codex session's own real `agenthub stage` call.
+A `codex` lane has no hooks to read and carries no pipeline, so nothing detects
+or advances its stage. `server/lib/codex-ingest.js` only mirrors its `status`
+between `idle` and `running` from the mtime of Codex's own rollout journals
+under `$CODEX_HOME/sessions/**/rollout-*.jsonl`, polled every
+`DASHBOARD_CODEX_POLL_MS` ms (default 15000, `0` disables), under the guard hook
+ingestion uses (no `run_id`, only from `idle`/`running`); it writes nothing else.
 
 ### Remote Data Sources
 
@@ -693,7 +679,7 @@ Reads — and carefully gated mutations for low-risk text-file artifacts — for
 
 ### Run a lane's CLI (`/api/run`)
 
-HTTP surface for the tmux-backed terminal run: one session per lane, named `agenthub-lane-<laneId>`, running the CLI that lane declares (`claude` or `codex`). There is no in-memory handle map — every read is computed from `tmux list-sessions`, so a session killed out-of-band self-corrects on the next call. Every route enforces a same-origin / loopback-Origin guard against browser CSRF.
+HTTP surface for the tmux-backed terminal run: one session per lane, named `agenthub-lane-<laneId>`, running the CLI that lane declares (`claude`, `codex`, or `agy` for an `antigravity` lane). There is no in-memory handle map — every read is computed from `tmux list-sessions`, so a session killed out-of-band self-corrects on the next call. Every route enforces a same-origin / loopback-Origin guard against browser CSRF.
 
 | Method   | Path                          | Description |
 | -------- | ----------------------------- | ----------- |
@@ -702,6 +688,7 @@ HTTP surface for the tmux-backed terminal run: one session per lane, named `agen
 | `GET`    | `/api/run/binary[?tool=]`     | Probe whether the CLI is on `PATH`. `?tool=codex` probes Codex; omitted or `?tool=claude` probes Claude; anything else is `400 EBADTOOL`. Returns `{ found, path }` |
 | `GET`    | `/api/run/tmux`               | `{ available }` — whether the `tmux` binary exists |
 | `GET`    | `/api/run/cwds`               | Suggested cwds (dashboard, home, recent from sessions) |
+| `POST`   | `/api/run/drop-image`          | An image dropped on the Workspace terminal. Raw body, `Content-Type` one of `image/png\|jpeg\|gif\|webp`, ≤20 MB. Saved `0600` under `<tmpdir>/agenthub-drops-<uid>/` with a RANDOM name (nothing from the request names the file); files older than a day are pruned on each write. Answers `{ path }`, which `TerminalView` pastes into the pane — what a local terminal does on a drop, and how `claude` attaches the image. 400 for any other type |
 | `GET`    | `/api/run/files?cwd=…&q=…`    | Fuzzy file search inside `cwd` for the run panel's `@`-file autocomplete. Skips `node_modules`, `.git`, `dist`, `build`, `.next`, `.cache`, `coverage`, `vendor`, etc. Cwd is required and must exist; results are capped and ranked by basename match |
 | `POST`   | `/api/run`                    | Create-or-adopt the lane's tmux session. Body: `{ laneId, cwd, initialPrompt?, model?, permissionMode?, effort?, resumeSessionId? }`. The CLI comes from the lane row, never from the body. An existing session whose pane sits at a shell prompt gets the argv typed into it; a pane already running a program is adopted unchanged |
 | `GET`    | `/api/run/:id`                | One run handle, or 404 once its tmux session is gone |

server/__tests__/cc-reload.test.js

@@ -43,13 +43,13 @@ function stubTmux(sessions, panes = {}) {
     calls.push(args);
     if (args[0] === "list-sessions") return sessions.join("\n");
     if (args[0] === "has-session") {
-      if (sessions.includes(args[2])) return "";
+      if (sessions.includes(args[2].slice(1))) return "";
       const e = new Error("no such session");
       e.status = 1;
       throw e;
     }
     if (args[0] === "display-message") {
-      const name = args[3];
+      const name = args[3].slice(1, -1);
       const cmd = panes[name] ?? "claude";
       if (cmd === null) {
         const e = new Error("pane gone");
@@ -59,7 +59,7 @@ function stubTmux(sessions, panes = {}) {
       return `${cmd}\n`;
     }
     if (args[0] === "send-keys") {
-      if (panes[args[2]] === "__send-fails__") throw new Error("pane died mid-send");
+      if (panes[args[2].slice(1, -1)] === "__send-fails__") throw new Error("pane died mid-send");
       return "";
     }
     return "";

server/__tests__/codex-ingest.test.js

@@ -1,7 +1,7 @@
 /**
- * @file Unit tests for Codex stage ingestion: the payload→hook-event mapping,
- * and one full pass over a fixture rollout journal (detection + status mirror +
- * broadcast + the no-new-bytes no-op).
+ * @file Unit tests for the Codex lane status mirror: one pass over fixture
+ * rollout journals flips a codex lane idle↔running, broadcasts it, and never
+ * touches a lane's stage.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -26,87 +26,11 @@ function line(payload, type = "response_item") {
   return JSON.stringify({ timestamp: new Date().toISOString(), ordinal: 1, type, payload });
 }
 
-describe("codex payload mapping", () => {
-  it("maps a function_call exec_command to a Bash event", () => {
-    const events = codex.eventsFromPayload({
-      type: "function_call",
-      name: "exec_command",
-      arguments: JSON.stringify({ cmd: "npm run test:server", workdir: "/repo" }),
-    });
-    assert.deepEqual(events, [
-      { tool_name: "Bash", tool_input: { command: "npm run test:server" } },
-    ]);
-  });
-
-  it("maps a custom_tool_call exec to a Bash event carrying the raw script", () => {
-    const [event] = codex.eventsFromPayload({
-      type: "custom_tool_call",
-      name: "exec",
-      input: 'const r = await tools.exec_command({cmd:"git push origin feat/x"}); text(r.output);',
-    });
-    assert.equal(event.tool_name, "Bash");
-    assert.match(event.tool_input.command, /git push origin feat\/x/);
-  });
-
-  it("maps an apply_patch script to one event per touched file", () => {
-    const events = codex.eventsFromPayload({
-      type: "custom_tool_call",
-      name: "exec",
-      input:
-        'const patch = "*** Begin Patch\n*** Update File: server/lib/lanes.js\n+x\n' +
-        '*** Add File: docs/NEW.md\n+y\n*** End Patch";',
-    });
-    assert.deepEqual(events, [
-      { tool_name: "Edit", tool_input: { file_path: "server/lib/lanes.js" } },
-      { tool_name: "Write", tool_input: { file_path: "docs/NEW.md" } },
-    ]);
-  });
-
-  it("maps an apply_patch script whose newlines are still escaped", () => {
-    // Verbatim from a real rollout: the patch heredoc lives inside a JS string
-    // literal, so after JSON.parse the line breaks are a literal backslash-n,
-    // not newlines. Matching only real newlines silently sees no files at all.
-    const events = codex.eventsFromPayload({
-      type: "custom_tool_call",
-      name: "exec",
-      input:
-        'const patch = "*** Begin Patch\\n*** Add File: config/demo.yml\\n+# demo\\n*** End Patch";',
-    });
-    assert.deepEqual(events, [
-      { tool_name: "Write", tool_input: { file_path: "config/demo.yml" } },
-    ]);
-  });
-
-  it("maps update_plan to TaskCreate and spawn_agent to Agent", () => {
-    assert.deepEqual(
-      codex.eventsFromPayload({ type: "function_call", name: "update_plan", arguments: "{}" }),
-      [{ tool_name: "TaskCreate", tool_input: {} }]
-    );
-    assert.deepEqual(
-      codex.eventsFromPayload({
-        type: "function_call",
-        name: "spawn_agent",
-        arguments: JSON.stringify({ task_name: "code_reviewer", message: "…" }),
-      }),
-      [{ tool_name: "Agent", tool_input: { subagent_type: "code_reviewer" } }]
-    );
-  });
-
-  it("ignores anything that is not a tool call", () => {
-    assert.deepEqual(codex.eventsFromPayload({ type: "reasoning" }), []);
-    assert.deepEqual(
-      codex.eventsFromPayload({ type: "custom_tool_call_output", name: "exec" }),
-      []
-    );
-    assert.deepEqual(codex.eventsFromPayload({ type: "function_call", name: "web_search" }), []);
-    assert.deepEqual(codex.eventsFromPayload(null), []);
-  });
-});
-
-describe("codex ingest pass", () => {
+describe("codex status mirror", () => {
   const HOME = fs.mkdtempSync(path.join(os.tmpdir(), "codex-home-"));
   const DIR = path.join(HOME, "sessions", "2026", "08", "27");
   let prevHome;
+  let seq = 0;
 
   before(() => {
     prevHome = process.env.CODEX_HOME;
@@ -117,21 +41,18 @@ describe("codex ingest pass", () => {
   after(() => {
     if (prevHome === undefined) delete process.env.CODEX_HOME;
     else process.env.CODEX_HOME = prevHome;
-    codex.__resetOffsets();
-    try {
-      fs.rmSync(HOME, { recursive: true, force: true });
-    } catch {
-      /* best-effort */
-    }
+    codex.__resetCache();
+    fs.rmSync(HOME, { recursive: true, force: true });
   });
 
   /** A rollout journal for `cwd` with one `npm run test:server` shell call. */
-  function writeRollout(name, cwd) {
-    const file = path.join(DIR, name);
+  function writeRollout(cwd, { mtime } = {}) {
+    seq += 1;
+    const file = path.join(DIR, `rollout-2026-08-27T10-00-00-${seq}.jsonl`);
     fs.writeFileSync(
       file,
       [
-        line({ cwd, session_id: "abc" }, "session_meta"),
+        line({ cwd, session_id: `s${seq}` }, "session_meta"),
         line({
           type: "function_call",
           name: "exec_command",
@@ -139,256 +60,97 @@ describe("codex ingest pass", () => {
         }),
       ].join("\n") + "\n"
     );
+    if (mtime !== undefined) fs.utimesSync(file, mtime / 1000, mtime / 1000);
+    codex.__resetCache();
     return file;
   }
 
-  it("detects a stage for a codex lane and mirrors its status", () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    writeRollout("rollout-2026-08-27T10-00-00-aaa.jsonl", cwd);
-    codex.__resetOffsets();
+  const codexLane = (prefix = "codex-lane-") =>
+    lanes.createLane({
+      title: "cx",
+      cwd: fs.mkdtempSync(path.join(os.tmpdir(), prefix)),
+      tool: "codex",
+    });
+
+  it("marks a codex lane running while its journal is fresh, and broadcasts it", () => {
+    const lane = codexLane();
+    writeRollout(lane.cwd);
 
     const seen = [];
     assert.equal(codex.ingestCodexOnce({ broadcast: (id) => seen.push(id) }), 1);
-    const after = lanes.getLane(lane.id);
-    assert.equal(after.detected_stage, "tests"); // `npm run test:server` → default template's tests node
-    assert.match(after.detected_signal, /test:server/);
-    assert.equal(after.status, "running"); // a journal written just now means work is happening
+    assert.equal(lanes.getLane(lane.id).status, "running");
     assert.deepEqual(seen, [lane.id]);
     lanes.deleteLane(lane.id);
   });
 
-  it("advances the declared stage from the detection, without evidence", () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    writeRollout("rollout-2026-08-27T10-00-10-adv.jsonl", cwd);
-    codex.__resetOffsets();
+  it("never writes a stage or a detection, whatever the journal ran", () => {
+    const lane = codexLane();
+    writeRollout(lane.cwd);
 
     codex.ingestCodexOnce({});
     const after = lanes.getLane(lane.id);
-    // The ring moves — a codex session has nothing else that would move it…
-    assert.equal(after.stage, "tests");
-    // …but the node stays amber: an inference sees the tool call, not its result.
-    assert.equal(after.stages.tests.evidence, null);
-    // …and the badge survives, so the card still says WHY it moved.
-    assert.equal(after.detected_stage, "tests");
-    assert.match(after.detected_signal, /test:server/);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("never drags an auto-advanced stage backwards", () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    lanes.setStage(lane.id, { stage: "review", evidence: "declared by the session" });
-    writeRollout("rollout-2026-08-27T10-00-11-back.jsonl", cwd); // detects `tests`, behind `review`
-    codex.__resetOffsets();
-
-    codex.ingestCodexOnce({});
-    const after = lanes.getLane(lane.id);
-    assert.equal(after.stage, "review"); // declared-wins: recordDetection refused, so no advance
+    assert.equal(after.stage, "idle");
     assert.equal(after.detected_stage, null);
-    assert.equal(after.stages.review.evidence, "declared by the session");
+    assert.equal(after.detected_signal, null);
     lanes.deleteLane(lane.id);
   });
 
-  it("a second pass with no appended bytes changes nothing", () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    writeRollout("rollout-2026-08-27T10-00-01-bbb.jsonl", cwd);
-    codex.__resetOffsets();
+  it("a second pass with nothing new changes nothing", () => {
+    const lane = codexLane();
+    writeRollout(lane.cwd);
 
     codex.ingestCodexOnce({});
-    const first = lanes.getLane(lane.id).detected_at;
     assert.equal(codex.ingestCodexOnce({}), 0);
-    assert.equal(lanes.getLane(lane.id).detected_at, first);
+    lanes.deleteLane(lane.id);
+  });
+
+  it("puts a running lane back to idle once its journal goes quiet", () => {
+    const lane = codexLane();
+    lanes.updateLane(lane.id, { status: "running" });
+    writeRollout(lane.cwd, { mtime: Date.now() - 6 * 60 * 60 * 1000 });
+
+    assert.equal(codex.ingestCodexOnce({}), 1);
+    assert.equal(lanes.getLane(lane.id).status, "idle");
+    lanes.deleteLane(lane.id);
+  });
+
+  it("treats a journal whose mtime is in the FUTURE as idle", () => {
+    // A clock stepped back (or a restore that preserved timestamps) leaves a
+    // finished thread's mtime ahead of now; raw `now - mtime` would read as live.
+    const lane = codexLane();
+    writeRollout(lane.cwd, { mtime: Date.now() + 6 * 60 * 60 * 1000 });
+
+    assert.equal(codex.ingestCodexOnce({}), 0);
+    assert.equal(lanes.getLane(lane.id).status, "idle");
     lanes.deleteLane(lane.id);
   });
 
   it("never touches a claude lane, even at the journal's own cwd", () => {
     const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "claude-lane-"));
     const lane = lanes.createLane({ title: "cc", cwd, tool: "claude" });
-    writeRollout("rollout-2026-08-27T10-00-02-ccc.jsonl", cwd);
-    codex.__resetOffsets();
+    writeRollout(cwd);
 
     assert.equal(codex.ingestCodexOnce({}), 0);
-    assert.equal(lanes.getLane(lane.id).detected_stage, null);
+    assert.equal(lanes.getLane(lane.id).status, "idle");
     lanes.deleteLane(lane.id);
   });
 
   it("ignores a journal whose cwd belongs to no lane", () => {
-    const orphan = fs.mkdtempSync(path.join(os.tmpdir(), "codex-orphan-"));
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    writeRollout("rollout-2026-08-27T10-00-03-ddd.jsonl", orphan);
-    codex.__resetOffsets();
+    const lane = codexLane();
+    writeRollout(fs.mkdtempSync(path.join(os.tmpdir(), "codex-orphan-")));
 
     assert.equal(codex.ingestCodexOnce({}), 0);
-    assert.equal(lanes.getLane(lane.id).detected_stage, null);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("keeps byte offsets exact when a tail read starts mid multi-byte character", () => {
-    // The first sight of a >64 KiB journal reads only its tail, and that offset
-    // can land inside a 3-byte UTF-8 sequence. Splitting the decoded STRING and
-    // measuring it back with Buffer.byteLength then counts the decoder's U+FFFD
-    // replacement instead of the bytes actually consumed, so the next pass
-    // starts 1-2 bytes off and every later record is unparseable.
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    const file = path.join(DIR, "rollout-2026-08-27T10-00-06-utf8.jsonl");
-    const record = (cmd) =>
-      line({
-        type: "function_call",
-        name: "exec_command",
-        arguments: JSON.stringify({ cmd, workdir: cwd }),
-      });
-
-    // Grow an all-multi-byte filler line until the tail boundary (size - 64 KiB)
-    // falls on a UTF-8 continuation byte.
-    const head = line({ cwd, session_id: "utf8" }, "session_meta") + "\n";
-    const tailRecord = record("npm run test:server") + "\n";
-    let filler = "→".repeat(30_000);
-    for (let pad = 0; pad < 8; pad += 1) {
-      const body = head + filler + "\n" + tailRecord;
-      const buf = Buffer.from(body, "utf8");
-      const boundary = buf.length - 64 * 1024;
-      if (boundary > 0 && (buf[boundary] & 0xc0) === 0x80) break;
-      filler += "x";
-    }
-    fs.writeFileSync(file, head + filler + "\n" + tailRecord);
-    const buf = Buffer.from(fs.readFileSync(file));
-    assert.equal(buf[buf.length - 64 * 1024] & 0xc0, 0x80, "fixture must straddle a UTF-8 char");
-
-    codex.__resetOffsets();
-    assert.equal(codex.ingestCodexOnce({}), 1);
-    assert.equal(lanes.getLane(lane.id).detected_stage, "tests");
-
-    // The real proof: the next append must still parse, which it only does if
-    // the stored offset is exactly on the previous line boundary.
-    fs.appendFileSync(file, record("git push origin feat/x") + "\n");
-    assert.equal(codex.ingestCodexOnce({}), 1);
-    assert.equal(lanes.getLane(lane.id).detected_stage, "ship");
-    lanes.deleteLane(lane.id);
-  });
-
-  it("ingests a line appended exactly at the previous read's boundary", () => {
-    // The offset after a pass lands on a line boundary, so the next chunk's
-    // FIRST line is a whole record — dropping it as torn loses every append
-    // that arrives one line at a time, which is how a journal actually grows.
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    const file = path.join(DIR, "rollout-2026-08-27T10-00-04-fff.jsonl");
-    fs.writeFileSync(file, line({ cwd, session_id: "boundary" }, "session_meta") + "\n");
-    codex.__resetOffsets();
-    codex.ingestCodexOnce({}); // consumes the header, offset now at EOF
-    assert.equal(lanes.getLane(lane.id).detected_stage, null);
-
-    fs.appendFileSync(
-      file,
-      line({
-        type: "function_call",
-        name: "exec_command",
-        arguments: JSON.stringify({ cmd: "npm run test:server", workdir: cwd }),
-      }) + "\n"
-    );
-    assert.equal(codex.ingestCodexOnce({}), 1);
-    assert.equal(lanes.getLane(lane.id).detected_stage, "tests");
-    lanes.deleteLane(lane.id);
-  });
-
-  it("re-reads a torn line whole on the next pass", () => {
-    // A pass that catches the writer mid-line must not consume that fragment:
-    // the record it belongs to would be lost forever.
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    const file = path.join(DIR, "rollout-2026-08-27T10-00-05-ggg.jsonl");
-    const record = line({
-      type: "function_call",
-      name: "exec_command",
-      arguments: JSON.stringify({ cmd: "npm run test:server", workdir: cwd }),
-    });
-    fs.writeFileSync(
-      file,
-      line({ cwd, session_id: "torn" }, "session_meta") + "\n" + record.slice(0, 40)
-    );
-    codex.__resetOffsets();
-    codex.ingestCodexOnce({});
-    assert.equal(lanes.getLane(lane.id).detected_stage, null);
-
-    fs.appendFileSync(file, record.slice(40) + "\n"); // the writer finishes the line
-    assert.equal(codex.ingestCodexOnce({}), 1);
-    assert.equal(lanes.getLane(lane.id).detected_stage, "tests");
-    lanes.deleteLane(lane.id);
-  });
-
-  it("does not replay a journal it sees for the first time already idle", () => {
-    // A thread that finished days ago must not paint a stage now — the first
-    // sight of a stale file only records where it ends.
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    const file = writeRollout("rollout-2026-08-20T10-00-00-eee.jsonl", cwd);
-    const old = Date.now() - 6 * 60 * 60 * 1000;
-    fs.utimesSync(file, old / 1000, old / 1000);
-    codex.__resetOffsets();
-
-    assert.equal(codex.ingestCodexOnce({}), 0);
-    assert.equal(lanes.getLane(lane.id).detected_stage, null);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("does not replay a journal whose mtime is in the FUTURE", () => {
-    // A clock stepped back (or a restore that preserved timestamps) leaves a
-    // finished thread's mtime ahead of now. Raw `now - mtime` is then negative,
-    // which reads as "written milliseconds ago" and would replay it as live work.
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-lane-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    const file = writeRollout("rollout-2026-08-27T10-00-00-fut.jsonl", cwd);
-    const future = Date.now() + 6 * 60 * 60 * 1000;
-    fs.utimesSync(file, future / 1000, future / 1000);
-    codex.__resetOffsets();
-
-    assert.equal(codex.ingestCodexOnce({}), 0);
-    assert.equal(lanes.getLane(lane.id).detected_stage, null);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("ignores a torn/partial JSONL line at the end of a file", () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-torn-line-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    const file = path.join(DIR, "rollout-torn.jsonl");
-    fs.writeFileSync(
-      file,
-      [
-        line({ cwd, session_id: "torn" }, "session_meta"),
-        line({
-          type: "function_call",
-          name: "exec_command",
-          arguments: JSON.stringify({ cmd: "npm run test:server", workdir: cwd }),
-        }),
-        // A torn last line: not valid JSON, so it will be skipped on next pass
-        '{"timestamp":"2026-08-27T10:00:00.000Z","type":"response_item","paylo',
-      ].join("\n")
-    );
-    codex.__resetOffsets();
-
-    const seen = [];
-    assert.equal(codex.ingestCodexOnce({ broadcast: (id) => seen.push(id) }), 1);
-    const after = lanes.getLane(lane.id);
-    assert.equal(after.detected_stage, "tests"); // the valid line was processed
-    assert.deepEqual(seen, [lane.id]);
+    assert.equal(lanes.getLane(lane.id).status, "idle");
     lanes.deleteLane(lane.id);
   });
 
   it("handles a journal whose session_meta is unparseable gracefully", () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-bad-meta-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    const file = path.join(DIR, "rollout-bad-meta.jsonl");
-    // Write an invalid JSON line as the first line
-    fs.writeFileSync(file, "not valid json at all\n");
-    codex.__resetOffsets();
+    const lane = codexLane();
+    fs.writeFileSync(path.join(DIR, "rollout-bad-meta.jsonl"), "not valid json at all\n");
+    codex.__resetCache();
 
     assert.equal(codex.ingestCodexOnce({}), 0);
-    assert.equal(lanes.getLane(lane.id).detected_stage, null);
+    assert.equal(lanes.getLane(lane.id).status, "idle");
     lanes.deleteLane(lane.id);
   });
 
@@ -397,50 +159,31 @@ describe("codex ingest pass", () => {
     const inner = fs.mkdtempSync(path.join(outer, "inner"));
     const outerLane = lanes.createLane({ title: "outer", cwd: outer, tool: "codex" });
     const innerLane = lanes.createLane({ title: "inner", cwd: inner, tool: "codex" });
-    const file = path.join(DIR, "rollout-nested.jsonl");
-    fs.writeFileSync(
-      file,
-      [
-        line({ cwd: inner, session_id: "nested" }, "session_meta"),
-        line({
-          type: "function_call",
-          name: "exec_command",
-          arguments: JSON.stringify({ cmd: "npm run test:server", workdir: inner }),
-        }),
-      ].join("\n") + "\n"
-    );
-    codex.__resetOffsets();
+    writeRollout(inner);
 
     const seen = [];
     assert.equal(codex.ingestCodexOnce({ broadcast: (id) => seen.push(id) }), 1);
-    // Inner lane should be the one detected, not outer
-    assert.equal(lanes.getLane(innerLane.id).detected_stage, "tests");
-    assert.equal(lanes.getLane(outerLane.id).detected_stage, null);
+    assert.equal(lanes.getLane(innerLane.id).status, "running");
+    assert.equal(lanes.getLane(outerLane.id).status, "idle");
     assert.deepEqual(seen, [innerLane.id]);
     lanes.deleteLane(innerLane.id);
     lanes.deleteLane(outerLane.id);
   });
 
   it("does not touch status of a lane with an active run_id", () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-run-id-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
+    const lane = codexLane();
     lanes.updateLane(lane.id, { run_id: "active-run" });
-    writeRollout("rollout-2026-08-27T10-00-10-rrr.jsonl", cwd);
-    codex.__resetOffsets();
+    writeRollout(lane.cwd);
 
     codex.ingestCodexOnce({});
-    const after = lanes.getLane(lane.id);
-    // Status should not change because run_id is present
-    assert.equal(after.status, "idle");
+    assert.equal(lanes.getLane(lane.id).status, "idle");
     lanes.deleteLane(lane.id);
   });
 
   it("does not change status from provisioning or failed", () => {
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-status-protected-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
+    const lane = codexLane();
     lanes.updateLane(lane.id, { status: "provisioning" });
-    writeRollout("rollout-2026-08-27T10-00-11-ppp.jsonl", cwd);
-    codex.__resetOffsets();
+    writeRollout(lane.cwd);
 
     codex.ingestCodexOnce({});
     assert.equal(lanes.getLane(lane.id).status, "provisioning");
@@ -455,119 +198,13 @@ describe("codex ingest pass", () => {
     const oldMs = process.env.DASHBOARD_CODEX_POLL_MS;
     try {
       process.env.DASHBOARD_CODEX_POLL_MS = "0";
-      // startCodexPoll should return early and not set up an interval
-      const timer = codex.startCodexPoll(() => {});
-      assert.equal(timer, undefined);
+      assert.equal(
+        codex.startCodexPoll(() => {}),
+        undefined
+      );
     } finally {
       if (oldMs === undefined) delete process.env.DASHBOARD_CODEX_POLL_MS;
       else process.env.DASHBOARD_CODEX_POLL_MS = oldMs;
     }
   });
-
-  it("handles a shell call with command as an array in arguments", () => {
-    const events = codex.eventsFromPayload({
-      type: "function_call",
-      name: "exec_command",
-      arguments: JSON.stringify({ command: ["npm", "run", "test:server"], workdir: "/repo" }),
-    });
-    // Should join array elements
-    assert.deepEqual(events, [
-      { tool_name: "Bash", tool_input: { command: "npm run test:server" } },
-    ]);
-  });
-
-  it("ignores a payload with a non-string name", () => {
-    // A payload with name as null or number should not match any tool
-    const events1 = codex.eventsFromPayload({
-      type: "function_call",
-      name: null,
-      arguments: "{}",
-    });
-    assert.deepEqual(events1, []);
-
-    const events2 = codex.eventsFromPayload({
-      type: "custom_tool_call",
-      name: 123,
-      input: "some script",
-    });
-    assert.deepEqual(events2, []);
-  });
-
-  it("uses the LAST detection in a batch to move the lane forward", () => {
-    // Within one ingest pass, if multiple tool calls map to different stages,
-    // recordDetection is called in order. Only the LAST one that actually writes
-    // should move the lane forward (forward-only). Simulate two tool calls:
-    // first impl call (implement), then tests call (tests).
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-batch-last-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    const file = path.join(DIR, "rollout-batch-last.jsonl");
-    fs.writeFileSync(
-      file,
-      [
-        line({ cwd, session_id: "batch" }, "session_meta"),
-        // Edit event (implement node)
-        line({
-          type: "custom_tool_call",
-          name: "exec",
-          input: 'await tools.edit("src/main.js", "add x");',
-        }),
-        // Bash event (tests node)
-        line({
-          type: "function_call",
-          name: "exec_command",
-          arguments: JSON.stringify({ cmd: "npm run test:server", workdir: cwd }),
-        }),
-      ].join("\n") + "\n"
-    );
-    codex.__resetOffsets();
-
-    const seen = [];
-    assert.equal(codex.ingestCodexOnce({ broadcast: (id) => seen.push(id) }), 1);
-    const after = lanes.getLane(lane.id);
-    // Should detect the tests node (later in batch), not implement
-    assert.equal(after.detected_stage, "tests");
-    lanes.deleteLane(lane.id);
-  });
-
-  it("limits file scan to MAX_FILES newest files", () => {
-    // Create more than MAX_FILES journal files and verify only newest are scanned
-    const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "codex-max-files-"));
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-
-    // Create 50 old files (more than MAX_FILES=40)
-    const oldTime = Date.now() - 2 * 60 * 60 * 1000;
-    for (let i = 0; i < 50; i++) {
-      const file = path.join(DIR, `rollout-old-${String(i).padStart(2, "0")}.jsonl`);
-      fs.writeFileSync(file, line({ cwd, session_id: `old-${i}` }, "session_meta") + "\n");
-      fs.utimesSync(file, oldTime / 1000, oldTime / 1000);
-    }
-    codex.__resetOffsets();
-
-    // The scan should not stall and should return (no detection expected since all files are stale)
-    const result = codex.ingestCodexOnce({});
-    // All files are stale and not active, so no broadcast
-    assert.equal(result, 0);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("detects correctly with Delete File in patch heredoc", () => {
-    const events = codex.eventsFromPayload({
-      type: "custom_tool_call",
-      name: "exec",
-      input: 'const patch = "*** Begin Patch\\n*** Delete File: old/removed.js\\n*** End Patch";',
-    });
-    // Delete creates an Edit event (not Write, not ignored)
-    assert.deepEqual(events, [{ tool_name: "Edit", tool_input: { file_path: "old/removed.js" } }]);
-  });
-
-  it("handles file paths with whitespace in patch patches", () => {
-    const events = codex.eventsFromPayload({
-      type: "custom_tool_call",
-      name: "exec",
-      input:
-        'const patch = "*** Begin Patch\\n*** Update File:  src/my file.js  \\n*** End Patch";',
-    });
-    // File path should be trimmed
-    assert.deepEqual(events, [{ tool_name: "Edit", tool_input: { file_path: "src/my file.js" } }]);
-  });
 });

server/__tests__/codex-nudge.test.js

@@ -1,142 +0,0 @@
-/**
- * @file Unit tests for the codex evidence safety net: nudges a live codex pane
- * to run `agenthub stage --evidence` when the lane has sat at an inferred (
- * evidence-less) stage past the delay, without ever writing stage itself.
- * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
- */
-
-const os = require("node:os");
-const path = require("node:path");
-
-const SUITE_DB_PATH = path.join(
-  os.tmpdir(),
-  `dashboard-codex-nudge-${Date.now()}-${process.pid}.db`
-);
-process.env.DASHBOARD_DB_PATH = SUITE_DB_PATH;
-
-const { describe, it, beforeEach, afterEach } = require("node:test");
-const assert = require("node:assert/strict");
-
-const { db } = require("../db");
-const lanes = require("../lib/lanes");
-const tmux = require("../lib/tmux");
-const nudge = require("../lib/codex-nudge");
-
-/** Backdate the current stage's enteredAt so it looks `minutes` old. */
-function backdateStage(laneId, minutes) {
-  const lane = lanes.getLane(laneId);
-  const stages = { ...lane.stages };
-  stages[lane.stage] = {
-    ...stages[lane.stage],
-    enteredAt: new Date(Date.now() - minutes * 60_000).toISOString(),
-  };
-  db.prepare("UPDATE lanes SET stages = ? WHERE id = ?").run(JSON.stringify(stages), laneId);
-}
-
-describe("codex-nudge sweep", () => {
-  let calls;
-
-  beforeEach(() => {
-    calls = [];
-    tmux.__setExecImpl((args) => {
-      calls.push(args);
-      if (args[0] === "display-message") return "codex"; // pane running the codex CLI
-      return "";
-    });
-    nudge.__resetNudgeState();
-  });
-
-  afterEach(() => {
-    tmux.__reset();
-  });
-
-  function makeCodexLane({ cwd, stage = "tests", evidence }) {
-    const lane = lanes.createLane({ title: "cx", cwd, tool: "codex" });
-    lanes.updateLane(lane.id, { run_id: `agenthub-lane-${lane.id}` });
-    lanes.setStage(lane.id, { stage, evidence });
-    return lane;
-  }
-
-  it("nudges once the lane has held an evidence-less stage past the delay", () => {
-    const cwd = os.tmpdir();
-    const lane = makeCodexLane({ cwd: `${cwd}/nudge-a` });
-    backdateStage(lane.id, 3); // older than the 2 min delay
-
-    assert.equal(nudge.sweepCodexNudges(), 1);
-    const sendKeys = calls.filter((a) => a[0] === "send-keys" && a[3] === "-l");
-    assert.equal(sendKeys.length, 1);
-    assert.match(sendKeys[0][4], /agenthub stage tests --tool codex --evidence/);
-
-    // A second pass for the same still-unevidenced stage must not repeat it.
-    assert.equal(nudge.sweepCodexNudges(), 0);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("never nudges before the delay has elapsed", () => {
-    const cwd = os.tmpdir();
-    const lane = makeCodexLane({ cwd: `${cwd}/nudge-b` });
-    // enteredAt is "now" — setStage just wrote it.
-    assert.equal(nudge.sweepCodexNudges(), 0);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("never nudges a stage the session already backed with evidence", () => {
-    const cwd = os.tmpdir();
-    const lane = makeCodexLane({ cwd: `${cwd}/nudge-c`, evidence: "12 tests green" });
-    backdateStage(lane.id, 10);
-    assert.equal(nudge.sweepCodexNudges(), 0);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("never nudges a lane that has not entered a pipeline node", () => {
-    const cwd = os.tmpdir();
-    const lane = lanes.createLane({ title: "cx", cwd: `${cwd}/nudge-h`, tool: "codex" });
-    lanes.updateLane(lane.id, { run_id: `agenthub-lane-${lane.id}` });
-    assert.equal(nudge.sweepCodexNudges(), 0);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("never nudges a claude lane", () => {
-    const cwd = os.tmpdir();
-    const lane = lanes.createLane({ title: "cc", cwd: `${cwd}/nudge-d`, tool: "claude" });
-    lanes.updateLane(lane.id, { run_id: `agenthub-lane-${lane.id}` });
-    lanes.setStage(lane.id, { stage: "tests" });
-    backdateStage(lane.id, 3);
-    assert.equal(nudge.sweepCodexNudges(), 0);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("never nudges a lane with no live run", () => {
-    const cwd = os.tmpdir();
-    const lane = lanes.createLane({ title: "cx", cwd: `${cwd}/nudge-e`, tool: "codex" });
-    lanes.setStage(lane.id, { stage: "tests" });
-    backdateStage(lane.id, 3);
-    assert.equal(nudge.sweepCodexNudges(), 0);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("never types into a pane sitting at a bare shell prompt", () => {
-    const cwd = os.tmpdir();
-    const lane = makeCodexLane({ cwd: `${cwd}/nudge-f` });
-    backdateStage(lane.id, 3);
-    tmux.__setExecImpl((args) => {
-      calls.push(args);
-      if (args[0] === "display-message") return "bash";
-      return "";
-    });
-    assert.equal(nudge.sweepCodexNudges(), 0);
-    lanes.deleteLane(lane.id);
-  });
-
-  it("nudges again once the lane moves to another evidence-less stage", () => {
-    const cwd = os.tmpdir();
-    const lane = makeCodexLane({ cwd: `${cwd}/nudge-g` });
-    backdateStage(lane.id, 3);
-    assert.equal(nudge.sweepCodexNudges(), 1);
-
-    lanes.setStage(lane.id, { stage: "review" });
-    backdateStage(lane.id, 3);
-    assert.equal(nudge.sweepCodexNudges(), 1);
-    lanes.deleteLane(lane.id);
-  });
-});

server/__tests__/env-scrub.test.js

@@ -0,0 +1,51 @@
+/**
+ * @file Tests that the server drops the variables describing the Claude Code
+ * session that started it (always the case on macOS, where there is no
+ * systemd unit to give it a clean env) — tmux and every lane pane inherit the
+ * server's env, so a leaked CLAUDECODE made each pane look like a nested
+ * session. User configuration (CLAUDE_CONFIG_DIR, ANTHROPIC_*, …) must survive.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { it, after } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-envscrub-"));
+process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
+process.env.CLAUDE_HOME = path.join(TMP, "home");
+process.env.DASHBOARD_DATA_DIR = path.join(TMP, "data");
+
+process.env.CLAUDECODE = "1";
+process.env.CLAUDE_CODE_ENTRYPOINT = "cli";
+process.env.CLAUDE_CODE_SESSION_ID = "abc";
+process.env.CLAUDE_CODE_MESSAGING_SOCKET = "/tmp/x.sock";
+process.env.CLAUDE_PLUGIN_ROOT = "/some/cache/dir";
+process.env.CLAUDE_CONFIG_DIR = "/Users/x/.claude-work";
+process.env.CLAUDE_CODE_USE_BEDROCK = "1";
+process.env.ANTHROPIC_BASE_URL = "https://example.invalid";
+
+require("../index");
+const { db } = require("../db");
+
+after(() => {
+  db.close();
+  fs.rmSync(TMP, { recursive: true, force: true });
+});
+
+it("strips the parent session's variables and keeps user configuration", () => {
+  for (const k of [
+    "CLAUDECODE",
+    "CLAUDE_CODE_ENTRYPOINT",
+    "CLAUDE_CODE_SESSION_ID",
+    "CLAUDE_CODE_MESSAGING_SOCKET",
+    "CLAUDE_PLUGIN_ROOT",
+  ]) {
+    assert.equal(process.env[k], undefined, k);
+  }
+  assert.equal(process.env.CLAUDE_CONFIG_DIR, "/Users/x/.claude-work");
+  assert.equal(process.env.CLAUDE_CODE_USE_BEDROCK, "1");
+  assert.equal(process.env.ANTHROPIC_BASE_URL, "https://example.invalid");
+});

server/__tests__/fixtures/pipelines/default.json

@@ -9,11 +9,7 @@
       "icon": "📝",
       "gate": false,
       "command": "/superpowers:brainstorming",
-      "aliases": [
-        "assigned",
-        "claimed",
-        "start"
-      ],
+      "aliases": ["assigned", "claimed", "start"],
       "detect": [
         {
           "tool": "Agent",
@@ -31,11 +27,7 @@
       "icon": "🧭",
       "gate": false,
       "command": "/superpowers:writing-plans",
-      "aliases": [
-        "planning",
-        "brainstorm",
-        "design"
-      ],
+      "aliases": ["planning", "brainstorm", "design"],
       "detect": [
         {
           "tool": "Skill",
@@ -60,11 +52,7 @@
       "icon": "🛠",
       "gate": false,
       "command": "/superpowers:test-driven-development",
-      "aliases": [
-        "implementing",
-        "coding",
-        "build"
-      ],
+      "aliases": ["implementing", "coding", "build"],
       "detect": [
         {
           "tool": "Skill",
@@ -85,12 +73,7 @@
       "icon": "🧪",
       "gate": true,
       "command": "npm test",
-      "aliases": [
-        "testing",
-        "unit",
-        "gates",
-        "pre-push-gate"
-      ],
+      "aliases": ["testing", "unit", "gates", "pre-push-gate"],
       "detect": [
         {
           "tool": "Bash",
@@ -108,11 +91,7 @@
       "icon": "👀",
       "gate": true,
       "command": "/code-review",
-      "aliases": [
-        "reviewing",
-        "code-review",
-        "self-review"
-      ],
+      "aliases": ["reviewing", "code-review", "self-review"],
       "detect": [
         {
           "tool": "Skill",
@@ -134,12 +113,7 @@
       "icon": "🚦",
       "gate": true,
       "command": "/superpowers:verification-before-completion",
-      "aliases": [
-        "verify",
-        "verification",
-        "sr-gate",
-        "gate-blocked"
-      ],
+      "aliases": ["verify", "verification", "sr-gate", "gate-blocked"],
       "detect": [
         {
           "tool": "Skill",
@@ -157,13 +131,7 @@
       "icon": "🔀",
       "gate": false,
       "command": "/superpowers:finishing-a-development-branch",
-      "aliases": [
-        "pr",
-        "pr-open",
-        "publishing",
-        "commit",
-        "push"
-      ],
+      "aliases": ["pr", "pr-open", "publishing", "commit", "push"],
       "detect": [
         {
           "tool": "Skill",
@@ -181,11 +149,7 @@
       "icon": "✅",
       "gate": false,
       "command": "agenthub stage done",
-      "aliases": [
-        "complete",
-        "completed",
-        "merged"
-      ]
+      "aliases": ["complete", "completed", "merged"]
     }
   ]
 }

server/__tests__/fixtures/pipelines/ship-feature.json

@@ -9,12 +9,7 @@
       "icon": "📝",
       "gate": false,
       "command": "/superpowers:brainstorming",
-      "aliases": [
-        "assigned",
-        "claimed",
-        "start",
-        "bootstrapping"
-      ],
+      "aliases": ["assigned", "claimed", "start", "bootstrapping"],
       "detect": [
         {
           "tool": "Skill",
@@ -36,11 +31,7 @@
       "icon": "🧭",
       "gate": false,
       "command": "/superpowers:writing-plans",
-      "aliases": [
-        "planning",
-        "brainstorm",
-        "design"
-      ],
+      "aliases": ["planning", "brainstorm", "design"],
       "detect": [
         {
           "tool": "Skill",
@@ -65,11 +56,7 @@
       "icon": "🛠",
       "gate": false,
       "command": "/superpowers:test-driven-development",
-      "aliases": [
-        "implement",
-        "coding",
-        "build"
-      ],
+      "aliases": ["implement", "coding", "build"],
       "detect": [
         {
           "tool": "Skill",
@@ -91,12 +78,7 @@
       "icon": "🧪",
       "gate": true,
       "command": "agenthub lanes hook ci-gate",
-      "aliases": [
-        "pre-push-gate",
-        "tests",
-        "migration-collision",
-        "sync-conflict"
-      ],
+      "aliases": ["pre-push-gate", "tests", "migration-collision", "sync-conflict"],
       "detect": [
         {
           "tool": "Bash",
@@ -114,12 +96,7 @@
       "icon": "🧪",
       "gate": false,
       "command": "agenthub lanes up --qc",
-      "aliases": [
-        "e2e",
-        "e2e-scoped",
-        "booting",
-        "live"
-      ],
+      "aliases": ["e2e", "e2e-scoped", "booting", "live"],
       "detect": [
         {
           "tool": "Bash",
@@ -133,9 +110,7 @@
       "icon": "🧪",
       "gate": true,
       "command": "agenthub stage e2e-feature-passed",
-      "aliases": [
-        "e2e-passed"
-      ]
+      "aliases": ["e2e-passed"]
     },
     {
       "id": "review",
@@ -143,11 +118,7 @@
       "icon": "👀",
       "gate": true,
       "command": "/code-review",
-      "aliases": [
-        "reviewing",
-        "code-review",
-        "self-review"
-      ],
+      "aliases": ["reviewing", "code-review", "self-review"],
       "detect": [
         {
           "tool": "Skill",
@@ -191,12 +162,7 @@
       "icon": "🚦",
       "gate": true,
       "command": "/superpowers:verification-before-completion",
-      "aliases": [
-        "sr-gate",
-        "verify",
-        "verification",
-        "gate-blocked"
-      ],
+      "aliases": ["sr-gate", "verify", "verification", "gate-blocked"],
       "detect": [
         {
           "tool": "Agent",
@@ -214,9 +180,7 @@
       "icon": "🔀",
       "gate": false,
       "command": "/superpowers:finishing-a-development-branch",
-      "aliases": [
-        "push"
-      ],
+      "aliases": ["push"],
       "detect": [
         {
           "tool": "Skill",
@@ -234,12 +198,7 @@
       "icon": "🔀",
       "gate": false,
       "command": "gh pr create --base development",
-      "aliases": [
-        "ship",
-        "pr",
-        "push-conflict",
-        "push-revalidate"
-      ],
+      "aliases": ["ship", "pr", "push-conflict", "push-revalidate"],
       "detect": [
         {
           "tool": "Bash",
@@ -261,9 +220,7 @@
       "icon": "👁",
       "gate": false,
       "command": "agenthub lanes ci status",
-      "aliases": [
-        "pr-comment-fix"
-      ],
+      "aliases": ["pr-comment-fix"],
       "detect": [
         {
           "tool": "Bash",
@@ -285,10 +242,7 @@
       "icon": "✅",
       "gate": false,
       "command": "agenthub stage done",
-      "aliases": [
-        "complete",
-        "completed"
-      ]
+      "aliases": ["complete", "completed"]
     }
   ]
 }

server/__tests__/git-credentials-route.test.js

@@ -0,0 +1,95 @@
+/**
+ * @file Route tests for git credentials (issue #45): /api/git-credentials
+ * never returns a password and refuses a cross-origin write, and a lane's
+ * fetch against a remote that wants a login answers 409 EGITAUTH with the
+ * host the git bar's login form needs.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const http = require("node:http");
+const { execFileSync } = require("node:child_process");
+
+const ROOT = fs.mkdtempSync(path.join(os.tmpdir(), "git-creds-route-"));
+process.env.DASHBOARD_DB_PATH = path.join(ROOT, "t.db");
+process.env.CLAUDE_HOME = path.join(ROOT, ".claude");
+process.env.DASHBOARD_REMOTE_SYNC_MS = "0";
+process.env.DASHBOARD_LIVENESS_PROBE = "0";
+process.env.GIT_CONFIG_NOSYSTEM = "1";
+process.env.HOME = ROOT;
+
+const { createApp } = require("../index");
+
+let app;
+let remote;
+let base;
+let host;
+
+function request(method, p, body, headers = {}) {
+  return fetch(`${base}${p}`, {
+    method,
+    headers: { "Content-Type": "application/json", ...headers },
+    body: body === undefined ? undefined : JSON.stringify(body),
+  }).then(async (r) => ({ status: r.status, body: await r.json().catch(() => null) }));
+}
+
+before(async () => {
+  remote = http.createServer((_req, res) => {
+    res.writeHead(401, { "WWW-Authenticate": 'Basic realm="t"' });
+    res.end();
+  });
+  await new Promise((r) => remote.listen(0, "127.0.0.1", r));
+  host = `127.0.0.1:${remote.address().port}`;
+  app = http.createServer(createApp());
+  await new Promise((r) => app.listen(0, "127.0.0.1", r));
+  base = `http://127.0.0.1:${app.address().port}`;
+});
+after(async () => {
+  await new Promise((r) => app.close(r));
+  await new Promise((r) => remote.close(r));
+});
+
+describe("/api/git-credentials", () => {
+  it("saves, lists without the secret, and deletes", async () => {
+    const saved = await request("POST", "/api/git-credentials", {
+      protocol: "https",
+      host: "git.example.test",
+      username: "vi",
+      password: "super-secret-token",
+    });
+    assert.equal(saved.status, 200);
+    const list = await request("GET", "/api/git-credentials");
+    assert.equal(list.body.items[0].hasToken, true);
+    assert.ok(!JSON.stringify(list.body).includes("super-secret-token"));
+    const del = await request("DELETE", "/api/git-credentials/https/git.example.test");
+    assert.deepEqual(del.body.items, []);
+  });
+
+  it("refuses a cross-origin write", async () => {
+    const r = await request(
+      "POST",
+      "/api/git-credentials",
+      { protocol: "https", host: "h.test", username: "u", password: "p" },
+      { Origin: "https://evil.example" }
+    );
+    assert.equal(r.status, 403);
+  });
+});
+
+describe("POST /api/lanes/:id/git/fetch", () => {
+  it("answers 409 EGITAUTH with the host when the remote wants a login", async () => {
+    const repo = path.join(ROOT, "repo");
+    execFileSync("git", ["init", "-q", repo]);
+    execFileSync("git", ["-C", repo, "remote", "add", "origin", `http://${host}/o/r.git`]);
+    const lane = await request("POST", "/api/lanes/ensure", { cwd: repo, tool: "claude" });
+    const r = await request("POST", `/api/lanes/${lane.body.lane.id}/git/fetch`, {});
+    assert.equal(r.status, 409);
+    assert.equal(r.body.error.code, "EGITAUTH");
+    assert.equal(r.body.error.auth.host, host);
+    assert.equal(r.body.error.auth.rejected, false);
+  });
+});