chore(release): bump version to 1.8.8

- Changes panel at full screen: the whole Files view (finder, expand-all,
  tree) becomes a left sidebar and the Files tab is dropped; a working-copy
  file opens straight into the editor (Save/Cancel live once the text
  differs, Cancel restores it, Whole file toggles back to the diff), and the
  page is height-locked so the editor no longer collapses with no live run.
- Overview splits into Staged Changes / Changes groups in the work range.
- A changed file's whole tree row takes its status tint.
- Drag an image onto the lane terminal: POST /api/run/drop-image saves it
  (png/jpeg/gif/webp, random name, 0600, pruned after a day) and the path
  is pasted into the pane, which is how claude attaches it.
- Claude Opus 5.5 gets its own pricing row (4/20/0.2/5/8, fast 8/40);
  claude-opus-5% had been pricing it as Opus 5.
- server/lib/pricing-sync.js: a model family used in token_usage with no
  row of its own is inserted from LiteLLM's public price list, never
  updated; off with AGENTHUB_PRICING_SYNC=0. repo-links allows exactly
  that one third-party GitHub raw URL.

client/src/components/Tooltip.tsx

@@ -9,10 +9,13 @@
  * touching every one of those call sites to get a designed bubble, and the
  * next `title=` someone writes would be back to the browser's grey box.
  * {@link GlobalTooltip} instead listens once at the document: on hover or
- * keyboard focus it takes the element's `title`, suppresses the native tooltip
+ * keyboard focus (`:focus-visible`, not the focus a click gives) it takes the element's `title`, suppresses the native tooltip
  * by removing the attribute for as long as the bubble is up, and restores it
  * on the way out. Nothing else in the app has to know it exists, and a control
  * keeps its native tooltip (and its accessible name) when JS has not run.
+ * While the title is parked, a control with no other name (icon-only) carries
+ * it as a temporary `aria-label`, so focusing it never leaves it nameless; the
+ * bubble goes away with its control if that is removed from the page.
  *
  * ## The look
  * Anchored to the CONTROL, not the cursor — a bubble that chases the mouse is
@@ -39,8 +42,10 @@ const SHOW_DELAY_MS = 350;
 /** Gap between the control and the bubble, and the minimum viewport margin. */
 const GAP = 8;
 
-/** Opt an element (or a subtree) out: `data-tip-off` keeps the native title. */
-const SELECTOR = "[title]:not([data-tip-off])";
+/** Opt an element (or a subtree) out: `data-tip-off` keeps the native title.
+ *  `[data-tip]` matches the control whose title is parked, so moving between
+ *  its own children still resolves to it instead of re-opening the bubble. */
+const SELECTOR = "[title]:not([data-tip-off]), [data-tip]";
 
 type Anchored = { text: string; rect: DOMRect };
 type Placed = { left: number; top: number; arrow: number; above: boolean };
@@ -58,16 +63,29 @@ export function GlobalTooltip() {
   // that unmounts it, Escape).
   const parked = useRef<HTMLElement | null>(null);
   const timer = useRef<number | undefined>(undefined);
+  // The element whose delay is running, so re-entering it does not restart it.
+  const pending = useRef<HTMLElement | null>(null);
 
   const restore = useCallback(() => {
     window.clearTimeout(timer.current);
+    pending.current = null;
     const el = parked.current;
     if (el) {
+      // Drop the instance shim `open` installed; the prototype method is back.
+      delete (el as { removeAttribute?: unknown }).removeAttribute;
       const text = el.dataset.tip;
       if (text !== undefined) {
-        el.setAttribute("title", text);
+        // React re-set `title` while it was parked (a poll flipped the hint):
+        // that value is current, the parked copy is stale. React never
+        // re-applies an unchanged prop, so writing the old one back would win
+        // for good.
+        if (!el.hasAttribute("title")) el.setAttribute("title", text);
         delete el.dataset.tip;
       }
+      if (el.dataset.tipAria !== undefined) {
+        el.removeAttribute("aria-label");
+        delete el.dataset.tipAria;
+      }
       parked.current = null;
     }
     setTip(null);
@@ -79,7 +97,9 @@ export function GlobalTooltip() {
       const text = (el.getAttribute("title") || "").trim();
       if (!text) return;
       restore();
+      pending.current = el;
       timer.current = window.setTimeout(() => {
+        pending.current = null;
         // Re-read at fire time: the control may have been re-rendered, removed
         // or had its title changed while the delay was running.
         if (!el.isConnected) return;
@@ -87,6 +107,29 @@ export function GlobalTooltip() {
         if (!current) return;
         el.dataset.tip = current;
         el.removeAttribute("title");
+        // React removing `title` while it is parked calls removeAttribute on an
+        // attribute that is already gone: no MutationRecord, nothing to see —
+        // and `restore` would write the stale text back for good. So, on THIS
+        // element and only while parked, that call is taken as React's intent:
+        // the parked copy is dropped and the bubble hides. (React DOM calls
+        // `node.removeAttribute`, the instance method; `restore` deletes the
+        // shim.) No global prototype is touched.
+        el.removeAttribute = (name: string) => {
+          if (name.toLowerCase() === "title" && el.dataset.tip !== undefined) {
+            delete el.dataset.tip;
+            restore();
+          }
+          Element.prototype.removeAttribute.call(el, name);
+        };
+        // The title was an icon-only control's ONLY name; keep it named.
+        if (
+          !el.hasAttribute("aria-label") &&
+          !el.hasAttribute("aria-labelledby") &&
+          !el.textContent?.trim()
+        ) {
+          el.setAttribute("aria-label", current);
+          el.dataset.tipAria = "";
+        }
         parked.current = el;
         setTip({ text: current, rect: el.getBoundingClientRect() });
       }, delay);
@@ -101,7 +144,10 @@ export function GlobalTooltip() {
     };
     const onOver = (e: PointerEvent) => {
       const el = target(e);
-      if (el) open(el, SHOW_DELAY_MS);
+      // Already showing or already counting down for this control: a pointer
+      // crossing its children must neither hide nor restart it.
+      if (!el || el === parked.current || el === pending.current) return;
+      open(el, SHOW_DELAY_MS);
     };
     const onOut = (e: PointerEvent) => {
       // Moving between children of the same control must not flicker.
@@ -112,9 +158,14 @@ export function GlobalTooltip() {
     };
     // Keyboard users get the same tooltip, immediately — a focus ring that
     // reveals nothing is the whole reason icon-only buttons are hard to learn.
+    // Only KEYBOARD focus, though: a click focuses too, and without the
+    // `:focus-visible` check it reopened the bubble the pointerdown just
+    // closed, with no delay. Hover keeps its own path.
     const onFocus = (e: FocusEvent) => {
       const el = target(e);
-      if (el) open(el, 0);
+      if (!el || el === parked.current) return;
+      if (!(e.target instanceof Element) || !e.target.matches(":focus-visible")) return;
+      open(el, 0);
     };
     const onKey = (e: KeyboardEvent) => {
       if (e.key === "Escape") restore();
@@ -126,9 +177,17 @@ export function GlobalTooltip() {
     document.addEventListener("focusin", onFocus);
     document.addEventListener("focusout", restore);
     document.addEventListener("keydown", onKey);
-    // A bubble anchored to a rect is wrong the moment anything moves.
-    window.addEventListener("scroll", restore, true);
+    // A bubble anchored to a rect is wrong the moment its anchor moves — but
+    // only a scroll of the document or of a box containing the anchor moves
+    // it. A log tailing in another panel must not close the bubble.
+    const onScroll = (e: Event) => {
+      const anchor = parked.current || pending.current;
+      const t = e.target;
+      if (!anchor || !(t instanceof Node) || t === document || t.contains(anchor)) restore();
+    };
+    window.addEventListener("scroll", onScroll, true);
     window.addEventListener("resize", restore);
+    window.addEventListener("blur", restore);
     return () => {
       document.removeEventListener("pointerover", onOver);
       document.removeEventListener("pointerout", onOut);
@@ -136,12 +195,33 @@ export function GlobalTooltip() {
       document.removeEventListener("focusin", onFocus);
       document.removeEventListener("focusout", restore);
       document.removeEventListener("keydown", onKey);
-      window.removeEventListener("scroll", restore, true);
+      window.removeEventListener("scroll", onScroll, true);
       window.removeEventListener("resize", restore);
+      window.removeEventListener("blur", restore);
       restore();
     };
   }, [open, restore]);
 
+  // A control unmounted under a still cursor fires no pointerout: without this
+  // its bubble stays up over whatever replaced it. The same goes for a title
+  // re-rendered under it — the bubble would keep saying the old text, so it
+  // hides and `restore` keeps the new attribute.
+  useEffect(() => {
+    if (!tip) return;
+    const watch = new MutationObserver((records) => {
+      const el = parked.current;
+      if (!el) return;
+      if (
+        !el.isConnected ||
+        records.some((r) => r.type === "attributes" && el.hasAttribute("title"))
+      )
+        restore();
+    });
+    watch.observe(document.body, { childList: true, subtree: true });
+    if (parked.current) watch.observe(parked.current, { attributeFilter: ["title"] });
+    return () => watch.disconnect();
+  }, [tip, restore]);
+
   // Placed after the first paint, when the bubble's real size is known —
   // measuring it is the only way to flip and clamp without guessing.
   useEffect(() => {

client/src/components/__tests__/Tooltip.test.tsx

@@ -10,6 +10,7 @@
 
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { render, screen, fireEvent, act } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import { GlobalTooltip } from "../Tooltip";
 
 function setup(extra?: React.ReactNode) {
@@ -24,6 +25,24 @@ function setup(extra?: React.ReactNode) {
 
 const hover = (el: Element) => fireEvent.pointerOver(el, { bubbles: true });
 const unhover = (el: Element) => fireEvent.pointerOut(el, { bubbles: true });
+// jsdom's :focus-visible is a heuristic over the previous events and leaks
+// between tests, so the tests say which kind of focus they mean: a spy answers
+// `:focus-visible` from this flag and passes every other selector through.
+let keyboardFocus = false;
+const realMatches = Element.prototype.matches;
+beforeEach(() => {
+  keyboardFocus = false;
+  vi.spyOn(Element.prototype, "matches").mockImplementation(function (this: Element, sel) {
+    return sel === ":focus-visible"
+      ? keyboardFocus && document.activeElement === this
+      : realMatches.call(this, sel);
+  });
+});
+afterEach(() => vi.restoreAllMocks());
+const tabTo = (el: HTMLElement) => {
+  keyboardFocus = true;
+  act(() => el.focus());
+};
 
 beforeEach(() => vi.useFakeTimers({ shouldAdvanceTime: true }));
 afterEach(() => vi.useRealTimers());
@@ -63,7 +82,7 @@ describe("GlobalTooltip", () => {
     setup();
     const button = screen.getByRole("button", { name: "refresh" });
 
-    fireEvent.focusIn(button);
+    tabTo(button);
     await act(async () => {
       vi.advanceTimersByTime(0);
     });
@@ -105,4 +124,165 @@ describe("GlobalTooltip", () => {
     await settle();
     expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Refresh the working copy");
   });
+  it("keeps an icon-only control's accessible name while its title is parked", async () => {
+    setup(
+      <button title="Stage this file">
+        <svg aria-hidden="true" />
+      </button>
+    );
+    const icon = screen.getByRole("button", { name: "Stage this file" });
+    tabTo(icon);
+    await act(async () => {
+      vi.advanceTimersByTime(0);
+    });
+    expect(screen.getByTestId("global-tooltip")).toBeInTheDocument();
+    expect(icon).not.toHaveAttribute("title");
+    expect(screen.getByRole("button", { name: "Stage this file" })).toBe(icon);
+
+    fireEvent.keyDown(document, { key: "Escape" });
+    // Put back exactly as found: no aria-label left behind.
+    expect(icon).toHaveAttribute("title", "Stage this file");
+    expect(icon).not.toHaveAttribute("aria-label");
+  });
+
+  it("does not flicker while the pointer crosses the control's own children", async () => {
+    setup(
+      <button title="Two parts">
+        <span data-testid="part-a">a</span>
+        <span data-testid="part-b">b</span>
+      </button>
+    );
+    const a = screen.getByTestId("part-a");
+    const b = screen.getByTestId("part-b");
+    hover(a);
+    await settle();
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Two parts");
+
+    fireEvent.pointerOut(a, { bubbles: true, relatedTarget: b });
+    fireEvent.pointerOver(b, { bubbles: true, relatedTarget: a });
+    // Still up, with no fresh delay.
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Two parts");
+  });
+
+  it("hides when its control is removed from the page", async () => {
+    const { rerender } = render(
+      <>
+        <GlobalTooltip />
+        <button title="Going away">x</button>
+      </>
+    );
+    hover(screen.getByRole("button", { name: "x" }));
+    await settle();
+    expect(screen.getByTestId("global-tooltip")).toBeInTheDocument();
+
+    rerender(
+      <>
+        <GlobalTooltip />
+      </>
+    );
+    await settle();
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+  });
+
+  it("keeps a title React changed while the bubble was up, instead of writing the stale one back", async () => {
+    const { rerender } = render(
+      <>
+        <GlobalTooltip />
+        <button title="Pull 2 commits">pull</button>
+      </>
+    );
+    const button = screen.getByRole("button", { name: "pull" });
+    hover(button);
+    await settle();
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Pull 2 commits");
+
+    // A poll flips the hint while the pointer rests on the control.
+    rerender(
+      <>
+        <GlobalTooltip />
+        <button title="Up to date">pull</button>
+      </>
+    );
+    await settle();
+    // The bubble must not keep advertising the old text.
+    expect(screen.queryByText("Pull 2 commits")).toBeNull();
+
+    unhover(button);
+    expect(button).toHaveAttribute("title", "Up to date");
+  });
+
+  it("leaves no title behind when React removed it while the bubble was up", async () => {
+    const { rerender } = render(
+      <>
+        <GlobalTooltip />
+        <button title="Pull 2 commits">pull</button>
+      </>
+    );
+    const button = screen.getByRole("button", { name: "pull" });
+    hover(button);
+    await settle();
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Pull 2 commits");
+
+    // React "removes" an attribute that is already parked: no MutationRecord.
+    rerender(
+      <>
+        <GlobalTooltip />
+        <button>pull</button>
+      </>
+    );
+    await settle();
+    unhover(button);
+    expect(button).not.toHaveAttribute("title");
+    expect(button).not.toHaveAttribute("data-tip");
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+  });
+
+  it("does not open on the focus a mouse click gives, only on keyboard focus", async () => {
+    const user = userEvent.setup({ advanceTimers: vi.advanceTimersByTime });
+    setup(<button title="Second control">second</button>);
+    // A click is pointer focus: :focus-visible does not match.
+    const button = screen.getByRole("button", { name: "refresh" });
+
+    await user.click(button);
+    await act(async () => {
+      vi.advanceTimersByTime(0);
+    });
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+
+    tabTo(screen.getByRole("button", { name: "second" }));
+    await act(async () => {
+      vi.advanceTimersByTime(0);
+    });
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Second control");
+  });
+
+  it("stays up when an unrelated panel scrolls, and hides when the anchor's own scroller moves", async () => {
+    render(
+      <>
+        <GlobalTooltip />
+        <div data-testid="scroller">
+          <button title="Inside the scroller">inside</button>
+        </div>
+        <div data-testid="elsewhere" />
+      </>
+    );
+    const button = screen.getByRole("button", { name: "inside" });
+    hover(button);
+    await settle();
+
+    fireEvent.scroll(screen.getByTestId("elsewhere"));
+    expect(screen.getByTestId("global-tooltip")).toHaveTextContent("Inside the scroller");
+
+    fireEvent.scroll(screen.getByTestId("scroller"));
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+    expect(button).toHaveAttribute("title", "Inside the scroller");
+  });
+
+  it("hides when the document itself scrolls", async () => {
+    setup();
+    hover(screen.getByRole("button", { name: "refresh" }));
+    await settle();
+    fireEvent.scroll(document);
+    expect(screen.queryByTestId("global-tooltip")).toBeNull();
+  });
 });

client/src/components/lanes/AddLaneModal.tsx

@@ -27,18 +27,6 @@ import { api } from "../../lib/api";
 import type { AiRouter, CwdSuggestion } from "../../lib/api";
 import type { Lane, LaneTool, LaneWorktree } from "../../lib/types";
 
-/** Mirrors server/lib/worktree.js `slugify`, for the branch-name PREVIEW only.
- *  Nothing is sent from it: an empty branch field means "let the server name
- *  it", which is how `LANE_BRANCH_PREFIX` keeps working. */
-function slugPreview(title: string) {
-  return title
-    .toLowerCase()
-    .normalize("NFKD")
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 40);
-}
-
 /** Polls the lane until the background `git worktree add` finishes (status
  *  leaves "provisioning"), or gives up after `timeoutMs`. Returns the final
  *  lane record, or `null` on timeout. */
@@ -589,12 +577,10 @@ export function AddLaneModal({
                     id="add-lane-branch"
                     value={branch}
                     onChange={(e) => setBranch(e.target.value)}
-                    // The placeholder is what the SERVER will name the branch
-                    // if this is left empty, so the default is visible without
-                    // the form having to duplicate LANE_BRANCH_PREFIX.
-                    placeholder={
-                      title.trim() ? `feat/${slugPreview(title)}` : t("addLaneBranchPlaceholder")
-                    }
+                    // Neutral on purpose: an empty field lets the SERVER name
+                    // the branch, under a LANE_BRANCH_PREFIX this form cannot
+                    // see, so any `feat/…` preview here could be wrong.
+                    placeholder={t("addLaneBranchPlaceholder")}
                     className="w-full rounded-md border border-border-light bg-surface-0 px-3 py-1.5 font-mono text-xs text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none"
                   />
                   <p className="mt-1 text-[10px] text-fg-muted">{t("addLaneBranchHintAuto")}</p>

client/src/components/lanes/LaneCard.tsx

@@ -1,5 +1,5 @@
 /**
- * @file One lane's card: branch/CI/PR facts, the "needs you"
+ * @file One lane's card: CI/PR facts, the "needs you"
  * banner sourced from Claude Code's Notification hook, and (for managed
  * lanes only) a ⋯ menu holding the rare `reset worktree` action behind
  * DestructiveLaneModal. A dead lane (its driving session went silent while
@@ -16,74 +16,33 @@
  * install / MCP sync / dev-sync check / create-update readme) and the
  * remove-lane button live in Workspace's page header / pipeline-picker row
  * instead of here, so they stay reachable and un-clipped regardless of this
- * card's own scroll area.
+ * card's own scroll area. The working copy — branch, uncommitted counts, the
+ * git action bar — is not here either: it heads the Changes panel
+ * (`LaneGitHeader`), beside the diff it describes.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-import { useCallback, useEffect, useLayoutEffect, useRef, useState } from "react";
-import { createPortal } from "react-dom";
+import { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { DestructiveLaneModal } from "./DestructiveLaneModal";
-import { LaneGitBar } from "./LaneGitBar";
 import { api } from "../../lib/api";
 import { eventBus } from "../../lib/eventBus";
 import { keepIfSame } from "../../lib/keepIfSame";
 import type { AiRouter } from "../../lib/api";
-import type { Lane, LaneGitFacts, LaneGitFile, LaneRuntime, NamedLock } from "../../lib/types";
+import type { Lane, LaneRuntime, NamedLock } from "../../lib/types";
 
-/** How often a mounted card re-reads its working-copy facts. Slow on purpose:
- *  each call is five git subprocesses server-side, and a branch name does not
- *  change on the timescale the lane list is polled at. */
-const GIT_REFRESH_MS = 30_000;
-
-/** How often a mounted card re-probes its stack. Faster than the git refresh
- *  because a stack dying is exactly what the user needs to see, and slower than
+/** How often a mounted card re-probes its stack. Faster than the Changes panel's
+ *  git refresh because a stack dying is exactly what the user needs to see, and slower than
  *  the lane poll because each call opens a socket per declared port. */
 const RUNTIME_REFRESH_MS = 10_000;
 
 /** How often a mounted card re-reads locks held by this lane. Same refresh rate
- *  as the git facts (slow, since lock state changes infrequently). */
+ *  as the Changes panel's git facts (slow, since lock state changes infrequently). */
 const LOCKS_REFRESH_MS = 30_000;
 
-/**
- * The lane's own working copy, fetched per card rather than folded into the
- * polled lane list. Absent facts are not an error state: a lane may point at a
- * plain directory, and it renders as a card without a git row.
- */
-function useLaneGitFacts(laneId: number): [LaneGitFacts | null, () => void] {
-  const [facts, setFacts] = useState<LaneGitFacts | null>(null);
-  // Bumped by the git action bar: a commit or a pull changes every fact on
-  // this row, and waiting out the 30s poll makes the button look inert.
-  const [nonce, setNonce] = useState(0);
-
-  useEffect(() => {
-    let alive = true;
-    const read = () => {
-      api.lanes
-        .git(laneId)
-        .then((f) => {
-          if (alive) setFacts(keepIfSame(f));
-        })
-        .catch(() => {
-          // Silent: a card that cannot read git shows the rest of itself. An
-          // error banner here would fire on every lane on every server blip.
-          if (alive) setFacts(keepIfSame<LaneGitFacts>({ available: false }));
-        });
-    };
-    read();
-    const timer = setInterval(read, GIT_REFRESH_MS);
-    return () => {
-      alive = false;
-      clearInterval(timer);
-    };
-  }, [laneId, nonce]);
-
-  return [facts, () => setNonce((n) => n + 1)];
-}
-
 /**
  * The lane's own application stack. Same shape and same silence as the git
- * facts above: a lane without a `.agenthub/profile` simply has no runtime row, which
+ * facts in LaneGitHeader: a lane without a `.agenthub/profile` simply has no runtime row, which
  * is the common case and not an error worth a banner.
  *
  * `bump` lets an up/down action re-read immediately instead of waiting out the
@@ -191,7 +150,7 @@ export function LaneRouterRow({ lane }: { lane: Lane }) {
         if (alive) setRouters(r.items);
       })
       .catch(() => {
-        // Silent, same contract as the git/runtime pollers above: a card that
+        // Silent, same contract as the runtime poller above: a card that
         // cannot list routers simply shows no router row.
         if (alive) setRouters([]);
       });
@@ -473,147 +432,11 @@ export function LaneToolsMenu({ lane }: { lane: Lane }) {
   );
 }
 
-/** Porcelain status code -> the letter shown and the colour it is shown in.
- *  Keyed on the code's first meaningful character, so an index-side change
- *  (`M `), a worktree-side one (` M`) and both (`MM`) read the same. */
-const GIT_STATUS_STYLE: Record<string, string> = {
-  M: "text-status-warning",
-  A: "text-status-success",
-  D: "text-status-danger",
-  R: "text-accent",
-  C: "text-accent",
-  U: "text-status-danger",
-  "?": "text-fg-muted",
-};
-
-/**
- * The file list behind a lane's uncommitted counts: which files, what happened
- * to each, and how many lines it gained and lost.
- *
- * It replaced a native `title` tooltip, which could show the same paths but
- * neither colour them nor align the deltas — and a plain porcelain dump is not
- * something you read at a glance.
- *
- * PORTALLED to `document.body` and `position: fixed`, for the same reason this
- * file's own header says the tools dropdown was moved out of the card: a lane
- * card renders inside the Workspace's `max-h-[45vh] overflow-y-auto` box, and
- * an absolutely positioned panel would be clipped by it for every card that is
- * not at the very top. It flips above its anchor rather than off the bottom of
- * the window, and clamps to the right edge.
- */
-function LaneGitFilesPanel({
-  files,
-  hidden,
-  anchor,
-  onPointerEnter,
-  onPointerLeave,
-}: {
-  files: LaneGitFile[];
-  hidden: number;
-  /** The counts button this panel hangs off. */
-  anchor: HTMLElement | null;
-  onPointerEnter: () => void;
-  onPointerLeave: () => void;
-}) {
-  const { t } = useTranslation(["lanes"]);
-  const panelRef = useRef<HTMLDivElement>(null);
-  const [pos, setPos] = useState<{ top: number; left: number } | null>(null);
-
-  // After the first paint, when the panel's real height is known: place it
-  // under the anchor, or above it when that would run off the bottom.
-  useLayoutEffect(() => {
-    if (!anchor || !panelRef.current) return;
-    const a = anchor.getBoundingClientRect();
-    const p = panelRef.current.getBoundingClientRect();
-    const gap = 4;
-    const top =
-      a.bottom + gap + p.height > window.innerHeight ? a.top - p.height - gap : a.bottom + gap;
-    setPos({
-      top: Math.max(8, top),
-      left: Math.max(8, Math.min(a.left, document.documentElement.clientWidth - p.width - 8)),
-    });
-  }, [anchor, files]);
-  // Totals are over the LISTED files only — the cap means the rest are unknown,
-  // and a total that silently omits them would be a wrong number rather than a
-  // partial one. `hidden` says how many are missing.
-  const added = files.reduce((n, f) => n + (f.added ?? 0), 0);
-  const deleted = files.reduce((n, f) => n + (f.deleted ?? 0), 0);
-
-  return createPortal(
-    <div
-      ref={panelRef}
-      data-testid="lane-git-files"
-      role="group"
-      aria-label={t("git.filesHeading", { count: files.length })}
-      // The pointer has to be able to travel INTO the panel to scroll it, so
-      // the panel answers the same enter/leave pair the trigger does.
-      onMouseEnter={onPointerEnter}
-      onMouseLeave={onPointerLeave}
-      style={{
-        position: "fixed",
-        zIndex: 60,
-        top: pos?.top ?? 0,
-        left: pos?.left ?? 0,
-        // Hidden for the one frame before it has been measured, so it never
-        // flashes at the top-left corner.
-        visibility: pos ? "visible" : "hidden",
-      }}
-      className="max-h-72 w-[22rem] max-w-[calc(100vw-1rem)] overflow-y-auto rounded-md border border-border bg-surface-1 p-2 shadow-lg"
-    >
-      <div className="mb-1.5 flex items-baseline gap-2 border-b border-border pb-1.5 text-[11px]">
-        <span className="text-fg-secondary">{t("git.filesHeading", { count: files.length })}</span>
-        <span className="ml-auto shrink-0 font-mono tabular-nums">
-          <span className="text-status-success">+{added}</span>{" "}
-          <span className="text-status-danger">−{deleted}</span>
-        </span>
-      </div>
-      <ul className="space-y-0.5 font-mono text-[11px]">
-        {files.map((f) => {
-          const code = f.status.trim()[0] || "?";
-          return (
-            <li key={f.path} className="flex items-baseline gap-2">
-              <span
-                className={`w-3 shrink-0 font-semibold ${GIT_STATUS_STYLE[code] || "text-fg-muted"}`}
-                title={f.status}
-              >
-                {code}
-              </span>
-              {/* The DIRECTORY truncates, never the filename: the name is what
-                  you scan for, the path is only there to disambiguate it. */}
-              <span className="flex min-w-0 flex-1 items-baseline" title={f.path}>
-                <span className="truncate text-fg-muted">{f.path.replace(/[^/]+$/, "")}</span>
-                <span className="shrink-0 text-fg-primary">{f.path.split("/").pop()}</span>
-              </span>
-              <span className="shrink-0 tabular-nums">
-                {f.added === null && f.deleted === null ? (
-                  <span className="text-fg-muted">{t("git.noDelta")}</span>
-                ) : (
-                  <>
-                    <span className="text-status-success">+{f.added ?? 0}</span>{" "}
-                    <span className="text-status-danger">−{f.deleted ?? 0}</span>
-                  </>
-                )}
-              </span>
-            </li>
-          );
-        })}
-      </ul>
-      {hidden > 0 && (
-        <p className="mt-1.5 border-t border-border pt-1.5 text-[10px] text-fg-muted">
-          {t("git.filesMore", { count: hidden })}
-        </p>
-      )}
-    </div>,
-    document.body
-  );
-}
-
 export default function LaneCard({
   lane,
   onAction,
   childWorktrees,
   onSelectLane,
-  onNewLaneFromRepo,
 }: {
   lane: Lane;
   onAction: (action: string, body?: Record<string, unknown>) => void;
@@ -623,31 +446,12 @@ export default function LaneCard({
   childWorktrees?: Lane[];
   /** Jumps the Workspace page's selection to another lane's card. */
   onSelectLane?: (id: number) => void;
-  /** Opens the Add-lane flow prefilled with this lane's repo, for a sibling
-   *  worktree on `branch`. Omitted where that flow is not reachable. */
-  onNewLaneFromRepo?: (repo: string, branch?: string) => void;
 }) {
   const { t } = useTranslation(["lanes"]);
   const [destructiveAction, setDestructiveAction] = useState<"reset" | null>(null);
   const [menuOpen, setMenuOpen] = useState(false);
   const [runtimeBump, setRuntimeBump] = useState(0);
   const [bootLine, setBootLine] = useState<string | null>(null);
-  const [filesOpen, setFilesOpen] = useState(false);
-  const [countsAnchor, setCountsAnchor] = useState<HTMLButtonElement | null>(null);
-  // Closing is DELAYED: the panel is portalled away from the trigger, so the
-  // pointer leaves the trigger before it can land on the panel it is heading
-  // for. Any enter — trigger or panel — cancels the pending close.
-  const filesCloseTimer = useRef<number | undefined>(undefined);
-  const openFiles = useCallback(() => {
-    window.clearTimeout(filesCloseTimer.current);
-    setFilesOpen(true);
-  }, []);
-  const closeFiles = useCallback(() => {
-    window.clearTimeout(filesCloseTimer.current);
-    filesCloseTimer.current = window.setTimeout(() => setFilesOpen(false), 150);
-  }, []);
-  useEffect(() => () => window.clearTimeout(filesCloseTimer.current), []);
-  const [git, refreshGit] = useLaneGitFacts(lane.id);
   const runtime = useLaneRuntime(lane.id, runtimeBump);
   const locks = useLaneLocks(lane.slot);
 
@@ -676,7 +480,9 @@ export default function LaneCard({
     <>
       <div
         data-testid={`lane-card-${lane.id}`}
-        className="flex flex-col rounded-lg border border-border bg-surface-4 p-2.5 transition-colors hover:border-border-light"
+        // Every row below is conditional: a lane with nothing to report
+        // renders no frame at all rather than an empty box.
+        className="flex flex-col rounded-lg border border-border bg-surface-4 p-2.5 transition-colors hover:border-border-light empty:hidden"
       >
         {(lane.ci_status || lane.tool === "codex") && (
           <div className="mb-2 flex flex-wrap items-center gap-1.5 text-[11px]">
@@ -693,11 +499,8 @@ export default function LaneCard({
           </div>
         )}
 
-        {lane.needs_action && (
-          <div className="mb-2 rounded border border-status-warning/50 bg-status-warning/10 px-2 py-1 text-xs text-status-warning">
-            ⚠ {lane.needs_action}
-          </div>
-        )}
+        {/* No needs-you banner here: the strip card already flags it, and the
+            console directly below is where the prompt actually waits. */}
 
         {/* Runtime strip: the lane's own app stack, shown only for lanes that
             declare a profile. A port that drifted from `base + slot` is called
@@ -773,73 +576,6 @@ export default function LaneCard({
           </div>
         )}
 
-        {/* One line, because every part of it is short and the panel is
-            narrow: branch, head, subject, and the uncommitted counts read as a
-            sentence rather than a four-row block. The cwd is NOT here — the
-            lane-detail header above this card already spells it out. */}
-        {git?.available && (
-          <div className="mb-2">
-            <div
-              data-testid="lane-git"
-              className="flex items-baseline gap-2 truncate font-mono text-[11px] text-fg-secondary"
-              title={git.subject}
-            >
-              <span className="shrink-0">⑂ {git.branch}</span>
-              <span className="shrink-0 text-fg-muted">{git.head}</span>
-              <span className="truncate text-fg-muted">{git.subject}</span>
-              {(git.dirty > 0 || git.untracked > 0) && (
-                <button
-                  type="button"
-                  ref={setCountsAnchor}
-                  data-testid="lane-git-counts"
-                  aria-expanded={filesOpen}
-                  onMouseEnter={openFiles}
-                  onMouseLeave={closeFiles}
-                  // Focus and click open it too: hover is not a gesture a
-                  // keyboard or a touchscreen has.
-                  onFocus={openFiles}
-                  onBlur={closeFiles}
-                  onClick={() => setFilesOpen((v) => !v)}
-                  className="shrink-0 cursor-help text-status-warning/80 underline decoration-dotted underline-offset-2"
-                >
-                  {t("git.uncommitted", { dirty: git.dirty, untracked: git.untracked })}
-                </button>
-              )}
-            </div>
-            {filesOpen && git.files?.length > 0 && (
-              <LaneGitFilesPanel
-                files={git.files}
-                hidden={git.dirty + git.untracked - git.files.length}
-                anchor={countsAnchor}
-                onPointerEnter={openFiles}
-                onPointerLeave={closeFiles}
-              />
-            )}
-          </div>
-        )}
-        {git?.available && (
-          <LaneGitBar
-            laneId={lane.id}
-            git={git}
-            onChanged={refreshGit}
-            /* A sibling worktree forks from the lane's SOURCE repo when it
-               has one (this lane is itself a worktree of it); an adopted lane
-               is its own repo. */
-            onNewLane={
-              onNewLaneFromRepo
-                ? (branch) => onNewLaneFromRepo(lane.source_repo || lane.cwd, branch)
-                : undefined
-            }
-          />
-        )}
-        {/* The lane's own recorded branch, shown only when git could not be
-            read — otherwise it duplicates the live branch above. */}
-        {!git?.available && lane.branch && (
-          <div className="mb-2 truncate font-mono text-[11px] text-fg-secondary">
-            ⑂ {lane.branch}
-          </div>
-        )}
-
         {childWorktrees && childWorktrees.length > 0 && (
           <div
             data-testid="lane-child-worktrees"
@@ -854,7 +590,7 @@ export default function LaneCard({
                   <button
                     type="button"
                     onClick={() => onSelectLane?.(w.id)}
-                    className="truncate text-left text-blue-400 hover:underline"
+                    className="truncate text-left text-blue-700 dark:text-blue-400 hover:underline"
                     title={w.cwd}
                   >
                     #{w.id} {w.title || w.cwd} · {w.status}

client/src/components/lanes/LaneDiffView.tsx

@@ -13,11 +13,25 @@
  *   - Line pairing for split view happens here, on the rows the server already
  *     numbered. The server stays the single source of what changed; this file
  *     only decides how it looks.
+ * Past `WINDOW_THRESHOLD` rows a view renders only the rows on screen (plus an
+ * overscan) between two spacers. Rows never wrap — the box scrolls sideways —
+ * so every windowed row is pinned to `ROW_PX` and the range is pure arithmetic
+ * (`visibleRange`); the content's min-width comes from the longest line, so
+ * the horizontal extent does not jump as rows come and go.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-import { useCallback, useRef } from "react";
+import {
+  createContext,
+  useContext,
+  useMemo,
+  useRef,
+  useState,
+  type CSSProperties,
+  type ReactNode,
+} from "react";
 import { useTranslation } from "react-i18next";
+import { ChevronDown, ChevronUp } from "lucide-react";
 import { canonicalLang, highlight, tokenClass } from "../../lib/highlight";
 import type { LaneChangeFile, LaneDiffHunk, LaneDiffLine } from "../../lib/types";
 
@@ -25,11 +39,125 @@ export type DiffLayout = "unified" | "split";
 
 /**
  * How tall a diff box may be. `fill` (the single-file view) takes the height
- * its parent gives it; otherwise — the review list, which stacks many files —
- * each file is capped so its own horizontal scrollbar stays on screen.
+ * its parent gives it. In the review list, which stacks many files, a diff
+ * grows to its full height so the PANEL is the one vertical scroller — a
+ * 60vh box per file nested inside it made hunk navigation scroll two boxes
+ * at once and land nowhere predictable. Only a windowed diff (above
+ * WINDOW_THRESHOLD rows) keeps the cap, because windowing needs its own
+ * scroller.
  */
-function boxHeight(fill: boolean) {
-  return fill ? "min-h-0 flex-1" : "max-h-[60vh]";
+function boxHeight(fill: boolean, windowed: boolean) {
+  return fill ? "min-h-0 flex-1" : windowed ? "max-h-[60vh]" : "";
+}
+
+/**
+ * Bring `el` to the top of the scroller that actually scrolls it, below
+ * `pad` px of sticky header. Not `scrollIntoView`: that moves EVERY scrolling
+ * ancestor, the page included.
+ */
+function scrollToTop(el: HTMLElement, pad: number) {
+  let s = el.parentElement;
+  while (
+    s &&
+    !(s.scrollHeight > s.clientHeight && /auto|scroll/.test(getComputedStyle(s).overflowY))
+  )
+    s = s.parentElement;
+  if (!s) return;
+  s.scrollTop += el.getBoundingClientRect().top - s.getBoundingClientRect().top - pad;
+}
+
+/** Rows above which a view windows; at or below it renders exactly as before. */
+export const WINDOW_THRESHOLD = 500;
+/** A windowed row's pinned height — the rows' own 11px × 1.45 line box, rounded. */
+export const ROW_PX = 16;
+const OVERSCAN = 20;
+const FIXED: CSSProperties = { height: ROW_PX };
+
+/**
+ * The `[start, end)` item range to render for a scroll position. `scrollTop`
+ * is clamped to the content first, so a stale offset (content that shrank, a
+ * layout switch) still lands on real rows instead of an empty window.
+ */
+export function visibleRange(
+  scrollTop: number,
+  viewport: number,
+  rowHeight: number,
+  count: number,
+  overscan: number
+) {
+  const top = Math.min(Math.max(0, scrollTop), Math.max(0, count * rowHeight - viewport));
+  const start = Math.max(0, Math.floor(top / rowHeight) - overscan);
+  const end = Math.min(count, Math.ceil((top + viewport) / rowHeight) + overscan);
+  return { start: Math.min(start, end), end };
+}
+
+/**
+ * Windowing state for one scroller of `count` items. Off (the whole range)
+ * at or below the threshold.
+ */
+function useWindow(count: number) {
+  const [top, setTop] = useState(0);
+  const on = count > WINDOW_THRESHOLD;
+  // The offset is tracked even while windowing is off, so a diff that GROWS
+  // past the threshold (expanded context) windows where the reader is, not at
+  // row 0. A ref, so an unwindowed diff does not re-render on every scroll.
+  const lastTop = useRef(0);
+  // count 0 = no scroller here (split layout): the browser drops its offset,
+  // so coming back to unified must start from 0, not the pre-split row.
+  if (count === 0) lastTop.current = 0;
+  const [wasOn, setWasOn] = useState(on);
+  if (wasOn !== on) {
+    setWasOn(on);
+    setTop(on ? lastTop.current : 0);
+  }
+  // ponytail: the viewport is taken as the window height — never smaller than
+  // a box that lives inside the window, so it only over-renders a few dozen
+  // rows, and it needs no ResizeObserver to follow a panel resize.
+  const range = on
+    ? visibleRange(top, window.innerHeight, ROW_PX, count, OVERSCAN)
+    : { start: 0, end: count };
+  const onScroll = (el: HTMLElement) => {
+    lastTop.current = el.scrollTop;
+    if (on) setTop(el.scrollTop);
+  };
+  return { on, range, onScroll };
+}
+
+/** Columns a line occupies under `whitespace-pre` (a tab counted at its widest). */
+function longest(texts: Iterable<string>) {
+  let max = 0;
+  for (const t of texts) {
+    let n = t.length;
+    for (let i = t.indexOf("\t"); i !== -1; i = t.indexOf("\t", i + 1)) n += 7;
+    if (n > max) max = n;
+  }
+  return max;
+}
+
+/** Stands in for `rows` off-screen rows. */
+function Spacer({ rows }: { rows: number }) {
+  return rows > 0 ? <div data-diff-spacer aria-hidden style={{ height: rows * ROW_PX }} /> : null;
+}
+
+/** A windowed list: spacer, the rendered slice, spacer, at a stable width. */
+function Windowed({
+  count,
+  range,
+  minWidth,
+  children,
+}: {
+  count: number;
+  range: { start: number; end: number };
+  minWidth: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <div data-diff-content style={{ minWidth }}>
+      <Spacer rows={range.start} />
+      {children}
+      <Spacer rows={count - range.end} />
+    </div>
+  );
 }
 
 /** Language tag for a path, for the tokenizer. Unknown ones render plain. */
@@ -86,26 +214,51 @@ function emphasis(
   };
 }
 
-/** Pair each run of removed lines with the run of added lines following it. */
-function pairs(
-  lines: LaneDiffLine[]
-): Array<{ left: LaneDiffLine | null; right: LaneDiffLine | null }> {
-  const out: Array<{ left: LaneDiffLine | null; right: LaneDiffLine | null }> = [];
+type PairRow = { left: LaneDiffLine | null; right: LaneDiffLine | null; emph: EmphPair | null };
+type EmphPair = { del: [number, number]; add: [number, number] };
+/** A hunk's split-view rows plus each paired line's emphasis, keyed by its
+ *  index in `hunk.lines` (what the unified view renders by). */
+type Analysed = { rows: PairRow[]; emph: Map<number, [number, number]> };
+
+// Keyed by the hunk object: a hunk is immutable once fetched, so both split
+// columns and every re-render of the same data share one pass. A refetch
+// brings new objects and the old entries go with them.
+const analysed = new WeakMap<LaneDiffHunk, Analysed>();
+
+/** Pair each run of removed lines with the run of added lines following it,
+ *  carrying indices so emphasis lands without searching the hunk again. */
+export function analyseHunk(hunk: LaneDiffHunk): Analysed {
+  const hit = analysed.get(hunk);
+  if (hit) return hit;
+  const lines = hunk.lines;
+  const rows: PairRow[] = [];
+  const emph = new Map<number, [number, number]>();
   for (let i = 0; i < lines.length; ) {
     const line = lines[i]!;
     if (line.type === "ctx") {
-      out.push({ left: line, right: line });
+      rows.push({ left: line, right: line, emph: null });
       i += 1;
       continue;
     }
-    const dels: LaneDiffLine[] = [];
-    const adds: LaneDiffLine[] = [];
-    while (i < lines.length && lines[i]!.type === "del") dels.push(lines[i++]!);
-    while (i < lines.length && lines[i]!.type === "add") adds.push(lines[i++]!);
-    for (let k = 0; k < Math.max(dels.length, adds.length); k += 1) {
-      out.push({ left: dels[k] ?? null, right: adds[k] ?? null });
+    const delStart = i;
+    while (i < lines.length && lines[i]!.type === "del") i += 1;
+    const addStart = i;
+    while (i < lines.length && lines[i]!.type === "add") i += 1;
+    const dels = addStart - delStart;
+    const adds = i - addStart;
+    for (let k = 0; k < Math.max(dels, adds); k += 1) {
+      const left = k < dels ? lines[delStart + k]! : null;
+      const right = k < adds ? lines[addStart + k]! : null;
+      const e = left && right ? emphasis(left.text, right.text) : null;
+      if (e) {
+        emph.set(delStart + k, e.del);
+        emph.set(addStart + k, e.add);
+      }
+      rows.push({ left, right, emph: e });
     }
   }
+  const out = { rows, emph };
+  analysed.set(hunk, out);
   return out;
 }
 
@@ -115,9 +268,26 @@ function Gutter({ n }: { n: number | null }) {
   );
 }
 
-/** A diff row. `w-max min-w-full` so the tint still spans a scrolled-open row. */
-function Row({ tint, children }: { tint: string; children: React.ReactNode }) {
-  return <div className={`flex w-max min-w-full ${tint}`}>{children}</div>;
+/** A diff row. `w-max min-w-full` so the tint still spans a scrolled-open row.
+ *  `style` pins a windowed row's height; unwindowed rows carry none. */
+function Row({
+  tint,
+  style,
+  children,
+}: {
+  tint: string;
+  style?: CSSProperties;
+  children: React.ReactNode;
+}) {
+  return (
+    <div
+      className={`flex w-max min-w-full ${tint}`}
+      style={style}
+      data-diff-item={style ? "" : undefined}
+    >
+      {children}
+    </div>
+  );
 }
 
 /** A /20 fill plus a 3px status bar at the row's left edge, so +/- rows still
@@ -135,44 +305,199 @@ function markerClass(type: LaneDiffLine["type"]) {
   return "text-fg-muted";
 }
 
-function HunkHeader({ hunk }: { hunk: LaneDiffHunk }) {
-  const at = hunk.header.split("@@")[1];
+/** Per-hunk review controls (Undo / Keep), drawn in a bar under each hunk's
+ *  last changed line. A context rather than a prop because lines render from
+ *  four places; `hunks` is what the bar's "n of N" and its arrows walk. */
+const HunkActions = createContext<{
+  actions: (hunk: LaneDiffHunk) => ReactNode;
+  hunks: LaneDiffHunk[];
+  go: (index: number) => void;
+} | null>(null);
+
+/** Index of a hunk's last +/- line (unified), or last row with one (split). */
+function lastChangedLine(hunk: LaneDiffHunk) {
+  for (let i = hunk.lines.length - 1; i >= 0; i -= 1) {
+    if (hunk.lines[i]!.type !== "ctx") return i;
+  }
+  return -1;
+}
+function lastChangedRow(hunk: LaneDiffHunk) {
+  const rows = analyseHunk(hunk).rows;
+  for (let i = rows.length - 1; i >= 0; i -= 1) {
+    const r = rows[i]!;
+    if ((r.left && r.left.type !== "ctx") || (r.right && r.right.type !== "ctx")) return i;
+  }
+  return -1;
+}
+
+/** The review bar: hangs just BELOW the last changed line, pinned to the
+ *  visible right edge, so it sits on the change it acts on — the editor-style
+ *  "^ v 2 of 3 · Undo · Keep" instead of glyphs at the end of the `@@` line. */
+function HunkBar({ hunk }: { hunk: LaneDiffHunk }) {
+  const { t } = useTranslation(["lanes"]);
+  const ctx = useContext(HunkActions);
+  if (!ctx) return null;
+  const index = ctx.hunks.indexOf(hunk);
+  const total = ctx.hunks.length;
+  const nav =
+    "rounded px-0.5 text-fg-muted hover:bg-surface-3 hover:text-fg-primary disabled:opacity-30";
   return (
-    <div className="bg-surface-2 px-2 py-0.5 text-[10px] text-fg-muted">
-      {at ? `@@${at}@@` : hunk.header}
-      {hunk.context ? ` ${hunk.context}` : ""}
+    <span className="sticky right-2 z-10 ml-auto h-0 w-0 self-start">
+      <span
+        data-testid="lane-hunk-bar"
+        className="absolute right-0 top-[18px] flex items-center gap-1 whitespace-nowrap rounded border border-border-light bg-surface-1 px-1 py-0.5 font-sans text-[10px] leading-[14px] text-fg-secondary shadow-card"
+      >
+        <button
+          type="button"
+          aria-label={t("changes.prevHunk")}
+          title={t("changes.prevHunk")}
+          disabled={index <= 0}
+          onClick={() => ctx.go(index - 1)}
+          className={nav}
+        >
+          <ChevronUp className="h-3 w-3" />
+        </button>
+        <button
+          type="button"
+          aria-label={t("changes.nextHunk")}
+          title={t("changes.nextHunk")}
+          disabled={index >= total - 1}
+          onClick={() => ctx.go(index + 1)}
+          className={nav}
+        >
+          <ChevronDown className="h-3 w-3" />
+        </button>
+        <span className="px-0.5 tabular-nums text-fg-muted">
+          {t("changes.hunkOf", { n: index + 1, total })}
+        </span>
+        {ctx.actions(hunk)}
+      </span>
+    </span>
+  );
+}
+
+function HunkHeader({ hunk, fixed }: { hunk: LaneDiffHunk; fixed?: boolean }) {
+  const ctx = useContext(HunkActions);
+  const at = hunk.header.split("@@")[1];
+  // Windowed, the header is one ROW_PX row like the lines around it.
+  return (
+    <div
+      className={`flex items-center gap-2 bg-surface-2 px-2 text-[10px] text-fg-muted ${
+        fixed ? "overflow-hidden whitespace-nowrap leading-4" : "py-0.5"
+      }`}
+      style={fixed ? FIXED : undefined}
+      data-diff-item={fixed ? "" : undefined}
+      data-hunk-index={ctx ? ctx.hunks.indexOf(hunk) : undefined}
+    >
+      <span className="min-w-0 flex-1 truncate">
+        {at ? `@@${at}@@` : hunk.header}
+        {hunk.context ? ` ${hunk.context}` : ""}
+      </span>
     </div>
   );
 }
 
+function UnifiedLine({
+  line,
+  lang,
+  emph,
+  style,
+  bar,
+}: {
+  line: LaneDiffLine;
+  lang: string;
+  emph?: [number, number];
+  style?: CSSProperties;
+  /** This is the hunk's last changed line: hang the review bar under it. */
+  bar?: LaneDiffHunk;
+}) {
+  return (
+    <Row tint={rowTint(line.type)} style={style}>
+      <Gutter n={line.oldLine} />
+      <Gutter n={line.newLine} />
+      <span className="whitespace-pre px-2">
+        <span className={`select-none ${markerClass(line.type)}`}>
+          {line.type === "add" ? "+" : line.type === "del" ? "-" : " "}
+        </span>
+        <Code text={line.text} lang={lang} emph={emph} />
+      </span>
+      {bar && <HunkBar hunk={bar} />}
+    </Row>
+  );
+}
+
 function UnifiedHunk({ hunk, lang }: { hunk: LaneDiffHunk; lang: string }) {
-  const emph = new Map<number, [number, number]>();
-  for (const { left, right } of pairs(hunk.lines)) {
-    if (!left || !right || left.type !== "del" || right.type !== "add") continue;
-    const e = emphasis(left.text, right.text);
-    if (!e) continue;
-    emph.set(hunk.lines.indexOf(left), e.del);
-    emph.set(hunk.lines.indexOf(right), e.add);
-  }
+  const { emph } = analyseHunk(hunk);
+  const last = lastChangedLine(hunk);
   return (
     <div>
       <HunkHeader hunk={hunk} />
       {hunk.lines.map((line, i) => (
-        <Row key={i} tint={rowTint(line.type)}>
-          <Gutter n={line.oldLine} />
-          <Gutter n={line.newLine} />
-          <span className="whitespace-pre px-2">
-            <span className={`select-none ${markerClass(line.type)}`}>
-              {line.type === "add" ? "+" : line.type === "del" ? "-" : " "}
-            </span>
-            <Code text={line.text} lang={lang} emph={emph.get(i)} />
-          </span>
-        </Row>
+        <UnifiedLine
+          key={i}
+          line={line}
+          lang={lang}
+          emph={emph.get(i)}
+          bar={i === last ? hunk : undefined}
+        />
       ))}
     </div>
   );
 }
 
+/** One windowable item: a hunk's header (`i < 0`) or its i-th row — a line in
+ *  unified, a paired row in split. */
+type Item = { hunk: LaneDiffHunk; i: number };
+
+function flatten(hunks: LaneDiffHunk[], layout: DiffLayout): Item[] {
+  const out: Item[] = [];
+  for (const hunk of hunks) {
+    out.push({ hunk, i: -1 });
+    const n = layout === "split" ? analyseHunk(hunk).rows.length : hunk.lines.length;
+    for (let i = 0; i < n; i += 1) out.push({ hunk, i });
+  }
+  return out;
+}
+
+function longestInHunks(hunks: LaneDiffHunk[]) {
+  return longest(
+    (function* () {
+      for (const h of hunks) for (const l of h.lines) yield l.text;
+    })()
+  );
+}
+
+function SplitLine({
+  row,
+  lang,
+  side,
+  style,
+  bar,
+}: {
+  row: PairRow;
+  lang: string;
+  side: "left" | "right";
+  style?: CSSProperties;
+  bar?: LaneDiffHunk;
+}) {
+  const line = side === "left" ? row.left : row.right;
+  return (
+    <Row tint={rowTint(line?.type ?? null)} style={style}>
+      <Gutter n={(side === "left" ? line?.oldLine : line?.newLine) ?? null} />
+      <span className="whitespace-pre px-1">
+        {line ? (
+          <Code
+            text={line.text}
+            lang={lang}
+            emph={side === "left" ? row.emph?.del : row.emph?.add}
+          />
+        ) : null}
+      </span>
+      {bar && <HunkBar hunk={bar} />}
+    </Row>
+  );
+}
+
 /** One side of the split view: a hunk header, then that side's rows. */
 function SplitColumn({
   hunks,
@@ -188,52 +513,121 @@ function SplitColumn({
       {hunks.map((hunk, h) => (
         <div key={`${hunk.header}:${h}`}>
           <HunkHeader hunk={hunk} />
-          {pairs(hunk.lines).map(({ left, right }, i) => {
-            const e =
-              left && right && left.type === "del" && right.type === "add"
-                ? emphasis(left.text, right.text)
-                : null;
-            const line = side === "left" ? left : right;
-            return (
-              <Row key={i} tint={rowTint(line?.type ?? null)}>
-                <Gutter n={(side === "left" ? line?.oldLine : line?.newLine) ?? null} />
-                <span className="whitespace-pre px-1">
-                  {line ? (
-                    <Code text={line.text} lang={lang} emph={side === "left" ? e?.del : e?.add} />
-                  ) : null}
-                </span>
-              </Row>
-            );
-          })}
+          {analyseHunk(hunk).rows.map((row, i) => (
+            <SplitLine
+              key={i}
+              row={row}
+              lang={lang}
+              side={side}
+              // One bar per hunk: on the right (new) column only.
+              bar={side === "right" && i === lastChangedRow(hunk) ? hunk : undefined}
+            />
+          ))}
         </div>
       ))}
     </>
   );
 }
 
-/** Both sides, each scrolling horizontally on its own but kept in step. */
+/** A windowed split column: the shared range of items, one side of each. */
+function SplitSlice({
+  items,
+  range,
+  lang,
+  side,
+}: {
+  items: Item[];
+  range: { start: number; end: number };
+  lang: string;
+  side: "left" | "right";
+}) {
+  return (
+    <>
+      {items
+        .slice(range.start, range.end)
+        .map(({ hunk, i }, k) =>
+          i < 0 ? (
+            <HunkHeader key={range.start + k} hunk={hunk} fixed />
+          ) : (
+            <SplitLine
+              key={range.start + k}
+              row={analyseHunk(hunk).rows[i]!}
+              lang={lang}
+              side={side}
+              style={FIXED}
+              bar={side === "right" && i === lastChangedRow(hunk) ? hunk : undefined}
+            />
+          )
+        )}
+    </>
+  );
+}
+
+/** `v` held inside a scroller's own extent. */
+export function clampScroll(v: number, scrollSize: number, clientSize: number) {
+  return Math.min(v, Math.max(0, scrollSize - clientSize));
+}
+
+type Axis =
+  | ["scrollLeft", "scrollWidth", "clientWidth"]
+  | ["scrollTop", "scrollHeight", "clientHeight"];
+const AXES: Axis[] = [
+  ["scrollLeft", "scrollWidth", "clientWidth"],
+  ["scrollTop", "scrollHeight", "clientHeight"],
+];
+
+/** Mirror `src`'s offset onto `dst`, clamped to what `dst` can show. */
+function follow(src: HTMLElement, dst: HTMLElement) {
+  for (const [pos, size, client] of AXES) {
+    // `src` pinned at its own end while `dst` sits past it: `src` is the
+    // narrower column echoing a clamp we just caused. Pulling `dst` back to
+    // it would snap the wide column home every time it scrolls past the
+    // narrow one's longest line.
+    if (src[pos] >= clampScroll(Infinity, src[size], src[client]) && dst[pos] > src[pos]) continue;
+    const target = clampScroll(src[pos], dst[size], dst[client]);
+    if (dst[pos] !== target) dst[pos] = target;
+  }
+}
+
+/** Both sides, each its own scroller but kept in step on both axes. */
 function SplitView({ hunks, lang, fill }: { hunks: LaneDiffHunk[]; lang: string; fill: boolean }) {
   const left = useRef<HTMLDivElement>(null);
   const right = useRef<HTMLDivElement>(null);
+  const items = useMemo(() => flatten(hunks, "split"), [hunks]);
+  const minWidth = useMemo(() => `calc(${longestInHunks(hunks)}ch + 3rem)`, [hunks]);
+  const win = useWindow(items.length);
 
   // Mirroring fires the other pane's own scroll handler, which mirrors back —
-  // the equality check is what ends that, so no re-entry flag is needed.
-  const sync = useCallback((from: "left" | "right") => {
+  // the equality check (and `follow`'s edge rule) is what ends that, so no
+  // re-entry flag is needed. Both axes: the columns hold paired rows, so a
+  // vertical drift puts a deletion beside some unrelated line. Both columns
+  // window off the same offset, so they always hold the same row range.
+  const sync = (from: "left" | "right") => {
     const src = from === "left" ? left.current : right.current;
     const dst = from === "left" ? right.current : left.current;
-    if (!src || !dst || dst.scrollLeft === src.scrollLeft) return;
-    dst.scrollLeft = src.scrollLeft;
-  }, []);
+    if (!src || !dst) return;
+    follow(src, dst);
+    win.onScroll(src);
+  };
+
+  const column = (side: "left" | "right") =>
+    win.on ? (
+      <Windowed count={items.length} range={win.range} minWidth={minWidth}>
+        <SplitSlice items={items} range={win.range} lang={lang} side={side} />
+      </Windowed>
+    ) : (
+      <SplitColumn hunks={hunks} lang={lang} side={side} />
+    );
 
   return (
-    <div className={`flex ${boxHeight(fill)}`}>
+    <div className={`flex ${boxHeight(fill, win.on)}`}>
       <div
         ref={left}
         data-testid="lane-diff-split-left"
         onScroll={() => sync("left")}
         className="w-1/2 min-w-0 overflow-auto"
       >
-        <SplitColumn hunks={hunks} lang={lang} side="left" />
+        {column("left")}
       </div>
       <div
         ref={right}
@@ -241,7 +635,7 @@ function SplitView({ hunks, lang, fill }: { hunks: LaneDiffHunk[]; lang: string;
         onScroll={() => sync("right")}
         className="w-1/2 min-w-0 overflow-auto border-l border-border-light"
       >
-        <SplitColumn hunks={hunks} lang={lang} side="right" />
+        {column("right")}
       </div>
     </div>
   );
@@ -252,14 +646,52 @@ export function LaneDiffView({
   file,
   layout,
   fill = false,
+  hunkActions,
 }: {
   file: LaneChangeFile;
   layout: DiffLayout;
   /** Take the parent's height (single-file view) instead of the 60vh cap. */
   fill?: boolean;
+  /** Controls drawn in each hunk's review bar. */
+  hunkActions?: (hunk: LaneDiffHunk) => ReactNode;
 }) {
+  const root = useRef<HTMLDivElement>(null);
   const { t } = useTranslation(["lanes"]);
   const lang = langFor(file.path);
+  const hunks = file.hunks;
+  const items = useMemo(() => (hunks ? flatten(hunks, "unified") : []), [hunks]);
+  const minWidth = useMemo(
+    // two gutters + the row's px-2, plus the marker column
+    () => `calc(${hunks ? longestInHunks(hunks) + 1 : 0}ch + 6rem)`,
+    [hunks]
+  );
+  // Unified only; split windows inside its own two scrollers.
+  const win = useWindow(layout === "unified" ? items.length : 0);
+  const splitWindowed = useMemo(
+    () => layout === "split" && !!hunks && flatten(hunks, "split").length > WINDOW_THRESHOLD,
+    [layout, hunks]
+  );
+
+  // The bar's arrows: bring hunk `index`'s header into view. A windowed
+  // unified diff may not have it in the DOM, so there it is found by offset.
+  const go = (index: number) => {
+    const el = root.current;
+    if (!el || !hunks) return;
+    const header = el.querySelector<HTMLElement>(`[data-hunk-index="${index}"]`);
+    // The review list pins each file's header over its own diff.
+    const sticky = el
+      .closest("[data-review-file]")
+      ?.querySelector<HTMLElement>("[data-sticky-top]");
+    const pad = sticky?.offsetHeight ?? 0;
+    if (header) {
+      scrollToTop(header, pad);
+      return;
+    }
+    // Windowed: the header is not in the DOM, but its offset is known.
+    const at = items.findIndex((it) => it.i < 0 && it.hunk === hunks[index]);
+    if (at >= 0 && layout === "unified") el.scrollTop = at * ROW_PX;
+  };
+  const review = hunkActions && hunks ? { actions: hunkActions, hunks, go } : null;
 
   if (file.binary)
     return <p className="px-2 py-1 text-[10px] text-fg-muted">{t("changes.binary")}</p>;
@@ -267,24 +699,49 @@ export function LaneDiffView({
     return <p className="px-2 py-1 text-[10px] text-fg-muted">{t("changes.noHunks")}</p>;
 
   return (
-    <div
-      data-testid="lane-diff-view"
-      data-layout={layout}
-      className={`flex flex-col font-mono text-[11px] leading-[1.45] ${
-        layout === "split" ? boxHeight(fill) : `overflow-auto ${boxHeight(fill)}`
-      }`}
-    >
-      {layout === "split" ? (
-        <SplitView hunks={file.hunks} lang={lang} fill={fill} />
-      ) : (
-        file.hunks.map((hunk, i) => (
-          <UnifiedHunk key={`${hunk.header}:${i}`} hunk={hunk} lang={lang} />
-        ))
-      )}
-      {file.truncated && (
-        <p className="px-2 py-1 text-[10px] text-status-warning">{t("changes.fileTruncated")}</p>
-      )}
-    </div>
+    <HunkActions.Provider value={review}>
+      <div
+        ref={root}
+        data-testid="lane-diff-view"
+        data-layout={layout}
+        onScroll={(e) => win.onScroll(e.currentTarget)}
+        className={`flex flex-col font-mono text-[11px] leading-[1.45] ${
+          layout === "split"
+            ? boxHeight(fill, splitWindowed)
+            : `overflow-auto ${boxHeight(fill, win.on)}`
+        }`}
+      >
+        {layout === "split" ? (
+          <SplitView hunks={file.hunks} lang={lang} fill={fill} />
+        ) : win.on ? (
+          <Windowed count={items.length} range={win.range} minWidth={minWidth}>
+            {items
+              .slice(win.range.start, win.range.end)
+              .map(({ hunk, i }, k) =>
+                i < 0 ? (
+                  <HunkHeader key={win.range.start + k} hunk={hunk} fixed />
+                ) : (
+                  <UnifiedLine
+                    key={win.range.start + k}
+                    line={hunk.lines[i]!}
+                    lang={lang}
+                    emph={analyseHunk(hunk).emph.get(i)}
+                    style={FIXED}
+                    bar={i === lastChangedLine(hunk) ? hunk : undefined}
+                  />
+                )
+              )}
+          </Windowed>
+        ) : (
+          file.hunks.map((hunk, i) => (
+            <UnifiedHunk key={`${hunk.header}:${i}`} hunk={hunk} lang={lang} />
+          ))
+        )}
+        {file.truncated && (
+          <p className="px-2 py-1 text-[10px] text-status-warning">{t("changes.fileTruncated")}</p>
+        )}
+      </div>
+    </HunkActions.Provider>
   );
 }
 
@@ -303,19 +760,32 @@ export function LaneFileView({
 }) {
   const { t } = useTranslation(["lanes"]);
   const lang = langFor(path);
+  const win = useWindow(lines.length);
+  // gutter + the row's px-2
+  const minWidth = useMemo(() => `calc(${longest(lines)}ch + 3.5rem)`, [lines]);
+  const row = (text: string, i: number, style?: CSSProperties) => (
+    <Row key={i} tint="" style={style}>
+      <Gutter n={i + 1} />
+      <span className="whitespace-pre px-2">
+        <Code text={text} lang={lang} />
+      </span>
+    </Row>
+  );
   return (
     <div
       data-testid="lane-file-view"
-      className={`overflow-auto font-mono text-[11px] leading-[1.45] ${boxHeight(fill)}`}
+      onScroll={(e) => win.onScroll(e.currentTarget)}
+      className={`overflow-auto font-mono text-[11px] leading-[1.45] ${boxHeight(fill, true)}`}
     >
-      {lines.map((text, i) => (
-        <Row key={i} tint="">
-          <Gutter n={i + 1} />
-          <span className="whitespace-pre px-2">
-            <Code text={text} lang={lang} />
-          </span>
-        </Row>
-      ))}
+      {win.on ? (
+        <Windowed count={lines.length} range={win.range} minWidth={minWidth}>
+          {lines
+            .slice(win.range.start, win.range.end)
+            .map((text, k) => row(text, win.range.start + k, FIXED))}
+        </Windowed>
+      ) : (
+        lines.map((text, i) => row(text, i))
+      )}
       {truncated && (
         <p className="px-2 py-1 text-[10px] text-status-warning">{t("changes.fileTruncated")}</p>
       )}

client/src/components/lanes/LaneGitBar.tsx

@@ -1,13 +1,14 @@
 /**
  * @file The lane's git action row: ahead/behind against the upstream, and the
  * writes `POST /api/lanes/:id/git/:action` offers that are not per-file —
- * fetch, pull, push, commit (everything, or only what the Changes panel has
- * staged), switch branch, and create/delete a branch. Per-file staging and
- * discard live in the Changes panel, beside the file they act on.
+ * fetch, pull, push, switch branch, and create/delete a branch. Committing is
+ * NOT here: it is the Changes panel's staged-only commit box, beside the
+ * per-file stage/unstage/discard it commits — one way to commit, and it only
+ * ever takes what the user staged.
  *
- * It renders beside the read-only git line in LaneCard rather than inside the
- * ⋯ menu: that menu holds the rare and dangerous (`reset worktree`), and these
- * are the opposite — the ordinary moves a lane needs several times an hour.
+ * It renders at the top of the Changes panel (`LaneGitHeader`), its actions as
+ * icons on the same row as the branch line, rather than in the lane card's ⋯ menu: that menu holds the rare and dangerous (`reset
+ * worktree`), and these are the ordinary moves a lane needs several times an hour.
  * Nothing here decides what an action may do; the server does (pull is always
  * --ff-only, switch refuses a dirty tree), and this only reports what it said.
  * Failures print git's own text, because "! [rejected] non-fast-forward" tells
@@ -15,23 +16,13 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-import { useState } from "react";
+import { useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
-import {
-  ArrowDown,
-  ArrowUp,
-  Check,
-  GitBranch,
-  Plus,
-  RefreshCw,
-  Trash2,
-  Upload,
-  X,
-} from "lucide-react";
+import { ArrowDown, ArrowUp, GitBranch, Plus, RefreshCw, Trash2, Upload } from "lucide-react";
 import { api } from "../../lib/api";
 import type { LaneGitFacts, LaneWorktree } from "../../lib/types";
 
-type Action = "fetch" | "pull" | "push" | "commit" | "switch" | "branch-create" | "branch-delete";
+type Action = "fetch" | "pull" | "push" | "switch" | "branch-create" | "branch-delete";
 
 function Btn({
   label,
@@ -39,6 +30,7 @@ function Btn({
   busy,
   disabled,
   title,
+  compact,
   onClick,
 }: {
   label: string;
@@ -46,6 +38,8 @@ function Btn({
   busy?: boolean;
   disabled?: boolean;
   title?: string;
+  /** Icon only; the label becomes the accessible name, the hint the tooltip. */
+  compact?: boolean;
   onClick: () => void;
 }) {
   return (
@@ -54,10 +48,13 @@ function Btn({
       onClick={onClick}
       disabled={disabled || busy}
       title={title}
-      className="flex items-center gap-1 rounded border border-border-light px-1.5 py-0.5 text-[11px] text-fg-secondary transition-colors hover:bg-surface-2 hover:text-fg-primary disabled:cursor-not-allowed disabled:opacity-40"
+      aria-label={compact ? label : undefined}
+      className={`flex items-center gap-1 rounded text-[11px] text-fg-secondary transition-colors hover:bg-surface-3 hover:text-fg-primary disabled:cursor-not-allowed disabled:opacity-40 ${
+        compact ? "h-6 w-6 justify-center" : "border border-border-light px-1.5 py-0.5"
+      }`}
     >
       {icon}
-      {label}
+      {!compact && label}
     </button>
   );
 }
@@ -67,9 +64,13 @@ export function LaneGitBar({
   git,
   onChanged,
   onNewLane,
+  lead,
 }: {
   laneId: number;
   git: LaneGitFacts;
+  /** Rendered at the start of the action row: the header's branch line, so
+   *  the facts and the buttons that act on them read as one row. */
+  lead?: React.ReactNode;
   /** Called after any action that could have moved the working copy. */
   onChanged: () => void;
   /** Open the Add-lane flow for a sibling worktree of this repo, optionally on
@@ -79,32 +80,52 @@ export function LaneGitBar({
   const { t } = useTranslation(["lanes"]);
   const [busy, setBusy] = useState<Action | null>(null);
   const [error, setError] = useState<string | null>(null);
-  const [committing, setCommitting] = useState(false);
-  const [message, setMessage] = useState("");
   const [switching, setSwitching] = useState(false);
   const [branches, setBranches] = useState<string[] | null>(null);
   const [worktrees, setWorktrees] = useState<LaneWorktree[]>([]);
   const [picked, setPicked] = useState("");
   const [newBranch, setNewBranch] = useState("");
+  // The Changes panel is not keyed by lane, so this bar outlives a lane switch.
+  // All of the state above describes ONE lane — a branch picked for lane A,
+  // applied after switching, would move B's HEAD — so it is reset during
+  // render the moment the id changes, before anything can act on it.
+  const [shownLane, setShownLane] = useState(laneId);
+  // One action at a time, checked synchronously: `busy` is state, and a second
+  // Enter can land before the render that disables anything.
+  const inFlight = useRef(false);
+  if (shownLane !== laneId) {
+    setShownLane(laneId);
+    setBusy(null);
+    setError(null);
+    setSwitching(false);
+    setBranches(null);
+    setWorktrees([]);
+    setPicked("");
+    setNewBranch("");
+    inFlight.current = false;
+  }
+  const laneNow = useRef(laneId);
+  laneNow.current = laneId;
 
   if (!git.available) return null;
   const dirty = git.dirty + git.untracked;
 
-  const run = async (
-    action: Action,
-    body?: { message?: string; only?: "staged"; branch?: string }
-  ) => {
+  const run = async (action: Action, body?: { branch?: string }) => {
+    if (inFlight.current) return;
+    inFlight.current = true;
+    const lane = laneId;
     setBusy(action);
     setError(null);
     try {
-      await api.lanes.gitAction(laneId, action, body || {});
-      setCommitting(false);
-      setMessage("");
+      await api.lanes.gitAction(lane, action, body || {});
+      // Landed after a lane switch: every write below belongs to the lane
+      // no longer shown.
+      if (laneNow.current !== lane) return;
       // The branch list this bar is showing is stale the moment a branch is
       // created, deleted or switched to, so it is re-read rather than patched.
-      if (action === "switch") setSwitching(false);
-      else if (action.startsWith("branch-")) {
-        setNewBranch("");
+      if (action === "switch" || action.startsWith("branch-")) {
+        if (action === "switch") setSwitching(false);
+        else setNewBranch("");
         setPicked("");
         setBranches(null);
         await refreshBranches();
@@ -113,19 +134,32 @@ export function LaneGitBar({
     } catch (err) {
       // The server appends git's own stderr to the message, so this is the
       // rejection text verbatim — hence the <pre> below rather than a line.
-      setError(err instanceof Error ? err.message : String(err));
+      // ENOREMOTE is the one refusal with no git text to show: the server's
+      // sentence is English and says less than a translated one.
+      if (laneNow.current === lane)
+        setError(
+          (err as { code?: string })?.code === "ENOREMOTE"
+            ? t("gitBar.errNoRemote")
+            : err instanceof Error
+              ? err.message
+              : String(err)
+        );
     } finally {
-      setBusy(null);
+      if (laneNow.current === lane) {
+        inFlight.current = false;
+        setBusy(null);
+      }
     }
   };
 
   const refreshBranches = async () => {
     try {
       const r = await api.lanes.gitBranches(laneId);
+      if (laneNow.current !== laneId) return;
       setBranches(r.branches);
       setWorktrees(r.worktrees || []);
     } catch {
-      setBranches([]);
+      if (laneNow.current === laneId) setBranches([]);
     }
   };
 
@@ -141,15 +175,19 @@ export function LaneGitBar({
   );
 
   return (
-    <div data-testid="lane-git-bar" className="mb-2 space-y-1">
-      <div className="flex flex-wrap items-center gap-1.5">
+    <div data-testid="lane-git-bar" className="space-y-1">
+      <div className="flex min-w-0 items-center gap-2">
+        {lead}
         {/* Ahead/behind first: it is the fact that decides which of the
             buttons beside it the user actually wants. */}
-        {git.upstream ? (
+        {/* Null counts with an upstream named means git could not compare
+            the two (the upstream ref is gone): claiming "in sync" there
+            would be a lie, so it reads as not pushed. */}
+        {git.upstream && git.ahead != null && git.behind != null ? (
           <span
             data-testid="lane-git-tracking"
             title={git.upstream}
-            className="flex items-center gap-1 font-mono text-[11px] text-fg-muted"
+            className="flex shrink-0 items-center gap-1 font-mono text-[11px] text-fg-muted"
           >
             {(git.ahead ?? 0) > 0 && (
               <span className="flex items-center text-status-warning">
@@ -167,95 +205,52 @@ export function LaneGitBar({
           </span>
         ) : (
           git.hasRemote && (
-            <span className="font-mono text-[11px] text-fg-muted">{t("gitBar.noUpstream")}</span>
+            <span className="shrink-0 font-mono text-[11px] text-fg-muted">
+              {t("gitBar.noUpstream")}
+            </span>
           )
         )}
 
-        <Btn
-          label={t("gitBar.fetch")}
-          icon={<RefreshCw className="h-3 w-3" />}
-          busy={busy === "fetch"}
-          disabled={!git.hasRemote || !!busy}
-          title={t("gitBar.fetchHint")}
-          onClick={() => run("fetch")}
-        />
-        <Btn
-          label={t("gitBar.pull")}
-          icon={<ArrowDown className="h-3 w-3" />}
-          busy={busy === "pull"}
-          disabled={!git.hasRemote || !!busy}
-          title={t("gitBar.pullHint")}
-          onClick={() => run("pull")}
-        />
-        <Btn
-          label={t("gitBar.push")}
-          icon={<Upload className="h-3 w-3" />}
-          busy={busy === "push"}
-          disabled={!git.hasRemote || !!busy}
-          title={t("gitBar.pushHint")}
-          onClick={() => run("push")}
-        />
-        <Btn
-          label={t("gitBar.commit")}
-          icon={<Check className="h-3 w-3" />}
-          disabled={dirty === 0 || !!busy}
-          title={dirty === 0 ? t("gitBar.commitNothing") : t("gitBar.commitHint")}
-          onClick={() => {
-            setCommitting((v) => !v);
-            setError(null);
-          }}
-        />
-        <Btn
-          label={t("gitBar.switch")}
-          icon={<GitBranch className="h-3 w-3" />}
-          disabled={!!busy}
-          // A dirty tree is refused server-side; saying so before the click
-          // beats a red box after it.
-          title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.switchHint")}
-          onClick={openSwitch}
-        />
-      </div>
-
-      {committing && (
-        <div className="flex items-center gap-1.5">
-          <input
-            autoFocus
-            value={message}
-            onChange={(e) => setMessage(e.target.value)}
-            onKeyDown={(e) => {
-              if (e.key === "Enter" && message.trim()) void run("commit", { message });
-              if (e.key === "Escape") setCommitting(false);
-            }}
-            placeholder={t("gitBar.commitPlaceholder")}
-            aria-label={t("gitBar.commitPlaceholder")}
-            className="min-w-0 flex-1 rounded border border-border-light bg-surface-0 px-2 py-0.5 text-[11px] text-fg-primary placeholder:text-fg-muted focus:border-accent focus:outline-none"
+        <div className="ml-auto flex shrink-0 items-center">
+          <Btn
+            compact
+            label={t("gitBar.fetch")}
+            icon={<RefreshCw className="h-3.5 w-3.5" />}
+            busy={busy === "fetch"}
+            disabled={!git.hasRemote || !!busy}
+            title={t("gitBar.fetchHint")}
+            onClick={() => run("fetch")}
           />
           <Btn
-            label={t("gitBar.commitAll", { count: dirty })}
-            busy={busy === "commit"}
-            disabled={!message.trim()}
-            onClick={() => void run("commit", { message })}
+            compact
+            label={t("gitBar.pull")}
+            icon={<ArrowDown className="h-3.5 w-3.5" />}
+            busy={busy === "pull"}
+            disabled={!git.hasRemote || !!busy}
+            title={t("gitBar.pullHint")}
+            onClick={() => run("pull")}
           />
-          {/* The Changes panel's per-file staging only means something if a
-              commit can take the index as it stands. The server answers
-              ENOCHANGES when nothing is staged, and that text lands below. */}
           <Btn
-            label={t("gitBar.commitStaged")}
-            title={t("gitBar.commitStagedHint")}
-            busy={busy === "commit"}
-            disabled={!message.trim()}
-            onClick={() => void run("commit", { message, only: "staged" })}
+            compact
+            label={t("gitBar.push")}
+            icon={<Upload className="h-3.5 w-3.5" />}
+            busy={busy === "push"}
+            disabled={!git.hasRemote || !!busy}
+            title={t("gitBar.pushHint")}
+            onClick={() => run("push")}
+          />
+          <Btn
+            compact
+            label={t("gitBar.switch")}
+            icon={<GitBranch className="h-3.5 w-3.5" />}
+            disabled={!!busy}
+            // A dirty tree is refused server-side; saying so before the click
+            // beats a red box after it.
+            title={dirty > 0 ? t("gitBar.switchDirty") : t("gitBar.switchHint")}
+            onClick={openSwitch}
           />
-          <button
-            type="button"
-            aria-label={t("gitBar.cancel")}
-            onClick={() => setCommitting(false)}
-            className="text-fg-muted hover:text-fg-primary"
-          >
-            <X className="h-3.5 w-3.5" />
-          </button>
         </div>
-      )}
+      </div>
 
       {switching && (
         <div className="flex items-center gap-1.5">
@@ -289,8 +284,16 @@ export function LaneGitBar({
           {onNewLane && (
             <Btn
               label={t("gitBar.newLane")}
-              title={t("gitBar.newLaneHint")}
-              disabled={!picked}
+              // A branch any worktree holds — this lane's own included — is
+              // one `addWorktree` refuses with EBRANCHBUSY; say so up front.
+              title={
+                picked && (heldBy.has(picked) || picked === git.branch)
+                  ? t("gitBar.newLaneHeld", {
+                      path: heldBy.get(picked) ?? t("gitBar.switchCurrent"),
+                    })
+                  : t("gitBar.newLaneHint")
+              }
+              disabled={!picked || heldBy.has(picked) || picked === git.branch}
               // The sibling lane is created through the normal Add-lane flow,
               // prefilled — one provisioning path, not a second one here.
               onClick={() => onNewLane(picked)}

client/src/components/lanes/LaneGitHeader.tsx

@@ -0,0 +1,294 @@
+/**
+ * @file The top of the Changes panel: the lane's working-copy line (branch,
+ * head, subject, and the uncommitted counts that open a per-file hover panel)
+ * and the git action bar under it (`LaneGitBar`).
+ *
+ * It used to sit in the lane card, a column away from the diff it describes —
+ * a pull there changed files the Changes panel only noticed on its next poll.
+ * Here the two share one read of `GET /api/lanes/:id/git` (`useLaneGitFacts`,
+ * owned by the panel) and refresh each other after every write.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useCallback, useEffect, useLayoutEffect, useRef, useState } from "react";
+import { createPortal } from "react-dom";
+import { useTranslation } from "react-i18next";
+import { GitBranch } from "lucide-react";
+import { LaneGitBar } from "./LaneGitBar";
+import { api } from "../../lib/api";
+import { keepIfSame } from "../../lib/keepIfSame";
+import type { LaneGitFacts, LaneGitFile } from "../../lib/types";
+
+/** How often the mounted panel re-reads its working-copy facts. Slow on
+ *  purpose: each call is five git subprocesses server-side, and a branch name
+ *  does not change on the timescale the lane list is polled at. */
+const GIT_REFRESH_MS = 30_000;
+
+/**
+ * The lane's own working copy, fetched by the Changes panel rather than folded
+ * into the polled lane list. Absent facts are not an error state: a lane may point at a
+ * plain directory, and it renders with no git header.
+ */
+export function useLaneGitFacts(laneId: number): [LaneGitFacts | null, () => void] {
+  const [facts, setFacts] = useState<LaneGitFacts | null>(null);
+  // Bumped by the git action bar: a commit or a pull changes every fact on
+  // this row, and waiting out the 30s poll makes the button look inert.
+  const [nonce, setNonce] = useState(0);
+  // A lane switch drops the previous lane's facts during render, so nothing
+  // (the git bar's "current branch" included) shows them until the new read.
+  const [factsLane, setFactsLane] = useState(laneId);
+  if (factsLane !== laneId) {
+    setFactsLane(laneId);
+    setFacts(null);
+  }
+
+  useEffect(() => {
+    let alive = true;
+    const read = () => {
+      api.lanes
+        .git(laneId)
+        .then((f) => {
+          if (alive) setFacts(keepIfSame(f));
+        })
+        .catch(() => {
+          // Silent: a panel that cannot read git shows the rest of itself. An
+          // error banner here would fire on every lane on every server blip.
+          if (alive) setFacts(keepIfSame<LaneGitFacts>({ available: false }));
+        });
+    };
+    read();
+    const timer = setInterval(read, GIT_REFRESH_MS);
+    return () => {
+      alive = false;
+      clearInterval(timer);
+    };
+  }, [laneId, nonce]);
+
+  return [facts, () => setNonce((n) => n + 1)];
+}
+
+/** Porcelain status code -> the letter shown and the colour it is shown in.
+ *  Keyed on the code's first meaningful character, so an index-side change
+ *  (`M `), a worktree-side one (` M`) and both (`MM`) read the same. */
+const GIT_STATUS_STYLE: Record<string, string> = {
+  M: "text-status-warning",
+  A: "text-status-success",
+  D: "text-status-danger",
+  R: "text-accent",
+  C: "text-accent",
+  U: "text-status-danger",
+  "?": "text-fg-muted",
+};
+
+/**
+ * The file list behind a lane's uncommitted counts: which files, what happened
+ * to each, and how many lines it gained and lost.
+ *
+ * It replaced a native `title` tooltip, which could show the same paths but
+ * neither colour them nor align the deltas — and a plain porcelain dump is not
+ * something you read at a glance.
+ *
+ * PORTALLED to `document.body` and `position: fixed`: the Changes panel
+ * scrolls in its own `overflow` box, and an absolutely positioned panel would
+ * be clipped by it. It flips above its anchor rather than off the bottom of
+ * the window, and clamps to the right edge.
+ */
+function LaneGitFilesPanel({
+  files,
+  hidden,
+  anchor,
+  onPointerEnter,
+  onPointerLeave,
+}: {
+  files: LaneGitFile[];
+  hidden: number;
+  /** The counts button this panel hangs off. */
+  anchor: HTMLElement | null;
+  onPointerEnter: () => void;
+  onPointerLeave: () => void;
+}) {
+  const { t } = useTranslation(["lanes"]);
+  const panelRef = useRef<HTMLDivElement>(null);
+  const [pos, setPos] = useState<{ top: number; left: number } | null>(null);
+
+  // After the first paint, when the panel's real height is known: place it
+  // under the anchor, or above it when that would run off the bottom.
+  useLayoutEffect(() => {
+    if (!anchor || !panelRef.current) return;
+    const a = anchor.getBoundingClientRect();
+    const p = panelRef.current.getBoundingClientRect();
+    const gap = 4;
+    const top =
+      a.bottom + gap + p.height > window.innerHeight ? a.top - p.height - gap : a.bottom + gap;
+    setPos({
+      top: Math.max(8, top),
+      left: Math.max(8, Math.min(a.left, document.documentElement.clientWidth - p.width - 8)),
+    });
+  }, [anchor, files]);
+  // Totals are over the LISTED files only — the cap means the rest are unknown,
+  // and a total that silently omits them would be a wrong number rather than a
+  // partial one. `hidden` says how many are missing.
+  const added = files.reduce((n, f) => n + (f.added ?? 0), 0);
+  const deleted = files.reduce((n, f) => n + (f.deleted ?? 0), 0);
+
+  return createPortal(
+    <div
+      ref={panelRef}
+      data-testid="lane-git-files"
+      role="group"
+      aria-label={t("git.filesHeading", { count: files.length })}
+      // The pointer has to be able to travel INTO the panel to scroll it, so
+      // the panel answers the same enter/leave pair the trigger does.
+      onMouseEnter={onPointerEnter}
+      onMouseLeave={onPointerLeave}
+      style={{
+        position: "fixed",
+        zIndex: 60,
+        top: pos?.top ?? 0,
+        left: pos?.left ?? 0,
+        // Hidden for the one frame before it has been measured, so it never
+        // flashes at the top-left corner.
+        visibility: pos ? "visible" : "hidden",
+      }}
+      className="max-h-72 w-[22rem] max-w-[calc(100vw-1rem)] overflow-y-auto rounded-md border border-border bg-surface-1 p-2 shadow-lg"
+    >
+      <div className="mb-1.5 flex items-baseline gap-2 border-b border-border pb-1.5 text-[11px]">
+        <span className="text-fg-secondary">{t("git.filesHeading", { count: files.length })}</span>
+        <span className="ml-auto shrink-0 font-mono tabular-nums">
+          <span className="text-status-success">+{added}</span>{" "}
+          <span className="text-status-danger">−{deleted}</span>
+        </span>
+      </div>
+      <ul className="space-y-0.5 font-mono text-[11px]">
+        {files.map((f) => {
+          const code = f.status.trim()[0] || "?";
+          return (
+            <li key={f.path} className="flex items-baseline gap-2">
+              <span
+                className={`w-3 shrink-0 font-semibold ${GIT_STATUS_STYLE[code] || "text-fg-muted"}`}
+                title={f.status}
+              >
+                {code}
+              </span>
+              {/* The DIRECTORY truncates, never the filename: the name is what
+                  you scan for, the path is only there to disambiguate it. */}
+              <span className="flex min-w-0 flex-1 items-baseline" title={f.path}>
+                <span className="truncate text-fg-muted">{f.path.replace(/[^/]+$/, "")}</span>
+                <span className="shrink-0 text-fg-primary">{f.path.split("/").pop()}</span>
+              </span>
+              <span className="shrink-0 tabular-nums">
+                {f.added === null && f.deleted === null ? (
+                  <span className="text-fg-muted">{t("git.noDelta")}</span>
+                ) : (
+                  <>
+                    <span className="text-status-success">+{f.added ?? 0}</span>{" "}
+                    <span className="text-status-danger">−{f.deleted ?? 0}</span>
+                  </>
+                )}
+              </span>
+            </li>
+          );
+        })}
+      </ul>
+      {hidden > 0 && (
+        <p className="mt-1.5 border-t border-border pt-1.5 text-[10px] text-fg-muted">
+          {t("git.filesMore", { count: hidden })}
+        </p>
+      )}
+    </div>,
+    document.body
+  );
+}
+
+export function LaneGitHeader({
+  laneId,
+  git,
+  onChanged,
+  onNewLane,
+}: {
+  laneId: number;
+  git: LaneGitFacts | null;
+  /** Called after a git bar action: the facts AND the panel's diff moved. */
+  onChanged: () => void;
+  /** See `LaneGitBar`'s prop of the same name. */
+  onNewLane?: (branch?: string) => void;
+}) {
+  const { t } = useTranslation(["lanes"]);
+  const [filesOpen, setFilesOpen] = useState(false);
+  const [countsAnchor, setCountsAnchor] = useState<HTMLButtonElement | null>(null);
+  // Closing is DELAYED: the panel is portalled away from the trigger, so the
+  // pointer leaves the trigger before it can land on the panel it is heading
+  // for. Any enter — trigger or panel — cancels the pending close.
+  const filesCloseTimer = useRef<number | undefined>(undefined);
+  const openFiles = useCallback(() => {
+    window.clearTimeout(filesCloseTimer.current);
+    setFilesOpen(true);
+  }, []);
+  const closeFiles = useCallback(() => {
+    window.clearTimeout(filesCloseTimer.current);
+    filesCloseTimer.current = window.setTimeout(() => setFilesOpen(false), 150);
+  }, []);
+  useEffect(() => () => window.clearTimeout(filesCloseTimer.current), []);
+
+  if (!git?.available) return null;
+  const lead = (
+    <>
+      {/* One row with the actions: branch first and strongest, then the head
+          and its subject, which is what truncates when the panel is narrow
+          (the whole of it stays in the tooltip). */}
+      <div
+        data-testid="lane-git"
+        className="flex min-w-0 flex-1 items-baseline gap-1.5 font-mono text-[11px]"
+        title={`${git.head} ${git.subject}`}
+      >
+        <span className="flex shrink-0 items-center gap-1 self-center font-semibold text-fg-primary">
+          <GitBranch className="h-3 w-3 text-fg-muted" />
+          {git.branch}
+        </span>
+        <span className="shrink-0 text-fg-muted">{git.head}</span>
+        <span className="min-w-0 truncate text-fg-muted">{git.subject}</span>
+      </div>
+      {(git.dirty > 0 || git.untracked > 0) && (
+        <button
+          type="button"
+          ref={setCountsAnchor}
+          data-testid="lane-git-counts"
+          aria-expanded={filesOpen}
+          onMouseEnter={openFiles}
+          onMouseLeave={closeFiles}
+          // Focus and click open it too: hover is not a gesture a
+          // keyboard or a touchscreen has.
+          onFocus={openFiles}
+          onBlur={closeFiles}
+          onClick={() => setFilesOpen((v) => !v)}
+          className="shrink-0 cursor-help rounded-full border border-status-warning/40 bg-status-warning/10 px-2 py-px text-[10.5px] text-status-warning"
+        >
+          {t("git.uncommitted", { dirty: git.dirty, untracked: git.untracked })}
+        </button>
+      )}
+    </>
+  );
+  return (
+    <div
+      data-testid="lane-git-header"
+      className="mb-2 rounded-md border border-border bg-surface-2 px-2 py-1"
+    >
+      <LaneGitBar
+        laneId={laneId}
+        git={git}
+        onChanged={onChanged}
+        onNewLane={onNewLane}
+        lead={lead}
+      />
+      {filesOpen && git.files?.length > 0 && (
+        <LaneGitFilesPanel
+          files={git.files}
+          hidden={git.dirty + git.untracked - git.files.length}
+          anchor={countsAnchor}
+          onPointerEnter={openFiles}
+          onPointerLeave={closeFiles}
+        />
+      )}
+    </div>
+  );
+}

client/src/components/lanes/__tests__/AddLaneModal.test.tsx

@@ -245,10 +245,11 @@ describe("AddLaneModal — picking an existing branch (issue #34)", () => {
     await user.type(repoField, "/Users/tester/projects/repo");
     await screen.findByLabelText("Branch to fork from");
     await user.type(screen.getByLabelText("Title"), "Auto named");
-    // The placeholder previews the name the server will pick.
+    // No `feat/…` guess: the prefix is the server's LANE_BRANCH_PREFIX, which
+    // the form cannot see, so the placeholder only says the field is optional.
     expect(screen.getByLabelText("New branch name")).toHaveAttribute(
       "placeholder",
-      "feat/auto-named"
+      "Automatic — named from the title"
     );
 
     await user.click(screen.getByRole("button", { name: "Add lane" }));

client/src/components/lanes/__tests__/LaneCard.test.tsx

@@ -9,7 +9,7 @@
  */
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, waitFor, fireEvent, act } from "@testing-library/react";
+import { render, screen, waitFor, act } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import LaneCard, { LaneToolsMenu, LaneRouterRow } from "../LaneCard";
 import type { Lane, LaneRuntime } from "../../../lib/types";
@@ -167,9 +167,9 @@ describe("LaneCard rebuilt layout", () => {
     expect(screen.queryByText("48%")).toBeNull();
   });
 
-  it("surfaces a needs-you message", () => {
+  it("leaves the needs-you message to the strip card", () => {
     render(<LaneCard lane={full({ needs_action: "waiting on approval" })} onAction={vi.fn()} />);
-    expect(screen.getByText(/waiting on approval/)).toBeInTheDocument();
+    expect(screen.queryByText(/waiting on approval/)).toBeNull();
   });
 
   it("keeps reset behind the ⋯ menu rather than showing it directly", async () => {
@@ -204,126 +204,11 @@ describe("LaneCard rebuilt layout", () => {
 });
 
 describe("LaneCard git block", () => {
-  const facts = {
-    available: true as const,
-    branch: "feat/rename-metric",
-    head: "9b3e74a",
-    subject: "free-text rule mode in the form",
-    dirty: 2,
-    untracked: 1,
-    files: [
-      { path: "server/lib/alerts.js", status: " M", added: 12, deleted: 3 },
-      { path: "client/src/lib/api.ts", status: "M ", added: 1, deleted: 0 },
-      { path: "scratch.txt", status: "??", added: null, deleted: null },
-    ],
-    // Tracking facts ride along on the same endpoint; a branch that has never
-    // been pushed reports nulls rather than zeros.
-    hasRemote: true,
-    upstream: null,
-    ahead: null,
-    behind: null,
-  };
-
-  it("renders the live branch, head, subject and uncommitted counts", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
-    render(<LaneCard lane={makeLane({ branch: "stale/recorded" })} onAction={vi.fn()} />);
-
-    const block = await screen.findByTestId("lane-git");
-    expect(block.textContent).toContain("feat/rename-metric");
-    expect(block.textContent).toContain("9b3e74a");
-    expect(block.textContent).toContain("free-text rule mode in the form");
-    expect(block.textContent).toContain("2");
-    // The live branch replaces the lane's recorded one rather than doubling it.
-    expect(screen.queryByText(/stale\/recorded/)).toBeNull();
-  });
-
-  it("names the files behind the counts on hover, with each one's line delta", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
-    render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-
-    const counts = await screen.findByTestId("lane-git-counts");
-    // Hidden until asked for: the row is a one-line summary until you hover.
-    expect(screen.queryByTestId("lane-git-files")).toBeNull();
-
-    fireEvent.mouseEnter(counts);
-    const panel = screen.getByTestId("lane-git-files");
-    expect(panel.textContent).toContain("alerts.js");
-    expect(panel.textContent).toContain("+12");
-    expect(panel.textContent).toContain("−3");
-    // Totals across the listed files.
-    expect(panel.textContent).toContain("+13");
-    // An untracked file has no delta to report and says so rather than "+0".
-    expect(panel.textContent).toContain("new");
-    expect(panel.textContent).toContain("3 files changed");
-
-    // Closing is delayed so the pointer can travel into the panel and scroll
-    // it — the panel is portalled to the body, away from its trigger.
-    fireEvent.mouseLeave(counts);
-    expect(screen.queryByTestId("lane-git-files")).not.toBeNull();
-    await waitFor(() => expect(screen.queryByTestId("lane-git-files")).toBeNull());
-  });
-
-  it("stays open while the pointer is inside the panel", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
-    render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-
-    const counts = await screen.findByTestId("lane-git-counts");
-    fireEvent.mouseEnter(counts);
-    fireEvent.mouseLeave(counts);
-    // The pointer landed on the panel before the pending close fired.
-    fireEvent.mouseEnter(screen.getByTestId("lane-git-files"));
-    await new Promise((r) => setTimeout(r, 200));
-    expect(screen.queryByTestId("lane-git-files")).not.toBeNull();
-
-    fireEvent.mouseLeave(screen.getByTestId("lane-git-files"));
-    await waitFor(() => expect(screen.queryByTestId("lane-git-files")).toBeNull());
-  });
-
-  it("says how many files the server-side cap left out", async () => {
-    // 40 uncommitted files, 3 listed: the counts are exact, the listing is not.
-    vi.mocked(api.lanes.git).mockResolvedValueOnce({ ...facts, dirty: 39, untracked: 1 });
-    render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-
-    fireEvent.mouseEnter(await screen.findByTestId("lane-git-counts"));
-    expect(screen.getByTestId("lane-git-files").textContent).toContain("37 more");
-  });
-
-  it("omits the uncommitted line when the tree is clean", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce({ ...facts, dirty: 0, untracked: 0 });
-    render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-    const block = await screen.findByTestId("lane-git");
-    expect(block.textContent).not.toContain("modified");
-  });
-
-  it("renders the card with no git block and no error when git is unavailable", async () => {
-    vi.mocked(api.lanes.git).mockResolvedValueOnce({ available: false });
-    render(<LaneCard lane={makeLane({ id: 2 })} onAction={vi.fn()} />);
-
-    expect(await screen.findByTestId("lane-card-2")).toBeInTheDocument();
+  it("carries no working-copy row — that heads the Changes panel now", async () => {
+    render(<LaneCard lane={makeLane({ id: 4 })} onAction={vi.fn()} />);
+    expect(await screen.findByTestId("lane-card-4")).toBeInTheDocument();
     expect(screen.queryByTestId("lane-git")).toBeNull();
-  });
-
-  it("swallows a rejected request instead of surfacing an error", async () => {
-    vi.mocked(api.lanes.git).mockRejectedValueOnce(new Error("network down"));
-    render(<LaneCard lane={makeLane({ id: 3 })} onAction={vi.fn()} />);
-
-    expect(await screen.findByTestId("lane-card-3")).toBeInTheDocument();
-    expect(screen.queryByTestId("lane-git")).toBeNull();
-    expect(screen.queryByText(/network down/)).toBeNull();
-  });
-
-  it("stops polling once the card unmounts", async () => {
-    vi.useFakeTimers();
-    try {
-      vi.mocked(api.lanes.git).mockResolvedValue({ available: false });
-      const { unmount } = render(<LaneCard lane={makeLane()} onAction={vi.fn()} />);
-      expect(api.lanes.git).toHaveBeenCalledTimes(1);
-      unmount();
-      vi.advanceTimersByTime(120_000);
-      expect(api.lanes.git).toHaveBeenCalledTimes(1);
-    } finally {
-      vi.useRealTimers();
-    }
+    expect(api.lanes.git).not.toHaveBeenCalled();
   });
 });
 

client/src/components/lanes/__tests__/LaneChangesPanel.test.tsx

@@ -11,7 +11,7 @@
  */
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { render, screen, waitFor } from "@testing-library/react";
+import { render, screen, waitFor, act, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { LaneChangesPanel } from "../LaneChangesPanel";
 import { api } from "../../../lib/api";
@@ -20,12 +20,16 @@ import type { LaneChanges } from "../../../lib/types";
 vi.mock("../../../lib/api", () => ({
   api: {
     lanes: {
+      git: vi.fn(),
+      gitBranches: vi.fn(),
       changes: vi.fn(),
       gitAction: vi.fn(),
       gitLog: vi.fn(),
       gitFile: vi.fn(),
+      gitSaveFile: vi.fn(),
       gitLs: vi.fn(),
       gitTree: vi.fn(),
+      gitTreeAll: vi.fn(),
     },
   },
 }));
@@ -76,7 +80,15 @@ function changes(over: Partial<Extract<LaneChanges, { available: true }>> = {}):
   };
 }
 
+/** The overview row's discard button for one path. */
+function discardOf(path: string) {
+  return within(screen.getByText(path).closest("li")!).getByRole("button", {
+    name: "Discard this file's changes",
+  });
+}
+
 beforeEach(() => {
+  vi.mocked(api.lanes.git).mockReset().mockResolvedValue({ available: false });
   vi.mocked(api.lanes.changes).mockReset();
   vi.mocked(api.lanes.changes).mockResolvedValue(changes());
   vi.mocked(api.lanes.gitAction).mockReset();
@@ -94,12 +106,14 @@ beforeEach(() => {
       },
     ],
   });
-  vi.mocked(api.lanes.gitLs).mockResolvedValue({
-    available: true,
-    paths: ["src/main.ts"],
-    truncated: false,
-    total: 1,
-  });
+  vi.mocked(api.lanes.gitLs)
+    .mockReset()
+    .mockResolvedValue({
+      available: true,
+      paths: ["src/main.ts"],
+      truncated: false,
+      total: 1,
+    });
   vi.mocked(api.lanes.gitTree).mockResolvedValue({
     available: true,
     path: "",
@@ -211,13 +225,165 @@ describe("LaneChangesPanel", () => {
     });
   });
 
+  it("heads the panel with the lane's git line, and a stage re-reads it", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValue({
+      available: true,
+      branch: "feat/thing",
+      head: "9b3e74a",
+      subject: "wip",
+      dirty: 2,
+      untracked: 1,
+      files: [],
+      hasRemote: false,
+      upstream: null,
+      ahead: null,
+      behind: null,
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    expect(await screen.findByTestId("lane-git")).toHaveTextContent("feat/thing");
+    expect(screen.getByTestId("lane-git-bar")).toBeInTheDocument();
+    expect(api.lanes.git).toHaveBeenCalledTimes(1);
+
+    const [stage] = screen.getAllByRole("button", { name: "Stage this file" });
+    await user.click(stage!);
+    // The header's counts moved with the index: waiting out its 30s poll
+    // would leave them wrong beside the list that just changed.
+    await waitFor(() => expect(api.lanes.git).toHaveBeenCalledTimes(2));
+  });
+
+  it("re-reads the diff after a git bar action", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValue({
+      available: true,
+      branch: "feat/thing",
+      head: "9b3e74a",
+      subject: "wip",
+      dirty: 0,
+      untracked: 0,
+      files: [],
+      hasRemote: true,
+      upstream: "origin/feat/thing",
+      ahead: 0,
+      behind: 1,
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-git-bar");
+    const before = vi.mocked(api.lanes.changes).mock.calls.length;
+
+    await user.click(screen.getByRole("button", { name: /Pull/ }));
+    expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "pull", {});
+    // A pull rewrites the working tree the list below describes.
+    await waitFor(() =>
+      expect(vi.mocked(api.lanes.changes).mock.calls.length).toBeGreaterThan(before)
+    );
+  });
+
+  it("re-reads history too when Refresh is pressed there", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "History" }));
+    await screen.findByText("feat: the commit");
+    vi.mocked(api.lanes.gitLog).mockClear();
+
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    // A pull or a switch from the git bar moves the commit list as well.
+    await waitFor(() => expect(api.lanes.gitLog).toHaveBeenCalledTimes(1));
+  });
+
+  it("stages every file the index lacks in one call, from above the list", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    const list = await screen.findByTestId("lane-changes-overview");
+    const actions = screen.getByTestId("lane-changes-actions");
+    // Commit box and Stage all come BEFORE the file list.
+    expect(actions.compareDocumentPosition(list) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
+    expect(screen.getByTestId("lane-changes-commit")).toBeInTheDocument();
+
+    await user.click(screen.getByRole("button", { name: "Stage all (2)" }));
+    // The already-staged docs/API.md is not sent again.
+    expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "stage", {
+      paths: ["server/lib/git-ops.js", "notes.txt"],
+    });
+  });
+
+  it("lists staged files apart from the changes the next commit leaves behind", async () => {
+    render(<LaneChangesPanel laneId={7} />);
+    const list = await screen.findByTestId("lane-changes-overview");
+    const staged = list.querySelector('[data-group="staged"]') as HTMLElement;
+    const unstaged = list.querySelector('[data-group="unstaged"]') as HTMLElement;
+    expect(within(staged).getByText("docs/API.md")).toBeInTheDocument();
+    expect(within(staged).queryByText("notes.txt")).toBeNull();
+    expect(within(unstaged).getByText("server/lib/git-ops.js")).toBeInTheDocument();
+    expect(within(unstaged).getByText("notes.txt")).toBeInTheDocument();
+    expect(within(unstaged).queryByText("docs/API.md")).toBeNull();
+    expect(screen.getByText("Staged Changes")).toBeInTheDocument();
+  });
+
+  it("at full width shows the tree as a sidebar and opens a file straight into the editor", async () => {
+    vi.mocked(api.lanes.gitTree).mockResolvedValue({
+      available: true,
+      path: "",
+      entries: [{ name: "main.ts", path: "src/main.ts", dir: false, status: " M" }],
+      truncated: false,
+    });
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["const whole = 1;"],
+      sha: "b".repeat(40),
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} full />);
+    const sidebar = await screen.findByTestId("lane-changes-sidebar");
+    // The sidebar IS the Files view: its finder lives there, and the tab is gone.
+    expect(within(sidebar).getByLabelText("Find a file by path…")).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: "Files" })).toBeNull();
+    expect(screen.getAllByTestId("lane-changes-browse")).toHaveLength(1);
+    await user.click(await within(sidebar).findByText("main.ts"));
+
+    // No Edit click: the editor is simply there, Save/Cancel idle until typed.
+    const editor = await screen.findByTestId("lane-file-editor");
+    expect(editor).toHaveValue("const whole = 1;");
+    expect(screen.queryByTestId("lane-file-edit")).toBeNull();
+    expect(screen.getByTestId("lane-file-save")).toBeDisabled();
+    await user.type(editor, "x");
+    expect(screen.getByTestId("lane-file-save")).toBeEnabled();
+    // Cancel reverts to the saved text and stays in the editor.
+    await user.click(screen.getByRole("button", { name: "Cancel" }));
+    expect(await screen.findByTestId("lane-file-editor")).toHaveValue("const whole = 1;");
+  });
+
+  it("at full width opens a changed file from the overview straight into the editor", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "server/lib/git-ops.js",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["a"],
+      sha: "b".repeat(40),
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} full />);
+    const list = await screen.findByTestId("lane-changes-overview");
+    await user.click(within(list).getByText("server/lib/git-ops.js"));
+    expect(await screen.findByTestId("lane-file-editor")).toHaveValue("a");
+    expect(screen.queryByTestId("lane-file-edit")).toBeNull();
+    expect(screen.getByTestId("lane-file-save")).toBeDisabled();
+    expect(screen.getByRole("button", { name: "Cancel" })).toBeDisabled();
+  });
+
   it("needs two clicks to discard, and only the second one reaches the server", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
     await screen.findByTestId("lane-changes-overview");
 
-    const [discard] = screen.getAllByRole("button", { name: "Discard this file's changes" });
-    await user.click(discard!);
+    await user.click(discardOf("server/lib/git-ops.js"));
     expect(api.lanes.gitAction).not.toHaveBeenCalled();
 
     await user.click(
@@ -229,6 +395,75 @@ describe("LaneChangesPanel", () => {
     });
   });
 
+  it("disarms a pending discard when the lane changes, so one click cannot discard in another lane", async () => {
+    const user = userEvent.setup();
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    const [discard] = screen.getAllByRole("button", { name: "Discard this file's changes" });
+    await user.click(discard!);
+
+    // Lane 8 has a file at the SAME path.
+    rerender(<LaneChangesPanel laneId={8} />);
+    await waitFor(() => expect(api.lanes.changes).toHaveBeenCalledWith(8, expect.anything()));
+    expect(
+      screen.queryByRole("button", { name: "Click again to discard — this cannot be undone" })
+    ).toBeNull();
+    const [again] = await screen.findAllByRole("button", { name: "Discard this file's changes" });
+    await user.click(again!);
+    expect(api.lanes.gitAction).not.toHaveBeenCalled();
+  });
+
+  it("disarms a pending discard once that path leaves the file list", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(discardOf("server/lib/git-ops.js"));
+
+    // The file was committed/reverted elsewhere; a later reappearance must not be pre-armed.
+    const base = changes();
+    const rest = base.available ? base.files.slice(1) : [];
+    vi.mocked(api.lanes.changes).mockResolvedValueOnce(changes({ files: rest }));
+    vi.mocked(api.lanes.changes).mockResolvedValue(changes());
+    // A plain refresh (the poll's twin), not a git action — an action already disarms.
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    await waitFor(() => expect(screen.queryByText("server/lib/git-ops.js")).toBeNull());
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    await screen.findByText("server/lib/git-ops.js");
+    expect(
+      screen.queryByRole("button", { name: "Click again to discard — this cannot be undone" })
+    ).toBeNull();
+  });
+
+  it("ignores a late response for the lane it has already left", async () => {
+    let resolveOld: (v: LaneChanges) => void = () => {};
+    vi.mocked(api.lanes.changes).mockImplementation((id) =>
+      id === 7
+        ? new Promise<LaneChanges>((r) => (resolveOld = r))
+        : Promise.resolve(
+            changes({
+              files: [
+                {
+                  path: "lane8.txt",
+                  status: "??",
+                  untracked: true,
+                  added: 1,
+                  deleted: 0,
+                  binary: false,
+                },
+              ],
+            })
+          )
+    );
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    rerender(<LaneChangesPanel laneId={8} />);
+    expect(await screen.findByText("lane8.txt")).toBeInTheDocument();
+
+    resolveOld(changes());
+    await new Promise((r) => setTimeout(r, 20));
+    expect(screen.getByText("lane8.txt")).toBeInTheDocument();
+    expect(screen.queryByText("server/lib/git-ops.js")).toBeNull();
+  });
+
   it("opens a commit from history as a commit-range review", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -275,8 +510,16 @@ describe("LaneChangesPanel", () => {
     expect(screen.getByText("src")).toBeInTheDocument();
   });
 
-  it("expands every folder at once, fetching whatever level wasn't cached yet", async () => {
+  it("expands every folder at once from one whole-tree read", async () => {
     const user = userEvent.setup();
+    vi.mocked(api.lanes.gitTreeAll).mockResolvedValue({
+      available: true,
+      truncated: false,
+      levels: {
+        "": [{ name: "src", path: "src", dir: true }],
+        src: [{ name: "main.ts", path: "src/main.ts", dir: false }],
+      },
+    });
     vi.mocked(api.lanes.gitTree).mockImplementation(async (_id, path) => {
       if (path === "src")
         return {
@@ -306,6 +549,34 @@ describe("LaneChangesPanel", () => {
     expect(screen.getByText("src")).toBeInTheDocument();
   });
 
+  it("highlights modified and untracked files in the Files tree, and folders holding them", async () => {
+    vi.mocked(api.lanes.gitTree).mockResolvedValue({
+      available: true,
+      path: "",
+      entries: [
+        { name: "src", path: "src", dir: true, changed: true },
+        { name: "docs", path: "docs", dir: true },
+        { name: "a.txt", path: "a.txt", dir: false, status: " M" },
+        { name: "new.txt", path: "new.txt", dir: false, status: "??" },
+        { name: "keep.txt", path: "keep.txt", dir: false },
+      ],
+      truncated: false,
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+
+    const row = async (name: string) => (await screen.findByText(name)).closest("button")!;
+    expect(await row("a.txt")).toHaveAttribute("data-tree-status", "M");
+    expect(await row("a.txt")).toHaveClass("text-status-warning");
+    expect(await row("new.txt")).toHaveAttribute("data-tree-status", "U");
+    expect(await row("new.txt")).toHaveClass("text-status-success");
+    expect(await row("src")).toHaveAttribute("data-tree-status", "dir");
+    expect(await row("keep.txt")).not.toHaveAttribute("data-tree-status");
+    expect(await row("docs")).not.toHaveAttribute("data-tree-status");
+  });
+
   it("quick-opens a tracked file as its whole content, not a diff", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -319,6 +590,113 @@ describe("LaneChangesPanel", () => {
     expect(await screen.findByTestId("lane-file-view")).toHaveTextContent("const whole = 1;");
   });
 
+  it("edits a whole file in place and saves over the exact version it opened", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["const whole = 1;"],
+      sha: "b".repeat(40),
+    });
+    vi.mocked(api.lanes.gitSaveFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["const whole = 2;"],
+      sha: "c".repeat(40),
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await user.click(await screen.findByText("src/main.ts"));
+    await screen.findByTestId("lane-file-view");
+
+    await user.click(screen.getByTestId("lane-file-edit"));
+    const editor = await screen.findByTestId("lane-file-editor");
+    expect(editor).toHaveValue("const whole = 1;");
+    await user.clear(editor);
+    await user.type(editor, "const whole = 2;");
+    await user.click(screen.getByTestId("lane-file-save"));
+
+    expect(api.lanes.gitSaveFile).toHaveBeenCalledWith(
+      7,
+      "src/main.ts",
+      "const whole = 2;",
+      "b".repeat(40)
+    );
+    // Back to reading, showing what was saved.
+    expect(await screen.findByTestId("lane-file-view")).toHaveTextContent("const whole = 2;");
+    expect(screen.queryByTestId("lane-file-editor")).toBeNull();
+  });
+
+  it("says why a file cannot be edited instead of offering a dead Edit button", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: true, // over the 1 MB view cap: no `sha`, nothing safe to save
+      lines: ["partial"],
+    });
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await user.click(await screen.findByText("src/main.ts"));
+
+    expect(await screen.findByTestId("lane-file-noedit")).toHaveTextContent(
+      "Too large to edit here (over 1 MB)"
+    );
+    expect(screen.queryByTestId("lane-file-edit")).toBeNull();
+  });
+
+  it("keeps the draft and says why when the file changed on disk meanwhile", async () => {
+    vi.mocked(api.lanes.gitFile).mockResolvedValue({
+      available: true,
+      path: "src/main.ts",
+      rev: "work",
+      binary: false,
+      truncated: false,
+      lines: ["x"],
+      sha: "b".repeat(40),
+    });
+    vi.mocked(api.lanes.gitSaveFile).mockRejectedValue(
+      Object.assign(new Error("the file changed on disk since it was opened"), { code: "ESTALE" })
+    );
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await user.click(await screen.findByText("src/main.ts"));
+    await screen.findByTestId("lane-file-view");
+    await user.click(screen.getByTestId("lane-file-edit"));
+    await user.type(await screen.findByTestId("lane-file-editor"), "y");
+    await user.click(screen.getByTestId("lane-file-save"));
+
+    expect(await screen.findByRole("alert")).toHaveTextContent(/changed on disk/);
+    expect(screen.getByTestId("lane-file-editor")).toHaveValue("xy");
+  });
+
+  it("unstages every staged file in one call, on the same row as Stage all and commit", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    const row = screen.getByTestId("lane-changes-actions");
+    expect(row).toContainElement(screen.getByTestId("lane-changes-commit"));
+    expect(row).toContainElement(screen.getByRole("button", { name: "Stage all (2)" }));
+
+    await user.click(screen.getByRole("button", { name: "Unstage all (1)" }));
+    expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "unstage", { paths: ["docs/API.md"] });
+  });
+
   it("switches the diff to side-by-side", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -411,6 +789,16 @@ describe("LaneChangesPanel", () => {
     });
   });
 
+  it("drops a half-typed commit message on a lane switch", async () => {
+    const user = userEvent.setup();
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-commit");
+    await user.type(screen.getByLabelText("Commit message"), "fix: meant for lane 7");
+    rerender(<LaneChangesPanel laneId={8} />);
+    await screen.findByTestId("lane-changes-commit");
+    expect(screen.getByLabelText("Commit message")).toHaveValue("");
+  });
+
   it("hides the commit box when nothing is staged", async () => {
     vi.mocked(api.lanes.changes).mockResolvedValue(
       changes({
@@ -491,6 +879,114 @@ describe("LaneChangesPanel", () => {
     expect(screen.getAllByTestId("lane-diff-view")).toHaveLength(2);
   });
 
+  describe("review actions", () => {
+    const reviewed = () =>
+      changes({
+        files: [
+          {
+            path: "server/lib/git-ops.js",
+            status: " M",
+            untracked: false,
+            unstaged: true,
+            added: 1,
+            deleted: 1,
+            binary: false,
+            hunks: [HUNK, { ...HUNK, header: "@@ -9,2 +10,3 @@" }],
+          },
+          {
+            path: "notes.txt",
+            status: "??",
+            untracked: true,
+            added: 1,
+            deleted: 0,
+            binary: false,
+            hunks: [HUNK],
+          },
+        ],
+      });
+    const openReview = async (user: ReturnType<typeof userEvent.setup>) => {
+      render(<LaneChangesPanel laneId={7} />);
+      await screen.findByTestId("lane-changes-overview");
+      vi.mocked(api.lanes.changes).mockResolvedValue(reviewed());
+      await user.click(screen.getByRole("button", { name: "Review" }));
+      await screen.findByTestId("lane-changes-review");
+    };
+
+    it("stages one hunk by its @@ line, at the context the diff was read with", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      // Two hunks on the tracked file; the untracked one has none to act on.
+      const stage = screen.getAllByRole("button", { name: "Stage this hunk" });
+      expect(stage).toHaveLength(2);
+      await user.click(stage[1]!);
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "stage-hunk", {
+        path: "server/lib/git-ops.js",
+        hunk: "@@ -9,2 +10,3 @@",
+        context: 3,
+      });
+    });
+
+    it("hangs one review bar under each actionable hunk, counting them", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      // Two hunks on the tracked file; the untracked file gets no bar.
+      const bars = screen.getAllByTestId("lane-hunk-bar");
+      expect(bars.map((b) => b.textContent)).toEqual([
+        expect.stringContaining("1 of 2"),
+        expect.stringContaining("2 of 2"),
+      ]);
+      // Undo sits beside Keep inside the bar — not on the @@ line.
+      expect(bars[0]).toContainElement(
+        screen.getAllByRole("button", { name: "Undo this hunk" })[0]!
+      );
+      expect(screen.getAllByRole("button", { name: "Previous change" })[0]).toBeDisabled();
+      expect(screen.getAllByRole("button", { name: "Next change" })[1]).toBeDisabled();
+    });
+
+    it("needs two clicks to undo a hunk, and arms only that hunk", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      const [first] = screen.getAllByRole("button", { name: "Undo this hunk" });
+      await user.click(first!);
+      expect(api.lanes.gitAction).not.toHaveBeenCalled();
+      // The other hunk is still at its first click.
+      expect(screen.getAllByRole("button", { name: "Undo this hunk" })).toHaveLength(1);
+      await user.click(
+        screen.getByRole("button", {
+          name: "Click again to undo this hunk — this cannot be undone",
+        })
+      );
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "discard-hunk", {
+        path: "server/lib/git-ops.js",
+        hunk: "@@ -1,2 +1,3 @@",
+        context: 3,
+        confirm: true,
+      });
+    });
+
+    it("stages a whole file from its review header without folding it", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      const [stageFile] = screen.getAllByRole("button", { name: "Stage this file" });
+      await user.click(stageFile!);
+      expect(api.lanes.gitAction).toHaveBeenCalledWith(7, "stage", {
+        paths: ["server/lib/git-ops.js"],
+      });
+      expect(
+        screen.getByRole("button", { name: "Collapse server/lib/git-ops.js" })
+      ).toBeInTheDocument();
+    });
+
+    it("keeps each file's header pinned while its diff scrolls", async () => {
+      const user = userEvent.setup();
+      await openReview(user);
+      expect(screen.getByRole("button", { name: "Collapse server/lib/git-ops.js" })).toHaveClass(
+        "sticky",
+        "top-0"
+      );
+    });
+  });
+
   it("opens a file only from its path, and folds it from anywhere else", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -515,6 +1011,73 @@ describe("LaneChangesPanel", () => {
     );
   });
 
+  it("opens, not folds, when Enter is pressed on the path", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Review" }));
+    await screen.findByTestId("lane-changes-review");
+
+    screen.getByRole("button", { name: "server/lib/git-ops.js" }).focus();
+    await user.keyboard("{Enter}");
+    await waitFor(() =>
+      expect(api.lanes.changes).toHaveBeenCalledWith(7, {
+        range: "work",
+        path: "server/lib/git-ops.js",
+        context: 3,
+      })
+    );
+  });
+
+  it("drops a quick-open answer for the lane it has already left", async () => {
+    const user = userEvent.setup();
+    let answer: (v: { paths: string[] }) => void = () => {};
+    vi.mocked(api.lanes.gitLs).mockReturnValueOnce(
+      new Promise((r) => {
+        answer = r as typeof answer;
+      }) as ReturnType<typeof api.lanes.gitLs>
+    );
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await waitFor(() => expect(api.lanes.gitLs).toHaveBeenCalledWith(7, "main"));
+
+    rerender(<LaneChangesPanel laneId={8} />);
+    await act(async () => answer({ paths: ["from/lane7.ts"] }));
+    // Back in Files on lane 8, before its own search lands: nothing of lane 7.
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    expect(screen.queryByText("from/lane7.ts")).toBeNull();
+  });
+
+  it("keeps the newest quick-open answer when an older one lands after it", async () => {
+    const user = userEvent.setup();
+    let answer: (v: { paths: string[] }) => void = () => {};
+    vi.mocked(api.lanes.gitLs)
+      .mockReturnValueOnce(
+        new Promise((r) => {
+          answer = r as typeof answer;
+        }) as ReturnType<typeof api.lanes.gitLs>
+      )
+      .mockResolvedValueOnce({
+        available: true,
+        paths: ["new/mainx.ts"],
+        truncated: false,
+        total: 1,
+      });
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    const box = await screen.findByLabelText("Find a file by path…");
+    await user.type(box, "main");
+    await waitFor(() => expect(api.lanes.gitLs).toHaveBeenCalledWith(7, "main"));
+    await user.type(box, "x");
+    expect(await screen.findByText("new/mainx.ts")).toBeInTheDocument();
+
+    await act(async () => answer({ paths: ["old/main-only.ts"] }));
+    expect(screen.queryByText("old/main-only.ts")).toBeNull();
+  });
+
   it("goes back to the list it came from, at the offset it was left at", async () => {
     const user = userEvent.setup();
     render(<LaneChangesPanel laneId={7} />);
@@ -537,4 +1100,148 @@ describe("LaneChangesPanel", () => {
     expect(await screen.findByTestId("lane-changes-review")).toBeInTheDocument();
     expect(screen.getByTestId("lane-changes-body").scrollTop).toBe(640);
   });
+
+  it("opens an unchanged tracked file from Files with no error banner", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    vi.mocked(api.lanes.changes).mockRejectedValue(
+      Object.assign(new Error("file has no changes in this range"), {
+        code: "ENOFILECHANGE",
+        status: 400,
+      })
+    );
+
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await user.type(await screen.findByLabelText("Find a file by path…"), "main");
+    await user.click(await screen.findByText("src/main.ts"));
+    expect(await screen.findByTestId("lane-file-view")).toHaveTextContent("const whole = 1;");
+
+    await user.click(screen.getByRole("button", { name: "Refresh" }));
+    await waitFor(() => expect(api.lanes.changes).toHaveBeenCalledTimes(3));
+    expect(screen.queryByRole("alert")).toBeNull();
+    expect(screen.getByTestId("lane-file-view")).toBeInTheDocument();
+  });
+
+  it("keeps the overview rows mounted across re-renders (typing in the commit box)", async () => {
+    const user = userEvent.setup();
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-commit");
+    const before = screen.getByText("server/lib/git-ops.js");
+    await user.type(screen.getByLabelText("Commit message"), "x");
+    expect(screen.getByText("server/lib/git-ops.js")).toBe(before);
+  });
+
+  it("expands all folders with ONE request, not one per folder", async () => {
+    const user = userEvent.setup();
+    vi.mocked(api.lanes.gitTree).mockClear();
+    vi.mocked(api.lanes.gitTreeAll)
+      .mockClear()
+      .mockResolvedValue({
+        available: true,
+        truncated: false,
+        levels: {
+          "": [{ name: "src", path: "src", dir: true }],
+          src: [{ name: "main.ts", path: "src/main.ts", dir: false }],
+        },
+      });
+    render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await screen.findByText("src");
+    await user.click(screen.getByRole("button", { name: "Expand all folders" }));
+
+    expect(await screen.findByText("main.ts")).toBeInTheDocument();
+    expect(api.lanes.gitTreeAll).toHaveBeenCalledTimes(1);
+    // Only the root read the Files tab made on entry — no per-folder walk.
+    expect(api.lanes.gitTree).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not repaint the previous lane after its git action resolves post-switch", async () => {
+    const user = userEvent.setup();
+    let resolveAction: (v: { action: string; ok: true; output: string }) => void = () => {};
+    vi.mocked(api.lanes.gitAction).mockReturnValue(
+      new Promise((r) => (resolveAction = r)) as ReturnType<typeof api.lanes.gitAction>
+    );
+    vi.mocked(api.lanes.changes).mockImplementation(async (id) =>
+      id === 7
+        ? changes()
+        : changes({
+            files: [
+              {
+                path: "lane8.txt",
+                status: "??",
+                untracked: true,
+                added: 1,
+                deleted: 0,
+                binary: false,
+              },
+            ],
+          })
+    );
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    const [stage] = screen.getAllByRole("button", { name: "Stage this file" });
+    await user.click(stage!);
+
+    rerender(<LaneChangesPanel laneId={8} />);
+    expect(await screen.findByText("lane8.txt")).toBeInTheDocument();
+    const lane7Reads = vi.mocked(api.lanes.changes).mock.calls.filter(([id]) => id === 7).length;
+
+    resolveAction({ action: "stage", ok: true, output: "" });
+    await new Promise((r) => setTimeout(r, 20));
+    expect(vi.mocked(api.lanes.changes).mock.calls.filter(([id]) => id === 7)).toHaveLength(
+      lane7Reads
+    );
+    expect(screen.getByText("lane8.txt")).toBeInTheDocument();
+    expect(screen.queryByText("server/lib/git-ops.js")).toBeNull();
+  });
+
+  it("does not paint the previous lane's tree when an expand-all read outlives a lane switch", async () => {
+    const user = userEvent.setup();
+    let resolveSrc: () => void = () => {};
+    vi.mocked(api.lanes.gitTreeAll).mockImplementation(
+      () =>
+        new Promise(
+          (r) =>
+            (resolveSrc = () =>
+              r({
+                available: true,
+                truncated: false,
+                levels: {
+                  "": [{ name: "src", path: "src", dir: true }],
+                  src: [{ name: "main.ts", path: "src/main.ts", dir: false }],
+                },
+              }))
+        )
+    );
+    vi.mocked(api.lanes.gitTree).mockImplementation((id) => {
+      return Promise.resolve({
+        available: true,
+        path: "",
+        entries: [
+          id === 7
+            ? { name: "src", path: "src", dir: true }
+            : { name: "lib8", path: "lib8", dir: false },
+        ],
+        truncated: false,
+      });
+    });
+    const { rerender } = render(<LaneChangesPanel laneId={7} />);
+    await screen.findByTestId("lane-changes-overview");
+    await user.click(screen.getByRole("button", { name: "Files" }));
+    await screen.findByText("src");
+    await user.click(screen.getByRole("button", { name: "Expand all folders" }));
+
+    rerender(<LaneChangesPanel laneId={8} />);
+    await user.click(await screen.findByRole("button", { name: "Files" }));
+    expect(await screen.findByText("lib8")).toBeInTheDocument();
+
+    resolveSrc();
+    await new Promise((r) => setTimeout(r, 20));
+    expect(screen.getByText("lib8")).toBeInTheDocument();
+    expect(screen.queryByText("src")).toBeNull();
+    expect(screen.queryByText("main.ts")).toBeNull();
+    expect(screen.getByRole("button", { name: "Expand all folders" })).toBeEnabled();
+  });
 });

client/src/components/lanes/__tests__/LaneDiffView.test.tsx

@@ -3,13 +3,21 @@
  * @description Pins the side-by-side renderer: two independently scrolling
  * columns (a long line must be reachable, not painted over its neighbour)
  * whose horizontal scroll is mirrored, so the two halves of a line stay
- * opposite each other.
+ * opposite each other. Also pins the clamped mirroring (a narrow column may
+ * not drag the wide one back) and the row windowing of large diffs.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
 import { describe, it, expect } from "vitest";
 import { fireEvent, render, screen } from "@testing-library/react";
-import { LaneDiffView } from "../LaneDiffView";
+import {
+  LaneDiffView,
+  LaneFileView,
+  ROW_PX,
+  WINDOW_THRESHOLD,
+  analyseHunk,
+  visibleRange,
+} from "../LaneDiffView";
 import type { LaneChangeFile } from "../../../lib/types";
 
 const FILE: LaneChangeFile = {
@@ -33,6 +41,17 @@ const FILE: LaneChangeFile = {
   ],
 };
 
+/** jsdom has no layout: give a scroller the extents a browser would. */
+function layout(
+  el: HTMLElement,
+  g: { scrollWidth?: number; clientWidth?: number; scrollHeight?: number; clientHeight?: number }
+) {
+  for (const [k, v] of Object.entries(g))
+    Object.defineProperty(el, k, { value: v, configurable: true });
+}
+
+const ROOMY = { scrollWidth: 2000, clientWidth: 200, scrollHeight: 2000, clientHeight: 200 };
+
 describe("LaneDiffView — side by side", () => {
   it("gives each column its own scroller", () => {
     render(<LaneDiffView file={FILE} layout="split" />);
@@ -40,11 +59,28 @@ describe("LaneDiffView — side by side", () => {
     expect(screen.getByTestId("lane-diff-split-right").className).toContain("overflow-auto");
   });
 
-  it("bounds its own height so the horizontal bar stays on screen", () => {
-    // A stacked review list caps each file; the single-file view takes the
-    // height its parent gives it. Either way the diff scrolls itself rather
-    // than growing a 2000-line container whose scrollbar is off the bottom.
+  it("caps a review diff only when it windows; the single-file view fills its parent", () => {
+    // Unwindowed, a review-list diff grows so the PANEL is the one vertical
+    // scroller (nested 60vh boxes made hunk navigation land nowhere); a
+    // windowed one keeps the cap because windowing needs its own scroller.
     const { rerender } = render(<LaneDiffView file={FILE} layout="unified" />);
+    expect(screen.getByTestId("lane-diff-view").className).not.toContain("max-h-[60vh]");
+
+    const big: LaneChangeFile = {
+      ...FILE,
+      hunks: [
+        {
+          ...FILE.hunks![0]!,
+          lines: Array.from({ length: WINDOW_THRESHOLD + 1 }, (_, i) => ({
+            type: "ctx" as const,
+            oldLine: i + 1,
+            newLine: i + 1,
+            text: `line ${i}`,
+          })),
+        },
+      ],
+    };
+    rerender(<LaneDiffView file={big} layout="unified" />);
     expect(screen.getByTestId("lane-diff-view").className).toContain("max-h-[60vh]");
 
     rerender(<LaneDiffView file={FILE} layout="unified" fill />);
@@ -56,6 +92,8 @@ describe("LaneDiffView — side by side", () => {
     render(<LaneDiffView file={FILE} layout="split" />);
     const left = screen.getByTestId("lane-diff-split-left");
     const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, ROOMY);
+    layout(right, ROOMY);
 
     left.scrollLeft = 320;
     fireEvent.scroll(left);
@@ -66,6 +104,55 @@ describe("LaneDiffView — side by side", () => {
     expect(left.scrollLeft).toBe(0);
   });
 
+  it("keeps the split columns on the same row vertically too", () => {
+    render(<LaneDiffView file={FILE} layout="split" />);
+    const left = screen.getByTestId("lane-diff-split-left");
+    const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, ROOMY);
+    layout(right, ROOMY);
+
+    left.scrollTop = 480;
+    fireEvent.scroll(left);
+    expect(right.scrollTop).toBe(480);
+
+    right.scrollTop = 40;
+    fireEvent.scroll(right);
+    expect(left.scrollTop).toBe(40);
+  });
+
+  it("clamps the mirrored offset to the other column's own extent", () => {
+    render(<LaneDiffView file={FILE} layout="split" />);
+    const left = screen.getByTestId("lane-diff-split-left");
+    const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, { scrollWidth: 500, clientWidth: 200, scrollHeight: 300, clientHeight: 200 });
+    layout(right, { scrollWidth: 1000, clientWidth: 200, scrollHeight: 300, clientHeight: 200 });
+
+    right.scrollLeft = 600;
+    right.scrollTop = 250;
+    fireEvent.scroll(right);
+    expect(left.scrollLeft).toBe(300);
+    expect(left.scrollTop).toBe(100);
+  });
+
+  it("does not let the narrow column's clamped echo drag the wide one back", () => {
+    render(<LaneDiffView file={FILE} layout="split" />);
+    const left = screen.getByTestId("lane-diff-split-left");
+    const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, { scrollWidth: 500, clientWidth: 200 });
+    layout(right, { scrollWidth: 1000, clientWidth: 200 });
+
+    right.scrollLeft = 600;
+    fireEvent.scroll(right);
+    // A browser fires the narrow column's scroll for the clamped write.
+    fireEvent.scroll(left);
+    expect(right.scrollLeft).toBe(600);
+
+    // A real move of the narrow column still carries the wide one.
+    left.scrollLeft = 100;
+    fireEvent.scroll(left);
+    expect(right.scrollLeft).toBe(100);
+  });
+
   it("keeps the unified layout on one scroller", () => {
     render(<LaneDiffView file={FILE} layout="unified" />);
     expect(screen.queryByTestId("lane-diff-split-left")).toBeNull();
@@ -158,3 +245,217 @@ describe("LaneDiffView — row styling", () => {
     expect(left!.className).not.toMatch(/status-(success|danger)/);
   });
 });
+
+describe("analyseHunk", () => {
+  const hunk = {
+    header: "@@ -1,4 +1,4 @@",
+    context: "",
+    oldStart: 1,
+    newStart: 1,
+    lines: [
+      { type: "ctx" as const, oldLine: 1, newLine: 1, text: "keep" },
+      { type: "del" as const, oldLine: 2, newLine: null, text: "foo = 1" },
+      { type: "add" as const, oldLine: null, newLine: 2, text: "foo = 2" },
+      { type: "del" as const, oldLine: 3, newLine: null, text: "bar = 1" },
+      { type: "add" as const, oldLine: null, newLine: 3, text: "bar = 2" },
+    ],
+  };
+
+  it("pairs each del/add with its emphasis, keyed by line index", () => {
+    const a = analyseHunk(hunk);
+    expect(a.rows).toHaveLength(3);
+    expect(a.emph.get(1)).toEqual([6, 7]);
+    expect(a.emph.get(2)).toEqual([6, 7]);
+    expect(a.emph.get(3)).toEqual([6, 7]);
+    expect(a.emph.get(4)).toEqual([6, 7]);
+    expect(a.emph.has(0)).toBe(false);
+  });
+
+  it("computes once per hunk, so both split columns and re-renders share it", () => {
+    expect(analyseHunk(hunk)).toBe(analyseHunk(hunk));
+  });
+});
+
+describe("visibleRange", () => {
+  it("covers the viewport plus overscan on both sides", () => {
+    expect(visibleRange(0, 160, 16, 1000, 5)).toEqual({ start: 0, end: 15 });
+    expect(visibleRange(1600, 160, 16, 1000, 5)).toEqual({ start: 95, end: 115 });
+  });
+
+  it("clamps a scrollTop past the content to the last full viewport", () => {
+    expect(visibleRange(99999, 160, 16, 1000, 5)).toEqual({ start: 985, end: 1000 });
+    expect(visibleRange(-50, 160, 16, 1000, 5)).toEqual({ start: 0, end: 15 });
+  });
+
+  it("never runs past a short list", () => {
+    expect(visibleRange(0, 800, 16, 3, 5)).toEqual({ start: 0, end: 3 });
+    expect(visibleRange(0, 800, 16, 0, 5)).toEqual({ start: 0, end: 0 });
+  });
+});
+
+function bigFile(n: number): LaneChangeFile {
+  const lines = Array.from({ length: n }, (_, i) =>
+    i % 2
+      ? { type: "add" as const, oldLine: null, newLine: i + 1, text: `line ${i};` }
+      : { type: "ctx" as const, oldLine: i + 1, newLine: i + 1, text: `line ${i};` }
+  );
+  lines[7] = { type: "ctx", oldLine: 8, newLine: 8, text: `line 7; ${"w".repeat(300)}` };
+  return fileWith(lines);
+}
+
+const rowsIn = (el: HTMLElement) => [...el.querySelectorAll<HTMLElement>("div.flex.w-max")];
+
+describe("LaneDiffView — windowing", () => {
+  it("renders every row below the threshold, with no spacers", () => {
+    const { container } = render(
+      <LaneDiffView file={bigFile(WINDOW_THRESHOLD - 10)} layout="unified" />
+    );
+    expect(rowsIn(container)).toHaveLength(WINDOW_THRESHOLD - 10);
+    expect(container.querySelector("[data-diff-spacer]")).toBeNull();
+  });
+
+  it("renders far fewer rows than a 5000-line diff holds, keeping the full scroll height", () => {
+    const { container } = render(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    const rows = rowsIn(container);
+    expect(rows.length).toBeGreaterThan(0);
+    expect(rows.length).toBeLessThan(300);
+    const spacers = [...container.querySelectorAll<HTMLElement>("[data-diff-spacer]")];
+    const spaced = spacers.reduce((sum, s) => sum + parseFloat(s.style.height), 0);
+    // header + 5000 lines, every item one fixed row tall
+    const rendered = container.querySelectorAll("[data-diff-item]").length;
+    expect(spaced + rendered * ROW_PX).toBe(5001 * ROW_PX);
+  });
+
+  it("moves the window with the scroll", () => {
+    const { container } = render(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    const view = screen.getByTestId("lane-diff-view");
+    expect(container.textContent).not.toContain("line 3000;");
+    view.scrollTop = 3000 * ROW_PX;
+    fireEvent.scroll(view);
+    expect(container.textContent).toContain("line 3000;");
+    expect(container.textContent).not.toContain("line 10;");
+  });
+
+  it("starts windowing where the reader is when a diff grows past the threshold", () => {
+    const { container, rerender } = render(<LaneDiffView file={bigFile(400)} layout="unified" />);
+    const view = screen.getByTestId("lane-diff-view");
+    view.scrollTop = 350 * ROW_PX;
+    fireEvent.scroll(view);
+    // Expanding context replaces the file in place, same mounted view.
+    rerender(<LaneDiffView file={bigFile(600)} layout="unified" />);
+    expect(container.textContent).toContain("line 350;");
+  });
+
+  it("starts from the top again after a round trip through split", () => {
+    const { container, rerender } = render(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    const view = screen.getByTestId("lane-diff-view");
+    view.scrollTop = 3000 * ROW_PX;
+    fireEvent.scroll(view);
+    rerender(<LaneDiffView file={bigFile(5000)} layout="split" />);
+    // In split the outer box is no scroller; the browser drops its offset.
+    screen.getByTestId("lane-diff-view").scrollTop = 0;
+    rerender(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    expect(container.textContent).toContain("line 5;");
+  });
+
+  it("holds the horizontal extent at the longest line, rendered or not", () => {
+    const { container } = render(<LaneDiffView file={bigFile(5000)} layout="unified" />);
+    const view = screen.getByTestId("lane-diff-view");
+    view.scrollTop = 3000 * ROW_PX;
+    fireEvent.scroll(view);
+    const content = container.querySelector<HTMLElement>("[data-diff-content]")!;
+    // the 300-w line 7 is off screen now, and still sets the width
+    expect(content.style.minWidth).toContain(`${"line 7; ".length + 300 + 1}ch`);
+  });
+
+  it("windows both split columns over the same row range", () => {
+    render(<LaneDiffView file={bigFile(5000)} layout="split" />);
+    const left = screen.getByTestId("lane-diff-split-left");
+    const right = screen.getByTestId("lane-diff-split-right");
+    layout(left, { scrollHeight: 5001 * ROW_PX, clientHeight: 400 });
+    layout(right, { scrollHeight: 5001 * ROW_PX, clientHeight: 400 });
+    right.scrollTop = 2000 * ROW_PX;
+    fireEvent.scroll(right);
+    expect(left.scrollTop).toBe(2000 * ROW_PX);
+    const l = rowsIn(left);
+    const r = rowsIn(right);
+    expect(l.length).toBeLessThan(300);
+    expect(l).toHaveLength(r.length);
+    expect(right.textContent).toContain("line 2001;");
+    // same rows: the right column's add has its filler row on the left
+    expect(left.textContent).toContain("line 2000;");
+  });
+
+  it("windows a whole-file read too", () => {
+    const lines = Array.from({ length: 5000 }, (_, i) => `row ${i}`);
+    const { container } = render(<LaneFileView path="a.ts" lines={lines} />);
+    expect(rowsIn(container).length).toBeLessThan(300);
+    const view = screen.getByTestId("lane-file-view");
+    view.scrollTop = 4000 * ROW_PX;
+    fireEvent.scroll(view);
+    expect(container.textContent).toContain("row 4000");
+  });
+});
+
+describe("LaneDiffView — hunk review bar navigation", () => {
+  const hunk = (n: number) => ({
+    header: `@@ -${n},1 +${n},1 @@`,
+    context: "",
+    oldStart: n,
+    newStart: n,
+    lines: [
+      { type: "del" as const, oldLine: n, newLine: null, text: `old ${n}` },
+      { type: "add" as const, oldLine: null, newLine: n, text: `new ${n}` },
+    ],
+  });
+  const three: LaneChangeFile = { ...FILE, hunks: [hunk(1), hunk(20), hunk(40)] };
+
+  // jsdom lays nothing out: give the ONE real scroller a scrollable box and
+  // put hunk k's `@@` row k×100px below its top, wherever it has scrolled to.
+  function renderInScroller() {
+    const view = render(
+      <div data-testid="scroller" style={{ overflowY: "auto" }}>
+        <LaneDiffView file={three} layout="unified" hunkActions={() => <span />} />
+      </div>
+    );
+    const scroller = screen.getByTestId("scroller");
+    Object.defineProperty(scroller, "scrollHeight", { value: 1000 });
+    Object.defineProperty(scroller, "clientHeight", { value: 100 });
+    scroller.getBoundingClientRect = () => ({ top: 0 }) as DOMRect;
+    for (const el of view.container.querySelectorAll<HTMLElement>("[data-hunk-index]")) {
+      const k = Number(el.dataset.hunkIndex);
+      el.getBoundingClientRect = () => ({ top: k * 100 - scroller.scrollTop }) as DOMRect;
+    }
+    return scroller;
+  }
+
+  it("steps to the NEXT hunk and back to the PREVIOUS one, not the first", () => {
+    const scroller = renderInScroller();
+    const next = screen.getAllByRole("button", { name: "Next change" });
+    const prev = screen.getAllByRole("button", { name: "Previous change" });
+
+    fireEvent.click(next[0]!); // bar 1 → hunk 2
+    expect(scroller.scrollTop).toBe(100);
+    fireEvent.click(next[1]!); // bar 2 → hunk 3
+    expect(scroller.scrollTop).toBe(200);
+    fireEvent.click(prev[2]!); // bar 3 → hunk 2, not hunk 1
+    expect(scroller.scrollTop).toBe(100);
+  });
+
+  it("counts the hunks and disables the arrows at either end", () => {
+    renderInScroller();
+    const bars = screen.getAllByTestId("lane-hunk-bar");
+    expect(bars.map((b) => b.textContent)).toEqual([
+      expect.stringContaining("1 of 3"),
+      expect.stringContaining("2 of 3"),
+      expect.stringContaining("3 of 3"),
+    ]);
+    expect(screen.getAllByRole("button", { name: "Previous change" })[0]).toBeDisabled();
+    expect(screen.getAllByRole("button", { name: "Next change" })[2]).toBeDisabled();
+  });
+
+  it("leaves an unwindowed review diff uncapped, so the panel is its only scroller", () => {
+    render(<LaneDiffView file={three} layout="unified" />);
+    expect(screen.getByTestId("lane-diff-view").className).not.toContain("max-h-[60vh]");
+  });
+});

client/src/components/lanes/__tests__/LaneGitBar.test.tsx

@@ -1,8 +1,8 @@
 /**
  * @file LaneGitBar.test.tsx
  * @description Pins the lane git action row: the ahead/behind readout, which
- * buttons a repo with no remote may press, that commit sends the typed
- * message, that a dirty tree blocks the branch switch client-side (the server
+ * buttons a repo with no remote may press, that it offers no commit (the
+ * Changes panel's staged-only box owns that), that a dirty tree blocks the branch switch client-side (the server
  * refuses it too), and that a failed action shows git's own words rather than
  * a generic sentence.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -70,28 +70,13 @@ describe("LaneGitBar", () => {
     );
     expect(screen.getByRole("button", { name: /Fetch/ })).toBeDisabled();
     expect(screen.getByRole("button", { name: /Push/ })).toBeDisabled();
-    // Local actions stay available — a repo with no remote still commits.
-    expect(screen.getByRole("button", { name: /^Commit$/ })).toBeEnabled();
+    // Local actions stay available — a repo with no remote still branches.
+    expect(screen.getByRole("button", { name: /Branch/ })).toBeEnabled();
   });
 
-  it("commits with the typed message and reports the change upward", async () => {
-    const user = userEvent.setup();
-    const onChanged = vi.fn();
-    render(<LaneGitBar laneId={3} git={facts()} onChanged={onChanged} />);
-
-    await user.click(screen.getByRole("button", { name: /^Commit$/ }));
-    await user.type(screen.getByLabelText("Commit message"), "fix: the thing");
-    await user.click(screen.getByRole("button", { name: /Commit 3 files/ }));
-
-    await waitFor(() =>
-      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "commit", { message: "fix: the thing" })
-    );
-    expect(onChanged).toHaveBeenCalled();
-  });
-
-  it("offers no commit when nothing is uncommitted", () => {
-    render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
-    expect(screen.getByRole("button", { name: /^Commit$/ })).toBeDisabled();
+  it("offers no commit at all — that is the Changes panel's staged-only box", () => {
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    expect(screen.queryByRole("button", { name: /Commit/ })).toBeNull();
   });
 
   it("loads the branch list on demand and refuses to switch while dirty", async () => {
@@ -120,6 +105,15 @@ describe("LaneGitBar", () => {
     );
   });
 
+  it("re-reads the branch list after a switch, so the branch just left is not held", async () => {
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts({ dirty: 0, untracked: 0 })} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+    await user.click(screen.getByRole("button", { name: "Switch branch" }));
+    await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledTimes(2));
+  });
+
   it("creates a branch without switching, then offers a sibling lane on it", async () => {
     const user = userEvent.setup();
     const onNewLane = vi.fn();
@@ -146,20 +140,32 @@ describe("LaneGitBar", () => {
     expect(onNewLane).toHaveBeenCalledWith("development");
   });
 
-  it("commits only the index when asked", async () => {
+  it("offers a sibling lane only on a branch no worktree holds — the server refuses the rest", async () => {
+    vi.mocked(api.lanes.gitBranches).mockResolvedValue({
+      available: true,
+      branches: ["development", "feat/thing", "feat/free"],
+      current: "feat/thing",
+      worktrees: [
+        { path: "/repo/lane3", branch: "feat/thing" },
+        { path: "/repo/dev", branch: "development" },
+      ],
+    });
     const user = userEvent.setup();
-    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} onNewLane={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    const select = await screen.findByLabelText("Switch branch…");
+    const newLane = () => screen.getByRole("button", { name: "New lane here" });
 
-    await user.click(screen.getByRole("button", { name: /^Commit$/ }));
-    await user.type(screen.getByLabelText(/Commit message/), "fix: staged only");
-    await user.click(screen.getByRole("button", { name: "Commit staged" }));
+    // This lane's own branch: its worktree is this lane.
+    await user.selectOptions(select, "feat/thing");
+    expect(newLane()).toBeDisabled();
+    // Held by another worktree: git allows one worktree per branch (EBRANCHBUSY).
+    await user.selectOptions(select, "development");
+    expect(newLane()).toBeDisabled();
+    expect(newLane()).toHaveAttribute("title", expect.stringContaining("/repo/dev"));
 
-    await waitFor(() =>
-      expect(api.lanes.gitAction).toHaveBeenCalledWith(3, "commit", {
-        message: "fix: staged only",
-        only: "staged",
-      })
-    );
+    await user.selectOptions(select, "feat/free");
+    expect(newLane()).toBeEnabled();
   });
 
   it("prints git's own rejection text when an action fails", async () => {
@@ -172,4 +178,80 @@ describe("LaneGitBar", () => {
     await user.click(screen.getByRole("button", { name: /Push/ }));
     expect(await screen.findByTestId("lane-git-bar-error")).toHaveTextContent("non-fast-forward");
   });
+
+  it("re-reads the branch list for the new lane instead of showing the old one's", async () => {
+    const user = userEvent.setup();
+    const { rerender } = render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await user.selectOptions(await screen.findByLabelText("Switch branch…"), "development");
+
+    rerender(<LaneGitBar laneId={4} git={facts()} onChanged={vi.fn()} />);
+    expect(screen.queryByLabelText("Switch branch…")).toBeNull();
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledWith(4));
+    expect(await screen.findByLabelText("Switch branch…")).toHaveValue("");
+  });
+
+  it("sends one branch-create for a double Enter", async () => {
+    vi.mocked(api.lanes.gitAction).mockReturnValue(new Promise(() => {}));
+    const user = userEvent.setup();
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    await user.type(await screen.findByLabelText(/New branch/), "feat/once{Enter}{Enter}");
+    expect(api.lanes.gitAction).toHaveBeenCalledTimes(1);
+  });
+
+  it("forgets which branches the previous lane's worktrees held once the lane changes", async () => {
+    let resolveOld: (v: Awaited<ReturnType<typeof api.lanes.gitBranches>>) => void = () => {};
+    vi.mocked(api.lanes.gitBranches).mockReturnValueOnce(
+      new Promise((r) => {
+        resolveOld = r;
+      })
+    );
+    const user = userEvent.setup();
+    const { rerender } = render(
+      <LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} onNewLane={vi.fn()} />
+    );
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+
+    rerender(<LaneGitBar laneId={4} git={facts()} onChanged={vi.fn()} onNewLane={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Branch/ }));
+    const select = await screen.findByLabelText("Switch branch…");
+    await waitFor(() => expect(api.lanes.gitBranches).toHaveBeenCalledWith(4));
+    // Lane 3's answer lands late: its worktree held `development`.
+    resolveOld({
+      available: true,
+      branches: ["development", "feat/thing"],
+      current: "feat/thing",
+      worktrees: [{ path: "/repo/dev", branch: "development" }],
+    });
+    await user.selectOptions(select, "development");
+    const newLane = screen.getByRole("button", { name: "New lane here" });
+    expect(newLane).toBeEnabled();
+    expect(newLane).not.toHaveAttribute("title", expect.stringContaining("/repo/dev"));
+  });
+
+  it("claims no sync state when the upstream comparison could not be counted", () => {
+    render(
+      <LaneGitBar
+        laneId={3}
+        git={facts({ upstream: "origin/gone", ahead: null, behind: null })}
+        onChanged={vi.fn()}
+      />
+    );
+    expect(screen.queryByText("in sync")).toBeNull();
+    expect(screen.queryByTestId("lane-git-tracking")).toBeNull();
+  });
+
+  it("explains a push with nowhere to go instead of the server's generic text", async () => {
+    const user = userEvent.setup();
+    vi.mocked(api.lanes.gitAction).mockRejectedValue(
+      Object.assign(new Error("this repository has no remote to push to"), { code: "ENOREMOTE" })
+    );
+    render(<LaneGitBar laneId={3} git={facts()} onChanged={vi.fn()} />);
+    await user.click(screen.getByRole("button", { name: /Push/ }));
+    expect(await screen.findByTestId("lane-git-bar-error")).toHaveTextContent(
+      "No remote to push to or pull from"
+    );
+  });
 });

client/src/components/lanes/__tests__/LaneGitHeader.test.tsx

@@ -0,0 +1,160 @@
+/**
+ * @file LaneGitHeader.test.tsx
+ * @description Pins the Changes panel's working-copy line: the live branch,
+ * head, subject and uncommitted counts, the per-file hover panel behind the
+ * counts, that a lane switch drops the previous lane's facts at once, and that
+ * an unreadable repo renders nothing rather than an error.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, waitFor, fireEvent } from "@testing-library/react";
+import { LaneGitHeader, useLaneGitFacts } from "../LaneGitHeader";
+import { api } from "../../../lib/api";
+
+vi.mock("../../../lib/api", () => ({
+  api: { lanes: { git: vi.fn(), gitAction: vi.fn(), gitBranches: vi.fn() } },
+}));
+
+beforeEach(() => {
+  vi.mocked(api.lanes.git).mockReset().mockResolvedValue({ available: false });
+});
+
+/** The panel's own wiring: one facts read feeding the header. */
+function Harness({ laneId }: { laneId: number }) {
+  const [git, refresh] = useLaneGitFacts(laneId);
+  return <LaneGitHeader laneId={laneId} git={git} onChanged={refresh} />;
+}
+
+describe("LaneGitHeader", () => {
+  const facts = {
+    available: true as const,
+    branch: "feat/rename-metric",
+    head: "9b3e74a",
+    subject: "free-text rule mode in the form",
+    dirty: 2,
+    untracked: 1,
+    files: [
+      { path: "server/lib/alerts.js", status: " M", added: 12, deleted: 3 },
+      { path: "client/src/lib/api.ts", status: "M ", added: 1, deleted: 0 },
+      { path: "scratch.txt", status: "??", added: null, deleted: null },
+    ],
+    // Tracking facts ride along on the same endpoint; a branch that has never
+    // been pushed reports nulls rather than zeros.
+    hasRemote: true,
+    upstream: null,
+    ahead: null,
+    behind: null,
+  };
+
+  it("renders the live branch, head, subject and uncommitted counts", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
+    render(<Harness laneId={1} />);
+
+    const block = await screen.findByTestId("lane-git");
+    expect(block.textContent).toContain("feat/rename-metric");
+    expect(block.textContent).toContain("9b3e74a");
+    expect(block.textContent).toContain("free-text rule mode in the form");
+    expect(screen.getByTestId("lane-git-counts").textContent).toContain("2");
+  });
+
+  it("drops the previous lane's facts the moment the lane changes", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
+    const { rerender } = render(<Harness laneId={1} />);
+    await screen.findByText(/feat\/rename-metric/);
+
+    // The next lane's read never lands: nothing of lane 1's git may linger.
+    vi.mocked(api.lanes.git).mockReturnValueOnce(new Promise(() => {}));
+    rerender(<Harness laneId={2} />);
+    expect(screen.queryByText(/feat\/rename-metric/)).toBeNull();
+  });
+
+  it("names the files behind the counts on hover, with each one's line delta", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
+    render(<Harness laneId={1} />);
+
+    const counts = await screen.findByTestId("lane-git-counts");
+    // Hidden until asked for: the row is a one-line summary until you hover.
+    expect(screen.queryByTestId("lane-git-files")).toBeNull();
+
+    fireEvent.mouseEnter(counts);
+    const panel = screen.getByTestId("lane-git-files");
+    expect(panel.textContent).toContain("alerts.js");
+    expect(panel.textContent).toContain("+12");
+    expect(panel.textContent).toContain("−3");
+    // Totals across the listed files.
+    expect(panel.textContent).toContain("+13");
+    // An untracked file has no delta to report and says so rather than "+0".
+    expect(panel.textContent).toContain("new");
+    expect(panel.textContent).toContain("3 files changed");
+
+    // Closing is delayed so the pointer can travel into the panel and scroll
+    // it — the panel is portalled to the body, away from its trigger.
+    fireEvent.mouseLeave(counts);
+    expect(screen.queryByTestId("lane-git-files")).not.toBeNull();
+    await waitFor(() => expect(screen.queryByTestId("lane-git-files")).toBeNull());
+  });
+
+  it("stays open while the pointer is inside the panel", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce(facts);
+    render(<Harness laneId={1} />);
+
+    const counts = await screen.findByTestId("lane-git-counts");
+    fireEvent.mouseEnter(counts);
+    fireEvent.mouseLeave(counts);
+    // The pointer landed on the panel before the pending close fired.
+    fireEvent.mouseEnter(screen.getByTestId("lane-git-files"));
+    await new Promise((r) => setTimeout(r, 200));
+    expect(screen.queryByTestId("lane-git-files")).not.toBeNull();
+
+    fireEvent.mouseLeave(screen.getByTestId("lane-git-files"));
+    await waitFor(() => expect(screen.queryByTestId("lane-git-files")).toBeNull());
+  });
+
+  it("says how many files the server-side cap left out", async () => {
+    // 40 uncommitted files, 3 listed: the counts are exact, the listing is not.
+    vi.mocked(api.lanes.git).mockResolvedValueOnce({ ...facts, dirty: 39, untracked: 1 });
+    render(<Harness laneId={1} />);
+
+    fireEvent.mouseEnter(await screen.findByTestId("lane-git-counts"));
+    expect(screen.getByTestId("lane-git-files").textContent).toContain("37 more");
+  });
+
+  it("omits the uncommitted line when the tree is clean", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce({ ...facts, dirty: 0, untracked: 0 });
+    render(<Harness laneId={1} />);
+    const block = await screen.findByTestId("lane-git");
+    expect(block.textContent).not.toContain("modified");
+  });
+
+  it("renders nothing and no error when git is unavailable", async () => {
+    vi.mocked(api.lanes.git).mockResolvedValueOnce({ available: false });
+    render(<Harness laneId={2} />);
+
+    await waitFor(() => expect(api.lanes.git).toHaveBeenCalledWith(2));
+    expect(screen.queryByTestId("lane-git-header")).toBeNull();
+  });
+
+  it("swallows a rejected request instead of surfacing an error", async () => {
+    vi.mocked(api.lanes.git).mockRejectedValueOnce(new Error("network down"));
+    render(<Harness laneId={3} />);
+
+    await waitFor(() => expect(api.lanes.git).toHaveBeenCalledWith(3));
+    expect(screen.queryByTestId("lane-git")).toBeNull();
+    expect(screen.queryByText(/network down/)).toBeNull();
+  });
+
+  it("stops polling once the panel unmounts", async () => {
+    vi.useFakeTimers();
+    try {
+      vi.mocked(api.lanes.git).mockResolvedValue({ available: false });
+      const { unmount } = render(<Harness laneId={1} />);
+      expect(api.lanes.git).toHaveBeenCalledTimes(1);
+      unmount();
+      vi.advanceTimersByTime(120_000);
+      expect(api.lanes.git).toHaveBeenCalledTimes(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});

client/src/components/run/LaneConsolePane.tsx

@@ -16,8 +16,9 @@
  * and its live tmux session — instead of leaving the previous lane's terminal
  * on screen under a new lane's header.
  *
- * A lane's pane is one tmux session, so starting or resuming into a lane
- * already holding a live run answers 409 ERUNLIVE rather than overwriting a
+ * Each pane is one tmux session on its lane — split panes all show the same
+ * lane, pane `slot` N owning `agenthub-lane-<id>[-N]` — so starting or resuming
+ * into a pane already holding a live run answers 409 ERUNLIVE rather than overwriting a
  * prompt in flight — `onStartFromSetup` and `onResumeFromHistory` both catch
  * that and attach to the still-live session instead of failing outright
  * (with a notice explaining what happened), since that session is still
@@ -27,7 +28,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-import { useCallback, useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Play, AlertCircle } from "lucide-react";
 import { api } from "../../lib/api";
@@ -47,6 +48,20 @@ import { TerminalView } from "./TerminalView";
 import { RunSetup } from "./RunSetup";
 import { ActiveRunsSwitcher } from "./RunHistory";
 
+/** The claude lane a session's cwd belongs to: the longest path-boundary
+ *  prefix, the same rule the server binds hook sessions with. External
+ *  sessions are all claude — Codex emits no hooks. */
+function owningLaneId(cwd: string, lanes: Lane[]): number | null {
+  let best: Lane | null = null;
+  for (const l of lanes) {
+    if (l.tool !== "claude") continue;
+    const root = l.cwd.replace(/\/+$/, "");
+    if (cwd !== root && !cwd.startsWith(root + "/")) continue;
+    if (!best || root.length > best.cwd.replace(/\/+$/, "").length) best = l;
+  }
+  return best?.id ?? null;
+}
+
 export interface LaneConsolePaneProps {
   lanes: Lane[];
   laneId: number | null;
@@ -62,6 +77,19 @@ export interface LaneConsolePaneProps {
   wsConnected: boolean;
   defaultCwd?: string;
   onHasActiveRunChange?: (active: boolean) => void;
+  /** Which split pane this is. Every pane shows the SAME lane, each in its own
+   *  tmux session: slot 0 is the lane's own, 1–3 are `agenthub-lane-<id>-<slot>`. */
+  slot?: number;
+  /** Runs the OTHER panes are showing — left out of this pane's Active runs so
+   *  one terminal is never attached twice side by side. */
+  hiddenRunIds?: string[];
+  /** Reports the run this pane shows (null on the setup form). */
+  onHandleChange?: (runId: string | null) => void;
+}
+
+/** The tmux session a lane's split pane owns (see server/lib/pty-run.js). */
+function paneRunId(laneId: number, slot: number): string {
+  return slot ? `agenthub-lane-${laneId}-${slot}` : `agenthub-lane-${laneId}`;
 }
 
 export function LaneConsolePane({
@@ -77,6 +105,9 @@ export function LaneConsolePane({
   wsConnected,
   defaultCwd,
   onHasActiveRunChange,
+  slot = 0,
+  hiddenRunIds,
+  onHandleChange,
 }: LaneConsolePaneProps) {
   const { t } = useTranslation("run");
   const { t: tLanes } = useTranslation("lanes");
@@ -97,12 +128,37 @@ export function LaneConsolePane({
 
   const currentLane = laneId !== null ? lanes.find((l) => l.id === laneId) : null;
   const laneTool = currentLane?.tool ?? "claude";
+  // The page polls runs and sessions for EVERY lane; this pane's Active runs
+  // list is this lane's only. No lane selected keeps the full lists.
+  const laneRuns = useMemo(
+    () =>
+      laneId === null || !activeRuns
+        ? activeRuns
+        : {
+            ...activeRuns,
+            items: activeRuns.items.filter(
+              (r) => r.laneId === laneId && !hiddenRunIds?.includes(r.id)
+            ),
+          },
+    [activeRuns, laneId, hiddenRunIds]
+  );
+  const laneSessions = useMemo(
+    () =>
+      laneId === null
+        ? externalSessions
+        : (externalSessions ?? []).filter((s) => s.cwd && owningLaneId(s.cwd, lanes) === laneId),
+    [externalSessions, laneId, lanes]
+  );
   const toolLabel = laneTool === "codex" ? "Codex" : "Claude";
 
   useEffect(() => {
     onHasActiveRunChange?.(handle !== null);
   }, [handle, onHasActiveRunChange]);
 
+  useEffect(() => {
+    onHandleChange?.(handle?.id ?? null);
+  }, [handle, onHandleChange]);
+
   useEffect(() => {
     if (!currentLane && defaultCwd && cwd === "") {
       setCwd(defaultCwd);
@@ -141,10 +197,11 @@ export function LaneConsolePane({
     setResumeSession(null);
     setError(null);
     setBusy(null);
-    setHandle(runs?.items.find((r) => r.laneId === laneId && r.status === "running") ?? null);
+    const own = laneId === null ? null : paneRunId(laneId, slot);
+    setHandle(runs?.items.find((r) => r.id === own && r.status === "running") ?? null);
     autoAttachedForLane.current = null;
     refreshList();
-  }, [laneId, refreshList]);
+  }, [laneId, slot, refreshList]);
 
   // Picking a pipeline template writes NOTHING into the prompt box: a prefilled
   // slash command (or the codex stage-checklist prose) is sent as soon as the
@@ -161,12 +218,13 @@ export function LaneConsolePane({
   useEffect(() => {
     if (handle || laneId === null) return;
     if (autoAttachedForLane.current === laneId) return;
-    const running = activeRuns?.items.find((r) => r.laneId === laneId && r.status === "running");
+    const own = paneRunId(laneId, slot);
+    const running = activeRuns?.items.find((r) => r.id === own && r.status === "running");
     if (running) {
       autoAttachedForLane.current = laneId;
       setHandle(running);
     }
-  }, [activeRuns, laneId, handle]);
+  }, [activeRuns, laneId, slot, handle]);
 
   // The cwd tracks the lane's own folder separately, keyed on the resolved
   // path rather than on `laneId` alone: the pane can mount before the lane
@@ -245,6 +303,7 @@ export function LaneConsolePane({
         let laneStartResult;
         try {
           laneStartResult = await api.lanes.action(targetLaneId, "start", {
+            slot,
             prompt: args.initialPrompt || "",
             model: args.model || undefined,
             permissionMode: args.permissionMode,
@@ -259,29 +318,27 @@ export function LaneConsolePane({
           // already has a live run"), never the literal strings "409" or
           // "ERUNLIVE" — matching against `.message` here is dead code that
           // always falls through to the raw error below.
+          // This pane's own session is the live one — land on it.
           if ((laneErr as { code?: string })?.code === "ERUNLIVE") {
-            const fresh = await api.lanes.list().catch(() => null);
-            const updatedLane = fresh?.lanes.find((l) => l.id === targetLaneId);
-            if (updatedLane?.run_id) {
-              await attachToRun(updatedLane.run_id);
-              setError(t("errors.attachedToLiveInstead"));
-              return;
-            }
+            await attachToRun(paneRunId(targetLaneId, slot));
+            setError(t("errors.attachedToLiveInstead"));
+            return;
           }
           throw laneErr;
         }
 
-        if (!laneStartResult.lane?.run_id) {
+        const startedId = laneStartResult.run_id ?? laneStartResult.lane?.run_id;
+        if (!startedId) {
           throw new Error(t("errors.noRunIdReturned"));
         }
 
         try {
-          const fetched = await api.run.get(laneStartResult.lane.run_id);
+          const fetched = await api.run.get(startedId);
           setHandle(fetched);
           refreshList();
         } catch {
           try {
-            await attachToRun(laneStartResult.lane.run_id);
+            await attachToRun(startedId);
             refreshList();
           } catch (fallbackErr: unknown) {
             const attachMsg = fallbackErr instanceof Error ? fallbackErr.message : "unknown";
@@ -295,7 +352,18 @@ export function LaneConsolePane({
         setBusy(null);
       }
     },
-    [busy, t, lanes, laneId, laneTool, onLaneIdChange, onLaneCreated, attachToRun, refreshList]
+    [
+      busy,
+      t,
+      lanes,
+      laneId,
+      laneTool,
+      slot,
+      onLaneIdChange,
+      onLaneCreated,
+      attachToRun,
+      refreshList,
+    ]
   );
 
   const onResumeFromHistory = useCallback(
@@ -323,6 +391,7 @@ export function LaneConsolePane({
           let laneStartResult;
           try {
             laneStartResult = await api.lanes.action(targetLaneId, "start", {
+              slot,
               prompt: "",
               model: item.model || undefined,
               permissionMode: item.permission_mode || undefined,
@@ -337,23 +406,20 @@ export function LaneConsolePane({
             // — the server's `.message` is prose, never the literal string
             // "ERUNLIVE" or "409".
             if ((laneErr as { code?: string })?.code === "ERUNLIVE") {
-              const fresh = await api.lanes.list().catch(() => null);
-              const updatedLane = fresh?.lanes.find((l) => l.id === targetLaneId);
-              if (updatedLane?.run_id) {
-                onLaneIdChange(targetLaneId);
-                await attachToRun(updatedLane.run_id);
-                setError(t("errors.attachedToLiveInstead"));
-                return;
-              }
+              onLaneIdChange(targetLaneId);
+              await attachToRun(paneRunId(targetLaneId, slot));
+              setError(t("errors.attachedToLiveInstead"));
+              return;
             }
             throw laneErr;
           }
 
-          if (!laneStartResult.lane?.run_id) {
+          const startedId = laneStartResult.run_id ?? laneStartResult.lane?.run_id;
+          if (!startedId) {
             throw new Error("No run_id returned from lane start");
           }
 
-          fetched = await api.run.get(laneStartResult.lane.run_id);
+          fetched = await api.run.get(startedId);
           onLaneIdChange(targetLaneId);
         } else {
           fetched = await api.run.start({
@@ -377,7 +443,7 @@ export function LaneConsolePane({
         setBusy(null);
       }
     },
-    [busy, refreshList, t, lanes, onLaneCreated, onLaneIdChange, attachToRun]
+    [busy, refreshList, t, lanes, slot, onLaneCreated, onLaneIdChange, attachToRun]
   );
 
   const onViewFromHistory = useCallback(
@@ -487,11 +553,11 @@ export function LaneConsolePane({
           </p>
         </div>
         <ActiveRunsSwitcher
-          activeRuns={activeRuns}
+          activeRuns={laneRuns}
           currentHandleId={handle?.id || null}
           onAttach={attachToRun}
           runHistory={runHistory}
-          externalSessions={externalSessions}
+          externalSessions={laneSessions}
           onResumeFromHistory={onResumeFromHistory}
           onViewFromHistory={onViewFromHistory}
           onKill={killRun}

client/src/components/run/RunSetup.tsx

@@ -53,30 +53,214 @@ import type {
   RunStartArgs,
   CodexSandbox,
   CodexApproval,
+  CcMdItem,
 } from "../../lib/api";
 import type { Session, LaneTool } from "../../lib/types";
 import { Select } from "../Select";
 
-// Minimal SlashCommand type (from deleted RunConsole)
 export interface SlashCommand {
   name: string;
-  source: "project" | "user" | "plugin" | "builtin";
+  source: "project" | "user" | "builtin";
   description?: string;
 }
 
-// Minimal PromptEditor component (from deleted RunConsole)
+// Commands the CLI answers itself. They are typed into the pane like any
+// other text, so they do run — they are just not files anyone can list.
+const BUILTIN_SLASH_COMMANDS: SlashCommand[] = [
+  "help",
+  "clear",
+  "compact",
+  "config",
+  "model",
+  "memory",
+  "hooks",
+  "cost",
+  "agents",
+  "review",
+  "permissions",
+  "status",
+  "init",
+  "mcp",
+  "plugin",
+  "output-style",
+  "exit",
+].map((name) => ({ name, source: "builtin" }));
+
+const SOURCE_ORDER = { project: 0, user: 1, builtin: 2 } as const;
+const SOURCE_TONE: Record<SlashCommand["source"], string> = {
+  project: "text-status-success border-status-success/40",
+  user: "text-accent border-accent/40",
+  builtin: "text-fg-muted border-border",
+};
+
+/** Tiered match: exact > prefix > word prefix > substring > subsequence >
+ *  description (3+ chars only, so one keystroke drags nothing tangential in). */
+function scoreSlashMatch(name: string, description: string | undefined, q: string): number {
+  if (!q) return 1;
+  const n = name.toLowerCase();
+  if (n === q) return 1000;
+  if (n.startsWith(q)) return 800 - Math.min(n.length, 100);
+  if (n.split(/[-_.:\s]/).some((p) => p.startsWith(q))) return 600 - Math.min(n.length, 100);
+  const idx = n.indexOf(q);
+  if (idx >= 0) return 400 - Math.min(idx, 100);
+  let i = 0;
+  for (let k = 0; k < n.length && i < q.length; k++) if (n[k] === q[i]) i++;
+  if (i === q.length) return 200;
+  if (q.length >= 3 && (description || "").toLowerCase().includes(q)) return 100;
+  return 0;
+}
+
+interface Trigger {
+  kind: "slash" | "file";
+  query: string;
+  /** Where the `/` or `@` token starts, so a pick replaces it up to the cursor. */
+  start: number;
+  cursor: number;
+}
+
+/** The `/…` or `@…` token the cursor is in, if any. A token starts at the
+ *  line start or after whitespace, so `a/b` and `me@x.io` never trigger. */
+function detectTrigger(value: string, cursor: number): Trigger | null {
+  let start = cursor;
+  while (start > 0 && !/\s/.test(value[start - 1] ?? " ")) start--;
+  const tok = value.slice(start, cursor);
+  if (tok.startsWith("/")) return { kind: "slash", query: tok.slice(1), start, cursor };
+  if (tok.startsWith("@")) return { kind: "file", query: tok.slice(1), start, cursor };
+  return null;
+}
+
 interface PromptEditorProps {
   value: string;
   onChange: (s: string) => void;
   onSubmit: () => void;
   placeholder: string;
   rows?: number;
-  slashCommands: SlashCommand[];
+  /** Offer slash commands. Off for codex: these are Claude Code's. */
+  slash: boolean;
+  /** Where `@` looks for files and project commands/skills are read from. */
   fileCwd: string;
 }
 
-function PromptEditor({ value, onChange, onSubmit, placeholder, rows = 5 }: PromptEditorProps) {
+function PromptEditor({
+  value,
+  onChange,
+  onSubmit,
+  placeholder,
+  rows = 5,
+  slash,
+  fileCwd,
+}: PromptEditorProps) {
+  const { t } = useTranslation("run");
+  const taRef = useRef<HTMLTextAreaElement | null>(null);
+  const [trigger, setTrigger] = useState<Trigger | null>(null);
+  const [active, setActive] = useState(0);
+  const [files, setFiles] = useState<string[]>([]);
+  const [commands, setCommands] = useState<SlashCommand[] | null>(null);
+  const [commandsCwd, setCommandsCwd] = useState(fileCwd);
+  if (commandsCwd !== fileCwd) {
+    setCommandsCwd(fileCwd);
+    setCommands(null);
+  }
+  const kind = trigger?.kind === "slash" && !slash ? null : trigger?.kind;
+
+  // Commands and skills are read the first time `/` is typed for this cwd —
+  // two directory walks nobody should pay for on every render of the form.
+  useEffect(() => {
+    if (kind !== "slash" || commands) return;
+    let live = true;
+    const toCmd = (c: CcMdItem): SlashCommand => ({
+      name: c.name,
+      source: c.scope,
+      description: c.frontmatter?.description || c.preview.slice(0, 80),
+    });
+    Promise.all([
+      api.ccConfig.commands(undefined, fileCwd).catch(() => ({ items: [] as CcMdItem[] })),
+      api.ccConfig.skills(undefined, fileCwd).catch(() => ({ items: [] as CcMdItem[] })),
+    ]).then(([c, sk]) => {
+      if (live) setCommands([...c.items, ...sk.items].map(toCmd).concat(BUILTIN_SLASH_COMMANDS));
+    });
+    return () => {
+      live = false;
+    };
+  }, [kind, commands, fileCwd]);
+
+  // Files: debounced, and only the newest query may land.
+  const query = trigger?.query ?? "";
+  useEffect(() => {
+    if (kind !== "file") return;
+    let live = true;
+    const tid = window.setTimeout(() => {
+      api.run
+        .files(fileCwd, query)
+        .then((r) => live && setFiles(r.items))
+        .catch(() => live && setFiles([]));
+    }, 120);
+    return () => {
+      live = false;
+      window.clearTimeout(tid);
+    };
+  }, [kind, query, fileCwd]);
+
+  const slashItems = useMemo(() => {
+    if (kind !== "slash" || !commands) return [];
+    const q = query.toLowerCase();
+    return commands
+      .map((cmd) => ({ cmd, score: scoreSlashMatch(cmd.name, cmd.description, q) }))
+      .filter((x) => x.score > 0)
+      .sort(
+        (a, b) =>
+          b.score - a.score ||
+          SOURCE_ORDER[a.cmd.source] - SOURCE_ORDER[b.cmd.source] ||
+          a.cmd.name.localeCompare(b.cmd.name)
+      )
+      .map((x) => x.cmd);
+  }, [kind, commands, query]);
+  const count = kind === "file" ? files.length : slashItems.length;
+  const current = Math.min(active, Math.max(0, count - 1));
+
+  const pick = (token: string) => {
+    if (!trigger) return;
+    const before = value.slice(0, trigger.start);
+    const after = value.slice(trigger.cursor);
+    const sep = after.startsWith(" ") ? "" : " ";
+    onChange(before + token + sep + after);
+    setTrigger(null);
+    setActive(0);
+    const pos = before.length + token.length + 1;
+    requestAnimationFrame(() => {
+      taRef.current?.focus();
+      taRef.current?.setSelectionRange(pos, pos);
+    });
+  };
+  const pickAt = (i: number) => {
+    if (kind === "file") {
+      const f = files[i];
+      if (f) pick(`@${f}`);
+    } else {
+      const c = slashItems[i];
+      if (c) pick(`/${c.name}`);
+    }
+  };
+
   const handleKeyDown = (e: React.KeyboardEvent<HTMLTextAreaElement>) => {
+    if (kind && count > 0) {
+      if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+        e.preventDefault();
+        const step = e.key === "ArrowDown" ? 1 : -1;
+        setActive(Math.min(count - 1, Math.max(0, current + step)));
+        return;
+      }
+      if ((e.key === "Enter" || e.key === "Tab") && !e.shiftKey && !e.nativeEvent.isComposing) {
+        e.preventDefault();
+        pickAt(current);
+        return;
+      }
+    }
+    if (kind && e.key === "Escape") {
+      e.preventDefault();
+      setTrigger(null);
+      return;
+    }
     // Enter sends (Ctrl/Cmd+Enter still does); Shift+Enter inserts a newline.
     // isComposing guards IME input (Vietnamese/CJK), where Enter commits the candidate.
     if (e.key === "Enter" && !e.shiftKey && !e.nativeEvent.isComposing) {
@@ -85,15 +269,89 @@ function PromptEditor({ value, onChange, onSubmit, placeholder, rows = 5 }: Prom
     }
   };
 
+  const retrack = (ta: HTMLTextAreaElement) => {
+    setTrigger(detectTrigger(ta.value, ta.selectionStart ?? 0));
+  };
+
+  const rowClass = (i: number) =>
+    `w-full text-left px-3 py-1.5 transition-colors ${i === current ? "bg-accent/15" : "hover:bg-surface-3"}`;
+
   return (
-    <textarea
-      value={value}
-      onChange={(e) => onChange(e.target.value)}
-      onKeyDown={handleKeyDown}
-      placeholder={placeholder}
-      rows={rows}
-      className="w-full bg-surface-2 border border-border rounded-md px-3 py-2 text-[11px] font-mono text-fg-primary placeholder:text-fg-muted focus:outline-none focus:border-accent/50 resize-none"
-    />
+    <div className="relative">
+      <textarea
+        ref={taRef}
+        value={value}
+        onChange={(e) => {
+          onChange(e.target.value);
+          retrack(e.target);
+          setActive(0);
+        }}
+        onSelect={(e) => retrack(e.currentTarget)}
+        onBlur={() => setTrigger(null)}
+        onKeyDown={handleKeyDown}
+        placeholder={placeholder}
+        rows={rows}
+        spellCheck={false}
+        className="w-full bg-surface-2 border border-border rounded-md px-3 py-2 text-[11px] font-mono text-fg-primary placeholder:text-fg-muted focus:outline-none focus:border-accent/50 resize-none"
+      />
+      {kind && (
+        <div
+          role="listbox"
+          data-testid="prompt-autocomplete"
+          className="absolute z-30 left-0 right-0 top-full mt-1 max-h-72 overflow-auto rounded-md border border-border bg-surface-1 py-1 shadow-lg"
+        >
+          <div className="px-3 py-1.5 border-b border-border text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
+            {kind === "slash" ? t("autocomplete.slashHint") : t("autocomplete.fileHint")}
+          </div>
+          {count === 0 ? (
+            <div className="px-3 py-2 text-[11px] text-fg-muted">
+              {kind === "slash" && !commands ? "…" : t("autocomplete.noMatches")}
+            </div>
+          ) : kind === "slash" ? (
+            slashItems.map((c, i) => (
+              <button
+                key={`${c.source}:${c.name}`}
+                type="button"
+                role="option"
+                aria-selected={i === current}
+                // Keep focus in the textarea, or its blur closes the list first.
+                onMouseDown={(e) => e.preventDefault()}
+                onClick={() => pickAt(i)}
+                onMouseEnter={() => setActive(i)}
+                className={rowClass(i)}
+              >
+                <div className="flex items-center gap-2">
+                  <span className="font-mono text-[12px] text-fg-primary">/{c.name}</span>
+                  <span
+                    className={`rounded border px-1.5 py-0.5 font-mono text-[9px] ${SOURCE_TONE[c.source]}`}
+                  >
+                    {c.source}
+                  </span>
+                </div>
+                {c.description && (
+                  <div className="mt-0.5 truncate text-[10.5px] text-fg-muted">{c.description}</div>
+                )}
+              </button>
+            ))
+          ) : (
+            files.map((f, i) => (
+              <button
+                key={f}
+                type="button"
+                role="option"
+                aria-selected={i === current}
+                onMouseDown={(e) => e.preventDefault()}
+                onClick={() => pickAt(i)}
+                onMouseEnter={() => setActive(i)}
+                className={`${rowClass(i)} truncate font-mono text-[11px] text-fg-secondary`}
+              >
+                {f}
+              </button>
+            ))
+          )}
+        </div>
+      )}
+    </div>
   );
 }
 
@@ -122,7 +380,6 @@ interface RunSetupProps {
    *  sessions. Undefined when no lane is selected (the picker then lists
    *  everything, same as before lanes existed). */
   laneCwd?: string;
-  slashCommands?: SlashCommand[];
   runHistory: DashboardRunHistoryItem[];
   onResumeFromHistory: (item: DashboardRunHistoryItem) => void;
   /** The selected lane's CLI. Decides which advanced fields render. */
@@ -287,7 +544,7 @@ export function RunSetup(props: RunSetupProps) {
           onSubmit={() => handleStart(props)}
           placeholder={t("fields.promptPlaceholderTerminal")}
           rows={5}
-          slashCommands={props.slashCommands ?? []}
+          slash={props.tool !== "codex"}
           fileCwd={props.resumeSession?.cwd || props.cwd}
         />
         <div className="mt-1 text-[10px] text-fg-muted">

client/src/components/run/TerminalView.tsx

@@ -11,15 +11,23 @@
  * still LOOKS live, but no keystroke or mouse report reaches tmux again.
  * Always painted dark, in the palette of the user's chosen DARK theme
  * (`lib/terminalTheme.ts`), recoloured live without re-attaching.
+ * An image dropped on it is saved on the server (`POST /api/run/drop-image`)
+ * and its PATH pasted into the pane — what a local terminal does on a drop,
+ * and how `claude` attaches an image.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
-import { useEffect, useMemo, useRef } from "react";
+import { useEffect, useMemo, useRef, useState, type DragEvent } from "react";
+import { useTranslation } from "react-i18next";
 import { Terminal } from "@xterm/xterm";
 import { FitAddon } from "@xterm/addon-fit";
 import { CanvasAddon } from "@xterm/addon-canvas";
 import "@xterm/xterm/css/xterm.css";
 import { useTheme } from "../../hooks/useTheme";
 import { terminalThemeFor } from "../../lib/terminalTheme";
+import { api } from "../../lib/api";
+
+type DropState = "hint" | "uploading" | "failed" | "imagesOnly";
+const hasFiles = (e: DragEvent) => Array.from(e.dataTransfer.types).includes("Files");
 
 interface TerminalViewProps {
   runId: string;
@@ -45,6 +53,42 @@ export function TerminalView({ runId, wsBaseUrl, onExit }: TerminalViewProps) {
   const paletteRef = useRef(palette);
   paletteRef.current = palette;
   const termRef = useRef<Terminal | null>(null);
+  const { t } = useTranslation("run");
+  const [drop, setDrop] = useState<DropState | null>(null);
+  // dragenter/dragleave fire for every child crossed, so count them: the hint
+  // only goes away when the pointer leaves the terminal itself.
+  const dragDepth = useRef(0);
+  const flashTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const flash = (state: DropState) => {
+    setDrop(state);
+    if (flashTimer.current) clearTimeout(flashTimer.current);
+    flashTimer.current = setTimeout(() => setDrop(null), 2500);
+  };
+  useEffect(
+    () => () => {
+      if (flashTimer.current) clearTimeout(flashTimer.current);
+    },
+    []
+  );
+
+  const onDrop = async (e: DragEvent) => {
+    if (!hasFiles(e)) return; // dragged text keeps xterm's own handling
+    e.preventDefault();
+    dragDepth.current = 0;
+    const images = Array.from(e.dataTransfer.files).filter((f) => f.type.startsWith("image/"));
+    if (images.length === 0) return flash("imagesOnly");
+    setDrop("uploading");
+    try {
+      const saved = await Promise.all(images.map((f) => api.run.dropImage(f)));
+      // paste(), not a raw send: it honours bracketed-paste mode, so claude
+      // sees one pasted path rather than typed keystrokes.
+      termRef.current?.paste(saved.map((r) => r.path).join(" ") + " ");
+      termRef.current?.focus();
+      setDrop(null);
+    } catch {
+      flash("failed");
+    }
+  };
 
   useEffect(() => {
     // An explicit fontFamily pins every glyph to one bundled webfont. Left
@@ -249,10 +293,44 @@ export function TerminalView({ runId, wsBaseUrl, onExit }: TerminalViewProps) {
 
   return (
     <div
-      ref={containerRef}
-      className="h-full w-full"
-      style={{ backgroundColor: palette.background }}
-      data-testid="terminal-view"
-    />
+      className="relative h-full w-full"
+      onDragEnter={(e) => {
+        if (!hasFiles(e)) return;
+        e.preventDefault();
+        dragDepth.current += 1;
+        setDrop("hint");
+      }}
+      onDragOver={(e) => {
+        if (!hasFiles(e)) return;
+        e.preventDefault(); // without it the browser refuses the drop
+        e.dataTransfer.dropEffect = "copy";
+      }}
+      onDragLeave={(e) => {
+        if (!hasFiles(e)) return;
+        dragDepth.current = Math.max(0, dragDepth.current - 1);
+        if (dragDepth.current === 0) setDrop((d) => (d === "hint" ? null : d));
+      }}
+      onDrop={(e) => void onDrop(e)}
+    >
+      <div
+        ref={containerRef}
+        className="h-full w-full"
+        style={{ backgroundColor: palette.background }}
+        data-testid="terminal-view"
+      />
+      {drop && (
+        // pointer-events-none: the drop must land on the terminal, not on this.
+        <div
+          data-testid="terminal-drop"
+          className={`pointer-events-none absolute inset-2 flex items-center justify-center rounded-lg border-2 border-dashed bg-black/50 text-sm font-medium ${
+            drop === "failed" || drop === "imagesOnly"
+              ? "border-red-400 text-red-300"
+              : "border-sky-400 text-sky-200"
+          }`}
+        >
+          {t(`drop.${drop}`)}
+        </div>
+      )}
+    </div>
   );
 }

client/src/components/run/__tests__/LaneConsolePane.test.tsx

@@ -331,4 +331,126 @@ describe("LaneConsolePane", () => {
     expect(screen.getByTestId("pane-lane-select")).toBeInTheDocument();
     expect(screen.queryByTestId("console-body")).not.toBeInTheDocument();
   });
+
+  it("lists only this lane's runs and sessions in Active runs, not every lane's", () => {
+    const run = (id: string, laneId: number, promptPreview: string) => ({
+      id,
+      laneId,
+      status: "running",
+      cwd: "/workspace/x",
+      model: null,
+      permissionMode: null,
+      effort: null,
+      resumeSessionId: null,
+      sessionId: null,
+      startedAt: "2026-09-24T01:00:00Z",
+      promptPreview,
+    });
+    const session = (id: string, cwd: string, name: string) =>
+      ({
+        id,
+        cwd,
+        name,
+        model: null,
+        source: "local",
+        started_at: "2026-09-24T01:00:00Z",
+      }) as never;
+    render(
+      <MemoryRouter>
+        <LaneConsolePane
+          {...baseProps()}
+          lanes={[
+            LANE,
+            { ...LANE, id: 2, cwd: "/workspace/b" },
+            // Nested inside lane 1: its sessions are ITS own, by longest prefix.
+            { ...LANE, id: 3, cwd: "/workspace/a/nested" },
+          ]}
+          activeRuns={{ items: [run("r1", 1, "mine"), run("r2", 2, "other lane's")] as never }}
+          externalSessions={[
+            session("s1", "/workspace/a/src", "my session"),
+            session("s2", "/workspace/b", "b session"),
+            session("s3", "/workspace/a/nested/x", "nested session"),
+            session("s4", "/workspace/ab", "sibling prefix"),
+          ]}
+        />
+      </MemoryRouter>
+    );
+    fireEvent.click(screen.getByRole("button", { name: /2 active runs/ }));
+    expect(screen.getByText("mine")).toBeTruthy();
+    expect(screen.getByText("my session")).toBeTruthy();
+    expect(screen.queryByText("other lane's")).toBeNull();
+    expect(screen.queryByText("b session")).toBeNull();
+    expect(screen.queryByText("nested session")).toBeNull();
+    expect(screen.queryByText("sibling prefix")).toBeNull();
+  });
+
+  describe("split panes on one lane", () => {
+    const run = (id: string, promptPreview = id) => ({
+      id,
+      laneId: 1,
+      status: "running" as const,
+      cwd: "/workspace/a",
+      model: null,
+      permissionMode: null,
+      effort: null,
+      resumeSessionId: null,
+      sessionId: null,
+      startedAt: "2026-09-24T01:00:00Z",
+      promptPreview,
+      tool: "claude" as const,
+    });
+
+    it("attaches a pane only to its own slot's session", async () => {
+      const activeRuns = { items: [run("agenthub-lane-1"), run("agenthub-lane-1-2")] };
+      render(<LaneConsolePane {...baseProps()} activeRuns={activeRuns} slot={2} />);
+      await waitFor(() =>
+        expect(screen.getByTestId("terminal-view")).toHaveAttribute(
+          "data-run-id",
+          "agenthub-lane-1-2"
+        )
+      );
+    });
+
+    it("starts into its own slot and shows the session the server opened", async () => {
+      (api.lanes.action as ReturnType<typeof vi.fn>).mockResolvedValue({
+        lane: { ...LANE, run_id: "agenthub-lane-1" },
+        run_id: "agenthub-lane-1-1",
+      });
+      (api.run.get as ReturnType<typeof vi.fn>).mockResolvedValue(run("agenthub-lane-1-1"));
+      render(<LaneConsolePane {...baseProps()} slot={1} />);
+      fireEvent.change(screen.getByPlaceholderText(/ask claude/i), { target: { value: "go" } });
+      fireEvent.click(screen.getByRole("button", { name: /^run$/i }));
+      await waitFor(() =>
+        expect(api.lanes.action).toHaveBeenCalledWith(
+          1,
+          "start",
+          expect.objectContaining({ slot: 1 })
+        )
+      );
+      await waitFor(() =>
+        expect(screen.getByTestId("terminal-view")).toHaveAttribute(
+          "data-run-id",
+          "agenthub-lane-1-1"
+        )
+      );
+    });
+
+    it("leaves runs other panes show out of Active runs", () => {
+      render(
+        <MemoryRouter>
+          <LaneConsolePane
+            {...baseProps()}
+            slot={1}
+            activeRuns={{
+              items: [run("agenthub-lane-1", "shown"), run("agenthub-lane-1-3", "free")],
+            }}
+            hiddenRunIds={["agenthub-lane-1"]}
+          />
+        </MemoryRouter>
+      );
+      fireEvent.click(screen.getByRole("button", { name: /1 active run/ }));
+      expect(screen.getByText("free")).toBeTruthy();
+      expect(screen.queryByText("shown")).toBeNull();
+    });
+  });
 });

client/src/components/run/__tests__/RunSetup.test.tsx

@@ -17,6 +17,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import i18n from "i18next";
 import { RunSetup } from "../RunSetup";
 import type { CwdSuggestion } from "../../../lib/api";
+import { api } from "../../../lib/api";
 
 vi.mock("../../../lib/api", async (importOriginal) => {
   const actual = await importOriginal<Record<string, unknown>>();
@@ -26,7 +27,22 @@ vi.mock("../../../lib/api", async (importOriginal) => {
     api: {
       run: { files: r({ items: [] }) },
       sessions: { list: r({ sessions: [], total: 0, limit: 100, offset: 0 }) },
-      ccConfig: { file: r({ text: "" }) },
+      ccConfig: {
+        file: r({ text: "" }),
+        commands: r({
+          items: [
+            {
+              scope: "project",
+              name: "ship-it",
+              frontmatter: { description: "Ship the change" },
+              preview: "",
+            },
+          ],
+        }),
+        skills: r({
+          items: [{ scope: "user", name: "review-pr", frontmatter: {}, preview: "Review a PR" }],
+        }),
+      },
     },
   };
 });
@@ -66,7 +82,6 @@ function renderSetup(overrides: Partial<React.ComponentProps<typeof RunSetup>> =
         busy={false}
         activeRuns={null}
         resumeSession={null}
-        slashCommands={[]}
         runHistory={[]}
         tool="claude"
         sandbox="workspace-write"
@@ -300,7 +315,6 @@ describe("RunSetup — resume picker scopes sessions to the selected lane", () =
           busy={false}
           activeRuns={null}
           resumeSession={null}
-          slashCommands={[]}
           runHistory={[]}
           laneCwd="/Users/tester/lane-b"
           tool="claude"
@@ -364,3 +378,48 @@ describe("RunSetup — per-tool fields", () => {
     expect(onResumeLast).toHaveBeenCalled();
   });
 });
+
+describe("RunSetup — / and @ suggestions in the prompt box", () => {
+  const box = () => screen.getByPlaceholderText(i18n.t("run:fields.promptPlaceholderTerminal"));
+
+  it("lists the lane's commands, skills and the CLI built-ins on /, and Enter picks one", async () => {
+    const { spies } = renderSetup({ prompt: "" });
+    fireEvent.change(box(), { target: { value: "/rev" } });
+
+    // Both prefix matches; the shorter name ranks first.
+    const options = await screen.findAllByRole("option");
+    expect(options.map((o) => o.textContent)).toEqual([
+      expect.stringContaining("/review"),
+      expect.stringContaining("/review-pr"),
+    ]);
+    fireEvent.keyDown(box(), { key: "ArrowDown" });
+    // Read for the directory the run will start in, not the server's own.
+    expect(api.ccConfig.commands).toHaveBeenCalledWith(undefined, "/Users/tester");
+    expect(api.ccConfig.skills).toHaveBeenCalledWith(undefined, "/Users/tester");
+
+    fireEvent.keyDown(box(), { key: "Enter" });
+    expect(spies.onPromptChange).toHaveBeenLastCalledWith("/review-pr ");
+    // Enter picked the suggestion; it did not send the prompt.
+    expect(spies.onStart).not.toHaveBeenCalled();
+  });
+
+  it("suggests files under the cwd on @", async () => {
+    vi.mocked(api.run.files).mockResolvedValue({ items: ["src/main.ts"] });
+    // The prompt is controlled by the page: put the cursor at the end of it.
+    const { spies } = renderSetup({ prompt: "look at @ma" });
+    (box() as HTMLTextAreaElement).setSelectionRange(11, 11);
+    fireEvent.select(box());
+
+    fireEvent.click(await screen.findByText("src/main.ts"));
+    expect(api.run.files).toHaveBeenCalledWith("/Users/tester", "ma");
+    expect(spies.onPromptChange).toHaveBeenLastCalledWith("look at @src/main.ts ");
+  });
+
+  it("offers no slash commands on a codex lane", async () => {
+    renderSetup({ prompt: "", tool: "codex" });
+    fireEvent.change(box(), { target: { value: "/rev" } });
+    await new Promise((r) => setTimeout(r, 20));
+    expect(screen.queryByTestId("prompt-autocomplete")).toBeNull();
+    expect(api.ccConfig.commands).not.toHaveBeenCalled();
+  });
+});

client/src/components/run/__tests__/TerminalView.test.tsx

@@ -8,7 +8,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { render, cleanup, act } from "@testing-library/react";
+import { render, cleanup, act, fireEvent, screen, waitFor } from "@testing-library/react";
 import { TerminalView } from "../TerminalView";
 
 const writeMock = vi.fn();
@@ -18,6 +18,11 @@ const disposeMock = vi.fn();
 const wheelHandlerMock = vi.fn();
 const keyHandlerMock = vi.fn();
 const focusMock = vi.fn();
+const pasteMock = vi.fn();
+const dropImageMock = vi.fn();
+vi.mock("../../../lib/api", () => ({
+  api: { run: { dropImage: (f: Blob) => dropImageMock(f) } },
+}));
 const loadAddonMock = vi.fn();
 // Mutable stand-ins for the two live terminal facts the wheel handler reads.
 const termState = {
@@ -61,6 +66,7 @@ vi.mock("@xterm/xterm", () => ({
     attachCustomWheelEventHandler: wheelHandlerMock,
     attachCustomKeyEventHandler: keyHandlerMock,
     focus: focusMock,
+    paste: pasteMock,
   })),
 }));
 // jsdom loads no stylesheet, so stand in for the CSS-variable probe.
@@ -314,4 +320,31 @@ describe("TerminalView", () => {
     expect(MockWebSocket.instances).toHaveLength(1);
     vi.useRealTimers();
   });
+
+  it("pastes the server-side path of a dropped image into the pane", async () => {
+    dropImageMock.mockReset().mockResolvedValue({ path: "/tmp/agenthub-drops-1/ab.png" });
+    pasteMock.mockClear();
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" />);
+    const img = new File([new Uint8Array([137, 80])], "shot.png", { type: "image/png" });
+    const target = screen.getByTestId("terminal-view");
+    fireEvent.dragEnter(target, { dataTransfer: { types: ["Files"], files: [img] } });
+    expect(screen.getByTestId("terminal-drop")).toHaveTextContent("Drop image to attach");
+    fireEvent.drop(target, { dataTransfer: { types: ["Files"], files: [img] } });
+    await waitFor(() => expect(pasteMock).toHaveBeenCalledWith("/tmp/agenthub-drops-1/ab.png "));
+    expect(dropImageMock).toHaveBeenCalledWith(img);
+    await waitFor(() => expect(screen.queryByTestId("terminal-drop")).toBeNull());
+  });
+
+  it("uploads nothing for a dropped non-image and says why", async () => {
+    dropImageMock.mockReset();
+    pasteMock.mockClear();
+    render(<TerminalView runId="r1" wsBaseUrl="ws://x" />);
+    const txt = new File(["hi"], "a.txt", { type: "text/plain" });
+    fireEvent.drop(screen.getByTestId("terminal-view"), {
+      dataTransfer: { types: ["Files"], files: [txt] },
+    });
+    expect(await screen.findByText("Only images can be dropped here")).toBeInTheDocument();
+    expect(dropImageMock).not.toHaveBeenCalled();
+    expect(pasteMock).not.toHaveBeenCalled();
+  });
 });

client/src/i18n/locales/en/lanes.json

@@ -25,13 +25,13 @@
   "addLaneBranchBusy": "{{branch}} — already checked out at {{path}}",
   "addLaneBranchExistingHint": "The worktree checks this branch out as it is — no new branch, no base.",
   "addLaneBranchExistingLabel": "Branch to check out",
-  "addLaneBranchHintAuto": "Leave empty to use the default name shown above.",
+  "addLaneBranchHintAuto": "Leave empty to let the server name the branch from the title.",
   "addLaneBranchLabel": "New branch name",
   "addLaneBranchModeCurrent": "Current branch",
   "addLaneBranchModeCurrentHint": "Work straight on this repo's checked-out branch (main) — no worktree, no fork. Switches to Repo mode.",
   "addLaneBranchModeExisting": "Existing branch",
   "addLaneBranchModeNew": "New branch",
-  "addLaneBranchPlaceholder": "feat/my-feature",
+  "addLaneBranchPlaceholder": "Automatic — named from the title",
   "addLaneNoBranches": "This repo has no commits yet — the worktree will start empty.",
   "addLaneNoFreeBranches": "Every branch in this repo is already checked out in a worktree. Create a new branch instead.",
   "addLaneExists": "This folder already has a lane: #{{id}} {{title}}. It is selected; pick another folder to add a new one.",
@@ -108,8 +108,13 @@
   "changes.refresh": "Refresh",
   "changes.resize": "Resize the changes panel (next: {{size}})",
   "changes.size.compact": "Narrow",
-  "changes.size.half": "50 / 50",
-  "changes.size.wide": "70 / 30",
+  "changes.size.half": "Medium",
+  "changes.size.full": "Full screen",
+  "changes.stageAll": "Stage all ({{count}})",
+  "changes.unstageAll": "Unstage all ({{count}})",
+  "changes.dropEdits": "Discard your unsaved edits to this file?",
+  "changes.stagedGroup": "Staged Changes",
+  "changes.unstagedGroup": "Changes",
   "changes.stage": "Stage this file",
   "changes.title": "Changes",
   "changes.truncated": "Some changes were left out to keep this panel responsive.",
@@ -169,19 +174,12 @@
   "gitBar.branchDelete": "Delete",
   "gitBar.branchDeleteHint": "Delete the selected branch (refused if it has unmerged commits)",
   "gitBar.branchNewPlaceholder": "New branch name…",
-  "gitBar.cancel": "Cancel",
-  "gitBar.commit": "Commit",
-  "gitBar.commitAll_one": "Commit {{count}} file",
-  "gitBar.commitAll_other": "Commit {{count}} files",
-  "gitBar.commitHint": "Stage everything and commit",
-  "gitBar.commitNothing": "Nothing to commit",
-  "gitBar.commitPlaceholder": "Commit message",
-  "gitBar.commitStaged": "Commit staged",
-  "gitBar.commitStagedHint": "Commit only what is staged in the Changes panel",
   "gitBar.fetch": "Fetch",
   "gitBar.fetchHint": "git fetch --all --prune",
+  "gitBar.errNoRemote": "No remote to push to or pull from. Add one, or set this branch's upstream, in a terminal.",
   "gitBar.inSync": "in sync",
   "gitBar.newLane": "New lane here",
+  "gitBar.newLaneHeld": "Already checked out at {{path}} — git allows one worktree per branch",
   "gitBar.newLaneHint": "Open Add lane for a sibling worktree on the selected branch",
   "gitBar.noUpstream": "not pushed",
   "gitBar.pull": "Pull",
@@ -239,5 +237,21 @@
   "title": "Lanes",
   "tooltipStart": "Spawn a conversation-mode run with no initial prompt; driven from CLI or via message",
   "worktrees.heading_one": "{{count}} worktree",
-  "worktrees.heading_other": "{{count}} worktrees"
+  "worktrees.heading_other": "{{count}} worktrees",
+  "changes.stageHunk": "Stage this hunk",
+  "changes.undoHunk": "Undo this hunk",
+  "changes.undoHunkConfirm": "Click again to undo this hunk — this cannot be undone",
+  "changes.stageHunkShort": "Keep",
+  "changes.undoHunkShort": "Undo",
+  "changes.undoHunkShortConfirm": "Confirm undo",
+  "changes.edit": "Edit",
+  "changes.save": "Save",
+  "changes.cancelEdit": "Cancel",
+  "changes.editorLabel": "Edit {{path}}",
+  "changes.prevHunk": "Previous change",
+  "changes.nextHunk": "Next change",
+  "changes.hunkOf": "{{n}} of {{total}}",
+  "changes.noEditBinary": "Binary file — not editable here",
+  "changes.noEditTooBig": "Too large to edit here (over 1 MB)",
+  "changes.noEdit": "Not editable here"
 }

client/src/i18n/locales/en/run.json

@@ -164,5 +164,11 @@
     "input": "Input",
     "label": "Context",
     "output": "Output"
+  },
+  "drop": {
+    "hint": "Drop image to attach",
+    "uploading": "Uploading image…",
+    "failed": "Could not attach the image",
+    "imagesOnly": "Only images can be dropped here"
   }
 }

client/src/i18n/locales/vi/lanes.json

@@ -25,13 +25,13 @@
   "addLaneBranchBusy": "{{branch}} — đang được checkout tại {{path}}",
   "addLaneBranchExistingHint": "Worktree checkout đúng nhánh này — không tạo nhánh mới, không cần nhánh gốc.",
   "addLaneBranchExistingLabel": "Nhánh cần checkout",
-  "addLaneBranchHintAuto": "Để trống để dùng tên mặc định hiển thị ở trên.",
+  "addLaneBranchHintAuto": "Để trống để server tự đặt tên nhánh theo tiêu đề.",
   "addLaneBranchLabel": "Tên nhánh mới",
   "addLaneBranchModeCurrent": "Nhánh hiện tại",
   "addLaneBranchModeCurrentHint": "Làm thẳng trên nhánh repo đang mở (main) — không tạo worktree, không fork nhánh. Chuyển sang chế độ Repo.",
   "addLaneBranchModeExisting": "Nhánh có sẵn",
   "addLaneBranchModeNew": "Nhánh mới",
-  "addLaneBranchPlaceholder": "feat/tinh-nang-cua-toi",
+  "addLaneBranchPlaceholder": "Tự động — đặt theo tiêu đề",
   "addLaneNoBranches": "Repo này chưa có commit nào — worktree sẽ bắt đầu trống.",
   "addLaneNoFreeBranches": "Mọi nhánh của repo này đều đang nằm trong một worktree. Hãy tạo nhánh mới.",
   "addLaneExists": "Thư mục này đã có lane: #{{id}} {{title}}. Lane đó đã được chọn; hãy chọn thư mục khác để thêm lane mới.",
@@ -108,8 +108,13 @@
   "changes.refresh": "Tải lại",
   "changes.resize": "Đổi độ rộng khung changes (kế tiếp: {{size}})",
   "changes.size.compact": "Hẹp",
-  "changes.size.half": "50 / 50",
-  "changes.size.wide": "70 / 30",
+  "changes.size.half": "Vừa",
+  "changes.size.full": "Toàn màn hình",
+  "changes.stageAll": "Stage tất cả ({{count}})",
+  "changes.unstageAll": "Bỏ stage tất cả ({{count}})",
+  "changes.dropEdits": "Bỏ các chỉnh sửa chưa lưu của file này?",
+  "changes.stagedGroup": "Đã stage",
+  "changes.unstagedGroup": "Thay đổi",
   "changes.stage": "Đưa file này vào index",
   "changes.title": "Thay đổi",
   "changes.truncated": "Một phần thay đổi đã bị lược bớt để bảng này còn mượt.",
@@ -169,19 +174,12 @@
   "gitBar.branchDelete": "Xoá",
   "gitBar.branchDeleteHint": "Xoá nhánh đang chọn (git từ chối nếu còn commit chưa merge)",
   "gitBar.branchNewPlaceholder": "Tên nhánh mới…",
-  "gitBar.cancel": "Huỷ",
-  "gitBar.commit": "Commit",
-  "gitBar.commitAll_one": "Commit {{count}} file",
-  "gitBar.commitAll_other": "Commit {{count}} file",
-  "gitBar.commitHint": "Stage tất cả rồi commit",
-  "gitBar.commitNothing": "Không có gì để commit",
-  "gitBar.commitPlaceholder": "Nội dung commit",
-  "gitBar.commitStaged": "Commit phần đã stage",
-  "gitBar.commitStagedHint": "Chỉ commit những file đã stage ở thẻ Changes",
   "gitBar.fetch": "Fetch",
   "gitBar.fetchHint": "git fetch --all --prune",
+  "gitBar.errNoRemote": "Không có remote để push hoặc pull. Hãy thêm remote, hoặc đặt upstream cho nhánh này, trong terminal.",
   "gitBar.inSync": "đã đồng bộ",
   "gitBar.newLane": "Tạo lane mới",
+  "gitBar.newLaneHeld": "Nhánh đã được checkout tại {{path}} — git chỉ cho một worktree trên mỗi nhánh",
   "gitBar.newLaneHint": "Mở Add lane để tạo worktree anh em trên nhánh đang chọn",
   "gitBar.noUpstream": "chưa push",
   "gitBar.pull": "Pull",
@@ -239,5 +237,21 @@
   "title": "Làn đường",
   "tooltipStart": "Tạo một lần chạy ở chế độ hội thoại mà không có lời nhắc ban đầu; được điều khiển từ CLI hoặc qua tin nhắn",
   "worktrees.heading_one": "{{count}} worktree",
-  "worktrees.heading_other": "{{count}} worktree"
+  "worktrees.heading_other": "{{count}} worktree",
+  "changes.stageHunk": "Stage đoạn này",
+  "changes.undoHunk": "Hoàn tác đoạn này",
+  "changes.undoHunkConfirm": "Bấm lần nữa để hoàn tác đoạn này — không thể khôi phục",
+  "changes.stageHunkShort": "Giữ",
+  "changes.undoHunkShort": "Hoàn tác",
+  "changes.undoHunkShortConfirm": "Xác nhận",
+  "changes.edit": "Sửa",
+  "changes.save": "Lưu",
+  "changes.cancelEdit": "Huỷ",
+  "changes.editorLabel": "Sửa {{path}}",
+  "changes.prevHunk": "Thay đổi trước",
+  "changes.nextHunk": "Thay đổi sau",
+  "changes.hunkOf": "{{n}} / {{total}}",
+  "changes.noEditBinary": "File nhị phân — không sửa được ở đây",
+  "changes.noEditTooBig": "File quá lớn để sửa ở đây (trên 1 MB)",
+  "changes.noEdit": "Không sửa được ở đây"
 }

client/src/i18n/locales/vi/run.json

@@ -163,5 +163,11 @@
     "input": "Input",
     "label": "Context",
     "output": "Output"
+  },
+  "drop": {
+    "hint": "Thả ảnh để đính kèm",
+    "uploading": "Đang tải ảnh lên…",
+    "failed": "Không đính kèm được ảnh",
+    "imagesOnly": "Chỉ thả được ảnh vào đây"
   }
 }

client/src/lib/api.ts

@@ -482,6 +482,15 @@ export function dashboardToken(): string | null {
   }
 }
 
+/** `?scope=&cwd=` for the cc-config list endpoints, each part only when given. */
+function ccQuery(scope?: CcScope, cwd?: string): string {
+  const qs = new URLSearchParams();
+  if (scope) qs.set("scope", scope);
+  if (cwd) qs.set("cwd", cwd);
+  const q = qs.toString();
+  return q ? `?${q}` : "";
+}
+
 /**
  * Shared fetch wrapper used by every method on {@link api}. Prefixes `path`
  * with {@link BASE} ("/api"), attaches the dashboard auth token (if any) as
@@ -1390,10 +1399,11 @@ export const api = {
      * list endpoints below (`agents`, `commands`, `outputStyles`).
      *
      * @param scope Optional {@link CcScope} ("user"|"project"|"all") filter.
+     * @param cwd Project directory to read, instead of the server's own cwd.
      * @returns `{ items }` — the {@link CcMdItem} summaries for each skill.
      */
-    skills: (scope?: CcScope) =>
-      request<{ items: CcMdItem[] }>(`/cc-config/skills${scope ? `?scope=${scope}` : ""}`),
+    skills: (scope?: CcScope, cwd?: string) =>
+      request<{ items: CcMdItem[] }>(`/cc-config/skills${ccQuery(scope, cwd)}`),
     /**
      * GET /api/cc-config/agents - user and/or project subagent definitions.
      * @param scope Optional {@link CcScope} filter.
@@ -1404,10 +1414,11 @@ export const api = {
     /**
      * GET /api/cc-config/commands - user and/or project slash commands.
      * @param scope Optional {@link CcScope} filter.
+     * @param cwd Project directory to read, instead of the server's own cwd.
      * @returns `{ items }` — {@link CcMdItem} summaries for each command.
      */
-    commands: (scope?: CcScope) =>
-      request<{ items: CcMdItem[] }>(`/cc-config/commands${scope ? `?scope=${scope}` : ""}`),
+    commands: (scope?: CcScope, cwd?: string) =>
+      request<{ items: CcMdItem[] }>(`/cc-config/commands${ccQuery(scope, cwd)}`),
     /**
      * GET /api/cc-config/output-styles.
      * @param scope Optional {@link CcScope} filter.
@@ -1971,6 +1982,14 @@ export const api = {
       if (q) qs.set("q", q);
       return request<{ items: string[] }>(`/run/files?${qs.toString()}`);
     },
+    /** POST /api/run/drop-image - save an image dropped on the terminal on the
+     *  server's machine; the returned path is what gets pasted into the pane. */
+    dropImage: (file: Blob) =>
+      request<{ path: string }>("/run/drop-image", {
+        method: "POST",
+        body: file,
+        headers: { "Content-Type": file.type },
+      }),
     /** POST /api/run - start (or adopt, if already live) a lane's terminal run. */
     start: (args: RunStartArgs) =>
       request<RunHandle>("/run", { method: "POST", body: JSON.stringify(args) }),
@@ -2436,6 +2455,16 @@ export const api = {
       request<LaneFileContent>(
         `/lanes/${id}/git/file?path=${encodeURIComponent(path)}&rev=${encodeURIComponent(rev)}`
       ),
+    /**
+     * PUT /api/lanes/:id/git/file — save the editor's text over the working
+     * file. `baseSha` is the `sha` it was opened at; a file that changed on
+     * disk since answers 409 ESTALE rather than being overwritten.
+     */
+    gitSaveFile: (id: number, path: string, content: string, baseSha: string) =>
+      request<LaneFileContent>(`/lanes/${id}/git/file`, {
+        method: "PUT",
+        body: JSON.stringify({ path, content, baseSha }),
+      }),
     /**
      * GET /api/lanes/:id/git/ls — tracked paths matching a substring, for
      * quick-open. Ignored files never appear (it reads `git ls-files`).
@@ -2451,6 +2480,16 @@ export const api = {
      * @param id The lane id.
      * @param path Repo-relative directory; "" for the repo root.
      */
+    /**
+     * GET /api/lanes/:id/git/tree-all — every level of the tracked tree in one
+     * read, keyed by directory ("" is the root), each shaped like `gitTree`'s.
+     */
+    gitTreeAll: (id: number) =>
+      request<{
+        available: boolean;
+        levels: Record<string, LaneTreeEntry[]>;
+        truncated: boolean;
+      }>(`/lanes/${id}/git/tree-all`),
     gitTree: (id: number, path = "") =>
       request<{
         available: boolean;
@@ -2493,6 +2532,8 @@ export const api = {
         | "stage"
         | "unstage"
         | "discard"
+        | "stage-hunk"
+        | "discard-hunk"
         | "branch-create"
         | "branch-delete",
       body: {
@@ -2502,6 +2543,9 @@ export const api = {
         base?: string;
         create?: boolean;
         paths?: string[];
+        path?: string;
+        hunk?: string;
+        context?: number;
         confirm?: boolean;
       } = {}
     ) =>
@@ -2585,7 +2629,9 @@ export const api = {
      * @returns `{ lane, ok }` — the updated lane (if applicable) or a boolean result.
      */
     action: (id: number, action: string, body: Record<string, unknown> = {}) =>
-      request<{ lane?: Lane; ok?: boolean }>(`/lanes/${id}/${action}`, {
+      // `run_id` answers a `start`: the session it opened, which for a split
+      // pane's slot (`body.slot` 1–3) is not the lane's own `run_id`.
+      request<{ lane?: Lane; ok?: boolean; run_id?: string }>(`/lanes/${id}/${action}`, {
         method: "POST",
         body: JSON.stringify(body),
       }),
@@ -3578,6 +3624,8 @@ export interface RunStartArgs {
 export interface RunHandle {
   id: string;
   laneId: number | null;
+  /** Which Workspace split pane's session this is: 0 is the lane's own. */
+  slot?: number | null;
   status: RunStatus;
   cwd: string | null;
   model: string | null;

client/src/lib/types.ts

@@ -2651,6 +2651,9 @@ export type LaneFileContent =
       binary: boolean;
       truncated: boolean;
       lines: string[];
+      /** Version stamp of a whole, textual `work` file — what a save sends
+       *  back as `baseSha`. Absent at a commit, or when binary/truncated. */
+      sha?: string;
     }
   | { available: false };
 
@@ -2660,6 +2663,10 @@ export interface LaneTreeEntry {
   /** Path relative to the repo root. */
   path: string;
   dir: boolean;
+  /** A changed file's porcelain code (` M`, `??`, `A `, ` D`…); absent when clean. */
+  status?: string;
+  /** A folder with a changed or untracked file anywhere under it. */
+  changed?: true;
 }
 
 /** One row of a rendered diff — both gutters already resolved server-side. */

client/src/pages/Workspace.tsx

@@ -40,7 +40,7 @@
  *
  * ----------------------------------------------------------------------------- */
 
-import { useCallback, useEffect, useState, useSyncExternalStore } from "react";
+import { useCallback, useEffect, useMemo, useState, useSyncExternalStore } from "react";
 import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import {
@@ -51,8 +51,8 @@ import {
   Pencil,
   Layers,
   PanelLeftClose,
-  ChevronsLeftRight,
   PanelRightClose,
+  Maximize2,
 } from "lucide-react";
 import { api } from "../lib/api";
 import type { CwdSuggestion, RunListResponse } from "../lib/api";
@@ -88,21 +88,23 @@ const CHANGES_SIZE_KEY = "agenthub.workspace.changesSize";
 /** The three widths the Changes panel cycles through, then closed. Reading a
  *  diff and watching a console want opposite amounts of room, and which one is
  *  "work" changes several times an hour — hence ONE control that steps
- *  narrow → 50/50 → 70/30 → closed, rather than a width button beside a
+ *  30/70 → 50/50 → full → closed, rather than a width button beside a
  *  collapse button that both live in the panel's tightest corner. */
-const CHANGES_SIZES = ["compact", "half", "wide"] as const;
+const CHANGES_SIZES = ["compact", "half", "full"] as const;
 type ChangesSize = (typeof CHANGES_SIZES)[number];
 const CHANGES_WIDTH: Record<ChangesSize, string> = {
-  compact: "w-[28rem] xl:w-[34rem]",
+  compact: "w-[30%]",
   half: "w-1/2",
-  wide: "w-[70%]",
+  // The console beside it is HIDDEN, not unmounted: a live run's terminal
+  // and a half-typed prompt must survive a round trip through full width.
+  full: "w-full",
 };
 /** The icon the one resize control shows AT each size: what the next click
- *  gives you — an even split, a wider panel, then closed. */
+ *  gives you — an even split, the full width, then closed. */
 const CHANGES_NEXT_ICON: Record<ChangesSize, typeof Columns2> = {
   compact: Columns2,
-  half: ChevronsLeftRight,
-  wide: PanelRightClose,
+  half: Maximize2,
+  full: PanelRightClose,
 };
 
 // ── Page ──────────────────────────────────────────────────────────────
@@ -158,7 +160,6 @@ function ConsoleArea({
   selectedLaneId,
   splitView,
   setLayout,
-  setPaneLaneId,
   binaryStatus,
   cwdSuggestions,
   activeRuns,
@@ -174,7 +175,6 @@ function ConsoleArea({
   selectedLaneId: number | null;
   splitView: SplitViewState;
   setLayout: (layout: SplitLayout) => void;
-  setPaneLaneId: (index: number, id: number) => void;
   binaryStatus: Record<LaneTool, { found: boolean; path: string | null }> | null;
   cwdSuggestions: CwdSuggestion[];
   activeRuns: RunListResponse | null;
@@ -186,6 +186,30 @@ function ConsoleArea({
   onLaneIdChange: (id: number | null) => void;
   showToggle?: boolean;
 }) {
+  // Every split pane shows the SELECTED lane, each in its own tmux session
+  // (slot = pane index). Tracking what each pane shows lets the others leave
+  // that run out of their Active runs, so no terminal is attached twice.
+  const [paneRunIds, setPaneRunIds] = useState<(string | null)[]>([]);
+  const onPaneHandle = useCallback((i: number, id: string | null) => {
+    setPaneRunIds((prev) => {
+      if (prev[i] === id) return prev;
+      const next = [...prev];
+      next[i] = id;
+      return next;
+    });
+  }, []);
+  const paneHandlers = useMemo(
+    () => [0, 1, 2, 3].map((i) => (id: string | null) => onPaneHandle(i, id)),
+    [onPaneHandle]
+  );
+  const hiddenFor = useMemo(
+    () =>
+      [0, 1, 2, 3].map((i) =>
+        paneRunIds.filter((id, j): id is string => j !== i && j < splitView.layout && !!id)
+      ),
+    [paneRunIds, splitView.layout]
+  );
+
   return (
     <>
       {showToggle && <SplitLayoutToggle splitView={splitView} setLayout={setLayout} />}
@@ -193,6 +217,7 @@ function ConsoleArea({
         <LaneConsolePane
           lanes={lanes}
           laneId={selectedLaneId}
+          onHandleChange={paneHandlers[0]}
           showLaneSelector={false}
           onLaneIdChange={onLaneIdChange}
           onLaneCreated={onLaneCreated}
@@ -210,13 +235,16 @@ function ConsoleArea({
             splitView.layout === 2 ? "grid-cols-2" : "grid-cols-2 grid-rows-2"
           }`}
         >
-          {splitView.paneLaneIds.map((id, i) => (
+          {Array.from({ length: splitView.layout }, (_, i) => (
             <LaneConsolePane
               key={i}
               lanes={lanes}
-              laneId={id}
-              showLaneSelector
-              onLaneIdChange={(newId) => setPaneLaneId(i, newId)}
+              laneId={selectedLaneId}
+              slot={i}
+              hiddenRunIds={hiddenFor[i]}
+              onHandleChange={paneHandlers[i]}
+              showLaneSelector={false}
+              onLaneIdChange={onLaneIdChange}
               onLaneCreated={onLaneCreated}
               binaryStatus={binaryStatus}
               cwdSuggestions={cwdSuggestions}
@@ -330,16 +358,6 @@ export function Workspace() {
     });
   }, []);
 
-  const setPaneLaneId = useCallback((index: number, id: number) => {
-    setSplitView((prev) => {
-      const paneLaneIds = [...prev.paneLaneIds];
-      paneLaneIds[index] = id;
-      const next = { ...prev, paneLaneIds };
-      writeSplitViewState(next);
-      return next;
-    });
-  }, []);
-
   // Pre-flight: probe binary + active runs + cwd suggestions + lanes on mount
   const refreshLanes = useCallback(async () => {
     try {
@@ -565,8 +583,11 @@ export function Workspace() {
 
   // Viewport locked only when a live run is showing (TerminalView needs locked
   // viewport for chat scrolling). The config-card screen needs normal page flow
-  // so the form is fully reachable on short windows.
-  const viewportLocked = paneHasActiveRun;
+  // so the form is fully reachable on short windows. A full-width Changes panel
+  // hides that form anyway, and without a locked height it shrinks to its
+  // content — the editor inside it collapsed to a few lines (no live run).
+  const viewportLocked =
+    paneHasActiveRun || (!!currentLane && changesOpen && changesSize === "full");
 
   const handleLaneAction = async (id: number, action: string, body?: Record<string, unknown>) => {
     setLaneActionError(null);
@@ -733,7 +754,9 @@ export function Workspace() {
         <div className="flex min-h-0 flex-1 gap-4">
           <section
             data-testid="lane-detail"
-            className={`flex min-h-0 min-w-0 flex-1 flex-col ${currentLane ? "card p-4" : ""}`}
+            className={`flex min-h-0 min-w-0 flex-1 flex-col ${currentLane ? "card p-4" : ""}${
+              currentLane && changesOpen && changesSize === "full" ? " hidden" : ""
+            }`}
           >
             {/* One header row, not two. The pipeline picker, the stage badges,
               the feature picker and the router select used to sit on a second
@@ -874,7 +897,8 @@ export function Workspace() {
             )}
             {currentLane && showInfo && (
               <div className="max-h-[45vh] shrink-0 overflow-y-auto">
-                <div className="mb-3">
+                {/* No margin when the card rendered nothing (see LaneCard). */}
+                <div className="mb-3 has-[>div:empty]:mb-0">
                   <LaneCard
                     lane={currentLane}
                     onAction={(a, b) => handleLaneAction(currentLane.id, a, b)}
@@ -882,10 +906,6 @@ export function Workspace() {
                       (l) => l.source_repo === currentLane.cwd && l.id !== currentLane.id
                     )}
                     onSelectLane={setSelectedLaneId}
-                    onNewLaneFromRepo={(repo, branch) => {
-                      setAddLanePrefill({ sourceRepo: repo, branch });
-                      setAddLaneOpen(true);
-                    }}
                   />
                 </div>
                 <div className="mb-3">
@@ -956,7 +976,6 @@ export function Workspace() {
                 selectedLaneId={selectedLaneId}
                 splitView={splitView}
                 setLayout={setLayout}
-                setPaneLaneId={setPaneLaneId}
                 binaryStatus={binaryStatus}
                 cwdSuggestions={cwdSuggestions}
                 activeRuns={activeRuns}
@@ -1014,7 +1033,20 @@ export function Workspace() {
                     })()}
                   </button>
                 </div>
-                <LaneChangesPanel laneId={currentLane.id} />
+                <LaneChangesPanel
+                  laneId={currentLane.id}
+                  full={changesSize === "full"}
+                  // A sibling worktree forks from the lane's SOURCE repo when
+                  // it has one (this lane is itself a worktree of it); an
+                  // adopted lane is its own repo.
+                  onNewLane={(branch) => {
+                    setAddLanePrefill({
+                      sourceRepo: currentLane.source_repo || currentLane.cwd,
+                      branch,
+                    });
+                    setAddLaneOpen(true);
+                  }}
+                />
               </aside>
             ) : (
               <button

client/src/pages/__tests__/Workspace.changesPanel.test.tsx

@@ -1,7 +1,7 @@
 /**
  * @file Workspace.changesPanel.test.tsx
- * @description The Changes panel is ONE control: it steps narrow → 50/50 →
- * 70/30 → closed, and the rail reopens it narrow. The width survives a reload.
+ * @description The Changes panel is ONE control: it steps 30/70 → 50/50 →
+ * full → closed, and the rail reopens it at 30/70. The width survives a reload.
  * All of it lives in localStorage and reaches no server — the same rule as the
  * lane strip's order.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -75,6 +75,7 @@ vi.mock("../../lib/api", async (importOriginal) => {
         }),
         pipelines: r({ pipelines: [] }),
         git: r({ available: false }),
+        gitTree: r({ entries: [] }),
         runtime: r({ up: false, ports: {}, lastError: null }),
         features: { list: r({ features: [] }), show: r({ feature: null }) },
         proof: { list: r({ features: [] }), imageUrl: () => "" },
@@ -142,26 +143,28 @@ describe("Workspace — the Changes panel's width", () => {
     }
   }
 
-  it("steps narrow → 50/50 → 70/30 → closed on one control", async () => {
+  it("steps 30/70 → 50/50 → full → closed on one control, with no 70/30 step", async () => {
     await openPanel();
     const card = () => screen.getByTestId("lane-changes-card");
-    expect(card().className).toContain("w-[28rem]");
+    expect(card().className).toContain("w-[30%]");
 
     fireEvent.click(screen.getByTestId("lane-changes-resize"));
     expect(card().className).toContain("w-1/2");
 
+    // Full width HIDES the console beside it — hidden, still mounted.
     fireEvent.click(screen.getByTestId("lane-changes-resize"));
-    expect(card().className).toContain("w-[70%]");
+    expect(card().className).toContain("w-full");
+    expect(screen.getByTestId("lane-detail").className).toContain("hidden");
 
-    // Past the widest step the panel closes — and reopens narrow, not back at
-    // 70/30, which is why closing resets the width.
+    // Past the widest step the panel closes — and reopens at 30/70, not back
+    // at full width, which is why closing resets the width.
     fireEvent.click(screen.getByTestId("lane-changes-resize"));
     await settle();
     expect(screen.queryByTestId("lane-changes-card")).toBeNull();
 
     fireEvent.click(screen.getByTestId("lane-changes-expand"));
     await settle();
-    expect(card().className).toContain("w-[28rem]");
+    expect(card().className).toContain("w-[30%]");
   });
 
   it("remembers the width across a reload, and never asks the server", async () => {

client/src/pages/__tests__/Workspace.test.tsx

@@ -652,46 +652,38 @@ describe("split terminal view", () => {
     expect(screen.queryAllByTestId("pane-lane-select")).toHaveLength(0);
   });
 
-  it("switching to 2-pane layout renders two independent panes with lane pickers", async () => {
+  it("switching to 2-pane layout renders two panes bound to the selected lane", async () => {
     await renderWorkspace();
     fireEvent.click(screen.getByRole("button", { name: /2.*pane/i }));
     await settle();
-    expect(screen.getAllByTestId(/console-body|pane-empty/)).toHaveLength(2);
-    expect(screen.getAllByTestId("pane-lane-select")).toHaveLength(2);
+    expect(screen.getAllByTestId("console-body")).toHaveLength(2);
+    expect(screen.queryAllByTestId("pane-lane-select")).toHaveLength(0);
   });
 
   it("switching to 4-pane layout renders four panes", async () => {
     await renderWorkspace();
     fireEvent.click(screen.getByRole("button", { name: /4.*pane/i }));
     await settle();
-    expect(screen.getAllByTestId(/console-body|pane-empty/)).toHaveLength(4);
+    expect(screen.getAllByTestId("console-body")).toHaveLength(4);
   });
 
-  it("persists the layout and pane selections to localStorage across remounts", async () => {
+  it("persists the layout to localStorage across remounts", async () => {
     const { unmount } = await renderWorkspace();
     fireEvent.click(screen.getByRole("button", { name: /2.*pane/i }));
     await settle();
-    const selects = screen.getAllByTestId("pane-lane-select");
-    const select = selects[1];
-    expect(select).toBeDefined();
-    fireEvent.change(select!, { target: { value: String(lanesToReturn[1]!.id) } });
-    await settle();
     unmount();
 
     await renderWorkspace();
-    const persistedSelects = screen.getAllByTestId("pane-lane-select");
-    expect(persistedSelects).toHaveLength(2);
-    expect((persistedSelects[1] as HTMLSelectElement).value).toBe(String(lanesToReturn[1]!.id));
+    expect(screen.getAllByTestId("console-body")).toHaveLength(2);
   });
 
-  it("falls back to unselected when a persisted lane id no longer exists", async () => {
+  it("ignores a persisted per-pane lane id: every pane follows the selected lane", async () => {
     localStorage.setItem(
       "agenthub.workspace.splitView",
       JSON.stringify({ layout: 2, paneLaneIds: [9999, null] })
     );
     await renderWorkspace();
-    // Lane 9999 doesn't exist, so it falls back to null (unselected).
-    // The second pane is already null. Both render as pane-empty.
-    expect(screen.getAllByTestId("pane-empty")).toHaveLength(2);
+    expect(screen.queryAllByTestId("pane-empty")).toHaveLength(0);
+    expect(screen.getAllByTestId("console-body")).toHaveLength(2);
   });
 });

client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap

@@ -5570,11 +5570,16 @@ exports[`screen snapshots > Run 1`] = `
                   >
                     Prompt
                   </label>
-                  <textarea
-                    class="w-full bg-surface-2 border border-border rounded-md px-3 py-2 text-[11px] font-mono text-fg-primary placeholder:text-fg-muted focus:outline-none focus:border-accent/50 resize-none"
-                    placeholder="Ask Claude anything…"
-                    rows="5"
-                  />
+                  <div
+                    class="relative"
+                  >
+                    <textarea
+                      class="w-full bg-surface-2 border border-border rounded-md px-3 py-2 text-[11px] font-mono text-fg-primary placeholder:text-fg-muted focus:outline-none focus:border-accent/50 resize-none"
+                      placeholder="Ask Claude anything…"
+                      rows="5"
+                      spellcheck="false"
+                    />
+                  </div>
                   <div
                     class="mt-1 text-[10px] text-fg-muted"
                   >
@@ -10359,7 +10364,7 @@ exports[`screen snapshots > Settings 1`] = `
             <p
               class="text-[10px] text-status-warning/90 mt-1"
             >
-              UI build v1.8.5 (rebuild client to match)
+              UI build v1.8.8 (rebuild client to match)
             </p>
           </div>
           <div

docs/API.md

@@ -261,6 +261,8 @@ All fields are optional. The tool (CLI invoked) comes from the lane itself, neve
 - **`approval`** — one of `on-request` or `never`, or omitted/empty for no approval prompt. Passed to `codex -a <value>`.
 - **`resumeSessionId`** or **`resumeLast: true`** — resume an earlier run instead of starting new. For Codex lanes specifically, `resumeLast: true` uses `codex resume --last`; `resumeSessionId` uses `codex resume <sessionId>`. For Claude lanes, `resumeSessionId` re-attaches a Claude session by id.
 
+- **`slot`** — which Workspace split pane's session to start, `0`–`3` (default `0`, else `400 EBADSLOT`). Slot 0 is the lane's own `agenthub-lane-<id>` and is what `run_id` records; slots 1–3 are extra sessions on the same lane, `agenthub-lane-<id>-<slot>`, and never touch `run_id`/`status`. The response adds `run_id`: the session this start opened. `stop`, `reset` and `remove` kill every slot's session, not only `run_id`.
+
 Error `503 ETMUXMISSING` is returned when the host has no `tmux` binary. Every run the dashboard starts is a tmux session, so this is a missing dependency rather than a bad request — the message carries the install command, and the same code comes back from `POST /api/run`. Nothing else in the dashboard is affected.
 
 Error `409 ERUNLIVE` is returned if the lane already has a live run; stop it first with the `stop` action. The same code and status come back when the lane's tmux pane is already running an agent while a `prompt` or `resumeSessionId` was sent — that argv cannot be typed over a live agent, so the request is refused instead of answered 200 with nothing done. A start that asks for neither still adopts the existing pane silently.
@@ -392,6 +394,9 @@ What the lane's directory looks like to git right now:
 }
 ```
 
+- `dirty`, `untracked` and `files` cover only the lane's own directory, with
+  cwd-relative, unquoted paths — a lane that is a subdirectory of its repo does
+  not count its siblings' files (the same scoping as `/git/changes`).
 - A `cwd` that is missing, is not a git repository, or makes git fail returns
   `{"available": false}` with HTTP **200** — a normal state, not a fault.
 - `files` names the files the counts came from, **capped at 20** (the counts
@@ -432,6 +437,12 @@ unresolvable one is `400 EBADREV`, never an empty diff).
 range the diff has effectively become the whole file, which is what "expand
 all" means in the panel.
 
+Every path on the lane git surface (reads and writes) is **relative to the
+lane's `cwd`**, even when that cwd is a subdirectory of its repo: changes
+outside the cwd are not listed and cannot be named. Paths are literal file
+names, never pathspec globs — `new*.js` or `app/[id]/page.js` names exactly
+that file.
+
 ```json
 {
   "available": true,
@@ -487,8 +498,10 @@ all" means in the panel.
 ```http
 GET /api/lanes/:id/git/log?limit=30[&file=<path>]
 GET /api/lanes/:id/git/file?path=<path>[&rev=work|HEAD|<sha>]
+PUT /api/lanes/:id/git/file   {path, content, baseSha}
 GET /api/lanes/:id/git/ls?q=<substring>
 GET /api/lanes/:id/git/tree?path=<dir>
+GET /api/lanes/:id/git/tree-all
 ```
 
 The reads behind the Changes panel's **History**, whole-file view, quick-open
@@ -497,19 +510,43 @@ and file explorer. All four are read-only and unguarded, and all four answer
 
 - **`/git/log`** → `{available, commits:[{sha, short, subject, author, date,
   refs}]}`, newest first, `limit` clamped to 200. `file=` narrows it to the
-  commits touching that path. Reading one commit's diff is
+  commits touching that path — relative, no `..` segment, else
+  `400 EBADPATH`. Reading one commit's diff is
   `/git/changes?range=commit&sha=`.
-- **`/git/file`** → `{available, path, rev, binary, truncated, lines}`.
+- **`PUT /git/file`** saves the whole-file editor (same-origin guarded;
+  `server/lib/lane-file-write.js`). Same path guards as the read, plus: the
+  file must already exist, be text and within the 1 MB cap, and `baseSha`
+  must equal the `sha` it was opened at — otherwise `409 ESTALE`, never an
+  overwrite. `403 ESECRET` for `settings.local.json`; `400 EBADPATH`,
+  `ENOFILE`, `EBADCONTENT`, `ETOOBIG`, `EBINARY`. Answers the file re-read,
+  fresh `sha` included. CRLF endings and the final newline are preserved.
+- **`/git/file`** → `{available, path, rev, binary, truncated, lines, sha?}`
+  (`sha` only for a whole, textual `work` file: what a save sends back).
   `rev=work` (default) is the file on disk — the one branch that reads the
-  filesystem, and it is realpath-confined to the lane directory; anything else
-  goes through `git show <rev>:<path>`. Binary content is reported, never
-  returned. Capped at 1 MB. `400 EBADPATH`, `EBADREV` or `ENOFILE`.
+  filesystem, and it is realpath-confined to the lane directory (a symlink
+  resolving outside it is `EBADPATH`); anything else goes through
+  `git show <rev>:./<path>` (cwd-relative). At EVERY rev the path must be
+  relative with no `..` segment (else `400 EBADPATH`), and it is normalised
+  (`./a//b` → `a/b`, also the `path` echoed back). Binary content is reported,
+  never returned. Capped at 1 MB — a larger file is `truncated: true`, never
+  `ENOFILE` (a working-tree file is read only up to the cap, never whole).
+  `400 EBADPATH`, `EBADREV` or `ENOFILE`. `.claude/settings.local.json`
+  (where a lane's AI Router key lives) is `403 ESECRET` at EVERY rev and at
+  ANY depth (`sub/.claude/settings.local.json`, a subdirectory lane's key, as
+  seen from a lane at the repo root), and so is any path that RESOLVES to it
+  (a symlinked `.claude` → `conf/` makes it `conf/settings.local.json`). In
+  fact ANY file named `settings.local.json`, in any directory and at any rev,
+  is refused — a symlink target's name is all a lane above it, or a commit of
+  it, ever sees. Its hunks are never returned by `/git/changes` either.
 - **`/git/ls`** → `{available, paths, truncated, total}`, capped at 500. It
   reads `git ls-files`, so ignored files never appear and no skip-list has to
   be maintained; basename hits rank first.
-- **`/git/tree`** → `{available, path, entries:[{name, path, dir}], truncated}`
-  — one directory level, tracked entries only, directories folded and listed
-  first. `400 EBADPATH` for a path that escapes the lane.
+- **`/git/tree`** → `{available, path, entries:[{name, path, dir, status?, changed?}], truncated}`
+  — one directory level: tracked files plus untracked ones git does not
+  ignore (`ls-files --cached --others --exclude-standard`), directories folded
+  and listed first. A changed file carries its porcelain `status` (` M`, `??`,
+  `A `, ` D`…), a folder with anything changed under it `changed: true`. `400 EBADPATH` for a path that escapes the lane.
+- **`/git/tree-all`** → `{available, levels: {"<dir>": [{name, path, dir}]}, truncated}` — every level of the same tree (entries decorated the same way) from ONE `git ls-files`, each level shaped and capped like `/git/tree`'s; the Files tab's **Expand all folders** is this one request instead of one per folder.
 
 #### Read a lane's own branches
 
@@ -530,16 +567,20 @@ POST /api/lanes/:id/git/:action
 ```
 
 The git **writes** the dashboard offers. Guarded (same-origin) and serialized
-per lane under the lane lock.
+per git index (the lane lock keyed on the worktree's git dir), so a claude and
+a codex lane on one cwd — or a root and a subdirectory lane of one repo —
+cannot collide on `index.lock`.
 
 | Action | Runs | Body |
 | --- | --- | --- |
 | `fetch` | `git fetch --all --prune` | — |
 | `pull` | `git pull --ff-only` | — |
-| `push` | `git push -u origin HEAD` | — |
+| `push` | `git push -u <remote> HEAD` — the branch's upstream remote, else the only remote, else `origin`, else `400 ENOREMOTE` | — |
 | `stage` | `git add -- <paths>` | `{"paths": ["..."]}` |
-| `unstage` | `git restore --staged -- <paths>` | `{"paths": ["..."]}` |
+| `unstage` | `git restore --staged -- <paths>` (a staged rename also passes its original path, so both halves unstage) | `{"paths": ["..."]}` |
 | `discard` | `git restore --source=HEAD --staged --worktree` (tracked) / `git clean -fd` (untracked) | `{"paths": ["..."], "confirm": true}` |
+| `stage-hunk` | `git apply --cached` of ONE hunk of `git diff -U<context> HEAD -- <path>` | `{"path": "...", "hunk": "@@ -1,2 +1,3 @@", "context": 3}` |
+| `discard-hunk` | `git apply -R` of that one hunk, off the working tree | `{"path": "...", "hunk": "@@ ... @@", "context": 3, "confirm": true}` |
 | `commit` | `git add -A` then `git commit -m <message>`, or the index as it stands with `only: "staged"` | `{"message": "...", "only": "staged"}` |
 | `switch` | `git switch [-c] <branch>` | `{"branch": "...", "create": false}` |
 | `branch-create` | `git branch <branch> [<base>]` — never switches | `{"branch": "...", "base": "..."}` |
@@ -558,18 +599,36 @@ per lane under the lane lock.
 - A **path** in the body is never trusted as a path: `stage`, `unstage` and
   `discard` accept only paths `git status` is reporting as changed right now,
   so `..`, an absolute path and an untouched file are all `400 EBADPATH`.
-- `discard` is the one irreversible action here and it **requires**
-  `confirm: true` (`400 ECONFIRM` without it). The UI additionally asks twice.
+  A `commit` without `only: "staged"` sweeps in (`git add -A -- .`) only the
+  lane cwd's own changes, and is `400 ENOCHANGES` when the lane has none —
+  even if the repo is dirty elsewhere.
+- `discard` and `discard-hunk` are the irreversible actions here and both
+  **require** `confirm: true` (`400 ECONFIRM` without it). The UI additionally
+  asks twice.
+- A hunk is named by its `@@` line and matched against a FRESH diff at the
+  `context` the caller read it with (send the `context` the changes read
+  returned), so a hunk the file has moved past is `409 EHUNKGONE`, never a
+  stale patch applied somewhere else. The path goes through the same
+  `git status` check; an untracked file has no hunks (`400 EUNTRACKED`). A
+  hunk that no longer applies (e.g. part of it is already staged) is
+  `409 EGIT`.
 - `branch-create` never switches — the usual reason to create one from a lane
   is to spawn a sibling worktree lane, and moving this pane's HEAD under a
   working agent is not. `branch-delete` is `-d`, never `-D`, and refuses
   `main`/`master`/`development`/`develop` (`400 EPROTECTED`), the current
   branch and a branch another worktree holds (`400 EBRANCHBUSY`).
 - Bad input is **400** (`EBADACTION`, `EBADMESSAGE`, `EBADBRANCH`, `EBADPATH`,
-  `ECONFIRM`, `EPROTECTED`, `ENOBRANCH`, `EBRANCHEXISTS`, `EBRANCHBUSY`,
-  `EDIRTY`, `ENOCHANGES`); a git failure is
-  **500** with git's own `stderr` appended to `error.message` — a rejection or a
-  credential failure reads better in git's words.
+  `ECONFIRM`, `EUNTRACKED`, `EPROTECTED`, `ENOBRANCH`, `EBRANCHEXISTS`, `EBRANCHBUSY`,
+  `EDIRTY`, `ENOCHANGES`, `ESTAGEDOUTSIDE`, `ENOREMOTE`); git itself exiting
+  non-zero (a rejected push, a credential failure, a diverged pull) is
+  **409 `EGIT`** with git's own `stderr` appended to `error.message` — a
+  rejection reads better in git's words. Anything else (git not installed, a
+  timeout kill) is **500**, still under a string code (`EGIT` when there is
+  none) — `error.code` is never git's numeric exit status.
+- In a lane whose cwd is a subdirectory of its repo, `commit` refuses with
+  `400 ESTAGEDOUTSIDE` while the index holds a change outside that directory:
+  `git commit` takes the whole index whatever the cwd, and scoping it with a
+  pathspec would commit the working-tree copy (unstaged edits included).
 - Network actions (`fetch`/`pull`/`push`) are killed after 60s so an unreachable
   remote fails instead of holding the request open.
 
@@ -1804,9 +1863,9 @@ The `/api/cc-config/*` namespace powers the Claude Config Explorer, now the **Cl
 
 ```http
 GET /api/cc-config/overview
-GET /api/cc-config/skills?scope=user|project|all
+GET /api/cc-config/skills?scope=user|project|all&cwd=<dir>
 GET /api/cc-config/agents
-GET /api/cc-config/commands
+GET /api/cc-config/commands?scope=user|project|all&cwd=<dir>
 GET /api/cc-config/output-styles
 GET /api/cc-config/plugins
 GET /api/cc-config/marketplaces
@@ -1842,6 +1901,8 @@ POST /api/cc-config/mcp/add               Body: { name, scope, transport?, url?,
 POST /api/cc-config/mcp/remove            Body: { name, scope? }
 ```
 
+The list reads take an optional `cwd` naming the project whose `.claude/` is read (default: the server's own cwd); the run console's `/` autocomplete passes the directory the run will start in, so a lane's own project commands and skills are the ones offered.
+
 `scope` is `"user"`, `"project"`, or `"auto-memory"`. `type` is one of `skills`, `agents`, `commands`, `output-styles`, `memory`, `auto-memory`. `name` is required for everything except `memory` (which is `CLAUDE.md` itself). On `PUT`, `name` is validated against `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$` (for `auto-memory` it must instead be a flat `*.md` filename). Settings are returned with secret-like keys (matching `/token|secret|password|api[_-]?key|auth/i`) replaced by `"<redacted>"`.
 
 `GET /api/cc-config/plugins` returns each installed plugin's `contributes` block: the `skills` / `agents` / `commands` / `outputStyles` / `hooks` counts, plus `contributes.items` listing the first four surfaces **by name** (`[{ name, description, file }]`) so the UI can show *which* artifacts a plugin ships, not only how many. `name` is the file's frontmatter `name` when it declares one — the string Claude Code actually addresses it by — otherwise the filename. Each surface covers both the conventional directory (`skills/`, `agents/`, `commands/`, `output-styles/`) **and** any path `plugin.json` declares under that key: a plugin that lists its commands explicitly and keeps nothing in `commands/` (this repo's own `agenthub` does) previously reported zero. A declared path that resolves outside the plugin's install directory is ignored — a third-party manifest must not make the dashboard read arbitrary files. The counts are always the matching list's length. `hooks` has no `items` list: a plugin's hooks are matcher/command pairs declared inline in `plugin.json`, not named artifacts.
@@ -1933,6 +1994,7 @@ GET    /api/run/binary?tool=          { found, path } for the `claude` or `codex
 GET    /api/run/cwds                  Suggested cwds (dashboard, home, recent)
 GET    /api/run/history?limit=&laneId=  Persisted run history; laneId narrows to one lane's runs
 GET    /api/run/files?cwd=&q=         Fuzzy file search inside cwd for the @-file autocomplete
+POST   /api/run/drop-image            Raw image body (png/jpeg/gif/webp, ≤20 MB) → {path}: saved 0600 under <tmpdir>/agenthub-drops-<uid>/ with a random name, pruned after a day; the terminal pastes the path
                                        (skips node_modules, .git, dist, build, .next, .cache, coverage, vendor)
 POST   /api/run                       Start/attach run — Body: { laneId, cwd?, model?, permissionMode?, effort?, resumeSessionId?, initialPrompt? }
 GET    /api/run/:id                   Run handle (returns live run state)

docs/DATABASE.md

@@ -389,7 +389,9 @@ CREATE TABLE notifications (
 
 ### model_pricing
 
-Per-model pricing rules for cost calculation, keyed by `model_pattern` (a SQL-style glob; `%` matches any characters). Rates are per **million** tokens (USD).
+Per-model pricing rules for cost calculation, keyed by `model_pattern` (a SQL-style glob; `%` matches any characters). Rates are per **million** tokens (USD). The longest matching pattern wins.
+
+**Automatic rates.** `server/lib/pricing-sync.js` runs at server start and every 15 minutes. Any Claude model seen in `token_usage` whose family (the id minus a `-YYYYMMDD` suffix) has no `<family>%` row of its own gets one, INSERTED from LiteLLM's public price list (`model_prices_and_context_window.json` on GitHub). The list is fetched only when something is missing and cached for 24 h. Existing rows are never updated, so a rate edited in Settings always wins. A rate outside 0–1000 $/MTok is rejected, and a failed fetch changes nothing. Set `AGENTHUB_PRICING_SYNC=0` (or `false`/`off`) to turn it off.
 
 ```sql
 CREATE TABLE model_pricing (

docs/LANES.md

@@ -421,14 +421,14 @@ The dashboard web UI merges lanes and runs into a single **Workspace** page acce
 - **Detail panel** — the selected lane's declared stage, its inferred stage when detection leads, a full-width pipeline map, and a legend naming all five node states plus the dashed-amber inferred treatment.
 - **Terminal** — a real interactive terminal (xterm.js) displaying the tmux session's PTY output, with full support for interactive commands, editors, and pagers. A live run keeps its rendered history and scroll position when scrolling. It grabs the keyboard the moment it appears, so typing goes into the pane without clicking it first, and when the pane's process ends — a double Ctrl+C out of `claude`, `exit`, a crash — the console returns to the run setup form on its own, with no "New run" click.
 - **Clipboard in a pane** — the lane's tmux session is started with the graphical session's own `DISPLAY`/`WAYLAND_DISPLAY`/`XAUTHORITY`/`XDG_RUNTIME_DIR` (read from `systemctl --user show-environment`, this process's own values winning; `server/lib/desktop-env.js`). The dashboard normally runs as a systemd *user* service, which has none of them, so a pane it started had no clipboard at all and `claude` answered "no image found in clipboard" on every image paste while the same CLI pasted fine in a terminal. Only those four names are forwarded, and only into panes this dashboard spawns — an already-running pane keeps the environment it was started with, so it needs a restart to gain one.
-- **Split view** — a layout toggle (one pane / two side by side / a 2×2 grid, drawn as icons rather than the words, with the count kept as each button's `aria-label` and tooltip) renders that many independent terminal panes side by side (`grid-cols-2` for 2, a 2×2 grid for 4). Layout 1 is bound to the lane strip's selection, same as always; layouts 2 and 4 give each pane its own lane picker, independent of the strip. The chosen layout and each pane's lane persist to `localStorage` (`agenthub.workspace.splitView`) across reloads.
-- **Lane grid** — one card per lane, 1 column, 2 at `md`, 3 at `xl`. Each card carries the lane id, liveness dot and status, title, declared stage and time-on-stage, the `auto:` chip when detection leads, the kind and CI tags, the working-copy facts from `GET /api/lanes/:id/git`, the needs-you banner, and the action row.
+- **Split view** — a layout toggle (one pane / two side by side / a 2×2 grid, drawn as icons rather than the words, with the count kept as each button's `aria-label` and tooltip) renders that many terminal panes side by side (`grid-cols-2` for 2, a 2×2 grid for 4). EVERY pane is bound to the lane strip's selection — there is no per-pane lane picker — and each pane owns its own tmux session on that lane: pane 0 is the lane's `agenthub-lane-<id>` (its `run_id`), panes 1–3 are `agenthub-lane-<id>-<slot>` (`POST /api/lanes/:id/start` with `slot`). A pane's **Active runs** leaves out the runs the other panes are showing, so one terminal is never attached twice side by side. Only the layout persists to `localStorage` (`agenthub.workspace.splitView`); a stored per-pane lane id from an older build is ignored.
+- **Lane grid** — one card per lane, 1 column, 2 at `md`, 3 at `xl`. Each card carries the lane id, liveness dot and status, title, declared stage and time-on-stage, the `auto:` chip when detection leads, the kind and CI tags, the working-copy facts from `GET /api/lanes/:id/git`, and the action row. The needs-you message (`needs_action`) is on the lane strip tile only — the detail card no longer repeats it as a banner.
 
 Run history is per lane, queryable via `GET /api/run/history?laneId=<n>`.
 
-**A console pane follows the lane it shows.** Selecting another lane — from the lane strip in layout 1, or from a pane's own lane picker in layouts 2 and 4 — swaps that pane's cwd, run history and terminal over to the new lane. If the new lane already has a live run in `GET /api/run`, the pane re-attaches to it immediately, so each lane sticks to its own `agenthub-lane-<id>` tmux session; if it has none, the pane shows that lane's setup form. Nothing of the previous lane (a half-typed prompt, its terminal) carries over.
+**A console pane follows the lane it shows.** Selecting another lane on the lane strip swaps every pane's cwd, run history and terminal over to the new lane. If the new lane already has a live session for that pane's slot in `GET /api/run`, the pane re-attaches to it immediately, so each pane sticks to its own `agenthub-lane-<id>[-<slot>]` tmux session; if it has none, the pane shows that lane's setup form. Nothing of the previous lane (a half-typed prompt, its terminal) carries over.
 
-The **working directory** field tracks the selected lane's own `cwd` specifically, and re-syncs as soon as that path is known rather than only when the selection changes — a pane can render before `GET /api/lanes` has answered (split view restores its pane lanes from `localStorage`), and its lane id never changes afterwards. `RunSetup` submits that string verbatim to `POST /api/lanes/:id/start`, so a cwd left over from the previous lane or from the home default would start the run in the wrong folder. The home suggestion is used only while no lane is selected at all.
+The **working directory** field tracks the selected lane's own `cwd` specifically, and re-syncs as soon as that path is known rather than only when the selection changes — a pane can render before `GET /api/lanes` has answered (the lane list loads after the page mounts), and its lane id never changes afterwards. `RunSetup` submits that string verbatim to `POST /api/lanes/:id/start`, so a cwd left over from the previous lane or from the home default would start the run in the wrong folder. The home suggestion is used only while no lane is selected at all.
 
 **Picking a session to resume starts it right away.** In the setup form's Fresh/Resume switch, choosing a session from the resume picker fires the start immediately — `POST /api/lanes/:id/start` with that `resumeSessionId` and the session's own `cwd` — and the pane switches straight to the terminal. A resume carries its own transcript, so there is nothing to type first: the prompt box stays optional for resumes (the Run button no longer requires it) and required for fresh runs. A resume also **sends no prompt at all** — whatever is left in that box is dropped rather than fired as an extra turn into the session being continued. Type into the tmux terminal once it's attached.
 
@@ -480,8 +480,8 @@ Two concurrent calls for the same `(cwd, tool)` pair always yield one lane: the
 
 ### Reading a lane's working copy: `GET /api/lanes/:id/git`
 
-Each lane card shows the branch its working copy is actually on, the short
-HEAD, that commit's subject, and how much is uncommitted:
+The top of a lane's **Changes** panel shows the branch its working copy is
+actually on, the short HEAD, that commit's subject, and how much is uncommitted:
 
 ```bash
 curl http://localhost:4820/api/lanes/5/git
@@ -505,7 +505,7 @@ curl http://localhost:4820/api/lanes/5/git
 
 - A `cwd` that is missing, is not a git repository, or makes git fail returns
   `{"available": false}` with HTTP **200**. A lane pointing at a plain directory
-  is a normal state, not a fault, and the card simply renders without a git row.
+  is a normal state, not a fault, and the panel simply renders without a git line.
 - A detached checkout reports the literal `HEAD` that git returns, rather than a
   prettier invention.
 - `files` names the files the two counts came from, **capped at 20** — a lane
@@ -520,8 +520,8 @@ curl http://localhost:4820/api/lanes/5/git
   read off disk, since a lane mid-build can have a 100 MB artifact), a **binary**
   file, a **rename** (numstat keys those differently), or a repo with no commit
   to diff against yet.
-- Hovering (or focusing, or tapping) the `N modified · N untracked` text on a
-  lane card opens this list as a panel: one row per file, its status letter
+- Hovering (or focusing, or tapping) the `N modified · N untracked` text at the
+  top of the Changes panel opens this list as a panel: one row per file, its status letter
   colour-coded, the directory truncated before the filename ever is, and each
   row's `+N −M` aligned on the right under a total.
 - An unknown lane id is a `404`.
@@ -529,32 +529,31 @@ curl http://localhost:4820/api/lanes/5/git
 This is **not** folded into `GET /api/lanes` on purpose: it shells out to git
 five times, and the lane list is polled and re-broadcast on every hook-driven
 `lane_update`. Putting it there would fire a burst of subprocesses behind every
-tool call an agent makes. The browser fetches it per card instead, on mount and
-every 30 seconds, and a failed fetch is silent.
+tool call an agent makes. The Changes panel fetches it instead, on mount, every 30 seconds and after
+every git write it or its action row makes, and a failed fetch is silent.
 
 The same response also carries the branch's standing against its remote:
 `hasRemote`, `upstream`, `ahead`, `behind`. A branch that has never been pushed
 reports `upstream: null` and **null** counts — not zeros, which would claim "in
-sync" about a comparison that was never possible. The card renders them as
+sync" about a comparison that was never possible. The panel renders them as
 `↑2 ↓1` beside the git actions below.
 
 ### Acting on a lane's working copy: the git action row
 
-Under the git line, a lane's card carries the git **writes** the dashboard
-offers (`POST /api/lanes/:id/git/:action`, see `docs/API.md`):
+On the same row as the git line — as icons, each naming itself in its tooltip —
+the Changes panel carries the per-repo git **writes** the dashboard offers (`POST /api/lanes/:id/git/:action`, see `docs/API.md`):
 
 | Button | Runs | Refuses when |
 | --- | --- | --- |
 | **Fetch** | `git fetch --all --prune` | the repo has no remote |
 | **Pull** | `git pull --ff-only` | the branch has diverged (it reports, never merges) |
 | **Push** | `git push -u origin HEAD` | the remote rejects it |
-| **Commit** | `git add -A` + `git commit -m …`, or **Commit staged** (the index as it stands) | nothing is uncommitted / nothing is staged |
 | **Branch** | `git switch …` | the tree is dirty, or another worktree holds that branch |
 | **Create** | `git branch <name>` — never switches | the branch already exists |
 | **Delete** | `git branch -d <name>` | it is protected (`main`, `master`, `development`, `develop`), current, held by another worktree, or has unmerged commits |
 | **New lane here** | opens **Add lane** prefilled with this repo and the selected branch | — |
 
-These sit on the card rather than in the ⋯ menu deliberately: that menu holds
+These sit in the panel rather than in the lane card's ⋯ menu deliberately: that menu holds
 the rare and dangerous (`reset worktree`), and these are the ordinary moves a
 lane needs several times an hour. The boring half of git is the whole list on
 purpose — there is no merge, rebase, reset or stash button, because a dashboard
@@ -565,7 +564,9 @@ deliberately does not switch: the usual reason to make a branch from a lane is
 to spawn a sibling worktree lane on it, and moving this pane's HEAD under a
 working agent is not. **New lane here** goes through the normal Add-lane flow
 with the fields prefilled — one provisioning path for every lane, not a second
-one hidden in the git bar.
+one hidden in the git bar. There is no **Commit** here: committing is the
+overview's staged-only box below, the one commit path, and it only ever takes
+what was staged.
 
 A failed action prints git's own `stderr` verbatim — `! [rejected] … (non-fast-forward)`
 says more than any sentence the dashboard could write.
@@ -574,9 +575,15 @@ says more than any sentence the dashboard could write.
 
 To the right of the lane detail sits a collapsible **Changes** card (its state
 persists per viewer in `localStorage`). Its header holds **one** control, which
-steps narrow → 50/50 → 70/30 → closed (`agenthub.workspace.changesSize`
+steps **Narrow** (30%) → **Medium** (50/50) → **Full screen** (the console beside it is hidden, never unmounted; the page is
+height-locked so the panel fills the viewport even with no live run; the whole
+Files view (finder, expand-all, tree) becomes a left sidebar and the Files tab
+is dropped, and every working-copy file opened there, from the sidebar, Overview or Review, IS
+the editor (Whole file toggles back to its diff; a commit still opens as a diff) — no
+Edit click, **Save**/**Cancel** stay and wake up once the text differs, Cancel
+restores the saved text) → closed (`agenthub.workspace.changesSize`
 alongside `agenthub.workspace.changesOpen`); the collapsed rail reopens it
-narrow. Reading a diff and watching a console want opposite amounts of room and
+narrow. A stored size from an older build that no longer exists (`wide`) falls back to narrow. Reading a diff and watching a console want opposite amounts of room and
 which one is "work" changes several times an hour, so the width is a step, not
 a setting — and one button beats a width button wedged beside a collapse button
 in the panel's tightest corner. It is icon-only, and the icon it draws is the
@@ -590,7 +597,18 @@ only one that answers "show me the code" rather than "show me the change"):
   them — a folder's children render nested under it, siblings stay visible,
   and a toolbar button expands or collapses every folder at once (each
   unfetched level lazily calls `/git/tree` the first time it's opened).
-  Opening a file entry shows the whole file (`/git/file`).
+  Untracked files git does not ignore are listed too, and the tree is
+  decorated like VS Code's: a modified file is amber with `M`, an untracked
+  one green with `U` (`A` added, `D` deleted and struck through, `R`
+  renamed), and a folder holding any of them gets an amber dot. The colours
+  come with the tree read, so **Refresh** re-reads them.
+  Opening a file entry shows the whole file (`/git/file`). Its **Edit** button
+  (any range but a commit) turns that view into a text editor: **Save** (or
+  Ctrl/Cmd+S) is `PUT /api/lanes/:id/git/file`, which writes only over the
+  exact version that was opened — a file the agent changed meanwhile answers
+  `409 ESTALE` and the draft stays for a retry — and keeps the file's CRLF
+  line endings and final newline. A file the editor cannot take (binary, or
+  over the 1 MB view cap) says so where the Edit button would be.
 - **Overview** — every changed file with its `+N −M`. Polls every 15s, because
   it is the cheap shape and the one you leave open while an agent works. Each
   row carries its own **stage** / **unstage** / **discard** buttons.
@@ -600,6 +618,16 @@ only one that answers "show me the code" rather than "show me the change"):
   target-practice exercise against one chevron.) One toolbar button folds or
   unfolds all of them. What is remembered is the set of *collapsed* paths, so
   a file that appears later is open by default; a lane switch clears it.
+  Each file's header stays **pinned** at the top while its diff scrolls past,
+  and carries the same stage / unstage / discard buttons as its overview row.
+  On a file with unstaged changes every hunk gets an editor-style **review
+  bar**, hung just under its last changed line and pinned to the visible
+  right edge: `^`/`v` to walk the hunks (each brings the next/previous `@@`
+  line to the top of the ONE scroller, below the sticky file header — a
+  review diff has no scroll box of its own unless it is large enough to
+  window, above 500 rows), `n of N`, **Undo**
+  (`discard-hunk` — asks twice, like discard) and **Keep** (`stage-hunk`).
+  The single-file view offers the same bar.
 - **One file** — clicking a file's path in any list opens just that file.
   **All files** returns to the list it was opened from — the same mode, at the
   same scroll offset — because reading a change-set is a walk down a long list
@@ -637,13 +665,19 @@ in every panel narrow enough to sit beside a console.
 
 **Per-file writes are the panel's, per-repo writes are the git bar's.** Staging
 one file means nothing unless a commit can take the index as it stands, so the
-overview grows a commit box the moment anything is staged — it sends
+overview grows a commit box the moment anything is staged — above the list and
+pinned while it scrolls, on ONE row with a **Stage all** that stages every listed file
+the index lacks in one call and an **Unstage all** that unstages every staged one — it sends
 `only: "staged"`, never `add -A`, and it is absent with a clean index because
-there is nothing it could mean. (The git bar's own **Commit staged** is the
-same call from the lane card; its plain **Commit** is still stage-everything.) **Discard** is the one
+there is nothing it could mean. It is the dashboard's ONLY commit: the git bar
+above it has none, so no click can sweep the rest of the tree in with `add -A`. **Discard** is the one
 irreversible action in the panel: it asks twice in the UI, and the server
 refuses it without `confirm: true` and accepts only paths `git status` is
-already reporting as changed.
+already reporting as changed. In the `work` range the overview splits like VS
+Code's Source Control: **Staged Changes** (what the next commit takes, each row
+offering Unstage) above **Changes** (unstaged and untracked, each offering
+Stage); a partly staged file appears in both. In the tree, a changed file's
+whole row takes its status tint, not only its letter.
 
 Review, single-file, history and browse do **not** poll: re-fetching under the
 reader's scroll position is worse than a slightly stale view, and those are the
@@ -1483,7 +1517,7 @@ curl -X POST http://localhost:4820/api/lanes/5/stop
 
 ### git: fetch / pull / push / stage / unstage / discard / commit / switch / branch-create / branch-delete
 
-The git writes the lane card's action row and the Changes panel offer. See
+The git writes the Changes panel and its action row offer. See
 "Acting on a lane's working copy" above for what each one refuses and why.
 
 ```bash

openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
   title: Agent Dashboard for Claude Code API
-  version: 1.8.5
+  version: 1.8.8
   description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
   contact:
     name: Nguyễn Ngọc Trí Vĩ
@@ -11043,7 +11043,7 @@ paths:
       tags:
         - Lanes
       summary: The lane's recent commits
-      description: Newest first, up to limit (default 30, max 200). file= narrows it to the commits touching one path. Reading a commit's diff is GET /api/lanes/{id}/git/changes?range=commit&sha=. Read-only, no same-origin guard.
+      description: Newest first, up to limit (default 30, max 200). file= narrows it to the commits touching one path (relative, no `..`, else 400 EBADPATH). Reading a commit's diff is GET /api/lanes/{id}/git/changes?range=commit&sha=. Read-only, no same-origin guard.
       operationId: listLaneCommits
       parameters:
         - name: id
@@ -11064,6 +11064,8 @@ paths:
       responses:
         '200':
           description: '{available, commits:[{sha, short, subject, author, date, refs}]}.'
+        '400':
+          description: EBADPATH (file= is absolute or has a `..` segment).
         '404':
           description: Lane not found.
   /api/lanes/{id}/git/file:
@@ -11093,7 +11095,9 @@ paths:
         '200':
           description: '{available, path, rev, binary, truncated, lines}.'
         '400':
-          description: EBADPATH, EBADREV or ENOFILE.
+          description: EBADPATH (incl. a symlink resolving outside the lane), EBADREV or ENOFILE.
+        '403':
+          description: ESECRET — `.claude/settings.local.json` (the AI Router key) is refused at every rev, at any depth, and under any path that resolves to it (a symlinked `.claude`).
         '404':
           description: Lane not found.
   /api/lanes/{id}/git/ls:
@@ -11143,6 +11147,24 @@ paths:
           description: EBADPATH (the path escapes the lane).
         '404':
           description: Lane not found.
+  /api/lanes/{id}/git/tree-all:
+    get:
+      tags:
+        - Lanes
+      summary: Every level of the tracked tree in one read
+      description: 'The file explorer''s expand-all-folders read: ONE git ls-files, grouped into levels keyed by directory ("" is the root), each level shaped and capped like GET /api/lanes/{id}/git/tree''s entries. Read-only, no same-origin guard.'
+      operationId: listLaneTreeAll
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: integer
+      responses:
+        '200':
+          description: '{available, levels:{<dir>:[{name, path, dir}]}, truncated}.'
+        '404':
+          description: Lane not found.
   /api/lanes/{id}/git/branches:
     get:
       tags:
@@ -11166,7 +11188,7 @@ paths:
       tags:
         - Lanes
       summary: One git write on the lane's working copy
-      description: 'fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u origin HEAD, so only the branch the lane is on), stage/unstage (per file), discard (per file; irreversible, so it REQUIRES confirm:true), commit (git add -A then commit -m <message>, or only:"staged" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent''s half-finished work is never carried onto another branch), and branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per lane under the lane lock. Deliberately no merge, rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.'
+      description: 'fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u <remote> HEAD, so only the branch the lane is on; remote = the branch''s upstream remote, else the only remote, else origin, else 400 ENOREMOTE), stage/unstage (per file), discard (per file; irreversible, so it REQUIRES confirm:true), stage-hunk / discard-hunk (ONE hunk of a tracked file''s `git diff HEAD`, named by its `@@` line and re-read server-side at the given context — the applied patch is always git''s own text, never one from the request; discard-hunk REQUIRES confirm:true; 400 EUNTRACKED for an untracked file, 409 EHUNKGONE when the hunk is no longer in the diff), commit (git add -A then commit -m <message>, or only:"staged" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent''s half-finished work is never carried onto another branch), and branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per git index (the lane lock keyed on the worktree''s git dir, so two lanes sharing one index cannot collide on index.lock). Deliberately no merge, rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.'
       operationId: runLaneGitAction
       parameters:
         - name: id
@@ -11186,6 +11208,8 @@ paths:
               - stage
               - unstage
               - discard
+              - stage-hunk
+              - discard-hunk
               - commit
               - switch
               - branch-create
@@ -11219,18 +11243,29 @@ paths:
                   items:
                     type: string
                   description: stage, unstage, discard; each must be a path git reports changed.
+                path:
+                  type: string
+                  description: stage-hunk, discard-hunk; a path git reports changed (not untracked).
+                hunk:
+                  type: string
+                  description: stage-hunk, discard-hunk; the hunk's `@@` line as the diff returned it. The server re-reads the diff and applies git's own text of that hunk; a hunk no longer present is 409 EHUNKGONE.
+                context:
+                  type: integer
+                  description: stage-hunk, discard-hunk; the context the hunk was read at.
                 confirm:
                   type: boolean
-                  description: discard only; the call is refused without it.
+                  description: discard and discard-hunk; the call is refused without it.
       responses:
         '200':
           description: '{action, ok:true, output} — git''s own stdout+stderr.'
         '400':
-          description: EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY or ENOCHANGES.
+          description: EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY, ENOCHANGES, ESTAGEDOUTSIDE or ENOREMOTE.
         '404':
           description: Lane not found.
+        '409':
+          description: EGIT — git ran and refused (a rejected push, a credential failure, a diverged --ff-only pull); its stderr is appended to error.message.
         '500':
-          description: git failed; its stderr is appended to error.message.
+          description: Unexpected server-side failure.
   /api/lanes/{id}/{action}:
     post:
       tags:

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "agenthub",
-  "version": "1.8.5",
+  "version": "1.8.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agenthub",
-      "version": "1.8.5",
+      "version": "1.8.8",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenthub",
-  "version": "1.8.5",
+  "version": "1.8.8",
   "bin": {
     "agenthub": "bin/agenthub.js"
   },
@@ -62,8 +62,8 @@
     "import-history": "node scripts/import-history.js",
     "reconcile-tokens": "node scripts/import-history.js --reconcile-tokens",
     "clear-data": "node scripts/clear-data.js",
-    "test": "node --test server/__tests__/*.test.js && cd client && npm test",
-    "test:server": "node --test server/__tests__/*.test.js",
+    "test": "node scripts/test-server.js && cd client && npm test",
+    "test:server": "node scripts/test-server.js",
     "test:client": "cd client && npm test",
     "format": "prettier --write .",
     "format:check": "prettier --check .",

scripts/test-server.js

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+/**
+ * @file test-server.js
+ * @description Runs the server test suite against a PRIVATE tmux server.
+ * Several suites start real `agenthub-lane-<id>` tmux sessions and then kill
+ * or reset them, with lane ids from their own throwaway database — on the
+ * user's default tmux server those names collide with the dashboard's real
+ * lane panes, and a test run kills whichever live session shares an id
+ * (including the pane the test was launched from). Dropping `TMUX` and
+ * pointing `TMUX_TMPDIR` at a fresh directory gives every tmux call — the
+ * app's own and the tests' direct `execFileSync("tmux", …)` — its own socket.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const root = path.join(__dirname, "..");
+const dir = path.join(root, "server", "__tests__");
+const files = fs
+  .readdirSync(dir)
+  .filter((f) => f.endsWith(".test.js"))
+  .map((f) => path.join(dir, f));
+const args = process.argv.slice(2);
+
+const tmuxDir = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-test-tmux-"));
+const env = { ...process.env, TMUX_TMPDIR: tmuxDir };
+delete env.TMUX;
+delete env.TMUX_PANE;
+
+const result = spawnSync(process.execPath, ["--test", ...args, ...(args.length ? [] : files)], {
+  stdio: "inherit",
+  env,
+  cwd: root,
+});
+
+// Whatever a test leaked dies with the private server, never a real pane.
+spawnSync("tmux", ["kill-server"], { env, stdio: "ignore" });
+fs.rmSync(tmuxDir, { recursive: true, force: true });
+process.exit(result.status ?? 1);

server/README.md

@@ -528,10 +528,11 @@ Request body shape:
 | `GET` | `/api/lanes/:id/git/changes?range=work\|branch\|commit[&sha=][&path=][&full=1][&context=]` | The lane's code changes for the Changes panel: a file summary, one file's hunks (`path`), or every file's hunks (`full=1`); `range=commit&sha=` is one commit, `context=` (default 3, max 5000) widens each hunk. Capped at 300 files / 200 KB per file / 1 MB per full read. `400 ENOBASE`, `ENOFILECHANGE`, `EBADRANGE` or `EBADREV`. |
 | `GET` | `/api/lanes/:id/git/log?limit=&file=` | The lane's recent commits (newest first, limit max 200), optionally only those touching one path. |
 | `GET` | `/api/lanes/:id/git/file?path=&rev=` | One file's whole content at `work` (realpath-confined to the lane), `HEAD` or a commit-ish. 1 MB cap. `400 EBADPATH`/`EBADREV`/`ENOFILE`. |
+| `PUT` | `/api/lanes/:id/git/file` | Same-origin guarded save from the whole-file editor: `{path, content, baseSha}`. An existing text file within the 1 MB cap, over exactly the version opened (`baseSha` = the read's `sha`, else `409 ESTALE`); `403 ESECRET`, `400 EBADPATH`/`ENOFILE`/`EBADCONTENT`/`ETOOBIG`/`EBINARY`. |
 | `GET` | `/api/lanes/:id/git/ls?q=` | Tracked paths matching a substring, for quick-open. `git ls-files`, so ignored files never appear. Capped at 500. |
-| `GET` | `/api/lanes/:id/git/tree?path=` | One directory level of tracked files, folded. `400 EBADPATH` for a path escaping the lane. |
+| `GET` | `/api/lanes/:id/git/tree?path=` | One directory level of tracked + untracked-not-ignored files, folded; changed files carry their porcelain `status`, folders holding one `changed: true`. `400 EBADPATH` for a path escaping the lane. |
 | `GET` | `/api/lanes/:id/git/branches` | The lane repo's own local branches + worktrees, for the branch switcher. The repo comes from the lane row, never the query. |
-| `POST` | `/api/lanes/:id/git/:action` | Same-origin guarded git write, serialized under the lane lock: `fetch`, `pull` (always `--ff-only`), `push` (`-u origin HEAD`), `stage`/`unstage`/`discard` (per file; a path must be one git reports changed, and `discard` needs `confirm:true`), `commit` (`add -A` + `-m`, or `only:"staged"`), `switch` (refuses a dirty tree), `branch-create` (never switches) and `branch-delete` (`-d`, refuses protected/current/busy branches). No merge/rebase/reset/stash by design. |
+| `POST` | `/api/lanes/:id/git/:action` | Same-origin guarded git write, serialized under the lane lock: `fetch`, `pull` (always `--ff-only`), `push` (`-u origin HEAD`), `stage`/`unstage`/`discard` (per file; a path must be one git reports changed, and `discard` needs `confirm:true`), `stage-hunk`/`discard-hunk` (one hunk by its `@@` line, re-read fresh — `409 EHUNKGONE` when it moved; `discard-hunk` needs `confirm:true`), `commit` (`add -A` + `-m`, or `only:"staged"`), `switch` (refuses a dirty tree), `branch-create` (never switches) and `branch-delete` (`-d`, refuses protected/current/busy branches). No merge/rebase/reset/stash by design. |
 
 The route accepts `{ sourceRepo, title, base?, slug? }`. `sourceRepo` must be
 an existing absolute git repository. The response lane starts as
@@ -702,6 +703,7 @@ HTTP surface for the tmux-backed terminal run: one session per lane, named `agen
 | `GET`    | `/api/run/binary[?tool=]`     | Probe whether the CLI is on `PATH`. `?tool=codex` probes Codex; omitted or `?tool=claude` probes Claude; anything else is `400 EBADTOOL`. Returns `{ found, path }` |
 | `GET`    | `/api/run/tmux`               | `{ available }` — whether the `tmux` binary exists |
 | `GET`    | `/api/run/cwds`               | Suggested cwds (dashboard, home, recent from sessions) |
+| `POST`   | `/api/run/drop-image`          | An image dropped on the Workspace terminal. Raw body, `Content-Type` one of `image/png\|jpeg\|gif\|webp`, ≤20 MB. Saved `0600` under `<tmpdir>/agenthub-drops-<uid>/` with a RANDOM name (nothing from the request names the file); files older than a day are pruned on each write. Answers `{ path }`, which `TerminalView` pastes into the pane — what a local terminal does on a drop, and how `claude` attaches the image. 400 for any other type |
 | `GET`    | `/api/run/files?cwd=…&q=…`    | Fuzzy file search inside `cwd` for the run panel's `@`-file autocomplete. Skips `node_modules`, `.git`, `dist`, `build`, `.next`, `.cache`, `coverage`, `vendor`, etc. Cwd is required and must exist; results are capped and ranked by basename match |
 | `POST`   | `/api/run`                    | Create-or-adopt the lane's tmux session. Body: `{ laneId, cwd, initialPrompt?, model?, permissionMode?, effort?, resumeSessionId? }`. The CLI comes from the lane row, never from the body. An existing session whose pane sits at a shell prompt gets the argv typed into it; a pane already running a program is adopted unchanged |
 | `GET`    | `/api/run/:id`                | One run handle, or 404 once its tmux session is gone |

server/__tests__/git-diff-ops-hardening.test.js

@@ -0,0 +1,639 @@
+/**
+ * @file Regression tests for the lane git surface's hardening: the file viewer
+ * and untracked-file diff never read a secret file or follow a symlink out of
+ * the lane, `git status` paths survive C-quoting (non-ASCII, spaces, quotes),
+ * discarding a staged rename restores the original path, and untracked reads
+ * are async (no fs.*Sync on the poll path). Real git fixture, like
+ * git-diff-ops.test.js.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, beforeEach, afterEach } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { execFileSync } = require("node:child_process");
+
+const { collectChanges, parseNumstat, readFileAt } = require("../lib/git-diff");
+const { runGitAction } = require("../lib/git-ops");
+const { gitFacts } = require("../lib/worktree");
+
+let ROOT;
+let LANE;
+
+const g = (cwd, ...args) => {
+  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  delete env.GIT_DIR;
+  delete env.GIT_WORK_TREE;
+  delete env.GIT_INDEX_FILE;
+  return execFileSync("git", args, { cwd, encoding: "utf8", env });
+};
+
+function write(dir, file, body) {
+  fs.mkdirSync(path.dirname(path.join(dir, file)), { recursive: true });
+  fs.writeFileSync(path.join(dir, file), body);
+}
+
+beforeEach(() => {
+  ROOT = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-githarden-"));
+  LANE = path.join(ROOT, "lane");
+  g(ROOT, "init", "-q", "-b", "main", LANE);
+  g(LANE, "config", "user.email", "t@h");
+  g(LANE, "config", "user.name", "t");
+  write(LANE, "a.txt", "one\ntwo\n");
+  write(LANE, "old name.txt", "keep me\nplease\n");
+  g(LANE, "add", "-A");
+  g(LANE, "commit", "-qm", "init");
+  write(ROOT, "outside.txt", "TOP SECRET OUTSIDE\n");
+});
+
+afterEach(() => fs.rmSync(ROOT, { recursive: true, force: true }));
+
+describe("readFileAt: secret files and symlink escapes", () => {
+  it("refuses .claude/settings.local.json at rev=work", async () => {
+    write(LANE, ".claude/settings.local.json", '{"env":{"ANTHROPIC_API_KEY":"sk-x"}}');
+    for (const p of [".claude/settings.local.json", "./.claude//settings.local.json"]) {
+      await assert.rejects(readFileAt(LANE, p, "work"), { code: "ESECRET" });
+    }
+  });
+
+  it("refuses the secret file at a committed revision too", async () => {
+    write(LANE, ".claude/settings.local.json", '{"env":{"ANTHROPIC_API_KEY":"sk-x"}}');
+    g(LANE, "add", "-f", ".claude/settings.local.json");
+    g(LANE, "commit", "-qm", "oops");
+    await assert.rejects(readFileAt(LANE, ".claude/settings.local.json", "HEAD"), {
+      code: "ESECRET",
+    });
+  });
+
+  it("refuses a symlink whose target is outside the lane", async () => {
+    fs.symlinkSync(path.join(ROOT, "outside.txt"), path.join(LANE, "link.txt"));
+    await assert.rejects(readFileAt(LANE, "link.txt", "work"), { code: "EBADPATH" });
+  });
+
+  it("refuses a symlink that points at the secret file", async () => {
+    write(LANE, ".claude/settings.local.json", '{"k":"sk-x"}');
+    fs.symlinkSync(".claude/settings.local.json", path.join(LANE, "innocent.json"));
+    await assert.rejects(readFileAt(LANE, "innocent.json", "work"), { code: "ESECRET" });
+  });
+
+  it("still reads a symlink that stays inside the lane", async () => {
+    fs.symlinkSync("a.txt", path.join(LANE, "alias.txt"));
+    const out = await readFileAt(LANE, "alias.txt", "work");
+    assert.deepEqual(out.lines, ["one", "two"]);
+  });
+});
+
+describe("collectChanges: untracked content reads", () => {
+  it("never shows the content of an untracked symlink pointing outside the lane", async () => {
+    fs.symlinkSync(path.join(ROOT, "outside.txt"), path.join(LANE, "escape.txt"));
+    const out = await collectChanges(LANE, { range: "work", full: true });
+    const entry = out.files.find((f) => f.path === "escape.txt");
+    assert.ok(entry, "the symlink is still listed");
+    assert.equal(JSON.stringify(entry).includes("TOP SECRET"), false);
+  });
+
+  it("never shows the secret file's content in a diff", async () => {
+    write(LANE, ".claude/settings.local.json", '{"k":"sk-old"}');
+    g(LANE, "add", "-f", ".claude/settings.local.json");
+    g(LANE, "commit", "-qm", "tracked by mistake");
+    write(LANE, ".claude/settings.local.json", '{"k":"sk-leak"}');
+    const out = await collectChanges(LANE, { range: "work", full: true });
+    assert.equal(JSON.stringify(out).includes("sk-leak"), false);
+  });
+
+  it("does not use synchronous fs reads", async () => {
+    write(LANE, "new.txt", "x\ny\n");
+    const saved = { readFileSync: fs.readFileSync, statSync: fs.statSync };
+    fs.readFileSync = () => {
+      throw new Error("sync read");
+    };
+    fs.statSync = () => {
+      throw new Error("sync stat");
+    };
+    let out;
+    try {
+      out = await collectChanges(LANE, { range: "work", full: true });
+    } finally {
+      Object.assign(fs, saved);
+    }
+    const entry = out.files.find((f) => f.path === "new.txt");
+    assert.equal(entry.added, 2);
+    assert.equal(entry.hunks[0].lines.length, 2);
+  });
+});
+
+describe("C-quoted status paths", () => {
+  const NAME = 'tài liệu "mới".txt';
+
+  it("collectChanges reports a non-ASCII/quoted path verbatim", async () => {
+    write(LANE, NAME, "xin chào\n");
+    write(LANE, "a.txt", "one\ntwo\nthree\n");
+    g(LANE, "mv", "old name.txt", "mới tên.txt");
+    const out = await collectChanges(LANE, { range: "work" });
+    const paths = out.files.map((f) => f.path);
+    assert.ok(paths.includes(NAME), paths.join("|"));
+    assert.ok(paths.includes("mới tên.txt"), paths.join("|"));
+    assert.equal(out.files.find((f) => f.path === NAME).added, 1);
+    assert.equal(out.files.find((f) => f.path === "a.txt").added, 1);
+  });
+
+  it("stage accepts a non-ASCII/quoted path", async () => {
+    write(LANE, NAME, "xin chào\n");
+    await runGitAction(LANE, "stage", { paths: [NAME] });
+    assert.match(g(LANE, "diff", "--cached", "--name-only", "-z"), /mới/);
+  });
+
+  it("branch range and commit range report renamed non-ASCII paths", async () => {
+    g(LANE, "checkout", "-qb", "feat");
+    g(LANE, "mv", "old name.txt", "mới tên.txt");
+    g(LANE, "commit", "-qm", "rename");
+    const branch = await collectChanges(LANE, { range: "branch", base: "main" });
+    assert.deepEqual(
+      branch.files.map((f) => f.path),
+      ["mới tên.txt"]
+    );
+    const commit = await collectChanges(LANE, { range: "commit", sha: "HEAD" });
+    assert.deepEqual(
+      commit.files.map((f) => f.path),
+      ["mới tên.txt"]
+    );
+  });
+});
+
+describe("discard of a staged rename", () => {
+  it("restores the original path and removes the new one", async () => {
+    g(LANE, "mv", "old name.txt", "new name.txt");
+    await runGitAction(LANE, "discard", { paths: ["new name.txt"], confirm: true });
+    assert.equal(fs.readFileSync(path.join(LANE, "old name.txt"), "utf8"), "keep me\nplease\n");
+    assert.equal(fs.existsSync(path.join(LANE, "new name.txt")), false);
+    assert.equal(g(LANE, "status", "--porcelain"), "");
+  });
+
+  it("still requires confirm: true", async () => {
+    g(LANE, "mv", "old name.txt", "new name.txt");
+    await assert.rejects(runGitAction(LANE, "discard", { paths: ["new name.txt"] }), {
+      code: "ECONFIRM",
+    });
+  });
+});
+
+describe("GET /api/lanes/:id/git/file maps a secret to 403 ESECRET", () => {
+  it("answers 403 for the router's settings file", async () => {
+    process.env.DASHBOARD_DB_PATH = path.join(ROOT, "api.db");
+    process.env.DASHBOARD_REMOTE_SYNC_MS = "0";
+    process.env.DASHBOARD_LIVENESS_PROBE = "0";
+    const { createApp, startServer } = require("../index");
+    const server = await startServer(createApp(), 0);
+    const base = `http://127.0.0.1:${server.address().port}`;
+    try {
+      write(LANE, ".claude/settings.local.json", '{"k":"sk-x"}');
+      const created = await fetch(`${base}/api/lanes`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ cwd: LANE, title: "secret" }),
+      }).then((r) => r.json());
+      const id = created.lane.id;
+      const r = await fetch(
+        `${base}/api/lanes/${id}/git/file?path=.claude/settings.local.json&rev=work`
+      );
+      assert.equal(r.status, 403);
+      const body = await r.json();
+      assert.equal(body.error.code, "ESECRET");
+      assert.equal(JSON.stringify(body).includes("sk-x"), false);
+      await fetch(`${base}/api/lanes/${id}`, { method: "DELETE" });
+    } finally {
+      server.close();
+    }
+  });
+});
+
+describe("unstage of a staged rename", () => {
+  it("unstages both halves: nothing staged, the new file left untracked, the old one deleted in the tree only", async () => {
+    g(LANE, "mv", "old name.txt", "new name.txt");
+    await runGitAction(LANE, "unstage", { paths: ["new name.txt"] });
+    assert.equal(g(LANE, "diff", "--cached", "--name-only"), "");
+    assert.equal(fs.readFileSync(path.join(LANE, "new name.txt"), "utf8"), "keep me\nplease\n");
+  });
+});
+
+describe("readFileAt: one lexical guard for every rev", () => {
+  let SUB;
+  beforeEach(() => {
+    write(LANE, ".claude/settings.local.json", '{"k":"sk-parent"}');
+    write(LANE, "root-only.txt", "ROOT CONTENT\n");
+    write(LANE, "pkg/in.txt", "inside\n");
+    write(LANE, "pkg/.claude/settings.local.json", '{"k":"sk-sub"}');
+    g(LANE, "add", "-f", "-A");
+    g(LANE, "commit", "-qm", "sub");
+    SUB = path.join(LANE, "pkg");
+  });
+
+  it("refuses ../ and absolute paths at a committed rev in a subdirectory lane", async () => {
+    for (const p of [
+      "../.claude/settings.local.json",
+      "./../root-only.txt",
+      "x/../../root-only.txt",
+      "/etc/passwd",
+    ]) {
+      await assert.rejects(readFileAt(SUB, p, "HEAD"), { code: "EBADPATH" }, p);
+    }
+  });
+
+  it("reads committed paths relative to the lane, not the repo root", async () => {
+    const out = await readFileAt(SUB, "./in.txt", "HEAD");
+    assert.deepEqual(out.lines, ["inside"]);
+    assert.equal(out.path, "in.txt");
+    // A repo-root path is NOT reachable by naming it without ../
+    await assert.rejects(readFileAt(SUB, "root-only.txt", "HEAD"), { code: "ENOFILE" });
+  });
+
+  it("refuses the lane's own secret file in its normalised spellings", async () => {
+    for (const p of ["./.claude/settings.local.json", ".claude//settings.local.json"]) {
+      await assert.rejects(readFileAt(SUB, p, "HEAD"), { code: "ESECRET" }, p);
+    }
+  });
+});
+
+describe("paths are literal, never pathspec patterns", () => {
+  it("discarding an untracked 'new*.js' deletes only that file", async () => {
+    for (const f of ["new*.js", "new1.js", "new2.js"]) write(LANE, f, "x\n");
+    await runGitAction(LANE, "discard", { paths: ["new*.js"], confirm: true });
+    assert.equal(fs.existsSync(path.join(LANE, "new*.js")), false);
+    assert.equal(fs.existsSync(path.join(LANE, "new1.js")), true);
+    assert.equal(fs.existsSync(path.join(LANE, "new2.js")), true);
+  });
+
+  it("staging 'app/[id]/page.js' does not stage app/i/page.js", async () => {
+    write(LANE, "app/[id]/page.js", "a\n");
+    write(LANE, "app/i/page.js", "b\n");
+    g(LANE, "add", "-A");
+    g(LANE, "commit", "-qm", "app");
+    write(LANE, "app/[id]/page.js", "a2\n");
+    write(LANE, "app/i/page.js", "b2\n");
+    await runGitAction(LANE, "stage", { paths: ["app/[id]/page.js"] });
+    assert.equal(g(LANE, "diff", "--cached", "--name-only"), "app/[id]/page.js\n");
+  });
+
+  it("a single-file diff of 'a[b].txt' carries only that file's hunks", async () => {
+    write(LANE, "a[b].txt", "one\n");
+    write(LANE, "ab.txt", "one\n");
+    g(LANE, "add", "-A");
+    g(LANE, "commit", "-qm", "brackets");
+    write(LANE, "a[b].txt", "one\nmine\n");
+    write(LANE, "ab.txt", "one\nOTHER\n");
+    const out = await collectChanges(LANE, { range: "work", file: "a[b].txt" });
+    assert.equal(JSON.stringify(out.files[0].hunks).includes("OTHER"), false);
+    assert.equal(out.files[0].hunks.length, 1);
+  });
+});
+
+describe("a lane whose cwd is a subdirectory of its repo", () => {
+  let SUB;
+  beforeEach(() => {
+    write(LANE, "pkg/in.txt", "one\n");
+    g(LANE, "add", "-A");
+    g(LANE, "commit", "-qm", "pkg");
+    SUB = path.join(LANE, "pkg");
+    write(LANE, "a.txt", "one\ntwo\nOUTSIDE EDIT\n");
+    write(LANE, "outside-new.txt", "no\n");
+    write(SUB, "in.txt", "one\ntwo\n");
+    write(SUB, "fresh.txt", "a\nb\nc\n");
+  });
+
+  it("lists only its own changes, lane-relative, with hunks", async () => {
+    const out = await collectChanges(SUB, { range: "work", full: true });
+    assert.deepEqual(
+      out.files.map((f) => f.path),
+      ["fresh.txt", "in.txt"]
+    );
+    const tracked = out.files.find((f) => f.path === "in.txt");
+    assert.equal(tracked.added, 1);
+    assert.equal(tracked.hunks.length, 1);
+    const fresh = out.files.find((f) => f.path === "fresh.txt");
+    assert.equal(fresh.added, 3);
+    assert.equal(fresh.hunks[0].lines.length, 3);
+  });
+
+  it("branch and commit ranges are lane-relative and lane-scoped too", async () => {
+    g(LANE, "checkout", "-qb", "feat");
+    g(LANE, "add", "-A");
+    g(LANE, "commit", "-qm", "both");
+    const branch = await collectChanges(SUB, { range: "branch", base: "main", full: true });
+    assert.deepEqual(
+      branch.files.map((f) => f.path),
+      ["fresh.txt", "in.txt"]
+    );
+    assert.equal(branch.files.find((f) => f.path === "in.txt").added, 1);
+    const commit = await collectChanges(SUB, { range: "commit", sha: "HEAD", file: "in.txt" });
+    assert.equal(commit.files[0].hunks.length, 1);
+  });
+
+  it("stage, unstage and discard work on lane-relative paths", async () => {
+    await runGitAction(SUB, "stage", { paths: ["in.txt", "fresh.txt"] });
+    assert.equal(g(LANE, "diff", "--cached", "--name-only"), "pkg/fresh.txt\npkg/in.txt\n");
+    await runGitAction(SUB, "unstage", { paths: ["in.txt"] });
+    assert.equal(g(LANE, "diff", "--cached", "--name-only"), "pkg/fresh.txt\n");
+    await runGitAction(SUB, "discard", { paths: ["in.txt"], confirm: true });
+    assert.equal(fs.readFileSync(path.join(SUB, "in.txt"), "utf8"), "one\n");
+  });
+
+  it("cannot name a change outside its cwd", async () => {
+    for (const p of ["../a.txt", "a.txt", "../outside-new.txt"]) {
+      await assert.rejects(
+        runGitAction(SUB, "discard", { paths: [p], confirm: true }),
+        { code: "EBADPATH" },
+        p
+      );
+    }
+    assert.equal(fs.existsSync(path.join(LANE, "outside-new.txt")), true);
+  });
+
+  it("gitFacts (the lane card) counts and lists only the lane's own files, cwd-relative", async () => {
+    write(SUB, "mới tên.txt", "x\n");
+    const facts = await gitFacts(SUB);
+    const paths = facts.files.map((f) => f.path).sort();
+    assert.deepEqual(paths, ["fresh.txt", "in.txt", "mới tên.txt"]);
+    assert.equal(facts.dirty, 1);
+    assert.equal(facts.untracked, 2);
+    assert.equal(facts.files.find((f) => f.path === "in.txt").added, 1);
+  });
+
+  it("commit sweeps in only the lane's own files", async () => {
+    await runGitAction(SUB, "commit", { message: "lane only" });
+    assert.equal(
+      g(LANE, "show", "--name-only", "--format=", "HEAD"),
+      "pkg/fresh.txt\npkg/in.txt\n"
+    );
+    assert.match(g(LANE, "status", "--porcelain"), /a\.txt/);
+  });
+
+  it("refuses to commit while something OUTSIDE the lane is staged, and leaves it staged", async () => {
+    const before = g(LANE, "rev-parse", "HEAD");
+    g(LANE, "add", "a.txt");
+    for (const only of [undefined, "staged"]) {
+      g(SUB, "add", "in.txt");
+      await assert.rejects(runGitAction(SUB, "commit", { message: "lane only", only }), {
+        code: "ESTAGEDOUTSIDE",
+      });
+    }
+    assert.match(g(LANE, "diff", "--cached", "--name-only"), /^a\.txt$/m);
+    assert.equal(g(LANE, "rev-parse", "HEAD"), before);
+  });
+});
+
+describe("reads larger than the git() buffer report truncated, not missing", () => {
+  const BIG = `${"x".repeat(99)}\n`.repeat(100_000); // 10 MB
+
+  it("readFileAt at a rev", async () => {
+    write(LANE, "big.txt", BIG);
+    g(LANE, "add", "-A");
+    g(LANE, "commit", "-qm", "big");
+    const out = await readFileAt(LANE, "big.txt", "HEAD");
+    assert.equal(out.truncated, true);
+    assert.ok(out.lines.length > 1000);
+  });
+
+  it("a single-file diff", async () => {
+    write(LANE, "big.txt", "seed\n");
+    g(LANE, "add", "-A");
+    g(LANE, "commit", "-qm", "seed");
+    write(LANE, "big.txt", BIG);
+    const out = await collectChanges(LANE, { range: "work", file: "big.txt" });
+    assert.equal(out.files[0].truncated, true);
+    assert.ok(out.files[0].hunks[0].lines.length > 100);
+  });
+});
+
+describe("loop 2: secret file at any depth, symlinked .claude", () => {
+  const KEY = '{"env":{"ANTHROPIC_API_KEY":"sk-deep"}}';
+
+  it("a root lane cannot read a subdir lane's settings.local.json (work, rev, hunks)", async () => {
+    write(LANE, "sub/.claude/settings.local.json", KEY);
+    for (const p of ["sub/.claude/settings.local.json", "SUB/.Claude/Settings.Local.json"]) {
+      await assert.rejects(readFileAt(LANE, p, "work"), { code: "ESECRET" }, p);
+    }
+    const untracked = await collectChanges(LANE, { range: "work", full: true });
+    assert.equal(JSON.stringify(untracked).includes("sk-deep"), false);
+    g(LANE, "add", "-f", "sub/.claude/settings.local.json");
+    g(LANE, "commit", "-qm", "oops");
+    await assert.rejects(readFileAt(LANE, "sub/.claude/settings.local.json", "HEAD"), {
+      code: "ESECRET",
+    });
+    write(LANE, "sub/.claude/settings.local.json", KEY.replace("deep", "deep2"));
+    const tracked = await collectChanges(LANE, { range: "work", full: true });
+    assert.equal(JSON.stringify(tracked).includes("sk-deep"), false);
+    const commit = await collectChanges(LANE, { range: "commit", sha: "HEAD", full: true });
+    assert.equal(JSON.stringify(commit).includes("sk-deep"), false);
+  });
+
+  it("a symlinked .claude does not expose the key under its target's name", async () => {
+    write(LANE, "conf/settings.local.json", KEY);
+    fs.symlinkSync("conf", path.join(LANE, ".claude"));
+    await assert.rejects(readFileAt(LANE, "conf/settings.local.json", "work"), {
+      code: "ESECRET",
+    });
+    const untracked = await collectChanges(LANE, { range: "work", full: true });
+    assert.equal(JSON.stringify(untracked).includes("sk-deep"), false);
+    g(LANE, "add", "conf/settings.local.json");
+    g(LANE, "commit", "-qm", "conf");
+    await assert.rejects(readFileAt(LANE, "conf/settings.local.json", "HEAD"), {
+      code: "ESECRET",
+    });
+    write(LANE, "conf/settings.local.json", KEY.replace("deep", "deep2"));
+    const tracked = await collectChanges(LANE, { range: "work", full: true });
+    assert.equal(JSON.stringify(tracked).includes("sk-deep"), false);
+  });
+});
+
+describe("loop 2: subdir lane boundaries", () => {
+  let SUB;
+  beforeEach(() => {
+    write(LANE, "pkg/in.txt", "one\n");
+    g(LANE, "add", "-A");
+    g(LANE, "commit", "-qm", "pkg");
+    SUB = path.join(LANE, "pkg");
+  });
+
+  it("listCommits refuses a ?file= outside the lane", async () => {
+    const { listCommits } = require("../lib/git-diff");
+    for (const p of ["../a.txt", "/etc/passwd"]) {
+      await assert.rejects(listCommits(SUB, { file: p }), { code: "EBADPATH" }, p);
+    }
+    assert.equal((await listCommits(SUB, { file: "in.txt" })).length, 1);
+  });
+
+  it("commit (all) in a clean subdir lane of a dirty repo is ENOCHANGES", async () => {
+    write(LANE, "a.txt", "dirty outside\n");
+    await assert.rejects(runGitAction(SUB, "commit", { message: "x" }), { code: "ENOCHANGES" });
+  });
+});
+
+describe("loop 2: readFileAt rev=work reads at most the cap", () => {
+  it("never loads a whole huge file, still reports truncated", async () => {
+    write(LANE, "huge.txt", `${"y".repeat(99)}\n`.repeat(30_000)); // 3 MB
+    const orig = fs.promises.readFile;
+    fs.promises.readFile = async () => {
+      throw new Error("whole-file read");
+    };
+    try {
+      const out = await readFileAt(LANE, "huge.txt", "work");
+      assert.equal(out.truncated, true);
+      assert.ok(out.lines.length > 1000);
+      assert.ok(out.lines.join("\n").length <= 1_000_000);
+    } finally {
+      fs.promises.readFile = orig;
+    }
+    const small = await readFileAt(LANE, "a.txt", "work");
+    assert.deepEqual(small.lines, ["one", "two"]);
+    assert.equal(small.truncated, false);
+  });
+});
+
+describe("loop 2: push picks the right remote", () => {
+  const bare = (name) => {
+    const dir = path.join(ROOT, `${name}.git`);
+    g(ROOT, "init", "-q", "--bare", dir);
+    return dir;
+  };
+  const head = () => g(LANE, "rev-parse", "HEAD").trim();
+
+  it("pushes to the sole remote even when it is not origin", async () => {
+    const dir = bare("only");
+    g(LANE, "remote", "add", "backup", dir);
+    await runGitAction(LANE, "push");
+    assert.equal(g(dir, "rev-parse", "main").trim(), head());
+  });
+
+  it("pushes to the branch's upstream remote over origin", async () => {
+    const o = bare("o");
+    const u = bare("u");
+    g(LANE, "remote", "add", "origin", o);
+    g(LANE, "remote", "add", "fork", u);
+    g(LANE, "push", "-q", "-u", "fork", "HEAD");
+    write(LANE, "a.txt", "new\n");
+    g(LANE, "commit", "-qam", "next");
+    await runGitAction(LANE, "push");
+    assert.equal(g(u, "rev-parse", "main").trim(), head());
+    assert.throws(() => g(o, "rev-parse", "--verify", "-q", "main"));
+  });
+
+  it("falls back to origin among several remotes", async () => {
+    const o = bare("o");
+    g(LANE, "remote", "add", "fork", bare("f"));
+    g(LANE, "remote", "add", "origin", o);
+    await runGitAction(LANE, "push");
+    assert.equal(g(o, "rev-parse", "main").trim(), head());
+  });
+
+  it("ENOREMOTE with no remote, or several and no origin", async () => {
+    await assert.rejects(runGitAction(LANE, "push"), { code: "ENOREMOTE" });
+    g(LANE, "remote", "add", "a", bare("a"));
+    g(LANE, "remote", "add", "b", bare("b"));
+    await assert.rejects(runGitAction(LANE, "push"), { code: "ENOREMOTE" });
+  });
+});
+
+describe("loop 2: a claude and a codex lane on one cwd share one git-write lock", () => {
+  it("concurrent writes from both lanes never collide on index.lock", async () => {
+    process.env.DASHBOARD_DB_PATH = path.join(ROOT, "api2.db");
+    process.env.DASHBOARD_REMOTE_SYNC_MS = "0";
+    process.env.DASHBOARD_LIVENESS_PROBE = "0";
+    const { createApp, startServer } = require("../index");
+    const server = await startServer(createApp(), 0);
+    const base = `http://127.0.0.1:${server.address().port}`;
+    const post = (url, body) =>
+      fetch(`${base}${url}`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });
+    try {
+      const ids = [];
+      for (const tool of ["claude", "codex"]) {
+        const r = await post("/api/lanes/ensure", { cwd: LANE, tool, title: tool }).then((x) =>
+          x.json()
+        );
+        ids.push(r.lane.id);
+      }
+      assert.notEqual(ids[0], ids[1]);
+      // A clean filter runs while `git add` HOLDS index.lock, so a write
+      // from the sibling lane in that window fails unless serialized.
+      g(LANE, "config", "filter.slow.clean", "sleep 1; cat");
+      write(LANE, ".gitattributes", "slow.txt filter=slow\n");
+      write(LANE, "slow.txt", "s\n");
+      write(LANE, "b.txt", "new\n");
+      const slow = post(`/api/lanes/${ids[0]}/git/stage`, { paths: ["slow.txt"] });
+      await new Promise((r) => setTimeout(r, 400));
+      const other = await post(`/api/lanes/${ids[1]}/git/stage`, { paths: ["b.txt"] });
+      const first = await slow;
+      assert.equal(first.status, 200, await first.text());
+      assert.equal(other.status, 200, await other.text());
+    } finally {
+      server.close();
+    }
+  });
+});
+
+describe("loop 3: a subdirectory lane's key behind its own symlinked .claude", () => {
+  it("is refused to a root lane by its target name, on disk and at a committed rev", async () => {
+    write(LANE, "sub/conf/settings.local.json", '{"env":{"ANTHROPIC_AUTH_TOKEN":"sk-SUB"}}');
+    fs.symlinkSync("conf", path.join(LANE, "sub/.claude"));
+    await assert.rejects(readFileAt(LANE, "sub/conf/settings.local.json", "work"), {
+      code: "ESECRET",
+    });
+    g(LANE, "add", "-f", "sub/conf/settings.local.json");
+    g(LANE, "commit", "-qm", "oops");
+    fs.rmSync(path.join(LANE, "sub"), { recursive: true });
+    await assert.rejects(readFileAt(LANE, "sub/conf/settings.local.json", "HEAD"), {
+      code: "ESECRET",
+    });
+  });
+});
+
+describe("loop 3: a staged rename INTO a subdirectory lane", () => {
+  it("is refused by ESTAGEDOUTSIDE, since it also deletes the old path outside the lane", async () => {
+    write(LANE, "shared/x.js", "export const x = 1;\n");
+    write(LANE, "pkg/keep.txt", "k\n");
+    g(LANE, "add", "-A");
+    g(LANE, "commit", "-qm", "base");
+    g(LANE, "mv", "shared/x.js", "pkg/x.js");
+    await assert.rejects(
+      runGitAction(path.join(LANE, "pkg"), "commit", { message: "move", only: "staged" }),
+      { code: "ESTAGEDOUTSIDE" }
+    );
+  });
+});
+
+describe("one numstat parser for the Changes panel and the lane card", () => {
+  it("keys a rename by its new path and a binary file with null counts", () => {
+    // Real `git diff --numstat -z` shapes: a rename is "a\td\t\0old\0new\0",
+    // a binary file is "-\t-\tpath\0". `git show --format=` adds a leading \n.
+    const stats = parseNumstat("\n1\t2\t\0old name.txt\0new name.txt\0-\t-\tlogo.png\0");
+    assert.deepEqual([...stats.keys()], ["new name.txt", "logo.png"]);
+    assert.deepEqual(stats.get("new name.txt"), { added: 1, deleted: 2, binary: false });
+    assert.deepEqual(stats.get("logo.png"), { added: null, deleted: null, binary: true });
+  });
+
+  it("gitFacts lists a staged rename and a binary file with the same counts, no extra field", async () => {
+    g(LANE, "mv", "old name.txt", "new name.txt");
+    write(LANE, "new name.txt", "keep me\nplease\nmore\n");
+    fs.writeFileSync(path.join(LANE, "logo.png"), Buffer.from([0, 1, 2, 0, 255]));
+    g(LANE, "add", "-A");
+    const { files } = await gitFacts(LANE);
+    const byPath = Object.fromEntries(files.map((f) => [f.path, f]));
+    assert.deepEqual(byPath["new name.txt"], {
+      path: "new name.txt",
+      status: "R ",
+      added: 1,
+      deleted: 0,
+    });
+    assert.deepEqual(byPath["logo.png"], {
+      path: "logo.png",
+      status: "A ",
+      added: null,
+      deleted: null,
+    });
+  });
+});

server/__tests__/git-diff-ops.test.js

@@ -19,6 +19,7 @@ const {
   listCommits,
   listPaths,
   listTree,
+  listTreeAll,
   parseUnifiedDiff,
   readFileAt,
 } = require("../lib/git-diff");
@@ -456,6 +457,49 @@ describe("listCommits / readFileAt / listPaths / listTree", () => {
     );
     await assert.rejects(() => listTree(LANE, { subdir: "../.." }), { code: "EBADPATH" });
   });
+
+  it("lists untracked-but-not-ignored files and marks what changed, folders included", async () => {
+    write(LANE, "src/main.ts", "m\n");
+    write(LANE, ".gitignore", "*.log\n");
+    gc(LANE, "add", "-A");
+    gc(LANE, "commit", "-qm", "src");
+    write(LANE, "a.txt", "modified\n");
+    write(LANE, "new.txt", "fresh\n");
+    write(LANE, "gen/deep/out.txt", "wholly untracked folder\n");
+    write(LANE, "noise.log", "ignored\n");
+
+    const root = await listTree(LANE, {});
+    const by = Object.fromEntries(root.entries.map((e) => [e.name, e]));
+    assert.equal(by["a.txt"].status, " M");
+    assert.equal(by["new.txt"].status, "??");
+    assert.equal(by["keep.txt"].status, undefined);
+    assert.equal(by["noise.log"], undefined, "an ignored file stays out of the tree");
+    assert.equal(by.gen.changed, true);
+    assert.equal(by.src.changed, undefined);
+
+    // Inside a folder git reports only as "gen/": still untracked, still marked.
+    const deep = await listTree(LANE, { subdir: "gen/deep" });
+    assert.equal(deep.entries[0].status, "??");
+    const all = await listTreeAll(LANE);
+    assert.equal(all.levels["gen"][0].changed, true);
+    assert.deepEqual(all.levels[""], root.entries);
+  });
+
+  it("reads every level of the tree in one pass, grouped like listTree", async () => {
+    write(LANE, "src/api/x.ts", "x\n");
+    write(LANE, "src/main.ts", "m\n");
+    gc(LANE, "add", "-A");
+    gc(LANE, "commit", "-qm", "src");
+
+    const all = await listTreeAll(LANE);
+    assert.equal(all.truncated, false);
+    // Each level equals what the one-level read returns for it.
+    for (const level of ["", "src", "src/api"]) {
+      const one = await listTree(LANE, { subdir: level });
+      assert.deepEqual(all.levels[level], one.entries, level);
+    }
+    assert.deepEqual(Object.keys(all.levels).sort(), ["", "src", "src/api"]);
+  });
 });
 
 describe("runGitAction — per-file staging, discard and branches", () => {
@@ -552,3 +596,67 @@ describe("runGitAction — per-file staging, discard and branches", () => {
     });
   });
 });
+
+describe("runGitAction — one hunk at a time", () => {
+  beforeEach(freshFixture);
+
+  /** A 20-line file edited at both ends: two hunks at the default context. */
+  function twoHunks() {
+    const lines = Array.from({ length: 20 }, (_, i) => `line ${i + 1}`);
+    write(LANE, "big.txt", lines.join("\n") + "\n");
+    gc(LANE, "add", "big.txt");
+    gc(LANE, "commit", "-qm", "big");
+    lines[0] = "FIRST";
+    lines[19] = "LAST";
+    write(LANE, "big.txt", lines.join("\n") + "\n");
+  }
+  const headers = async () =>
+    (await collectChanges(LANE, { range: "work", file: "big.txt" })).files[0].hunks.map(
+      (h) => h.header
+    );
+
+  it("stages ONE hunk, leaving the other in the working tree", async () => {
+    twoHunks();
+    const [first] = await headers();
+    await runGitAction(LANE, "stage-hunk", { path: "big.txt", hunk: first });
+    const staged = g(LANE, "diff", "--cached", "--", "big.txt");
+    const unstaged = g(LANE, "diff", "--", "big.txt");
+    assert.match(staged, /\+FIRST/);
+    assert.doesNotMatch(staged, /LAST/);
+    assert.match(unstaged, /\+LAST/);
+    assert.doesNotMatch(unstaged, /FIRST/);
+  });
+
+  it("undoes ONE hunk in the working tree, only with confirm", async () => {
+    twoHunks();
+    const [, second] = await headers();
+    await assert.rejects(
+      () => runGitAction(LANE, "discard-hunk", { path: "big.txt", hunk: second }),
+      { code: "ECONFIRM" }
+    );
+    await runGitAction(LANE, "discard-hunk", { path: "big.txt", hunk: second, confirm: true });
+    const text = fs.readFileSync(path.join(LANE, "big.txt"), "utf8");
+    assert.match(text, /^FIRST\n/);
+    assert.match(text, /line 20\n$/);
+  });
+
+  it("refuses a hunk that is no longer in the diff, and a path that is not changed", async () => {
+    twoHunks();
+    await assert.rejects(
+      () => runGitAction(LANE, "stage-hunk", { path: "big.txt", hunk: "@@ -1,9 +1,9 @@" }),
+      { code: "EHUNKGONE" }
+    );
+    await assert.rejects(
+      () => runGitAction(LANE, "stage-hunk", { path: "keep.txt", hunk: "@@ -1 +1 @@" }),
+      { code: "EBADPATH" }
+    );
+  });
+
+  it("sends an untracked file to the per-file actions", async () => {
+    write(LANE, "new.txt", "x\n");
+    await assert.rejects(
+      () => runGitAction(LANE, "stage-hunk", { path: "new.txt", hunk: "@@ -0,0 +1,1 @@" }),
+      { code: "EUNTRACKED" }
+    );
+  });
+});

server/__tests__/lane-lifecycle.test.js

@@ -848,17 +848,12 @@ describe("destructive lane lifecycle actions", () => {
     const runId = started.body.lane.run_id;
 
     // Mock tmux so has-session always returns 0 (session exists), simulating a stuck session
-    tmux.__setExecImpl(async (cmd, args) => {
-      if (cmd === "tmux" && args[0] === "has-session" && args[1] === "-t" && args[2] === runId) {
-        return { code: 0, stdout: "", stderr: "" };
-      }
-      if (cmd === "tmux" && args[0] === "list-sessions") {
-        return { code: 0, stdout: "", stderr: "" };
-      }
-      if (cmd === "tmux" && args[0] === "kill-session" && args[1] === "-t" && args[2] === runId) {
-        return { code: 0, stdout: "", stderr: "" };
-      }
-      return { code: 1, stdout: "", stderr: "" };
+    // Same shape as tmux.js's own exec: sync, argv only, throws on failure.
+    tmux.__setExecImpl((args) => {
+      if (args[0] === "has-session" && args[2] === runId) return "";
+      if (args[0] === "list-sessions") return `${runId}\n`;
+      if (args[0] === "kill-session" && args[2] === runId) return "";
+      throw Object.assign(new Error("mocked tmux failure"), { status: 1 });
     });
 
     try {

server/__tests__/lanes-api.test.js

@@ -959,6 +959,47 @@ describe("the lane git surface: changes, branches, actions (issue #34)", () => {
     assert.ok(tree.body.entries.some((e) => e.name === "a.txt" && e.dir === false));
   });
 
+  it("saves a file from the editor over the exact bytes it loaded, and nothing else", async () => {
+    const opened = await request("GET", `/api/lanes/${laneId}/git/file?path=a.txt&rev=work`);
+    assert.equal(typeof opened.body.sha, "string");
+
+    const saved = await request("PUT", `/api/lanes/${laneId}/git/file`, {
+      path: "a.txt",
+      content: "one\nTWO\nthree",
+      baseSha: opened.body.sha,
+    });
+    assert.equal(saved.status, 200, JSON.stringify(saved.body));
+    // The final newline the file had survives an editor that drops it.
+    assert.equal(fs.readFileSync(path.join(dir, "a.txt"), "utf8"), "one\nTWO\nthree\n");
+    assert.notEqual(saved.body.sha, opened.body.sha);
+
+    // Saving over the OLD stamp is a conflict, never a silent overwrite.
+    const stale = await request("PUT", `/api/lanes/${laneId}/git/file`, {
+      path: "a.txt",
+      content: "clobbered",
+      baseSha: opened.body.sha,
+    });
+    assert.equal(stale.status, 409);
+    assert.equal(stale.body.error.code, "ESTALE");
+    assert.equal(fs.readFileSync(path.join(dir, "a.txt"), "utf8"), "one\nTWO\nthree\n");
+
+    const escape = await request("PUT", `/api/lanes/${laneId}/git/file`, {
+      path: "../../etc/passwd",
+      content: "x",
+      baseSha: "0".repeat(40),
+    });
+    assert.equal(escape.status, 400);
+    assert.equal(escape.body.error.code, "EBADPATH");
+
+    const secret = await request("PUT", `/api/lanes/${laneId}/git/file`, {
+      path: ".claude/settings.local.json",
+      content: "{}",
+      baseSha: "0".repeat(40),
+    });
+    assert.equal(secret.status, 403);
+    assert.equal(secret.body.error.code, "ESECRET");
+  });
+
   it("stages one file, commits only the index, and refuses an unchanged path", async () => {
     fs.writeFileSync(path.join(dir, "a.txt"), "one\nTHREE\n");
     fs.writeFileSync(path.join(dir, "b.txt"), "left behind\n");
@@ -1022,6 +1063,22 @@ describe("the lane git surface: changes, branches, actions (issue #34)", () => {
     assert.equal(g(dir, "branch", "--list", "feat/sibling").trim(), "");
   });
 
+  it("maps a git exit status to 409 EGIT with git's stderr in the message", async () => {
+    // A remote that is not a repository: `git push` exits 128, and execFile
+    // reports that as a NUMERIC err.code. It must never reach the client as
+    // `code: 128`, nor as a 500 — git refusing is not a server fault.
+    g(dir, "remote", "add", "origin", path.join(ROOT, "no-such-remote"));
+    try {
+      const r = await request("POST", `/api/lanes/${laneId}/git/push`, {});
+      assert.equal(r.status, 409, JSON.stringify(r.body));
+      assert.equal(r.body.error.code, "EGIT");
+      assert.match(r.body.error.message, /^git push failed\n/);
+      assert.match(r.body.error.message, /no-such-remote/);
+    } finally {
+      g(dir, "remote", "remove", "origin");
+    }
+  });
+
   it("404s every git route for a lane that does not exist", async () => {
     for (const url of [
       "/api/lanes/999999/git/changes",

server/__tests__/pricing-calc.test.js

@@ -324,3 +324,42 @@ describe("calculateCost — date-effective (intro) pricing", () => {
     );
   });
 });
+
+describe("DEFAULT_PRICING — Opus 5.5", () => {
+  it("prices claude-opus-5-5 at its own rates, not Opus 5's", () => {
+    const os = require("os");
+    const path = require("path");
+    process.env.DASHBOARD_DB_PATH = path.join(
+      os.tmpdir(),
+      `pricing-opus55-${Date.now()}-${process.pid}.db`
+    );
+    const { DEFAULT_PRICING } = require("../db");
+    const rules = DEFAULT_PRICING.map(([p, n, i, o, cr, cw, cw1h, fi, fo]) => ({
+      model_pattern: p,
+      display_name: n,
+      input_per_mtok: i,
+      output_per_mtok: o,
+      cache_read_per_mtok: cr,
+      cache_write_per_mtok: cw,
+      cache_write_1h_per_mtok: cw1h,
+      fast_input_per_mtok: fi,
+      fast_output_per_mtok: fo,
+    }));
+    // A real session: Claude Code's /cost reported $2.72 for exactly these
+    // counts (all cache writes at the 1h tier); Opus 5's rates gave $4.86.
+    const r = calculateCost(
+      [
+        bucket({
+          model: "claude-opus-5-5",
+          input_tokens: 102,
+          output_tokens: 25_408,
+          cache_read_tokens: 5_866_977,
+          cache_write_tokens: 129_432,
+          cache_write_1h_tokens: 129_432,
+        }),
+      ],
+      rules
+    );
+    assert.equal(r.total_cost.toFixed(2), "2.72");
+  });
+});

server/__tests__/pricing-sync.test.js

@@ -0,0 +1,100 @@
+/**
+ * @file Tests for the automatic pricing sync: a model seen in token_usage with
+ * no row of its own gets one from the price list, an edited row is never
+ * overwritten, and a bad list or a failed fetch changes nothing.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, beforeEach } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("path");
+const os = require("os");
+
+process.env.DASHBOARD_DB_PATH = path.join(
+  os.tmpdir(),
+  `pricing-sync-${Date.now()}-${process.pid}.db`
+);
+const { db } = require("../db");
+const { syncPricing, familyOf, displayName, _resetCache } = require("../lib/pricing-sync");
+
+// The real LiteLLM entry for Opus 5.5, trimmed.
+const LIST = {
+  "claude-opus-9-9": {
+    litellm_provider: "anthropic",
+    input_cost_per_token: 0.000004,
+    output_cost_per_token: 0.00002,
+    cache_read_input_token_cost: 2e-7,
+    cache_creation_input_token_cost: 0.000005,
+    cache_creation_input_token_cost_above_1hr: 0.000008,
+    supports_fast_mode: true,
+    provider_specific_entry: { fast: 2 },
+  },
+};
+
+function useModel(model) {
+  db.prepare("INSERT OR IGNORE INTO sessions (id, status, started_at) VALUES (?, 'active', ?)").run(
+    `s-${model}`,
+    new Date().toISOString()
+  );
+  db.prepare("INSERT INTO token_usage (session_id, model) VALUES (?, ?)").run(`s-${model}`, model);
+}
+const row = (p) => db.prepare("SELECT * FROM model_pricing WHERE model_pattern = ?").get(p);
+
+beforeEach(() => {
+  _resetCache();
+  db.prepare("DELETE FROM token_usage").run();
+  db.prepare("DELETE FROM model_pricing WHERE model_pattern LIKE 'claude-opus-9%'").run();
+});
+
+describe("pricing sync", () => {
+  it("reduces an id to its family and names it", () => {
+    assert.equal(familyOf("claude-opus-5-5-20260101"), "claude-opus-5-5");
+    assert.equal(familyOf("gpt-4"), null);
+    assert.equal(familyOf("claude-x%"), null);
+    assert.equal(displayName("claude-opus-5-5"), "Claude Opus 5.5");
+  });
+
+  it("adds a row for a used model that only a broader pattern matched", async () => {
+    db.prepare(
+      "INSERT INTO model_pricing (model_pattern, display_name, input_per_mtok) VALUES ('claude-opus-9%', 'Broad', 5)"
+    ).run();
+    useModel("claude-opus-9-9-20260101");
+    const added = await syncPricing(db, { fetchList: async () => LIST });
+    assert.deepEqual(added, ["claude-opus-9-9%"]);
+    const r = row("claude-opus-9-9%");
+    assert.equal(r.display_name, "Claude Opus 9.9");
+    assert.deepEqual([r.input_per_mtok, r.output_per_mtok, r.cache_read_per_mtok], [4, 20, 0.2]);
+    assert.deepEqual([r.cache_write_per_mtok, r.cache_write_1h_per_mtok], [5, 8]);
+    assert.deepEqual([r.fast_input_per_mtok, r.fast_output_per_mtok], [8, 40]);
+  });
+
+  it("never overwrites a row that exists, and fetches nothing when none is missing", async () => {
+    db.prepare(
+      "INSERT INTO model_pricing (model_pattern, display_name, input_per_mtok) VALUES ('claude-opus-9-9%', 'Mine', 1)"
+    ).run();
+    useModel("claude-opus-9-9");
+    let fetched = false;
+    await syncPricing(db, {
+      fetchList: async () => {
+        fetched = true;
+        return LIST;
+      },
+    });
+    assert.equal(fetched, false);
+    assert.equal(row("claude-opus-9-9%").input_per_mtok, 1);
+  });
+
+  it("skips absurd rates and survives a failed fetch", async () => {
+    useModel("claude-opus-9-9");
+    const bad = { "claude-opus-9-9": { ...LIST["claude-opus-9-9"], input_cost_per_token: 5 } };
+    assert.deepEqual(await syncPricing(db, { fetchList: async () => bad }), []);
+    _resetCache();
+    const failed = await syncPricing(db, {
+      fetchList: async () => {
+        throw new Error("offline");
+      },
+    });
+    assert.deepEqual(failed, []);
+    assert.equal(row("claude-opus-9-9%"), undefined);
+  });
+});

server/__tests__/pty-attach.test.js

@@ -55,6 +55,8 @@ describe("pty-attach", () => {
 
   it("accepts a well-formed runId", () => {
     assert.doesNotThrow(() => ptyAttach.validateRunId("agenthub-lane-42"));
+    assert.doesNotThrow(() => ptyAttach.validateRunId("agenthub-lane-42-3"));
+    assert.throws(() => ptyAttach.validateRunId("agenthub-lane-42-4"), /EBADRUNID/);
   });
 
   it("turns tmux mouse mode on for the session it attaches to", () => {

server/__tests__/pty-run.test.js

@@ -58,6 +58,26 @@ describe("pty-run", () => {
     assert.ok(newSessionCall.includes("opus"));
   });
 
+  it("spawnRun names a split pane's session agenthub-lane-<id>-<slot>, and refuses a slot past 3", () => {
+    tmux.__setExecImpl((args) => {
+      if (args[0] === "has-session") {
+        const e = new Error("no such session");
+        e.status = 1;
+        throw e;
+      }
+      return "";
+    });
+    const handle = pty.spawnRun({ laneId: 42, slot: 2, cwd: "/tmp/repo" });
+    assert.equal(handle.id, "agenthub-lane-42-2");
+    assert.equal(handle.laneId, 42);
+    assert.equal(handle.slot, 2);
+    assert.equal(pty.laneIdFromRunId("agenthub-lane-42-2"), 42);
+    assert.throws(
+      () => pty.spawnRun({ laneId: 42, slot: 4, cwd: "/tmp/repo" }),
+      (err) => err.code === "EBADSLOT"
+    );
+  });
+
   it("spawnRun refuses with ETMUXMISSING, naming the fix, when tmux is not installed", () => {
     // Before this guard the ENOENT escaped from three calls down as
     // `spawnSync tmux ENOENT` and the route answered 400 — blaming the request

server/__tests__/repo-links.test.js

@@ -79,7 +79,9 @@ const RULES = [
     // a Gitea /raw/branch/<ref>/ URL instead.
     re: /raw\.githubusercontent\.com\/[\w-]+\/[\w.-]+/g,
     fix: "use a same-origin path, or a Gitea /raw/branch/<ref>/ URL",
-    skip: [],
+    // A third-party project that really is on GitHub: the public model price
+    // list server/lib/pricing-sync.js reads.
+    skip: [/raw\.githubusercontent\.com\/BerriAI\/litellm$/],
   },
   {
     name: "GitHub Pages host for a Smartgift site",

server/__tests__/run.test.js

@@ -26,7 +26,11 @@ function fetchJson(p, opts = {}) {
     const url = new URL(p, BASE);
     const headers = { ...(opts.headers || {}) };
     let body;
-    if (opts.body !== undefined) {
+    if (opts.raw) {
+      body = opts.raw.buf;
+      headers["Content-Type"] = opts.raw.type;
+      headers["Content-Length"] = body.length;
+    } else if (opts.body !== undefined) {
       body = Buffer.from(JSON.stringify(opts.body));
       headers["Content-Type"] = "application/json";
       headers["Content-Length"] = body.length;
@@ -203,3 +207,45 @@ describe("/api/run", () => {
     assert.equal(res.status, 400);
   });
 });
+
+describe("POST /api/run/drop-image", () => {
+  let srv;
+  before(async () => {
+    srv = http.createServer(createApp());
+    await new Promise((r) => srv.listen(0, r));
+    BASE = `http://127.0.0.1:${srv.address().port}`;
+  });
+  after(() => new Promise((r) => srv.close(r)));
+
+  const PNG = Buffer.from("89504e470d0a1a0a0000", "hex");
+
+  it("saves the image under a random name, owner-only, and returns its path", async () => {
+    const r = await fetchJson("/api/run/drop-image", {
+      method: "POST",
+      raw: { type: "image/png", buf: PNG },
+    });
+    assert.equal(r.status, 200);
+    assert.match(path.basename(r.body.path), /^[0-9a-f]{16}\.png$/);
+    assert.ok(r.body.path.startsWith(os.tmpdir()));
+    assert.deepEqual(fs.readFileSync(r.body.path), PNG);
+    assert.equal(fs.statSync(r.body.path).mode & 0o777, 0o600);
+    fs.unlinkSync(r.body.path);
+  });
+
+  it("refuses anything that is not one of the image types", async () => {
+    const r = await fetchJson("/api/run/drop-image", {
+      method: "POST",
+      raw: { type: "text/x-shellscript", buf: Buffer.from("rm -rf ~") },
+    });
+    assert.equal(r.status, 400);
+  });
+
+  it("refuses a cross-origin browser request", async () => {
+    const r = await fetchJson("/api/run/drop-image", {
+      method: "POST",
+      headers: { Origin: "https://evil.example" },
+      raw: { type: "image/png", buf: PNG },
+    });
+    assert.equal(r.status, 403);
+  });
+});

server/db.js

@@ -834,6 +834,9 @@ const DEFAULT_PRICING = [
   ["claude-fable-5%", "Claude Fable 5", 10, 50, 1, 12.5, 20, 0, 0],
   ["claude-mythos-5%", "Claude Mythos 5", 10, 50, 1, 12.5, 20, 0, 0],
   // Opus family (fast mode available on 5 / 4.6 / 4.7 / 4.8)
+  // 5.5 is cheaper than 5 and "claude-opus-5%" would swallow it — own row
+  // (longest pattern wins in calculateCost).
+  ["claude-opus-5-5%", "Claude Opus 5.5", 4, 20, 0.2, 5, 8, 8, 40],
   ["claude-opus-5%", "Claude Opus 5", 5, 25, 0.5, 6.25, 10, 10, 50],
   ["claude-opus-4-8%", "Claude Opus 4.8", 5, 25, 0.5, 6.25, 10, 10, 50],
   ["claude-opus-4-7%", "Claude Opus 4.7", 5, 25, 0.5, 6.25, 10, 30, 150],

server/index.js

@@ -325,6 +325,9 @@ function startBackgroundServices() {
   // One-time legacy-session backfill (a no-op once its marker file exists).
   autoImportLegacySessions();
 
+  // Rates for models seen in token_usage with no pricing row of their own.
+  require("./lib/pricing-sync").startPricingSync(require("./db").db);
+
   // A provisioning job belongs to the previous Node process and cannot survive
   // a restart. Recover those rows now so the dashboard never shows a permanent
   // provisioning spinner for work that was interrupted by the restart.

server/lib/git-diff.js

@@ -16,13 +16,40 @@
  * total) because this rides an HTTP response a browser has to render: a lane
  * mid-`npm install` or holding a committed lockfile would otherwise ship
  * megabytes of patch to a React list. A cap that bites sets `truncated`.
+ *
+ * The lane's cwd is the boundary, even when it is a SUBDIRECTORY of its repo:
+ * every path in and out is cwd-relative, status entries outside the cwd are
+ * dropped, and every git call treats a path as a literal file name, never a
+ * pathspec glob (`GIT_LITERAL_PATHSPECS`).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+const crypto = require("node:crypto");
 const fs = require("node:fs");
 const path = require("node:path");
 
-const { git } = require("./worktree");
+const worktree = require("./worktree");
+
+/** Every git call here: argv only, and a path argument is a literal name. */
+const git = (dir, args, opts) => worktree.git(dir, args, { literal: true, ...opts });
+
+/**
+ * A git READ whose output this module caps itself: the buffer is sized past
+ * the cap (x4, a UTF-8 char is at most 4 bytes, plus headroom) so git's own
+ * buffer can never be what fails first, and an overflow comes back as the
+ * partial output — longer than `capChars`, so the caller's cap marks it
+ * truncated — instead of an error read as "missing".
+ */
+async function readCapped(dir, args, capChars) {
+  try {
+    return (await git(dir, args, { maxBuffer: capChars * 4 + 64 * 1024 })).stdout;
+  } catch (err) {
+    if (err.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" && err.git?.stdout) {
+      return String(err.git.stdout);
+    }
+    throw err;
+  }
+}
 
 /** Most files one response names. Beyond this the list is `truncated`. */
 const MAX_FILES = 300;
@@ -36,6 +63,8 @@ const MAX_UNTRACKED_BYTES = 1_000_000;
 const MAX_FILE_VIEW_BYTES = 1_000_000;
 /** Most paths `listPaths`/`listTree` answer with. */
 const MAX_PATHS = 500;
+/** Characters of `ls-files -z` read before the listing counts as truncated. */
+const MAX_LS_CHARS = 16 * 1024 * 1024;
 /** Lines of unchanged context around a hunk, and the ceiling "expand all"
  *  is clamped to — a whole large file rendered as context is the one way this
  *  panel can be made to ship more bytes than the caps above allow. */
@@ -47,6 +76,104 @@ const VALID_RANGES = new Set(["work", "branch", "commit"]);
  *  ref name without the characters that would let it read as an option or a
  *  pathspec. `git` is called with an argv array, so this is belt-and-braces. */
 const SAFE_REV = /^[A-Za-z0-9][A-Za-z0-9._\/-]{0,200}$/;
+/** The file whose CONTENT this module never returns, at any rev and at ANY
+ *  depth: `settings.local.json` is where router-apply.js writes a lane's AI
+ *  Router API key, and key material never leaves the server. Any depth,
+ *  because a lane at the repo root sees a subdirectory lane's key as
+ *  `sub/.claude/settings.local.json`. Lower-cased: a case-insensitive
+ *  filesystem (macOS) opens it under any casing. */
+const SECRET_FILE = ".claude/settings.local.json";
+const SECRET_BASENAME = path.posix.basename(SECRET_FILE);
+
+/** Whether a lane-relative path names a secret file, however it is spelled. */
+function isSecret(rel) {
+  const norm = path.posix
+    .normalize(String(rel).replace(/\\/g, "/"))
+    .replace(/^\.\//, "")
+    .toLowerCase();
+  // By BASENAME, in any directory: a `.claude` symlinked to `conf/` stores the
+  // key as `conf/settings.local.json`, and a lane above that one (or a commit
+  // of that target) never spells it through `.claude/`. A file with this name
+  // is Claude Code's local settings in practice, so nothing legitimate is lost.
+  return norm === SECRET_FILE || path.posix.basename(norm) === SECRET_BASENAME;
+}
+
+/**
+ * Whether `file` in the lane is a secret by what it RESOLVES to, not by how
+ * it is spelled: a symlinked `.claude` (→ `conf/`) makes the key file
+ * `conf/settings.local.json`, which no name check catches. Secret when the
+ * real path, relative to the lane's real root, is one by `isSecret`, or when
+ * it is the very file `<lane>/.claude/settings.local.json` resolves to. A
+ * path that does not exist on disk is judged by its name alone.
+ */
+async function isSecretOnDisk(dir, file) {
+  if (isSecret(file)) return true;
+  let root;
+  let real;
+  try {
+    root = await fs.promises.realpath(dir);
+    real = await fs.promises.realpath(path.resolve(root, file));
+  } catch {
+    return false;
+  }
+  if (isSecret(path.relative(root, real))) return true;
+  try {
+    return real === (await fs.promises.realpath(path.join(root, SECRET_FILE)));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The ONE lexical guard for a caller-supplied path, at every rev: a relative
+ * path with no `..` segment, normalised (`./a//b` → `a/b`) so the secret
+ * check and git both see the lane-relative spelling. Throws EBADPATH.
+ */
+function lanePath(file) {
+  if (typeof file !== "string" || !file || file.includes("\0")) {
+    throw badRequest("EBADPATH", "path must be a relative path inside the lane");
+  }
+  // A backslash is an ordinary file-name byte to git on POSIX, not a separator.
+  if (file.startsWith("/") || file.split("/").includes("..")) {
+    throw badRequest("EBADPATH", "path must be a relative path inside the lane");
+  }
+  const norm = path.posix
+    .normalize(file)
+    .replace(/^(\.\/)+/, "")
+    .replace(/\/+$/, "");
+  if (!norm || norm === ".") throw badRequest("EBADPATH", "path must name a file");
+  return norm;
+}
+
+/**
+ * Resolve `file` inside the lane for a CONTENT read: realpath-confined to the
+ * lane's own realpath, so neither `..` nor a symlink can walk out of it, and
+ * refused when either the requested or the resolved path is a secret file.
+ * Throws EBADPATH / ESECRET / ENOFILE.
+ */
+async function resolveInLane(dir, file) {
+  if (isSecret(file))
+    throw badRequest("ESECRET", "that file holds secrets and is not readable here");
+  const escapes = (base, target) => {
+    const r = path.relative(base, target);
+    return !r || r === ".." || r.startsWith(`..${path.sep}`) || path.isAbsolute(r);
+  };
+  // Lexically first, so `../x` is EBADPATH whether or not x exists.
+  if (escapes(path.resolve(dir), path.resolve(dir, file))) {
+    throw badRequest("EBADPATH", "path escapes the lane directory");
+  }
+  const root = await fs.promises.realpath(dir);
+  let real;
+  try {
+    real = await fs.promises.realpath(path.resolve(root, file));
+  } catch {
+    throw badRequest("ENOFILE", "no such file in the working tree");
+  }
+  if (escapes(root, real)) throw badRequest("EBADPATH", "path escapes the lane directory");
+  if (await isSecretOnDisk(root, file))
+    throw badRequest("ESECRET", "that file holds secrets and is not readable here");
+  return real;
+}
 
 /** Throw a coded error the routes map onto a 400. */
 function badRequest(code, message) {
@@ -131,15 +258,26 @@ async function resolveBaseRef(dir, base) {
   return null;
 }
 
-/** `git diff --numstat` output → Map<path, {added, deleted, binary}>. */
+/**
+ * `git diff --numstat -z` output → Map<path, {added, deleted, binary}>. `-z`
+ * because without it git C-quotes any path with a space, a quote or a
+ * non-ASCII byte (`"t\303\240i.txt"`), which then keys nothing. A rename is
+ * `a\td\t\0old\0new\0`; the path that exists now is the key. Shared with
+ * worktree.js's `laneFiles` (the lane card), so the card and the Changes panel
+ * count a file the same way.
+ */
 function parseNumstat(stdout) {
   const stats = new Map();
-  for (const line of stdout.split("\n")) {
-    const m = line.match(/^(\d+|-)\t(\d+|-)\t(.+)$/);
+  const tokens = stdout.split("\0");
+  for (let i = 0; i < tokens.length; i++) {
+    const m = tokens[i].replace(/^\n/, "").match(/^(\d+|-)\t(\d+|-)\t(.*)$/s);
     if (!m) continue;
-    // A rename reports "old => new" (or "dir/{a => b}/file"); the path that
-    // exists now is what every other source here is keyed by.
-    const file = m[3].includes(" => ") ? renameTarget(m[3]) : m[3];
+    let file = m[3];
+    if (!file) {
+      file = tokens[i + 2];
+      i += 2;
+    }
+    if (!file) continue;
     stats.set(file, {
       added: m[1] === "-" ? null : Number(m[1]),
       deleted: m[2] === "-" ? null : Number(m[2]),
@@ -149,11 +287,48 @@ function parseNumstat(stdout) {
   return stats;
 }
 
-/** `dir/{old => new}/f.js` or `old.js => new.js` → the post-rename path. */
-function renameTarget(spec) {
-  const braced = spec.match(/^(.*)\{(.*) => (.*)\}(.*)$/);
-  if (braced) return `${braced[1]}${braced[3]}${braced[4]}`.replace(/\/\//g, "/");
-  return spec.split(" => ").pop();
+/**
+ * `git status --porcelain=v1 -z` → [{code, path, from}]. Each record is
+ * `XY path\0`; a rename/copy carries its ORIGINAL path as the next record.
+ * Shared with git-ops.js so the paths a write may name are the paths shown.
+ */
+function parsePorcelainZ(stdout) {
+  const entries = [];
+  const tokens = stdout.split("\0");
+  for (let i = 0; i < tokens.length; i++) {
+    const rec = tokens[i];
+    if (rec.length < 4) continue;
+    const code = rec.slice(0, 2);
+    const entry = { code, path: rec.slice(3), from: null };
+    if (code[0] === "R" || code[0] === "C" || code[1] === "R" || code[1] === "C") {
+      entry.from = tokens[++i] || null;
+    }
+    entries.push(entry);
+  }
+  return entries;
+}
+
+/**
+ * `git status` for the LANE: porcelain paths are always repo-ROOT-relative,
+ * while every pathspec and every fs read here resolves from the lane's cwd.
+ * So entries are cut down to the ones inside the cwd and re-spelled relative
+ * to it — a subdirectory lane neither shows nor can name a change outside
+ * itself. A rename whose original path is outside keeps `from: null`.
+ * Shared with git-ops.js so the paths a write may name are the paths shown.
+ */
+async function laneStatus(dir) {
+  const [status, prefix] = await Promise.all([
+    git(dir, ["status", "--porcelain=v1", "-z", "--untracked-files=normal"]),
+    git(dir, ["rev-parse", "--show-prefix"]),
+  ]);
+  const pre = prefix.stdout.trim();
+  const inside = (p) => (p && p.startsWith(pre) ? p.slice(pre.length) || null : null);
+  const entries = [];
+  for (const e of parsePorcelainZ(status.stdout)) {
+    const rel = inside(e.path);
+    if (rel) entries.push({ code: e.code, path: rel, from: inside(e.from) });
+  }
+  return entries;
 }
 
 /**
@@ -165,22 +340,20 @@ const CONFLICT_CODES = new Set(["DD", "AU", "UD", "UA", "DU", "AA", "UU"]);
 
 /** Working-tree summary: porcelain status, plus numstat deltas for tracked files. */
 async function summarizeWork(dir) {
-  const [status, numstat] = await Promise.all([
-    git(dir, ["status", "--porcelain=v1", "--untracked-files=normal"]),
-    git(dir, ["diff", "--numstat", "HEAD"]).catch(() => ({ stdout: "" })),
+  const [entries, numstat] = await Promise.all([
+    laneStatus(dir),
+    // --relative: cwd-scoped, cwd-relative paths, so they key the status ones.
+    git(dir, ["diff", "--numstat", "-z", "--relative", "HEAD"]).catch(() => ({ stdout: "" })),
   ]);
   const stats = parseNumstat(numstat.stdout);
   const files = [];
-  for (const line of status.stdout.split("\n")) {
-    if (!line.trim()) continue;
-    const code = line.slice(0, 2);
-    const raw = line.slice(3).trimEnd();
-    const file = raw.split(" -> ").pop().replace(/^"|"$/g, "");
+  for (const { code, path: file } of entries) {
     const untracked = code === "??";
     const stat = stats.get(file);
     // One read per untracked file, not two: its line count and its
     // binary-ness are the same buffer answered twice.
-    const fresh = untracked ? untrackedFacts(dir, file) : null;
+    // Sequential on purpose: `normal` folds untracked dirs, so this is short.
+    const fresh = untracked ? await untrackedFacts(dir, file) : null;
     files.push({
       path: file,
       status: code,
@@ -208,11 +381,12 @@ async function summarizeWork(dir) {
  * everywhere else in this response. A file over the cap counts as binary so
  * nothing downstream tries to render it.
  */
-function untrackedFacts(dir, file) {
+async function untrackedFacts(dir, file) {
   try {
-    const abs = path.join(dir, file);
-    if (fs.statSync(abs).size > MAX_UNTRACKED_BYTES) return { lines: null, binary: true };
-    const buf = fs.readFileSync(abs);
+    const abs = await resolveInLane(dir, file);
+    if ((await fs.promises.stat(abs)).size > MAX_UNTRACKED_BYTES)
+      return { lines: null, binary: true };
+    const buf = await fs.promises.readFile(abs);
     if (looksBinary(buf)) return { lines: null, binary: true };
     const text = buf.toString("utf8");
     if (!text) return { lines: 0, binary: false };
@@ -220,7 +394,8 @@ function untrackedFacts(dir, file) {
     return { lines, binary: false };
   } catch {
     // A directory entry (git reports untracked DIRS with a trailing slash), a
-    // dangling symlink, a file deleted between the status call and this read.
+    // dangling symlink, a file deleted between the status call and this read,
+    // or one resolveInLane refuses (a secret, a symlink out of the lane).
     return { lines: null, binary: false };
   }
 }
@@ -229,8 +404,8 @@ function untrackedFacts(dir, file) {
 async function summarizeBranch(dir, baseRef) {
   const spec = `${baseRef}...HEAD`;
   const [nameStatus, numstat] = await Promise.all([
-    git(dir, ["diff", "--name-status", spec]),
-    git(dir, ["diff", "--numstat", spec]),
+    git(dir, ["diff", "--name-status", "-z", "--relative", spec]),
+    git(dir, ["diff", "--numstat", "-z", "--relative", spec]),
   ]);
   return parseNameStatus(nameStatus.stdout, parseNumstat(numstat.stdout));
 }
@@ -242,24 +417,26 @@ async function summarizeBranch(dir, baseRef) {
  * a reader scrolling a branch's history.
  */
 async function summarizeCommit(dir, sha) {
-  const base = ["show", "--format=", "-m", "--first-parent", sha];
+  const base = ["show", "--format=", "-m", "--first-parent", "--relative", sha];
   const [nameStatus, numstat] = await Promise.all([
-    git(dir, [...base, "--name-status"]),
-    git(dir, [...base, "--numstat"]),
+    git(dir, [...base, "--name-status", "-z"]),
+    git(dir, [...base, "--numstat", "-z"]),
   ]);
   return parseNameStatus(nameStatus.stdout, parseNumstat(numstat.stdout));
 }
 
-/** Shared `--name-status` reader for the ranges that have no working tree. */
+/** Shared `--name-status -z` reader for the ranges that have no working tree. */
 function parseNameStatus(stdout, stats) {
   const files = [];
   const seen = new Set();
-  for (const line of stdout.split("\n")) {
-    if (!line.trim()) continue;
-    const parts = line.split("\t");
-    const letter = parts[0][0];
-    // A rename/copy line is "R100\told\tnew" — the new path is the live one.
-    const file = parts.length > 2 ? parts[2] : parts[1];
+  const tokens = stdout.split("\0");
+  for (let i = 0; i < tokens.length; i++) {
+    const status = tokens[i].replace(/^\n/, "");
+    if (!/^[A-Z]/.test(status)) continue;
+    const letter = status[0];
+    // A rename/copy is "R100\0old\0new" — the new path is the live one.
+    const file = letter === "R" || letter === "C" ? tokens[(i += 2)] : tokens[++i];
+    if (!file) continue;
     // `-m` prints one diff per parent for a merge; --first-parent keeps it to
     // one, but a defensive de-dup costs nothing and a doubled row is a lie.
     if (seen.has(file)) continue;
@@ -282,6 +459,9 @@ function parseNameStatus(stdout, stats) {
 
 /** One file's patch text, for any range. Empty string when there is none. */
 async function patchFor(dir, { range, baseRef, sha, file, untracked, context }) {
+  // A secret file may be tracked by mistake; its hunks would carry the key —
+  // under its own name, or under a symlinked `.claude`'s target name.
+  if (await isSecretOnDisk(dir, file)) return "";
   if (untracked) return synthesizeAddedPatch(dir, file);
   const u = `-U${context}`;
   const args =
@@ -290,10 +470,7 @@ async function patchFor(dir, { range, baseRef, sha, file, untracked, context })
       : range === "branch"
         ? ["diff", u, `${baseRef}...HEAD`, "--", file]
         : ["diff", u, "HEAD", "--", file];
-  const result = await git(dir, [...args, "--no-color", "--no-ext-diff"]).catch(() => ({
-    stdout: "",
-  }));
-  return result.stdout;
+  return readCapped(dir, [...args, "--no-color", "--no-ext-diff"], MAX_FILE_BYTES).catch(() => "");
 }
 
 /**
@@ -302,10 +479,10 @@ async function patchFor(dir, { range, baseRef, sha, file, untracked, context })
  * --no-index /dev/null <file>` would print, without the non-zero exit that
  * wrapper treats as a failure.
  */
-function synthesizeAddedPatch(dir, file) {
+async function synthesizeAddedPatch(dir, file) {
   let buf;
   try {
-    buf = fs.readFileSync(path.join(dir, file));
+    buf = await fs.promises.readFile(await resolveInLane(dir, file));
   } catch {
     return "";
   }
@@ -440,7 +617,9 @@ async function listCommits(dir, { limit = 30, file = null } = {}) {
   const n = Math.min(Math.max(Number(limit) || 30, 1), 200);
   const format = ["%H", "%h", "%s", "%an", "%aI", "%D"].join("%x1f");
   const args = ["log", `-${n}`, `--format=${format}%x1e`];
-  if (file) args.push("--", file);
+  // Through the same lexical guard as every other path: in a subdirectory
+  // lane `../x` would list commit metadata for a path outside the lane.
+  if (file) args.push("--", lanePath(file));
   const result = await git(dir, args);
   const commits = [];
   for (const record of result.stdout.split("\x1e")) {
@@ -471,42 +650,64 @@ async function listCommits(dir, { limit = 30, file = null } = {}) {
  * `rev` is `work` (the file on disk, including an untracked one), `HEAD`, or a
  * commit-ish. The path is resolved against git's own index/tree rather than
  * trusted: for `work` it is realpath-confined to the lane directory, because
- * that is the one branch that reads the filesystem directly.
+ * that is the one branch that reads the filesystem directly. A SECRET_PATHS
+ * file is refused (ESECRET) at every rev.
  */
-async function readFileAt(dir, file, rev = "work") {
-  if (typeof file !== "string" || !file || file.startsWith("/") || file.includes("\0")) {
-    throw badRequest("EBADPATH", "path must be a relative path inside the lane");
-  }
+async function readFileAt(dir, requested, rev = "work") {
+  // Lexical guard FIRST and for every rev: `git show <rev>:<path>` reads the
+  // whole repo, so a `../` here is a committed file outside the lane.
+  const file = lanePath(requested);
   if (rev !== "work" && !SAFE_REV.test(rev)) {
     throw badRequest("EBADREV", "rev is not a valid revision");
   }
+  // By resolved path too, at every rev: the key committed under a symlinked
+  // `.claude`'s target name is still the key.
+  if (await isSecretOnDisk(dir, file)) {
+    throw badRequest("ESECRET", "that file holds secrets and is not readable here");
+  }
 
   let text;
   let binary = false;
+  let sha;
   if (rev === "work") {
-    const abs = path.resolve(dir, file);
-    // `..` in the request must not walk out of the lane. Compare resolved
-    // paths, not the string the caller sent.
-    const root = path.resolve(dir);
-    if (abs !== root && !abs.startsWith(root + path.sep)) {
-      throw badRequest("EBADPATH", "path escapes the lane directory");
-    }
+    // Neither `..` nor a symlink may walk out of the lane: resolveInLane
+    // compares REAL paths, not the string the caller sent.
+    const abs = await resolveInLane(dir, file);
     let buf;
     try {
-      buf = fs.readFileSync(abs);
+      // Only cap+1 bytes: a multi-gigabyte log in the lane must not be read
+      // whole to answer with its first megabyte. The extra byte is what
+      // tells the cap below the file was longer.
+      const fh = await fs.promises.open(abs, "r");
+      try {
+        const size = Math.min((await fh.stat()).size, MAX_FILE_VIEW_BYTES + 1);
+        buf = Buffer.alloc(size);
+        let off = 0;
+        while (off < size) {
+          const { bytesRead } = await fh.read(buf, off, size - off, off);
+          if (!bytesRead) break;
+          off += bytesRead;
+        }
+        buf = buf.subarray(0, off);
+      } finally {
+        await fh.close();
+      }
     } catch {
       throw badRequest("ENOFILE", "no such file in the working tree");
     }
     binary = looksBinary(buf);
     text = binary ? "" : buf.toString("utf8");
+    // What an editor must send back to save over THIS content and nothing
+    // newer (lane-file-write.js). Only for a whole, textual file.
+    if (!binary && buf.length <= MAX_FILE_VIEW_BYTES) sha = contentSha(buf);
   } else {
-    let out;
     try {
-      out = await git(dir, ["show", `${rev}:${file}`]);
+      // `./`: resolve from the lane's cwd, not the repo root (a bare
+      // `<rev>:<path>` is root-relative) — `file` has no `..`, so it stays in.
+      text = await readCapped(dir, ["show", `${rev}:./${file}`], MAX_FILE_VIEW_BYTES);
     } catch {
       throw badRequest("ENOFILE", "no such file at that revision");
     }
-    text = out.stdout;
     binary = text.includes("\0");
     if (binary) text = "";
   }
@@ -519,7 +720,12 @@ async function readFileAt(dir, file, rev = "work") {
   }
   const lines = text ? text.split("\n") : [];
   if (lines[lines.length - 1] === "") lines.pop();
-  return { path: file, rev, binary, truncated, lines };
+  return { path: file, rev, binary, truncated, lines, ...(sha ? { sha } : {}) };
+}
+
+/** The version stamp of a file's bytes, for a stale-save check. */
+function contentSha(buf) {
+  return crypto.createHash("sha1").update(buf).digest("hex");
 }
 
 /**
@@ -530,12 +736,11 @@ async function readFileAt(dir, file, rev = "work") {
  * skip-list has to be maintained here.
  */
 async function listPaths(dir, { q = "", limit = MAX_PATHS } = {}) {
-  const result = await git(dir, ["ls-files", "-z"]);
+  const { all, cut } = await lsFiles(dir, []);
   const needle = String(q || "")
     .toLowerCase()
     .trim();
   const cap = Math.min(Math.max(Number(limit) || MAX_PATHS, 1), MAX_PATHS);
-  const all = result.stdout.split("\0").filter(Boolean);
   const hits = needle ? all.filter((p) => p.toLowerCase().includes(needle)) : all;
   // A basename hit beats a directory hit: typing "api" wants `api.ts`, not
   // every file under `src/api/`.
@@ -546,48 +751,176 @@ async function listPaths(dir, { q = "", limit = MAX_PATHS } = {}) {
       return ab - bb || a.length - b.length || a.localeCompare(b);
     });
   }
-  return { paths: hits.slice(0, cap), truncated: hits.length > cap, total: hits.length };
+  return { paths: hits.slice(0, cap), truncated: cut || hits.length > cap, total: hits.length };
+}
+
+/** `git ls-files -z [args]` → paths, and whether a huge listing was cut short. */
+async function lsFiles(dir, args) {
+  const out = await readCapped(dir, ["ls-files", "-z", ...args], MAX_LS_CHARS);
+  const all = out.split("\0");
+  // A complete listing ends in NUL (last token ""); a cut one ends mid-path.
+  const cut = all.pop() !== "";
+  return { all: all.filter(Boolean), cut };
+}
+
+/** What the explorer lists: tracked files plus untracked ones git does not
+ *  ignore — the new file an agent just wrote is the one you want to open. */
+const TREE_LS = ["--cached", "--others", "--exclude-standard"];
+
+/**
+ * A lane's working-copy status for decorating the explorer, from ONE
+ * `laneStatus`: `fileStatus(path)` is the porcelain code of a changed file
+ * (untracked inside a folded untracked dir included), `dirChanged(path)` is
+ * whether anything under a folder is.
+ */
+async function treeStatus(dir) {
+  const codes = new Map();
+  const folded = []; // `normal` reports a wholly untracked folder as "dir/"
+  const dirs = new Set();
+  for (const { code, path: p } of await laneStatus(dir).catch(() => [])) {
+    if (p.endsWith("/")) folded.push(p);
+    else codes.set(p, code);
+    const parts = p.replace(/\/$/, "").split("/");
+    for (let i = 1; i <= parts.length - (p.endsWith("/") ? 0 : 1); i++) {
+      dirs.add(parts.slice(0, i).join("/"));
+    }
+  }
+  const inFolded = (p) => folded.some((f) => p.startsWith(f));
+  return {
+    fileStatus: (p) => codes.get(p) ?? (inFolded(p) ? "??" : undefined),
+    dirChanged: (p) => dirs.has(p) || inFolded(`${p}/`),
+  };
+}
+
+/** A folded level's entries, each carrying its status (see `treeStatus`). */
+function treeEntries(prefix, dirNames, files, st) {
+  return [
+    ...[...dirNames].sort().map((name) => {
+      const p = `${prefix}${name}`;
+      return { name, path: p, dir: true, ...(st.dirChanged(p) ? { changed: true } : {}) };
+    }),
+    ...files
+      .sort((a, b) => a.name.localeCompare(b.name))
+      .map((f) => {
+        const status = st.fileStatus(f.path);
+        return status ? { ...f, status } : f;
+      }),
+  ];
 }
 
 /**
- * One directory level of the working tree, for the file explorer. Tracked
- * entries only (same `.gitignore` reasoning as `listPaths`), folded into
+ * One directory level of the working tree, for the file explorer: tracked
+ * files plus untracked-but-not-ignored ones (`TREE_LS`), folded into
  * directories at this level — a tree that lists a repo's every file at once is
- * both slow to render and not what "expand a folder" means.
+ * both slow to render and not what "expand a folder" means. A changed file
+ * carries its porcelain `status`, a folder holding one `changed: true`.
  */
 async function listTree(dir, { subdir = "" } = {}) {
   const clean = String(subdir || "")
     .replace(/^\/+|\/+$/g, "")
     .trim();
   if (clean.split("/").includes("..")) throw badRequest("EBADPATH", "path escapes the lane");
-  const args = ["ls-files", "-z"];
-  if (clean) args.push("--", `${clean}/`);
-  const result = await git(dir, args);
+  const [{ all, cut }, st] = await Promise.all([
+    lsFiles(dir, clean ? [...TREE_LS, "--", `${clean}/`] : TREE_LS),
+    treeStatus(dir),
+  ]);
   const prefix = clean ? `${clean}/` : "";
   const dirs = new Set();
   const files = [];
-  for (const p of result.stdout.split("\0").filter(Boolean)) {
+  for (const p of all) {
     const rest = p.slice(prefix.length);
     const slash = rest.indexOf("/");
     if (slash === -1) files.push({ name: rest, path: p, dir: false });
     else dirs.add(rest.slice(0, slash));
   }
-  const entries = [
-    ...[...dirs].sort().map((name) => ({ name, path: `${prefix}${name}`, dir: true })),
-    ...files.sort((a, b) => a.name.localeCompare(b.name)),
-  ];
+  const entries = treeEntries(prefix, dirs, files, st);
   return {
     path: clean,
     entries: entries.slice(0, MAX_PATHS),
-    truncated: entries.length > MAX_PATHS,
+    truncated: cut || entries.length > MAX_PATHS,
   };
 }
 
+/**
+ * ONE hunk of a tracked file's working-copy diff (`git diff HEAD`, the same
+ * read the Changes panel shows), as a standalone patch `git apply` accepts:
+ * the file's own header lines plus that hunk. The hunk is named by its `@@`
+ * line and matched against a FRESH diff at the caller's context, so what gets
+ * applied is always git's own text of the current tree — never a patch a
+ * request carried. Null when no hunk matches (the tree moved on, or the file
+ * is a secret, binary or too large to read whole).
+ */
+async function hunkPatch(dir, file, header, context) {
+  if (!header || (await isSecretOnDisk(dir, file))) return null;
+  const u = `-U${normalizeContext(context)}`;
+  const raw = await readCapped(
+    dir,
+    ["diff", u, "HEAD", "--no-color", "--no-ext-diff", "--", file],
+    MAX_FILE_BYTES
+  ).catch(() => "");
+  // A capped read may end mid-hunk; applying half a hunk is worse than none.
+  if (!raw || raw.length >= MAX_FILE_BYTES) return null;
+  const at = raw.indexOf("\n@@ ");
+  if (at < 0) return null;
+  const head = raw.slice(0, at + 1);
+  // A content line starts with " ", "+", "-" or "\\" — never "@@" — so every
+  // line that does is a hunk boundary.
+  const hunk = raw
+    .slice(at + 1)
+    .split(/^(?=@@ )/m)
+    .find((h) => h.slice(0, h.indexOf("\n")) === header);
+  return hunk ? head + (hunk.endsWith("\n") ? hunk : `${hunk}\n`) : null;
+}
+
+/**
+ * Every level of the explorer tree (tracked + untracked-not-ignored) from ONE `git ls-files`, keyed by directory
+ * path ("" is the root), each level shaped and capped exactly like
+ * `listTree`'s. "Expand all folders" used to be one request — one ls-files —
+ * per folder, which on a large repo is thousands of git processes.
+ */
+async function listTreeAll(dir) {
+  const [{ all, cut }, st] = await Promise.all([lsFiles(dir, TREE_LS), treeStatus(dir)]);
+  const byDir = new Map();
+  const level = (d) => {
+    let l = byDir.get(d);
+    if (!l) byDir.set(d, (l = { dirs: new Set(), files: [] }));
+    return l;
+  };
+  level("");
+  for (const p of all) {
+    const parts = p.split("/");
+    for (let i = 0; i < parts.length - 1; i++) {
+      level(parts.slice(0, i).join("/")).dirs.add(parts[i]);
+    }
+    const parent = parts.slice(0, -1).join("/");
+    level(parent).files.push({ name: parts[parts.length - 1], path: p, dir: false });
+  }
+  const levels = {};
+  let truncated = cut;
+  for (const [d, { dirs, files }] of byDir) {
+    const entries = treeEntries(d ? `${d}/` : "", dirs, files, st);
+    if (entries.length > MAX_PATHS) truncated = true;
+    levels[d] = entries.slice(0, MAX_PATHS);
+  }
+  return { levels, truncated };
+}
+
 module.exports = {
   collectChanges,
+  contentSha,
+  isSecretOnDisk,
+  lanePath,
+  looksBinary,
+  resolveInLane,
+  MAX_FILE_VIEW_BYTES,
+  hunkPatch,
+  laneStatus,
   listCommits,
   listPaths,
   listTree,
+  listTreeAll,
+  parseNumstat,
+  parsePorcelainZ,
   parseUnifiedDiff,
   readFileAt,
   resolveBaseRef,

server/lib/git-ops.js

@@ -9,7 +9,11 @@
  *
  * Four rules hold for every action:
  *   - argv only, via worktree.js's `git()` — never a shell string.
- *   - the lane's own working directory is the only cwd.
+ *   - the lane's own working directory is the only cwd, and its boundary:
+ *     in a lane that is a subdirectory of its repo, paths are cwd-relative
+ *     and nothing outside the cwd can be named or swept into a commit.
+ *   - every path is a LITERAL file name, never a pathspec glob — `new*.js`
+ *     must not also discard new1.js (`literal: true` on every call).
  *   - a caller-supplied path is never trusted as a path: it must be one
  *     `git status` is reporting as changed right now (`resolvePaths`), so no
  *     `..`, no absolute path and no untouched file is reachable.
@@ -25,13 +29,19 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
 const {
-  git,
+  git: rawGit,
   isValidBranchName,
   listBranches,
   branchCheckedOutAt,
   statusCounts,
 } = require("./worktree");
+const { hunkPatch, laneStatus } = require("./git-diff");
+
+const git = (dir, args, opts) => rawGit(dir, args, { literal: true, ...opts });
 
 /** How long a fetch/pull/push may run before it is killed. */
 const NETWORK_TIMEOUT_MS = 60_000;
@@ -47,6 +57,8 @@ const ACTIONS = new Set([
   "stage",
   "unstage",
   "discard",
+  "stage-hunk",
+  "discard-hunk",
   "branch-create",
   "branch-delete",
 ]);
@@ -68,7 +80,9 @@ async function isDirty(dir) {
 
 /**
  * The paths a per-file action may name — exactly the ones `git status` is
- * reporting as changed right now, keyed by their porcelain code.
+ * reporting as changed right now, keyed by path → `{code, from}` (`from` is a
+ * rename's original path). `-z`, so a path git would C-quote (non-ASCII, a
+ * space, a quote) matches the literal path the panel sends.
  *
  * This is the whole authorization story for `stage`/`unstage`/`discard`: the
  * request cannot reach a path git is not already talking about, so no `..`,
@@ -76,18 +90,56 @@ async function isDirty(dir) {
  * that is not in this map is a 400, never a silent no-op.
  */
 async function changedPaths(dir) {
-  const result = await git(dir, ["status", "--porcelain=v1", "--untracked-files=normal"]);
   const map = new Map();
-  for (const line of result.stdout.split("\n")) {
-    if (!line.trim()) continue;
-    const code = line.slice(0, 2);
-    const raw = line.slice(3).trimEnd();
-    const file = raw.split(" -> ").pop().replace(/^"|"$/g, "");
-    map.set(file, code);
-  }
+  for (const { code, path, from } of await laneStatus(dir)) map.set(path, { code, from });
   return map;
 }
 
+/**
+ * The remote a push goes to — never a name from the request: the current
+ * branch's configured upstream remote, else the ONLY remote, else `origin`.
+ * Anything else is ambiguous, so ENOREMOTE rather than a guess.
+ */
+async function pushRemote(dir) {
+  const remotes = (await git(dir, ["remote"])).stdout.split("\n").filter(Boolean);
+  const branch = (
+    await git(dir, ["symbolic-ref", "--short", "-q", "HEAD"]).catch(() => ({ stdout: "" }))
+  ).stdout.trim();
+  if (branch) {
+    const upstream = (
+      await git(dir, ["config", "--get", `branch.${branch}.remote`]).catch(() => ({ stdout: "" }))
+    ).stdout.trim();
+    if (remotes.includes(upstream)) return upstream;
+  }
+  if (remotes.length === 1) return remotes[0];
+  if (remotes.includes("origin")) return "origin";
+  throw bad(
+    "ENOREMOTE",
+    remotes.length
+      ? "several remotes and no upstream or origin: set this branch's upstream first"
+      : "this repository has no remote to push to"
+  );
+}
+
+/** Throw ESTAGEDOUTSIDE when the index holds a change outside the lane's cwd. */
+async function assertNothingStagedOutside(dir) {
+  const prefix = (await git(dir, ["rev-parse", "--show-prefix"])).stdout.trim();
+  if (!prefix) return; // the lane IS the repo root: nothing is outside it
+  // No --relative: root-relative names, so outside entries are visible.
+  // --no-renames: a staged move INTO the lane is listed as its new path only
+  // otherwise, and the deletion of the old path outside would slip through.
+  const staged = (await git(dir, ["diff", "--cached", "--name-only", "--no-renames", "-z"])).stdout
+    .split("\0")
+    .filter(Boolean);
+  const outside = staged.find((p) => !p.startsWith(prefix));
+  if (outside) {
+    throw bad(
+      "ESTAGEDOUTSIDE",
+      `refusing to commit: ${outside} is staged outside this lane's directory`
+    );
+  }
+}
+
 /** Validate `body.paths` against what git reports as changed. */
 async function resolvePaths(dir, body) {
   const wanted = Array.isArray(body.paths)
@@ -104,7 +156,7 @@ async function resolvePaths(dir, body) {
   if (unknown.length) {
     throw bad("EBADPATH", `not a changed path: ${unknown[0]}`);
   }
-  return wanted.map((p) => ({ path: p, code: changed.get(p) }));
+  return wanted.map((p) => ({ path: p, ...changed.get(p) }));
 }
 
 /**
@@ -138,9 +190,10 @@ async function runGitAction(dir, action, body = {}) {
     // HEAD, not a branch name from the request: the lane pushes the branch it
     // is actually on, and -u makes the first push set the upstream the
     // ahead/behind counts then read.
+    const remote = await pushRemote(dir);
     return done(
       action,
-      await git(dir, ["push", "-u", "origin", "HEAD"], { timeout: NETWORK_TIMEOUT_MS })
+      await git(dir, ["push", "-u", remote, "HEAD"], { timeout: NETWORK_TIMEOUT_MS })
     );
   }
 
@@ -159,7 +212,14 @@ async function runGitAction(dir, action, body = {}) {
     const args =
       untracked.length === paths.length && !(await hasHead(dir))
         ? ["rm", "--cached", "-r", "--", ...paths.map((p) => p.path)]
-        : ["restore", "--staged", "--", ...paths.map((p) => p.path)];
+        : // A staged rename's ORIGINAL path rides along, as in `discard`:
+          // restoring only the new one leaves the old path's deletion staged.
+          [
+            "restore",
+            "--staged",
+            "--",
+            ...paths.flatMap((p) => (p.from && p.code.includes("R") ? [p.path, p.from] : [p.path])),
+          ];
     return done(action, await git(dir, args));
   }
 
@@ -167,7 +227,11 @@ async function runGitAction(dir, action, body = {}) {
     if (body.confirm !== true) throw bad("ECONFIRM", "discard requires confirm: true");
     const paths = await resolvePaths(dir, body);
     const untracked = paths.filter((p) => p.code === "??").map((p) => p.path);
-    const tracked = paths.filter((p) => p.code !== "??").map((p) => p.path);
+    // A rename's ORIGINAL path rides along: restoring only the new one would
+    // drop it from the index and the tree, and leave the old one deleted.
+    const tracked = paths
+      .filter((p) => p.code !== "??")
+      .flatMap((p) => (p.from && p.code.includes("R") ? [p.path, p.from] : [p.path]));
     const out = [];
     // Untracked files are deleted (git has no copy to restore); tracked ones
     // go back to HEAD in both gutters, so a staged-then-edited file lands in
@@ -181,20 +245,63 @@ async function runGitAction(dir, action, body = {}) {
     return done(action, mergeResults(out));
   }
 
+  if (action === "stage-hunk" || action === "discard-hunk") {
+    // Undoing a hunk is as irreversible as discarding a file: same gate.
+    if (action === "discard-hunk" && body.confirm !== true) {
+      throw bad("ECONFIRM", "discard-hunk requires confirm: true");
+    }
+    const [target] = await resolvePaths(dir, { path: body.path });
+    if (target.code === "??") {
+      throw bad("EUNTRACKED", "an untracked file has no hunks; stage or discard the whole file");
+    }
+    const patch = await hunkPatch(
+      dir,
+      target.path,
+      typeof body.hunk === "string" ? body.hunk : "",
+      body.context
+    );
+    if (!patch) throw bad("EHUNKGONE", "that change is no longer in the diff; refresh and retry");
+    // The patch names paths from the repo root, so it is applied there.
+    const top = (await git(dir, ["rev-parse", "--show-toplevel"])).stdout.trim();
+    const tmp = await fs.promises.mkdtemp(path.join(os.tmpdir(), "agenthub-hunk-"));
+    const file = path.join(tmp, "hunk.patch");
+    try {
+      await fs.promises.writeFile(file, patch);
+      const zero = Number(body.context) === 0 ? ["--unidiff-zero"] : [];
+      // stage: HEAD -> worktree hunk onto the index; undo: the same hunk,
+      // reversed, off the working tree. A hunk the index or tree no longer
+      // matches fails in git's own words (409), never half-applies.
+      const args =
+        action === "stage-hunk" ? ["apply", "--cached", ...zero] : ["apply", "-R", ...zero];
+      return done(action, await git(top, [...args, file]));
+    } finally {
+      await fs.promises.rm(tmp, { recursive: true, force: true });
+    }
+  }
+
   if (action === "commit") {
     const message = typeof body.message === "string" ? body.message.trim() : "";
     if (!message) throw bad("EBADMESSAGE", "commit message is required");
     if (message.length > MAX_MESSAGE_LEN) throw bad("EBADMESSAGE", "commit message is too long");
+    // `git commit` takes the WHOLE index, whatever the cwd, and a pathspec
+    // would switch it to committing the working-tree copy (unstaged edits
+    // included) — so a subdirectory lane refuses rather than sweep another
+    // actor's staged work outside it into this lane's commit.
+    await assertNothingStagedOutside(dir);
     if (body.only === "staged") {
       // The panel's per-file staging only means something if a commit can
       // take the index as it stands — no `add -A` sweeping in the rest.
       const staged = [...(await changedPaths(dir)).values()].some(
-        (code) => code[0] !== " " && code[0] !== "?"
+        ({ code }) => code[0] !== " " && code[0] !== "?"
       );
       if (!staged) throw bad("ENOCHANGES", "nothing staged to commit");
     } else {
-      if (!(await isDirty(dir))) throw bad("ENOCHANGES", "nothing to commit");
-      await git(dir, ["add", "-A"]);
+      // The LANE's status, not the repo's: `add -A -- .` below only takes the
+      // lane's files, so a clean subdirectory lane in a repo dirty elsewhere
+      // has nothing to commit — not a git failure after the fact.
+      if (!(await laneStatus(dir)).length) throw bad("ENOCHANGES", "nothing to commit");
+      // `-- .`: the lane's own directory, not the whole repo it sits in.
+      await git(dir, ["add", "-A", "--", "."]);
     }
     // -m takes the message as one argv element, so a message containing
     // newlines, quotes or a leading dash is content, never syntax.

server/lib/lane-file-write.js

@@ -0,0 +1,77 @@
+/**
+ * @file Saves one text file in a lane's working tree, for the Changes panel's
+ * single-file editor. The one filesystem WRITE of the lane file surface, kept
+ * out of git-ops.js on purpose: that module only ever touches paths `git
+ * status` reports as changed, and an editor may save any file.
+ *
+ * The guards are the READ path's own (git-diff.js), so the editor can never
+ * write where the viewer could not read: a lexical `lanePath`, a realpath
+ * confined to the lane (no `..`, no symlink out), and no `settings.local.json`
+ * — the lane router's key file — at any depth or through any symlink. On top:
+ * only an EXISTING, textual file within the viewer's size cap, and only over
+ * the exact bytes the editor loaded (`baseSha`, from `readFileAt`), so a save
+ * never silently overwrites what the agent wrote in the meantime (ESTALE).
+ * The file keeps its CRLF line endings and its final newline.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const fs = require("node:fs");
+const {
+  contentSha,
+  isSecretOnDisk,
+  lanePath,
+  looksBinary,
+  resolveInLane,
+  MAX_FILE_VIEW_BYTES,
+} = require("./git-diff");
+
+function bad(code, message) {
+  return Object.assign(new Error(message), { code });
+}
+
+/**
+ * Overwrite `requested` in lane `dir` with `content`. Throws EBADPATH,
+ * ESECRET, ENOFILE, EBADCONTENT, ETOOBIG, EBINARY or ESTALE.
+ */
+async function writeLaneFile(dir, requested, content, baseSha) {
+  const file = lanePath(requested);
+  if (await isSecretOnDisk(dir, file)) {
+    throw bad("ESECRET", "that file holds secrets and is not writable here");
+  }
+  if (typeof content !== "string") throw bad("EBADCONTENT", "content must be a string");
+  if (typeof baseSha !== "string" || !/^[0-9a-f]{40}$/.test(baseSha)) {
+    throw bad("EBADCONTENT", "baseSha is required");
+  }
+  if (Buffer.byteLength(content) > MAX_FILE_VIEW_BYTES) {
+    throw bad("ETOOBIG", "file is too large to edit here");
+  }
+  const abs = await resolveInLane(dir, file);
+
+  let current;
+  try {
+    const stat = await fs.promises.stat(abs);
+    if (!stat.isFile()) throw bad("ENOFILE", "no such file in the working tree");
+    if (stat.size > MAX_FILE_VIEW_BYTES) throw bad("ETOOBIG", "file is too large to edit here");
+    current = await fs.promises.readFile(abs);
+  } catch (err) {
+    if (err.code === "ETOOBIG" || err.code === "ENOFILE") throw err;
+    throw bad("ENOFILE", "no such file in the working tree");
+  }
+  if (looksBinary(current)) throw bad("EBINARY", "binary files are not editable here");
+  if (contentSha(current) !== baseSha) {
+    throw bad("ESTALE", "the file changed on disk since it was opened — reload it first");
+  }
+
+  // A browser textarea hands back LF only, and the viewer drops the final
+  // newline: put back what the file had, so a one-word fix is a one-line diff.
+  const text = current.toString("utf8");
+  const eol = text.includes("\r\n") ? "\r\n" : "\n";
+  let out = content.replace(/\r\n/g, "\n");
+  if (eol === "\r\n") out = out.replace(/\n/g, "\r\n");
+  if (text.endsWith("\n") && out && !out.endsWith(eol)) out += eol;
+
+  await fs.promises.writeFile(abs, out);
+  return { path: file };
+}
+
+module.exports = { writeLaneFile };

server/lib/pricing-sync.js

@@ -0,0 +1,142 @@
+/**
+ * @file Automatic pricing for Claude models the dashboard has seen but has no
+ * rate row of its own for. Every model id in `token_usage` is reduced to its
+ * family (a `-YYYYMMDD` snapshot suffix dropped); a family with no
+ * `<family>%` row is looked up in LiteLLM's public price list and INSERTED —
+ * never updated, so a rate the user edited in Settings always wins. "Its own
+ * row" is the test, not "some row matches": Opus 5.5 was silently priced as
+ * Opus 5 by the broader `claude-opus-5%` pattern.
+ *
+ * The list is fetched only when something is missing, at most once per
+ * CACHE_MS. Off with AGENTHUB_PRICING_SYNC=0|false|off.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const PRICE_LIST_URL =
+  "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json";
+const CHECK_MS = 15 * 60_000;
+const CACHE_MS = 24 * 60 * 60_000;
+/** A per-MTok rate above this is a parse error, not a price. */
+const MAX_PER_MTOK = 1000;
+
+let cached = null; // { at, list }
+
+/** `claude-opus-5-5-20260101` → `claude-opus-5-5`; null for anything else. */
+function familyOf(model) {
+  if (typeof model !== "string") return null;
+  const fam = model.replace(/-\d{8}$/, "");
+  return /^claude-[a-z0-9-]+$/.test(fam) ? fam : null;
+}
+
+/** `claude-opus-5-5` → `Claude Opus 5.5`. */
+function displayName(fam) {
+  const [, ...parts] = fam.split("-");
+  const words = [];
+  const nums = [];
+  for (const p of parts) (/^\d+$/.test(p) ? nums : words).push(p);
+  const name = words.map((w) => w[0].toUpperCase() + w.slice(1)).join(" ");
+  return `Claude ${name}${nums.length ? " " + nums.join(".") : ""}`;
+}
+
+/** One LiteLLM entry → a model_pricing row, or null when it is not usable. */
+function toRow(fam, e) {
+  if (!e || e.litellm_provider !== "anthropic") return null;
+  const per = (v) => (typeof v === "number" ? v * 1e6 : NaN);
+  const input = per(e.input_cost_per_token);
+  const output = per(e.output_cost_per_token);
+  // Anthropic's published multipliers stand in for a field the list omits.
+  const read = per(e.cache_read_input_token_cost ?? e.input_cost_per_token * 0.1);
+  const w5m = per(e.cache_creation_input_token_cost ?? e.input_cost_per_token * 1.25);
+  const w1h = per(e.cache_creation_input_token_cost_above_1hr ?? e.input_cost_per_token * 2);
+  const rates = [input, output, read, w5m, w1h];
+  if (!rates.every((r) => Number.isFinite(r) && r >= 0 && r <= MAX_PER_MTOK)) return null;
+  if (input === 0 && output === 0) return null;
+  const fast = e.supports_fast_mode ? Number(e.provider_specific_entry?.fast) : 0;
+  const fastOk = Number.isFinite(fast) && fast > 0 && fast <= 10;
+  // Rounded: 0.000004 * 1e6 is 3.9999999999999996, which Settings would show.
+  const r = (n) => Math.round(n * 1e6) / 1e6;
+  return {
+    pattern: `${fam}%`,
+    name: displayName(fam),
+    input: r(input),
+    output: r(output),
+    read: r(read),
+    w5m: r(w5m),
+    w1h: r(w1h),
+    fastIn: fastOk ? r(input * fast) : 0,
+    fastOut: fastOk ? r(output * fast) : 0,
+  };
+}
+
+/** Families used in token_usage that have no `<family>%` row of their own. */
+function missingFamilies(db) {
+  const have = new Set(
+    db
+      .prepare("SELECT model_pattern FROM model_pricing")
+      .all()
+      .map((r) => r.model_pattern)
+  );
+  const out = new Set();
+  for (const { model } of db.prepare("SELECT DISTINCT model FROM token_usage").all()) {
+    const fam = familyOf(model);
+    if (fam && !have.has(`${fam}%`)) out.add(fam);
+  }
+  return [...out];
+}
+
+async function defaultFetch() {
+  const res = await fetch(PRICE_LIST_URL, { signal: AbortSignal.timeout(20_000) });
+  if (!res.ok) throw new Error(`price list HTTP ${res.status}`);
+  return res.json();
+}
+
+/**
+ * One pass. Returns the patterns inserted. Never throws: pricing is a display
+ * concern and a failed fetch must not reach the server's startup path.
+ */
+async function syncPricing(db, { fetchList = defaultFetch, now = Date.now() } = {}) {
+  try {
+    const missing = missingFamilies(db);
+    if (missing.length === 0) return [];
+    if (!cached || now - cached.at > CACHE_MS) cached = { at: now, list: await fetchList() };
+    const insert = db.prepare(
+      `INSERT OR IGNORE INTO model_pricing (model_pattern, display_name, input_per_mtok,
+         output_per_mtok, cache_read_per_mtok, cache_write_per_mtok, cache_write_1h_per_mtok,
+         fast_input_per_mtok, fast_output_per_mtok) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    const added = [];
+    for (const fam of missing) {
+      const row = toRow(fam, cached.list?.[fam]);
+      if (!row) continue;
+      const { changes } = insert.run(
+        row.pattern,
+        row.name,
+        row.input,
+        row.output,
+        row.read,
+        row.w5m,
+        row.w1h,
+        row.fastIn,
+        row.fastOut
+      );
+      if (changes) added.push(row.pattern);
+    }
+    if (added.length) console.log(`[pricing] added rates for ${added.join(", ")}`);
+    return added;
+  } catch (err) {
+    console.warn("[pricing] sync failed:", err.message);
+    return [];
+  }
+}
+
+function startPricingSync(db) {
+  if (/^(0|false|off)$/i.test(process.env.AGENTHUB_PRICING_SYNC || "")) return;
+  void syncPricing(db);
+  setInterval(() => void syncPricing(db), CHECK_MS).unref();
+}
+
+function _resetCache() {
+  cached = null;
+}
+
+module.exports = { syncPricing, startPricingSync, familyOf, displayName, toRow, _resetCache };

server/lib/pty-attach.js

@@ -12,10 +12,10 @@
 
 const tmux = require("./tmux");
 
-const RUN_ID_RE = /^agenthub-lane-\d+$/;
+const RUN_ID_RE = /^agenthub-lane-\d+(?:-[1-3])?$/;
 
 /**
- * Reject anything that isn't exactly `agenthub-lane-<digits>` before it can ever
+ * Reject anything that isn't exactly `agenthub-lane-<digits>[-<1-3>]` before it can ever
  * reach a tmux/PTY command — the trust boundary for this WS path, since a
  * validated runId is the only thing standing between an authenticated WS
  * client and naming an arbitrary session on the host.

server/lib/pty-run.js

@@ -21,6 +21,10 @@
  *
  * Spawns `claude` or `codex` in the tmux pane based on the tool parameter.
  *
+ * A lane can hold up to four sessions, one per Workspace split pane: pane 0 is
+ * `agenthub-lane-<laneId>` (the lane's own `run_id`), panes 1–3 are
+ * `agenthub-lane-<laneId>-<slot>`.
+ *
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -35,7 +39,9 @@ try {
   /* db-less environment, skip persistence */
 }
 
-const RUN_ID_RE = /^agenthub-lane-(\d+)$/;
+const RUN_ID_RE = /^agenthub-lane-(\d+)(?:-([1-3]))?$/;
+/** Highest pane slot a lane may use (the Workspace's 4-pane grid is 0–3). */
+const MAX_PANE_SLOT = 3;
 const EFFORT_LEVELS = new Set(["low", "medium", "high", "xhigh", "max"]);
 // `auto` is the CLI's own default-ish mode (`claude --permission-mode auto`):
 // it asks only for what its classifier reads as risky. `default` is kept for
@@ -55,8 +61,13 @@ const CODEX_APPROVALS = new Set(["on-request", "never"]);
 // Codex has no `--effort` flag; reasoning effort is a config override.
 const CODEX_EFFORTS = new Set(["low", "medium", "high", "xhigh"]);
 
-function runIdForLane(laneId) {
-  return `agenthub-lane-${laneId}`;
+function runIdForLane(laneId, slot = 0) {
+  return slot ? `agenthub-lane-${laneId}-${slot}` : `agenthub-lane-${laneId}`;
+}
+
+function slotFromRunId(id) {
+  const m = typeof id === "string" ? id.match(RUN_ID_RE) : null;
+  return m ? Number(m[2] || 0) : null;
 }
 
 function laneIdFromRunId(id) {
@@ -149,6 +160,7 @@ function buildArgv(args) {
 function spawnRun(args) {
   const {
     laneId,
+    slot = 0,
     cwd,
     tool = "claude",
     model,
@@ -164,6 +176,9 @@ function spawnRun(args) {
   if (typeof laneId !== "number" || !Number.isInteger(laneId)) {
     throw makeErr("EBADLANE", "laneId must be an integer");
   }
+  if (!Number.isInteger(slot) || slot < 0 || slot > MAX_PANE_SLOT) {
+    throw makeErr("EBADSLOT", `slot must be an integer 0–${MAX_PANE_SLOT}`);
+  }
   if (typeof cwd !== "string" || !cwd) {
     throw makeErr("EBADCWD", "cwd is required");
   }
@@ -215,7 +230,7 @@ function spawnRun(args) {
     );
   }
 
-  const id = runIdForLane(laneId);
+  const id = runIdForLane(laneId, slot);
   const startedAt = Date.now();
   const argv = buildArgv({
     tool,
@@ -323,6 +338,7 @@ function publicRun(id) {
   return {
     id,
     laneId,
+    slot: slotFromRunId(id),
     status: live ? "running" : "gone",
     tool: row?.tool || "claude",
     cwd: row?.cwd || null,
@@ -353,5 +369,6 @@ module.exports = {
   listRuns,
   laneIdFromRunId,
   runIdForLane,
+  MAX_PANE_SLOT,
   SHELL_COMMANDS,
 };

server/lib/worktree.js

@@ -30,7 +30,7 @@ const STATUS_FILE_CAP = 20;
  * these variables. This module's whole job is to run git safely against repos other
  * than the one enclosing the current working directory.
  */
-async function git(cwd, args, { timeout = 0 } = {}) {
+async function git(cwd, args, { timeout = 0, maxBuffer = 8 * 1024 * 1024, literal = false } = {}) {
   // Build a clean environment: copy process.env but scrub git hook variables
   // that could point to the outer repo's git directory or index.
   const env = { ...process.env };
@@ -52,12 +52,23 @@ async function git(cwd, args, { timeout = 0 } = {}) {
   }
   // Prevent credential prompts from hanging a background provisioning job
   env.GIT_TERMINAL_PROMPT = "0";
+  // Pathspec behaviour is ours to choose, never the parent's. `literal` makes a
+  // path argument name exactly one file: without it `new*.js` or `app/[id]/`
+  // is a GLOB, and `git clean -- 'new*.js'` deletes every match.
+  delete env.GIT_GLOB_PATHSPECS;
+  delete env.GIT_NOGLOB_PATHSPECS;
+  delete env.GIT_ICASE_PATHSPECS;
+  if (literal) env.GIT_LITERAL_PATHSPECS = "1";
+  else delete env.GIT_LITERAL_PATHSPECS;
 
   try {
     const result = await execFileAsync("git", args, {
       cwd,
       env,
-      maxBuffer: 8 * 1024 * 1024,
+      // A read with its own size cap passes a bigger buffer and treats an
+      // overflow (err.code ERR_CHILD_PROCESS_STDIO_MAXBUFFER, partial output in
+      // err.git.stdout) as truncated rather than as a failure.
+      maxBuffer,
       // 0 = no limit, node's own default. A network command (fetch/pull/push)
       // passes one so an unreachable remote fails instead of pinning a request
       // open forever; GIT_TERMINAL_PROMPT=0 only covers the prompting case.
@@ -631,6 +642,46 @@ async function statusCounts(dir) {
   return { dirty, untracked, head, files };
 }
 
+/**
+ * The lane card's view of the working copy: only entries inside the lane's own
+ * cwd, cwd-relative and read with `-z` — the same scoping the Changes panel
+ * uses (`laneStatus`), so a subdirectory lane's card never counts or lists a
+ * sibling's files, and a non-ASCII name is not shown C-quoted. `statusCounts`
+ * stays whole-repo on purpose: `switch` and the preflight need to know about
+ * ANY dirt a branch change would carry across.
+ */
+async function laneFiles(dir) {
+  // Lazy: git-diff.js requires this module, so a top-level require would cycle.
+  const { laneStatus, parseNumstat } = require("./git-diff");
+  const entries = await laneStatus(dir);
+  let stats = new Map();
+  try {
+    // -z --relative: cwd-scoped, cwd-relative, unquoted — keys the entries.
+    stats = parseNumstat(
+      (await git(dir, ["diff", "--numstat", "-z", "--relative", "HEAD"])).stdout
+    );
+  } catch {
+    /* no HEAD to diff against -> no per-file deltas */
+  }
+  let dirty = 0;
+  let untracked = 0;
+  const files = [];
+  for (const e of entries) {
+    if (e.code === "??") untracked++;
+    else dirty++;
+    if (files.length < STATUS_FILE_CAP) {
+      files.push({
+        path: e.path,
+        status: e.code,
+        // Counts only: the card's file record has no `binary` field.
+        added: stats.get(e.path)?.added ?? null,
+        deleted: stats.get(e.path)?.deleted ?? null,
+      });
+    }
+  }
+  return { dirty, untracked, files };
+}
+
 /**
  * What a lane's working copy looks like right now: which branch it is on, the
  * short HEAD, that commit's subject, and how much is uncommitted.
@@ -641,7 +692,8 @@ async function statusCounts(dir) {
  * caller shows what git says rather than inventing a nicer word for it.
  */
 async function gitFacts(dir) {
-  const { dirty, untracked, head, files } = await statusCounts(dir);
+  const { head } = await statusCounts(dir);
+  const { dirty, untracked, files } = await laneFiles(dir);
   const branch = (await git(dir, ["rev-parse", "--abbrev-ref", "HEAD"])).stdout.trim();
   const subject = (await git(dir, ["log", "-1", "--format=%s"])).stdout.trim();
   return { branch, head, subject, dirty, untracked, files, ...(await trackingFacts(dir)) };

server/openapi-extra/lanes.js

@@ -511,7 +511,7 @@ const paths = {
       tags: ["Lanes"],
       summary: "The lane's recent commits",
       description:
-        "Newest first, up to limit (default 30, max 200). file= narrows it to the commits touching one path. Reading a commit's diff is GET /api/lanes/{id}/git/changes?range=commit&sha=. Read-only, no same-origin guard.",
+        "Newest first, up to limit (default 30, max 200). file= narrows it to the commits touching one path (relative, no `..`, else 400 EBADPATH). Reading a commit's diff is GET /api/lanes/{id}/git/changes?range=commit&sha=. Read-only, no same-origin guard.",
       operationId: "listLaneCommits",
       parameters: [
         { name: "id", in: "path", required: true, schema: { type: "integer" } },
@@ -520,6 +520,7 @@ const paths = {
       ],
       responses: {
         200: { description: "{available, commits:[{sha, short, subject, author, date, refs}]}." },
+        400: { description: "EBADPATH (file= is absolute or has a `..` segment)." },
         404: { description: "Lane not found." },
       },
     },
@@ -538,7 +539,13 @@ const paths = {
       ],
       responses: {
         200: { description: "{available, path, rev, binary, truncated, lines}." },
-        400: { description: "EBADPATH, EBADREV or ENOFILE." },
+        400: {
+          description: "EBADPATH (incl. a symlink resolving outside the lane), EBADREV or ENOFILE.",
+        },
+        403: {
+          description:
+            "ESECRET — `.claude/settings.local.json` (the AI Router key) is refused at every rev, at any depth, and under any path that resolves to it (a symlinked `.claude`).",
+        },
         404: { description: "Lane not found." },
       },
     },
@@ -578,6 +585,20 @@ const paths = {
       },
     },
   },
+  "/api/lanes/{id}/git/tree-all": {
+    get: {
+      tags: ["Lanes"],
+      summary: "Every level of the tracked tree in one read",
+      description:
+        "The file explorer's expand-all-folders read: ONE git ls-files, grouped into levels keyed by directory (\"\" is the root), each level shaped and capped like GET /api/lanes/{id}/git/tree's entries. Read-only, no same-origin guard.",
+      operationId: "listLaneTreeAll",
+      parameters: [{ name: "id", in: "path", required: true, schema: { type: "integer" } }],
+      responses: {
+        200: { description: "{available, levels:{<dir>:[{name, path, dir}]}, truncated}." },
+        404: { description: "Lane not found." },
+      },
+    },
+  },
   "/api/lanes/{id}/git/branches": {
     get: {
       tags: ["Lanes"],
@@ -597,7 +618,7 @@ const paths = {
       tags: ["Lanes"],
       summary: "One git write on the lane's working copy",
       description:
-        'fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u origin HEAD, so only the branch the lane is on), stage/unstage (per file), discard (per file; irreversible, so it REQUIRES confirm:true), commit (git add -A then commit -m <message>, or only:"staged" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent\'s half-finished work is never carried onto another branch), and branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per lane under the lane lock. Deliberately no merge, rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.',
+        "fetch (--all --prune), pull (ALWAYS --ff-only — a diverged branch is reported, never merged), push (-u <remote> HEAD, so only the branch the lane is on; remote = the branch's upstream remote, else the only remote, else origin, else 400 ENOREMOTE), stage/unstage (per file), discard (per file; irreversible, so it REQUIRES confirm:true), stage-hunk / discard-hunk (ONE hunk of a tracked file's `git diff HEAD`, named by its `@@` line and re-read server-side at the given context — the applied patch is always git's own text, never one from the request; discard-hunk REQUIRES confirm:true; 400 EUNTRACKED for an untracked file, 409 EHUNKGONE when the hunk is no longer in the diff), commit (git add -A then commit -m <message>, or only:\"staged\" to take the index as it stands), switch (git switch, -c to create; refuses a dirty tree so an agent's half-finished work is never carried onto another branch), and branch-create / branch-delete (create never switches; delete is `git branch -d`, refuses main/master/development/develop, the current branch and one held by another worktree). A path in the body must be one `git status` is reporting as changed, so no path outside the lane is reachable. Guarded and serialized per git index (the lane lock keyed on the worktree's git dir, so two lanes sharing one index cannot collide on index.lock). Deliberately no merge, rebase, reset or stash: reset stays behind the destroy guard on POST /api/lanes/{id}/reset. Network actions are killed after 60s.",
       operationId: "runLaneGitAction",
       parameters: [
         { name: "id", in: "path", required: true, schema: { type: "integer" } },
@@ -614,6 +635,8 @@ const paths = {
               "stage",
               "unstage",
               "discard",
+              "stage-hunk",
+              "discard-hunk",
               "commit",
               "switch",
               "branch-create",
@@ -646,9 +669,23 @@ const paths = {
                   items: { type: "string" },
                   description: "stage, unstage, discard; each must be a path git reports changed.",
                 },
+                path: {
+                  type: "string",
+                  description:
+                    "stage-hunk, discard-hunk; a path git reports changed (not untracked).",
+                },
+                hunk: {
+                  type: "string",
+                  description:
+                    "stage-hunk, discard-hunk; the hunk's `@@` line as the diff returned it. The server re-reads the diff and applies git's own text of that hunk; a hunk no longer present is 409 EHUNKGONE.",
+                },
+                context: {
+                  type: "integer",
+                  description: "stage-hunk, discard-hunk; the context the hunk was read at.",
+                },
                 confirm: {
                   type: "boolean",
-                  description: "discard only; the call is refused without it.",
+                  description: "discard and discard-hunk; the call is refused without it.",
                 },
               },
             },
@@ -659,10 +696,14 @@ const paths = {
         200: { description: "{action, ok:true, output} — git's own stdout+stderr." },
         400: {
           description:
-            "EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY or ENOCHANGES.",
+            "EBADACTION, EBADMESSAGE, EBADBRANCH, EBADPATH, ECONFIRM, EPROTECTED, ENOBRANCH, EBRANCHEXISTS, EBRANCHBUSY, EDIRTY, ENOCHANGES, ESTAGEDOUTSIDE or ENOREMOTE.",
         },
         404: { description: "Lane not found." },
-        500: { description: "git failed; its stderr is appended to error.message." },
+        409: {
+          description:
+            "EGIT — git ran and refused (a rejected push, a credential failure, a diverged --ff-only pull); its stderr is appended to error.message.",
+        },
+        500: { description: "Unexpected server-side failure." },
       },
     },
   },

server/routes/lanes.js

@@ -27,10 +27,12 @@ const { broadcast } = require("../websocket");
 const runs = require("../lib/pty-run");
 const { applyRouterToLane } = require("../lib/router-apply");
 const { sameOriginGuard } = require("./run");
+const { writeLaneFile } = require("../lib/lane-file-write");
 const { preflight } = require("../lib/lane-preflight");
 const {
   LANES_ROOT,
   addWorktree,
+  git,
   gitFacts,
   isGitRepo,
   isValidBranchName,
@@ -40,7 +42,14 @@ const {
   resolveBase,
   slugify,
 } = require("../lib/worktree");
-const { collectChanges, listCommits, listPaths, listTree, readFileAt } = require("../lib/git-diff");
+const {
+  collectChanges,
+  listCommits,
+  listPaths,
+  listTree,
+  listTreeAll,
+  readFileAt,
+} = require("../lib/git-diff");
 const { runGitAction } = require("../lib/git-ops");
 const { withLaneLock } = require("../lib/lane-lock");
 const { checkSync, mergeSync, continueSync } = require("../lib/lane-sync");
@@ -293,7 +302,9 @@ router.get("/branches", async (req, res) => {
     const worktrees = await listWorktrees(sourceRepo).catch(() => []);
     res.json({ branches, current, worktrees });
   } catch (err) {
-    res.status(500).json({ error: { code: err.code, message: err.message, git: err.git } });
+    res
+      .status(500)
+      .json({ error: { code: gitErrorCode(err), message: err.message, git: err.git } });
   }
 });
 
@@ -808,7 +819,10 @@ router.get("/:id/git/log", async (req, res) => {
       file: typeof req.query.file === "string" && req.query.file ? req.query.file : null,
     });
     res.json({ available: true, commits });
-  } catch {
+  } catch (err) {
+    if (err.code === "EBADPATH") {
+      return res.status(400).json({ error: { code: err.code, message: err.message } });
+    }
     res.json({ available: false, commits: [] });
   }
 });
@@ -817,7 +831,8 @@ router.get("/:id/git/log", async (req, res) => {
  * One file's whole content at a revision (`?rev=work|HEAD|<sha>`), for the
  * viewer's "show the entire file" mode. Path validation lives in
  * git-diff.js's `readFileAt` — the `work` revision is the one branch that
- * touches the filesystem, and it is realpath-confined to the lane.
+ * touches the filesystem, and it is realpath-confined to the lane (symlinks
+ * included). `.claude/settings.local.json` is 403 ESECRET at every rev.
  */
 router.get("/:id/git/file", async (req, res) => {
   const lane = laneOr404(req, res);
@@ -830,6 +845,10 @@ router.get("/:id/git/file", async (req, res) => {
     );
     res.json({ available: true, ...file });
   } catch (err) {
+    // A secret file (the router's API key) is refused at every rev.
+    if (err.code === "ESECRET") {
+      return res.status(403).json({ error: { code: err.code, message: err.message } });
+    }
     if (["EBADPATH", "EBADREV", "ENOFILE"].includes(err.code)) {
       return res.status(400).json({ error: { code: err.code, message: err.message } });
     }
@@ -837,6 +856,26 @@ router.get("/:id/git/file", async (req, res) => {
   }
 });
 
+/**
+ * Save one text file in the lane from the viewer's editor. Guards live in
+ * lane-file-write.js (the read path's own, plus existing-textual-file-only and
+ * a `baseSha` stale check). Answers the file re-read, fresh `sha` included.
+ */
+router.put("/:id/git/file", sameOriginGuard, async (req, res) => {
+  const lane = laneOr404(req, res);
+  if (!lane) return;
+  const body = req.body || {};
+  try {
+    await writeLaneFile(lane.cwd, body.path, body.content, body.baseSha);
+    res.json({ available: true, ...(await readFileAt(lane.cwd, body.path, "work")) });
+  } catch (err) {
+    const status =
+      { ESECRET: 403, ESTALE: 409 }[err.code] ??
+      (["EBADPATH", "ENOFILE", "EBADCONTENT", "ETOOBIG", "EBINARY"].includes(err.code) ? 400 : 500);
+    res.status(status).json({ error: { code: err.code || "EWRITE", message: err.message } });
+  }
+});
+
 /** Tracked paths matching `?q=`, for quick-open. */
 router.get("/:id/git/ls", async (req, res) => {
   const lane = laneOr404(req, res);
@@ -848,7 +887,18 @@ router.get("/:id/git/ls", async (req, res) => {
   }
 });
 
-/** One directory level of tracked files, for the file explorer. */
+/** Every level of the tracked tree in one read, for "expand all folders". */
+router.get("/:id/git/tree-all", async (req, res) => {
+  const lane = laneOr404(req, res);
+  if (!lane) return;
+  try {
+    res.json({ available: true, ...(await listTreeAll(lane.cwd)) });
+  } catch {
+    res.json({ available: false, levels: {}, truncated: false });
+  }
+});
+
+/** One directory level of the explorer tree (tracked + untracked-not-ignored), status-decorated. */
 router.get("/:id/git/tree", async (req, res) => {
   const lane = laneOr404(req, res);
   if (!lane) return;
@@ -884,8 +934,10 @@ router.get("/:id/git/branches", async (req, res) => {
 /**
  * The git WRITES the dashboard offers: fetch, pull, push, stage, unstage,
  * discard, commit, switch, branch-create and branch-delete.
- * Guarded (they mutate), serialized per lane (`withLaneLock`) so a push and a
- * commit fired from two tabs cannot interleave on one index, and thin — every
+ * Guarded (they mutate), serialized per git index (`withLaneLock` keyed on
+ * the worktree's git dir, so a claude and a codex lane on one directory share
+ * it) so a push and a commit fired from two tabs or two lanes cannot
+ * interleave on one index, and thin — every
  * rule about what each action may do lives in server/lib/git-ops.js, not here.
  * `git pull` is --ff-only and `switch` refuses a dirty tree, by design there.
  */
@@ -893,7 +945,15 @@ router.post("/:id/git/:action", sameOriginGuard, async (req, res) => {
   const lane = laneOr404(req, res);
   if (!lane) return;
   try {
-    const result = await withLaneLock(lane.id, () =>
+    // Keyed on the INDEX, not the lane id: a claude and a codex lane on one
+    // cwd — or a root lane and a subdirectory lane of one repo — share one
+    // index, and their writes would otherwise race on index.lock. The git dir
+    // is per worktree, so sibling worktree lanes still run in parallel; a
+    // cwd that is not a repo falls back to its real path.
+    const gitDir = await git(lane.cwd, ["rev-parse", "--absolute-git-dir"])
+      .then((r) => r.stdout.trim())
+      .catch(() => fs.promises.realpath(lane.cwd).catch(() => lane.cwd));
+    const result = await withLaneLock(`git:${gitDir}`, () =>
       runGitAction(lane.cwd, req.params.action, req.body || {})
     );
     res.json(result);
@@ -910,8 +970,21 @@ router.post("/:id/git/:action", sameOriginGuard, async (req, res) => {
       "EBADPATH",
       "ECONFIRM",
       "EPROTECTED",
+      "ESTAGEDOUTSIDE",
+      "ENOREMOTE",
+      "EUNTRACKED",
     ];
-    const status = badRequest.includes(err.code) ? 400 : 500;
+    // A numeric code is git's own exit status (execFile reports one that way):
+    // git ran and refused — a rejected push, a failed credential, a diverged
+    // pull. That is the repository's state answering a valid request, not a
+    // server fault, so it is a 409 under the string code the client expects.
+    const exited = typeof err.code === "number";
+    // EHUNKGONE is the same kind of answer: the tree moved under the click.
+    const status = badRequest.includes(err.code)
+      ? 400
+      : exited || err.code === "EHUNKGONE"
+        ? 409
+        : 500;
     // git's own stderr is the useful half of a failed push or pull (a
     // rejection, a missing credential, a diverged branch), so it joins the
     // message rather than riding a side field the client would have to know
@@ -919,7 +992,7 @@ router.post("/:id/git/:action", sameOriginGuard, async (req, res) => {
     const detail = err.git ? (err.git.stderr || "").trim() : "";
     res.status(status).json({
       error: {
-        code: err.code || "EGIT",
+        code: gitErrorCode(err),
         message: detail ? `${err.message}\n${detail}` : err.message,
       },
     });
@@ -1113,26 +1186,44 @@ function wait(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-/** Kill a lane run and wait for the tmux session to exit before touching its cwd. */
+/** Every tmux session a lane holds: its recorded `run_id` plus the extra
+ *  split-pane sessions (`agenthub-lane-<id>-<slot>`), which never touch it. */
+function laneRunIds(lane) {
+  const ids = new Set(
+    runs
+      .listRuns()
+      .filter((r) => r.laneId === lane.id)
+      .map((r) => r.id)
+  );
+  if (lane.run_id) ids.add(lane.run_id);
+  return [...ids];
+}
+
+/** Kill a lane's runs and wait for their tmux sessions to exit before touching its cwd. */
 async function stopLaneRun(lane) {
-  if (!lane.run_id) return;
-  try {
-    runs.killRun(lane.run_id);
-  } catch {
-    /* a concurrently completed run is already safe */
+  const ids = laneRunIds(lane);
+  if (ids.length === 0) return;
+  for (const id of ids) {
+    try {
+      runs.killRun(id);
+    } catch {
+      /* a concurrently completed run is already safe */
+    }
   }
 
   const deadline = Date.now() + RUN_EXIT_TIMEOUT_MS;
-  let run = runs.getRun(lane.run_id);
-  while (run && run.status !== "gone") {
-    if (Date.now() >= deadline) {
-      throw lifecycleError(
-        "ERUNTIMEOUT",
-        `lane run ${lane.run_id} did not exit within ${RUN_EXIT_TIMEOUT_MS / 1000} seconds`
-      );
+  for (const id of ids) {
+    let run = runs.getRun(id);
+    while (run && run.status !== "gone") {
+      if (Date.now() >= deadline) {
+        throw lifecycleError(
+          "ERUNTIMEOUT",
+          `lane run ${id} did not exit within ${RUN_EXIT_TIMEOUT_MS / 1000} seconds`
+        );
+      }
+      await wait(RUN_EXIT_POLL_MS);
+      run = runs.getRun(id);
     }
-    await wait(RUN_EXIT_POLL_MS);
-    run = runs.getRun(lane.run_id);
   }
   lanesLib.updateLane(lane.id, { run_id: null });
 }
@@ -1154,7 +1245,7 @@ function sendLifecycleError(res, err) {
   }
   if (err.git) {
     return res.status(500).json({
-      error: { code: err.code, message: err.message, stderr: err.git.stderr },
+      error: { code: gitErrorCode(err), message: err.message, stderr: err.git.stderr },
     });
   }
   return res.status(500).json({ error: { code: err.code, message: err.message } });
@@ -1207,6 +1298,16 @@ function sendRuntimeError(res, err) {
   });
 }
 
+/**
+ * The string `error.code` for an error that may have come out of `git()`.
+ * When git exits non-zero, execFile sets `err.code` to the exit STATUS (a
+ * number, e.g. 128); the client branches on string codes, so that becomes
+ * `EGIT`. A missing code (a timeout kill) is `EGIT` too; string codes pass.
+ */
+function gitErrorCode(err) {
+  return typeof err.code === "string" && err.code ? err.code : "EGIT";
+}
+
 /** Resolve `:id` or answer 404. Returns null once the response has been sent. */
 function laneOr404(req, res) {
   const lane = lanesLib.getLane(req.params.id);
@@ -1525,9 +1626,18 @@ router.post("/:id/:action", sameOriginGuard, async (req, res) => {
     }
   }
 
+  // The pane a `start` targets: 0 is the lane's own session (`run_id`), 1–3
+  // are the Workspace split panes' extra sessions on the same lane.
+  let startedRunId = null;
   try {
     switch (action) {
       case "start": {
+        const slot = body.slot === undefined ? 0 : body.slot;
+        if (!Number.isInteger(slot) || slot < 0 || slot > runs.MAX_PANE_SLOT) {
+          return res.status(400).json({
+            error: { code: "EBADSLOT", message: `slot must be an integer 0–${runs.MAX_PANE_SLOT}` },
+          });
+        }
         // Overwriting run_id while its child is alive orphans that child: a later
         // reset would kill and await only the RECORDED run, then `git clean -fd`
         // the directory the orphan is still writing into. Stop the first run before starting a
@@ -1541,12 +1651,14 @@ router.post("/:id/:action", sameOriginGuard, async (req, res) => {
           // waited for the lock — the lock makes that race visible instead of
           // spawning a run for a lane that no longer exists.
           if (!current) return { missing: true };
-          const live = current.run_id ? runs.getRun(current.run_id) : null;
+          const liveId = slot ? runs.runIdForLane(current.id, slot) : current.run_id;
+          const live = liveId ? runs.getRun(liveId) : null;
           if (live && live.status === "running") {
             return { conflict: true };
           }
           const handle = runs.spawnRun({
             laneId: current.id,
+            slot,
             initialPrompt: body.prompt || "",
             cwd: current.cwd,
             // The tool is the LANE's fact, never the request's: a client that
@@ -1564,7 +1676,10 @@ router.post("/:id/:action", sameOriginGuard, async (req, res) => {
             resumeLast: body.resumeLast === true,
             resumeSessionId: body.resumeSessionId || (body.resume ? current.session_id : undefined),
           });
-          lanesLib.updateLane(current.id, { run_id: handle.id, status: "running" });
+          startedRunId = handle.id;
+          // An extra pane's session is not the lane's run: `run_id` stays the
+          // pane-0 session every other path (reset, router restart) names.
+          if (!slot) lanesLib.updateLane(current.id, { run_id: handle.id, status: "running" });
           return {};
         });
         if (outcome.missing) {
@@ -1579,9 +1694,9 @@ router.post("/:id/:action", sameOriginGuard, async (req, res) => {
       }
       case "stop": {
         // A lane with no live run is already stopped — say so, don't 500.
-        if (lane.run_id) {
+        for (const id of laneRunIds(lane)) {
           try {
-            runs.killRun(lane.run_id);
+            runs.killRun(id);
           } catch {
             /* already gone */
           }
@@ -1615,7 +1730,10 @@ router.post("/:id/:action", sameOriginGuard, async (req, res) => {
   }
 
   broadcastLane(lane.id);
-  res.json({ lane: payload(lanesLib.getLane(lane.id)) });
+  res.json({
+    lane: payload(lanesLib.getLane(lane.id)),
+    ...(startedRunId ? { run_id: startedRunId } : {}),
+  });
 });
 
 router.delete("/:id", sameOriginGuard, (req, res) => {

server/routes/run.js

@@ -19,8 +19,11 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-const { Router } = require("express");
+const express = require("express");
+const { Router } = express;
 const fs = require("node:fs");
+const os = require("node:os");
+const crypto = require("node:crypto");
 const path = require("node:path");
 const runs = require("../lib/pty-run");
 const tmux = require("../lib/tmux");
@@ -81,6 +84,57 @@ router.get("/", (_req, res) => {
  * runs are first. Optional ?laneId=<n> narrows to the runs started through one
  * lane, which is what the Workspace page's per-lane history shows.
  */
+// ── Drag & drop into the terminal ─────────────────────────────────────────
+// A local terminal answers a dropped image by typing its PATH, which is how
+// `claude` attaches it. A browser has no path to give, so the image is saved
+// here — on the machine the pane runs on — and the client pastes this path.
+// Only the bytes come from the request: the name is random and the type picks
+// the extension from a fixed map, so a request never names a file.
+const DROP_TYPES = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/gif": "gif",
+  "image/webp": "webp",
+};
+const DROP_MAX_BYTES = 20 * 1024 * 1024;
+const DROP_TTL_MS = 24 * 60 * 60_000;
+const dropDir = () => path.join(os.tmpdir(), `agenthub-drops-${os.userInfo().uid}`);
+
+router.post(
+  "/drop-image",
+  express.raw({ type: Object.keys(DROP_TYPES), limit: DROP_MAX_BYTES }),
+  (req, res) => {
+    const ext =
+      DROP_TYPES[
+        String(req.headers["content-type"] || "")
+          .split(";")[0]
+          .trim()
+      ];
+    if (!ext || !Buffer.isBuffer(req.body) || req.body.length === 0) {
+      return res.status(400).json({ error: "png, jpeg, gif or webp image body required" });
+    }
+    try {
+      const dir = dropDir();
+      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+      // ponytail: prune-on-write, a day old; a sweep job only if drops pile up.
+      const cutoff = Date.now() - DROP_TTL_MS;
+      for (const name of fs.readdirSync(dir)) {
+        const f = path.join(dir, name);
+        try {
+          if (fs.statSync(f).mtimeMs < cutoff) fs.unlinkSync(f);
+        } catch {
+          /* raced with another prune — fine */
+        }
+      }
+      const file = path.join(dir, `${crypto.randomBytes(8).toString("hex")}.${ext}`);
+      fs.writeFileSync(file, req.body, { mode: 0o600, flag: "wx" });
+      res.json({ path: file });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  }
+);
+
 router.get("/history", (req, res) => {
   let dr = null;
   try {

server/websocket.js

@@ -80,7 +80,7 @@ function initWebSocket(server) {
 }
 
 let ptyWss = null;
-const PTY_PATH_RE = /^\/ws-pty\/(agenthub-lane-\d+)$/;
+const PTY_PATH_RE = /^\/ws-pty\/(agenthub-lane-\d+(?:-[1-3])?)$/;
 
 /**
  * The attaching terminal's own size, off the attach URL's query. tmux resizes