chore: v2.8.19 — avatar from a link the browser loads, Files groups workspaces by owner

- POST /api/me/avatar/url stores the https link (users.avatar_link) instead
  of downloading it; GET /api/me/avatar and /api/users/:id/avatar answer 302
  to it (no referrer). Link rules: https, no userinfo, <= 2048 chars, no
  localhost or private/reserved IP literal. Upload and link replace each other.
- Settings -> Account first loads the link as an embedded image and refuses
  one this browser cannot show: a picture behind a login (Mattermost's
  /api/v4/users/<id>/image) gets no cookie cross-site and 401s.
- Files sidebar: each workspace under its owner's home, chevrons remembered
  per browser (agenthub.files.homesOpen); ownerless ones stay flat.

bin/agenthub.js

@@ -2845,12 +2845,12 @@ const COMMAND_GROUPS = [
       ],
       [
         "server",
-        "setup|off|status [--hostname name] [--admin name]",
+        "setup|install-system|tools|off|status [--hostname name] [--admin name]",
         "Server mode: logins for a shared dashboard (docs/SERVER-MODE.md)",
       ],
       [
         "users",
-        "list|add|passwd|role|disable|enable|assign|audit [name]",
+        "list|add|passwd|role|disable|enable|provision|assign|audit [name]",
         "Server mode's accounts (add: --role admin|analyst|developer)",
       ],
       [
@@ -3812,8 +3812,8 @@ const COMMANDS = (() => {
 const SUBCOMMANDS = {
   alerts: ["ack", "ack-all"],
   service: ["install", "uninstall", "status"],
-  server: ["setup", "off", "status"],
-  users: ["list", "add", "passwd", "role", "disable", "enable", "assign", "audit"],
+  server: ["setup", "install-system", "tools", "off", "status"],
+  users: ["list", "add", "passwd", "role", "disable", "enable", "provision", "assign", "audit"],
   accounts: ["list", "add", "remove", "pin", "unpin"],
   pricing: ["set", "delete", "reset"],
   webhooks: ["test"],
@@ -3905,7 +3905,7 @@ async function newPassword(label) {
   return first;
 }
 
-/** `agenthub server setup|off|status` — turn server mode on or off. */
+/** `agenthub server setup|install-system|tools|off|status` — turn server mode on or off. */
 async function cmdServer(sub, flags) {
   const { settingsEnv, auth } = serverAuth();
   const file = settingsEnv.settingsFilePath();
@@ -4062,7 +4062,7 @@ async function installSystem(flags, settingsEnv) {
     throw new Error("run this as the account that runs the dashboard, not as root (it uses sudo)");
   }
   const which = (bin) =>
-    spawnSync("sh", ["-c", `command -v ${bin}`], { encoding: "utf8" }).stdout.trim();
+    spawnSync("sh", ["-c", 'command -v "$1"', "sh", bin], { encoding: "utf8" }).stdout.trim();
   const host = os.userInfo().username;
   const { getDataDir } = require(path.join(REPO_ROOT, "server", "lib", "claude-home.js"));
   const data = getDataDir();
@@ -4166,14 +4166,25 @@ async function cmdUsers(sub, positional, flags) {
     case "list":
       table(
         ["id", "username", "role", "state"],
-        auth.listUsers().map((u) => [u.id, u.username, u.role, u.disabled ? "disabled" : "active"])
+        auth
+          .listUsers()
+          .map((u) => [
+            u.id,
+            u.username,
+            u.role,
+            u.disabled ? "disabled" : u.mustChangePassword ? "active (new password due)" : "active",
+          ])
       );
       return;
     case "add": {
       need();
       const role = typeof flags.role === "string" ? flags.role : "developer";
-      const user = await auth.createUser(name, await newPassword(`Password for ${name}`), role);
-      console.log(`${c.green("✔")} ${user.username} added (${user.role})`);
+      const user = await auth.createUser(name, await newPassword(`Password for ${name}`), role, {
+        mustChange: true,
+      });
+      console.log(
+        `${c.green("✔")} ${user.username} added (${user.role}) — they choose their own password at first login`
+      );
       return;
     }
     case "passwd":

client/package-lock.json

@@ -29,7 +29,7 @@
         "react-dom": "^18.3.1",
         "react-i18next": "^17.0.4",
         "react-markdown": "^10.1.0",
-        "react-router-dom": "^6.28.2",
+        "react-router-dom": "^7.18.4",
         "remark-gfm": "^4.0.1"
       },
       "devDependencies": {
@@ -1251,15 +1251,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/@remix-run/router": {
-      "version": "1.23.4",
-      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.4.tgz",
-      "integrity": "sha512-q7j5geK7xs3UJSdm9/iytUNclBnLmYx1EnSeCFXHPeutdqgIMeFeHtUZgS3EhlKxdBEAu8OwtJCwmLrEzpSs7Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
     "node_modules/@rolldown/pluginutils": {
       "version": "1.0.0-beta.27",
       "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-beta.27.tgz",
@@ -2740,6 +2731,18 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/cookie": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/crelt": {
       "version": "1.0.7",
       "resolved": "https://registry.npmjs.org/crelt/-/crelt-1.0.7.tgz",
@@ -5472,35 +5475,39 @@
       }
     },
     "node_modules/react-router": {
-      "version": "6.30.6",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.30.6.tgz",
-      "integrity": "sha512-5HfK7k5im7LTOB0EqCQmfvy4C13G92Ssj1VTmouTK3AJvyjKTnFuCV0vcMAD/JS+JC4DvDIBRrlAeJIFjh5VWg==",
-      "license": "MIT",
+      "version": "7.18.4",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.4.tgz",
+      "integrity": "sha512-PUPQcMhMGRAslLcvtlPz/kmzBEWPhLdgLFrL7pLNepBL6dX0lWj4WD2cUYVgYCuT3jxvghYFg81cDTj44DhetQ==",
       "dependencies": {
-        "@remix-run/router": "1.23.4"
+        "cookie": "^1.0.1",
+        "set-cookie-parser": "^2.6.0"
       },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=20.0.0"
       },
       "peerDependencies": {
-        "react": ">=16.8"
+        "react": ">=18",
+        "react-dom": ">=18"
+      },
+      "peerDependenciesMeta": {
+        "react-dom": {
+          "optional": true
+        }
       }
     },
     "node_modules/react-router-dom": {
-      "version": "6.30.6",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.30.6.tgz",
-      "integrity": "sha512-0RHKZz7wwffvkU+2MFVT2NnjK44ssLEV+m0CAJaS2Ksmorrwj7WxH00jO0SOCW26/tINUnJHToXblDs33I38YQ==",
-      "license": "MIT",
+      "version": "7.18.4",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.4.tgz",
+      "integrity": "sha512-yrfmJHIpDG7taCpqKjT1G5B6q3O2K+RN8/fgNf0lTjCwiPbQ0ei6vXX9ZjQR+7ld8Tr7Z5xmyMnZ8YJrphWQUw==",
       "dependencies": {
-        "@remix-run/router": "1.23.4",
-        "react-router": "6.30.6"
+        "react-router": "7.18.4"
       },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=20.0.0"
       },
       "peerDependencies": {
-        "react": ">=16.8",
-        "react-dom": ">=16.8"
+        "react": ">=18",
+        "react-dom": ">=18"
       }
     },
     "node_modules/read-cache": {
@@ -5766,6 +5773,11 @@
         "semver": "bin/semver.js"
       }
     },
+    "node_modules/set-cookie-parser": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
+      "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw=="
+    },
     "node_modules/siginfo": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",

client/package.json

@@ -32,7 +32,7 @@
     "react-dom": "^18.3.1",
     "react-i18next": "^17.0.4",
     "react-markdown": "^10.1.0",
-    "react-router-dom": "^6.28.2",
+    "react-router-dom": "^7.18.4",
     "remark-gfm": "^4.0.1"
   },
   "devDependencies": {

client/src/components/AuthCard.tsx

@@ -0,0 +1,64 @@
+/**
+ * @file AuthCard.tsx
+ * @description The card the signed-out screens share (the login page, the
+ * first-login password change in `FirstPasswordPage.tsx`): a centred form
+ * with the theme's accent glow and grid behind the brand logo, a title and a
+ * subtitle. While it shows, the OS's light/dark applies (`applySystemTheme`),
+ * since no account's theme has been chosen for it.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useLayoutEffect, type FormEvent, type ReactNode } from "react";
+import { BRAND_LOGO } from "../lib/brand";
+import { applySystemTheme } from "../hooks/useTheme";
+
+export function AuthCard({
+  title,
+  subtitle,
+  onSubmit,
+  children,
+}: {
+  title: string;
+  subtitle: string;
+  onSubmit: (e: FormEvent) => void;
+  children: ReactNode;
+}) {
+  // Follow the OS, live.
+  useLayoutEffect(() => {
+    applySystemTheme();
+    const mq = window.matchMedia?.("(prefers-color-scheme: dark)");
+    mq?.addEventListener?.("change", applySystemTheme);
+    return () => mq?.removeEventListener?.("change", applySystemTheme);
+  }, []);
+
+  return (
+    <main className="flex min-h-screen items-center justify-center bg-surface-0 p-4">
+      <form
+        onSubmit={onSubmit}
+        className="card relative w-full max-w-md overflow-hidden px-6 pb-8 pt-12 sm:px-10"
+      >
+        {/* Accent glow and a grid fading out from the top, drawn from the
+            theme's own accent so it holds in every theme. */}
+        <div
+          aria-hidden
+          className="pointer-events-none absolute inset-x-0 top-0 h-56"
+          style={{
+            backgroundImage:
+              "linear-gradient(to right, rgb(var(--accent) / 0.12) 1px, transparent 1px), linear-gradient(to bottom, rgb(var(--accent) / 0.12) 1px, transparent 1px), radial-gradient(ellipse at top, rgb(var(--accent) / 0.16), transparent 70%)",
+            backgroundSize: "48px 48px, 48px 48px, 100% 100%",
+            backgroundPosition: "center top",
+            maskImage: "radial-gradient(ellipse 70% 100% at top, black 30%, transparent 100%)",
+          }}
+        />
+        <div className="relative space-y-5">
+          <div className="text-center">
+            <img src={BRAND_LOGO} alt="SmartGift" className="block h-auto w-full" />
+            <h1 className="mt-5 text-3xl font-semibold tracking-tight text-fg-primary">{title}</h1>
+            <p className="mt-2 text-sm text-fg-secondary">{subtitle}</p>
+          </div>
+          {children}
+        </div>
+      </form>
+    </main>
+  );
+}

client/src/components/AuthGate.tsx

@@ -11,7 +11,9 @@
  * `usePermissions()` says what that user's role may do, so pages hide the rest.
  * Once an account is known (local mode is one), its own UI preferences are
  * loaded into this browser (`lib/userPrefs.ts`).
- * The login page follows the OS's light/dark (`applySystemTheme`).
+ * The login page follows the OS's light/dark (`AuthCard`). An account whose
+ * password an admin gave (`mustChangePassword`) sees only
+ * `FirstPasswordPage` until it picks its own.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -20,15 +22,14 @@ import {
   useCallback,
   useContext,
   useEffect,
-  useLayoutEffect,
   useState,
   type FormEvent,
   type ReactNode,
 } from "react";
 import { useTranslation } from "react-i18next";
 import { Eye, EyeOff } from "lucide-react";
-import { BRAND_LOGO } from "../lib/brand";
-import { applySystemTheme } from "../hooks/useTheme";
+import { AuthCard } from "./AuthCard";
+import { FirstPasswordPage } from "./FirstPasswordPage";
 import { api, AUTH_REQUIRED_EVENT, type AuthState, type AuthUser } from "../lib/api";
 import { hydrate } from "../lib/userPrefs";
 
@@ -165,6 +166,17 @@ export function AuthGate({ children }: { children: ReactNode }) {
     await api.auth.logout().catch(() => {});
     setState({ mode: "server", user: null });
   };
+  // A password an admin gave: nothing else until the user picks their own
+  // (the server refuses the rest anyway — EPWCHANGE).
+  if (state.mode === "server" && state.user?.mustChangePassword) {
+    return (
+      <FirstPasswordPage
+        user={state.user}
+        onDone={() => updateUser({ mustChangePassword: false })}
+        onLogout={() => void logout()}
+      />
+    );
+  }
   return (
     <AuthContext.Provider value={{ state, logout, updateUser }}>{children}</AuthContext.Provider>
   );
@@ -178,14 +190,6 @@ function LoginPage({ onLoggedIn }: { onLoggedIn: (user: AuthUser) => void }) {
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
-  // Nobody is signed in, so no account's theme applies: follow the OS, live.
-  useLayoutEffect(() => {
-    applySystemTheme();
-    const mq = window.matchMedia?.("(prefers-color-scheme: dark)");
-    mq?.addEventListener?.("change", applySystemTheme);
-    return () => mq?.removeEventListener?.("change", applySystemTheme);
-  }, []);
-
   const submit = async (e: FormEvent) => {
     e.preventDefault();
     setBusy(true);
@@ -201,86 +205,60 @@ function LoginPage({ onLoggedIn }: { onLoggedIn: (user: AuthUser) => void }) {
     }
   };
 
+  // Nobody is signed in, so no account's theme applies: AuthCard follows the OS.
   return (
-    <main className="flex min-h-screen items-center justify-center bg-surface-0 p-4">
-      <form
-        onSubmit={submit}
-        className="card relative w-full max-w-md overflow-hidden px-6 pb-8 pt-12 sm:px-10"
-      >
-        {/* Accent glow and a grid fading out from the top, drawn from the
-            theme's own accent so it holds in every theme. */}
-        <div
-          aria-hidden
-          className="pointer-events-none absolute inset-x-0 top-0 h-56"
-          style={{
-            backgroundImage:
-              "linear-gradient(to right, rgb(var(--accent) / 0.12) 1px, transparent 1px), linear-gradient(to bottom, rgb(var(--accent) / 0.12) 1px, transparent 1px), radial-gradient(ellipse at top, rgb(var(--accent) / 0.16), transparent 70%)",
-            backgroundSize: "48px 48px, 48px 48px, 100% 100%",
-            backgroundPosition: "center top",
-            maskImage: "radial-gradient(ellipse 70% 100% at top, black 30%, transparent 100%)",
-          }}
+    <AuthCard title={t("auth.title")} subtitle={t("auth.subtitle")} onSubmit={submit}>
+      <label className="block space-y-1.5 text-sm font-medium text-fg-primary">
+        <span>{t("auth.username")}</span>
+        <input
+          className="input h-11 w-full px-4"
+          autoComplete="username"
+          autoFocus
+          required
+          placeholder={t("auth.username")}
+          value={username}
+          onChange={(e) => setUsername(e.target.value)}
         />
-        <div className="relative space-y-5">
-          <div className="text-center">
-            <img src={BRAND_LOGO} alt="SmartGift" className="block h-auto w-full" />
-            <h1 className="mt-5 text-3xl font-semibold tracking-tight text-fg-primary">
-              {t("auth.title")}
-            </h1>
-            <p className="mt-2 text-sm text-fg-secondary">{t("auth.subtitle")}</p>
-          </div>
-          <label className="block space-y-1.5 text-sm font-medium text-fg-primary">
-            <span>{t("auth.username")}</span>
-            <input
-              className="input h-11 w-full px-4"
-              autoComplete="username"
-              autoFocus
-              required
-              placeholder={t("auth.username")}
-              value={username}
-              onChange={(e) => setUsername(e.target.value)}
-            />
-          </label>
-          <div className="space-y-1.5 text-sm font-medium text-fg-primary">
-            <label htmlFor="login-password">{t("auth.password")}</label>
-            <div className="relative">
-              <input
-                id="login-password"
-                className="input h-11 w-full pl-4 pr-11"
-                type={showPassword ? "text" : "password"}
-                autoComplete="current-password"
-                required
-                placeholder="••••••••"
-                value={password}
-                onChange={(e) => setPassword(e.target.value)}
-              />
-              <button
-                type="button"
-                onClick={() => setShowPassword((v) => !v)}
-                aria-label={showPassword ? t("auth.hidePassword") : t("auth.showPassword")}
-                aria-pressed={showPassword}
-                className="absolute inset-y-0 right-0 flex w-11 items-center justify-center rounded-r-lg text-fg-muted hover:text-fg-primary focus:outline-none focus-visible:ring-2 focus-visible:ring-accent"
-              >
-                {showPassword ? <EyeOff className="h-4 w-4" /> : <Eye className="h-4 w-4" />}
-              </button>
-            </div>
-          </div>
-          {error && (
-            <p role="alert" className="text-sm text-status-danger">
-              {error}
-            </p>
-          )}
-          {/* Inverted fill (text colour behind the surface colour): black in a
-              light theme, light in a dark one, like the reference design. */}
+      </label>
+      <div className="space-y-1.5 text-sm font-medium text-fg-primary">
+        <label htmlFor="login-password">{t("auth.password")}</label>
+        <div className="relative">
+          <input
+            id="login-password"
+            className="input h-11 w-full pl-4 pr-11"
+            type={showPassword ? "text" : "password"}
+            autoComplete="current-password"
+            required
+            placeholder="••••••••"
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+          />
           <button
-            type="submit"
-            className="h-11 w-full rounded-xl bg-fg-primary text-sm font-medium text-surface-0 shadow-sm transition-opacity hover:opacity-90 focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-2 focus-visible:ring-offset-surface-0 disabled:cursor-not-allowed disabled:opacity-50"
-            disabled={busy}
+            type="button"
+            onClick={() => setShowPassword((v) => !v)}
+            aria-label={showPassword ? t("auth.hidePassword") : t("auth.showPassword")}
+            aria-pressed={showPassword}
+            className="absolute inset-y-0 right-0 flex w-11 items-center justify-center rounded-r-lg text-fg-muted hover:text-fg-primary focus:outline-none focus-visible:ring-2 focus-visible:ring-accent"
           >
-            {busy ? t("auth.submitting") : t("auth.submit")}
+            {showPassword ? <EyeOff className="h-4 w-4" /> : <Eye className="h-4 w-4" />}
           </button>
-          <p className="text-center text-sm text-fg-secondary">{t("auth.noAccount")}</p>
         </div>
-      </form>
-    </main>
+      </div>
+      {error && (
+        <p role="alert" className="text-sm text-status-danger">
+          {error}
+        </p>
+      )}
+      {/* Inverted fill (text colour behind the surface colour): black in a
+              light theme, light in a dark one, like the reference design. */}
+      <button
+        type="submit"
+        className="h-11 w-full rounded-xl bg-fg-primary text-sm font-medium text-surface-0 shadow-sm transition-opacity hover:opacity-90 focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-2 focus-visible:ring-offset-surface-0 disabled:cursor-not-allowed disabled:opacity-50"
+        disabled={busy}
+      >
+        {busy ? t("auth.submitting") : t("auth.submit")}
+      </button>
+      <p className="text-center text-sm text-fg-secondary">{t("auth.noAccount")}</p>
+    </AuthCard>
   );
 }

client/src/components/FirstPasswordPage.tsx

@@ -0,0 +1,110 @@
+/**
+ * @file FirstPasswordPage.tsx
+ * @description The screen an account signed in with a password an admin GAVE
+ * (created or reset on the Users page — `mustChangePassword`) sees instead of
+ * the app: the current password, a new one that must pass every rule (the
+ * `PasswordRules` checklist ticks them as they are typed) and the same again,
+ * sent to `POST /api/me/password`. On success the app opens; "Sign out"
+ * leaves. The server refuses every other request meanwhile (EPWCHANGE).
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useState, type FormEvent } from "react";
+import { useTranslation } from "react-i18next";
+import { api, type AuthUser } from "../lib/api";
+import { passwordProblems } from "../lib/passwordRules";
+import { AuthCard } from "./AuthCard";
+import { PasswordRules } from "./users/PasswordRules";
+
+export function FirstPasswordPage({
+  user,
+  onDone,
+  onLogout,
+}: {
+  user: AuthUser;
+  onDone: () => void;
+  onLogout: () => void;
+}) {
+  const { t } = useTranslation();
+  const [current, setCurrent] = useState("");
+  const [next, setNext] = useState("");
+  const [again, setAgain] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const mismatch = again.length > 0 && again !== next;
+  const strong = passwordProblems(next, user.username).length === 0;
+  const ready = current.length > 0 && strong && again === next && !busy;
+
+  const submit = async (e: FormEvent) => {
+    e.preventDefault();
+    if (!ready) return;
+    setBusy(true);
+    setError(null);
+    try {
+      await api.me.changePassword(current, next);
+      onDone();
+    } catch (err) {
+      const code = (err as { code?: string }).code;
+      setError(
+        code && t(`users:errors.${code}`, { defaultValue: "" })
+          ? t(`users:errors.${code}`)
+          : (err as Error).message
+      );
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const field = (
+    label: string,
+    value: string,
+    set: (v: string) => void,
+    autoComplete: string,
+    autoFocus = false
+  ) => (
+    <label className="block space-y-1.5 text-sm font-medium text-fg-primary">
+      <span>{label}</span>
+      <input
+        type="password"
+        className="input h-11 w-full px-4"
+        autoComplete={autoComplete}
+        autoFocus={autoFocus}
+        required
+        value={value}
+        onChange={(e) => set(e.target.value)}
+      />
+    </label>
+  );
+
+  return (
+    <AuthCard
+      title={t("auth.mustChangeTitle")}
+      subtitle={t("auth.mustChangeSubtitle")}
+      onSubmit={submit}
+    >
+      {field(t("auth.currentPassword"), current, setCurrent, "current-password", true)}
+      {field(t("auth.newPassword"), next, setNext, "new-password")}
+      <PasswordRules password={next} username={user.username} />
+      {field(t("auth.confirmPassword"), again, setAgain, "new-password")}
+      {(mismatch || error) && (
+        <p role="alert" className="text-sm text-status-danger">
+          {error ?? t("auth.mismatch")}
+        </p>
+      )}
+      <button
+        type="submit"
+        className="h-11 w-full rounded-xl bg-fg-primary text-sm font-medium text-surface-0 shadow-sm transition-opacity hover:opacity-90 focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-2 focus-visible:ring-offset-surface-0 disabled:cursor-not-allowed disabled:opacity-50"
+        disabled={!ready}
+      >
+        {busy ? t("auth.saving") : t("auth.mustChangeSubmit")}
+      </button>
+      <button
+        type="button"
+        className="block w-full text-center text-sm text-fg-secondary hover:text-fg-primary"
+        onClick={onLogout}
+      >
+        {t("auth.logout")}
+      </button>
+    </AuthCard>
+  );
+}

client/src/components/ImageLightbox.tsx

@@ -4,12 +4,14 @@
  * Escape closes it. Rendered into `document.body`, so no pane, its stacking
  * layer or a header drawn over a pane can cover it — opened from inside a
  * pane's Chat view, a `fixed` overlay would otherwise stay in that pane's
- * layer, under anything stacked above it.
+ * layer, under anything stacked above it. `useDialog` takes the focus while it
+ * is open and gives it back, and its Escape closes only this, the top dialog.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
-import { useEffect } from "react";
+import { useRef } from "react";
 import { createPortal } from "react-dom";
+import { useDialog } from "../hooks/useDialog";
 
 export function ImageLightbox({
   src,
@@ -20,18 +22,18 @@ export function ImageLightbox({
   alt: string;
   onClose: () => void;
 }) {
-  useEffect(() => {
-    const onKey = (e: KeyboardEvent) => e.key === "Escape" && onClose();
-    document.addEventListener("keydown", onKey);
-    return () => document.removeEventListener("keydown", onKey);
-  }, [onClose]);
+  const panel = useRef<HTMLDivElement>(null);
+  useDialog(true, panel, onClose);
   return createPortal(
     <div
+      ref={panel}
+      tabIndex={-1}
       role="dialog"
+      aria-modal="true"
       aria-label={alt}
       data-testid="image-lightbox"
       onClick={onClose}
-      className="fixed inset-0 z-[200] flex cursor-zoom-out items-center justify-center bg-black/60 p-8"
+      className="fixed inset-0 z-[200] flex cursor-zoom-out items-center justify-center bg-black/60 p-8 outline-none"
     >
       <img
         src={src}

client/src/components/ImportHistory.tsx

@@ -82,6 +82,7 @@ import { api, type ImportResult, type ImportBackupResult } from "../lib/api";
 import { eventBus } from "../lib/eventBus";
 import type { WSMessage, ImportProgressMessage } from "../lib/types";
 import { PathPickButton } from "./PathPickButton";
+import { copyText } from "../lib/clipboard";
 
 type Mode = "rescan" | "path" | "upload" | "backup";
 
@@ -247,13 +248,9 @@ export function ImportHistory() {
 
   const copyArchiveCmd = async () => {
     if (!guide) return;
-    try {
-      await navigator.clipboard.writeText(guide.archive_command);
-      setCopied(true);
-      setTimeout(() => setCopied(false), 1500);
-    } catch {
-      /* clipboard unavailable */
-    }
+    if (!(await copyText(guide.archive_command, true))) return;
+    setCopied(true);
+    setTimeout(() => setCopied(false), 1500);
   };
 
   const progressText = (() => {

client/src/components/RemoteSources.tsx

@@ -88,6 +88,7 @@ import { isRemoteDataRefreshMessage } from "../lib/remoteDataEvents";
 import { useDataScope } from "../lib/dataScope";
 import type { ScopeMode } from "../lib/dataScope";
 import { PathPickButton } from "./PathPickButton";
+import { copyText } from "../lib/clipboard";
 
 /** Data-scope choices in display order (the radio group's arrow-key order). */
 const SCOPE_MODES: ScopeMode[] = ["all", "local", "selected"];
@@ -863,7 +864,7 @@ export function RemoteSources() {
                   : t("remoteSources.enable", "Enable")}
               </MenuItem>
               <MenuItem onSelect={pick(openEdit)}>{t("common:edit", "Edit")}</MenuItem>
-              <MenuItem onSelect={pick((s) => void navigator.clipboard.writeText(s.host))}>
+              <MenuItem onSelect={pick((s) => void copyText(s.host))}>
                 {t("rowMenu.copyHost")}
               </MenuItem>
               <MenuSeparator />

client/src/components/Sagi/SagiInfo.tsx

@@ -24,6 +24,7 @@ import {
 import { useTranslation } from "react-i18next";
 import { subjectLabel, type AttentionItem, type SagiStatus, type SagiSubject } from "./brain";
 import { PET_NAME_MAX } from "./prefs";
+import { isSubmitEnter } from "../../lib/keys";
 
 /** How many sessions the "Needs you" list shows before pointing at Sessions. */
 const ATTENTION_SHOWN = 4;
@@ -70,7 +71,7 @@ export function PetNameButton({
       onChange={(e) => setRenaming(e.target.value)}
       onBlur={save}
       onKeyDown={(e) => {
-        if (e.key === "Enter") {
+        if (isSubmitEnter(e)) {
           e.preventDefault();
           save();
         } else if (e.key === "Escape") {

client/src/components/SnapshotButton.tsx

@@ -14,6 +14,7 @@ import { api } from "../lib/api";
 import { ConfirmModal } from "./ConfirmModal";
 import { Checkbox } from "./Checkbox";
 import { CopyButton } from "./event-views/primitives";
+import { copyText } from "../lib/clipboard";
 
 export function snapshotUrl(token: string): string {
   return `${window.location.origin}/snapshot/${token}`;
@@ -33,7 +34,7 @@ export function SnapshotButton({ sessionId }: { sessionId: string }) {
     try {
       const { snapshot } = await api.snapshots.create(sessionId, { filePaths: redact });
       setToken(snapshot.token);
-      navigator.clipboard?.writeText(snapshotUrl(snapshot.token)).catch(() => undefined);
+      void copyText(snapshotUrl(snapshot.token));
     } catch (err) {
       setError(err instanceof Error ? err.message : String(err));
     } finally {

client/src/components/__tests__/AuthGate.test.tsx

@@ -6,7 +6,9 @@
  * `useWorkLanes` mirror the server's roles: an admin changes everything, an
  * analyst reads everything but works only in their own workspaces, a
  * developer only ever sees (and so changes) their own. The login page wears the
- * OS's light/dark; a sign-in swaps in the account's saved appearance.
+ * OS's light/dark; a sign-in swaps in the account's saved appearance. A
+ * password an admin gave shows only the "choose your own password" page,
+ * whose button waits for every rule, until the change succeeds.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -18,6 +20,7 @@ import "../../i18n";
 const me = vi.fn();
 const login = vi.fn();
 const prefs = vi.fn();
+const changePassword = vi.fn();
 const LANES = [
   { id: 1, owner_id: 5 },
   { id: 2, owner_id: 6 },
@@ -27,7 +30,11 @@ vi.mock("../../lib/api", () => ({
   api: {
     auth: { me: () => me(), login: (u: string, p: string) => login(u, p), logout: vi.fn() },
     lanes: { list: () => Promise.resolve({ lanes: LANES }) },
-    me: { prefs: () => prefs(), savePrefs: () => Promise.resolve({ prefs: {} }) },
+    me: {
+      prefs: () => prefs(),
+      savePrefs: () => Promise.resolve({ prefs: {} }),
+      changePassword: (c: string, n: string) => changePassword(c, n),
+    },
   },
 }));
 
@@ -56,10 +63,30 @@ beforeEach(() => {
   me.mockReset();
   login.mockReset();
   prefs.mockReset().mockResolvedValue({ prefs: {} });
+  changePassword.mockReset().mockResolvedValue({ ok: true });
   localStorage.clear();
 });
 
 describe("AuthGate", () => {
+  it("makes an account with an admin-given password choose its own first", async () => {
+    const ue = userEvent.setup();
+    me.mockResolvedValue({ mode: "server", user: { ...user, mustChangePassword: true } });
+    render(<AuthGate>app</AuthGate>);
+    const save = await screen.findByRole("button", { name: "Save and continue" });
+    expect(screen.queryByText("app")).toBeNull();
+    await ue.type(screen.getByLabelText("Current password"), "123");
+    await ue.type(screen.getByLabelText("New password"), "weakpass");
+    await ue.type(screen.getByLabelText("Confirm new password"), "weakpass");
+    expect(save).toBeDisabled();
+    await ue.clear(screen.getByLabelText("New password"));
+    await ue.clear(screen.getByLabelText("Confirm new password"));
+    await ue.type(screen.getByLabelText("New password"), "Green-Tea-42");
+    await ue.type(screen.getByLabelText("Confirm new password"), "Green-Tea-42");
+    await ue.click(save);
+    expect(changePassword).toHaveBeenCalledWith("123", "Green-Tea-42");
+    expect(await screen.findByText("app")).toBeInTheDocument();
+  });
+
   it("renders the app in local mode", async () => {
     me.mockResolvedValue({ mode: "local" });
     render(<AuthGate>app</AuthGate>);

client/src/components/__tests__/MarkdownPreview.test.tsx

@@ -58,14 +58,25 @@ describe("MarkdownPreview", () => {
 describe("FileViewer — markdown preview", () => {
   const data = { text: "# Hello\n", truncated: false } as never;
 
-  it("switches a markdown file between raw and preview", async () => {
+  it("opens a markdown file rendered, and switches it to raw and back", async () => {
     render(<FileViewer state={{ path: "/x/CLAUDE.md", data, error: null }} onClose={vi.fn()} />);
+    expect(screen.getByRole("heading", { name: "Hello" })).toBeInTheDocument();
+    await userEvent.click(screen.getByRole("button", { name: "Raw" }));
     expect(screen.queryByTestId("markdown-preview")).toBeNull();
     expect(screen.getByText("# Hello")).toBeInTheDocument();
     await userEvent.click(screen.getByRole("button", { name: "Preview" }));
     expect(screen.getByRole("heading", { name: "Hello" })).toBeInTheDocument();
-    await userEvent.click(screen.getByRole("button", { name: "Raw" }));
-    expect(screen.queryByTestId("markdown-preview")).toBeNull();
+  });
+
+  it("opens it as source when Settings → Appearance says Raw", () => {
+    window.localStorage.setItem("agenthub.markdown.view", "raw");
+    try {
+      render(<FileViewer state={{ path: "/x/CLAUDE.md", data, error: null }} onClose={vi.fn()} />);
+      expect(screen.queryByTestId("markdown-preview")).toBeNull();
+      expect(screen.getByText("# Hello")).toBeInTheDocument();
+    } finally {
+      window.localStorage.removeItem("agenthub.markdown.view");
+    }
   });
 
   it("offers no preview for another file type", () => {

client/src/components/__tests__/StatusBar.test.tsx

@@ -238,7 +238,7 @@ describe("StatusBar", () => {
     expect(work).toHaveTextContent("5h95%Resets in 41m");
     expect(work).toHaveTextContent("Week32%");
     expect(personal).toHaveTextContent("home@example.com · Sign-in expired");
-    expect(personal).toHaveTextContent("Check quota in Claude Code → Profiles");
+    expect(personal).toHaveTextContent("Check quota in Settings → AI tools → Profiles");
     expect(personal).not.toHaveTextContent("in use");
     expect(codex).toHaveTextContent("dev@example.com");
     expect(codex).toHaveTextContent("Sign-in expired");

client/src/components/artifacts/ArtifactAddPanels.tsx

@@ -20,7 +20,7 @@
 
 import { useEffect, useMemo, useRef, useState, type DragEvent } from "react";
 import { useTranslation } from "react-i18next";
-import { FileText, FolderOpen, Package, Sparkles, Upload, X } from "lucide-react";
+import { X } from "lucide-react";
 import { api, type MarketplaceInfo } from "../../lib/api";
 import type { Lane } from "../../lib/types";
 import { toast } from "../../lib/toast";
@@ -374,7 +374,6 @@ export function SkillAddPanel({
               dragging ? "border-accent bg-accent/10" : "border-border"
             }`}
           >
-            <Upload className="mx-auto mb-1 h-5 w-5 text-fg-muted" />
             <p className="text-xs text-fg-secondary">{t("skill.dropHint")}</p>
             <div className="mt-2 flex flex-wrap justify-center gap-2">
               <button
@@ -382,14 +381,14 @@ export function SkillAddPanel({
                 className="btn-ghost text-xs"
                 onClick={() => fileInput.current?.click()}
               >
-                <FileText className="h-3.5 w-3.5" /> {t("skill.pickFiles")}
+                {t("skill.pickFiles")}
               </button>
               <button
                 type="button"
                 className="btn-ghost text-xs"
                 onClick={() => folderInput.current?.click()}
               >
-                <FolderOpen className="h-3.5 w-3.5" /> {t("skill.pickFolder")}
+                {t("skill.pickFolder")}
               </button>
             </div>
             <input
@@ -569,7 +568,6 @@ export function SkillAddPanel({
             <ul className="max-h-72 space-y-0.5 overflow-auto">
               {skills.map((s) => (
                 <li key={`${s.from}:${s.name}`} className="flex items-center gap-2 text-xs">
-                  <Sparkles className="h-3 w-3 shrink-0 text-fg-muted" />
                   <span className="min-w-0 flex-1 truncate text-fg-secondary">{s.name}</span>
                   <span className="text-fg-muted">
                     {t(s.from === "user" ? "form.fromUser" : "form.fromWorkspace")}
@@ -746,10 +744,7 @@ export function PluginAddPanel({ onAdded, onClose }: { onAdded: () => void; onCl
       {info && (
         <div className="space-y-2" data-testid="market-plugins">
           <div>
-            <p className="text-sm font-medium text-fg-primary">
-              <Package className="mr-1 inline h-4 w-4 text-fg-muted" />
-              {info.name}
-            </p>
+            <p className="text-sm font-medium text-fg-primary">{info.name}</p>
             {info.description && <p className={hint}>{info.description}</p>}
           </div>
           {info.plugins.length === 0 ? (
@@ -949,7 +944,7 @@ export function FileUploadPanel({ onAdded }: { onAdded: () => void }) {
           className="btn-primary shrink-0 text-sm"
           disabled={busy || !file || tooBig}
         >
-          <Upload className="h-3.5 w-3.5" /> {t("file.upload")}
+          {t("file.upload")}
         </button>
       </div>
     </form>

client/src/components/config/FileViewer.tsx

@@ -4,7 +4,8 @@
  * already-fetched data as props (path/data/error) rather than fetching
  * itself, so it stays tool-agnostic — the orchestrator (Claude or Codex
  * config page) owns the fetch. A markdown file gets a Raw / Preview switch
- * (`MarkdownPreview`); Raw is the default.
+ * (`MarkdownPreview`), opening as Settings → Appearance says
+ * (`lib/markdownView.ts`: Preview by default).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -15,6 +16,7 @@ import { FileText, X, AlertCircle, Eye, Code2 } from "lucide-react";
 import type { CcFileResponse } from "../../lib/api";
 import { CopyButton } from "./configPrimitives";
 import { MarkdownPreview, isMarkdown } from "../MarkdownPreview";
+import { readMarkdownPreview } from "../../lib/markdownView";
 
 export function FileViewer({
   state,
@@ -24,7 +26,7 @@ export function FileViewer({
   onClose: () => void;
 }) {
   const { t } = useTranslation("ccConfig");
-  const [preview, setPreview] = useState(false);
+  const [preview, setPreview] = useState(readMarkdownPreview);
   const canPreview = isMarkdown(state.path) && !!state.data;
   const panelRef = useRef<HTMLDivElement>(null);
   useDialog(true, panelRef, onClose);

client/src/components/event-views/primitives.tsx

@@ -103,6 +103,7 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Copy, Check } from "lucide-react";
+import { copyText } from "../../lib/clipboard";
 
 // ───────────────────────── Copy button ─────────────────────────
 
@@ -111,13 +112,9 @@ export function CopyButton({ text }: { text: string }) {
   const [copied, setCopied] = useState(false);
 
   async function copy() {
-    try {
-      await navigator.clipboard.writeText(text);
-      setCopied(true);
-      setTimeout(() => setCopied(false), 1500);
-    } catch {
-      // Clipboard API can fail in insecure contexts - silently ignore.
-    }
+    if (!(await copyText(text, true))) return;
+    setCopied(true);
+    setTimeout(() => setCopied(false), 1500);
   }
 
   return (

client/src/components/lanes/FileExplorer.tsx

@@ -22,6 +22,9 @@
  * another user's. An admin's Trash opens on one folder per user (with its
  * item count); each folder is THAT user's Trash, to restore from or purge
  * without waiting the 7 days.
+ * The sidebar nests each workspace under its owner's home (a chevron drops
+ * them down, remembered per browser); one with no owner home stays in a flat
+ * Workspaces list.
  * Server side: `/api/lanes/:id/fs/*` and `/api/homes/:who/fs/*`
  * (server/lib/file-explorer.js).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -92,6 +95,8 @@ import { formatBytes } from "../../lib/format";
 import { copyText } from "../../lib/clipboard";
 import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../ContextMenu";
 import { CloneHereDialog } from "./CloneHereDialog";
+import { isSubmitEnter } from "../../lib/keys";
+import { useAuth } from "../AuthGate";
 
 /** One upload batch at most (the server caps one file the same). */
 export const FX_BATCH_MAX_BYTES = 500 * 1024 * 1024;
@@ -136,6 +141,11 @@ export function packUploads<T extends { file: Blob; rel: string }>(files: T[]) {
 const MIME = "application/x-agenthub-fx";
 const VIEW_KEY = "agenthub.files.view";
 const HIDDEN_KEY = "agenthub.files.hidden";
+/** The sidebar homes whose workspaces are dropped down (a JSON list of home ids). */
+const HOMES_OPEN_KEY = "agenthub.files.homesOpen";
+/** A sidebar user row; `noHome`: it only groups an owner's workspaces, the
+ *  viewer may not open that home (an analyst's view of other users). */
+type UserRow = FsHome & { noHome?: boolean };
 
 type Clip = { place: FsPlace; paths: string[]; cut: boolean };
 // The clipboard outlives the dialog and a workspace switch, like a desktop's.
@@ -318,6 +328,16 @@ export function FileBrowser({
     bytes: number;
   } | null>(null);
   const [lanes, setLanes] = useState<Lane[]>([]);
+  const { state: auth } = useAuth();
+  const myId = auth.mode === "server" ? (auth.user?.id ?? null) : null;
+  const [openHomes, setOpenHomes] = useState<Set<string>>(() => {
+    try {
+      const v: unknown = JSON.parse(readPref(HOMES_OPEN_KEY, '["me"]'));
+      return new Set(Array.isArray(v) ? v.filter((x): x is string => typeof x === "string") : []);
+    } catch {
+      return new Set(["me"]);
+    }
+  });
   const [clip, setClip] = useState<Clip | null>(clipboard);
   const [dropping, setDropping] = useState(false);
   const [menu, setMenu] = useState<"new" | "upload" | "more" | null>(null);
@@ -891,6 +911,52 @@ export function FileBrowser({
         onCancel={() => setRenaming(null)}
       />
     ) : null;
+  // Each workspace drops down under its owner: the caller's own under My
+  // home, another user's under theirs (`owner_name` = that home's id). An
+  // owner whose home this viewer may not open (an analyst's view of other
+  // users) still gets a row, one that only groups. A workspace with no owner
+  // stays in the flat Workspaces list. Which rows are open is per browser.
+  const { lanesOfHome, userRows } = useMemo(() => {
+    const ids = new Set(homes.map((h) => h.id));
+    const map = new Map<string, Lane[]>();
+    const extra = new Map<string, UserRow>();
+    for (const l of lanes) {
+      const home =
+        myId != null && l.owner_id === myId && ids.has("me")
+          ? "me"
+          : l.owner_name && l.owner_name !== "me"
+            ? l.owner_name
+            : null;
+      if (!home) continue;
+      map.set(home, [...(map.get(home) ?? []), l]);
+      if (!ids.has(home) && !extra.has(home)) {
+        extra.set(home, {
+          id: home,
+          label: l.owner_display_name || home,
+          readOnly: true,
+          noHome: true,
+        });
+      }
+    }
+    const rows: UserRow[] = [
+      ...homes.filter((h) => h.id !== "me"),
+      ...[...extra.values()].sort((a, b) => a.label.localeCompare(b.label)),
+    ];
+    return { lanesOfHome: map, userRows: rows };
+  }, [homes, lanes, myId]);
+  const grouped = new Set([...lanesOfHome.values()].flat().map((l) => l.id));
+  const looseLanes = lanes.filter((l) => !grouped.has(l.id));
+  // A home holding the open workspace shows it, whatever was stored.
+  const homeIsOpen = (id: string, own: Lane[]) =>
+    openHomes.has(id) ||
+    (view === "files" && !isHomePlace(target) && own.some((l) => l.id === laneOf(target)));
+  const toggleHome = (id: string, own: Lane[]) => {
+    const next = new Set(openHomes);
+    if (homeIsOpen(id, own)) next.delete(id);
+    else next.add(id);
+    setOpenHomes(next);
+    writePref(HOMES_OPEN_KEY, JSON.stringify([...next]));
+  };
   const placeClass = (active: boolean) =>
     `flex w-full items-center gap-2 rounded-md px-2 py-1.5 text-left text-[13px] ${
       active ? "bg-accent/15 font-medium text-accent" : "text-fg-secondary hover:bg-surface-2"
@@ -919,64 +985,104 @@ export function FileBrowser({
       {/* ── Places ── */}
       <aside className="hidden w-52 shrink-0 flex-col border-r border-border bg-surface-0 sm:flex">
         <nav className="min-h-0 flex-1 overflow-y-auto px-2 pb-2" aria-label={t("fx.places")}>
-          {homes.some((h) => h.id === "me") && (
-            <div className="pt-3">
+          {(() => {
+            const laneRow = (l: Lane, nested: boolean) => (
               <button
+                key={l.id}
                 type="button"
-                onClick={() => go("", { home: "me" })}
-                onContextMenu={(e) => placeCtx.open(e, { home: "me" })}
-                className={placeClass(
-                  view === "files" && isHomePlace(target) && target.home === "me"
-                )}
+                title={l.cwd}
+                onClick={() => go("", l.id)}
+                onContextMenu={(e) => placeCtx.open(e, { lane: l })}
+                className={`${placeClass(
+                  view === "files" && !isHomePlace(target) && laneOf(target) === l.id
+                )}${nested ? " pl-7" : ""}`}
               >
-                <House className="h-4 w-4 shrink-0" />
-                <span className="truncate">{t("fx.myHome")}</span>
+                <FolderGit2 className="h-4 w-4 shrink-0" />
+                <span className="truncate">{l.title || l.cwd.split("/").pop()}</span>
               </button>
-            </div>
-          )}
-          {homes.some((h) => h.id !== "me") && (
-            <>
-              <p className="px-2 pb-1 pt-3 text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
-                {t("fx.userHomes")}
-              </p>
-              {homes
-                .filter((h) => h.id !== "me")
-                .map((h) => (
-                  <button
-                    key={h.id}
-                    type="button"
-                    title={t("fx.readOnlyHome")}
-                    onClick={() => go("", { home: h.id })}
-                    onContextMenu={(e) => placeCtx.open(e, { home: h.id })}
-                    className={placeClass(
-                      view === "files" && isHomePlace(target) && target.home === h.id
-                    )}
-                  >
-                    <UserRound className="h-4 w-4 shrink-0" />
-                    <span className="truncate">{h.label}</span>
-                    <Eye className="ml-auto h-3 w-3 shrink-0 opacity-60" />
-                  </button>
-                ))}
-            </>
-          )}
-          <p className="px-2 pb-1 pt-3 text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
-            {t("fx.places")}
-          </p>
-          {lanes.map((l) => (
-            <button
-              key={l.id}
-              type="button"
-              title={l.cwd}
-              onClick={() => go("", l.id)}
-              onContextMenu={(e) => placeCtx.open(e, { lane: l })}
-              className={placeClass(
-                view === "files" && !isHomePlace(target) && laneOf(target) === l.id
-              )}
-            >
-              <FolderGit2 className="h-4 w-4 shrink-0" />
-              <span className="truncate">{l.title || l.cwd.split("/").pop()}</span>
-            </button>
-          ))}
+            );
+            // A home row with a chevron: its user's workspaces drop down under it.
+            const homeRow = (h: UserRow) => {
+              const own = lanesOfHome.get(h.id) ?? [];
+              const open = own.length > 0 && homeIsOpen(h.id, own);
+              const mine = h.id === "me";
+              // No home to open: the name drops the list down too.
+              const browse = !h.noHome;
+              return (
+                <div key={h.id} data-testid={`fx-home-${h.id}`}>
+                  <div className="flex items-center">
+                    <button
+                      type="button"
+                      aria-label={t("fx.toggleWorkspaces", {
+                        name: mine ? t("fx.myHome") : h.label,
+                      })}
+                      aria-expanded={open}
+                      disabled={!own.length}
+                      onClick={() => toggleHome(h.id, own)}
+                      className="flex h-6 w-5 shrink-0 items-center justify-center rounded text-fg-muted hover:bg-surface-2 disabled:opacity-0"
+                    >
+                      {open ? (
+                        <ChevronDown className="h-3.5 w-3.5" />
+                      ) : (
+                        <ChevronRight className="h-3.5 w-3.5" />
+                      )}
+                    </button>
+                    <button
+                      type="button"
+                      title={mine || !browse ? undefined : t("fx.readOnlyHome")}
+                      aria-expanded={browse ? undefined : open}
+                      onClick={() => (browse ? go("", { home: h.id }) : toggleHome(h.id, own))}
+                      onContextMenu={browse ? (e) => placeCtx.open(e, { home: h.id }) : undefined}
+                      className={placeClass(
+                        browse && view === "files" && isHomePlace(target) && target.home === h.id
+                      )}
+                    >
+                      {mine ? (
+                        <House className="h-4 w-4 shrink-0" />
+                      ) : (
+                        <UserRound className="h-4 w-4 shrink-0" />
+                      )}
+                      <span className="truncate">{mine ? t("fx.myHome") : h.label}</span>
+                      {own.length > 0 && (
+                        <span className="ml-auto shrink-0 text-[11px] tabular-nums text-fg-muted">
+                          {own.length}
+                        </span>
+                      )}
+                      {!mine && browse && (
+                        <Eye
+                          className={`${own.length ? "" : "ml-auto "}h-3 w-3 shrink-0 opacity-60`}
+                        />
+                      )}
+                    </button>
+                  </div>
+                  {open && own.map((l) => laneRow(l, true))}
+                </div>
+              );
+            };
+            const me = homes.find((h) => h.id === "me");
+            const others = userRows;
+            return (
+              <>
+                {me && <div className="pt-3">{homeRow(me)}</div>}
+                {others.length > 0 && (
+                  <>
+                    <p className="px-2 pb-1 pt-3 text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
+                      {others.some((h) => !h.noHome) ? t("fx.userHomes") : t("fx.users")}
+                    </p>
+                    {others.map(homeRow)}
+                  </>
+                )}
+                {looseLanes.length > 0 && (
+                  <>
+                    <p className="px-2 pb-1 pt-3 text-[10px] font-semibold uppercase tracking-wider text-fg-muted">
+                      {t("fx.places")}
+                    </p>
+                    {looseLanes.map((l) => laneRow(l, false))}
+                  </>
+                )}
+              </>
+            );
+          })()}
         </nav>
         <div className="border-t border-border p-2" data-testid="fx-trashes">
           <button type="button" onClick={openTrashes} className={placeClass(view === "trash")}>
@@ -1987,7 +2093,7 @@ function InlineName({
       onDoubleClick={(e) => e.stopPropagation()}
       onKeyDown={(e) => {
         e.stopPropagation();
-        if (e.key === "Enter") onDone();
+        if (isSubmitEnter(e)) onDone();
         if (e.key === "Escape") onCancel();
       }}
       onBlur={onDone}

client/src/components/lanes/LaneChangesPanel.tsx

@@ -106,6 +106,7 @@ import {
 import { api, gitTarget } from "../../lib/api";
 import { usePermissions } from "../AuthGate";
 import { pasteToLane } from "../../lib/panePaste";
+import { readMarkdownPreview } from "../../lib/markdownView";
 import { confirmDialog, confirmDiscard as askDiscard } from "../../lib/confirm";
 import { copyText } from "../../lib/clipboard";
 import { isSubmitEnter } from "../../lib/keys";
@@ -873,9 +874,10 @@ export function LaneChangesPanel({
   const [layout, setLayout] = useState<DiffLayout>(wide ? "split" : "unified");
   useEffect(() => setLayout(wide ? "split" : "unified"), [wide]);
   const [whole, setWhole] = useState(false);
-  // A whole markdown file shown rendered instead of as source; per file.
-  const [mdPreview, setMdPreview] = useState(false);
-  useEffect(() => setMdPreview(false), [openFile]);
+  // A whole markdown file shown rendered instead of as source; per file, each
+  // one opening as Settings → Appearance says (`lib/markdownView.ts`).
+  const [mdPreview, setMdPreview] = useState(readMarkdownPreview);
+  useEffect(() => setMdPreview(readMarkdownPreview()), [openFile]);
   const [data, setData] = useState<LaneChanges | null>(null);
   // A folder that is not a repo (an empty new workspace, a parent of clones)
   // has no changes, review or history — only its files, which Files reads
@@ -1061,6 +1063,9 @@ export function LaneChangesPanel({
   const [historyLoading, setHistoryLoading] = useState(false);
   useEffect(() => {
     if (mode !== "history") return;
+    // A reply for the previous ref/file/page lands after the next request
+    // started: drop it, or it overwrites the list the user is looking at.
+    let live = true;
     setHistoryLoading(true);
     void api.lanes
       .gitLog(target, {
@@ -1068,16 +1073,23 @@ export function LaneChangesPanel({
         ...(historyRef ? { ref: historyRef } : {}),
         ...(historyFile ? { file: historyFile } : {}),
       })
-      .then(forLane(laneId, (r) => setCommits(r.commits)))
-      .catch((err) => setError(err instanceof Error ? err.message : String(err)))
-      .finally(() => laneNow.current === laneId && setHistoryLoading(false));
+      .then(forLane(laneId, (r) => live && setCommits(r.commits)))
+      .catch((err) => live && setError(err instanceof Error ? err.message : String(err)))
+      .finally(() => live && laneNow.current === laneId && setHistoryLoading(false));
+    return () => {
+      live = false;
+    };
   }, [mode, laneId, reread, historyLimit, historyRef, historyFile]);
   useEffect(() => {
     if (mode !== "history") return;
+    let live = true;
     void api.lanes
       .gitBranches(target)
-      .then(forLane(laneId, (r) => setHistoryBranches(r.branches)))
-      .catch(() => setHistoryBranches([]));
+      .then(forLane(laneId, (r) => live && setHistoryBranches(r.branches)))
+      .catch(() => live && setHistoryBranches([]));
+    return () => {
+      live = false;
+    };
   }, [mode, laneId, reread]);
 
   // Re-run when a lane switch empties the cache too: the full-width sidebar
@@ -1171,24 +1183,33 @@ export function LaneChangesPanel({
   // own fetch — and only while the viewer is actually showing it.
   useEffect(() => {
     if (mode !== "file" || !(whole || editable) || !openFile) return;
+    // Opening file B before file A's read came back must not show (and let the
+    // editor save) A's text under B's header.
+    let live = true;
     void api.lanes
       .gitFile(target, openFile, range === "commit" && sha ? sha : "work")
       .then(
-        forLane(laneId, (r) =>
-          setText(
-            r.available
-              ? {
-                  path: r.path,
-                  lines: r.lines,
-                  truncated: r.truncated,
-                  binary: r.binary,
-                  sha: r.sha,
-                }
-              : null
-          )
+        forLane(
+          laneId,
+          (r) =>
+            live &&
+            setText(
+              r.available
+                ? {
+                    path: r.path,
+                    lines: r.lines,
+                    truncated: r.truncated,
+                    binary: r.binary,
+                    sha: r.sha,
+                  }
+                : null
+            )
         )
       )
-      .catch((err) => setError(err instanceof Error ? err.message : String(err)));
+      .catch((err) => live && setError(err instanceof Error ? err.message : String(err)));
+    return () => {
+      live = false;
+    };
   }, [mode, whole, editable, openFile, laneId, range, sha]);
   // The editor's original side, read beside the working file. A file that is
   // not there (new since) diffs against nothing: every line is added.
@@ -1196,10 +1217,17 @@ export function LaneChangesPanel({
   useEffect(() => {
     if (mode !== "file" || !(whole || editable) || !openFile || range === "commit") return;
     const rev = range === "branch" && mergeBase ? mergeBase : "HEAD";
+    let live = true;
     void api.lanes.gitFile(target, openFile, rev).then(
-      forLane(laneId, (r) => setBaseText(r.available && !r.binary ? r.lines.join("\n") : "")),
-      forLane(laneId, () => setBaseText(""))
+      forLane(
+        laneId,
+        (r) => live && setBaseText(r.available && !r.binary ? r.lines.join("\n") : "")
+      ),
+      forLane(laneId, () => live && setBaseText(""))
     );
+    return () => {
+      live = false;
+    };
   }, [mode, whole, editable, openFile, laneId, range, mergeBase]);
 
   useEffect(() => {
@@ -2014,6 +2042,8 @@ export function LaneChangesPanel({
     });
 
   const dirty = draft !== null && draft !== text?.lines.join("\n");
+  // Rendered only where the toggle is offered: a whole markdown file.
+  const mdShown = mdPreview && whole && isMarkdown(openFile);
   dirtyRef.current = dirty;
   useUnsavedGuard(dirty);
   const dirtyChangeRef = useRef(onDirtyChange);
@@ -3027,7 +3057,7 @@ export function LaneChangesPanel({
                       range === "commit" && sha ? sha : "work"
                     )}
                   />
-                ) : !mdPreview &&
+                ) : !mdShown &&
                   (whole || editable) &&
                   (draft !== null || (editable && text === null)) ? (
                   // The editor, once both texts are in: not the diff first.
@@ -3083,7 +3113,7 @@ export function LaneChangesPanel({
                     </Suspense>
                   )
                 ) : whole ? (
-                  text && mdPreview ? (
+                  text && mdShown ? (
                     <div className="min-h-0 flex-1 overflow-auto rounded border border-border-light bg-surface-0 p-4">
                       <MarkdownPreview text={text.lines.join("\n")} />
                     </div>

client/src/components/lanes/__tests__/FileExplorer.test.tsx

@@ -7,7 +7,9 @@
  * Trash, opens an admin's Trash on one folder per user (counted, an unreadable
  * one saying why), opens each user's Trash from its folder (asking before a
  * purge there, sending the item's store) and
- * shows a Trash that could not be read as an error, never as empty.
+ * shows a Trash that could not be read as an error, never as empty; nests a
+ * user's workspaces under their home in the sidebar (under a fold-only row
+ * when the viewer may not open that home).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import { describe, it, expect, vi, beforeEach } from "vitest";
@@ -470,6 +472,59 @@ describe("FileExplorer", () => {
     fireEvent.keyDown(screen.getByTestId("fx-list"), { key: "Delete" });
     expect(api.files.remove).not.toHaveBeenCalled();
   });
+
+  it("drops a user's workspaces down under their home; an unowned one stays in the list", async () => {
+    localStorage.removeItem("agenthub.files.homesOpen");
+    vi.mocked(api.lanes.list).mockResolvedValue({
+      lanes: [
+        { id: 1, title: "one", cwd: "/w/one" },
+        { id: 2, title: "two", cwd: "/w/two", owner_id: 7, owner_name: "bob" },
+      ],
+      counts: {},
+    } as never);
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("a.txt");
+    const toggle = await screen.findByRole("button", { name: "Show or hide Bob’s workspaces" });
+    expect(toggle).toHaveAttribute("aria-expanded", "false");
+    const places = screen.getByRole("navigation", { name: "Workspaces" });
+    expect(within(places).queryByRole("button", { name: "two" })).toBeNull();
+    expect(within(places).getByRole("button", { name: "one" })).toBeInTheDocument();
+    await user.click(toggle);
+    await user.click(within(places).getByRole("button", { name: "two" }));
+    await waitFor(() => expect(api.files.list).toHaveBeenLastCalledWith(2, ""));
+    expect(localStorage.getItem("agenthub.files.homesOpen")).toContain("bob");
+  });
+
+  it("groups an owner whose home the viewer cannot open (an analyst) under a row that only folds", async () => {
+    localStorage.removeItem("agenthub.files.homesOpen");
+    vi.mocked(api.files.homes).mockResolvedValue({
+      homes: [{ id: "me", label: "An", readOnly: false }],
+    });
+    vi.mocked(api.lanes.list).mockResolvedValue({
+      lanes: [
+        { id: 1, title: "one", cwd: "/w/one" },
+        {
+          id: 3,
+          title: "three",
+          cwd: "/w/three",
+          owner_id: 9,
+          owner_name: "cara",
+          owner_display_name: "Cara",
+        },
+      ],
+      counts: {},
+    } as never);
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("a.txt");
+    const places = screen.getByRole("navigation", { name: "Workspaces" });
+    expect(within(places).getByText("Users")).toBeInTheDocument();
+    expect(within(places).queryByRole("button", { name: "three" })).toBeNull();
+    await user.click(within(places).getByRole("button", { name: /^Cara/ }));
+    expect(api.files.list).not.toHaveBeenCalledWith({ home: "cara" }, "");
+    expect(within(places).getByRole("button", { name: "three" })).toBeInTheDocument();
+  });
 });
 
 describe("FileExplorer — New → Clone repository", () => {

client/src/components/lanes/__tests__/LaneChangesPanel.test.tsx

@@ -514,7 +514,7 @@ describe("LaneChangesPanel", () => {
     expect(screen.getByText("Unversioned Files")).toBeInTheDocument();
   });
 
-  it("reads a whole markdown file rendered after Preview, and back as source after Raw", async () => {
+  it("opens a whole markdown file rendered, as source after Raw, and rendered again after Preview", async () => {
     vi.mocked(api.lanes.gitTree).mockResolvedValue({
       available: true,
       path: "",
@@ -534,12 +534,13 @@ describe("LaneChangesPanel", () => {
     render(<LaneChangesPanel laneId={7} full />);
     const sidebar = await screen.findByTestId("lane-changes-sidebar");
     await user.click(await within(sidebar).findByText("README.md"));
-    await screen.findByTestId("lane-file-editor");
-    await user.click(screen.getByTestId("lane-file-preview"));
-    expect(screen.getByRole("heading", { name: "Hello" })).toBeInTheDocument();
+    expect(await screen.findByRole("heading", { name: "Hello" })).toBeInTheDocument();
     expect(screen.queryByTestId("lane-file-editor")).toBeNull();
     await user.click(screen.getByTestId("lane-file-preview"));
     expect(await screen.findByTestId("lane-file-editor")).toHaveValue("# Hello\n\n- one");
+    await user.click(screen.getByTestId("lane-file-preview"));
+    expect(screen.getByRole("heading", { name: "Hello" })).toBeInTheDocument();
+    expect(screen.queryByTestId("lane-file-editor")).toBeNull();
   });
 
   it("shows an image file as the picture, with no edit control", async () => {

client/src/components/run/ChatFilePreview.tsx

@@ -37,6 +37,7 @@ import { api, gitTarget } from "../../lib/api";
 import { copyText } from "../../lib/clipboard";
 import { useDialog } from "../../hooks/useDialog";
 import { dragSkill } from "../../lib/promptAttach";
+import { readMarkdownPreview } from "../../lib/markdownView";
 import { MarkdownPreview } from "../MarkdownPreview";
 import { CodeBlock } from "../conversation/CodeBlock";
 import { useTheme } from "../../hooks/useTheme";
@@ -227,6 +228,13 @@ function ArtifactFrame({ kind, text, title }: { kind: ArtifactKind; text: string
 
 type View = "preview" | "code";
 
+/** A file's first tab: Preview where it renders — Markdown as Settings → Appearance says. */
+function defaultView(path: string): View {
+  const kind = artifactKind(path);
+  if (!RENDERED.has(kind)) return "code";
+  return kind === "markdown" && !readMarkdownPreview() ? "code" : "preview";
+}
+
 function Body({ path, content, view }: { path: string; content: Content; view: View }) {
   const { t } = useTranslation("run");
   const kind = artifactKind(path);
@@ -320,7 +328,7 @@ export function FilePreview({
   const { t } = useTranslation("run");
   const kind = artifactKind(path);
   const loaded = useContent(path, scope);
-  const [view, setView] = useState<View>(RENDERED.has(kind) ? "preview" : "code");
+  const [view, setView] = useState<View>(() => defaultView(path));
   const [full, setFull] = useState(false);
   const [sharing, setSharing] = useState(false);
   const versions = useMemo(
@@ -332,7 +340,7 @@ export function FilePreview({
   // Another file opens on its own default tab, at its newest version.
   useEffect(() => {
     setPicked(null);
-    setView(RENDERED.has(artifactKind(path)) ? "preview" : "code");
+    setView(defaultView(path));
   }, [path]);
   const last = Math.max(versions.length - 1, 0);
   const at = picked ?? last;

client/src/components/run/RunSetup.tsx

@@ -70,6 +70,7 @@ import {
   ATTACH_MIME,
   addAttachments,
   claudeMention,
+  copiedFilePaths,
   droppedAttachments,
   droppedSkill,
   droppedText,
@@ -452,6 +453,14 @@ export function PromptEditor({
     });
     return true;
   };
+  /** A file manager's copy pasted with no file beside it, only `file://`
+   *  text: attached by those paths, as the terminal pastes them. */
+  const pastedLocalFiles = (dt: DataTransfer | null | undefined) => {
+    const paths = isLocalBrowser() ? copiedFilePaths(dt) : null;
+    if (!paths) return false;
+    onImagesChange((prev) => addAttachments(prev, paths.map(localAttachment)));
+    return true;
+  };
   /** Dropped or pasted files: by their own paths when the browser is on the
    *  dashboard's machine and the server finds the same files there (a file
    *  manager hands over `file://` paths beside the bytes), else uploaded. */
@@ -675,6 +684,7 @@ export function PromptEditor({
           onKeyDown={handleKeyDown}
           onPaste={(e) => {
             if (attachDropped(e.clipboardData, e.clipboardData?.files)) e.preventDefault();
+            else if (pastedLocalFiles(e.clipboardData)) e.preventDefault();
             else {
               // A very long paste goes in as a text file, like Claude Desktop:
               // the prompt then carries its path, never the text (#68: a CLI's
@@ -863,7 +873,7 @@ export function CwdAutocomplete({
     } else if (e.key === "ArrowUp") {
       e.preventDefault();
       setActive((a) => Math.max(0, a - 1));
-    } else if (e.key === "Enter") {
+    } else if (isSubmitEnter(e)) {
       if (open && flat[active]) {
         e.preventDefault();
         choose(flat[active]);

client/src/components/run/TerminalView.tsx

@@ -65,14 +65,10 @@ import { useTheme } from "../../hooks/useTheme";
 import { terminalThemeFor } from "../../lib/terminalTheme";
 import { api } from "../../lib/api";
 import { writeClipboard } from "../../lib/clipboard";
-import {
-  MENU_CURSOR_ROW,
-  notePaneFocus,
-  notePaneOutput,
-  registerPane,
-} from "../../lib/panePaste";
+import { MENU_CURSOR_ROW, notePaneFocus, notePaneOutput, registerPane } from "../../lib/panePaste";
 import {
   claudePastes,
+  copiedFilePaths,
   droppedFilePaths,
   isLocalBrowser,
   localCandidates,
@@ -160,15 +156,6 @@ const hasFiles = (e: DragEvent) => Array.from(e.dataTransfer.types).includes("Fi
 const hasText = (e: DragEvent) =>
   !hasFiles(e) && Array.from(e.dataTransfer.types).includes("text/plain");
 
-/** The `file://` paths a paste carries as text — a file manager's copy — or
- *  null: its uri-list, else its plain text when every line is one. */
-function copiedFilePaths(dt: DataTransfer | null): string[] | null {
-  const text = dt?.getData("text/plain") ?? "";
-  if (droppedFilePaths(dt)) return droppedFilePaths(dt);
-  if (!/^file:\/\//.test(text.trim())) return null;
-  return droppedFilePaths({ getData: () => text } as unknown as DataTransfer);
-}
-
 interface TerminalViewProps {
   runId: string;
   wsBaseUrl: string;

client/src/components/settings/AccountSettings.tsx

@@ -3,10 +3,12 @@
  * @description Settings → Account (server mode, any signed-in role): the
  * account's own information (`GET /api/me/account` — username, role, member
  * since, workspaces, sessions, active sign-ins, last sign-in), its avatar
- * (`PUT`/`DELETE /api/me/avatar` — PNG, JPEG, GIF or WebP, at most 1 MB; the
- * sidebar shows it at once), its display name
+ * (`PUT`/`DELETE /api/me/avatar` — PNG, JPEG, GIF or WebP, at most 1 MB — or
+ * an https link the browser loads itself, `POST /api/me/avatar/url`; the sidebar
+ * shows it at once), its display name
  * and email (`PATCH /api/me/account`), a password change that asks for the
- * current one (`POST /api/me/password` — this browser stays signed in, every
+ * current one and passes every rule of `lib/passwordRules.ts`, ticked as it is
+ * typed (`POST /api/me/password` — this browser stays signed in, every
  * other sign-in ends) and "Sign out other devices" (`POST
  * /api/me/sign-out-others`, behind `confirmDialog`). Role and state are an
  * admin's to change, on the Users page — never here.
@@ -23,15 +25,18 @@ import {
   type ReactNode,
 } from "react";
 import { useTranslation } from "react-i18next";
-import { Camera, LogOut, RefreshCw, Trash2 } from "lucide-react";
+import { Camera, Link2, LogOut, RefreshCw, Trash2 } from "lucide-react";
 import { api, type MyAccount } from "../../lib/api";
 import { formatDateTime } from "../../lib/format";
 import { toast } from "../../lib/toast";
 import { confirmDialog } from "../../lib/confirm";
 import { isSubmitEnter } from "../../lib/keys";
+import { useSpin } from "../../hooks/useSpin";
 import { useAuth } from "../AuthGate";
 import { ROLE_BADGE } from "../users/UserEditDialog";
 import { UserAvatar } from "../users/UserAvatar";
+import { PasswordRules } from "../users/PasswordRules";
+import { passwordProblems } from "../../lib/passwordRules";
 import { SettingsSection } from "./SettingsRow";
 
 type ServerAccount = Extract<MyAccount, { mode: "server" }>;
@@ -43,6 +48,24 @@ const errText = (t: (k: string, o?: Record<string, unknown>) => string, e: unkno
     : err.message;
 };
 
+/** Whether `url` loads as an image embedded in this page — the way every
+ *  avatar is shown: no referrer, the cookies a cross-site image gets. */
+export function loadsAsImage(url: string, timeoutMs = 10_000): Promise<boolean> {
+  return new Promise((resolve) => {
+    const img = new Image();
+    const done = (ok: boolean) => {
+      window.clearTimeout(timer);
+      img.onload = img.onerror = null;
+      resolve(ok);
+    };
+    const timer = window.setTimeout(() => done(false), timeoutMs);
+    img.referrerPolicy = "no-referrer";
+    img.onload = () => done(img.naturalWidth > 0);
+    img.onerror = () => done(false);
+    img.src = url;
+  });
+}
+
 export function AccountSettings() {
   const { t } = useTranslation("settings");
   const [account, setAccount] = useState<ServerAccount | null>(null);
@@ -64,19 +87,23 @@ export function AccountSettings() {
   );
   const load = useCallback(() => {
     setLoadError(null);
-    api.me
+    return api.me
       .account()
       .then(apply)
       .catch((e: Error) => setLoadError(e.message));
   }, [apply]);
-  useEffect(load, [load]);
+  useEffect(() => {
+    void load();
+  }, [load]);
+  const [retrying, retry] = useSpin(load);
 
   if (loadError) {
     return (
       <div role="alert" className="card flex items-center gap-3 p-4 text-sm text-status-danger">
         <span className="flex-1">{t("account.loadFailed", { message: loadError })}</span>
-        <button type="button" className="btn-ghost text-xs" onClick={load}>
-          <RefreshCw className="h-3.5 w-3.5" /> {t("common:retry")}
+        <button type="button" className="btn-ghost text-xs" onClick={retry} disabled={retrying}>
+          <RefreshCw className={`h-3.5 w-3.5${retrying ? " animate-spin" : ""}`} />{" "}
+          {t("common:retry")}
         </button>
       </div>
     );
@@ -110,18 +137,35 @@ function ProfileCard({
   const shown = user.displayName || user.username;
   const fileRef = useRef<HTMLInputElement>(null);
   const [busy, setBusy] = useState(false);
+  // null = the link field is closed.
+  const [link, setLink] = useState<string | null>(null);
 
   const run = async (op: () => Promise<MyAccount>, done: string) => {
     setBusy(true);
     try {
       onSaved(await op());
       toast.success(done);
+      return true;
     } catch (e) {
       toast.error(errText(t, e));
+      return false;
     } finally {
       setBusy(false);
     }
   };
+  const applyLink = async () => {
+    const url = link?.trim();
+    if (!url) return;
+    // The avatar routes only redirect to the link, so it shows only if THIS
+    // browser can load it as an embedded image: a link behind a login (a
+    // Mattermost /api/v4/users/<id>/image) gets no cookie from another site
+    // and fails — say so now instead of saving a picture nobody sees.
+    setBusy(true);
+    const ok = await loadsAsImage(url);
+    setBusy(false);
+    if (!ok) return void toast.error(t("account.avatar.linkUnreachable"));
+    if (await run(() => api.me.setAvatarFromUrl(url), t("account.avatar.saved"))) setLink(null);
+  };
   const pick = (e: ChangeEvent<HTMLInputElement>) => {
     const file = e.target.files?.[0];
     e.target.value = ""; // the same file can be picked again
@@ -150,6 +194,18 @@ function ProfileCard({
             >
               <Camera className="h-3.5 w-3.5" />
             </button>
+            <button
+              type="button"
+              className={`btn-ghost h-6 w-6 justify-center p-0 ${link !== null ? "text-accent" : ""}`}
+              onClick={() => setLink((v) => (v === null ? "" : null))}
+              disabled={busy}
+              title={t("account.avatar.fromUrl")}
+              aria-label={t("account.avatar.fromUrl")}
+              aria-pressed={link !== null}
+              data-testid="account-avatar-url-toggle"
+            >
+              <Link2 className="h-3.5 w-3.5" />
+            </button>
             {user.avatarAt && (
               <button
                 type="button"
@@ -187,6 +243,36 @@ function ProfileCard({
           </div>
         </div>
       </div>
+      {link !== null && (
+        <div className="mt-3 flex items-center gap-2">
+          <input
+            type="url"
+            className="input w-full text-sm"
+            value={link}
+            placeholder={t("account.avatar.urlPlaceholder")}
+            aria-label={t("account.avatar.fromUrl")}
+            autoFocus
+            disabled={busy}
+            onChange={(e) => setLink(e.target.value)}
+            onKeyDown={(e) => {
+              if (isSubmitEnter(e)) {
+                e.preventDefault();
+                void applyLink();
+              } else if (e.key === "Escape") setLink(null);
+            }}
+            data-testid="account-avatar-url-input"
+          />
+          <button
+            type="button"
+            className="btn-primary flex-shrink-0 text-sm"
+            onClick={() => void applyLink()}
+            disabled={busy || !link.trim()}
+            data-testid="account-avatar-url-apply"
+          >
+            {t("account.avatar.urlApply")}
+          </button>
+        </div>
+      )}
       <dl className="mt-4 grid grid-cols-2 gap-3 border-t border-border pt-4 text-xs sm:grid-cols-5">
         <Stat label={t("account.memberSince")}>
           {user.createdAt ? formatDateTime(user.createdAt) : "—"}
@@ -283,13 +369,17 @@ function ProfileForm({
 
 function PasswordForm() {
   const { t } = useTranslation("settings");
+  const { state } = useAuth();
+  const username = state.mode === "server" ? state.user?.username : undefined;
   const [current, setCurrent] = useState("");
   const [next, setNext] = useState("");
   const [again, setAgain] = useState("");
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const mismatch = again.length > 0 && again !== next;
-  const ready = current.length > 0 && next.length > 0 && again === next && !busy;
+  // The account's own password: every rule (server/lib/auth.js decides too).
+  const strong = passwordProblems(next, username).length === 0;
+  const ready = current.length > 0 && strong && again === next && !busy;
 
   const submit = async () => {
     if (!ready) return;
@@ -331,7 +421,7 @@ function PasswordForm() {
             aria-label={t("account.currentPassword")}
           />
         </Field>
-        <Field label={t("account.newPassword")} hint={t("users:passwordHint")}>
+        <Field label={t("account.newPassword")}>
           <input
             type="password"
             className="input w-full text-sm"
@@ -352,6 +442,9 @@ function PasswordForm() {
           />
         </Field>
       </div>
+      <div className="mt-3">
+        <PasswordRules password={next} username={username} />
+      </div>
       {(mismatch || error) && (
         <p role="alert" className="mt-2 text-xs text-status-danger">
           {error ?? t("account.mismatch")}

client/src/components/settings/AgentInstructionsSettings.tsx

@@ -17,6 +17,7 @@ import { FileUp } from "lucide-react";
 import { useTranslation } from "react-i18next";
 import { api, type AgentInstructionsView } from "../../lib/api";
 import { useAiTools } from "../../hooks/useAiTools";
+import { useSpin } from "../../hooks/useSpin";
 import { AiToolIcon } from "../AiToolIcon";
 import { toast } from "../../lib/toast";
 import { SettingsSection } from "./SettingsRow";
@@ -41,13 +42,16 @@ export function AgentInstructionsSettings() {
 
   const load = () => {
     setLoadError(null);
-    api.me
+    return api.me
       .instructions()
       .then(apply)
       .catch((err) => setLoadError(err instanceof Error ? err.message : String(err)));
   };
 
-  useEffect(load, []);
+  useEffect(() => {
+    void load();
+  }, []);
+  const [retrying, retry] = useSpin(load);
 
   async function save() {
     setSaving(true);
@@ -123,7 +127,12 @@ export function AgentInstructionsSettings() {
               <span className="truncate">
                 {t("agentInstructions.loadFailed", { message: loadError })}
               </span>
-              <button type="button" className="btn-ghost shrink-0 text-xs" onClick={load}>
+              <button
+                type="button"
+                className="btn-ghost shrink-0 text-xs"
+                onClick={retry}
+                disabled={retrying}
+              >
                 {t("common:retry")}
               </button>
             </p>

client/src/components/settings/AiToolsSettings.tsx

@@ -29,6 +29,7 @@ import { AiToolIcon } from "../AiToolIcon";
 import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../ContextMenu";
 import { api, type AiTool, type AiToolJob } from "../../lib/api";
 import { usePermissions } from "../AuthGate";
+import { copyText } from "../../lib/clipboard";
 
 type Confirm = { kind: "install" | "update"; tool: AiTool } | { kind: "update-all" };
 
@@ -374,9 +375,7 @@ export function AiToolsSettings({
             {ctx.menu.item.path && (
               <>
                 {isAdmin && <MenuSeparator />}
-                <MenuItem
-                  onSelect={pick((tool) => void navigator.clipboard.writeText(tool.path ?? ""))}
-                >
+                <MenuItem onSelect={pick((tool) => void copyText(tool.path ?? ""))}>
                   {t("rowMenu.copyPath")}
                 </MenuItem>
               </>

client/src/components/settings/AppearanceSettings.tsx

@@ -7,7 +7,8 @@
  * `#terminal-font`, with a preview line); **Sessions** (`#sessions-view`) —
  * the per-user Chat UI default (`ChatUiSettings`, `#chat-ui`) and whether the
  * session view's tabs hold every workspace's sessions (`lib/workspaceTabs.ts`,
- * `#workspace-tabs`); then the
+ * `#workspace-tabs`), and whether a Markdown file opens as Preview (the
+ * default) or Raw (`lib/markdownView.ts`, `#markdown-view`); then the
  * Dark / Light / System mode switch and one named-theme picker per mode, and the
  * corner pet (`PetSettings`, deep-linked as `#pet`) — the old General and Pet
  * pages redirect here. Theme state is in `hooks/useTheme.ts`, palettes in
@@ -37,6 +38,7 @@ import {
   type TerminalFont,
 } from "../../lib/terminalFont";
 import { readAllTabs, writeAllTabs } from "../../lib/workspaceTabs";
+import { readMarkdownPreview, writeMarkdownPreview } from "../../lib/markdownView";
 import {
   TERMINAL_FONT_SIZES,
   UI_FONT_SIZES,
@@ -97,6 +99,7 @@ export function AppearanceSettings() {
   const [termSize, setTermSize] = useState(readTerminalFontSize);
   const [uiSize, setUiSize] = useState(readUiFontSize);
   const [allTabs, setAllTabs] = useState(readAllTabs);
+  const [mdPreview, setMdPreview] = useState(readMarkdownPreview);
   const pickTermFont = (font: TerminalFont) => {
     writeTerminalFont(font);
     setTermFont(font);
@@ -224,6 +227,25 @@ export function AppearanceSettings() {
             setAllTabs(on);
           }}
         />
+        <SettingsRow
+          id="markdown-view"
+          label={t("markdownView.label")}
+          description={t("markdownView.description")}
+          control={
+            <SettingsSegmented
+              ariaLabel={t("markdownView.label")}
+              value={mdPreview ? "preview" : "raw"}
+              onChange={(v) => {
+                writeMarkdownPreview(v === "preview");
+                setMdPreview(v === "preview");
+              }}
+              options={[
+                { value: "preview" as const, label: t("markdownView.preview") },
+                { value: "raw" as const, label: t("markdownView.raw") },
+              ]}
+            />
+          }
+        />
       </SettingsSection>
 
       <section id="theme" className="card p-5 space-y-5 scroll-mt-24">

client/src/components/settings/OmpSharingSettings.tsx

@@ -0,0 +1,68 @@
+/**
+ * @file OmpSharingSettings — Settings → AI tools → Oh My Pi login sharing: the
+ * admin's server-wide switch that lets every member's omp pane run on the
+ * HOST account's omp login through omp's own auth broker + gateway, without
+ * any member holding a credential (`GET/PUT /api/ai-tools/omp-sharing`,
+ * `server/lib/omp-share.js`). Renders nothing outside server mode with
+ * per-user accounts (S3), or for anyone but an admin.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { api, type OmpSharingState } from "../../lib/api";
+import { toast } from "../../lib/toast";
+import { usePermissions } from "../AuthGate";
+import { SettingsSection, SettingsSwitchRow } from "./SettingsRow";
+
+export function OmpSharingSettings() {
+  const { t } = useTranslation("settings");
+  const { isAdmin, local } = usePermissions();
+  const [state, setState] = useState<OmpSharingState | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  useEffect(() => {
+    if (local || !isAdmin) return;
+    api.aiTools
+      .ompSharing()
+      .then(setState)
+      .catch(() => setState(null));
+  }, [local, isAdmin]);
+
+  if (local || !isAdmin || !state?.available) return null;
+  const error = state.broker.error || state.gateway.error;
+  const status = !state.enabled
+    ? null
+    : !state.installed
+      ? t("ompSharing.notInstalled")
+      : state.broker.running && state.gateway.running
+        ? t("ompSharing.running")
+        : error
+          ? t("ompSharing.failed", { error })
+          : t("ompSharing.starting");
+  return (
+    <SettingsSection id="omp-sharing" title={t("ompSharing.title")}>
+      <SettingsSwitchRow
+        label={t("ompSharing.switch")}
+        description={t("ompSharing.hint")}
+        checked={state.enabled}
+        disabled={busy}
+        onChange={async (on) => {
+          setBusy(true);
+          try {
+            setState(await api.aiTools.setOmpSharing(on));
+          } catch (err) {
+            toast.error(err);
+          } finally {
+            setBusy(false);
+          }
+        }}
+      />
+      {status && (
+        <p data-testid="omp-sharing-status" className="text-xs text-fg-muted">
+          {status}
+        </p>
+      )}
+    </SettingsSection>
+  );
+}

client/src/components/settings/PushIngestSettings.tsx

@@ -16,8 +16,7 @@ import { api } from "../../lib/api";
 import type { PushTokenStatus } from "../../lib/api";
 import { ConfirmModal } from "../ConfirmModal";
 import { SettingsSection } from "./SettingsRow";
-
-const copyText = (text: string) => navigator.clipboard?.writeText(text).catch(() => undefined);
+import { copyText } from "../../lib/clipboard";
 
 /** The forwarder for the pushing machine; `origin` is how it reaches this dashboard. */
 function forwarder(origin: string) {

client/src/components/settings/SnapshotSettings.tsx

@@ -19,6 +19,7 @@ import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../Context
 import { CopyButton } from "../event-views/primitives";
 import { snapshotUrl } from "../SnapshotButton";
 import { SettingsSection } from "./SettingsRow";
+import { copyText } from "../../lib/clipboard";
 
 export function SnapshotSettings() {
   const { t } = useTranslation("settings");
@@ -116,9 +117,7 @@ export function SnapshotSettings() {
           <MenuItem onSelect={pick((s) => navigate(`/snapshot/${s.token}`))}>
             {t("snapshots.open")}
           </MenuItem>
-          <MenuItem
-            onSelect={pick((s) => void navigator.clipboard?.writeText(snapshotUrl(s.token)))}
-          >
+          <MenuItem onSelect={pick((s) => void copyText(snapshotUrl(s.token)))}>
             {t("snapshots.copyLink")}
           </MenuItem>
           <MenuSeparator />

client/src/components/settings/ToolProfilesSettings.tsx

@@ -0,0 +1,808 @@
+/**
+ * @file ToolProfilesSettings — Settings → AI tools → Profiles: every AI tool's
+ * login profiles in ONE place, a tab per tool. Claude Code's are cc-profiles
+ * (`/api/cc-config/profiles`, with its quota check and token-owner mismatch
+ * warning — this panel used to be a modal on the Claude Code page); Codex and
+ * Oh My Pi are `/api/tool-profiles`; a tool that cannot be switched
+ * (Antigravity: an OS-keyring login) says why. In server mode the panel links
+ * each Claude/Codex profile to the account pool in Administration → Users,
+ * where an admin moves it in (`?poolAdd=<tool>&poolProfile=<name>` opens the
+ * pool's Add dialog on it), and shows how many accounts the pool holds.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Link } from "react-router-dom";
+import {
+  AlertCircle,
+  ArrowRightLeft,
+  Check,
+  Copy,
+  KeyRound,
+  Pencil,
+  Save,
+  ShieldAlert,
+  Terminal,
+  Trash2,
+} from "lucide-react";
+import {
+  api,
+  type AccountPool,
+  type CcAccountIdentity,
+  type CcProfile,
+  type CcProfileUsage,
+  type CcUsageWindow,
+  type ToolProfile,
+  type ToolProfileIdentity,
+  type ToolProfilesTool,
+} from "../../lib/api";
+import { toast } from "../../lib/toast";
+import { confirmDialog } from "../../lib/confirm";
+import { copyText } from "../../lib/clipboard";
+import { useAiTools } from "../../hooks/useAiTools";
+import { usePermissions } from "../AuthGate";
+import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../ContextMenu";
+import { SkeletonRows } from "../config/configPrimitives";
+import { AiToolIcon } from "../AiToolIcon";
+import { SettingsSection } from "./SettingsRow";
+
+/** The tools the panel covers, in tab order, with the command that signs one in. */
+const TOOLS: { id: string; label: string; login: string }[] = [
+  { id: "claude", label: "Claude Code", login: "claude auth login" },
+  { id: "codex", label: "Codex", login: "codex login" },
+  { id: "omp", label: "Oh My Pi", login: "omp  (then /login)" },
+  { id: "antigravity", label: "Antigravity", login: "agy" },
+];
+/** Tools the account pool takes (server/routes/accounts.js). */
+const POOL_TOOLS = new Set(["claude", "codex"]);
+
+const rowCls = "rounded-lg border border-border bg-surface-2 px-3 py-2.5";
+const btnCls =
+  "h-7 text-[11px] font-medium px-2.5 rounded-md border border-accent/30 bg-accent/10 hover:bg-accent/20 text-accent inline-flex items-center gap-1.5 disabled:opacity-50";
+
+export function ToolProfilesSettings() {
+  const { t } = useTranslation("settings");
+  const aiTools = useAiTools();
+  const { local, seesAll } = usePermissions();
+  const shown = TOOLS.filter((x) => {
+    const tool = aiTools.byId(x.id);
+    if (x.id === "claude") return tool?.enabled !== false;
+    return !!tool && tool.installed && tool.enabled !== false;
+  });
+  const [tab, setTab] = useState<string>("claude");
+  const current = shown.find((x) => x.id === tab) ?? shown[0];
+  const [others, setOthers] = useState<ToolProfilesTool[] | null>(null);
+  const [pool, setPool] = useState<AccountPool | null>(null);
+
+  const loadOthers = useCallback(
+    () =>
+      api.toolProfiles
+        .list()
+        .then((r) => setOthers(r.tools))
+        .catch(() => setOthers([])),
+    []
+  );
+  useEffect(() => {
+    void loadOthers();
+  }, [loadOthers]);
+  // The pool is a server-mode, staff-only read.
+  useEffect(() => {
+    if (local || !seesAll) return;
+    api.accountPool
+      .list()
+      .then(setPool)
+      .catch(() => setPool(null));
+  }, [local, seesAll]);
+
+  if (!current) return null;
+  const poolCount = (tool: string) =>
+    pool ? (tool === "codex" ? pool.codex.length : pool.accounts.length) : null;
+
+  return (
+    <SettingsSection
+      id="tool-profiles"
+      title={t("toolProfiles.title")}
+      description={t("toolProfiles.description")}
+    >
+      <div role="tablist" aria-label={t("toolProfiles.title")} className="flex flex-wrap gap-1.5">
+        {shown.map((x) => (
+          <button
+            key={x.id}
+            type="button"
+            role="tab"
+            aria-selected={x.id === current.id}
+            onClick={() => setTab(x.id)}
+            className={`inline-flex items-center gap-1.5 rounded-md border px-2.5 py-1 text-xs ${
+              x.id === current.id
+                ? "border-accent/40 bg-accent/10 text-accent"
+                : "border-border bg-surface-2 text-fg-secondary hover:bg-surface-3"
+            }`}
+          >
+            <AiToolIcon tool={{ id: x.id, label: x.label }} className="h-3.5 w-3.5" />
+            {x.label}
+          </button>
+        ))}
+      </div>
+      <div role="tabpanel" className="mt-3 space-y-3">
+        {POOL_TOOLS.has(current.id) && poolCount(current.id) !== null && (
+          <PoolLine count={poolCount(current.id)!} />
+        )}
+        {current.id === "claude" ? (
+          <ClaudeProfiles pooled={!local && POOL_TOOLS.has("claude")} />
+        ) : (
+          <OtherProfiles
+            key={current.id}
+            tool={current.id}
+            label={current.label}
+            login={current.login}
+            state={others?.find((o) => o.tool === current.id) ?? null}
+            loading={others === null}
+            pooled={!local && POOL_TOOLS.has(current.id)}
+            onChanged={loadOthers}
+          />
+        )}
+      </div>
+    </SettingsSection>
+  );
+}
+
+/** "The pool holds N accounts" + the way to it (Administration → Users). */
+function PoolLine({ count }: { count: number }) {
+  const { t } = useTranslation("settings");
+  return (
+    <div className="flex flex-wrap items-center gap-2 rounded-lg border border-border bg-surface-2 px-3 py-2 text-xs text-fg-secondary">
+      <KeyRound className="h-3.5 w-3.5 text-fg-muted" />
+      <span className="flex-1">{t("toolProfiles.poolCount", { count })}</span>
+      <Link to="/admin#account-pool" className="text-accent hover:underline">
+        {t("toolProfiles.openPool")}
+      </Link>
+    </div>
+  );
+}
+
+/** The link that opens the pool's Add dialog on one saved profile (admins only). */
+function MoveToPool({ tool, name }: { tool: string; name: string }) {
+  const { t } = useTranslation("settings");
+  const { isAdmin } = usePermissions();
+  if (!isAdmin) return null;
+  return (
+    <Link
+      to={`/admin?${new URLSearchParams({ poolAdd: tool, poolProfile: name })}#account-pool`}
+      title={t("toolProfiles.moveToPoolHint")}
+      className="h-7 text-[11px] px-2 rounded-md text-fg-muted hover:text-accent hover:bg-surface-3 inline-flex items-center gap-1"
+    >
+      <ArrowRightLeft className="h-3 w-3" />
+      {t("toolProfiles.moveToPool")}
+    </Link>
+  );
+}
+
+function LoginHint({ text, command }: { text: string; command: string }) {
+  const { t } = useTranslation("ccConfig");
+  const [copied, setCopied] = useState(false);
+  return (
+    <div>
+      <div className="text-[10px] text-fg-muted mb-1">{text}</div>
+      <div className="rounded-md border border-border bg-surface-2 px-2.5 py-1.5 flex items-center gap-2">
+        <Terminal className="w-3 h-3 text-fg-muted flex-shrink-0" />
+        <code className="font-mono text-[11px] text-fg-secondary truncate flex-1">{command}</code>
+        <button
+          type="button"
+          onClick={async () => {
+            if (await copyText(command, true)) {
+              setCopied(true);
+              setTimeout(() => setCopied(false), 1500);
+            }
+          }}
+          className="text-[10px] font-medium px-1.5 py-1 rounded border border-border bg-surface-1 hover:bg-surface-3 text-fg-secondary hover:text-fg-primary inline-flex items-center gap-1 flex-shrink-0"
+          title={t("snippet.copy")}
+        >
+          {copied ? <Check className="w-3 h-3" /> : <Copy className="w-3 h-3" />}
+          <span>{copied ? t("snippet.copied") : t("snippet.copy")}</span>
+        </button>
+      </div>
+    </div>
+  );
+}
+
+/** A profile's label, renamed in place: click it (or the menu's Rename), type, Enter. */
+function LabelEdit({
+  label,
+  busy,
+  editing,
+  setEditing,
+  onRename,
+}: {
+  label: string;
+  busy: boolean;
+  editing: boolean;
+  setEditing: (on: boolean) => void;
+  onRename: (next: string) => void;
+}) {
+  const { t } = useTranslation("ccConfig");
+  const [draft, setDraft] = useState(label);
+  useEffect(() => {
+    if (editing) setDraft(label);
+  }, [editing, label]);
+  if (editing) {
+    return (
+      <input
+        autoFocus
+        value={draft}
+        onChange={(e) => setDraft(e.target.value)}
+        onBlur={() => setEditing(false)}
+        onKeyDown={(e) => {
+          if (e.key === "Escape") setEditing(false);
+          if (e.key !== "Enter") return;
+          const next = draft.trim();
+          setEditing(false);
+          if (next && next !== label) onRename(next);
+        }}
+        maxLength={60}
+        aria-label={t("profiles.renameLabel")}
+        className="h-7 w-48 rounded-md border border-accent/40 bg-surface-1 px-2 text-xs text-fg-primary focus:outline-none focus:ring-1 focus:ring-accent/40"
+      />
+    );
+  }
+  return (
+    <button
+      disabled={busy}
+      onClick={() => setEditing(true)}
+      title={t("profiles.renameHint")}
+      className="text-xs font-medium text-fg-primary hover:text-accent inline-flex items-center gap-1 group"
+    >
+      {label}
+      <Pencil className="w-3 h-3 opacity-0 group-hover:opacity-100 text-fg-muted" />
+    </button>
+  );
+}
+
+/** One mutation with a busy key, a toast either way, then a reload. */
+function useRunner(load: () => Promise<unknown>) {
+  const [busy, setBusy] = useState<string | null>(null);
+  const run = useCallback(
+    async (key: string, fn: () => Promise<unknown>, success: string) => {
+      setBusy(key);
+      try {
+        await fn();
+        toast.success(success);
+        await load();
+      } catch (err: unknown) {
+        toast.error(err);
+      } finally {
+        setBusy(null);
+      }
+    },
+    [load]
+  );
+  return { busy, run };
+}
+
+// ── Codex, Oh My Pi, … ─────────────────────────────────────────────────
+
+function OtherProfiles({
+  tool,
+  label,
+  login,
+  state,
+  loading,
+  pooled,
+  onChanged,
+}: {
+  tool: string;
+  label: string;
+  login: string;
+  state: ToolProfilesTool | null;
+  loading: boolean;
+  pooled: boolean;
+  onChanged: () => Promise<unknown>;
+}) {
+  const { t } = useTranslation("settings");
+  const { t: tc } = useTranslation("ccConfig");
+  const { busy, run } = useRunner(onChanged);
+  const [renaming, setRenaming] = useState<string | null>(null);
+
+  if (loading) return <SkeletonRows n={2} />;
+  if (!state) return <p className="text-xs text-fg-muted">{t("toolProfiles.noProfiles")}</p>;
+  if (!state.supported) {
+    return (
+      <p className="text-xs text-fg-muted inline-flex items-start gap-1.5">
+        <ShieldAlert className="h-3.5 w-3.5 flex-shrink-0 mt-0.5" />
+        <span>{t(`toolProfiles.unsupported.${tool}`, { defaultValue: state.reason ?? "" })}</span>
+      </p>
+    );
+  }
+  const items = state.items;
+  const activeSaved = items.some((p) => p.active);
+  const remove = async (p: ToolProfile) => {
+    const ok = await confirmDialog({
+      title: tc("profiles.deleteConfirmTitle", { name: p.label }),
+      message: t("toolProfiles.deleteConfirmBody", { tool: label }),
+      confirmLabel: tc("profiles.deleteButton"),
+    });
+    if (ok) {
+      void run(
+        `del:${p.name}`,
+        () => api.toolProfiles.remove(tool, p.name),
+        tc("profiles.deleteSuccess", { name: p.label })
+      );
+    }
+  };
+
+  return (
+    <div className="space-y-3">
+      <p className="text-[11px] text-fg-muted leading-relaxed">
+        {t(`toolProfiles.subtitle.${tool}`, { defaultValue: "" })}
+      </p>
+      {state.error && (
+        <div className="text-sm text-status-danger inline-flex items-center gap-2">
+          <AlertCircle className="w-4 h-4" />
+          {state.error.message}
+        </div>
+      )}
+      <div className={`${rowCls} space-y-1`}>
+        <div className="text-[10px] uppercase tracking-wide text-fg-muted">
+          {tc("profiles.activeLabel")}
+        </div>
+        {state.active ? (
+          <>
+            <div className="text-sm text-fg-primary">{who(state.active)}</div>
+            <OtherIdentityLine identity={state.active} />
+          </>
+        ) : (
+          <div className="text-sm text-fg-muted">{t("toolProfiles.noActive", { tool: label })}</div>
+        )}
+        {state.active && !activeSaved && (
+          <div className="pt-1.5 space-y-1.5">
+            <div className="text-[11px] text-status-warning">{tc("profiles.unsavedActive")}</div>
+            <button
+              disabled={busy !== null}
+              onClick={() =>
+                void run("save", () => api.toolProfiles.save(tool), tc("profiles.saveSuccess"))
+              }
+              className={btnCls}
+            >
+              <Save className="w-3 h-3" />
+              {busy === "save" ? tc("profiles.saving") : t("toolProfiles.saveButton")}
+            </button>
+          </div>
+        )}
+      </div>
+      {items.length === 0 && (
+        <div className="rounded-lg border border-dashed border-border bg-surface-2 px-4 py-6 text-center text-sm text-fg-muted">
+          {tc("profiles.empty")}
+        </div>
+      )}
+      {items.map((p) => (
+        <div key={p.name} data-testid={`profile-row-${tool}-${p.name}`} className={rowCls}>
+          <div className="flex items-center gap-2 flex-wrap">
+            <LabelEdit
+              label={p.label}
+              busy={busy !== null}
+              editing={renaming === p.name}
+              setEditing={(on) => setRenaming(on ? p.name : null)}
+              onRename={(next) =>
+                void run(
+                  `rename:${p.name}`,
+                  () => api.toolProfiles.rename(tool, p.name, next),
+                  tc("profiles.renameSuccess", { name: next })
+                )
+              }
+            />
+            {p.active && <ActiveBadge />}
+            <span className="text-xs text-fg-secondary truncate flex-1 min-w-0">{who(p)}</span>
+            {!p.active && (
+              <button
+                disabled={busy !== null}
+                onClick={() =>
+                  void run(
+                    `switch:${p.name}`,
+                    () => api.toolProfiles.activate(tool, p.name),
+                    t("toolProfiles.switchSuccess", { name: p.label, tool: label })
+                  )
+                }
+                className={btnCls}
+              >
+                {busy === `switch:${p.name}`
+                  ? tc("profiles.switching")
+                  : tc("profiles.switchButton")}
+              </button>
+            )}
+            {pooled && <MoveToPool tool={tool} name={p.name} />}
+            {!p.active && (
+              <button
+                type="button"
+                disabled={busy !== null}
+                onClick={() => void remove(p)}
+                title={tc("profiles.deleteButton")}
+                aria-label={tc("profiles.deleteButton")}
+                className="h-7 w-7 inline-flex items-center justify-center rounded-md text-fg-muted hover:text-status-danger hover:bg-surface-3 disabled:opacity-50"
+              >
+                <Trash2 className="w-3.5 h-3.5" />
+              </button>
+            )}
+          </div>
+          <OtherIdentityLine identity={p} />
+          {p.savedAt && (
+            <div className="text-[10px] text-fg-muted mt-1">
+              {tc("profiles.savedAt", { time: new Date(p.savedAt).toLocaleString() })}
+            </div>
+          )}
+        </div>
+      ))}
+      <LoginHint text={t("toolProfiles.loginHint", { tool: label })} command={login} />
+    </div>
+  );
+}
+
+const who = (id: ToolProfileIdentity) => id.email || id.detail || id.kind;
+
+function OtherIdentityLine({ identity }: { identity: ToolProfileIdentity }) {
+  const { t } = useTranslation("settings");
+  const parts = [
+    t(`toolProfiles.kind.${identity.kind}`, { defaultValue: identity.kind }),
+    identity.email ? identity.detail : null,
+  ].filter(Boolean);
+  return <div className="text-[10px] text-fg-muted mt-0.5">{parts.join(" · ")}</div>;
+}
+
+function ActiveBadge() {
+  const { t } = useTranslation("ccConfig");
+  return (
+    <span className="text-[10px] px-1.5 py-0.5 rounded-full bg-status-success/10 border border-status-success/20 text-status-success">
+      {t("profiles.activeBadge")}
+    </span>
+  );
+}
+
+// ── Claude Code ────────────────────────────────────────────────────────
+//
+// Swaps which Anthropic account the local `claude` CLI runs as. Only the two
+// identity artifacts move (the OAuth blob + `oauthAccount`), so skills,
+// subagents, memory, plugins, marketplaces and settings all stay exactly where
+// they are. The dashboard cannot log a new account in (only `claude auth login`
+// can mint tokens), so adding a profile is always "log in, then snapshot what
+// the CLI wrote" — a save button on the live account, never a name field: the
+// server derives the identifier, and the user edits the label in place. The
+// save button only appears while the live account is unsaved, because one
+// account is one profile.
+
+function ClaudeProfiles({ pooled }: { pooled: boolean }) {
+  const { t } = useTranslation("ccConfig");
+  const [items, setItems] = useState<CcProfile[] | null>(null);
+  const [active, setActive] = useState<CcAccountIdentity | null>(null);
+  /** `.claude.json`'s account, when it is not the one the live token belongs to. */
+  const [mismatchEmail, setMismatchEmail] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  /** Quota per profile, keyed by `name`, fetched for every profile once the
+   *  list arrives: the live account is read from the CLI and never refreshed,
+   *  any other profile only when its token has actually expired. */
+  const [usage, setUsage] = useState<Record<string, CcProfileUsage>>({});
+  const [usageError, setUsageError] = useState<Record<string, string>>({});
+  /** Per profile, so one slow account does not freeze the other rows. */
+  const [usageBusy, setUsageBusy] = useState<Record<string, boolean>>({});
+  /** Names already auto-fetched, so the effect below fires once per profile. */
+  const autoFetched = useRef<Set<string>>(new Set());
+  const ctx = useContextMenu<CcProfile>();
+
+  const load = useCallback(async () => {
+    try {
+      const r = await api.ccConfig.profiles();
+      setItems(r.items);
+      setActive(r.active);
+      setMismatchEmail(r.mismatch ? r.mismatch.configEmail || "?" : null);
+      setError(null);
+    } catch (err: unknown) {
+      setError(err instanceof Error ? err.message : "unknown");
+    }
+  }, []);
+  const { busy, run } = useRunner(load);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const checkUsage = useCallback(async (name: string) => {
+    setUsageBusy((prev) => ({ ...prev, [name]: true }));
+    setUsageError((prev) => {
+      const next = { ...prev };
+      delete next[name];
+      return next;
+    });
+    try {
+      const result = await api.ccConfig.profileUsage(name);
+      setUsage((prev) => ({ ...prev, [name]: result }));
+    } catch (err: unknown) {
+      setUsageError((prev) => ({
+        ...prev,
+        [name]: err instanceof Error ? err.message : "unknown error",
+      }));
+    } finally {
+      setUsageBusy((prev) => {
+        const next = { ...prev };
+        delete next[name];
+        return next;
+      });
+    }
+  }, []);
+
+  // Every profile's quota, once per profile per mount: a retry is the row's
+  // own button, so a failed account is not re-asked on every render.
+  useEffect(() => {
+    if (!items) return;
+    for (const p of items) {
+      if (autoFetched.current.has(p.name)) continue;
+      autoFetched.current.add(p.name);
+      void checkUsage(p.name);
+    }
+  }, [items, checkUsage]);
+
+  const activeSaved = items?.some((p) => p.active) ?? false;
+  /** How many saved profiles hold the same account as `p`. */
+  const copies = (p: CcProfile) =>
+    items?.filter((q) => q.accountUuid && q.accountUuid === p.accountUuid).length ?? 1;
+  /** Deletable unless it is the ONLY saved copy of the live account. */
+  const deletable = (p: CcProfile) => !p.active || copies(p) > 1;
+  const [renaming, setRenaming] = useState<string | null>(null);
+  const switchTo = (p: CcProfile) =>
+    void run(
+      `switch:${p.name}`,
+      () => api.ccConfig.activateProfile(p.name),
+      t("profiles.switchSuccess", { name: p.label })
+    );
+  const remove = async (p: CcProfile) => {
+    const ok = await confirmDialog({
+      title: t("profiles.deleteConfirmTitle", { name: p.label }),
+      message: t("profiles.deleteConfirmBody"),
+      confirmLabel: t("profiles.deleteButton"),
+    });
+    if (!ok) return;
+    void run(
+      `del:${p.name}`,
+      () => api.ccConfig.deleteProfile(p.name),
+      t("profiles.deleteSuccess", { name: p.label })
+    );
+  };
+  const pick = (fn: (p: CcProfile) => void) => () => {
+    const p = ctx.menu!.item;
+    ctx.close();
+    fn(p);
+  };
+
+  return (
+    <div className="space-y-3">
+      <p className="text-[11px] text-fg-muted leading-relaxed">{t("profiles.subtitle")}</p>
+      <p className="text-[11px] text-fg-muted leading-relaxed">{t("profiles.warning")}</p>
+      {mismatchEmail && (
+        <p className="text-[11px] text-status-warning inline-flex items-start gap-1.5 leading-relaxed">
+          <ShieldAlert className="w-3.5 h-3.5 flex-shrink-0 mt-0.5" />
+          <span>
+            {t("profiles.mismatch", {
+              config: mismatchEmail,
+              owner: active?.email || active?.accountUuid || "?",
+            })}
+          </span>
+        </p>
+      )}
+      {error && (
+        <div className="text-sm text-status-danger inline-flex items-center gap-2">
+          <AlertCircle className="w-4 h-4" />
+          {error}
+        </div>
+      )}
+
+      <div className={`${rowCls} space-y-1`}>
+        <div className="text-[10px] uppercase tracking-wide text-fg-muted">
+          {t("profiles.activeLabel")}
+        </div>
+        {active ? (
+          <>
+            <div className="text-sm text-fg-primary">
+              {active.email || active.displayName || active.accountUuid}
+            </div>
+            <IdentityLine identity={active} />
+          </>
+        ) : (
+          <div className="text-sm text-fg-muted">{t("profiles.noActive")}</div>
+        )}
+        {active && !activeSaved && (
+          <div className="pt-1.5 space-y-1.5">
+            <div className="text-[11px] text-status-warning">{t("profiles.unsavedActive")}</div>
+            <button
+              disabled={busy !== null}
+              onClick={() =>
+                void run("save", () => api.ccConfig.saveProfile(), t("profiles.saveSuccess"))
+              }
+              className={btnCls}
+            >
+              <Save className="w-3 h-3" />
+              {busy === "save" ? t("profiles.saving") : t("profiles.saveButton")}
+            </button>
+          </div>
+        )}
+      </div>
+
+      {items === null && !error && <SkeletonRows n={3} />}
+      {items !== null && items.length === 0 && (
+        <div className="rounded-lg border border-dashed border-border bg-surface-2 px-4 py-8 text-center text-sm text-fg-muted">
+          {t("profiles.empty")}
+        </div>
+      )}
+      {items?.map((p) => (
+        <div
+          key={p.name}
+          data-testid={`profile-row-${p.name}`}
+          onContextMenu={(e) => ctx.open(e, p)}
+          className={rowCls}
+        >
+          <div className="flex items-center gap-2 flex-wrap">
+            <LabelEdit
+              label={p.label}
+              busy={busy !== null}
+              editing={renaming === p.name}
+              setEditing={(on) => setRenaming(on ? p.name : null)}
+              onRename={(next) =>
+                void run(
+                  `rename:${p.name}`,
+                  () => api.ccConfig.renameProfile(p.name, next),
+                  t("profiles.renameSuccess", { name: next })
+                )
+              }
+            />
+            {p.active && <ActiveBadge />}
+            <span className="text-xs text-fg-secondary truncate flex-1 min-w-0">
+              {p.email || p.displayName || p.accountUuid}
+            </span>
+            {!p.active && (
+              <button disabled={busy !== null} onClick={() => switchTo(p)} className={btnCls}>
+                {busy === `switch:${p.name}` ? t("profiles.switching") : t("profiles.switchButton")}
+              </button>
+            )}
+            {pooled && <MoveToPool tool="claude" name={p.name} />}
+            {deletable(p) && (
+              <button
+                type="button"
+                disabled={busy !== null}
+                onClick={() => void remove(p)}
+                title={t("profiles.deleteButton")}
+                aria-label={t("profiles.deleteButton")}
+                className="h-7 w-7 inline-flex items-center justify-center rounded-md text-fg-muted hover:text-status-danger hover:bg-surface-3 disabled:opacity-50"
+              >
+                <Trash2 className="w-3.5 h-3.5" />
+              </button>
+            )}
+          </div>
+          <IdentityLine identity={p} />
+          <ProfileUsageLine
+            usage={usage[p.name]}
+            error={usageError[p.name]}
+            busy={!!usageBusy[p.name]}
+            disabled={busy !== null || !!usageBusy[p.name]}
+            onCheck={() => void checkUsage(p.name)}
+          />
+          {p.savedAt && (
+            <div className="text-[10px] text-fg-muted mt-1">
+              {t("profiles.savedAt", { time: new Date(p.savedAt).toLocaleString() })}
+            </div>
+          )}
+        </div>
+      ))}
+
+      {ctx.menu && (
+        <ContextMenu x={ctx.menu.x} y={ctx.menu.y} onClose={ctx.close} testId="profile-menu">
+          <MenuItem onSelect={pick((p) => setRenaming(p.name))}>{t("profiles.rename")}</MenuItem>
+          {!ctx.menu.item.active && (
+            <MenuItem disabled={busy !== null} onSelect={pick(switchTo)}>
+              {t("profiles.switchButton")}
+            </MenuItem>
+          )}
+          <MenuItem
+            disabled={busy !== null || !!usageBusy[ctx.menu.item.name]}
+            onSelect={pick((p) => void checkUsage(p.name))}
+          >
+            {t("profiles.usageCheck")}
+          </MenuItem>
+          {deletable(ctx.menu.item) && (
+            <>
+              <MenuSeparator />
+              <MenuItem
+                danger
+                disabled={busy !== null}
+                testId="profile-menu-delete"
+                onSelect={pick((p) => void remove(p))}
+              >
+                {t("profiles.deleteButton")}
+              </MenuItem>
+            </>
+          )}
+        </ContextMenu>
+      )}
+
+      <LoginHint text={t("profiles.loginHint")} command="claude auth login" />
+    </div>
+  );
+}
+
+/**
+ * One profile's quota: a button until asked, then the two windows Anthropic
+ * reports — the 5-hour session allowance and the 7-day one. Reading a saved
+ * profile's usage may refresh its OAuth token (rotating it on disk), so it
+ * happens once per mount or click, never on a poll.
+ */
+function ProfileUsageLine({
+  usage,
+  error,
+  busy,
+  disabled,
+  onCheck,
+}: {
+  usage?: CcProfileUsage;
+  error?: string;
+  busy: boolean;
+  disabled: boolean;
+  onCheck: () => void;
+}) {
+  const { t } = useTranslation("ccConfig");
+  const pct = (w: CcUsageWindow | null | undefined) =>
+    w && w.utilization !== null ? `${Math.round(w.utilization)}%` : "—";
+  const resetTitle = (w: CcUsageWindow | null | undefined) =>
+    w && w.resetsAt
+      ? t("profiles.usageResets", { time: new Date(w.resetsAt).toLocaleString() })
+      : undefined;
+
+  if (error) {
+    return (
+      <div className="mt-1 flex items-center gap-2 text-[10px]">
+        <span className="text-status-danger">{error}</span>
+        <button
+          onClick={onCheck}
+          disabled={disabled}
+          className="text-fg-muted hover:text-accent disabled:opacity-50"
+        >
+          {t("profiles.usageRetry")}
+        </button>
+      </div>
+    );
+  }
+  if (!usage) {
+    return (
+      <button
+        onClick={onCheck}
+        disabled={disabled}
+        title={t("profiles.usageHint")}
+        className="mt-1 text-[10px] text-fg-muted hover:text-accent disabled:opacity-50"
+      >
+        {busy ? t("profiles.usageChecking") : t("profiles.usageCheck")}
+      </button>
+    );
+  }
+  return (
+    <div className="mt-1 flex items-center gap-2 text-[10px] text-fg-muted">
+      <span title={resetTitle(usage.fiveHour)}>
+        {t("profiles.usageFiveHour")}{" "}
+        <span className="text-fg-secondary">{pct(usage.fiveHour)}</span>
+      </span>
+      <span title={resetTitle(usage.sevenDay)}>
+        {t("profiles.usageSevenDay")}{" "}
+        <span className="text-fg-secondary">{pct(usage.sevenDay)}</span>
+      </span>
+      <button
+        onClick={onCheck}
+        disabled={disabled}
+        className="hover:text-accent disabled:opacity-50"
+      >
+        {busy ? t("profiles.usageChecking") : t("profiles.usageRefresh")}
+      </button>
+    </div>
+  );
+}
+
+/** Org / seat / plan line shared by the active card and each profile row. */
+function IdentityLine({ identity }: { identity: CcAccountIdentity }) {
+  const parts = [identity.organization, identity.seatTier, identity.subscriptionType].filter(
+    Boolean
+  );
+  if (parts.length === 0) return null;
+  return <div className="text-[10px] text-fg-muted mt-0.5">{parts.join(" · ")}</div>;
+}

client/src/components/settings/__tests__/AccountSettings.test.tsx

@@ -2,8 +2,9 @@
  * @file AccountSettings.test.tsx
  * @description Settings → Account: shows the account's own information, saves
  * only a changed display name/email, refuses a password change whose two new
- * passwords differ, sends the current + new password, asks before signing
- * the other devices out, and uploads/removes the avatar.
+ * passwords differ, keeps a password that misses a rule from being sent,
+ * sends the current + new password, asks before signing
+ * the other devices out, and uploads/removes the avatar or sets it from a link.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -17,6 +18,7 @@ const me = vi.hoisted(() => ({
   changePassword: vi.fn(),
   signOutOthers: vi.fn(),
   setAvatar: vi.fn(),
+  setAvatarFromUrl: vi.fn(),
   removeAvatar: vi.fn(),
   avatarUrl: (at?: string | null) => (at ? `/api/me/avatar?v=${at}` : null),
 }));
@@ -76,6 +78,55 @@ describe("AccountSettings", () => {
     expect(await screen.findByTestId("user-avatar-initials")).toBeTruthy();
   });
 
+  /** jsdom never loads an image: play the browser's answer to `src`. */
+  const stubImage = (loads: boolean) =>
+    vi.stubGlobal(
+      "Image",
+      class {
+        naturalWidth = loads ? 64 : 0;
+        referrerPolicy = "";
+        onload: (() => void) | null = null;
+        onerror: (() => void) | null = null;
+        set src(_v: string) {
+          setTimeout(() => (loads ? this.onload?.() : this.onerror?.()), 0);
+        }
+      }
+    );
+
+  it("refuses a link this browser cannot load as an image, and saves nothing", async () => {
+    const ue = userEvent.setup();
+    stubImage(false);
+    render(<AccountSettings />);
+    await screen.findByTestId("account-card");
+    await ue.click(screen.getByTestId("account-avatar-url-toggle"));
+    await ue.type(
+      screen.getByTestId("account-avatar-url-input"),
+      "https://chat.example/api/v4/users/x/image{Enter}"
+    );
+    await waitFor(() => expect(screen.getByTestId("account-avatar-url-input")).toBeTruthy());
+    await new Promise((r) => setTimeout(r, 20));
+    expect(me.setAvatarFromUrl).not.toHaveBeenCalled();
+    vi.unstubAllGlobals();
+  });
+
+  it("sets the avatar from a link and closes the field", async () => {
+    const ue = userEvent.setup();
+    stubImage(true);
+    const withAvatar = { ...account, user: { ...account.user, avatarAt: "2026-10-21T00:00:00Z" } };
+    me.setAvatarFromUrl.mockResolvedValue(withAvatar);
+    render(<AccountSettings />);
+    await screen.findByTestId("account-card");
+    expect(screen.queryByTestId("account-avatar-url-input")).toBeNull();
+    await ue.click(screen.getByTestId("account-avatar-url-toggle"));
+    await ue.type(screen.getByTestId("account-avatar-url-input"), " https://x.vn/me.png {Enter}");
+    await waitFor(() => expect(me.setAvatarFromUrl).toHaveBeenCalledWith("https://x.vn/me.png"));
+    expect((await screen.findByTestId("user-avatar-img")).getAttribute("src")).toBe(
+      "/api/me/avatar?v=2026-10-21T00:00:00Z"
+    );
+    expect(screen.queryByTestId("account-avatar-url-input")).toBeNull();
+    vi.unstubAllGlobals();
+  });
+
   it("shows the account's own information", async () => {
     render(<AccountSettings />);
     const card = await screen.findByTestId("account-card");
@@ -114,9 +165,21 @@ describe("AccountSettings", () => {
     await ue.type(screen.getByLabelText("Current password"), "old-pass-1");
     await ue.type(screen.getByLabelText("New password"), "new-pass-123");
     await ue.type(screen.getByLabelText("Confirm new password"), "new-pass-123");
+    // No upper-case letter: the checklist says so and the button stays off.
+    expect(
+      screen
+        .getByTestId("password-rules")
+        .querySelector('[data-rule="upper"]')
+        ?.getAttribute("data-ok")
+    ).toBe("false");
+    expect(screen.getByRole("button", { name: "Change password" })).toBeDisabled();
+    await ue.clear(screen.getByLabelText("New password"));
+    await ue.clear(screen.getByLabelText("Confirm new password"));
+    await ue.type(screen.getByLabelText("New password"), "New-pass-123");
+    await ue.type(screen.getByLabelText("Confirm new password"), "New-pass-123");
     await ue.click(screen.getByRole("button", { name: "Change password" }));
     await waitFor(() =>
-      expect(me.changePassword).toHaveBeenCalledWith("old-pass-1", "new-pass-123")
+      expect(me.changePassword).toHaveBeenCalledWith("old-pass-1", "New-pass-123")
     );
   });
 

client/src/components/settings/__tests__/OmpSharingSettings.test.tsx

@@ -0,0 +1,74 @@
+/**
+ * @file Tests for OmpSharingSettings — the admin's Oh My Pi login-sharing
+ * switch in Settings → AI tools: hidden in local mode, for a non-admin and
+ * outside S3, and a toggle saves through PUT /api/ai-tools/omp-sharing and
+ * shows the daemons' state.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import "../../../i18n";
+import { OmpSharingSettings } from "../OmpSharingSettings";
+import { api, type OmpSharingState } from "../../../lib/api";
+
+const perms = vi.hoisted(() => ({ isAdmin: true, local: false }));
+vi.mock("../../AuthGate", () => ({ usePermissions: () => perms }));
+vi.mock("../../../lib/api", () => ({
+  api: { aiTools: { ompSharing: vi.fn(), setOmpSharing: vi.fn() } },
+}));
+
+const get = vi.mocked(api.aiTools.ompSharing);
+const set = vi.mocked(api.aiTools.setOmpSharing);
+const off: OmpSharingState = {
+  available: true,
+  enabled: false,
+  installed: true,
+  broker: { running: false, error: null },
+  gateway: { running: false, error: null },
+};
+
+describe("OmpSharingSettings", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    perms.isAdmin = true;
+    perms.local = false;
+  });
+
+  it("lets an admin turn sharing on and shows it running", async () => {
+    get.mockResolvedValue(off);
+    set.mockResolvedValue({
+      ...off,
+      enabled: true,
+      broker: { running: true },
+      gateway: { running: true, port: 4827 },
+    });
+    render(<OmpSharingSettings />);
+    const sw = await screen.findByRole("switch", { name: "Share this server's Oh My Pi login" });
+    fireEvent.click(sw);
+    await waitFor(() => expect(set).toHaveBeenCalledWith(true));
+    expect(await screen.findByTestId("omp-sharing-status")).toHaveTextContent("Running");
+  });
+
+  it("names a daemon's failure", async () => {
+    get.mockResolvedValue({
+      ...off,
+      enabled: true,
+      gateway: { running: false, error: "port 4827 is taken" },
+    });
+    render(<OmpSharingSettings />);
+    expect(await screen.findByTestId("omp-sharing-status")).toHaveTextContent("port 4827 is taken");
+  });
+
+  it("renders nothing outside S3, for a non-admin or in local mode", async () => {
+    get.mockResolvedValue({ ...off, available: false });
+    const r = render(<OmpSharingSettings />);
+    await waitFor(() => expect(get).toHaveBeenCalled());
+    expect(r.container).toBeEmptyDOMElement();
+    r.unmount();
+    perms.isAdmin = false;
+    const r2 = render(<OmpSharingSettings />);
+    expect(r2.container).toBeEmptyDOMElement();
+    expect(get).toHaveBeenCalledTimes(1);
+  });
+});

client/src/components/settings/__tests__/ToolProfilesSettings.test.tsx

@@ -0,0 +1,178 @@
+/**
+ * @file Tests for ToolProfilesSettings — Settings → AI tools → Profiles: one
+ * tab per AI tool. Claude's tab asks for EVERY saved account's quota once (a
+ * failing account costs the others nothing), and its right-click delete asks
+ * first and never offers to delete the only copy of the live account; Codex's
+ * tab switches through /api/tool-profiles; Antigravity says why it cannot be
+ * switched; and in server mode a profile links into the account pool.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, act } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { MemoryRouter } from "react-router-dom";
+import "../../../i18n";
+import { settleConfirm } from "../../../lib/confirm";
+import { ToolProfilesSettings } from "../ToolProfilesSettings";
+
+const perms = vi.hoisted(() => ({ isAdmin: true, local: true, seesAll: true }));
+vi.mock("../../AuthGate", () => ({ usePermissions: () => perms }));
+vi.mock("../../../hooks/useAiTools", () => ({
+  useAiTools: () => ({
+    byId: (id: string) => ({ id, installed: true, enabled: true }),
+  }),
+}));
+
+const m = vi.hoisted(() => {
+  const window = (utilization: number) => ({ utilization, resetsAt: "2026-09-18T08:00:00Z" });
+  return {
+    window,
+    cc: {
+      profiles: vi.fn(),
+      profileUsage: vi.fn(),
+      deleteProfile: vi.fn(),
+      activateProfile: vi.fn(),
+      saveProfile: vi.fn(),
+      renameProfile: vi.fn(),
+    },
+    tp: { list: vi.fn(), activate: vi.fn(), save: vi.fn(), rename: vi.fn(), remove: vi.fn() },
+    pool: { list: vi.fn() },
+  };
+});
+vi.mock("../../../lib/api", () => ({
+  api: {
+    ccConfig: m.cc,
+    toolProfiles: m.tp,
+    accountPool: m.pool,
+    aiTools: { iconUrl: (id: string) => `/icons/${id}.png` },
+  },
+}));
+
+async function settle() {
+  await act(async () => {
+    await new Promise((res) => setTimeout(res, 0));
+    await new Promise((res) => setTimeout(res, 0));
+  });
+}
+
+async function show() {
+  render(
+    <MemoryRouter>
+      <ToolProfilesSettings />
+    </MemoryRouter>
+  );
+  await settle();
+  await settle();
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  perms.local = true;
+  m.cc.profiles.mockResolvedValue({
+    items: [
+      { name: "work", label: "Work", active: true, accountUuid: "u1", email: "a@b.c" },
+      { name: "spare", label: "Spare", active: false, accountUuid: "u2", email: "d@e.f" },
+    ],
+    active: { accountUuid: "u1", email: "a@b.c" },
+  });
+  m.cc.profileUsage.mockImplementation(async (name: string) => {
+    if (name === "spare") throw new Error("this profile's saved login has been superseded");
+    return { name, refreshed: false, fiveHour: m.window(8), sevenDay: m.window(70) };
+  });
+  m.cc.deleteProfile.mockResolvedValue({ ok: true, name: "spare" });
+  m.tp.list.mockResolvedValue({
+    tools: [
+      {
+        tool: "codex",
+        supported: true,
+        items: [
+          {
+            name: "a",
+            label: "Alice",
+            active: true,
+            kind: "chatgpt",
+            email: "a@x",
+            detail: "plus",
+          },
+          { name: "b", label: "Bob", active: false, kind: "apikey", email: null, detail: "…1234" },
+        ],
+        active: { kind: "chatgpt", email: "a@x", detail: "plus" },
+      },
+      { tool: "omp", supported: true, items: [], active: null },
+      { tool: "antigravity", supported: false, reason: "keyring", items: [], active: null },
+    ],
+  });
+  m.tp.activate.mockResolvedValue({ ok: true, name: "b", savedOutgoing: "a" });
+  m.pool.list.mockResolvedValue({ accounts: [{ name: "p1" }], codex: [], blockPercent: 90 });
+});
+
+describe("ToolProfilesSettings — Claude", () => {
+  it("asks for every saved account's quota once, a failure costing the others nothing", async () => {
+    await show();
+    await settle();
+    expect(m.cc.profileUsage).toHaveBeenCalledWith("work");
+    expect(m.cc.profileUsage).toHaveBeenCalledWith("spare");
+    expect(m.cc.profileUsage.mock.calls.filter((c) => c[0] === "work")).toHaveLength(1);
+    expect(await screen.findByText("8%")).toBeInTheDocument();
+    expect(await screen.findByText(/saved login has been superseded/i)).toBeInTheDocument();
+  });
+
+  it("deletes from the right-click menu only after confirming", async () => {
+    const user = userEvent.setup();
+    await show();
+    await user.pointer({ keys: "[MouseRight]", target: screen.getByTestId("profile-row-spare") });
+    await user.click(screen.getByTestId("profile-menu-delete"));
+    await settle();
+    expect(m.cc.deleteProfile).not.toHaveBeenCalled();
+    await act(async () => settleConfirm(true));
+    await settle();
+    expect(m.cc.deleteProfile).toHaveBeenCalledWith("spare");
+  });
+
+  it("offers no delete for the only saved copy of the live account", async () => {
+    const user = userEvent.setup();
+    await show();
+    await user.pointer({ keys: "[MouseRight]", target: screen.getByTestId("profile-row-work") });
+    expect(screen.getByTestId("profile-menu")).toBeInTheDocument();
+    expect(screen.queryByTestId("profile-menu-delete")).toBeNull();
+  });
+});
+
+describe("ToolProfilesSettings — other tools", () => {
+  it("switches a Codex login through /api/tool-profiles", async () => {
+    const user = userEvent.setup();
+    await show();
+    await user.click(screen.getByRole("tab", { name: /codex/i }));
+    const bob = screen.getByTestId("profile-row-codex-b");
+    expect(bob).toHaveTextContent("…1234");
+    await user.click(screen.getByRole("button", { name: "Switch to" }));
+    await settle();
+    expect(m.tp.activate).toHaveBeenCalledWith("codex", "b");
+    expect(m.tp.list).toHaveBeenCalledTimes(2);
+  });
+
+  it("says why Antigravity cannot be switched", async () => {
+    const user = userEvent.setup();
+    await show();
+    await user.click(screen.getByRole("tab", { name: /antigravity/i }));
+    expect(screen.getByText(/system keyring/i)).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: "Switch to" })).toBeNull();
+  });
+});
+
+describe("ToolProfilesSettings — account pool", () => {
+  it("is not shown in local mode", async () => {
+    await show();
+    expect(m.pool.list).not.toHaveBeenCalled();
+    expect(screen.queryByText(/Move to pool/)).toBeNull();
+  });
+
+  it("in server mode shows the pool's size and links a profile into it", async () => {
+    perms.local = false;
+    await show();
+    expect(screen.getByText(/holds 1 account/)).toBeInTheDocument();
+    const [link] = screen.getAllByRole("link", { name: /Move to pool/ });
+    expect(link?.getAttribute("href")).toBe("/admin?poolAdd=claude&poolProfile=work#account-pool");
+  });
+});

client/src/components/users/AccountPoolCard.tsx

@@ -4,19 +4,23 @@
  * Claude and Codex accounts every user's new sessions are spread over, each
  * with its live panes, $ and tokens in the last 5 h / 7 d and quota — so nobody signs in
  * per user. An admin adds one — for Claude a login MOVED in from a saved
- * switch-user profile (`GET /api/accounts/profiles`), a pasted
- * `.credentials.json`, or a `claude setup-token` token; for Codex an OpenAI
- * API key or a pasted `auth.json` — or removes one, each time with their own
+ * profile (Settings → AI tools → Profiles, `GET /api/accounts/profiles`), a
+ * pasted `.credentials.json`, or a `claude setup-token` token; for Codex a
+ * saved Codex profile (`?tool=codex`), an OpenAI API key or a pasted
+ * `auth.json` — or removes one, each time with their own
  * password again; an analyst only reads. The secret only goes IN: the server
  * never sends it back. An account's Edit (pencil) picks the users who run on
  * it (`PUT /api/accounts/:name/users`): their sessions skip the balancer, and
- * a Claude login goes into their home at once — no restart.
+ * a Claude login goes into their home at once — no restart. A profile's
+ * "Move to pool" link lands here as `?poolAdd=<tool>&poolProfile=<name>`,
+ * which opens Add on that profile; the header links back to the profiles.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
 import { useCallback, useEffect, useState, type KeyboardEvent, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 import type { TFunction } from "i18next";
+import { Link, useSearchParams } from "react-router-dom";
 import { KeyRound, Pencil, Plus, RefreshCw, Trash2 } from "lucide-react";
 import {
   api,
@@ -77,7 +81,22 @@ export function AccountPoolCard({ isAdmin }: { isAdmin: boolean }) {
   const { t } = useTranslation("users");
   const [pool, setPool] = useState<AccountPool | null>(null);
   const [error, setError] = useState<string | null>(null);
-  const [adding, setAdding] = useState(false);
+  const [params, setParams] = useSearchParams();
+  // A profile's "Move to pool" (Settings → AI tools → Profiles) lands here.
+  const preset = (() => {
+    const tool = params.get("poolAdd");
+    const profile = params.get("poolProfile");
+    return (tool === "claude" || tool === "codex") && profile ? { tool, profile } : null;
+  })() as { tool: PoolTool; profile: string } | null;
+  const [adding, setAdding] = useState(() => isAdmin && preset !== null);
+  const closeAdd = () => {
+    setAdding(false);
+    if (!preset) return;
+    const next = new URLSearchParams(params);
+    next.delete("poolAdd");
+    next.delete("poolProfile");
+    setParams(next, { replace: true });
+  };
   const [removing, setRemoving] = useState<Row | null>(null);
   const [editing, setEditing] = useState<Row | null>(null);
 
@@ -102,13 +121,16 @@ export function AccountPoolCard({ isAdmin }: { isAdmin: boolean }) {
   const th = "px-5 py-2.5 text-[11px] font-semibold text-fg-muted uppercase tracking-wider";
 
   return (
-    <section className="card" data-testid="account-pool">
+    <section id="account-pool" className="card scroll-mt-24" data-testid="account-pool">
       <div className="flex flex-wrap items-center gap-2 px-5 py-4 border-b border-border">
         <KeyRound className="w-4 h-4 text-fg-muted" />
         <div className="flex-1 min-w-0">
           <h2 className="text-sm font-semibold text-fg-primary">{t("pool.title")}</h2>
           <p className="text-xs text-fg-muted">{t("pool.description")}</p>
         </div>
+        <Link to="/settings/agents#tool-profiles" className="btn-ghost text-xs">
+          {t("pool.profilesLink")}
+        </Link>
         <button
           type="button"
           onClick={refresh}
@@ -235,10 +257,11 @@ export function AccountPoolCard({ isAdmin }: { isAdmin: boolean }) {
       )}
       {adding && (
         <AddAccountDialog
-          onClose={() => setAdding(false)}
+          preset={preset}
+          onClose={closeAdd}
           onDone={(name) => {
             toast.success(t("pool.done.added", { name }));
-            setAdding(false);
+            closeAdd();
             void load();
           }}
         />
@@ -412,19 +435,27 @@ function EditAccountDialog({
 }
 
 type ClaudeSource = "profile" | "credentials" | "token";
+/** What each tool's pool account can come from (server/routes/accounts.js). */
+const SOURCES: Record<PoolTool, ClaudeSource[]> = {
+  claude: ["profile", "credentials", "token"],
+  codex: ["profile", "token"],
+};
 
 function AddAccountDialog({
+  preset,
   onClose,
   onDone,
 }: {
+  /** A saved profile to move in, from its "Move to pool" link. */
+  preset?: { tool: PoolTool; profile: string } | null;
   onClose: () => void;
   onDone: (name: string) => void;
 }) {
   const { t } = useTranslation("users");
-  const [tool, setTool] = useState<PoolTool>("claude");
+  const [tool, setTool] = useState<PoolTool>(preset?.tool ?? "claude");
   const [source, setSource] = useState<ClaudeSource>("profile");
   const [profiles, setProfiles] = useState<PoolProfile[] | null>(null);
-  const [profile, setProfile] = useState("");
+  const [profile, setProfile] = useState(preset?.profile ?? "");
   const [name, setName] = useState("");
   const [secret, setSecret] = useState("");
   const [current, setCurrent] = useState("");
@@ -432,13 +463,14 @@ function AddAccountDialog({
   const [error, setError] = useState<string | null>(null);
 
   useEffect(() => {
+    setProfiles(null);
     api.accountPool
-      .profiles()
+      .profiles(tool)
       .then((r) => setProfiles(r.profiles))
       .catch(() => setProfiles([]));
-  }, []);
+  }, [tool]);
 
-  const fromProfile = tool === "claude" && source === "profile";
+  const fromProfile = source === "profile";
   // A profile already names itself: its name is the default.
   const ready =
     current.length > 0 &&
@@ -449,10 +481,10 @@ function AddAccountDialog({
     setBusy(true);
     setError(null);
     const body: PoolAccountInput =
-      tool === "codex"
-        ? { tool, name: name.trim(), token: secret.trim() }
-        : source === "profile"
-          ? { tool, name: name.trim() || profile, profile }
+      source === "profile"
+        ? { tool, name: name.trim() || profile, profile }
+        : tool === "codex"
+          ? { tool, name: name.trim(), token: secret.trim() }
           : source === "credentials"
             ? { tool, name: name.trim(), credentials: secret.trim() }
             : { tool, name: name.trim(), token: secret.trim() };
@@ -491,29 +523,36 @@ function AddAccountDialog({
           <select
             className="input w-full text-sm"
             value={tool}
-            onChange={(e) => setTool(e.target.value as PoolTool)}
+            onChange={(e) => {
+              setTool(e.target.value as PoolTool);
+              setProfile("");
+              setSource("profile");
+            }}
             aria-label={t("pool.tool")}
           >
             <option value="claude">Claude Code</option>
             <option value="codex">Codex</option>
           </select>
         </Field>
-        {tool === "claude" && (
-          <Field label={t("pool.source")} hint={t(`pool.sourceHint.${source}`)}>
-            <select
-              className="input w-full text-sm"
-              value={source}
-              onChange={(e) => setSource(e.target.value as ClaudeSource)}
-              aria-label={t("pool.source")}
-            >
-              {(["profile", "credentials", "token"] as const).map((s) => (
-                <option key={s} value={s}>
-                  {t(`pool.sources.${s}`)}
-                </option>
-              ))}
-            </select>
-          </Field>
-        )}
+        <Field
+          label={t("pool.source")}
+          hint={t(`pool.sourceHint.${tool === "codex" && source === "token" ? "codex" : source}`)}
+        >
+          <select
+            className="input w-full text-sm"
+            value={source}
+            onChange={(e) => setSource(e.target.value as ClaudeSource)}
+            aria-label={t("pool.source")}
+          >
+            {SOURCES[tool].map((s) => (
+              <option key={s} value={s}>
+                {tool === "codex" && s === "token"
+                  ? t("pool.secret.codex")
+                  : t(`pool.sources.${s}`)}
+              </option>
+            ))}
+          </select>
+        </Field>
         {fromProfile && (
           <Field label={t("pool.profile")} hint={t("pool.profileHint")}>
             <select

client/src/components/users/PasswordRules.tsx

@@ -0,0 +1,39 @@
+/**
+ * @file PasswordRules.tsx
+ * @description The checklist under a "new password" field the account picks
+ * for itself (Settings → Account, the first-login password change, an admin's
+ * own password on the Users page): each rule of `lib/passwordRules.ts`, ticked
+ * as the password typed passes it.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+import { useTranslation } from "react-i18next";
+import { Check, Circle } from "lucide-react";
+import { PASSWORD_MIN_LENGTH, PASSWORD_RULES, passwordProblems } from "../../lib/passwordRules";
+
+export function PasswordRules({ password, username }: { password: string; username?: string }) {
+  const { t } = useTranslation("users");
+  const failed = new Set(passwordProblems(password, username));
+  return (
+    <ul className="grid gap-x-4 gap-y-1 text-xs sm:grid-cols-2" data-testid="password-rules">
+      {PASSWORD_RULES.map((rule) => {
+        const ok = password.length > 0 && !failed.has(rule);
+        return (
+          <li
+            key={rule}
+            className={`flex items-center gap-1.5 ${ok ? "text-status-success" : "text-fg-muted"}`}
+            data-rule={rule}
+            data-ok={ok}
+          >
+            {ok ? (
+              <Check className="h-3.5 w-3.5 flex-shrink-0" />
+            ) : (
+              <Circle className="h-3 w-3 flex-shrink-0" />
+            )}
+            {t(`passwordRules.${rule}`, { min: PASSWORD_MIN_LENGTH })}
+          </li>
+        );
+      })}
+    </ul>
+  );
+}

client/src/components/users/UserEditDialog.tsx

@@ -2,7 +2,9 @@
  * @file UserEditDialog.tsx
  * @description The Users page's ONE account editor (admin only): profile
  * (display name, email), access (role, active/disabled — neither for your own
- * account), a new password (typed or generated, copyable), the workspaces the
+ * account), a new password (typed or generated, copyable — someone else's
+ * may be anything and makes them choose their own at next sign-in; your own
+ * must pass every rule of `lib/passwordRules.ts`), the workspaces the
  * account owns (remove, add from every workspace), and "sign out everywhere".
  * Every change is staged and sent as ONE `PATCH /api/users/:id` carrying only
  * what changed, confirmed with the admin's OWN password (`currentPassword`) —
@@ -20,6 +22,8 @@ import type { Lane } from "../../lib/types";
 import { fmtCost, formatDateTime } from "../../lib/format";
 import { copyText } from "../../lib/clipboard";
 import { isSubmitEnter } from "../../lib/keys";
+import { passwordProblems } from "../../lib/passwordRules";
+import { PasswordRules } from "./PasswordRules";
 import { useDialog } from "../../hooks/useDialog";
 import { Switch } from "../Switch";
 import { Checkbox } from "../Checkbox";
@@ -34,11 +38,15 @@ export const ROLE_BADGE: Record<Role, string> = {
 };
 
 /** A random password of `n` characters, no look-alikes (0/O, 1/l/I). */
-export function generatePassword(n = 16): string {
+export function generatePassword(n = 16, username?: string): string {
   const chars = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789-_!@#%";
   const bytes = new Uint32Array(n);
-  crypto.getRandomValues(bytes);
-  return Array.from(bytes, (b) => chars[b % chars.length]).join("");
+  // Drawn again until it passes every rule, so it also fits an own password.
+  for (;;) {
+    crypto.getRandomValues(bytes);
+    const out = Array.from(bytes, (b) => chars[b % chars.length]).join("");
+    if (passwordProblems(out, username).length === 0) return out;
+  }
 }
 
 type OwnedWorkspace = { id: number; title: string; cwd: string };
@@ -110,8 +118,11 @@ export function UserEditDialog({
   if (removed.size) patch.removeWorkspaces = [...removed];
   if (signOut) patch.signOut = true;
   const changed = Object.keys(patch).length > 0;
-  // No minimum length (server/lib/auth.js) — a blank field keeps the password.
-  const ready = changed && current.length > 0 && !busy;
+  // A blank field keeps the password. Someone else's may be anything (they
+  // choose their own at next sign-in); your own must pass every rule.
+  const weakOwn =
+    self && password.length > 0 && passwordProblems(password, user.username).length > 0;
+  const ready = changed && current.length > 0 && !weakOwn && !busy;
 
   const submit = async () => {
     if (!ready) return;
@@ -309,7 +320,10 @@ export function UserEditDialog({
           </Section>
 
           <Section title={t("edit.password")}>
-            <Field label={t("newPassword")} hint={t("edit.passwordHint")}>
+            <Field
+              label={t("newPassword")}
+              hint={self ? t("edit.ownPasswordHint") : t("edit.passwordHint")}
+            >
               <div className="flex gap-2">
                 <input
                   type={showPassword ? "text" : "password"}
@@ -343,7 +357,7 @@ export function UserEditDialog({
                   type="button"
                   className="btn-ghost whitespace-nowrap text-xs"
                   onClick={() => {
-                    setPassword(generatePassword());
+                    setPassword(generatePassword(16, user.username));
                     setShowPassword(true);
                   }}
                 >
@@ -351,6 +365,11 @@ export function UserEditDialog({
                 </button>
               </div>
             </Field>
+            {self && password.length > 0 && (
+              <div className="mt-2">
+                <PasswordRules password={password} username={user.username} />
+              </div>
+            )}
           </Section>
 
           <Section title={t("workspaces")}>

client/src/components/users/__tests__/AccountPoolCard.test.tsx

@@ -13,6 +13,7 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { render, screen, waitFor } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
+import { MemoryRouter } from "react-router-dom";
 import type { AccountPool } from "../../../lib/api";
 
 const accountPool = vi.hoisted(() => ({
@@ -30,6 +31,13 @@ vi.mock("../../../lib/api", async (importOriginal) => {
 
 import { AccountPoolCard } from "../AccountPoolCard";
 
+/** The card reads `?poolAdd=` and links to Settings: it needs a router. */
+const card = (isAdmin: boolean, url = "/admin") => (
+  <MemoryRouter initialEntries={[url]}>
+    <AccountPoolCard isAdmin={isAdmin} />
+  </MemoryRouter>
+);
+
 const POOL: AccountPool = {
   accounts: [
     {
@@ -91,7 +99,7 @@ beforeEach(() => {
 
 describe("AccountPoolCard", () => {
   it("lists every account, and explains an empty pool", async () => {
-    const { unmount } = render(<AccountPoolCard isAdmin={false} />);
+    const { unmount } = render(card(false));
     expect(await screen.findByText("team-1")).toBeInTheDocument();
     expect(screen.getByText("cx-1")).toBeInTheDocument();
     expect(screen.getByText("42%")).toBeInTheDocument();
@@ -102,14 +110,14 @@ describe("AccountPoolCard", () => {
     expect(screen.queryByRole("button", { name: /remove/i })).toBeNull();
     unmount();
     accountPool.list.mockResolvedValue({ accounts: [], codex: [], blockPercent: 90 });
-    render(<AccountPoolCard isAdmin />);
+    render(card(true));
     expect(await screen.findByText(/no accounts yet/i)).toBeInTheDocument();
   });
 
   it("moves a saved login in, the server's own included", async () => {
     accountPool.add.mockResolvedValue({ account: { name: "work" } });
     const user = userEvent.setup();
-    render(<AccountPoolCard isAdmin />);
+    render(card(true));
     await screen.findByText("team-1");
     await user.click(screen.getByRole("button", { name: /add account/i }));
     const dialog = await screen.findByRole("dialog");
@@ -134,7 +142,7 @@ describe("AccountPoolCard", () => {
   it("adds a setup-token only with the admin's own password", async () => {
     accountPool.add.mockResolvedValue({ account: { name: "team-2" } });
     const user = userEvent.setup();
-    render(<AccountPoolCard isAdmin />);
+    render(card(true));
     await screen.findByText("team-1");
     await user.click(screen.getByRole("button", { name: /add account/i }));
     const dialog = await screen.findByRole("dialog");
@@ -159,7 +167,7 @@ describe("AccountPoolCard", () => {
   it("removes an account with the admin's own password", async () => {
     accountPool.remove.mockResolvedValue({ ok: true });
     const user = userEvent.setup();
-    render(<AccountPoolCard isAdmin />);
+    render(card(true));
     await user.click(await screen.findByRole("button", { name: "Remove cx-1" }));
     await user.type(await screen.findByLabelText("Your password"), "boss-pass");
     await user.click(screen.getByRole("button", { name: "Remove" }));
@@ -184,7 +192,7 @@ describe("AccountPoolCard", () => {
       removed: [{ userId: 8, username: "leo" }],
     });
     const user = userEvent.setup();
-    render(<AccountPoolCard isAdmin />);
+    render(card(true));
     expect(await screen.findByText("Used by: leo")).toBeInTheDocument();
     expect(screen.queryByRole("button", { name: /switch a user/i })).toBeNull();
     await user.click(screen.getByRole("button", { name: "Edit team-1" }));
@@ -206,4 +214,40 @@ describe("AccountPoolCard", () => {
       expect(accountPool.setUsers).toHaveBeenCalledWith("claude", "team-1", [7], "boss-pass")
     );
   });
+
+  it("moves a saved Codex profile in, and opens on one from its Move to pool link", async () => {
+    accountPool.add.mockResolvedValue({ account: { name: "cx" } });
+    accountPool.profiles.mockImplementation(async (tool: string) =>
+      tool === "codex"
+        ? {
+            profiles: [
+              { name: "cx", label: "Codex", email: "c@x", subscriptionType: "plus", active: false },
+            ],
+          }
+        : { profiles: [] }
+    );
+    const user = userEvent.setup();
+    render(card(true, "/admin?poolAdd=codex&poolProfile=cx"));
+    const dialog = await screen.findByRole("dialog");
+    await waitFor(() => expect(accountPool.profiles).toHaveBeenCalledWith("codex"));
+    expect(screen.getByLabelText("Tool")).toHaveValue("codex");
+    await waitFor(() => expect(screen.getByLabelText("Profile")).toHaveValue("cx"));
+    await user.type(screen.getByLabelText("Your password"), "boss-pass");
+    const confirm = Array.from(dialog.querySelectorAll("button")).find(
+      (b) => b.textContent === "Add account"
+    )!;
+    await user.click(confirm);
+    await waitFor(() =>
+      expect(accountPool.add).toHaveBeenCalledWith(
+        { tool: "codex", name: "cx", profile: "cx" },
+        "boss-pass"
+      )
+    );
+  });
+
+  it("links back to the profiles in Settings", async () => {
+    render(card(false));
+    const link = await screen.findByRole("link", { name: "Profiles in Settings" });
+    expect(link.getAttribute("href")).toBe("/settings/agents#tool-profiles");
+  });
 });

client/src/components/workflows/LanePipelinePanel.tsx

@@ -17,6 +17,7 @@ import { api } from "../../lib/api";
 import { useLiveRefresh } from "../../hooks/useLiveRefresh";
 import { laneChangeMatcher } from "../../lib/laneChange";
 import type { PipelineStats } from "../../lib/types";
+import { copyText } from "../../lib/clipboard";
 
 /** Percentage of `n` out of `total`, 0 when nothing was recorded. */
 function pct(n: number, total: number): number {
@@ -160,7 +161,7 @@ export function LanePipelinePanel({
                     type="button"
                     data-testid={`pipeline-stat-command-${n.id}`}
                     title={t("lanes.copyCommand", { command: n.command })}
-                    onClick={() => void navigator.clipboard?.writeText(n.command || "")}
+                    onClick={() => void copyText(n.command || "")}
                     className="block max-w-full truncate font-mono text-[10px] text-fg-muted hover:text-accent"
                   >
                     {n.command}

client/src/i18n/locales/en/artifacts.json

@@ -117,6 +117,20 @@
   "edit.description": "Description",
   "previewFailed": "Could not load this file.",
   "truncated": "Showing the first 1 MB — download the file to see all of it.",
+  "section.hub.own": "Shared by me",
+  "section.hub.ownHint": "Yours, visible to every user",
+  "section.hub.others": "Shared by others",
+  "section.hub.othersHint": "What other users shared — install what you need",
+  "section.mine.own": "Mine",
+  "section.mine.ownHint": "What you added",
+  "section.mine.others": "Installed from others",
+  "section.mine.othersHint": "Shared by other users, installed in your account",
+  "section.all.others": "Shared by others",
+  "section.all.othersHint": "What other users shared",
+  "section.all.own": "Mine",
+  "section.all.ownHint": "What you added, shared or not",
+  "pages": "Pages",
+  "section.empty": "Nothing here yet.",
   "tab.all": "All",
   "installedBadge": "Installed",
   "installsTitle": "Installs",
@@ -126,12 +140,7 @@
   "installsPluginWhere": "claude plugin install --scope user",
   "installsUnrecorded": "{{count}} earlier installs were counted before details were kept",
   "installsNoneOfYours": "You have not installed it — only your own installs are listed.",
-  "reinstall": "Reinstall",
-  "reinstallHint": "Write this version over your installed copy",
-  "reinstallTitle": "Reinstall “{{title}}”?",
-  "reinstallBody": "Your installed ~/.claude/skills/{{name}}/ and ~/.agents/skills/{{name}}/ are replaced with this version. The current copy is moved to ~/.claude/agenthub-replaced-skills/, not deleted.",
   "uninstall": "Uninstall",
-  "uninstallHint": "Remove it from your account",
   "uninstallTitle": "Uninstall “{{title}}”?",
   "uninstallSkillBody": "~/.claude/skills/{{name}}/ and ~/.agents/skills/{{name}}/ are moved to ~/.claude/agenthub-replaced-skills/, not deleted. Sessions already open keep it until they reload.",
   "uninstallPluginBody": "Runs claude plugin uninstall {{name}} for your account; the plugin's data folder is kept. Open sessions keep it until /reload-plugins.",
@@ -145,7 +154,7 @@
   "hubRemoveTitle": "Remove “{{title}}” from the Hub?",
   "hubRemoveBody": "It is no longer in your library, so it is deleted for good. Anything already installed from it stays installed.",
   "edit.otherFiles": "Its other {{count}} file(s) are kept as they are.",
-  "edit.reinstallNote": "Your installed copy keeps the old version until you Reinstall it.",
+  "edit.reinstallNote": "Your installed copy keeps the old version until you uninstall it and install it again.",
   "preview.instructions": "Instructions",
   "preview.frontmatter": "Frontmatter (SKILL.md header)",
   "preview.whenUsed": "When Claude uses it",

client/src/i18n/locales/en/common.json

@@ -198,7 +198,15 @@
     "tooMany": "Too many failed attempts — try again in a few minutes",
     "logout": "Sign out",
     "noAccount": "No account yet? Ask your administrator to create one.",
-    "signedInAs": "Signed in as {{name}} ({{role}})"
+    "signedInAs": "Signed in as {{name}} ({{role}})",
+    "mustChangeTitle": "Choose your own password",
+    "mustChangeSubtitle": "Your administrator gave you a starting password. Choose your own before you continue.",
+    "currentPassword": "Current password",
+    "newPassword": "New password",
+    "confirmPassword": "Confirm new password",
+    "mismatch": "The two new passwords differ",
+    "mustChangeSubmit": "Save and continue",
+    "saving": "Saving…"
   },
   "insights": {
     "help": {

client/src/i18n/locales/en/lanes.json

@@ -650,6 +650,8 @@
   "fx.noWorkspace": "There is no workspace yet. Add one first, then its files show here.",
   "fx.myHome": "Home",
   "fx.userHomes": "Users' homes",
+  "fx.users": "Users",
+  "fx.toggleWorkspaces": "Show or hide {{name}}’s workspaces",
   "fx.readOnlyHome": "Another user's home — view and download only; their Trash can be restored or emptied",
   "fx.readOnly": "Read-only",
   "fx.readOnlyHint": "This is another user's home: you can view, copy and download, not change it.",

client/src/i18n/locales/en/nav.json

@@ -72,7 +72,7 @@
     "quotaWrongAccount": "This sign-in belongs to another Claude account: log in as this account and save it again",
     "quotaActive": "in use",
     "quotaTokenExpired": "Sign-in expired: use the tool once so it signs in again",
-    "quotaProfileExpired": "Sign-in expired: use Check quota in Claude Code → Profiles to refresh it",
+    "quotaProfileExpired": "Sign-in expired: use Check quota in Settings → AI tools → Profiles to refresh it",
     "quotaSignInExpires": "Sign-in expires in {{time}}",
     "quotaSignInExpired": "Sign-in expired",
     "quotaWindow": {

client/src/i18n/locales/en/settings.json

@@ -77,21 +77,13 @@
       "run_done_other": "{{count}} runs finished 🐾"
     },
     "greet": {
-      "morning": [
-        "good morning! ☀️",
-        "morning! coffee first? ☕",
-        "rise and shine 🌤️"
-      ],
+      "morning": ["good morning! ☀️", "morning! coffee first? ☕", "rise and shine 🌤️"],
       "afternoon": [
         "good afternoon! 🐾",
         "hey, welcome back 😺",
         "afternoon! ready when you are ✨"
       ],
-      "evening": [
-        "good evening! 🌆",
-        "evening shift? I'm in 😼",
-        "hey there, night owl-to-be 🌙"
-      ],
+      "evening": ["good evening! 🌆", "evening shift? I'm in 😼", "hey there, night owl-to-be 🌙"],
       "night": [
         "burning the midnight oil? 🌙",
         "late one, huh? I'll keep watch 🦉",
@@ -114,11 +106,7 @@
       "help": "I'm {{name}} - I watch your sessions. Try \"what's running\", \"any errors\", \"what's waiting\" or \"status\". Anything else, I'll hand to Claude.",
       "whoami": "I'm {{name}}, your session-watching buddy 🐾 Right-click me to change my look, or click my name in the panel to rename me.",
       "hello": "hi there! 😺 {{summary}}.",
-      "thanks": [
-        "anytime! 💜",
-        "happy to help 😸",
-        "you got it 🐾"
-      ],
+      "thanks": ["anytime! 💜", "happy to help 😸", "you got it 🐾"],
       "errors_one": "{{count}} session errored{{list}} - open the panel to jump to it.",
       "errors_other": "{{count}} sessions errored{{list}} - open the panel to jump to them.",
       "errorsNone": "no errors - all clean 🐾",
@@ -175,41 +163,17 @@
         "can't reach the server 📡",
         "no signal - taking a nap 💤"
       ],
-      "worried": [
-        "that didn't look right 😟",
-        "keeping an eye out 👀",
-        "hmm, something's off 🫣"
-      ],
+      "worried": ["that didn't look right 😟", "keeping an eye out 👀", "hmm, something's off 🫣"],
       "stuck": [
         "a session's been quiet a while… 🤔",
         "is something stuck? ⏳",
         "still chewing on it… 😾"
       ],
-      "happy": [
-        "great run! 😻",
-        "love a tidy finish ✨",
-        "purrfect 💜"
-      ],
-      "thinking": [
-        "hmm, let me look… 🤔",
-        "sniffing around… 🐾",
-        "one sec, checking 🔍"
-      ],
-      "watching": [
-        "on the prowl 👀",
-        "watching your sessions 😼",
-        "eyes peeled 🐾"
-      ],
-      "sleeping": [
-        "zzz… 💤",
-        "wake me if something happens 😴",
-        "curled up, all calm 🐈"
-      ],
-      "idle": [
-        "all quiet 😺",
-        "ready when you are 🐾",
-        "just vibing ✨"
-      ]
+      "happy": ["great run! 😻", "love a tidy finish ✨", "purrfect 💜"],
+      "thinking": ["hmm, let me look… 🤔", "sniffing around… 🐾", "one sec, checking 🔍"],
+      "watching": ["on the prowl 👀", "watching your sessions 😼", "eyes peeled 🐾"],
+      "sleeping": ["zzz… 💤", "wake me if something happens 😴", "curled up, all calm 🐈"],
+      "idle": ["all quiet 😺", "ready when you are 🐾", "just vibing ✨"]
     },
     "chat": {
       "label": "Chat with {{name}}",
@@ -1140,6 +1104,21 @@
       "vi": "Tiếng Việt"
     }
   },
+  "ompSharing": {
+    "title": "Oh My Pi login sharing",
+    "switch": "Share this server's Oh My Pi login",
+    "hint": "Every user's omp sessions run on the logins the host account made with `omp login`, through omp's own auth broker and gateway on this machine. A session gets only a key that works while its pane runs, never the login itself. Only omp's built-in providers are shared.",
+    "running": "Running: broker and gateway are up.",
+    "starting": "Starting…",
+    "notInstalled": "omp is not installed on this server.",
+    "failed": "Not running: {{error}}"
+  },
+  "markdownView": {
+    "label": "Open Markdown as",
+    "description": "How a .md file opens in Files, Changes, the config viewer and a chat's file panel. Its Preview/Raw button still switches that one file. Saved to your account.",
+    "preview": "Preview",
+    "raw": "Raw"
+  },
   "workspaceTabs": {
     "title": "Workspace tabs",
     "description": "Which sessions the session view's tab bar holds. Saved to your account.",
@@ -1339,7 +1318,11 @@
       "remove": "Remove picture",
       "saved": "Picture updated",
       "removed": "Picture removed",
-      "tooBig": "The picture must be at most 1 MB"
+      "tooBig": "The picture must be at most 1 MB",
+      "fromUrl": "Use a picture from a link",
+      "urlPlaceholder": "https://… image link",
+      "urlApply": "Use",
+      "linkUnreachable": "That link did not load as an image in your browser — it may need a login (a Mattermost or other chat picture does). Download the picture and upload it instead."
     },
     "loadFailed": "Could not load your account: {{message}}",
     "memberSince": "Member since",
@@ -1367,5 +1350,32 @@
     "signOutOthersBody": "Every browser signed in to your account except this one is signed out.",
     "signedOut_one": "Signed out {{count}} other device",
     "signedOut_other": "Signed out {{count}} other devices"
+  },
+  "toolProfiles": {
+    "title": "Profiles",
+    "description": "Every AI tool's saved logins in one place. Switching swaps only the login; config, skills, sessions and history stay as they are.",
+    "poolCount_one": "The account pool holds {{count}} account for this tool.",
+    "poolCount_other": "The account pool holds {{count}} accounts for this tool.",
+    "openPool": "Open the account pool",
+    "moveToPool": "Move to pool",
+    "moveToPoolHint": "Administration → Users → Account pool, with this profile chosen. The pool becomes the login's only holder and the profile is removed.",
+    "saveButton": "Save this login as a profile",
+    "noActive": "{{tool}} holds no login on this machine.",
+    "noProfiles": "Could not load the profiles.",
+    "switchSuccess": "Switched {{tool}} to \"{{name}}\". Start a new session to use it.",
+    "deleteConfirmBody": "This removes the saved {{tool}} login. To use it again, sign in from a terminal and save it once more.",
+    "loginHint": "Add another {{tool}} login by signing in from a terminal first:",
+    "subtitle": {
+      "codex": "A profile is one Codex login (a ChatGPT account or an API key): the whole auth.json. config.toml, sessions, skills and history stay where they are.",
+      "omp": "A profile is the full set of logins Oh My Pi stores (every provider), read with `omp auth export` and put back with `omp auth import`. Settings, models and sessions stay where they are. Running omp sessions pick up the switch on their own."
+    },
+    "unsupported": {
+      "antigravity": "Antigravity keeps its login in the system keyring, which AgentHub does not read or write, so it cannot be switched from here. Sign in or out inside agy itself."
+    },
+    "kind": {
+      "chatgpt": "ChatGPT login",
+      "apikey": "API key",
+      "credentials": "Logins"
+    }
   }
 }

client/src/i18n/locales/en/users.json

@@ -30,7 +30,7 @@
   "username": "Username",
   "usernameHint": "Letters, digits, '.', '_' or '-'",
   "password": "Password",
-  "passwordHint": "No minimum length",
+  "passwordHint": "Any starting password — they choose their own at first sign-in",
   "newPassword": "New password",
   "changeRole": "Change role",
   "disable": "Disable",
@@ -68,6 +68,9 @@
   "errors": {
     "EBADIMAGE": "Only a PNG, JPEG, GIF or WebP picture",
     "ETOOBIG": "The picture must be at most 1 MB",
+    "EBADURL": "Enter an https:// link to a picture.",
+    "EPRIVATEURL": "That link points to a private or local address.",
+    "EFETCH": "Could not download the picture from that link.",
     "EREAUTH": "Your password is wrong.",
     "ETOOMANY": "Too many wrong passwords. Try again in 15 minutes.",
     "ESELF": "You cannot change your own role or disable yourself.",
@@ -81,7 +84,9 @@
     "EOWNERFOLDER": "That workspace's folder belongs to another user's account.",
     "EBADROLE": "Unknown role.",
     "ELOCALMODE": "Accounts are managed in server mode only.",
-    "ELASTADMIN": "The last admin cannot be deleted."
+    "ELASTADMIN": "The last admin cannot be deleted, demoted or disabled.",
+    "EWEAKPASSWORD": "The new password does not meet every rule (or is the current one).",
+    "EPWCHANGE": "Choose your own password first."
   },
   "readOnly": "Analysts can view accounts but not change them.",
   "auditTitle": "Audit log",
@@ -107,7 +112,7 @@
     "selfRole": "You cannot change your own role.",
     "selfDisable": "You cannot disable yourself.",
     "password": "Password",
-    "passwordHint": "Leave blank to keep the current one. A new one signs them out everywhere.",
+    "passwordHint": "Leave blank to keep the current one. A new one signs them out everywhere, and they choose their own at their next sign-in.",
     "show": "Show password",
     "hide": "Hide password",
     "copy": "Copy password",
@@ -122,7 +127,8 @@
     "sessions": "Sign-ins",
     "signOut": "Sign out everywhere",
     "signOutHint": "Ends this user's {{n}} active sign-in(s); they sign in again with their password.",
-    "noChanges": "No changes yet."
+    "noChanges": "No changes yet.",
+    "ownPasswordHint": "Leave blank to keep the current one. Your other sign-ins end."
   },
   "pool": {
     "title": "Account pool",
@@ -171,19 +177,20 @@
     },
     "source": "From",
     "sources": {
-      "profile": "A saved login (Switch account profiles)",
+      "profile": "A saved profile (Settings → AI tools → Profiles)",
       "credentials": "Paste .credentials.json / Keychain",
       "token": "claude setup-token"
     },
     "sourceHint": {
       "profile": "The login is moved into the pool: the profile leaves the switcher, and the server writes it into each user's home when their session starts.",
       "credentials": "From ~/.claude/.credentials.json, or on a Mac `security find-generic-password -s \"Claude Code-credentials\" -w`. Do not keep using that login where you copied it from — two copies log each other out.",
-      "token": "A one-year token from `claude setup-token`, given to every session as an environment variable."
+      "token": "A one-year token from `claude setup-token`, given to every session as an environment variable.",
+      "codex": "An OpenAI API key (sk-…), or the whole ~/.codex/auth.json after `codex login` with a ChatGPT account."
     },
     "profile": "Profile",
-    "profileHint": "Saved in Settings → Claude config → Switch account. The one this server's own Claude Code is logged into can be moved too: the server keeps running on it and refreshes it for everyone.",
+    "profileHint": "Saved in Settings → AI tools → Profiles. The one this server's own CLI is logged into can be moved too: the server keeps running on it.",
     "chooseProfile": "Choose a saved login…",
-    "noProfiles": "No saved logins — save one in Settings → Claude config → Switch account",
+    "noProfiles": "No saved profiles — save one in Settings → AI tools → Profiles",
     "loadingProfiles": "Loading…",
     "activeHere": "in use on this server — keeps working",
     "nameFromProfile": "Leave blank to use the profile's name",
@@ -210,7 +217,8 @@
     "users": "Users on this account",
     "noUsers": "No users yet.",
     "onAccount": "now on {{account}}",
-    "editDone": "{{name}} saved"
+    "editDone": "{{name}} saved",
+    "profilesLink": "Profiles in Settings"
   },
   "delete": {
     "button": "Delete user",
@@ -253,5 +261,15 @@
     "openHome": "Open home in Files",
     "copyUsername": "Copy username",
     "copyEmail": "Copy email"
+  },
+  "mustChange": "New password due",
+  "mustChangeHint": "Signed in with a password an admin gave; must choose their own before using AgentHub",
+  "passwordRules": {
+    "length": "At least {{min}} characters",
+    "lower": "A lower-case letter",
+    "upper": "An upper-case letter",
+    "digit": "A digit",
+    "symbol": "A symbol (e.g. ! - _ @)",
+    "username": "Does not contain the username"
   }
 }

client/src/i18n/locales/vi/artifacts.json

@@ -117,6 +117,20 @@
   "edit.description": "Mô tả",
   "previewFailed": "Không tải được file này.",
   "truncated": "Chỉ hiển thị 1 MB đầu — tải file về để xem toàn bộ.",
+  "section.hub.own": "Tôi đã share",
+  "section.hub.ownHint": "Của bạn, mọi người dùng đều thấy",
+  "section.hub.others": "Người khác share",
+  "section.hub.othersHint": "Những gì người dùng khác đã share — cài cái bạn cần",
+  "section.mine.own": "Của tôi",
+  "section.mine.ownHint": "Những gì bạn đã thêm",
+  "section.mine.others": "Đã cài từ người khác",
+  "section.mine.othersHint": "Người dùng khác share, đã cài vào tài khoản của bạn",
+  "section.all.others": "Người khác share",
+  "section.all.othersHint": "Những gì người dùng khác đã share",
+  "section.all.own": "Của tôi",
+  "section.all.ownHint": "Những gì bạn đã thêm, đã share hoặc chưa",
+  "pages": "Trang",
+  "section.empty": "Chưa có gì.",
   "tab.all": "Tất cả",
   "installedBadge": "Đã cài",
   "installsTitle": "Lượt cài",
@@ -126,12 +140,7 @@
   "installsPluginWhere": "claude plugin install --scope user",
   "installsUnrecorded": "{{count}} lượt cài trước đây chỉ được đếm, không lưu chi tiết",
   "installsNoneOfYours": "Bạn chưa cài — chỉ hiện các lượt cài của bạn.",
-  "reinstall": "Cài lại",
-  "reinstallHint": "Ghi bản này đè lên bản bạn đã cài",
-  "reinstallTitle": "Cài lại “{{title}}”?",
-  "reinstallBody": "Bản đã cài ở ~/.claude/skills/{{name}}/ và ~/.agents/skills/{{name}}/ sẽ được thay bằng bản này. Bản hiện tại được chuyển vào ~/.claude/agenthub-replaced-skills/, không bị xoá.",
   "uninstall": "Gỡ cài đặt",
-  "uninstallHint": "Gỡ khỏi tài khoản của bạn",
   "uninstallTitle": "Gỡ cài đặt “{{title}}”?",
   "uninstallSkillBody": "~/.claude/skills/{{name}}/ và ~/.agents/skills/{{name}}/ sẽ được chuyển vào ~/.claude/agenthub-replaced-skills/, không bị xoá. Các phiên đang mở vẫn giữ nó cho tới khi tải lại.",
   "uninstallPluginBody": "Chạy claude plugin uninstall {{name}} cho tài khoản của bạn; thư mục dữ liệu của plugin được giữ lại. Các phiên đang mở vẫn giữ nó cho tới khi /reload-plugins.",
@@ -145,7 +154,7 @@
   "hubRemoveTitle": "Gỡ “{{title}}” khỏi Hub?",
   "hubRemoveBody": "Mục này không còn trong thư viện của bạn nên sẽ bị xoá hẳn. Những gì đã cài từ nó vẫn được giữ.",
   "edit.otherFiles": "{{count}} file khác của skill được giữ nguyên.",
-  "edit.reinstallNote": "Bản bạn đã cài vẫn là bản cũ cho đến khi bấm Cài lại.",
+  "edit.reinstallNote": "Bản bạn đã cài vẫn là bản cũ cho đến khi bạn gỡ cài đặt rồi cài lại.",
   "preview.instructions": "Hướng dẫn",
   "preview.frontmatter": "Frontmatter (phần đầu SKILL.md)",
   "preview.whenUsed": "Khi nào Claude dùng",

client/src/i18n/locales/vi/common.json

@@ -198,7 +198,15 @@
     "tooMany": "Sai quá nhiều lần — hãy thử lại sau vài phút",
     "logout": "Đăng xuất",
     "noAccount": "Chưa có tài khoản? Hãy nhờ quản trị viên tạo cho bạn.",
-    "signedInAs": "Đang đăng nhập: {{name}} ({{role}})"
+    "signedInAs": "Đang đăng nhập: {{name}} ({{role}})",
+    "mustChangeTitle": "Đặt mật khẩu của bạn",
+    "mustChangeSubtitle": "Quản trị viên đã cấp cho bạn mật khẩu ban đầu. Hãy đặt mật khẩu riêng trước khi tiếp tục.",
+    "currentPassword": "Mật khẩu hiện tại",
+    "newPassword": "Mật khẩu mới",
+    "confirmPassword": "Nhập lại mật khẩu mới",
+    "mismatch": "Hai mật khẩu mới không khớp",
+    "mustChangeSubmit": "Lưu và tiếp tục",
+    "saving": "Đang lưu…"
   },
   "insights": {
     "help": {

client/src/i18n/locales/vi/lanes.json

@@ -650,6 +650,8 @@
   "fx.noWorkspace": "Chưa có workspace nào. Hãy thêm một workspace, file của nó sẽ hiện ở đây.",
   "fx.myHome": "Thư mục home",
   "fx.userHomes": "Home của các user",
+  "fx.users": "Người dùng",
+  "fx.toggleWorkspaces": "Hiện/ẩn workspace của {{name}}",
   "fx.readOnlyHome": "Home của user khác — chỉ xem và tải về; Thùng rác của họ thì khôi phục hoặc xoá được",
   "fx.readOnly": "Chỉ đọc",
   "fx.readOnlyHint": "Đây là home của user khác: bạn chỉ xem, sao chép và tải về được, không sửa được.",

client/src/i18n/locales/vi/nav.json

@@ -72,7 +72,7 @@
     "quotaWrongAccount": "Lượt đăng nhập này thuộc tài khoản Claude khác: đăng nhập lại đúng tài khoản này rồi lưu lại",
     "quotaActive": "đang dùng",
     "quotaTokenExpired": "Đăng nhập đã hết hạn: dùng công cụ một lần để nó đăng nhập lại",
-    "quotaProfileExpired": "Đăng nhập đã hết hạn: bấm Kiểm tra quota trong Claude Code → Profiles để làm mới",
+    "quotaProfileExpired": "Đăng nhập đã hết hạn: bấm Kiểm tra quota trong Cài đặt → AI tools → Hồ sơ đăng nhập để làm mới",
     "quotaSignInExpires": "Đăng nhập hết hạn sau {{time}}",
     "quotaSignInExpired": "Đăng nhập đã hết hạn",
     "quotaWindow": {

client/src/i18n/locales/vi/settings.json

@@ -77,26 +77,10 @@
       "run_done_other": "{{count}} lượt chạy vừa xong 🐾"
     },
     "greet": {
-      "morning": [
-        "chào buổi sáng! ☀️",
-        "sáng rồi! cà phê chưa? ☕",
-        "ngày mới tốt lành nha 🌤️"
-      ],
-      "afternoon": [
-        "chào buổi chiều! 🐾",
-        "bạn quay lại rồi 😺",
-        "chiều nay làm gì đây? ✨"
-      ],
-      "evening": [
-        "chào buổi tối! 🌆",
-        "ca tối hả? có mình đây 😼",
-        "tối rồi, cố lên nhé 🌙"
-      ],
-      "night": [
-        "khuya rồi mà vẫn làm à? 🌙",
-        "để mình canh giúp cho 🦉",
-        "nhớ nghỉ ngơi nha 💤"
-      ],
+      "morning": ["chào buổi sáng! ☀️", "sáng rồi! cà phê chưa? ☕", "ngày mới tốt lành nha 🌤️"],
+      "afternoon": ["chào buổi chiều! 🐾", "bạn quay lại rồi 😺", "chiều nay làm gì đây? ✨"],
+      "evening": ["chào buổi tối! 🌆", "ca tối hả? có mình đây 😼", "tối rồi, cố lên nhé 🌙"],
+      "night": ["khuya rồi mà vẫn làm à? 🌙", "để mình canh giúp cho 🦉", "nhớ nghỉ ngơi nha 💤"],
       "summary_one": "{{count}} phiên đang chạy",
       "summary_other": "{{count}} phiên đang chạy",
       "summaryWaiting": "{{count}} phiên chờ bạn",
@@ -114,11 +98,7 @@
       "help": "Mình là {{name}} - mình canh các phiên của bạn. Thử hỏi \"đang chạy gì\", \"có lỗi không\", \"cái gì đang chờ\" hoặc \"tình hình\". Câu khác mình sẽ chuyển cho Claude.",
       "whoami": "Mình là {{name}}, bạn đồng hành canh phiên của bạn 🐾 Chuột phải vào mình để đổi ngoại hình, hoặc bấm vào tên trong bảng để đặt tên mới.",
       "hello": "chào bạn! 😺 {{summary}}.",
-      "thanks": [
-        "có gì đâu! 💜",
-        "rất vui được giúp 😸",
-        "chuyện nhỏ 🐾"
-      ],
+      "thanks": ["có gì đâu! 💜", "rất vui được giúp 😸", "chuyện nhỏ 🐾"],
       "errors_one": "{{count}} phiên bị lỗi{{list}} - mở bảng để xem nhé.",
       "errors_other": "{{count}} phiên bị lỗi{{list}} - mở bảng để xem nhé.",
       "errorsNone": "không có lỗi nào - sạch sẽ 🐾",
@@ -175,41 +155,13 @@
         "không gọi được máy chủ 📡",
         "mất sóng - đi ngủ chút 💤"
       ],
-      "worried": [
-        "có vẻ không ổn 😟",
-        "mình đang để mắt đây 👀",
-        "hừm, có gì đó lạ lạ 🫣"
-      ],
-      "stuck": [
-        "một phiên im lặng lâu rồi… 🤔",
-        "có gì bị kẹt không? ⏳",
-        "vẫn đang nhai… 😾"
-      ],
-      "happy": [
-        "tuyệt vời! 😻",
-        "kết thúc gọn ghê ✨",
-        "hoàn hảo 💜"
-      ],
-      "thinking": [
-        "để mình xem… 🤔",
-        "đang đánh hơi… 🐾",
-        "chờ chút, đang kiểm tra 🔍"
-      ],
-      "watching": [
-        "đang tuần tra 👀",
-        "đang canh các phiên của bạn 😼",
-        "mắt mở to 🐾"
-      ],
-      "sleeping": [
-        "zzz… 💤",
-        "có gì thì gọi mình dậy nhé 😴",
-        "cuộn tròn, mọi thứ yên ổn 🐈"
-      ],
-      "idle": [
-        "yên ắng quá 😺",
-        "sẵn sàng khi bạn cần 🐾",
-        "chill thôi ✨"
-      ]
+      "worried": ["có vẻ không ổn 😟", "mình đang để mắt đây 👀", "hừm, có gì đó lạ lạ 🫣"],
+      "stuck": ["một phiên im lặng lâu rồi… 🤔", "có gì bị kẹt không? ⏳", "vẫn đang nhai… 😾"],
+      "happy": ["tuyệt vời! 😻", "kết thúc gọn ghê ✨", "hoàn hảo 💜"],
+      "thinking": ["để mình xem… 🤔", "đang đánh hơi… 🐾", "chờ chút, đang kiểm tra 🔍"],
+      "watching": ["đang tuần tra 👀", "đang canh các phiên của bạn 😼", "mắt mở to 🐾"],
+      "sleeping": ["zzz… 💤", "có gì thì gọi mình dậy nhé 😴", "cuộn tròn, mọi thứ yên ổn 🐈"],
+      "idle": ["yên ắng quá 😺", "sẵn sàng khi bạn cần 🐾", "chill thôi ✨"]
     },
     "chat": {
       "label": "Trò chuyện với {{name}}",
@@ -1140,6 +1092,21 @@
       "vi": "Tiếng Việt"
     }
   },
+  "ompSharing": {
+    "title": "Dùng chung đăng nhập Oh My Pi",
+    "switch": "Dùng chung đăng nhập Oh My Pi của máy chủ",
+    "hint": "Mọi session omp của người dùng chạy bằng các đăng nhập mà tài khoản máy chủ đã tạo bằng `omp login`, qua auth broker và gateway của chính omp trên máy này. Session chỉ nhận một key dùng được khi pane còn chạy, không bao giờ nhận chính đăng nhập. Chỉ các provider có sẵn của omp được dùng chung.",
+    "running": "Đang chạy: broker và gateway đã sẵn sàng.",
+    "starting": "Đang khởi động…",
+    "notInstalled": "Máy chủ chưa cài omp.",
+    "failed": "Không chạy: {{error}}"
+  },
+  "markdownView": {
+    "label": "Mở file Markdown dạng",
+    "description": "Cách file .md mở trong Files, Changes, trình xem cấu hình và bảng file của chat. Nút Xem trước/Mã nguồn vẫn đổi riêng file đó. Lưu theo tài khoản.",
+    "preview": "Xem trước",
+    "raw": "Mã nguồn"
+  },
   "workspaceTabs": {
     "title": "Tab của workspace",
     "description": "Thanh tab của màn hình session chứa những session nào. Lưu theo tài khoản.",
@@ -1339,7 +1306,11 @@
       "remove": "Xoá ảnh đại diện",
       "saved": "Đã cập nhật ảnh đại diện",
       "removed": "Đã xoá ảnh đại diện",
-      "tooBig": "Ảnh tối đa 1 MB"
+      "tooBig": "Ảnh tối đa 1 MB",
+      "fromUrl": "Dùng ảnh từ đường dẫn",
+      "urlPlaceholder": "https://… đường dẫn ảnh",
+      "urlApply": "Dùng",
+      "linkUnreachable": "Trình duyệt không tải được ảnh từ link này — có thể link cần đăng nhập (ảnh Mattermost hay app chat khác là vậy). Hãy tải ảnh về rồi upload lên."
     },
     "loadFailed": "Không tải được tài khoản: {{message}}",
     "memberSince": "Tham gia từ",
@@ -1367,5 +1338,32 @@
     "signOutOthersBody": "Mọi trình duyệt đang đăng nhập tài khoản của bạn, trừ trình duyệt này, sẽ bị đăng xuất.",
     "signedOut_one": "Đã đăng xuất {{count}} thiết bị khác",
     "signedOut_other": "Đã đăng xuất {{count}} thiết bị khác"
+  },
+  "toolProfiles": {
+    "title": "Hồ sơ đăng nhập",
+    "description": "Mọi đăng nhập đã lưu của các AI tool ở một nơi. Khi đổi chỉ phần đăng nhập được hoán đổi; config, skills, phiên làm việc và lịch sử vẫn giữ nguyên.",
+    "poolCount_one": "Account pool đang có {{count}} tài khoản cho tool này.",
+    "poolCount_other": "Account pool đang có {{count}} tài khoản cho tool này.",
+    "openPool": "Mở account pool",
+    "moveToPool": "Đưa vào pool",
+    "moveToPoolHint": "Quản trị → Người dùng → Account pool, chọn sẵn hồ sơ này. Pool sẽ là nơi duy nhất giữ đăng nhập này và hồ sơ được xoá.",
+    "saveButton": "Lưu đăng nhập này thành hồ sơ",
+    "noActive": "{{tool}} chưa có đăng nhập nào trên máy này.",
+    "noProfiles": "Không tải được danh sách hồ sơ.",
+    "switchSuccess": "Đã chuyển {{tool}} sang \"{{name}}\". Mở phiên mới để dùng.",
+    "deleteConfirmBody": "Thao tác này xoá đăng nhập {{tool}} đã lưu. Muốn dùng lại, hãy đăng nhập từ terminal và lưu lại lần nữa.",
+    "loginHint": "Thêm đăng nhập {{tool}} khác bằng cách đăng nhập từ terminal trước:",
+    "subtitle": {
+      "codex": "Mỗi hồ sơ là một đăng nhập Codex (tài khoản ChatGPT hoặc API key): toàn bộ auth.json. config.toml, phiên, skills và lịch sử vẫn giữ nguyên.",
+      "omp": "Mỗi hồ sơ là toàn bộ các đăng nhập Oh My Pi đang lưu (mọi provider), đọc bằng `omp auth export` và ghi lại bằng `omp auth import`. Settings, model và phiên vẫn giữ nguyên. Các phiên omp đang chạy tự nhận đăng nhập mới."
+    },
+    "unsupported": {
+      "antigravity": "Antigravity lưu đăng nhập trong keyring của hệ điều hành, AgentHub không đọc hay ghi vào đó nên không đổi được từ đây. Hãy đăng nhập/đăng xuất ngay trong agy."
+    },
+    "kind": {
+      "chatgpt": "Đăng nhập ChatGPT",
+      "apikey": "API key",
+      "credentials": "Đăng nhập"
+    }
   }
 }

client/src/i18n/locales/vi/users.json

@@ -30,7 +30,7 @@
   "username": "Tên đăng nhập",
   "usernameHint": "Chữ, số, '.', '_' hoặc '-'",
   "password": "Mật khẩu",
-  "passwordHint": "Không giới hạn độ dài tối thiểu",
+  "passwordHint": "Mật khẩu ban đầu tuỳ ý — người dùng sẽ tự đặt mật khẩu riêng ở lần đăng nhập đầu",
   "newPassword": "Mật khẩu mới",
   "changeRole": "Đổi vai trò",
   "disable": "Khoá",
@@ -68,6 +68,9 @@
   "errors": {
     "EBADIMAGE": "Chỉ nhận ảnh PNG, JPEG, GIF hoặc WebP",
     "ETOOBIG": "Ảnh tối đa 1 MB",
+    "EBADURL": "Hãy nhập đường dẫn https:// tới một ảnh.",
+    "EPRIVATEURL": "Đường dẫn trỏ tới địa chỉ nội bộ hoặc cục bộ.",
+    "EFETCH": "Không tải được ảnh từ đường dẫn này.",
     "EREAUTH": "Mật khẩu của bạn không đúng.",
     "ETOOMANY": "Nhập sai mật khẩu quá nhiều lần. Thử lại sau 15 phút.",
     "ESELF": "Bạn không thể tự đổi vai trò hay tự khoá chính mình.",
@@ -81,7 +84,9 @@
     "EOWNERFOLDER": "Thư mục của workspace đó thuộc tài khoản của người dùng khác.",
     "EBADROLE": "Vai trò không hợp lệ.",
     "ELOCALMODE": "Chỉ quản lý tài khoản được ở chế độ server.",
-    "ELASTADMIN": "Không thể xoá admin cuối cùng."
+    "ELASTADMIN": "Không thể xoá, hạ quyền hay khoá admin cuối cùng.",
+    "EWEAKPASSWORD": "Mật khẩu mới chưa đạt đủ các yêu cầu (hoặc trùng mật khẩu hiện tại).",
+    "EPWCHANGE": "Hãy đặt mật khẩu riêng của bạn trước."
   },
   "readOnly": "Analyst chỉ xem được tài khoản, không thay đổi được.",
   "auditTitle": "Nhật ký audit",
@@ -107,7 +112,7 @@
     "selfRole": "Bạn không thể đổi vai trò của chính mình.",
     "selfDisable": "Bạn không thể tự vô hiệu hoá mình.",
     "password": "Mật khẩu",
-    "passwordHint": "Để trống để giữ mật khẩu hiện tại. Mật khẩu mới sẽ đăng xuất họ ở mọi nơi.",
+    "passwordHint": "Để trống để giữ mật khẩu hiện tại. Mật khẩu mới sẽ đăng xuất họ ở mọi nơi và họ phải tự đặt mật khẩu riêng ở lần đăng nhập sau.",
     "show": "Hiện mật khẩu",
     "hide": "Ẩn mật khẩu",
     "copy": "Sao chép mật khẩu",
@@ -122,7 +127,8 @@
     "sessions": "Phiên đăng nhập",
     "signOut": "Đăng xuất ở mọi nơi",
     "signOutHint": "Kết thúc {{n}} phiên đăng nhập đang hoạt động của người này; họ đăng nhập lại bằng mật khẩu.",
-    "noChanges": "Chưa có thay đổi."
+    "noChanges": "Chưa có thay đổi.",
+    "ownPasswordHint": "Để trống để giữ mật khẩu hiện tại. Các phiên đăng nhập khác của bạn sẽ kết thúc."
   },
   "pool": {
     "title": "Pool tài khoản",
@@ -171,19 +177,20 @@
     },
     "source": "Nguồn",
     "sources": {
-      "profile": "Login đã lưu (profile Switch account)",
+      "profile": "Hồ sơ đã lưu (Cài đặt → AI tools → Hồ sơ đăng nhập)",
       "credentials": "Dán .credentials.json / Keychain",
       "token": "claude setup-token"
     },
     "sourceHint": {
       "profile": "Login được chuyển vào pool: profile rời khỏi trình đổi tài khoản, và server ghi nó vào home của từng user khi phiên của họ bắt đầu.",
       "credentials": "Lấy từ ~/.claude/.credentials.json, hoặc trên Mac: `security find-generic-password -s \"Claude Code-credentials\" -w`. Đừng dùng tiếp login đó ở nơi đã copy — hai bản sẽ làm nhau bị đăng xuất.",
-      "token": "Token 1 năm từ `claude setup-token`, đưa vào mọi phiên qua biến môi trường."
+      "token": "Token 1 năm từ `claude setup-token`, đưa vào mọi phiên qua biến môi trường.",
+      "codex": "OpenAI API key (sk-…), hoặc toàn bộ ~/.codex/auth.json sau khi `codex login` bằng tài khoản ChatGPT."
     },
     "profile": "Profile",
-    "profileHint": "Lưu ở Settings → Claude config → Switch account. Profile mà Claude Code của server đang dùng cũng chuyển được: server vẫn chạy trên nó và tự làm mới cho mọi người.",
+    "profileHint": "Lưu ở Cài đặt → AI tools → Hồ sơ đăng nhập. Hồ sơ mà CLI của server đang dùng cũng chuyển được: server vẫn chạy trên nó.",
     "chooseProfile": "Chọn login đã lưu…",
-    "noProfiles": "Chưa có login nào — lưu ở Settings → Claude config → Switch account",
+    "noProfiles": "Chưa có hồ sơ nào — lưu ở Cài đặt → AI tools → Hồ sơ đăng nhập",
     "loadingProfiles": "Đang tải…",
     "activeHere": "server đang dùng — vẫn chạy tiếp",
     "nameFromProfile": "Để trống để dùng tên profile",
@@ -210,7 +217,8 @@
     "users": "User dùng tài khoản này",
     "noUsers": "Chưa có user nào.",
     "onAccount": "đang ở {{account}}",
-    "editDone": "Đã lưu {{name}}"
+    "editDone": "Đã lưu {{name}}",
+    "profilesLink": "Hồ sơ trong Cài đặt"
   },
   "delete": {
     "button": "Xoá user",
@@ -253,5 +261,15 @@
     "openHome": "Mở home trong Files",
     "copyUsername": "Sao chép username",
     "copyEmail": "Sao chép email"
+  },
+  "mustChange": "Chờ đổi mật khẩu",
+  "mustChangeHint": "Đang dùng mật khẩu do admin cấp; phải tự đặt mật khẩu riêng trước khi dùng AgentHub",
+  "passwordRules": {
+    "length": "Ít nhất {{min}} ký tự",
+    "lower": "Có chữ thường",
+    "upper": "Có chữ hoa",
+    "digit": "Có chữ số",
+    "symbol": "Có ký tự đặc biệt (vd. ! - _ @)",
+    "username": "Không chứa tên đăng nhập"
   }
 }

client/src/lib/__tests__/promptAttach.test.ts

@@ -3,7 +3,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 import { describe, expect, it } from "vitest";
-import { claudePastes } from "../promptAttach";
+import { claudePastes, copiedFilePaths, localCandidates } from "../promptAttach";
 
 describe("claudePastes", () => {
   it("pastes each image as its bare path and the other files as one @ mention paste", () => {
@@ -18,3 +18,46 @@ describe("claudePastes", () => {
     ]);
   });
 });
+
+/** A clipboard as the browser hands it to a paste handler. */
+const clip = (data: Record<string, string>) =>
+  ({ getData: (t: string) => data[t] ?? "" }) as unknown as DataTransfer;
+const file = (name: string) => new File(["x"], name);
+
+describe("localCandidates (a file manager's copy, pasted)", () => {
+  it("takes the plain-text paths when their names match the pasted files", () => {
+    expect(window.location.hostname).toBe("localhost");
+    const dt = clip({ "text/plain": "/home/u/Videos/big.mp4\n/home/u/b c.pdf\n" });
+    expect(localCandidates(dt, [file("b c.pdf"), file("big.mp4")])).toEqual([
+      "/home/u/Videos/big.mp4",
+      "/home/u/b c.pdf",
+    ]);
+  });
+
+  it("takes file:// lines too, decoded", () => {
+    const dt = clip({ "text/plain": "file:///home/u/a%20b.zip" });
+    expect(localCandidates(dt, [file("a b.zip")])).toEqual(["/home/u/a b.zip"]);
+  });
+
+  it("refuses text that does not name exactly the pasted files", () => {
+    expect(localCandidates(clip({ "text/plain": "/etc/passwd" }), [file("big.mp4")])).toBeNull();
+    expect(localCandidates(clip({ "text/plain": "hello" }), [file("hello")])).toBeNull();
+    expect(
+      localCandidates(clip({ "text/plain": "/a/x.txt" }), [file("x.txt"), file("y.txt")])
+    ).toBeNull();
+  });
+
+  it("prefers a uri-list (a drag) as before", () => {
+    const dt = clip({ "text/uri-list": "file:///tmp/z.bin", "text/plain": "/other/z.bin" });
+    expect(localCandidates(dt, [file("z.bin")])).toEqual(["/tmp/z.bin"]);
+  });
+});
+
+describe("copiedFilePaths (no file beside the text)", () => {
+  it("takes file:// text, never bare absolute paths, which stay text to paste", () => {
+    expect(copiedFilePaths(clip({ "text/plain": "file:///home/u/a.txt" }))).toEqual([
+      "/home/u/a.txt",
+    ]);
+    expect(copiedFilePaths(clip({ "text/plain": "/home/u/a.txt" }))).toBeNull();
+  });
+});

client/src/lib/api.ts

@@ -699,6 +699,29 @@ export type PoolProfile = {
   subscriptionType: string | null;
   active: boolean;
 };
+/** A login profile of a tool other than Claude (`/api/tool-profiles`) — never a token. */
+export type ToolProfileIdentity = {
+  /** codex: `chatgpt` | `apikey`; omp: `credentials`. */
+  kind: string;
+  email: string | null;
+  /** codex: the ChatGPT plan or `…1234` of a key; omp: its providers. */
+  detail: string | null;
+};
+export type ToolProfile = ToolProfileIdentity & {
+  name: string;
+  label: string;
+  savedAt: number | null;
+  active: boolean;
+};
+export type ToolProfilesTool = {
+  tool: string;
+  supported: boolean;
+  /** Why a tool cannot be switched (`supported: false`). */
+  reason?: string;
+  items: ToolProfile[];
+  active: ToolProfileIdentity | null;
+  error?: { code?: string; message: string } | null;
+};
 /** What `POST /api/accounts` takes: exactly one of `profile`, `credentials`, `token`. */
 export type PoolAccountInput = {
   tool: PoolTool;
@@ -733,6 +756,8 @@ export type AuthUser = {
   /** When the account's avatar was last set (null = none) — versions its URL. */
   avatarAt?: string | null;
   createdAt?: string;
+  /** An admin gave this password: the user must choose their own before anything else. */
+  mustChangePassword?: boolean;
 };
 export type AuthState = { mode: "local" } | { mode: "server"; user: AuthUser | null };
 /** GET /api/me/prefs — the signed-in account's own UI preferences (localStorage keys). */
@@ -1007,6 +1032,9 @@ export const api = {
         body: file,
         headers: { "Content-Type": "application/octet-stream" },
       }),
+    /** POST /api/me/avatar/url — the server downloads the picture from an https link. */
+    setAvatarFromUrl: (url: string) =>
+      request<MyAccount>("/me/avatar/url", { method: "POST", body: JSON.stringify({ url }) }),
     /** DELETE /api/me/avatar — back to the initials. */
     removeAvatar: () => request<MyAccount>("/me/avatar", { method: "DELETE" }),
   },
@@ -1091,6 +1119,33 @@ export const api = {
         body: JSON.stringify({ laneId, currentPassword }),
       }),
   },
+  /** Login profiles of Codex, Oh My Pi… (Claude's: `ccConfig.profiles`). */
+  toolProfiles: {
+    /** GET /api/tool-profiles — every covered tool, switchable or not. */
+    list: () => request<{ tools: ToolProfilesTool[] }>("/tool-profiles"),
+    /** POST /api/tool-profiles/:tool — save the login the tool holds now. */
+    save: (tool: string) =>
+      request<{ ok: true; name: string; label: string }>(
+        `/tool-profiles/${encodeURIComponent(tool)}`,
+        { method: "POST", body: JSON.stringify({}) }
+      ),
+    rename: (tool: string, name: string, label: string) =>
+      request<{ ok: true; name: string; label: string }>(
+        `/tool-profiles/${encodeURIComponent(tool)}`,
+        { method: "PATCH", body: JSON.stringify({ name, label }) }
+      ),
+    /** POST /api/tool-profiles/:tool/activate — the outgoing login is saved back first. */
+    activate: (tool: string, name: string) =>
+      request<{ ok: true; name: string; savedOutgoing: string | null }>(
+        `/tool-profiles/${encodeURIComponent(tool)}/activate`,
+        { method: "POST", body: JSON.stringify({ name }) }
+      ),
+    remove: (tool: string, name: string) =>
+      request<{ ok: true; name: string }>(`/tool-profiles/${encodeURIComponent(tool)}`, {
+        method: "DELETE",
+        body: JSON.stringify({ name }),
+      }),
+  },
   /** The Claude/Codex account pool every member's new panes run on
    *  (`server/routes/accounts.js`). Tokens only go IN: no answer has one. */
   accountPool: {
@@ -1098,7 +1153,10 @@ export const api = {
     list: (force = false) => request<AccountPool>(`/accounts${force ? "?force=1" : ""}`),
     /** POST /api/accounts — admin, with their OWN password again. */
     /** GET /api/accounts/profiles — saved switch-user logins that can be moved in. */
-    profiles: () => request<{ profiles: PoolProfile[] }>("/accounts/profiles"),
+    profiles: (tool: PoolTool = "claude") =>
+      request<{ profiles: PoolProfile[] }>(
+        tool === "codex" ? "/accounts/profiles?tool=codex" : "/accounts/profiles"
+      ),
     add: (body: PoolAccountInput, currentPassword: string) =>
       request<{ account: { name: string } }>("/accounts", {
         method: "POST",
@@ -3051,6 +3109,14 @@ export const api = {
   aiTools: {
     /** GET /api/ai-tools - the catalog, what is installed, enabled, and the default. */
     list: () => request<AiToolsView>("/ai-tools"),
+    /** GET /api/ai-tools/omp-sharing - the host's Oh My Pi login shared with members (S3). */
+    ompSharing: () => request<OmpSharingState>("/ai-tools/omp-sharing"),
+    /** PUT /api/ai-tools/omp-sharing - an admin's switch. */
+    setOmpSharing: (enabled: boolean) =>
+      request<OmpSharingState>("/ai-tools/omp-sharing", {
+        method: "PUT",
+        body: JSON.stringify({ enabled }),
+      }),
     /** POST /api/ai-tools/refresh - re-read the login shell's PATH and re-detect. */
     refresh: () => request<AiToolsView>("/ai-tools/refresh", { method: "POST" }),
     /** PUT /api/ai-tools/:id - enable/disable a tool, make it the default, or set its default model ("" clears). */
@@ -4307,6 +4373,16 @@ export interface ArtifactCandidate {
   pinned: boolean;
 }
 
+/** `GET /api/ai-tools/omp-sharing` — never a token. */
+export interface OmpSharingState {
+  /** Server mode with per-user Linux accounts (S3): the only place it applies. */
+  available: boolean;
+  enabled: boolean;
+  installed: boolean;
+  broker: { running: boolean; error?: string | null };
+  gateway: { running: boolean; port?: number; error?: string | null };
+}
+
 export interface ArtifactSettings {
   serverMode: boolean;
   canShare: boolean;

client/src/lib/markdownView.ts

@@ -0,0 +1,29 @@
+/**
+ * @file markdownView — Settings → Appearance → "Open Markdown as": a viewer
+ * preference in `localStorage` (`agenthub.markdown.view`, synced to the
+ * account through `lib/userPrefs.ts`). Preview (the default) opens a `.md`
+ * file rendered; Raw opens its source. Read each time a viewer opens a file
+ * (the Files/Changes panel, the config file viewer, a chat artifact); the
+ * viewer's own Preview/Raw toggle still flips that one file.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+export const MARKDOWN_VIEW_KEY = "agenthub.markdown.view";
+
+/** True when a Markdown file opens rendered (the default). */
+export function readMarkdownPreview(): boolean {
+  try {
+    return window.localStorage.getItem(MARKDOWN_VIEW_KEY) !== "raw";
+  } catch {
+    return true;
+  }
+}
+
+export function writeMarkdownPreview(on: boolean) {
+  try {
+    if (on) window.localStorage.removeItem(MARKDOWN_VIEW_KEY);
+    else window.localStorage.setItem(MARKDOWN_VIEW_KEY, "raw");
+  } catch {
+    /* storage blocked — the default */
+  }
+}

client/src/lib/passwordRules.ts

@@ -0,0 +1,26 @@
+/**
+ * @file passwordRules.ts
+ * @description The rules a password an account picks for ITSELF must pass —
+ * a copy of `passwordProblems` in server/lib/auth.js, so the checklist can
+ * tick each one as it is typed. The server's copy is the one that decides
+ * (EWEAKPASSWORD); a password an admin gives someone else has no rules.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+export const PASSWORD_MIN_LENGTH = 8;
+
+export const PASSWORD_RULES = ["length", "lower", "upper", "digit", "symbol", "username"] as const;
+export type PasswordRule = (typeof PASSWORD_RULES)[number];
+
+/** The rules `password` fails (empty = it passes every one). */
+export function passwordProblems(password: string, username?: string): PasswordRule[] {
+  const out: PasswordRule[] = [];
+  if ([...password].length < PASSWORD_MIN_LENGTH) out.push("length");
+  if (!/\p{Ll}/u.test(password)) out.push("lower");
+  if (!/\p{Lu}/u.test(password)) out.push("upper");
+  if (!/\p{N}/u.test(password)) out.push("digit");
+  if (!/[^\p{L}\p{N}]/u.test(password)) out.push("symbol");
+  const name = (username || "").toLowerCase();
+  if (name && password.toLowerCase().includes(name)) out.push("username");
+  return out;
+}

client/src/lib/promptAttach.ts

@@ -7,7 +7,8 @@
  * last day (`recentUploads`, kept in this browser), and `claudeMention`, the
  * `@` form a file is handed to `claude` in, and what a browser on the
  * dashboard's own machine attaches by path instead of uploading
- * (`localCandidates`, checked by the server in `sameFilesHere` —
+ * (`localCandidates` — a drag's uri-list, or the plain-text paths a pasted
+ * file-manager copy carries —, checked by the server in `sameFilesHere` —
  * `POST /api/run/local-paths` —, `localAttachment`). An attachment is a path
  * sent with the prompt; that check is the one call here to the server.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -85,7 +86,47 @@ export function localCandidates(
 ): string[] | null {
   if (!isLocalBrowser()) return null;
   const paths = droppedFilePaths(dt);
-  return paths && paths.length === files.length ? paths : null;
+  if (paths) return paths.length === files.length ? paths : null;
+  // A PASTE of a file manager's copy has no uri-list: Chrome hands over the
+  // files and the paths as plain text only. Kept only when the names match
+  // the files one for one — `sameFilesHere` then checks the sizes.
+  const copied = textFilePaths(dt);
+  if (!copied || copied.length !== files.length) return null;
+  const base = (p: string) => p.split(/[\\/]/).pop() ?? "";
+  const want = files.map((f) => f.name).sort();
+  const have = copied.map(base).sort();
+  return have.every((n, i) => n === want[i]) ? copied : null;
+}
+
+/** A paste's plain text as absolute paths — every non-empty line a `file://`
+ *  URI or an absolute path (a file manager's copy) — else null. */
+function textFilePaths(dt: DataTransfer | null | undefined): string[] | null {
+  let lines: string[];
+  try {
+    lines = (dt?.getData("text/plain") ?? "")
+      .split(/\r?\n/)
+      .map((l) => l.trim())
+      .filter(Boolean);
+  } catch {
+    return null;
+  }
+  if (lines.length === 0) return null;
+  if (lines.every((l) => l.startsWith("file://"))) {
+    return droppedFilePaths({ getData: () => lines.join("\n") } as unknown as DataTransfer);
+  }
+  return lines.every((l) => /^(\/|[A-Za-z]:[\\/])/.test(l)) ? lines : null;
+}
+
+/** The `file://` paths a paste carries as text with no file beside it — a
+ *  file manager's copy, as some browsers paste it — or null: its uri-list,
+ *  else its plain text when every line is one. Plain absolute paths are NOT
+ *  taken here: with no file to compare against, they are text to paste. */
+export function copiedFilePaths(dt: DataTransfer | null | undefined): string[] | null {
+  const uris = droppedFilePaths(dt);
+  if (uris) return uris;
+  const text = dt?.getData("text/plain") ?? "";
+  if (!/^file:\/\//.test(text.trim())) return null;
+  return textFilePaths(dt);
 }
 
 /** Whether `paths` are the dropped `files` as the dashboard's machine sees

client/src/lib/settingsSearch.ts

@@ -313,9 +313,21 @@ export const SETTINGS_INDEX: {
     to: "?tab=settings",
   },
   {
-    section: "agents/claude-code",
-    titleKey: "ccConfig:profiles.title",
-    keywords: ["account", "login", "quota", "switch"],
+    section: "agents",
+    titleKey: "toolProfiles.title",
+    keywords: [
+      "profile",
+      "account",
+      "login",
+      "quota",
+      "switch",
+      "codex",
+      "omp",
+      "pool",
+      "hồ sơ",
+      "tài khoản",
+    ],
+    to: "#tool-profiles",
   },
   { section: "agents/claude-code", titleKey: "ccConfig:backups.title", keywords: ["restore"] },
   { section: "agents/codex", titleKey: "codexHooks.title" },

client/src/lib/userPrefs.ts

@@ -43,6 +43,7 @@ export const PREF_KEYS = [
   "agenthub.codex.bypass",
   "agenthub.tour",
   "agenthub.workspace.allTabs",
+  "agenthub.markdown.view",
 ] as const;
 const SYNCED = new Set<string>(PREF_KEYS);
 const PUSH_DELAY_MS = 400;

client/src/pages/AiToolConfig.tsx

@@ -243,14 +243,19 @@ export function AiToolConfig({ toolId }: { toolId: string }) {
   const [lanes, setLanes] = useState<Lane[]>([]);
 
   useEffect(() => {
+    // Switching tabs quickly must not show the previous tool's numbers.
+    let cancelled = false;
     api.aiTools
       .usage(toolId)
-      .then(setUsage)
-      .catch(() => setUsage(null));
+      .then((u) => !cancelled && setUsage(u))
+      .catch(() => !cancelled && setUsage(null));
     api.lanes
       .list()
-      .then((r) => setLanes(r.lanes.filter((l) => l.tool === toolId)))
-      .catch(() => setLanes([]));
+      .then((r) => !cancelled && setLanes(r.lanes.filter((l) => l.tool === toolId)))
+      .catch(() => !cancelled && setLanes([]));
+    return () => {
+      cancelled = true;
+    };
   }, [toolId]);
 
   if (!tool) return null;

client/src/pages/CcConfig.tsx

@@ -10,8 +10,10 @@
  * concurrent-write races with the live CLI. Its Overview also holds the
  * dashboard's own Claude Code settings (CLAUDE_HOME — editable, so the path
  * list leaves it out — hooks, pricing: `ClaudeAgentHubSettings`).
+ * The toolbar's Switch profile button links to Settings → AI tools → Profiles
+ * (`ToolProfilesSettings`), where every AI tool's login profiles live.
  * Every card with action buttons (plugins, marketplaces, MCP servers, memory
- * files, auth profiles, and the `MdItemList` artifacts) also opens a
+ * files, and the `MdItemList` artifacts) also opens a
  * right-click menu that repeats those buttons — same handlers, same
  * confirm path — plus Copy name/path.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
@@ -61,7 +63,8 @@
 
 import { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { useTranslation } from "react-i18next";
-import { useSearchParams } from "react-router-dom";
+import { Link, useSearchParams } from "react-router-dom";
+import { useSettingsHref } from "../lib/settingsLink";
 import { eventBus } from "../lib/eventBus";
 import {
   Boxes,
@@ -89,7 +92,6 @@ import {
   Trash2,
   Plus,
   Save,
-  ShieldAlert,
   Lock,
   History,
   Terminal,
@@ -153,14 +155,11 @@ import type {
   CcPluginItem,
   CcPluginsResponse,
   CcUpdateAllBatch,
-  CcProfile,
-  CcAccountIdentity,
-  CcProfileUsage,
-  CcUsageWindow,
   CcScope,
   CcSettingsSource,
   CcStatusline,
 } from "../lib/api";
+import { isSubmitEnter } from "../lib/keys";
 
 /** How an inline editor reports unsaved edits to the page. */
 type OnDirty = (id: string, dirty: boolean) => void;
@@ -450,7 +449,6 @@ export function CcConfig() {
   const [confirmDelete, setConfirmDelete] = useState<ConfirmDeleteState>(null);
   const setToast = showToast;
   const [backupsOpen, setBackupsOpen] = useState(false);
-  const [profilesOpen, setProfilesOpen] = useState(false);
   const [projectMemoryOpen, setProjectMemoryOpen] = useState(false);
 
   const scopeRef = useRef(scope);
@@ -682,7 +680,6 @@ export function CcConfig() {
           setAgenthubKey((k) => k + 1);
         }}
         onOpenBackups={() => setBackupsOpen(true)}
-        onOpenProfiles={() => setProfilesOpen(true)}
         wsConnected={wsConnected}
       />
 
@@ -811,7 +808,6 @@ export function CcConfig() {
         />
       )}
       {backupsOpen && <BackupsModal onClose={() => setBackupsOpen(false)} />}
-      {profilesOpen && <ProfilesModal onClose={() => setProfilesOpen(false)} onToast={setToast} />}
     </div>
   );
 }
@@ -823,20 +819,13 @@ interface HeaderProps {
   lastUpdated: Date | null;
   onRefresh: () => void;
   onOpenBackups: () => void;
-  onOpenProfiles: () => void;
   wsConnected: boolean;
 }
 
 /** The page's toolbar. No title of its own: the Settings hub already draws one. */
-function Header({
-  loading,
-  lastUpdated,
-  onRefresh,
-  onOpenBackups,
-  onOpenProfiles,
-  wsConnected,
-}: HeaderProps) {
+function Header({ loading, lastUpdated, onRefresh, onOpenBackups, wsConnected }: HeaderProps) {
   const { t } = useTranslation("ccConfig");
+  const settingsHref = useSettingsHref();
   const { t: tCommon } = useTranslation("common");
   const formatted = lastUpdated
     ? lastUpdated.toLocaleTimeString(undefined, {
@@ -863,14 +852,14 @@ function Header({
       </div>
       <div className="flex flex-col items-stretch lg:items-end gap-2 flex-shrink-0">
         <div className="flex items-center gap-2 justify-end flex-wrap">
-          <button
-            type="button"
-            onClick={onOpenProfiles}
+          {/* Every AI tool's login profiles live in one place: Settings → AI tools. */}
+          <Link
+            to={settingsHref("agents#tool-profiles")}
             className="inline-flex items-center gap-2 rounded-lg border border-border bg-surface-2 px-3 py-1.5 text-xs font-medium text-fg-secondary hover:bg-surface-3 transition-colors"
           >
             <UserCog className="w-3.5 h-3.5" />
             {t("profiles.openButton")}
-          </button>
+          </Link>
           <button
             type="button"
             onClick={onOpenBackups}
@@ -1807,7 +1796,7 @@ function PluginsPanel({
             value={input}
             onChange={(e) => setInput(e.target.value)}
             onKeyDown={(e) => {
-              if (e.key === "Enter") void submit();
+              if (isSubmitEnter(e)) void submit();
             }}
             placeholder={t("manage.installPlaceholder")}
             aria-label={t("manage.installTitle")}
@@ -2340,7 +2329,7 @@ function McpPanel({
             value={commandLine}
             onChange={(e) => setCommandLine(e.target.value)}
             onKeyDown={(e) => {
-              if (e.key === "Enter") void submit();
+              if (isSubmitEnter(e)) void submit();
             }}
             placeholder={t("manage.addMcpCommandPlaceholder")}
             aria-label={t("mcp.command")}
@@ -2351,7 +2340,7 @@ function McpPanel({
             value={url}
             onChange={(e) => setUrl(e.target.value)}
             onKeyDown={(e) => {
-              if (e.key === "Enter") void submit();
+              if (isSubmitEnter(e)) void submit();
             }}
             placeholder={t("manage.addMcpUrlPlaceholder")}
             aria-label={t("mcp.url")}
@@ -4226,7 +4215,7 @@ function MarketplacesPanel({
             value={source}
             onChange={(e) => setSource(e.target.value)}
             onKeyDown={(e) => {
-              if (e.key === "Enter") void add();
+              if (isSubmitEnter(e)) void add();
             }}
             placeholder={t("manage.addMarketplacePlaceholder")}
             aria-label={t("manage.addMarketplaceTitle")}
@@ -4737,476 +4726,6 @@ function CommandSnippet({ command, label }: { command: string; label?: string })
   );
 }
 
-// ── Auth profiles modal ────────────────────────────────────────────────
-//
-// Swaps which Anthropic account the local `claude` CLI runs as. Only the two
-// identity artifacts move (the OAuth blob + `oauthAccount`), so skills,
-// subagents, memory, plugins, marketplaces and settings all stay exactly where
-// they are — that is the whole point of the feature.
-//
-// The dashboard cannot log a new account in (only `claude auth login` can mint
-// tokens), so adding a profile is always "log in, then snapshot what the CLI
-// wrote" — hence a save button on the live account rather than an add-account
-// flow. There is no name field: the server derives the identifier, and the user
-// edits the display label in place by clicking it. That keeps the one string
-// the user types free of filename rules, so spaces and diacritics are fine.
-// The save button only appears while the live account is unsaved, because one
-// account is one profile — a second copy would just report itself active too.
-
-function ProfilesModal({
-  onClose,
-  onToast,
-}: {
-  onClose: () => void;
-  onToast: (t: NonNullable<Toast>) => void;
-}) {
-  const { t } = useTranslation("ccConfig");
-  const [items, setItems] = useState<CcProfile[] | null>(null);
-  const [active, setActive] = useState<CcAccountIdentity | null>(null);
-  /** `.claude.json`'s account, when it is not the one the live token belongs to. */
-  const [mismatchEmail, setMismatchEmail] = useState<string | null>(null);
-  const [error, setError] = useState<string | null>(null);
-  const [busy, setBusy] = useState<string | null>(null);
-  /** `name` of the profile whose label is being edited inline, plus its draft. */
-  const [renaming, setRenaming] = useState<string | null>(null);
-  const [draft, setDraft] = useState("");
-  /** Quota per profile, keyed by `name`, fetched for every profile once the
-   *  list arrives — the whole point of the panel is comparing accounts, and one
-   *  button per row made the user do that by hand. The cost is bounded: the
-   *  live account is read from the CLI and never refreshed, and any other
-   *  profile is refreshed only when its token has actually expired, which
-   *  leaves it valid for hours of further opens. */
-  const [usage, setUsage] = useState<Record<string, CcProfileUsage>>({});
-  const [usageError, setUsageError] = useState<Record<string, string>>({});
-  /** Per profile, so one slow account does not freeze the other rows. */
-  const [usageBusy, setUsageBusy] = useState<Record<string, boolean>>({});
-  /** Names already auto-fetched, so the effect below fires once per profile. */
-  const autoFetched = useRef<Set<string>>(new Set());
-  const ctx = useContextMenu<CcProfile>();
-
-  const load = useCallback(async () => {
-    try {
-      const r = await api.ccConfig.profiles();
-      setItems(r.items);
-      setActive(r.active);
-      setMismatchEmail(r.mismatch ? r.mismatch.configEmail || "?" : null);
-      setError(null);
-    } catch (err: unknown) {
-      setError(err instanceof Error ? err.message : "unknown");
-    }
-  }, []);
-
-  useEffect(() => {
-    void load();
-  }, [load]);
-
-  const panelRef = useRef<HTMLDivElement>(null);
-  const menuOpen = useRef(false);
-  menuOpen.current = !!ctx.menu;
-  // An open right-click menu takes this Escape for itself.
-  useDialog(true, panelRef, () => {
-    if (!menuOpen.current) onClose();
-  });
-
-  /** Run one profile mutation, then refresh the list. */
-  const run = useCallback(
-    async (key: string, fn: () => Promise<unknown>, success: string) => {
-      setBusy(key);
-      try {
-        await fn();
-        onToast({ kind: "success", message: success });
-        await load();
-      } catch (err: unknown) {
-        onToast({
-          kind: "error",
-          message: err instanceof Error ? err.message : "unknown error",
-        });
-      } finally {
-        setBusy(null);
-      }
-    },
-    [load, onToast]
-  );
-
-  const checkUsage = useCallback(async (name: string) => {
-    setUsageBusy((prev) => ({ ...prev, [name]: true }));
-    setUsageError((prev) => {
-      const next = { ...prev };
-      delete next[name];
-      return next;
-    });
-    try {
-      const result = await api.ccConfig.profileUsage(name);
-      setUsage((prev) => ({ ...prev, [name]: result }));
-    } catch (err: unknown) {
-      setUsageError((prev) => ({
-        ...prev,
-        [name]: err instanceof Error ? err.message : "unknown error",
-      }));
-    } finally {
-      setUsageBusy((prev) => {
-        const next = { ...prev };
-        delete next[name];
-        return next;
-      });
-    }
-  }, []);
-
-  // Every profile's quota, as soon as there is a list to ask about. Once per
-  // profile per opening: a retry is the row's own button, so a failed account
-  // is not re-asked on every render.
-  useEffect(() => {
-    if (!items) return;
-    for (const p of items) {
-      if (autoFetched.current.has(p.name)) continue;
-      autoFetched.current.add(p.name);
-      void checkUsage(p.name);
-    }
-  }, [items, checkUsage]);
-
-  const activeSaved = items?.some((p) => p.active) ?? false;
-
-  /** How many saved profiles hold the same account as `p`. */
-  const copies = (p: CcProfile) =>
-    items?.filter((q) => q.accountUuid && q.accountUuid === p.accountUuid).length ?? 1;
-  /** Deletable unless it is the ONLY saved copy of the live account — a
-   *  redundant copy has to be removable, or an accidental duplicate could
-   *  never be cleaned up. */
-  const deletable = (p: CcProfile) => !p.active || copies(p) > 1;
-  const startRename = (p: CcProfile) => {
-    setDraft(p.label);
-    setRenaming(p.name);
-  };
-  const switchTo = (p: CcProfile) =>
-    void run(
-      `switch:${p.name}`,
-      () => api.ccConfig.activateProfile(p.name),
-      t("profiles.switchSuccess", { name: p.label })
-    );
-  // A saved profile holds that account's OAuth credentials — deleting it
-  // cannot be undone from here, so it asks first.
-  const remove = async (p: CcProfile) => {
-    const ok = await confirmDialog({
-      title: t("profiles.deleteConfirmTitle", { name: p.label }),
-      message: t("profiles.deleteConfirmBody"),
-      confirmLabel: t("profiles.deleteButton"),
-    });
-    if (!ok) return;
-    void run(
-      `del:${p.name}`,
-      () => api.ccConfig.deleteProfile(p.name),
-      t("profiles.deleteSuccess", { name: p.label })
-    );
-  };
-  const pick = (fn: (p: CcProfile) => void) => () => {
-    const p = ctx.menu!.item;
-    ctx.close();
-    fn(p);
-  };
-
-  return (
-    <div
-      className="fixed inset-0 bg-surface-0/70 z-50 flex items-center justify-center p-4"
-      onClick={onClose}
-    >
-      <div
-        ref={panelRef}
-        role="dialog"
-        aria-modal="true"
-        aria-labelledby="cc-profiles-title"
-        className="relative w-full max-w-2xl max-h-[85vh] rounded-xl border border-border bg-surface-1 flex flex-col"
-        onClick={(e) => e.stopPropagation()}
-      >
-        <div className="flex items-center gap-2 border-b border-border px-4 py-2.5">
-          <UserCog className="w-4 h-4 text-fg-muted" />
-          <span id="cc-profiles-title" className="text-sm font-medium text-fg-primary flex-1">
-            {t("profiles.title")}
-          </span>
-          <button
-            type="button"
-            onClick={onClose}
-            className="text-fg-secondary hover:text-fg-primary p-1 rounded-md hover:bg-surface-3"
-            aria-label={t("common.close")}
-          >
-            <X className="w-4 h-4" />
-          </button>
-        </div>
-
-        <div className="px-4 py-3 border-b border-border space-y-2">
-          <p className="text-[11px] text-fg-muted leading-relaxed">{t("profiles.subtitle")}</p>
-          <p className="text-[11px] text-fg-muted leading-relaxed">{t("profiles.warning")}</p>
-          {mismatchEmail && (
-            <p className="text-[11px] text-status-warning inline-flex items-start gap-1.5 leading-relaxed">
-              <ShieldAlert className="w-3.5 h-3.5 flex-shrink-0 mt-0.5" />
-              <span>
-                {t("profiles.mismatch", {
-                  config: mismatchEmail,
-                  owner: active?.email || active?.accountUuid || "?",
-                })}
-              </span>
-            </p>
-          )}
-        </div>
-
-        <div className="overflow-auto p-4 space-y-3">
-          {error && (
-            <div className="text-sm text-status-danger inline-flex items-center gap-2">
-              <AlertCircle className="w-4 h-4" />
-              {error}
-            </div>
-          )}
-
-          <div className="rounded-lg border border-border bg-surface-2 px-3 py-2.5 space-y-1">
-            <div className="text-[10px] uppercase tracking-wide text-fg-muted">
-              {t("profiles.activeLabel")}
-            </div>
-            {active ? (
-              <>
-                <div className="text-sm text-fg-primary">
-                  {active.email || active.displayName || active.accountUuid}
-                </div>
-                <IdentityLine identity={active} />
-              </>
-            ) : (
-              <div className="text-sm text-fg-muted">{t("profiles.noActive")}</div>
-            )}
-            {active && !activeSaved && (
-              <div className="pt-1.5 space-y-1.5">
-                <div className="text-[11px] text-status-warning">{t("profiles.unsavedActive")}</div>
-                <button
-                  disabled={busy !== null}
-                  onClick={() =>
-                    void run("save", () => api.ccConfig.saveProfile(), t("profiles.saveSuccess"))
-                  }
-                  className="h-7 text-[11px] font-medium px-2.5 rounded-md border border-accent/30 bg-accent/10 hover:bg-accent/20 text-accent inline-flex items-center gap-1.5 disabled:opacity-50"
-                >
-                  <Save className="w-3 h-3" />
-                  {busy === "save" ? t("profiles.saving") : t("profiles.saveButton")}
-                </button>
-              </div>
-            )}
-          </div>
-
-          {items === null && !error && <SkeletonRows n={3} />}
-          {items !== null && items.length === 0 && (
-            <div className="rounded-lg border border-dashed border-border bg-surface-2 px-4 py-8 text-center text-sm text-fg-muted">
-              {t("profiles.empty")}
-            </div>
-          )}
-          {items?.map((p) => (
-            <div
-              key={p.name}
-              data-testid={`profile-row-${p.name}`}
-              onContextMenu={(e) => ctx.open(e, p)}
-              className="rounded-lg border border-border bg-surface-2 px-3 py-2.5"
-            >
-              <div className="flex items-center gap-2 flex-wrap">
-                {renaming === p.name ? (
-                  <input
-                    autoFocus
-                    value={draft}
-                    onChange={(e) => setDraft(e.target.value)}
-                    onBlur={() => setRenaming(null)}
-                    onKeyDown={(e) => {
-                      if (e.key === "Escape") setRenaming(null);
-                      if (e.key !== "Enter") return;
-                      const next = draft.trim();
-                      setRenaming(null);
-                      if (!next || next === p.label) return;
-                      void run(
-                        `rename:${p.name}`,
-                        () => api.ccConfig.renameProfile(p.name, next),
-                        t("profiles.renameSuccess", { name: next })
-                      );
-                    }}
-                    maxLength={60}
-                    aria-label={t("profiles.renameLabel")}
-                    className="h-7 w-48 rounded-md border border-accent/40 bg-surface-1 px-2 text-xs text-fg-primary focus:outline-none focus:ring-1 focus:ring-accent/40"
-                  />
-                ) : (
-                  <button
-                    onClick={() => startRename(p)}
-                    title={t("profiles.renameHint")}
-                    className="text-xs font-medium text-fg-primary hover:text-accent inline-flex items-center gap-1 group"
-                  >
-                    {p.label}
-                    <Pencil className="w-3 h-3 opacity-0 group-hover:opacity-100 text-fg-muted" />
-                  </button>
-                )}
-                {p.active && (
-                  <span className="text-[10px] px-1.5 py-0.5 rounded-full bg-status-success/10 border border-status-success/20 text-status-success">
-                    {t("profiles.activeBadge")}
-                  </span>
-                )}
-                <span className="text-xs text-fg-secondary truncate flex-1 min-w-0">
-                  {p.email || p.displayName || p.accountUuid}
-                </span>
-                {!p.active && (
-                  <button
-                    disabled={busy !== null}
-                    onClick={() => switchTo(p)}
-                    className="h-7 text-[11px] font-medium px-2.5 rounded-md border border-accent/30 bg-accent/10 hover:bg-accent/20 text-accent disabled:opacity-50"
-                  >
-                    {busy === `switch:${p.name}`
-                      ? t("profiles.switching")
-                      : t("profiles.switchButton")}
-                  </button>
-                )}
-                {deletable(p) && (
-                  <button
-                    type="button"
-                    disabled={busy !== null}
-                    onClick={() => void remove(p)}
-                    title={t("profiles.deleteButton")}
-                    aria-label={t("profiles.deleteButton")}
-                    className="h-7 w-7 inline-flex items-center justify-center rounded-md text-fg-muted hover:text-status-danger hover:bg-surface-3 disabled:opacity-50"
-                  >
-                    <Trash2 className="w-3.5 h-3.5" />
-                  </button>
-                )}
-              </div>
-              <IdentityLine identity={p} />
-              <ProfileUsageLine
-                usage={usage[p.name]}
-                error={usageError[p.name]}
-                busy={!!usageBusy[p.name]}
-                disabled={busy !== null || !!usageBusy[p.name]}
-                onCheck={() => void checkUsage(p.name)}
-              />
-              {p.savedAt && (
-                <div className="text-[10px] text-fg-muted mt-1">
-                  {t("profiles.savedAt", { time: new Date(p.savedAt).toLocaleString() })}
-                </div>
-              )}
-            </div>
-          ))}
-
-          {ctx.menu && (
-            <ContextMenu x={ctx.menu.x} y={ctx.menu.y} onClose={ctx.close} testId="profile-menu">
-              <MenuItem onSelect={pick(startRename)}>{t("profiles.rename")}</MenuItem>
-              {!ctx.menu.item.active && (
-                <MenuItem disabled={busy !== null} onSelect={pick(switchTo)}>
-                  {t("profiles.switchButton")}
-                </MenuItem>
-              )}
-              <MenuItem
-                disabled={busy !== null || !!usageBusy[ctx.menu.item.name]}
-                onSelect={pick((p) => void checkUsage(p.name))}
-              >
-                {t("profiles.usageCheck")}
-              </MenuItem>
-              {deletable(ctx.menu.item) && (
-                <>
-                  <MenuSeparator />
-                  <MenuItem
-                    danger
-                    disabled={busy !== null}
-                    testId="profile-menu-delete"
-                    onSelect={pick((p) => void remove(p))}
-                  >
-                    {t("profiles.deleteButton")}
-                  </MenuItem>
-                </>
-              )}
-            </ContextMenu>
-          )}
-
-          <div>
-            <div className="text-[10px] text-fg-muted mb-1">{t("profiles.loginHint")}</div>
-            <CommandSnippet command="claude auth login" />
-          </div>
-        </div>
-      </div>
-    </div>
-  );
-}
-
-/**
- * One profile's quota: a button until asked, then the two windows Anthropic
- * reports — the 5-hour session allowance and the 7-day one.
- *
- * Deliberately not fetched with the profile list. Reading a saved profile's
- * usage means refreshing its OAuth token, and that rotates the credentials on
- * disk (see `server/lib/cc-usage.js`), so it happens once per click and never
- * on a render or a poll.
- */
-function ProfileUsageLine({
-  usage,
-  error,
-  busy,
-  disabled,
-  onCheck,
-}: {
-  usage?: CcProfileUsage;
-  error?: string;
-  busy: boolean;
-  disabled: boolean;
-  onCheck: () => void;
-}) {
-  const { t } = useTranslation("ccConfig");
-  const pct = (w: CcUsageWindow | null | undefined) =>
-    w && w.utilization !== null ? `${Math.round(w.utilization)}%` : "—";
-  const resetTitle = (w: CcUsageWindow | null | undefined) =>
-    w && w.resetsAt
-      ? t("profiles.usageResets", { time: new Date(w.resetsAt).toLocaleString() })
-      : undefined;
-
-  if (error) {
-    return (
-      <div className="mt-1 flex items-center gap-2 text-[10px]">
-        <span className="text-status-danger">{error}</span>
-        <button
-          onClick={onCheck}
-          disabled={disabled}
-          className="text-fg-muted hover:text-accent disabled:opacity-50"
-        >
-          {t("profiles.usageRetry")}
-        </button>
-      </div>
-    );
-  }
-  if (!usage) {
-    return (
-      <button
-        onClick={onCheck}
-        disabled={disabled}
-        title={t("profiles.usageHint")}
-        className="mt-1 text-[10px] text-fg-muted hover:text-accent disabled:opacity-50"
-      >
-        {busy ? t("profiles.usageChecking") : t("profiles.usageCheck")}
-      </button>
-    );
-  }
-  return (
-    <div className="mt-1 flex items-center gap-2 text-[10px] text-fg-muted">
-      <span title={resetTitle(usage.fiveHour)}>
-        {t("profiles.usageFiveHour")}{" "}
-        <span className="text-fg-secondary">{pct(usage.fiveHour)}</span>
-      </span>
-      <span title={resetTitle(usage.sevenDay)}>
-        {t("profiles.usageSevenDay")}{" "}
-        <span className="text-fg-secondary">{pct(usage.sevenDay)}</span>
-      </span>
-      <button
-        onClick={onCheck}
-        disabled={disabled}
-        className="hover:text-accent disabled:opacity-50"
-      >
-        {busy ? t("profiles.usageChecking") : t("profiles.usageRefresh")}
-      </button>
-    </div>
-  );
-}
-
-/** Org / seat / plan line shared by the active card and each profile row. */
-function IdentityLine({ identity }: { identity: CcAccountIdentity }) {
-  const parts = [identity.organization, identity.seatTier, identity.subscriptionType].filter(
-    Boolean
-  );
-  if (parts.length === 0) return null;
-  return <div className="text-[10px] text-fg-muted mt-0.5">{parts.join(" · ")}</div>;
-}
-
 // ── Backups modal ──────────────────────────────────────────────────────
 
 function BackupsModal({ onClose }: { onClose: () => void }) {

client/src/pages/CodexConfig.tsx

@@ -95,6 +95,7 @@ import type {
   CodexScope,
   CodexSkill,
 } from "../lib/api";
+import { isSubmitEnter } from "../lib/keys";
 
 type TabKey = "overview" | "skills" | "agents" | "rules" | "memory" | "config" | "mcp" | "plugins";
 
@@ -1630,7 +1631,7 @@ function PluginsPanel({
               value={spec}
               onChange={(e) => setSpec(e.target.value)}
               onKeyDown={(e) => {
-                if (e.key === "Enter") void submitPlugin();
+                if (isSubmitEnter(e)) void submitPlugin();
               }}
               placeholder={t("plugins.installPlaceholder")}
               aria-label={t("plugins.installTitle")}
@@ -1710,7 +1711,7 @@ function PluginsPanel({
               value={mktUrl}
               onChange={(e) => setMktUrl(e.target.value)}
               onKeyDown={(e) => {
-                if (e.key === "Enter") void submitMarketplace();
+                if (isSubmitEnter(e)) void submitMarketplace();
               }}
               placeholder={t("plugins.addMarketplacePlaceholder")}
               aria-label={t("plugins.addMarketplaceTitle")}

client/src/pages/Dashboard.tsx

@@ -1092,7 +1092,7 @@ function AnalyticsTab() {
         >
           <AlertCircle className="w-4 h-4 flex-shrink-0" />
           <span className="flex-1 min-w-0">{loadError}</span>
-          <button onClick={load} className="btn-ghost text-xs">
+          <button onClick={refresh} disabled={spinning} className="btn-ghost text-xs">
             {t("common:retry")}
           </button>
         </div>
@@ -3133,7 +3133,7 @@ export function Dashboard() {
               <span className="flex-1 min-w-0">
                 {t("failedLoad")}: {error}
               </span>
-              <button onClick={load} className="btn-ghost text-xs">
+              <button onClick={refresh} disabled={spinning} className="btn-ghost text-xs">
                 {t("common:retry")}
               </button>
             </div>

client/src/pages/Sessions.tsx

@@ -561,7 +561,7 @@ export function Sessions({ embedded = false }: { embedded?: boolean } = {}) {
           <span className="flex-1 min-w-0">
             {t("failedList")}: {error}
           </span>
-          <button onClick={load} className="btn-ghost text-xs">
+          <button onClick={refresh} disabled={spinning} className="btn-ghost text-xs">
             {t("common:retry")}
           </button>
         </div>

client/src/pages/Settings.tsx

@@ -120,6 +120,7 @@ import { toast } from "../lib/toast";
 import { useDialog } from "../hooks/useDialog";
 import { useSpin } from "../hooks/useSpin";
 import { exportPrefs, importPrefs } from "../lib/prefsBackup";
+import { isSubmitEnter } from "../lib/keys";
 
 /** The fewest milliseconds between two activity-driven `/settings/info` reads:
  *  it COUNTs whole tables, and hooks fire many times a second while sessions run. */
@@ -1335,7 +1336,7 @@ function ClearDataDialog({
             value={typed}
             onChange={(e) => setTyped(e.target.value)}
             onKeyDown={(e) => {
-              if (e.key === "Enter" && ok && !busy) onConfirm();
+              if (isSubmitEnter(e) && ok && !busy) onConfirm();
             }}
             autoComplete="off"
             className="input mt-1 w-full font-mono text-sm"

client/src/pages/SettingsHub.tsx

@@ -69,6 +69,8 @@ import { AiToolsSettings } from "../components/settings/AiToolsSettings";
 import { AgentInstructionsSettings } from "../components/settings/AgentInstructionsSettings";
 import { SessionDefaultsSettings } from "../components/settings/SessionDefaultsSettings";
 import { ArtifactsHubSettings } from "../components/settings/ArtifactsHubSettings";
+import { ToolProfilesSettings } from "../components/settings/ToolProfilesSettings";
+import { OmpSharingSettings } from "../components/settings/OmpSharingSettings";
 import { PricingSettings } from "../components/settings/PricingSettings";
 import { WorktreeVisibilitySettings } from "../components/settings/WorktreeVisibilitySettings";
 import { useAiTools } from "../hooks/useAiTools";
@@ -83,6 +85,7 @@ import { AiToolIcon } from "../components/AiToolIcon";
 import { toast } from "../lib/toast";
 import { useAuth, usePermissions } from "../components/AuthGate";
 import { PageTabs } from "../components/PageTabs";
+import { isSubmitEnter } from "../lib/keys";
 
 const GROUPS = ["general", "agents", "data"] as const;
 type Group = (typeof GROUPS)[number];
@@ -295,8 +298,12 @@ export function SettingsHub({ section }: { section?: string } = {}) {
           <AgentInstructionsSettings />
           <SessionDefaultsSettings />
           <AiToolsSettings settingsHref={toolHref} />
+          {/* Every AI tool's login profiles, linked to the account pool. */}
+          <ToolProfilesSettings />
           {/* The Hub's install switch: server mode, an admin's (it hides itself). */}
           <ArtifactsHubSettings />
+          {/* The host's omp login for members: server mode + S3, an admin's. */}
+          <OmpSharingSettings />
         </div>
       ),
     },
@@ -509,7 +516,7 @@ export function SettingsHub({ section }: { section?: string } = {}) {
         value={query}
         onChange={(e) => setQuery(e.target.value)}
         onKeyDown={(e) => {
-          if (e.key === "Enter" && results[0]) navigate(hrefOf(results[0]), nav);
+          if (isSubmitEnter(e) && results[0]) navigate(hrefOf(results[0]), nav);
           if (e.key === "Escape") setQuery("");
         }}
         placeholder={t("search.placeholder")}

client/src/pages/Users.tsx

@@ -14,7 +14,8 @@
  * account — moved to the Server tab, `MemberTmuxCard` in `ServerPanel`.)
  * Every change asks for the admin's OWN password again (the
  * server refuses without it); an analyst only reads. A row shows the display
- * name and email under the username when set; right-clicking a row offers
+ * name and email under the username when set, and "New password due" while
+ * the account still has a password an admin gave; right-clicking a row offers
  * Edit, Open home (in /files), and copying the username or email.
  * Laid out like the other list pages: icon header, a row of totals
  * (`StatCard`), the accounts in a `card` table, the audit log in a card.
@@ -273,6 +274,15 @@ export function Users({ embedded = false }: { embedded?: boolean } = {}) {
                           {t("disabled")}
                         </span>
                       )}
+                      {!u.disabled && u.mustChangePassword && (
+                        <span
+                          className="badge py-0.5 text-[11px] bg-status-warning/10 text-status-warning border-status-warning/20"
+                          title={t("mustChangeHint")}
+                          data-testid="user-must-change"
+                        >
+                          {t("mustChange")}
+                        </span>
+                      )}
                     </div>
                   </td>
                   <td className="px-5 py-3">

client/src/pages/Workspace.tsx

@@ -1105,10 +1105,18 @@ export function Workspace() {
       setFeatures([]);
       return;
     }
+    let cancelled = false;
     api.lanes.features
       .list(currentLane.id)
-      .then((data) => setFeatures(data.features))
-      .catch(() => setFeatures([]));
+      .then((data) => {
+        if (!cancelled) setFeatures(data.features);
+      })
+      .catch(() => {
+        if (!cancelled) setFeatures([]);
+      });
+    return () => {
+      cancelled = true;
+    };
   }, [currentLane?.id]);
 
   // Fetch the archived snapshot when the picker selects one — read-only, never
@@ -1138,10 +1146,18 @@ export function Workspace() {
       setProofFeatures([]);
       return;
     }
+    let cancelled = false;
     api.lanes.proof
       .list(currentLane.id)
-      .then((data) => setProofFeatures(data.features))
-      .catch(() => setProofFeatures([]));
+      .then((data) => {
+        if (!cancelled) setProofFeatures(data.features);
+      })
+      .catch(() => {
+        if (!cancelled) setProofFeatures([]);
+      });
+    return () => {
+      cancelled = true;
+    };
   }, [currentLane?.id, viewedFeatureSlug]);
 
   // Resolve the active feature slug: either the user-selected one, or the lane's active_feature_id

client/src/pages/__tests__/Artifacts.test.tsx

@@ -227,6 +227,66 @@ describe("Artifacts", () => {
     );
   });
 
+  it("splits the Hub and My library into yours and others'", async () => {
+    vi.mocked(api.artifacts.settings).mockResolvedValue({
+      serverMode: true,
+      canShare: true,
+      installsEnabled: true,
+      canManage: false,
+    });
+    vi.mocked(api.artifacts.list).mockResolvedValue({
+      items: [
+        item({ id: 1, title: "my-page", shared: true }),
+        item({
+          id: 2,
+          kind: "skill",
+          title: "their-skill",
+          mine: false,
+          owner: "an",
+          shared: true,
+        }),
+      ],
+    });
+    const user = userEvent.setup();
+    open();
+    // All is split too, others' first.
+    const allOthers = await screen.findByTestId("half-all.others");
+    expect(within(allOthers).getByText("their-skill")).toBeInTheDocument();
+    expect(
+      allOthers.compareDocumentPosition(screen.getByTestId("half-all.own")) &
+        Node.DOCUMENT_POSITION_FOLLOWING
+    ).toBeTruthy();
+    await user.click(await screen.findByRole("button", { name: "Hub" }));
+    const own = await screen.findByTestId("half-hub.own");
+    expect(own).toHaveTextContent("Shared by me");
+    expect(within(own).getByText("my-page")).toBeInTheDocument();
+    const others = screen.getByTestId("half-hub.others");
+    expect(within(others).getByText("their-skill")).toBeInTheDocument();
+    expect(within(others).queryByText("my-page")).toBeNull();
+
+    await user.click(screen.getByRole("button", { name: "My library" }));
+    expect(await screen.findByTestId("half-mine.others")).toHaveTextContent(
+      "Installed from others"
+    );
+    expect(within(screen.getByTestId("half-mine.own")).getByText("my-page")).toBeInTheDocument();
+  });
+
+  it("pages a long section 12 cards at a time", async () => {
+    vi.mocked(api.artifacts.list).mockResolvedValue({
+      items: Array.from({ length: 14 }, (_, i) =>
+        item({ id: i + 1, kind: "page", title: `p${i + 1}`, files: [] })
+      ),
+    });
+    const user = userEvent.setup();
+    open();
+    await screen.findByText("p1");
+    expect(screen.queryByText("p13")).toBeNull();
+    expect(screen.getByText("Showing 1-12 of 14")).toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: "Next" }));
+    expect(screen.getByText("p13")).toBeInTheDocument();
+    expect(screen.queryByText("p1")).toBeNull();
+  });
+
   it("lists who installed an artifact, when and where, from its install count", async () => {
     vi.mocked(api.artifacts.list).mockResolvedValue({
       items: [item({ id: 2, kind: "skill", title: "deploy", source: "deploy", installs: 3 })],
@@ -287,13 +347,13 @@ describe("Artifacts", () => {
     const card = await screen.findByTestId("artifact-2");
     expect(within(card).getByTestId("artifact-installed")).toHaveTextContent("Installed");
     expect(within(card).queryByRole("button", { name: "Install" })).toBeNull();
-
-    vi.mocked(confirmDialog).mockResolvedValueOnce(true);
-    vi.mocked(api.artifacts.install).mockResolvedValueOnce({
-      installed: "/h/.claude/skills/deploy",
-    });
-    await userEvent.setup().click(within(card).getByRole("button", { name: "Reinstall" }));
-    await waitFor(() => expect(api.artifacts.install).toHaveBeenLastCalledWith(2, true));
+    // No Reinstall anywhere, and Uninstall lives only in the ⋯ menu.
+    expect(within(card).queryByRole("button", { name: "Reinstall" })).toBeNull();
+    expect(within(card).queryByRole("button", { name: "Uninstall" })).toBeNull();
+    await userEvent.setup().click(within(card).getByRole("button", { name: "More actions" }));
+    const menu = screen.getByTestId("artifact-menu");
+    expect(within(menu).queryByRole("menuitem", { name: "Reinstall" })).toBeNull();
+    expect(within(menu).getByRole("menuitem", { name: "Uninstall" })).toBeInTheDocument();
   });
 
   it("uninstalls an installed plugin only after a confirmation", async () => {
@@ -307,7 +367,13 @@ describe("Artifacts", () => {
     const card = await screen.findByTestId("artifact-4");
     const user = userEvent.setup();
     vi.mocked(confirmDialog).mockResolvedValueOnce(false);
-    await user.click(within(card).getByRole("button", { name: "Uninstall" }));
+    const uninstall = async () => {
+      await user.click(within(card).getByRole("button", { name: "More actions" }));
+      await user.click(
+        within(screen.getByTestId("artifact-menu")).getByRole("menuitem", { name: "Uninstall" })
+      );
+    };
+    await uninstall();
     await waitFor(() => expect(confirmDialog).toHaveBeenCalled());
     expect(api.artifacts.uninstall).not.toHaveBeenCalled();
 
@@ -316,7 +382,7 @@ describe("Artifacts", () => {
       uninstalled: "tool@market",
       paths: [],
     });
-    await user.click(within(card).getByRole("button", { name: "Uninstall" }));
+    await uninstall();
     await waitFor(() => expect(api.artifacts.uninstall).toHaveBeenCalledWith(4));
   });
 

client/src/pages/__tests__/CcConfig.contextMenu.test.tsx

@@ -1,8 +1,8 @@
 /**
  * @file Covers the right-click menus on the Claude Code config page: a menu
  * item runs the SAME action as the card's button — a plugin's uninstall still
- * takes two clicks before it reaches the API, and a profile's delete calls the
- * same endpoint the trash button does.
+ * takes two clicks before it reaches the API. (The profiles' menu moved with
+ * them to Settings → AI tools: ToolProfilesSettings.test.tsx.)
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -10,7 +10,6 @@ import { describe, it, expect, vi, afterEach } from "vitest";
 import { render, screen, act } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { MemoryRouter } from "react-router-dom";
-import { settleConfirm } from "../../lib/confirm";
 
 const ccConfigMock = vi.hoisted(() => {
   const r = (value: unknown) => vi.fn().mockResolvedValue(value);
@@ -124,41 +123,4 @@ describe("CcConfig — right-click menus", () => {
     expect(ccConfigMock.pluginAction).toHaveBeenCalledWith("ponytail@ponytail", "uninstall");
     expect(screen.queryByTestId("plugin-menu")).toBeNull();
   });
-
-  it("deletes a saved profile from its menu through the same API as the trash button", async () => {
-    const user = userEvent.setup();
-    render(
-      <MemoryRouter>
-        <CcConfig />
-      </MemoryRouter>
-    );
-    await settle();
-    await user.click(screen.getByRole("button", { name: /profile/i }));
-    await settle();
-
-    await user.pointer({ keys: "[MouseRight]", target: screen.getByTestId("profile-row-spare") });
-    await user.click(screen.getByTestId("profile-menu-delete"));
-    await settle();
-    // A saved login is never deleted on one click: it asks first.
-    expect(ccConfigMock.deleteProfile).not.toHaveBeenCalled();
-    await act(async () => settleConfirm(true));
-    await settle();
-    expect(ccConfigMock.deleteProfile).toHaveBeenCalledWith("spare");
-  });
-
-  it("offers no delete for the only saved copy of the live account", async () => {
-    const user = userEvent.setup();
-    render(
-      <MemoryRouter>
-        <CcConfig />
-      </MemoryRouter>
-    );
-    await settle();
-    await user.click(screen.getByRole("button", { name: /profile/i }));
-    await settle();
-
-    await user.pointer({ keys: "[MouseRight]", target: screen.getByTestId("profile-row-work") });
-    expect(screen.getByTestId("profile-menu")).toBeInTheDocument();
-    expect(screen.queryByTestId("profile-menu-delete")).toBeNull();
-  });
 });

client/src/pages/__tests__/CcConfig.profilesUsage.test.tsx

@@ -1,151 +0,0 @@
-/**
- * @file Covers the quota lines in the Claude Code auth-profile modal: opening
- * it asks for EVERY saved account's quota, not one row at a time.
- *
- * The one-at-a-time version made the user click through their own accounts to
- * answer the only question the panel exists for — which account still has room.
- * The other half is that each row fails on its own: an account whose saved
- * login has been superseded must not stop its neighbours from reporting.
- * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
- */
-
-import { describe, it, expect, vi, afterEach } from "vitest";
-import { render, screen, act } from "@testing-library/react";
-import userEvent from "@testing-library/user-event";
-import { MemoryRouter } from "react-router-dom";
-
-const ccConfigMock = vi.hoisted(() => {
-  const r = (value: unknown) => vi.fn().mockResolvedValue(value);
-  const window = (utilization: number) => ({
-    utilization,
-    resetsAt: "2026-09-18T08:00:00Z",
-  });
-  return {
-    window,
-    overview: r({
-      roots: {
-        claudeHome: "/home/.claude",
-        projectClaudeDir: "/repo/.claude",
-        projectRoot: "/repo",
-      },
-      counts: {
-        skills: { user: 0, project: 0 },
-        agents: { user: 0, project: 0 },
-        commands: { user: 0, project: 0 },
-        outputStyles: { user: 0, project: 0 },
-        mcpServers: { user: 0, project: 0 },
-        hooks: {},
-        plugins: 0,
-        marketplaces: 0,
-        keybindings: 0,
-        settingsFiles: 0,
-        memory: 0,
-      },
-    }),
-    skills: r({ items: [] }),
-    agents: r({ items: [] }),
-    commands: r({ items: [] }),
-    outputStyles: r({ items: [] }),
-    memory: r({ items: [] }),
-    plugins: r({ manifestPath: "", manifestExists: false, plugins: [] }),
-    marketplaces: r({ marketplaces: [] }),
-    mcp: r({ mcp: [] }),
-    hooks: r({ hooks: [] }),
-    settings: r({ sources: [] }),
-    keybindings: r({ groups: [] }),
-    statusline: r({}),
-    hookScripts: r({ items: [] }),
-    backups: r({ items: [] }),
-    file: r({ ok: true, file: "", size: 0, mtime: 0, truncated: false, text: "" }),
-    pluginsAvailable: r({ installed: [], available: [] }),
-    updateAllStatus: r({ batch: null }),
-    // The modal's own list: two saved accounts, one of them live.
-    profiles: r({
-      items: [
-        { name: "work", label: "Work", active: true, accountUuid: "u1", email: "a@b.c" },
-        { name: "spare", label: "Spare", active: false, accountUuid: "u2", email: "d@e.f" },
-      ],
-      active: { accountUuid: "u1", email: "a@b.c" },
-    }),
-    profileUsage: vi.fn().mockImplementation(async (name: string) => {
-      if (name === "spare") {
-        throw new Error("this profile's saved login has been superseded");
-      }
-      return {
-        name,
-        refreshed: false,
-        fiveHour: window(8),
-        sevenDay: window(70),
-        checkedAt: "2026-09-17T16:00:00Z",
-      };
-    }),
-  };
-});
-
-vi.mock("../../lib/api", async (importOriginal) => {
-  const actual = await importOriginal<Record<string, unknown>>();
-  return {
-    ...actual,
-    api: { ...(actual.api as Record<string, unknown>), ccConfig: ccConfigMock },
-  };
-});
-
-vi.mock("../../lib/eventBus", () => ({
-  eventBus: {
-    subscribe: () => () => {},
-    publish: () => {},
-    onConnection: () => () => {},
-    connected: true,
-    setConnected: () => {},
-  },
-}));
-
-import { CcConfig } from "../CcConfig";
-
-async function settle() {
-  await act(async () => {
-    await new Promise((res) => setTimeout(res, 0));
-    await new Promise((res) => setTimeout(res, 0));
-  });
-}
-
-async function openProfiles() {
-  render(
-    <MemoryRouter>
-      <CcConfig />
-    </MemoryRouter>
-  );
-  await settle();
-  await userEvent.click(screen.getByRole("button", { name: /profile/i }));
-  await settle();
-  await settle();
-}
-
-afterEach(() => vi.clearAllMocks());
-
-describe("CcConfig — auth profile quotas", () => {
-  it("asks for every saved account's quota when the modal opens", async () => {
-    await openProfiles();
-
-    expect(ccConfigMock.profileUsage).toHaveBeenCalledWith("work");
-    expect(ccConfigMock.profileUsage).toHaveBeenCalledWith("spare");
-    expect(await screen.findByText("8%")).toBeInTheDocument();
-    expect(await screen.findByText("70%")).toBeInTheDocument();
-  });
-
-  it("reports the account that failed without costing the others their numbers", async () => {
-    await openProfiles();
-
-    expect(await screen.findByText(/saved login has been superseded/i)).toBeInTheDocument();
-    expect(screen.getByText("8%")).toBeInTheDocument();
-  });
-
-  it("asks once per profile, however many times the panel re-renders", async () => {
-    await openProfiles();
-    await settle();
-    await settle();
-
-    const asked = ccConfigMock.profileUsage.mock.calls.filter((c) => c[0] === "work");
-    expect(asked).toHaveLength(1);
-  });
-});

client/src/pages/__tests__/SettingsHub.test.tsx

@@ -86,6 +86,9 @@ vi.mock("../../lib/api", async (importOriginal) => {
     api: {
       aiTools: { list: vi.fn(async () => view), iconUrl: () => "" },
       lanes: { list: vi.fn(async () => ({ lanes: [], counts: {} })) },
+      // AI tools → Profiles.
+      toolProfiles: { list: vi.fn(async () => ({ tools: [] })) },
+      ccConfig: { profiles: vi.fn(async () => ({ items: [], active: null })) },
     },
   };
 });

client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap

@@ -796,9 +796,10 @@ exports[`screen snapshots > Claude Config 1`] = `
         <div
           class="flex items-center gap-2 justify-end flex-wrap"
         >
-          <button
+          <a
             class="inline-flex items-center gap-2 rounded-lg border border-border bg-surface-2 px-3 py-1.5 text-xs font-medium text-fg-secondary hover:bg-surface-3 transition-colors"
-            type="button"
+            data-discover="true"
+            href="/settings/agents#tool-profiles"
           >
             <svg
               class="lucide lucide-user-cog w-3.5 h-3.5"
@@ -851,7 +852,7 @@ exports[`screen snapshots > Claude Config 1`] = `
               />
             </svg>
             Switch profile
-          </button>
+          </a>
           <button
             class="inline-flex items-center gap-2 rounded-lg border border-border bg-surface-2 px-3 py-1.5 text-xs font-medium text-fg-secondary hover:bg-surface-3 transition-colors"
             type="button"
@@ -2806,6 +2807,7 @@ exports[`screen snapshots > Claude Config 1`] = `
         </div>
         <a
           class="btn-ghost shrink-0 text-xs"
+          data-discover="true"
           href="/settings/pricing#pricing-claude"
         >
           Open Pricing
@@ -3222,6 +3224,7 @@ exports[`screen snapshots > Dashboard 1`] = `
       >
         <a
           class="card p-5 block hover:bg-surface-4/40 transition-colors focus-visible:outline focus-visible:outline-2 focus-visible:outline-accent"
+          data-discover="true"
           href="/sessions"
         >
           <div
@@ -3475,6 +3478,7 @@ exports[`screen snapshots > Dashboard 1`] = `
         </div>
         <a
           class="card p-5 block hover:bg-surface-4/40 transition-colors focus-visible:outline focus-visible:outline-2 focus-visible:outline-accent"
+          data-discover="true"
           href="/sessions?view=events"
         >
           <div
@@ -5408,6 +5412,7 @@ exports[`screen snapshots > Dashboard 1`] = `
                
               <a
                 class="text-accent hover:underline"
+                data-discover="true"
                 href="/settings/notifications"
               >
                 Add one in Settings → Notifications
@@ -7239,7 +7244,7 @@ exports[`screen snapshots > Settings — about 1`] = `
                 <span
                   class="text-status-warning/90"
                 >
-                  UI build v2.8.14 (rebuild client to match)
+                  UI build v2.8.19 (rebuild client to match)
                 </span>
               </p>
             </div>
@@ -11059,6 +11064,7 @@ exports[`screen snapshots > Workflows 1`] = `
             </div>
             <a
               class="text-fg-muted hover:text-violet-700 dark:hover:text-violet-400 transition-colors flex-shrink-0"
+              data-discover="true"
               href="/sessions/sess-1"
               title="Open parent session"
             >

docs/API.md

@@ -22,6 +22,10 @@ Complete REST API and WebSocket documentation for Agent Dashboard.
   - [Remote Data Sources](#remote-data-sources)
   - [Query Explorer](#query-explorer)
   - [Scheduled reports](#scheduled-reports)
+  - [Webhooks](#webhooks)
+  - [Web Push](#web-push)
+  - [Updates](#updates)
+  - [Import history](#import-history)
 - [WebSocket API](#websocket-api)
 - [Error Handling](#error-handling)
 - [Rate Limiting](#rate-limiting)
@@ -85,13 +89,13 @@ A dashboard shared by several people runs in **server mode** ([SERVER-MODE.md](S
 | `POST /api/auth/login` `{username, password}` | `{user}` + the cookie; `401 EBADLOGIN`, `429 ETOOMANY`, `404 ENOTSERVER` in local mode |
 | `POST /api/auth/logout` | `{ok: true}`, cookie cleared |
 
-In server mode a **developer** sees only rows of the workspaces they own (`lanes.owner_id`): every list, count, chart and cost answer is limited to them, and a request naming another user's session, agent, workspace or run (in the path, query or body) answers `404 ENOTFOUND`. Admin and analyst see everything; `GET /api/users` lists every account (`displayName`, `email`, `createdAt`, `logins`, `lastLoginAt` included) with its workspaces, sessions and 7/30-day `{cost, tokens}`, `GET /api/users/storage[?refresh=1]` each user's home size (`{storage: {<id>: {bytes, files, partial, measuredAt} | null}, measuring}` — measured in the background, see [SERVER-MODE.md](SERVER-MODE.md)), `GET /api/users/tmux` each member's own tmux server under one Linux user per account (`{available, installed, matched, users: [{id, username, running, stuck?, version, pid, startedAt, sessions, busy, outdated}]}`; an admin's `POST /api/users/:id/tmux-restart` and `POST /api/users/tmux-restart-idle` restart them with `currentPassword`, audited, `409 ETMUXSTUCK` for a server that will not stop), `GET /api/host` the machine and each user's live share of it (`{at, hostname, os, uptime, cpu: {model, cores, load}, memory: {total, available, used, swapTotal, swapUsed}, disks: [{device, mount, type, kind: "HDD"|"SSD"|null, total, used, free}], homesMount, gpus: [{name, utilization, memoryUsed, memoryTotal}], usage: {cpu, sampleMs, groups: [{key, kind: "user"|"host"|"system", userId?, username?, cpu, memory, memoryPercent, processes, top: [{pid, name, cpu, memory}]}]} | null}` — read-only, cached 3 s, `usage` null off Linux), and `GET /api/users/audit[?limit=]` the staff reads of developers' sessions and admins' account changes (`reader`/`owner` are usernames, `reader_display`/`owner_display` their display names or null) (all `403 EADMIN` for a developer). See [SERVER-MODE.md](SERVER-MODE.md#what-each-user-sees).
+In server mode a **developer** sees only rows of the workspaces they own (`lanes.owner_id`): every list, count, chart and cost answer is limited to them, and a request naming another user's session, agent, workspace or run (in the path, query or body) answers `404 ENOTFOUND`. Admin and analyst see everything; `GET /api/users` lists every account (`displayName`, `email`, `createdAt`, `logins`, `lastLoginAt` — the last login ever, kept after it ends —, `mustChangePassword` included) with its workspaces, sessions and 7/30-day `{cost, tokens}`, `GET /api/users/storage[?refresh=1]` each user's home size (`{storage: {<id>: {bytes, files, partial, measuredAt} | null}, measuring}` — measured in the background, see [SERVER-MODE.md](SERVER-MODE.md)), `GET /api/users/tmux` each member's own tmux server under one Linux user per account (`{available, installed, matched, users: [{id, username, running, stuck?, version, pid, startedAt, sessions, busy, outdated}]}`; an admin's `POST /api/users/:id/tmux-restart` and `POST /api/users/tmux-restart-idle` restart them with `currentPassword`, audited, `409 ETMUXSTUCK` for a server that will not stop), `GET /api/host` the machine and each user's live share of it (`{at, hostname, os, uptime, cpu: {model, cores, load}, memory: {total, available, used, swapTotal, swapUsed}, disks: [{device, mount, type, kind: "HDD"|"SSD"|null, total, used, free}], homesMount, gpus: [{name, utilization, memoryUsed, memoryTotal}], usage: {cpu, sampleMs, groups: [{key, kind: "user"|"host"|"system", userId?, username?, cpu, memory, memoryPercent, processes, top: [{pid, name, cpu, memory}]}]} | null}` — read-only, cached 3 s, `usage` null off Linux), and `GET /api/users/audit[?limit=]` the staff reads of developers' sessions and admins' account changes (kept `AGENTHUB_AUDIT_DAYS` days, default 180, `0` = forever) (`reader`/`owner` are usernames, `reader_display`/`owner_display` their display names or null) (all `403 EADMIN` for a developer). See [SERVER-MODE.md](SERVER-MODE.md#what-each-user-sees).
 
-An admin changes accounts with `POST /api/users` (`{username, password, role}` → `201 {user}`), `GET /api/users/:id` (`{user, workspaces: [{id, title, cwd}]}`, the account with `logins` and `lastLoginAt`, for the Edit form; admin or analyst), `GET /api/users/:id/avatar` (that account's picture for the sidebar's owner groups — admin or analyst, `nosniff` + `sandbox` CSP, `404 ENOAVATAR`; a workspace in `GET /api/lanes` carries `owner_avatar_at` to version its URL), `PATCH /api/users/:id` (any of `{displayName?, email?, role?, disabled?, password?, addWorkspaces?: [laneId], removeWorkspaces?: [laneId], signOut?: true}` — every field validated before any is written; `removeWorkspaces` leaves the workspace with no owner and answers `409 ENOTOWNED` for one the user does not own; an admin's own `password`/`signOut` keeps the login it came from), `POST /api/users/:id/password` (`{password}`; that user's logins end) `POST /api/users/:id/workspaces` (`{laneId}`; the workspace's owner becomes that user) and `DELETE /api/users/:id` (delete for good: the user's logins, panes, workspaces' records, prefs and — under S3 — their Linux account and whole home, removed FIRST so a refusal (`502 EPROVISION`) leaves every row; `409 ESELF` for yourself, `409 ELASTADMIN` for the last admin; session history and the audit log stay). Every one carries `currentPassword`, the admin's own password: `403 EREAUTH` when it is wrong or missing, `429 ETOOMANY` after 10 wrong tries in 15 minutes. `409 ESELF` for an admin's own role or disable, `409 EEXISTS` for a taken name, `400 EBADUSER`/`EBADPASSWORD`/`EBADROLE`/`EBADEMAIL`/`EBADFIELD`, `404 ENOUSER`/`ENOLANE`; a developer or analyst gets `403 EADMIN`, and local mode `403 ELOCALMODE`. No answer carries a password hash; each change is written to the audit log.
+An admin changes accounts with `POST /api/users` (`{username, password, role}` → `201 {user}`; the password may be any non-empty starting one and the account gets `mustChangePassword: true`), `GET /api/users/:id` (`{user, workspaces: [{id, title, cwd}]}`, the account with `logins` and `lastLoginAt`, for the Edit form; admin or analyst), `GET /api/users/:id/avatar` (that account's picture for the sidebar's owner groups — admin or analyst, `nosniff` + `sandbox` CSP, `404 ENOAVATAR`; a workspace in `GET /api/lanes` carries `owner_avatar_at` to version its URL), `PATCH /api/users/:id` (any of `{displayName?, email?, role?, disabled?, password?, addWorkspaces?: [laneId], removeWorkspaces?: [laneId], signOut?: true}` — every field validated before any is written; `removeWorkspaces` leaves the workspace with no owner and answers `409 ENOTOWNED` for one the user does not own; an admin's own `password`/`signOut` keeps the login it came from; a password for SOMEONE ELSE may be anything non-empty and sets their `mustChangePassword`, the admin's OWN must pass every rule below, `400 EWEAKPASSWORD` with `rules`), `POST /api/users/:id/password` (`{password}`; that user's logins end; the same two bars) `POST /api/users/:id/workspaces` (`{laneId}`; the workspace's owner becomes that user) and `DELETE /api/users/:id` (delete for good: the user's logins, panes, workspaces' records, prefs and — under S3 — their Linux account and whole home, removed FIRST so a refusal (`502 EPROVISION`) leaves every row; `409 ESELF` for yourself, `409 ELASTADMIN` for the last admin; session history and the audit log stay). No path — this API or the `agenthub users` CLI — may demote, disable or delete the last enabled admin (`409 ELASTADMIN`). Every one carries `currentPassword`, the admin's own password: `403 EREAUTH` when it is wrong or missing, `429 ETOOMANY` after 10 wrong tries in 15 minutes. `409 ESELF` for an admin's own role or disable, `409 EEXISTS` for a taken name, `400 EBADUSER`/`EBADPASSWORD`/`EBADROLE`/`EBADEMAIL`/`EBADFIELD`, `404 ENOUSER`/`ENOLANE`; a developer or analyst gets `403 EADMIN`, and local mode `403 ELOCALMODE`. No answer carries a password hash; each change is written to the audit log.
 
 `GET /api/accounts[?force=1]` lists the Claude account pool ([SERVER-MODE.md](SERVER-MODE.md#claude-account-pool)): `{accounts: [{name, addedAt, expiresAt, expired, livePanes, spend5h, spend7d, tokens5h, tokens7d, quota: {fiveHour, sevenDay, checkedAt, error} | null, quotaPercent, full}], codex: [{name, kind: "apikey"|"chatgpt", addedAt, livePanes, spend5h, spend7d, tokens5h, tokens7d, quota: {windows: [{label, usedPercent, resetsAt}], asOf} | null, quotaPercent, full}], pins: {claude: [{userId, username, account, pinnedAt}], codex: […]}, blockPercent}` — `pins` are the users an admin pinned to one account (empty in local mode); `codex` is the [Codex account pool](SERVER-MODE.md#codex-account-pool). `spend*`/`tokens*` = the sessions the account's runs held, over the hours they held them (a Codex session counts whole once its run started in the window). It never includes a key or a token. `force=1` re-reads every quota first. Run rows (`/api/run/history`) carry `account`, the pool account their pane ran on (`null` = the machine's own login).
 
-An admin (server mode) adds an account with `POST /api/accounts` `{tool: "claude"|"codex", name, currentPassword, …}` → `201 {account}`. For Claude the body carries one of: `profile` (a saved switch-user profile, MOVED in: the profile is deleted; the one the host's CLI is logged into moves in with its live login and the host's home becomes one more placement the server refreshes — `409 EACTIVE` only for a macOS Keychain login; `name` defaults to it), `credentials` (the text of a `.credentials.json`; Anthropic is asked whose account it is, `502 EUPSTREAM` when it cannot be reached), or `token` (a `claude setup-token` token). For Codex, `token` is an OpenAI API key or the text of an `auth.json`. `GET /api/accounts/profiles` lists the saved profiles `{profiles: [{name, label, email, subscriptionType, active}]}` (no token). Claude rows in `GET /api/accounts` carry `kind` (`token`|`login`), `email` and `refreshError`; a login's `expiresAt` is null and removes one with `DELETE /api/accounts/:name` `{tool, currentPassword}` → `{ok: true}`. No answer carries the token. `403 EREAUTH` wrong password (`429 ETOOMANY` after 10), `403 EADMIN` for a non-admin, `403 ELOCALMODE` in local mode, `400 EBADTOOL`/`EBADNAME`/`EBADTOKEN`, `409 EEXISTS`, `404 ENOACCOUNT`; each change is audited by account name. `PUT /api/accounts/pins` `{tool, userId, account, currentPassword}` → `{pin: {userId, username, account}}` switches that user's sessions of `tool` to one pool account (`account: null` = automatic again; `404 ENOUSER`/`ENOACCOUNT`); `switched` says what happened now — `switched` (a Claude login was written into their home: running panes take it at their next credentials read, no restart), `kept`, `own-login` (their own login, left alone), `expired`, `next-session` (a token, Codex, or no member home), with the same password step-up and audit (the user as `owner_id`). `PUT /api/accounts/:name/users` `{tool, userIds, currentPassword}` → `{added: [{userId, username, switched}], removed: [{userId, username}]}` is the Users page's Edit of one account: exactly those users run on it afterwards (a user on another account moves here, one left out goes back to the balancer; one transaction, each change audited; `400 EBADUSER`, `404 ENOUSER`/`ENOACCOUNT`). Removing an account drops its pins; deleting a user drops theirs.
+An admin (server mode) adds an account with `POST /api/accounts` `{tool: "claude"|"codex", name, currentPassword, …}` → `201 {account}`. For Claude the body carries one of: `profile` (a saved switch-user profile, MOVED in: the profile is deleted; the one the host's CLI is logged into moves in with its live login and the host's home becomes one more placement the server refreshes — `409 EACTIVE` only for a macOS Keychain login; `name` defaults to it), `credentials` (the text of a `.credentials.json`; Anthropic is asked whose account it is, `502 EUPSTREAM` when it cannot be reached), or `token` (a `claude setup-token` token). For Codex, `token` is an OpenAI API key or the text of an `auth.json`, or `profile` names a saved Codex profile (`/api/tool-profiles`), MOVED in the same way (the profile file is deleted; the host's own `auth.json` is left as it is). `GET /api/accounts/profiles[?tool=codex]` lists the saved profiles `{profiles: [{name, label, email, subscriptionType, active}]}` (no token; for Codex `subscriptionType` is the ChatGPT plan or `…1234` of a key). Settings → AI tools → Profiles links each Claude/Codex profile here (`/admin?poolAdd=<tool>&poolProfile=<name>` opens the pool's Add dialog on it). Claude rows in `GET /api/accounts` carry `kind` (`token`|`login`), `email` and `refreshError`; a login's `expiresAt` is null and removes one with `DELETE /api/accounts/:name` `{tool, currentPassword}` → `{ok: true}`. No answer carries the token. `403 EREAUTH` wrong password (`429 ETOOMANY` after 10), `403 EADMIN` for a non-admin, `403 ELOCALMODE` in local mode, `400 EBADTOOL`/`EBADNAME`/`EBADTOKEN`, `409 EEXISTS`, `404 ENOACCOUNT`; each change is audited by account name. `PUT /api/accounts/pins` `{tool, userId, account, currentPassword}` → `{pin: {userId, username, account}}` switches that user's sessions of `tool` to one pool account (`account: null` = automatic again; `404 ENOUSER`/`ENOACCOUNT`); `switched` says what happened now — `switched` (a Claude login was written into their home: running panes take it at their next credentials read, no restart), `kept`, `own-login` (their own login, left alone), `expired`, `next-session` (a token, Codex, or no member home), with the same password step-up and audit (the user as `owner_id`). `PUT /api/accounts/:name/users` `{tool, userIds, currentPassword}` → `{added: [{userId, username, switched}], removed: [{userId, username}]}` is the Users page's Edit of one account: exactly those users run on it afterwards (a user on another account moves here, one left out goes back to the balancer; one transaction, each change audited; `400 EBADUSER`, `404 ENOUSER`/`ENOACCOUNT`). Removing an account drops its pins; deleting a user drops theirs.
 
 **The account's own preferences and first-run setup** (`server/routes/me.js`; local mode is the one account `local`, server mode one row per account in `user_prefs`):
 
@@ -104,10 +108,11 @@ An admin (server mode) adds an account with `POST /api/accounts` `{tool: "claude
 | `POST /api/me/onboarded` | the first-run setup is done or skipped (kept from the first call) |
 | `GET /api/me/account` | Settings → Account. Server mode: `{mode: "server", user: {id, username, role, disabled, displayName, email, avatarAt, createdAt}, workspaces, sessions, logins, lastLoginAt}`; local mode `{mode: "local"}` |
 | `PATCH /api/me/account` `{displayName?, email?}` | the account's own profile (`""`/`null` clears), the same shape back; `400 EBADFIELD` (display name over 100 characters or with control characters) / `EBADEMAIL` |
-| `POST /api/me/password` `{currentPassword, newPassword}` | `{ok: true}`; every other login of the account ends, this one stays. `403 EREAUTH` wrong current password (`429 ETOOMANY` after 10), `400 EBADPASSWORD` |
+| `POST /api/me/password` `{currentPassword, newPassword}` | `{ok: true}`; every other login of the account ends, this one stays, and `mustChangePassword` clears. The new password must pass every rule — at least 8 characters, a lower-case and an upper-case letter, a digit, a symbol, not containing the username — and differ from the current one: `400 EWEAKPASSWORD` with `error.rules` (`length`, `lower`, `upper`, `digit`, `symbol`, `username`, `reused`). `403 EREAUTH` wrong current password (`429 ETOOMANY` after 10), `400 EBADPASSWORD` |
 | `POST /api/me/sign-out-others` | `{ended}` — every login of the account but this one ends |
 | `GET /api/me/avatar` | server mode: the account's own picture (`nosniff`, `sandbox` CSP; the client adds `?v=<avatarAt>`), `404 ENOAVATAR` when it has none |
 | `PUT /api/me/avatar` (raw image bytes) | the account's picture (PNG, JPEG, GIF or WebP by magic bytes — never SVG), stored as `<data dir>/avatars/u<id>.<ext>`; the `/api/me/account` shape back with `user.avatarAt` set. `400 EBADIMAGE`, `413 ETOOBIG` over 1 MB, `403 ELOCALMODE`. Login cookie only, audited |
+| `POST /api/me/avatar/url` (`{url}`) | the picture as a LINK: stored as typed (`users.avatar_link`, an `https://` URL with no userinfo, ≤ 2048 chars, not `localhost` or a loopback/private/link-local/reserved IP literal) and NEVER downloaded by the server — `GET /api/me/avatar` and `GET /api/users/:id/avatar` answer `302` to it (`Referrer-Policy: no-referrer`), so the viewer's browser loads it with its own logins and network (a Mattermost `/api/v4/users/<id>/image` link works). Replaces an uploaded picture, and an upload replaces it (`server/lib/avatar-url.js`). `400 EBADURL`/`EPRIVATEURL`, `403 ELOCALMODE`. Login cookie only, audited |
 | `DELETE /api/me/avatar` | removes it (`avatarAt` back to `null`); deleting the user removes it too |
 
 The keys are the browser's own localStorage names: `theme`, `agenthub.theme.dark`, `agenthub.theme.light`, `i18nextLng`, `agenthub.terminal.font`, `agenthub.terminal.fontSize`, `agenthub.ui.fontSize`, `agenthub.pet`, `agenthub.pet.size`, `agenthub.pet.names`, `agent-dashboard-sagi-enabled`, `agent-dashboard-sagi-muted`, `agent-monitor-notifications`, `agenthub.defaultTool`, `agenthub.permissionMode` (`bypassPermissions` allowed — set only from Settings → AI tools → Session defaults, behind a confirm), `agenthub.codex.sandbox`, `agenthub.codex.approval`, `agenthub.codex.bypass` (`"true"`/`"false"`: a new Codex session's defaults), `agenthub.tour`, and `agenthub.chatUi` (`"1"` = Claude/Codex sessions open as a chat; read and written on the server only, by `client/src/lib/chatUi.ts`). The request never names an account, and writes are same-origin. An account's save writes only their own row, and under S3 a `theme` of `dark` or `light` also becomes the `theme` in their own `~/.claude/settings.json`, written as them.
@@ -285,7 +290,7 @@ POST /api/lanes/:id/fs/upload-batch?dir=&conflict=   length + JSON list + bytes
 GET  /api/lanes/:id/fs/zip?p=<path>&p=…    application/zip, streamed
 ```
 
-The workspace **File Explorer** (server mode only — a local dashboard has no **Files** entry, `/files` redirects home, and its buttons are hidden; the routes still answer) — the **Files** page in the sidebar (`/files?lane=<id>&path=<folder>`), laid out like GNOME Files (workspaces as places, Back/Forward, a path bar, icon grid or list, hidden files behind Ctrl+H), and the same manager in a dialog from a workspace's Files tab (the folder button; "Open in File Explorer" on a folder). `?session=` / `?source=` pick the same folder the
+The workspace **File Explorer** (server mode only — a local dashboard has no **Files** entry, `/files` redirects home, and its buttons are hidden; the routes still answer) — the **Files** page in the sidebar (`/files?lane=<id>&path=<folder>`), laid out like GNOME Files (workspaces as places — each nested under its owner's home, dropped down by that home's chevron (open homes kept per browser in `agenthub.files.homesOpen`), an owner whose home the viewer may not open (an analyst's view) under a row that only folds, one with no owner in a flat Workspaces list — Back/Forward, a path bar, icon grid or list, hidden files behind Ctrl+H), and the same manager in a dialog from a workspace's Files tab (the folder button; "Open in File Explorer" on a folder). `?session=` / `?source=` pick the same folder the
 git reads do. Paths go through the read path's guards (`lanePath`, the parent
 `resolveInLane`-confined, the last segment kept as a name so a symlink is acted
 on as a link); nothing in `.git`, no secret file, never the workspace folder
@@ -326,6 +331,25 @@ by one, 0.5 s as one batch.
 GET  /api/homes                                   { homes: [{ id: "me" | <username>, label, readOnly, dir? }] }
 GET  /api/homes/:who/fs/list|trash|zip|download   as the workspace routes above
 POST /api/homes/:who/fs/mkdir|newfile|rename|move|copy|delete|upload|trash/restore|trash/purge
+GET  /api/homes/trash                             { items, errors, keepDays } — every Trash the caller may open (below)
+```
+
+One line per route, for searching (bodies and answers as the workspace routes above; `copy` takes `fromLane` instead of `fromHome`, `trash/restore` and `trash/purge` also take `store`):
+
+```
+GET  /api/homes/:who/fs/download?path=
+GET  /api/homes/:who/fs/zip?p=<path>&p=…
+GET  /api/homes/:who/fs/trash
+POST /api/homes/:who/fs/newfile
+POST /api/homes/:who/fs/rename
+POST /api/homes/:who/fs/move
+POST /api/homes/:who/fs/copy
+POST /api/homes/:who/fs/delete
+POST /api/homes/:who/fs/trash/restore
+POST /api/homes/:who/fs/trash/purge
+POST /api/homes/:who/fs/upload?path=&conflict=
+POST /api/homes/:who/fs/upload-check
+POST /api/homes/:who/fs/upload-batch?dir=&conflict=
 ```
 
 The same File Explorer on a user's HOME (`server/lib/homes.js`): under S3 their
@@ -548,6 +572,14 @@ Error `409 ENOCWD` is returned when the workspace's folder no longer exists (or
 
 Error `409 ERUNLIVE` is returned if the workspace already has a live run; stop it first with the `stop` action. The same code and status come back when the workspace's tmux pane is already running an agent while a `prompt` or `resumeSessionId` was sent — that argv cannot be typed over a live agent, so the request is refused instead of answered 200 with nothing done. A start that asks for neither still adopts the existing pane silently.
 
+#### Other workspace actions
+
+```http
+POST /api/lanes/:id/:action
+```
+
+The one control route behind `start` (above), `stop`, `message`, `clear`, `reset`, `remove` and `purge` (same-origin). Any other `:action` is `400 EBADACTION`, an unknown workspace `404 ENOLANE`. `reset`, `remove` and `purge` are destructive and need `{ "confirm": true }` (`400 ECONFIRM`) — see below.
+
 #### Preflight a destructive workspace action
 
 ```http
@@ -1273,6 +1305,33 @@ anything is spawned, and `args` travels as an array of strings straight into
 argv — neither is ever joined into a command string. An unknown name returns
 `400 ENOHOOK` with the allowed list; a workspace with no slot returns `409 ENOSLOT`.
 
+#### Scaffold a profile, sync MCP servers, read an integration
+
+```http
+POST /api/lanes/:id/profile/init
+POST /api/lanes/:id/mcp/sync
+GET  /api/lanes/:id/integrations/:name
+```
+
+`profile/init` (same-origin) detects a Node.js project in the workspace's OWN folder and scaffolds `.agenthub/profile/` there — the HTTP twin of `agenthub lanes profile init`. `{ force?: true }` overwrites; answers `{ scaffolded: true, written, todos }`, or `{ scaffolded: false, reason }` (200) when no Node.js project is found; `400 EPROFILEEXISTS` without `force`. `mcp/sync` (same-origin) copies the source repo's `mcpServers` from `~/.claude.json` into `<workspace>/.mcp.json` (paths relocated) and seeds Playwright profiles → `{ servers, profilesSeeded }`; `400 ENOMCPCONFIG` when the source has none. Never automatic — a session calls it. `integrations/:name` → `{ enabled }`, read from `.agenthub/profile/integrations.env`. All three `404 ENOLANE` for an unknown workspace; under S3 the two writes refuse a member's folder the way the runtime routes do.
+
+#### CI status and base sync
+
+```http
+GET  /api/lanes/:id/ci/status?ref=<branch|sha>
+POST /api/lanes/:id/sync-base
+```
+
+`ci/status` is ONE snapshot of GitHub Actions for `ref` through `gh` in the workspace's folder — not a poll loop: `{ state: "pending"|"success"|"failure", ref, checks: [{ name, conclusion, url }] }`; `400 EBADREF` without `ref`. `sync-base` (same-origin, under the workspace lock, needs the workspace profile) merges the profile's base branch INTO the workspace's branch behind a migration-number collision preflight: body `{ mode?: "check"|"merge"|"continue" (default merge), branch? }`. Every documented outcome — clean, a collision, a conflict left in place — is a 200 with `code` 0/4/5; only a malformed request, a missing profile or an out-of-order `continue` answers an `error`. It never writes the stage.
+
+#### Housekeeping
+
+```http
+POST /api/lanes/gc
+```
+
+Same-origin, admin only (`403 EADMIN` for a developer or analyst — it is machine-wide). Reaps orphaned Playwright MCP processes under `LANES_ROOT` and caps oversized logs under `LANES_ROOT/.state/`. `{ dryRun?: true }` reports without acting. Answers `{ reaped, capped }`.
+
 #### Tail a workspace's log
 
 ```http
@@ -1563,6 +1622,17 @@ Both `GET /api/workflows` and `/skill-usage` also take `from=YYYY-MM-DD&to=YYYY-
 query failure.
 
 
+#### Workflow-tool runs
+
+```http
+GET /api/workflows/runs?status=&session_id=&limit=&offset=
+GET /api/workflows/runs/:runId
+GET /api/workflows/session/:id
+```
+
+`runs` lists the fleets the Claude Code **Workflow** tool launched, ingested from their on-disk journals (`server/lib/workflow-ingest.js`): `{ runs, total, counts, limit, offset }`, newest first, `phases`/`progress` parsed into arrays, `counts` per status; `status` (omit or `all` for every one) or `session_id` filters, `limit` 1–1000 (default 50). A developer sees only runs of their own sessions. `runs/:runId` → `{ workflow, agents, events }` — the run, its inner agents and their events (oldest first, at most 5000); `404 WORKFLOW_NOT_FOUND`. `session/:id` is the session drill-in of the Workflow analytics page: `{ session, tree, toolTimeline, swimLanes, events }` (the agent tree, every tool call in order, one swim lane per agent, the first 500 events); `404` for an unknown session.
+
+
 ### Locks
 
 Cross-workspace named locks (`server/lib/named-lock.js`) — the OTHER axis from a
@@ -1771,6 +1841,16 @@ classDiagram
 
 ---
 
+#### Create Session
+
+```http
+POST /api/sessions
+```
+
+Body `{ id, name?, cwd?, model?, metadata? }` (`id` required, else `400 INVALID_INPUT`). An existing id answers `200 { session, created: false }` unchanged; a new one is inserted `active` and broadcast as `session_created` → `201 { session, created: true }`. Sessions normally come from hooks; in server mode a developer or analyst is refused (`403 EADMIN`).
+
+---
+
 #### Update Session
 
 ```http
@@ -1960,53 +2040,24 @@ curl http://localhost:4820/api/sessions/sess_abc123/stats
 
 ---
 
-#### Get Session Agents
+#### Session transcripts
 
 ```http
-GET /api/sessions/:id/agents
+GET /api/sessions/:id/transcripts
+GET /api/sessions/:id/transcript?agent_id=&run_id=&limit=&after=&before=&offset=
 ```
 
-Returns all agents for a session.
+`transcripts` lists the session's conversation files — the main one first, then each subagent's and compaction's — as `{ transcripts: [{ id, name, type: "main"|"subagent"|"compaction", subagent_type?, db_agent_id, … }] }`; `db_agent_id` links an entry to its `agents` row (`null` when none matches). A Codex, Antigravity, Cursor, omp or OpenCode session lists its own tool's journal instead.
 
-**Path Parameters:**
+`transcript` reads one of them as structured messages: no `agent_id` = the main conversation, `agent_id` (+ `run_id` for a Workflow-tool agent) = a subagent's — each one plain name, never a path. `limit` defaults to 50 (max 200); `after=<line>` returns only messages past that JSONL line (the chat's tail), `before=<line>` the page before it (history), `offset` is the legacy pager. Answers `{ messages, total, has_more, last_line, first_line }` (empty when the file is gone). The live file under the Claude projects folder is preferred, else the snapshot taken at import. `404 NOT_FOUND` for an unknown session.
 
-| Parameter | Type | Description |
-|-----------|------|-------------|
-| `id` | string | Session ID |
+---
 
-**Example Request:**
+#### Get Session Agents
 
-```bash
-curl http://localhost:4820/api/sessions/sess_abc123/agents
-```
+There is no `/api/sessions/:id/agents` route: a session's agents come with `GET /api/sessions/:id` (its `agents` array) or from `GET /api/agents?session_id=<id>` (see [Agents](#agents)).
 
-**Example Response:**
-
-```json
-{
-  "agents": [
-    {
-      "id": "sess_abc123-main",
-      "session_id": "sess_abc123",
-      "name": "Main Agent - my-project",
-      "type": "main",
-      "subagent_type": null,
-      "status": "idle",
-      "current_tool": null,
-      "task": null,
-      "started_at": "2024-03-18T12:00:00Z",
-      "ended_at": null,
-      "updated_at": "2024-03-18T12:05:00Z",
-      "parent_agent_id": null,
-      "awaiting_input_since": "2024-03-18T12:05:00Z",
-      "awaiting_reason": "stop",
-      "cost": 0
-    }
-  ]
-}
-```
-
-> **Note on `cost`** — `/api/agents` and `/api/sessions/:id/agents` attach a `cost` (USD) to each agent: the agent's **own** cost, computed server-side from the per-agent token buckets stored in `agents.metadata.tokens` and priced at the current pricing rules (at the agent's start date, so promo/standard cutovers apply — see [Pricing](#pricing)). It is `0` for main agents (whose cost is the session total, reported by `/api/pricing/cost/:sessionId`), for compaction pseudo-agents, and for any subagent whose transcript is unavailable. This lets a subagent card show only what that subagent spent instead of the whole session's total.
+> **Note on `cost`** — `/api/agents` and `GET /api/sessions/:id` (its `agents`) attach a `cost` (USD) to each agent: the agent's **own** cost, computed server-side from the per-agent token buckets stored in `agents.metadata.tokens` and priced at the current pricing rules (at the agent's start date, so promo/standard cutovers apply — see [Pricing](#pricing)). It is `0` for main agents (whose cost is the session total, reported by `/api/pricing/cost/:sessionId`), for compaction pseudo-agents, and for any subagent whose transcript is unavailable. This lets a subagent card show only what that subagent spent instead of the whole session's total.
 
 > **Note on `status` vs Waiting** — agents are persisted with one of `idle | connected | working | completed | error`. The yellow **Waiting** badge surfaced in the dashboard is a UI overlay derived from `awaiting_input_since` being non-null on a non-terminal agent (typically `idle` after a `Stop`, or `connected` right after `SessionStart`). Filter `?status=idle` on `/api/agents` and inspect `awaiting_input_since` to enumerate currently-waiting main agents.
 
@@ -2070,54 +2121,18 @@ curl http://localhost:4820/api/agents/agent_xyz789
 
 ---
 
-#### Get Agent Tools
+#### Create or update an agent
 
 ```http
-GET /api/agents/:id/tools
+POST  /api/agents
+PATCH /api/agents/:id
 ```
 
-Returns tool executions for an agent.
+`POST` body `{ id, session_id, name, type?, subagent_type?, status?, task?, parent_agent_id?, metadata? }` (`id`, `session_id`, `name` required, else `400 INVALID_INPUT`): an existing id answers `200 { agent, created: false }` (`404 ENOTFOUND` when it is another user's in server mode); a new one is inserted (`type` default `main`, `status` default `waiting`), broadcast as `agent_created` → `201 { agent, created: true }`. `PATCH` takes any of `name`, `status`, `task`, `current_tool`, `ended_at`, `metadata` and answers `{ agent }`; `404 NOT_FOUND` for an unknown id. Agents normally come from hooks.
 
-**Path Parameters:**
+#### Tool Execution Flow
 
-| Parameter | Type | Description |
-|-----------|------|-------------|
-| `id` | string | Agent ID |
-
-**Example Request:**
-
-```bash
-curl http://localhost:4820/api/agents/agent_xyz789/tools
-```
-
-**Example Response:**
-
-```json
-{
-  "tools": [
-    {
-      "id": 1,
-      "agent_id": "agent_xyz789",
-      "tool_name": "bash",
-      "duration_ms": 1234,
-      "success": 1,
-      "error_message": null,
-      "created_at": "2024-03-18T12:01:00Z"
-    },
-    {
-      "id": 2,
-      "agent_id": "agent_xyz789",
-      "tool_name": "view",
-      "duration_ms": 45,
-      "success": 1,
-      "error_message": null,
-      "created_at": "2024-03-18T12:02:00Z"
-    }
-  ]
-}
-```
-
-**Tool Execution Flow:**
+Tool calls are recorded as `PreToolUse`/`PostToolUse` events, not as a separate table — read them with `GET /api/events?agent_id=<id>` or `?tool_name=<name>`.
 
 ```mermaid
 sequenceDiagram
@@ -2128,13 +2143,13 @@ sequenceDiagram
     participant DB as Database
     
     Agent->>PreHook: Tool about to execute
-    PreHook->>DB: Set current_tool
+    PreHook->>DB: Store PreToolUse event, set current_tool
     
     Agent->>Tool: Execute (bash, view, etc.)
     Tool-->>Agent: Result
     
     Agent->>PostHook: Tool completed
-    PostHook->>DB: Create tool_execution record
+    PostHook->>DB: Store PostToolUse event
     PostHook->>DB: Clear current_tool
     PostHook->>DB: Update token counts + cost
 ```
@@ -2153,6 +2168,16 @@ Returns `{ events, limit, offset, total }`, newest first, filtered by `event_typ
 
 ---
 
+#### Event filter values
+
+```http
+GET /api/events/facets
+```
+
+`{ event_types, tool_names }` — the distinct values in the events table, sorted, for the Events page's filters (a developer's: only their own sessions' events).
+
+---
+
 ### Data cleanup
 
 #### Clean up old data
@@ -2197,50 +2222,57 @@ POST /api/settings/uninstall
 
 Settings → System's **Uninstall AgentHub** (same-origin only). Body `{ "confirm": true }` — anything else is `400 ECONFIRM`; in server mode `403 ESERVERMODE` (a shared dashboard is removed with `agenthub uninstall` on the host). Spawns `scripts/uninstall.js --yes` detached and answers `202 { ok: true, log }` at once; the worker then stops this server and removes everything `agenthub uninstall --yes` does (see [CLI.md](CLI.md)), the database included. `log` is `$TMPDIR/agenthub-uninstall-<uid>.log`, the only record left afterwards.
 
+#### Clear, re-import, export and restore data
+
+```http
+POST /api/settings/clear-data
+POST /api/settings/reimport
+GET  /api/settings/export
+POST /api/settings/import
+POST /api/settings/reset-pricing
+```
+
+`clear-data` deletes every session, agent, event, token row, workflow run, fired alert and webhook delivery in one transaction (alert rules, webhook targets, pricing, snapshots and reports survive) → `{ ok: true, cleared: <table counts before> }`. `reimport` re-reads the Claude projects folder (`importAllSessions`) → `{ ok: true, imported, skipped, errors, … }`; `500 IMPORT_FAILED`. `export` streams one JSON attachment (`agent-monitor-export-<date>.json`: `format`, `version`, `exported_at`, `sessions`, `agents`, `events`, `token_usage`, `workflows`, `dashboard_runs`, `alert_rules`, `model_pricing`), events written in pages so a large database never sits in memory. `import` (same-origin) restores such a file sent as multipart `file` (≤ 512 MB, else `413 FILE_TOO_LARGE`): non-destructive — a session already here is skipped whole — → `{ ok: true, source, format, …counts }`; `400 NO_FILE` / `BAD_UPLOAD` / `INVALID_FORMAT`. `reset-pricing` reseeds the default model prices (and intro rates), then waits up to 3 s for the automatic price sync → `{ ok: true, pricing }`; `{ scope: "claude" }` resets only the `claude-…` rows. All five are admin-only in server mode, and `export` is staff-only.
+
+#### Hooks for Claude Code, Codex and Antigravity
+
+```http
+POST   /api/settings/reinstall-hooks
+GET    /api/settings/codex-hooks
+POST   /api/settings/codex-hooks
+DELETE /api/settings/codex-hooks
+GET    /api/settings/antigravity-hooks
+POST   /api/settings/antigravity-hooks
+DELETE /api/settings/antigravity-hooks
+```
+
+`reinstall-hooks` rewrites AgentHub's hooks in Claude Code's `settings.json` → `{ ok, hooks }` (`500 HOOK_INSTALL_FAILED`). `codex-hooks` reads, installs (or reinstalls) and removes AgentHub's entries in `$CODEX_HOME/hooks.json` (`server/lib/codex-hooks.js`); every answer is the status `{ supported, path, script, readable, installed, trusted, events: { <Event>: { installed, trusted } }, error? }` — `trusted` is read from Codex's own `config.toml`, which AgentHub never writes. `antigravity-hooks` does the same for the named hook `agenthub` in `~/.gemini/config/hooks.json` (status `{ supported, path, script, readable, installed, enabled, events }`). Only on a click; the writes are same-origin; `400 EBADJSON` / `EUNSUPPORTED` / `EFOREIGN` (a forwarder script that is not AgentHub's), else `500 ESAVE`.
+
+#### Privacy
+
+```http
+GET /api/settings/privacy
+PUT /api/settings/privacy
+```
+
+`{ redact_secrets, ignore_cwd, env_owned: { redact_secrets, ignore_cwd } }` — opt-in redaction of secrets in stored payloads, and the folders whose hooks are dropped (`server/lib/privacy.js`). `PUT` (same-origin) takes either field (`redact_secrets` boolean, `ignore_cwd` a list of absolute folders) and answers `{ ok: true, …state }`; `400 INVALID_INPUT` / `EBADPATH` (not absolute, a filesystem root, over 100 entries), `409 EENVOWNED` when the environment sets it, `500 ESAVE`.
+
+#### Push ingest token
+
+```http
+GET    /api/settings/push-token
+POST   /api/settings/push-token
+DELETE /api/settings/push-token
+```
+
+The token for [`POST /api/hooks/ingest-batch`](#push-ingest-post-apihooksingest-batch). `GET` → `{ enabled, env_owned }` — never the token. `POST` (same-origin) makes a new one (the old one stops working) and returns it THIS ONCE: `{ ok: true, token, enabled, env_owned }`; `DELETE` turns push ingest off → `{ ok: true, enabled: false, env_owned }`. `409 EENVOWNED` when `AGENTHUB_PUSH_TOKEN_SHA256` comes from the environment.
+
+
 ---
 
 ### Tools
 
-#### List All Tools
-
-```http
-GET /api/tools
-```
-
-Returns all tool executions across all sessions.
-
-**Query Parameters:**
-
-| Parameter | Type | Default | Description |
-|-----------|------|---------|-------------|
-| `limit` | integer | 100 | Max tools to return |
-| `tool_name` | string | - | Filter by tool name |
-| `success` | boolean | - | Filter by success status |
-
-**Example Request:**
-
-```bash
-curl http://localhost:4820/api/tools?limit=50&tool_name=bash
-```
-
-**Example Response:**
-
-```json
-{
-  "tools": [
-    {
-      "id": 1,
-      "agent_id": "agent_xyz789",
-      "tool_name": "bash",
-      "duration_ms": 1234,
-      "success": 1,
-      "error_message": null,
-      "created_at": "2024-03-18T12:01:00Z"
-    }
-  ],
-  "total": 156
-}
-```
+There is no `/api/tools` route. Per-tool counts come from `GET /api/sessions/:id/stats` (`tools_used`, `tool_call_count`) and `GET /api/events/facets`; individual calls from `GET /api/events?tool_name=<name>`.
 
 ---
 
@@ -2289,6 +2321,27 @@ A ready-made Prometheus config, recording rules and three Grafana boards built o
 
 ---
 
+#### Overview counts
+
+```http
+GET /api/stats?tz_offset=&sources=&tool=
+```
+
+The Dashboard's header numbers: the overview counts (sessions, agents, events…), `events_today` (in the local day of `tz_offset`, the browser's `getTimezoneOffset()`), `ws_connections`, `agents_by_status` and `sessions_by_status` (`{ <status>: count }`). `sources`/`tool` narrow it like `/api/sessions`; a malformed `tool` is `400 INVALID_INPUT`.
+
+#### Health and API docs
+
+```http
+GET /api/health
+GET /api/openapi.json
+GET /api/redoc
+GET /api/redoc/redoc.standalone.js
+```
+
+`health` → `{ status: "ok", version, timestamp }`, exempt from every login. `openapi.json` is this API's OpenAPI 3.0 document (also browsable at `/api/docs`, Swagger UI); `redoc` renders it with ReDoc, whose script `redoc.standalone.js` is served locally (no CDN).
+
+---
+
 ### Pricing
 
 #### List Pricing Rules
@@ -2534,41 +2587,28 @@ POST /api/alerts/rules/preview
 
 ### Notifications
 
-#### Get Session Notifications
+Notifications are not stored per session and have no REST read. Hook `Notification` events land in the events table (`GET /api/events?session_id=<id>&event_type=Notification`), and the dashboard's alerts feed is [`GET /api/alerts`](#alerts-feed).
+#### Alert rules
 
 ```http
-GET /api/sessions/:id/notifications
+GET    /api/alerts/rules
+POST   /api/alerts/rules
+PATCH  /api/alerts/rules/:id
+DELETE /api/alerts/rules/:id
 ```
 
-Returns notifications for a session.
+`GET` → `{ rules: [{ id, name, rule_type, config, enabled, cooldown_seconds, … }] }` (`config` parsed). `POST` body `{ name, rule_type, config, enabled?, cooldown_seconds? }`: `rule_type` is one of `event_pattern`, `inactivity`, `status_duration`, `token_threshold`, `cost_threshold`, `budget`, and `config` is validated for it (`validateRuleConfig`); `cooldown_seconds` defaults to 300 → `201 { rule }`. `PATCH` takes `name`, `config` (checked against the stored type — `rule_type` is immutable), `enabled`, `cooldown_seconds` → `{ rule }`. `DELETE` → `{ ok: true }`, its fired alerts cascading away. `400 INVALID_INPUT`, `404 NOT_FOUND`. In server mode rules are staff-only and their writes admin-only. See [Spend Budgets](#spend-budgets) for `budget` and the read-only preview.
 
-**Path Parameters:**
+#### Alerts feed
 
-| Parameter | Type | Description |
-|-----------|------|-------------|
-| `id` | string | Session ID |
-
-**Example Request:**
-
-```bash
-curl http://localhost:4820/api/sessions/sess_abc123/notifications
+```http
+GET  /api/alerts?unacked=true&limit=&offset=
+POST /api/alerts/:id/ack
+POST /api/alerts/ack-all
 ```
 
-**Example Response:**
+`GET` → `{ alerts, total, unacked, limit, offset }`, newest first (`limit` 1–200, default 50; `unacked=true` only the unacknowledged). A developer's feed is their own sessions' alerts (one with no session — a budget — is staff-only); an analyst's rows carry `can_ack`. `:id/ack` acknowledges one (`:id` numeric) → `{ alert }`, broadcast as `alert_updated`; `404 NOT_FOUND`. `ack-all` → `{ ok: true, acknowledged }` (a developer's or analyst's: their own sessions' only).
 
-```json
-{
-  "notifications": [
-    {
-      "id": 1,
-      "session_id": "sess_abc123",
-      "notification_type": "backgroundTaskComplete",
-      "message": "Explore agent completed",
-      "created_at": "2024-03-18T12:05:00Z"
-    }
-  ]
-}
-```
 
 ### Remote Data Sources
 
@@ -2894,6 +2934,7 @@ POST   /api/run/:id/permission-mode   {mode} → Shift+Tab steps, each read back
 POST   /api/run                       Start/attach run — Body: { laneId, cwd?, model?, permissionMode?, effort?, resumeSessionId?, initialPrompt?, sandbox?, approval?, resumeLast?, bypass? }
 GET    /api/run/:id                   Run handle (returns live run state)
 DELETE /api/run/:id[?archive=1]       Kill the pane → {ok}. `archive=1` (the UI's Stop) also archives the session it held → {ok, archived: <session id> | null}; without it (Sleep, the CLI) the session stays listed to resume
+DELETE /api/run/history/:id          Forget one CLOSED Terminal tab (`tool = 'shell'`) from the history now → {removed}; 409 ERUNLIVE while open, 404 ENOTFOUND for any other row
 ```
 
 `:id` must be a workspace pane name, `agenthub-lane-<n>`; anything else answers 404 without reaching tmux, so these two routes can never touch a tmux session the dashboard did not start.
@@ -2918,6 +2959,8 @@ Every history row carries `lane_id` (the workspace whose run it belongs to) and
 GET    /api/ai-tools                  Catalog + detection — { tools: [...], default }
 POST   /api/ai-tools/refresh          Re-read the login shell's PATH, re-detect, same body
 PUT    /api/ai-tools/:id              Body: { enabled?: boolean, default?: true, defaultModel?: string|null } — same body
+GET    /api/ai-tools/omp-sharing      { available, enabled, installed, broker: {running, error?}, gateway: {running, port?, error?} } — S3 only, never a token
+PUT    /api/ai-tools/omp-sharing      Body: { enabled: boolean } — an admin's; 409 ENOS3 without per-user accounts; audited
 GET    /api/ai-tools/:id/models       { flag, models: [{ id, label, hint? }], defaultModel } — the tool's own list
 GET    /api/ai-tools/:id/usage        { sessions, cost } — sessions with tool = id, their tokens priced
 GET    /api/ai-tools/:id/config       { files: [{ index, path, format: "json"|"jsonc"|"text", exists, size }] }
@@ -2935,6 +2978,18 @@ Each tool: `{ id, label, command, homepageUrl, installed, path, enabled, source:
 
 **Install / update jobs.** Commands come only from built-in or release catalog files, never from the request or `DASHBOARD_AI_TOOLS_DIR`. npm is the login shell's (`npm install -g <package>@latest`, plus `--prefix ~/.local` when npm's global prefix is not writable by the server's account — a system-wide Node; a tool under `~/.local/lib/node_modules` is updated the same way); a script is downloaded by the server (https, same site as the tool's homepage, ≤ 1 MB) and run as `bash <file>`; `self` runs `<detected path> ...args`. One job server-wide; the job is `{ id, tool, action, status: "running"|"ok"|"failed", startedAt, endedAt, exitCode, log }` (last 256 KB, 10-minute timeout) and lives in memory. A successful install enables the tool. Errors: `404 ENOTOOL`; `400 ENOINSTALL`/`ENOUPDATE`/`ENOTHING`; `409 EINSTALLED`/`ENOTINSTALLED`/`ENOTNPM` (npm update of a tool whose binary is under neither `npm prefix -g` nor `~/.local/lib/node_modules`)/`ENONPM`/`EBUSY`. Icons are the root `/favicon.ico`, raster only by magic bytes (never SVG), ≤ 256 KB, cached in `<data dir>/runtime/ai-tool-icons/`, served with `nosniff` and `Content-Security-Policy: sandbox`; an `<img>` passes the dashboard token as `?token=`. The client shows its own shipped mark instead where it has one (`client/public/ai-tools/<id>.svg` — claude, codex, openclaw, and hermes as a `-black`/`-white` pair swapped by the theme; `BUNDLED` in `client/src/components/AiToolIcon.tsx`), so this route is asked only for the other tools.
 
+### AI tool login profiles
+
+```
+GET /api/tool-profiles
+POST /api/tool-profiles/:tool            Body: { name? }
+PATCH /api/tool-profiles/:tool           Body: { name, label }
+POST /api/tool-profiles/:tool/activate   Body: { name }
+DELETE /api/tool-profiles/:tool          Body: { name }
+```
+
+The login profiles of the AI tools other than Claude Code (`server/lib/tool-profiles.js`; Claude's are `/api/cc-config/profiles` above). Settings → AI tools → **Profiles** shows both, one tab per tool. `:tool` is `codex` (the whole `$CODEX_HOME/auth.json`: a ChatGPT login or an API key) or `omp` (every credential Oh My Pi stores, read with `omp auth export` and written back with `omp auth import -` — secrets on stdin, never argv; import merges, so a switch first empties omp's credential tables in `~/.omp/agent/agent.db`, and a failed import puts the outgoing set back). `antigravity` is listed with `supported: false` and a `reason`: agy keeps its login in the OS keyring, which AgentHub does not touch (`409 EUNSUPPORTED`). `GET /` answers `{tools: [{tool, supported, reason?, items, active, error?}]}`, each item `{name, label, savedAt, active, kind, email, detail}` — never a token; one tool's failure (omp not installed) is that tool's `error`, not the request's. Profiles are stored one file each under `<CLAUDE_HOME>/agenthub-profiles/<tool>/` (0700/0600) with cc-profiles' rules: one login is one profile (`409 EDUPLICATE`), a switch re-saves the outgoing login into its own profile first and refuses one never saved (`409 EUNSAVED`), the live login's profile is not deletable (`409 EACTIVE`), `409 ENOAUTH` when the tool holds no login, `409 ENOTINSTALLED`, `502 EOMP` when omp's own command fails. Writes are same-origin only; in server mode `/tool-profiles` is in `ADMIN_WRITE_PREFIXES` and `STAFF_ONLY_PREFIXES` — it changes the HOST's own logins.
+
 ### AI Proxy profiles
 
 ```
@@ -3056,16 +3111,16 @@ GET    /api/artifacts/:id/installs             {items: [{user, mine, at, replace
 
 What agents produced, per OWNER (`server/lib/artifacts.js`, plan: `docs/plans/artifacts/README.md`):
 
-- **page** — a claude.ai link (`https://claude.ai/…` only, `400 EBADURL`), one row per owner and link. A session's `Artifact` tool publish is captured from its PostToolUse hook (the first `https://claude.ai/…artifact/…` in `tool_response`), owned by the session's workspace owner.
+- **page** — a claude.ai link (`https://claude.ai/…` only, `400 EBADURL`), one row per owner and link. A session's `Artifact` tool publish is captured from its PostToolUse hook (the first `https://claude.ai/…artifact/…` in `tool_response`), owned by the session's workspace owner — or, for a session no workspace owns (a member's `claude` started from their own terminal under S3), by the member whose account sent the hook (by its connection's uid, never the body); the host account names nobody, so such a page from the host stays unowned.
 - **file** — `candidates` are the documents (html, md, pdf, images, csv, office…) the workspace's sessions wrote with Write/Edit/MultiEdit/NotebookEdit, inside its folder. A pin is read under the download route's guards (`lanePath`, `resolveInLane`, `ESECRET`, ≤ 25 MB, `413 ETOOBIG`) and SNAPSHOTTED to `<data dir>/artifacts/<random>/`.
 - **skill** — the caller's own `~/.claude/skills/<name>` (their member home under S3; the host's for an admin or in local mode, else `409 ENOACCOUNT`) or a workspace's `.claude/skills/<name>`. Snapshotted whole: ≤ 300 files, ≤ 5 MB, a symlink anywhere is `ESYMLINK`, a secret-looking file name (`.env`, `*.pem`, `*token*`…) `403 ESECRET`.
 - **file upload** — one file from the user's computer (≤ 25 MB, `413 ETOOBIG`), snapshotted under its own base name (no folder kept).
 - **skill upload / new** — a skill made from files rather than picked: one Markdown/text file of any name becomes `SKILL.md`; several files or a picked/dropped folder (`paths` keeps the layout) need a `SKILL.md` (at the top or in one folder, which is stripped — `400 ENOSKILLMD` otherwise); a single `.zip`/`.skill` is unpacked (sizes checked from its directory first, a symlink entry `ESYMLINK`, `__MACOSX`/`.DS_Store`/`.git`/`node_modules` skipped); an upload holding several skill folders makes one artifact per skill, named by its folder, and stores NOTHING if any of them fails. The `name` the user typed (only for a single skill; else the frontmatter `name:`, the folder or the file name) is made a folder name (`skillSlug`: marks dropped, other characters → `-`; `400 EBADNAME` if nothing is left) and written into `SKILL.md`'s frontmatter as `name:`; a `description` given replaces the frontmatter's, and a skill with none anywhere is `400 ENODESCRIPTION`. Paths are relative with no `..` (`EBADPATH`); the same limits and `ESECRET` as a picked skill. `new` writes `SKILL.md` from `content` the same way.
 - **plugin** — only the spec and its marketplace source (`EBADPLUGIN`, `EBADMARKET`: `owner/repo`, a `validateRemoteUrl` URL, or an https link to a `marketplace.json`); no files. A GitHub web link becomes `owner/repo`, and a forge's `…/src/…`, `…/tree/…`, `…/blob/…` suffix or trailing slash is trimmed. The same `key` added again by its owner updates that row. **inspect** reads the marketplace's `.claude-plugin/marketplace.json` to list its plugins: a git link is cloned shallow, blob-less and without checkout into a temp dir that is removed after, with every credential helper switched off and no prompt (a repository that needs a login is `502 ENEEDLOGIN`; type the key by hand — installing then uses each user's own git login), https only (an ssh link is `400 ESSHMARKET`); a repo with only a `plugin.json` is `400 ENOTMARKET`; unreachable `502 EMARKETFETCH`. It reaches any https host a signed-in user names, like `publish` does — no login is ever sent with it.
-- **Visibility** — local mode: every row, no sharing (`400 ELOCALMODE`). Server mode: a developer sees their own rows and shared ones, admin/analyst every row; only the owner or an admin changes or deletes one (`403 EFORBIDDEN`). `shared` puts a row in every user's **Hub**. The page shows one list (`scope=all`: own rows plus shared ones) with an **All · My library · Hub** filter. Deleting a SHARED row of your own only takes it out of your library (`in_library = 0`, `inLibrary: false`, `{kept: true}`; it leaves `scope=mine` and shows as **Hub only**); unsharing such a row then deletes it (`PATCH` answers `{item, removed: true}`). Deleting an unshared row, or an admin deleting someone else's, deletes it outright.
+- **Visibility** — local mode: every row, no sharing (`400 ELOCALMODE`). Server mode: a developer sees their own rows and shared ones, admin/analyst every row; only the owner or an admin changes or deletes one (`403 EFORBIDDEN`). `shared` puts a row in every user's **Hub**. The page shows one list (`scope=all`: own rows plus shared ones) with an **All · My library · Hub** filter. `scope=mine` is the caller's own library rows plus the shared skills/plugins of OTHER users that the caller has installed (`installed: true`, `mine: false`); in server mode the page splits EVERY tab by `mine`, others' section first — **All** into *Shared by others* / *Mine*, **Hub** into *Shared by others* / *Shared by me*, **My library** into *Installed from others* / *Mine* — and each section pages 12 cards at a time (client-side). Deleting a SHARED row of your own only takes it out of your library (`in_library = 0`, `inLibrary: false`, `{kept: true}`; it leaves `scope=mine` and shows as **Hub only**); unsharing such a row then deletes it (`PATCH` answers `{item, removed: true}`). Deleting an unshared row, or an admin deleting someone else's, deletes it outright.
 - **raw** — only a file the snapshot recorded (`404 ENOFILE` otherwise), never a request path; served with `Content-Security-Policy: …; sandbox` and `nosniff`, unknown types as an attachment.
 - **install** — a skill or plugin (`EBADKIND`), into the CALLER's own account: a skill is written to `~/.claude/skills/<name>/` AND `~/.agents/skills/<name>/` (the folder Codex, Gemini/Antigravity, OpenCode and Cursor read) of every account the caller's sessions run as — under S3 their member home (as them through `write-as`), plus the host's home for an admin, whose host-folder workspaces run as the host. The answer is `{installed, paths, replaced}` (`installed` = the paths joined). A name taken in any of them is `409 EEXISTS` unless `replace: true`, which moves each old one to `~/.claude/agenthub-replaced-skills/<name>[-agents]-<time>/`. A plugin runs `claude plugin marketplace add <market>` then `claude plugin install --scope user <key>` as the caller, never with `-y`. `403 EINSTALLSOFF` while an admin has turned installs off. A list row's `installed` is true when that skill (`~/.claude/skills/<name>`) or plugin (a key of `~/.claude/plugins/installed_plugins.json`) is already in EVERY one of those accounts — the page then shows **Installed** instead of Install; it is a pure read, and an account that cannot be resolved or read counts as not installed. Every install is also a row of `artifact_installs` (who, when, the folders written, whether it replaced); `GET …/installs` lists them newest first — the owner, staff and local mode see every install, anyone else only their own, and `paths` goes only to the installer and an admin (a plugin has none: it is `claude plugin install --scope user`). `unrecorded` is what `installs` counted before that table existed. The card's "N installs" opens this list. Share, unshare, a shared row's delete and every install or uninstall by someone else are written to `audit_log`.
-- **uninstall** — takes an installed skill or plugin out of the same accounts again (`EBADKIND` otherwise; allowed while installs are off). A skill's folders that exist (both skills folders of each account) are MOVED to `~/.claude/agenthub-replaced-skills/<name>[-agents]-uninstalled-<time>/`, never deleted; a plugin runs `claude plugin uninstall --scope user --keep-data <key>` as the caller (its data dir stays). Nothing of it there is `409 ENOTINSTALLED`. The answer is `{uninstalled, paths}` (`paths` = the skill folders moved; empty for a plugin). The `installs` count and `artifact_installs` history are left as they were. The page shows **Uninstall** (card icon, ⋯ menu, detail sheet) beside **Installed**.
+- **uninstall** — takes an installed skill or plugin out of the same accounts again (`EBADKIND` otherwise; allowed while installs are off). A skill's folders that exist (both skills folders of each account) are MOVED to `~/.claude/agenthub-replaced-skills/<name>[-agents]-uninstalled-<time>/`, never deleted; a plugin runs `claude plugin uninstall --scope user --keep-data <key>` as the caller (its data dir stays). Nothing of it there is `409 ENOTINSTALLED`. The answer is `{uninstalled, paths}` (`paths` = the skill folders moved; empty for a plugin). The `installs` count and `artifact_installs` history are left as they were. The page offers **Uninstall** only in the card's ⋯ menu (and its right-click menu); there is no Reinstall — a newer version is uninstalled and installed again.
 - Every write is same-origin. The `artifact_changed` broadcast (`{id, ownerId, shared}`) reaches everyone for a shared row, else its owner and staff.
 
 ### Query Explorer
@@ -3130,6 +3185,53 @@ POST   /api/settings/compact       { confirm: true } → 202 — started (or alr
 Settings → Data → **Session cleanup** (`server/lib/db-retention.js`). Automatic retention is OFF unless `days` (1–3650, `AGENTHUB_RETENTION_DAYS` in the settings file) is set; nothing is deleted by default. When set, the hourly maintenance (`DASHBOARD_DB_MAINTAIN_MS`) purges finished (completed/error/abandoned) sessions that started more than `days` ago — the same rule and the same deletion (`purgeSessionIds`: events, agents, token usage, the session) as `POST /api/settings/cleanup` with `purge_days` — 25 sessions per transaction with a yield between, at most 5000 per run. A new database is created with `auto_vacuum = INCREMENTAL`, an existing one up to 32 MB is converted by a VACUUM at startup; the same hourly run then returns free pages to the OS (`incremental_vacuum`, in 1024-page slices, at most 65536 pages per run) once more than 1024 are free. A larger, older database is converted only by **Compact**: a full VACUUM in a worker thread followed by a TRUNCATE checkpoint — it holds the write lock while it runs (tens of seconds on a GB-size file), so hooks wait meanwhile; it runs only on a click. In server mode both writes are an admin's (`/settings` is in `ADMIN_WRITE_PREFIXES`).
 ---
 
+### Webhooks
+
+```http
+GET    /api/webhooks/providers
+GET    /api/webhooks
+POST   /api/webhooks
+PATCH  /api/webhooks/:id
+DELETE /api/webhooks/:id
+POST   /api/webhooks/:id/test
+GET    /api/webhooks/:id/deliveries?limit=&offset=
+```
+
+Where fired alerts are delivered (`server/lib/webhook-providers.js`). `providers` → `{ providers }`, the catalog with each provider's fields (secrets flagged). A target is answered REDACTED: `{ id, name, type, enabled, url_preview (masked), has_secret, headers (values redacted, generic family only), config (secret fields as ••••), rule_ids, created_at, updated_at, last_delivery }`. `POST` body `{ name, type, url?, enabled?, secret?, headers?, rule_ids?, config? }` — `type` one of the catalog ids (`slack`, `discord`, `teams`, `google_chat`, `mattermost`, `rocketchat`, `telegram`, `pagerduty`, `opsgenie`, `splunk_oncall`, `zapier`, `make`, `pipedream`, `generic`); `url` is required for providers that need one; `secret`/`headers` apply to the generic family only; `rule_ids` limits it to those alert rules (omit = all) → `201 { target }`. `PATCH` changes only the keys present (`config` is merged over the stored one, so a secret need not be re-sent) → `{ target }`. `DELETE` → `{ ok: true }` (its delivery log cascades). `test` sends a synthetic alert and always answers 200 `{ ok, status, attempts, error }`. `deliveries` → `{ deliveries, limit, offset }` (`limit` 1–200, default 20). `400 INVALID_INPUT`, `404 NOT_FOUND`. Staff-only in server mode, writes admin-only.
+
+### Web Push
+
+```http
+GET    /api/push/vapid-public-key
+POST   /api/push/subscribe
+DELETE /api/push/subscribe
+POST   /api/push/send
+```
+
+`vapid-public-key` → `{ publicKey }` for `PushManager.subscribe`. `subscribe` stores a browser subscription `{ endpoint, keys: { p256dh, auth } }` (upsert by `endpoint`; in server mode tagged with the user) → `{ ok: true }`; `DELETE` takes `{ endpoint }` in the BODY (a user removes only their own) → `{ ok: true }`. `send` `{ title, body, url? }` pushes to every subscription (in server mode: the caller's own) and fires a native notification in the desktop app → `{ ok: true, native, pushed, failed }`. `400` with `{ error: { message } }` on a missing field.
+
+### Updates
+
+```http
+GET  /api/updates/status
+POST /api/updates/check
+POST /api/updates/apply
+```
+
+Release-based update detection (`server/lib/update-check.js`). `status` and `check` answer the same object — `{ git_repo, update_available, install_kind: "checkout"|"plugin", local_version, latest_release, latest_release_url, latest_release_notes, release_check, commits_behind, commits_behind_release, manual_command, situation, last_plugin_update, repo_root, … }` (`repo_root` is `null` for a developer); `check` also broadcasts it as `update_status`. `apply` (admin-only in server mode) picks its mode by install kind, never from the request: a fast-forwardable checkout merges the release `--ff-only`, rebuilds, answers `{ …, applied: true }` and then restarts the server; a plugin-cache install with a newer release hands off to the detached plugin-update chain → `{ …, applied: true, mode: "plugin" }`. Nothing to apply is `409 UPDATE_NOT_APPLICABLE` (`reason`: `up_to_date`, `plugin_managed`, `not_fast_forwardable`). `500 UPDATE_STATUS_FAILED` / `UPDATE_CHECK_FAILED` / `UPDATE_APPLY_FAILED`.
+
+### Import history
+
+```http
+GET  /api/import/guide
+POST /api/import/rescan
+POST /api/import/scan-path
+POST /api/import/upload
+```
+
+Bring Claude Code history in (Settings → Import). `guide` → `{ platform, default_projects_dir, default_projects_dir_display, default_projects_dir_exists, default_projects_dir_stats: { projects, jsonl_files }, archive_command, supported_extensions, max_upload_bytes, max_upload_files, steps }`. `rescan` re-reads the default projects folder → `{ ok: true, source: "default", … }`. `scan-path` `{ path }` (absolute, `~` expanded, a directory) imports from it → `{ ok: true, source: "path", path, imported, skipped, backfilled, errors, sessions_seen, files_scanned }`; `400 INVALID_INPUT` / `PATH_NOT_FOUND` / `NOT_A_DIRECTORY`. `upload` takes multipart `files` (`.jsonl`, `.meta.json`, `.zip`, `.tar`, `.tar.gz`, `.tgz`, `.gz`; up to `AGENTHUB_IMPORT_MAX_FILES` = 2000 files and `AGENTHUB_IMPORT_MAX_BYTES` = 1 GB), extracts archives into a private temp dir and imports → `{ ok: true, source: "upload", files_received, rejected_files, entries_extracted, entries_skipped, …counts }`; `400 NO_FILES` / `NO_JSONL`, `413` when an archive passes the extraction limits. Imports are idempotent, and progress is broadcast as `import.progress`. Staff-only in server mode, admin-only to run; `500 IMPORT_FAILED`.
+
+
 ## WebSocket API
 
 ### Connection

docs/CLI.md

@@ -109,7 +109,7 @@ The CLI talks to the local dashboard server — **API-backed commands require it
 | `agenthub server tools` | One Linux user per account: publish this install's scripts and every installed AI tool under `/opt/agenthub` (`tools/bin/<command>`), where every account's pane runs them. The server also does this at start and after each install or update. Prints each tool's shared copy, or why it could not be shared |
 | `agenthub server off` / `agenthub server status` | Back to local mode (accounts kept) / show the mode and account count |
 | `agenthub accounts list\|add <name>\|remove <name>` | The **Claude account pool**: new Claude sessions spread over these accounts (each a `claude setup-token` token, typed hidden or read from stdin). `list` shows live panes, $ and tokens in the last 5 h / 7 d, and quota. With `--tool codex` the same for the **Codex account pool**: `add <name> --tool codex --api-key` (key typed hidden or on stdin) or `--from <dir>` (a `codex login` home or its `auth.json`). `pin <account> <user>` / `unpin <user>` (add `--tool codex` for Codex) switches one user's sessions to that account (a Claude login goes into their home at once, running sessions follow without a restart) (server mode; `list` shows a `pinned` column). See [SERVER-MODE.md](SERVER-MODE.md#claude-account-pool) |
-| `agenthub users list\|add <name> [--role admin\|analyst\|member]\|passwd <name>\|role <name> <role>\|disable <name>\|enable <name>\|provision <name>\|--all\|assign <workspace id> <name>\|audit [--limit N]` | Server mode's accounts, written straight to the database. Once `install-system` ran, `add` first creates the Linux user `ah-<name>`; a name must then be lower case: a letter, then up to 28 letters, digits, `_` or `-`. `disable`/`enable` lock or unlock that Linux user too, and `provision` gives users made earlier their Linux user (idempotent); `assign` gives a workspace made before server mode an owner; `audit` lists admin/analyst reads of members' sessions. Inside a dashboard pane in server mode, every command acts as the workspace's owner through the pane's `AGENTHUB_PANE_TOKEN`. A password is typed hidden twice, or read from the first line of stdin |
+| `agenthub users list\|add <name> [--role admin\|analyst\|developer]\|passwd <name>\|role <name> <role>\|disable <name>\|enable <name>\|provision <name>\|--all\|assign <workspace id> <name>\|audit [--limit N]` | Server mode's accounts, written straight to the database. Once `install-system` ran, `add` first creates the Linux user `ah-<name>`; a name must then be lower case: a letter, then up to 28 letters, digits, `_` or `-`. `disable`/`enable` lock or unlock that Linux user too, and `provision` gives users made earlier their Linux user (idempotent); `assign` gives a workspace made before server mode an owner; `audit` lists admin/analyst reads of developers' sessions. Inside a dashboard pane in server mode, every command acts as the workspace's owner through the pane's `AGENTHUB_PANE_TOKEN`. A password is typed hidden twice, or read from the first line of stdin |
 
 ### Interactive REPL
 
@@ -273,7 +273,7 @@ Omit `<id>` and the command addresses the workspace owning the current directory
 
 Resolution order, shared by every cwd-resolving command: `--workspace` (old name `--lane`)/leading id → `AGENTHUB_LANE_ID` (exported into every tmux pane the dashboard starts) → `--tool <id>`, else the harness's marker (`CLAUDECODE` means claude; Codex has no equivalent marker, so a codex session outside a dashboard pane passes `--tool codex`) → the workspace owning the directory. One directory can back a `claude` workspace and a `codex` workspace at once, so when two candidates remain the command fails and names both instead of picking one — see [Which workspace a CLI command addresses](LANES.md#which-workspace-a-cli-command-addresses).
 
-Because a workspace's services are fully detached, restarting the dashboard (or `agenthub update`) never stops a running stack.
+Because a workspace's services are fully detached, restarting the dashboard (or applying an update — `agenthub update-check` reports one, the dashboard's Update button applies it) never stops a running stack.
 
 ### Integrations
 

docs/DATABASE.md

@@ -619,13 +619,13 @@ Server mode's accounts ([SERVER-MODE.md](SERVER-MODE.md), `server/lib/auth.js`).
 
 | Table | Columns |
 | --- | --- |
-| `users` | `id`, `username` (unique, case-insensitive), `role` (`admin`\|`analyst`\|`member`), `password_hash` (`scrypt$<salt>$<hash>`), `disabled`, `created_at` |
+| `users` | `id`, `username` (unique, case-insensitive), `role` (`admin`\|`analyst`\|`developer` — `member` before, migrated on start), `password_hash` (`scrypt$<salt>$<hash>`), `disabled`, `created_at` |
 | `auth_sessions` | `token_hash` (SHA-256 of the cookie token, PK), `user_id` → `users.id` (cascade), `created_at`, `expires_at` (30 days) |
 | `account_pins` | `user_id` → `users.id` (cascade), `tool` (`claude`\|`codex`), `account` (a pool account's name), `pinned_at`; PK (`user_id`, `tool`) — an admin's pin of a user to one pool account (`server/lib/account-pins.js`) |
 
 `dashboard_runs.account` names the Claude pool account a run's pane was started on (`server/lib/claude-pool.js`; `NULL` = the machine's own login). The balancer sums each account's spend from the `token_usage_hourly` rows of those runs' sessions. The pool's tokens live in files under `<CLAUDE_HOME>/agenthub-accounts/`, never in the database.
 
-`lanes.owner_id` (server mode) is the user who created a workspace; `NULL` for one made in local mode or by the host account. A member sees only sessions of their own workspaces, and everything hanging off them (`server/lib/scope.js`). `audit_log` (`user_id`, `owner_id`, `session_id`, `method`, `path`, `at`) records each admin/analyst read of a session a member owns.
+`lanes.owner_id` (server mode) is the user who created a workspace; `NULL` for one made in local mode or by the host account. A member sees only sessions of their own workspaces, and everything hanging off them (`server/lib/scope.js`). `audit_log` (`user_id`, `owner_id`, `session_id`, `method`, `path`, `at`) records each admin/analyst read of a session a member owns, and each admin account change; rows older than `AGENTHUB_AUDIT_DAYS` (default 180) are pruned as new ones are written. `users.last_login_at` is the account's last login (kept past its `auth_sessions` row); `users.must_change_password` (0/1) is set when an admin gives the password (create, reset) and cleared when the account picks its own.
 
 `dashboard_runs.pane_token_hash` is the SHA-256 of the pane credential (`AGENTHUB_PANE_TOKEN`) a server-mode pane was started with; it is never returned by any route. `push_subscriptions.user_id` is the user whose browser a subscription is (`NULL` in local mode).
 

docs/LANES.md

@@ -636,6 +636,10 @@ reads the workspace's git surface in five modes:
   A workspace folder that is **not a git repo** still gets the tree and
   quick-open, read off the disk (no colours; `.git` hidden, `node_modules`
   listed but never entered, symlinks never followed, at most 20 000 entries).
+  A whole `.md` file opens rendered, with a **Raw**/**Preview** button for
+  that file; Settings → Appearance → **Open Markdown as** (`agenthub.markdown.view`,
+  `client/src/lib/markdownView.ts`, synced to the account) makes Raw the
+  default instead — here, in the config file viewer and in a chat's file panel.
   **Download** on a file's right-click menu, or in an open file's header,
   saves that file (`/git/download`, any type, up to 512 MB); the **Upload**
   button beside the finder uploads files to the workspace root and **Upload

docs/OVERVIEW.md

@@ -107,7 +107,7 @@ Internal build — all rights reserved.
   Prometheus rules + Grafana boards for `/api/metrics`
   (`docker-compose.monitoring.yml`, [docs/MONITORING.md](MONITORING.md)).
 - **Server mode for a shared dashboard** (`agenthub server setup`): a login on
-  every page and API call, with admin / member / analyst roles. It is off by
+  every page and API call, with admin / developer / analyst roles. It is off by
   default, and a local install does not change. It is login only, without
   per-user isolation yet ([docs/SERVER-MODE.md](SERVER-MODE.md)).
 

docs/README.md

@@ -43,7 +43,7 @@ graph TB
 |----------|-------------|----------|
 | [client/README.md](../client/README.md) | React frontend architecture, components, state management | Frontend developers |
 | [server/README.md](../server/README.md) | Express backend, database, WebSocket, API | Backend developers |
-| [API.md](./API.md) | REST API endpoints (sessions, agents, events, stats, analytics, hooks, pricing, workflows, settings, import history, **cc-config**, **run**), WebSocket protocol (including `run_stream` / `run_status` / `run_input_ack` for the Run page) | Integration developers |
+| [API.md](./API.md) | REST API endpoints (sessions, agents, events, stats, analytics, hooks, pricing, workflows, settings, import history, **cc-config**, **run**), WebSocket protocol (JSON broadcast messages, plus the binary `/ws-pty/:runId` terminal stream of a lane pane) | Integration developers |
 | [SERVER-MODE.md](./SERVER-MODE.md) | Server mode: logins and roles for a dashboard shared over the web (`agenthub server setup`), reverse proxy setup | Operators |
 | [DATABASE.md](./DATABASE.md) | SQLite schema, queries, performance | Database administrators |
 | [HOOKS.md](./HOOKS.md) | Claude Code hook system integration | Hook developers |

docs/SERVER-MODE.md

@@ -155,6 +155,10 @@ Workspaces made before server mode, or by the host account, have none.
 - An **admin** or **analyst** sees everything. Each time one of them opens a
   session a developer owns (its page, transcript, events or cost), the read is
   written to the audit log: `agenthub users audit`, or `GET /api/users/audit`.
+  Entries are kept `AGENTHUB_AUDIT_DAYS` days (default 180; `0` keeps them
+  all) — older ones are deleted as new ones are written, at most once an hour.
+  An account's last login is kept in `users.last_login_at`, so it still shows
+  after the login itself has ended.
 - `GET /api/users` (admin/analyst) lists every account with its workspaces,
   sessions, and the tokens and $ it used in the last 7 and 30 days — the
   **Administration** page in the sidebar (`/admin`; the old `/users` link
@@ -264,7 +268,22 @@ settings file that lacks the variable falls back to `USERS_ROOT` in
 - A login lasts 30 days in the httpOnly, `SameSite=Strict` cookie
   `agenthub_sid`. Only the token's SHA-256 is stored. Logging out, a password
   change and disabling the user each end it.
-- Passwords are stored as scrypt hashes; any non-empty password is accepted (no minimum length).
+- Passwords are stored as scrypt hashes. Two bars:
+  - A password an admin **gives** someone — **Add user**, a reset on the Edit
+    form, `agenthub users add` — may be anything non-empty (`123` included).
+    The account is then flagged `must_change_password`: after signing in it
+    sees only a "Choose your own password" page, the server answers every
+    other request with `403 EPWCHANGE` (only `/auth/*`, the `/me` reads and
+    `POST /api/me/password` pass) and no WebSocket opens. A pane token is not
+    held back — agents started before a reset keep running.
+  - A password an account **picks for itself** (that page, Settings → Account,
+    an admin's own on the Edit form) must pass every rule: at least 8
+    characters, a lower-case and an upper-case letter, a digit, a symbol, not
+    containing the username, and not the current password (`400
+    EWEAKPASSWORD`, with the failed `rules`). The form ticks each rule as it is
+    typed (`client/src/lib/passwordRules.ts` mirrors `passwordProblems` in
+    `server/lib/auth.js`). `agenthub users passwd` and the first admin of
+    `agenthub server setup` set no flag.
   Every login attempt counts before its password is checked, so attempts sent
   in parallel count too. After 10 failed logins from one address, or 30 for one
   username, in 15 minutes, further logins answer `429 ETOOMANY` until the
@@ -307,7 +326,10 @@ everywhere". Every field is checked before any is written, so a bad email or
 a workspace the user does not own changes nothing. Every change asks for the admin's OWN
 password again — the server refuses without it (`EREAUTH`, and `ETOOMANY`
 after 10 wrong tries in 15 minutes) — an admin can never demote or disable
-themselves (`ESELF`), and each change is written to the audit log. In local
+themselves (`ESELF`), no path (the CLI included) may demote, disable or
+delete the last enabled admin (`ELASTADMIN`), and each change is written to
+the audit log. A row says **New password due** while the account still has a
+password an admin gave. In local
 mode these routes refuse (`ELOCALMODE`): there is no login to check.
 
 Wherever the dashboard names a person — the sidebar's sign-out tooltip, the
@@ -323,7 +345,10 @@ remembered, so the default is always the admin's own account.
 
 Every signed-in user has **Settings → Account**: their username, role, member
 since, workspace and session counts and active logins; their own picture
-(PNG, JPEG, GIF or WebP up to 1 MB, kept in `<data dir>/avatars/`; shown with
+(PNG, JPEG, GIF or WebP up to 1 MB, kept in `<data dir>/avatars/`, or an
+https link to one, which the browser loads itself — never downloaded, so a
+link behind a login (a Mattermost `/api/v4/users/<id>/image`) cannot show and
+is refused when saved; shown with
 their name and role at the foot of the sidebar, which opens this page); their
 own display name and email; **Change password** (the current password is required, the login
 it is changed from stays and every other one ends); and **Sign out other
@@ -335,10 +360,10 @@ The same from the host's shell:
 
 ```bash
 agenthub users list
-agenthub users add <name> [--role admin|analyst|developer]
+agenthub users add <name> [--role admin|analyst|developer]   # they choose their own password at first login
 agenthub users passwd <name>        # ends that user's logins
-agenthub users role <name> <role>
-agenthub users disable <name>       # ends that user's logins; users are never deleted
+agenthub users role <name> <role>   # never the last enabled admin (ELASTADMIN)
+agenthub users disable <name>       # ends that user's logins; never the last enabled admin
 agenthub users enable <name>
 agenthub users assign <workspace id> <name>   # give a pre-server-mode workspace an owner
 agenthub users audit [--limit N]    # who read which developer's session
@@ -366,7 +391,7 @@ In server mode an admin can do the same on the **Users** page, in the
 **Account pool** card: **Add account** and the bin icon to remove one. A Claude
 account comes from one of three sources:
 
-- **A saved login**: a profile from Settings → Claude config → Switch account
+- **A saved login**: a profile from Settings → AI tools → Profiles
   (log in with `claude auth login`, then save it). It is MOVED into the pool, so
   the profile leaves the switcher. The account this server's own Claude Code is
   logged into can be moved in too. It moves with the login the CLI holds right
@@ -379,8 +404,11 @@ account comes from one of three sources:
   using that login where you copied it from.
 - **A `claude setup-token` token** (`sk-ant-…`), as with `agenthub accounts add`.
 
-A Codex account is an OpenAI API key, or the whole `~/.codex/auth.json` after
-`codex login`.
+A Codex account is an OpenAI API key, the whole `~/.codex/auth.json` after
+`codex login`, or a saved Codex profile from Settings → AI tools → Profiles
+(moved in like a Claude one). Each Claude/Codex profile there has a **Move to
+pool** link that opens this dialog on it, and the card links back with
+**Profiles in Settings**.
 
 A **login** (the first two sources) works like a Codex ChatGPT login. Claude
 Code reads it from no env var, so before a member's pane starts, AgentHub writes
@@ -507,6 +535,52 @@ agenthub accounts pin team-key mia --tool codex   # pins work as for Claude
 > **Ceiling:** a pane can read its own account's key (`$AGENTHUB_POOL_KEY`) or
 > `auth.json`, like the Claude pool's token.
 
+## Oh My Pi login sharing
+
+With one Linux user per account, a member's omp has its own `~/.omp` and no
+login. An admin can let every member's omp run on the HOST account's omp
+logins instead: **Settings → AI tools → Oh My Pi login sharing** (off by
+default; `PUT /api/ai-tools/omp-sharing`, audited). It uses omp's own auth
+broker and gateway (`server/lib/omp-share.js`):
+
+```bash
+# as the host account: the logins to share (omp's built-in providers only)
+omp login            # e.g. anthropic
+```
+
+- While it is on, the dashboard runs, as the host and on loopback only,
+  `omp auth-broker serve --bind=127.0.0.1:4826` over the host's `~/.omp` store
+  and `omp auth-gateway serve --bind=127.0.0.1:4827 --clients=<data dir>/omp-share/clients.json`
+  (ports: `AGENTHUB_OMP_BROKER_PORT`, `AGENTHUB_OMP_GATEWAY_PORT`; logs in
+  `<data dir>/omp-share/`). Both tokens stay in the host's 0700 home; the
+  broker's reaches only the gateway's env. A crashed daemon restarts with a
+  back-off; the server stops both on shutdown, and kills ones a previous
+  server left (by pid file and argv) before starting its own.
+- A member's omp pane gets one provider `agenthub` in its
+  `~/.omp/agent/models.yml` (written as the member; the rest of the file is
+  kept, a file that is not a YAML mapping is left alone), pointing at the
+  gateway with `apiKey: AGENTHUB_OMP_KEY` — the NAME of the env var holding
+  the pane's key — and `OMP_SKIP_SETUP=1`. It runs on `--model agenthub/<model>`:
+  the model picked in AgentHub, else the host's own `modelRoles.default`
+  (`~/.omp/agent/config.yml`) — left to itself omp would take the provider's
+  first listed model, a retired one the API answers 404 for.
+- The gateway re-reads its clients file only every 10 s, and an omp that
+  starts while its key is still refused hangs for good. So AgentHub keeps four
+  keys QUEUED in the clients file (hashes only; the keys themselves in
+  `<data dir>/omp-share/tokens.json`, 0600): a new pane takes one that is
+  already listed, and a fresh key joins the queue. A pane's key leaves the
+  file at the first sync (every 15 s) after its pane is gone, and turning
+  sharing off empties both files at once.
+- A scoped client token calls models only: it cannot read a credential, the
+  gateway's usage or credential health, and refresh tokens never leave the
+  broker. Host panes use the host's login directly and get nothing new.
+- A custom provider in the host's own `models.yml` (a 9Router, say) is not
+  shared — the gateway serves omp's built-in providers.
+
+> **Ceiling:** an agent can SPEND through the shared logins while its pane
+> runs; it cannot carry a login away. A member who edits the `agenthub`
+> provider out of their `models.yml` gets it back at their next omp pane.
+
 ## One Linux user per account
 
 Every pane of a user, an agent's shell included, runs as that user's own Linux

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "agenthub",
-  "version": "2.8.14",
+  "version": "2.8.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agenthub",
-      "version": "2.8.14",
+      "version": "2.8.19",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenthub",
-  "version": "2.8.14",
+  "version": "2.8.19",
   "bin": {
     "agenthub": "bin/agenthub.js"
   },

server/__tests__/api.test.js

@@ -94,7 +94,6 @@ const EXPECTED_API_PATHS = [
   "/api/run/files",
   "/api/run/binary",
   "/api/run/{id}",
-  "/api/run/{id}/message",
   "/api/webhooks",
   "/api/webhooks/providers",
   "/api/webhooks/{id}",

server/__tests__/artifacts.test.js

@@ -119,6 +119,34 @@ describe("pages", () => {
     assert.equal(artifacts.captureFromHook("s1", { tool_input: { action: "read" } }), null);
     assert.equal(artifacts.captureFromHook("s1", { tool_response: "no link" }), null);
   });
+
+  it("gives a page from a session no workspace owns to the member who sent the hook", () => {
+    const uid = db
+      .prepare("INSERT INTO users (username, password_hash) VALUES ('ann', 'x')")
+      .run().lastInsertRowid;
+    const hook = (url) => ({
+      tool_input: { action: "publish" },
+      tool_response: `Published: ${url}`,
+    });
+    const own = artifacts.captureFromHook("loose-1", hook("https://claude.ai/artifact/m1"), {
+      kind: "member",
+      name: "ann",
+    });
+    assert.equal(own.owner_id, Number(uid));
+    assert.equal(own.lane_id, null);
+    // The host account names nobody; a workspace's owner still wins over the peer.
+    const host = artifacts.captureFromHook("loose-2", hook("https://claude.ai/artifact/m2"), {
+      kind: "host",
+    });
+    assert.equal(host.owner_id, null);
+    const ws = artifacts.captureFromHook("s1", hook("https://claude.ai/artifact/m3"), {
+      kind: "member",
+      name: "ann",
+    });
+    const laneOwner = db.prepare("SELECT owner_id FROM lanes WHERE id = ?").get(lane.id).owner_id;
+    assert.equal(ws.owner_id, laneOwner);
+    assert.equal(ws.lane_id, lane.id);
+  });
 });
 
 describe("files", () => {
@@ -145,6 +173,12 @@ describe("files", () => {
     assert.match(raw.text, /<h1>hi<\/h1>/);
     assert.match(raw.headers.get("content-security-policy"), /sandbox/);
     assert.equal(raw.headers.get("x-content-type-options"), "nosniff");
+    // Deleting the source on disk takes nothing away: only a delete in AgentHub does.
+    const live = path.join(ws, "out", "report.html");
+    fs.rmSync(live);
+    assert.equal((await request("GET", `/api/artifacts/${id}`)).status, 200);
+    assert.match((await request("GET", `/api/artifacts/${id}/raw`)).text, /<h1>hi<\/h1>/);
+    fs.writeFileSync(live, "changed");
     const other = await request("GET", `/api/artifacts/${id}/raw?path=../../t.db`);
     assert.equal(other.status, 404);
 
@@ -160,6 +194,32 @@ describe("files", () => {
   });
 });
 
+describe("my library", () => {
+  it("adds the shared skills of others the caller installed, and only those", () => {
+    const ins = db.prepare(
+      "INSERT INTO artifacts (kind, title, owner_id, source, shared) VALUES ('skill', ?, ?, ?, ?)"
+    );
+    const theirs = Number(ins.run("theirs", 77, "lib-theirs", 1).lastInsertRowid);
+    const notInstalled = Number(ins.run("other", 77, "lib-other", 1).lastInsertRowid);
+    const unshared = Number(ins.run("private", 77, "lib-private", 0).lastInsertRowid);
+    const own = Number(ins.run("own", 5, "lib-own", 0).lastInsertRowid);
+    for (const name of ["lib-theirs", "lib-private"])
+      fs.mkdirSync(path.join(process.env.CLAUDE_HOME, "skills", name), { recursive: true });
+    const req = { user: { id: 5, role: "admin" } };
+    const ids = artifacts.list(req, { scope: "mine", kind: "skill" }).map((a) => [a.id, a.mine]);
+    assert.deepEqual(
+      ids.filter(([id]) => [theirs, notInstalled, unshared, own].includes(id)).sort(),
+      [
+        [theirs, false],
+        [own, true],
+      ].sort()
+    );
+    db.prepare(
+      `DELETE FROM artifacts WHERE id IN (${[theirs, notInstalled, unshared, own].join(",")})`
+    ).run();
+  });
+});
+
 describe("skills", () => {
   it("snapshots a workspace skill and installs it into ~/.claude/skills and ~/.agents/skills", async () => {
     const list = await request("GET", `/api/artifacts/skills?laneId=${lane.id}`);

server/__tests__/cc-config.test.js

@@ -1215,4 +1215,15 @@ describe("/api/cc-config", () => {
     assert.equal(status, 400);
     assert.equal(body.error.code, "EBADARG");
   });
+
+  it("refuses a write from a foreign origin before it reaches the CLI", async () => {
+    for (const p of ["/api/cc-config/mcp/add", "/api/cc-config/plugins/install"]) {
+      const { status } = await fetchJson(p, {
+        method: "POST",
+        body: { name: "x", command: "true", plugin: "x@y" },
+        headers: { Origin: "https://evil.example" },
+      });
+      assert.equal(status, 403, p);
+    }
+  });
 });

server/__tests__/claude-pool-login.test.js

@@ -338,6 +338,42 @@ describe("moving a saved profile in from the Users page", () => {
     pool.removeAccount("work");
   });
 
+  it("moves a saved Codex profile in, and lists Codex profiles without a token", async () => {
+    const dir = path.join(TMP, ".claude", "agenthub-profiles", "codex");
+    fs.mkdirSync(dir, { recursive: true });
+    const idToken = `x.${Buffer.from(JSON.stringify({ email: "cx@example.com" })).toString("base64url")}.s`;
+    fs.writeFileSync(
+      path.join(dir, "cx.json"),
+      JSON.stringify({
+        name: "cx",
+        label: "Codex work",
+        secret: {
+          tokens: {
+            id_token: idToken,
+            access_token: "at-cx",
+            refresh_token: "rt-cx",
+            account_id: "a-cx",
+          },
+        },
+      })
+    );
+    const list = await call("GET", "/api/accounts/profiles?tool=codex");
+    assert.deepEqual(
+      list.body.profiles.map((p) => [p.name, p.label, p.email]),
+      [["cx", "Codex work", "cx@example.com"]]
+    );
+    assert.ok(!JSON.stringify(list.body).includes("rt-cx"));
+    const moved = await call("POST", "/api/accounts", {
+      tool: "codex",
+      profile: "cx",
+      currentPassword: "admin-pass-1",
+    });
+    assert.equal(moved.status, 201);
+    assert.equal(moved.body.account.kind, "chatgpt");
+    assert.equal(fs.existsSync(path.join(dir, "cx.json")), false, "the pool is its one holder");
+    require("../lib/codex-pool").removeAccount("cx");
+  });
+
   it("takes a pasted .credentials.json once Anthropic names its account", async () => {
     const pasted = oauth("p");
     owners[pasted.accessToken] = { uuid: "uuid-pasted", email: "p@example.com" };

server/__tests__/me-avatar.test.js

@@ -6,7 +6,10 @@
  * served with `nosniff` and a `sandbox` CSP; `avatarAt` reaches `/api/auth/me`;
  * another account never sees it through `/api/me`; staff read it at
  * `/api/users/:id/avatar` (a developer is refused) and a workspace carries
- * `owner_avatar_at` for the sidebar's owner groups.
+ * `owner_avatar_at` for the sidebar's owner groups. A picture from a link
+ * (`POST /api/me/avatar/url`, server/lib/avatar-url.js) is stored, never
+ * downloaded, and the avatar routes redirect to it; https only, never a
+ * loopback/private IP literal.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -108,6 +111,91 @@ it("refuses an SVG, an empty body, a too-large image and no login", async () =>
   assert.equal((await put("", PNG)).status, 401);
 });
 
+it("a picture from a link is stored and redirected to, never downloaded", async () => {
+  const ava = await login("ava", "ava-pass-1");
+  const ann = await login("ann", "ann-pass-1");
+  const link =
+    "https://chat.runsystem.vn/api/v4/users/7bya4wy58bdk3qmb5ks1rgoqkh/image?_=1776312011651";
+  assert.equal((await put(ava, PNG)).status, 200);
+  const set = await fetch(BASE + "/api/me/avatar/url", {
+    method: "POST",
+    headers: { cookie: ava, "Content-Type": "application/json" },
+    body: JSON.stringify({ url: ` ${link} ` }),
+  });
+  assert.equal(set.status, 200);
+  assert.ok((await set.json()).user.avatarAt);
+  // The uploaded file is gone: a link replaces it.
+  assert.equal(fs.readdirSync(path.join(TMP, "avatars")).length, 0);
+
+  const got = await fetch(BASE + "/api/me/avatar", {
+    headers: { cookie: ava },
+    redirect: "manual",
+  });
+  assert.equal(got.status, 302);
+  assert.equal(got.headers.get("location"), link);
+  assert.equal(got.headers.get("referrer-policy"), "no-referrer");
+  const id = auth.findUser("ava").id;
+  const staff = await fetch(`${BASE}/api/users/${id}/avatar`, {
+    headers: { cookie: ann },
+    redirect: "manual",
+  });
+  assert.equal(staff.status, 302);
+  assert.equal(staff.headers.get("location"), link);
+
+  // An upload replaces the link.
+  assert.equal((await put(ava, PNG)).status, 200);
+  assert.equal(
+    (await fetch(BASE + "/api/me/avatar", { headers: { cookie: ava }, redirect: "manual" })).status,
+    200
+  );
+  await fetch(BASE + "/api/me/avatar", { method: "DELETE", headers: { cookie: ava } });
+});
+
+it("a picture from a link: https only, never a private or local address", async () => {
+  const ava = await login("ava", "ava-pass-1");
+  const post = (url) =>
+    fetch(BASE + "/api/me/avatar/url", {
+      method: "POST",
+      headers: { cookie: ava, "Content-Type": "application/json" },
+      body: JSON.stringify({ url }),
+    });
+  for (const [url, code] of [
+    ["not a url", "EBADURL"],
+    ["http://example.com/a.png", "EBADURL"],
+    ["https://user:pw@example.com/a.png", "EBADURL"],
+    ["https://127.0.0.1/a.png", "EPRIVATEURL"],
+    ["https://[::1]/a.png", "EPRIVATEURL"],
+    ["https://localhost/a.png", "EPRIVATEURL"],
+    ["https://169.254.169.254/latest", "EPRIVATEURL"],
+  ]) {
+    const res = await post(url);
+    assert.equal(res.status, 400, url);
+    assert.equal((await res.json()).error.code, code, url);
+  }
+  assert.equal((await post("")).status, 400);
+
+  const { isPublicAddress } = require("../lib/avatar-url");
+  for (const a of [
+    "10.1.2.3",
+    "172.20.0.1",
+    "192.168.1.1",
+    "100.64.0.1",
+    "0.0.0.0",
+    "::",
+    "fe80::1",
+    "fd00::1",
+    "::ffff:127.0.0.1",
+    "::ffff:7f00:1",
+    "2002:7f00::1",
+    "ff02::1",
+  ]) {
+    assert.equal(isPublicAddress(a), false, a);
+  }
+  for (const a of ["8.8.8.8", "1.1.1.1", "2606:4700:4700::1111", "::ffff:8.8.8.8"]) {
+    assert.equal(isPublicAddress(a), true, a);
+  }
+});
+
 it("staff read another account's avatar; workspaces carry owner_avatar_at", async () => {
   const ava = await login("ava", "ava-pass-1");
   const ann = await login("ann", "ann-pass-1");

server/__tests__/omp-share.test.js

@@ -0,0 +1,225 @@
+/**
+ * @file omp-share.test.js
+ * @description Oh My Pi login sharing (server/lib/omp-share.js): a member's
+ * `models.yml` gets one `agenthub` provider pointing at the loopback gateway
+ * with the key's env var NAME as its key (the rest of the file kept, a
+ * non-mapping refused); a pane takes a key the clients file listed BEFORE it
+ * started (the gateway re-reads it only every 10 s), and a gone pane's key
+ * leaves it; a spawn is untouched while sharing is off, for a host pane, or
+ * without S3; and the route refuses outside S3. No omp daemon is started.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after, afterEach } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("node:path");
+const fs = require("node:fs");
+const os = require("node:os");
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "omp-share-"));
+process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
+process.env.DASHBOARD_LIVENESS_PROBE = "0";
+process.env.LANES_ROOT = path.join(TMP, "lanes");
+process.env.CLAUDE_HOME = path.join(TMP, ".claude");
+process.env.DASHBOARD_DATA_DIR = path.join(TMP, "data");
+process.env.AGENTHUB_OMP_GATEWAY_PORT = "4999";
+
+const crypto = require("node:crypto");
+const yaml = require("js-yaml");
+
+const sha = (t) => crypto.createHash("sha256").update(t).digest("hex");
+const { createApp, startServer } = require("../index");
+const share = require("../lib/omp-share");
+const linux = require("../lib/linux-accounts");
+const runAs = require("../lib/run-as");
+const tmux = require("../lib/tmux");
+
+const realS3 = linux.s3Enabled;
+const realLive = tmux.liveSessions;
+const flag = path.join(TMP, "data", "omp-share", "enabled");
+const clientsFile = path.join(TMP, "data", "omp-share", "clients.json");
+
+function turnOn() {
+  fs.mkdirSync(path.dirname(flag), { recursive: true });
+  fs.writeFileSync(flag, "");
+  linux.s3Enabled = () => true;
+}
+
+afterEach(() => {
+  linux.s3Enabled = realS3;
+  tmux.liveSessions = realLive;
+  fs.rmSync(flag, { force: true });
+});
+
+after(() => fs.rmSync(TMP, { recursive: true, force: true }));
+
+describe("mergedModels", () => {
+  it("adds the provider to an empty or missing file", () => {
+    const doc = yaml.load(share.mergedModels(""));
+    assert.deepEqual(doc, {
+      providers: {
+        agenthub: {
+          baseUrl: "http://127.0.0.1:4999",
+          apiKey: "AGENTHUB_OMP_KEY",
+          api: "anthropic-messages",
+          authHeader: true,
+          discovery: { type: "proxy" },
+        },
+      },
+    });
+  });
+
+  it("keeps the member's own providers and settings", () => {
+    const text =
+      "equivalence:\n  x: y\nproviders:\n  mine:\n    baseUrl: http://h/v1\n    apiKey: K\n";
+    const doc = yaml.load(share.mergedModels(text));
+    assert.equal(doc.providers.mine.baseUrl, "http://h/v1");
+    assert.deepEqual(doc.equivalence, { x: "y" });
+    assert.equal(doc.providers.agenthub.apiKey, "AGENTHUB_OMP_KEY");
+  });
+
+  it("writes nothing when the provider is already there as is", () => {
+    const once = share.mergedModels("");
+    assert.equal(share.mergedModels(once), null);
+  });
+
+  it("replaces a stale provider of ours", () => {
+    const stale = "providers:\n  agenthub:\n    baseUrl: http://127.0.0.1:1\n";
+    assert.equal(
+      yaml.load(share.mergedModels(stale)).providers.agenthub.baseUrl,
+      "http://127.0.0.1:4999"
+    );
+  });
+
+  it("refuses a file that is not a mapping", () => {
+    assert.throws(() => share.mergedModels("- a\n- b\n"), /mapping/);
+    assert.throws(() => share.mergedModels("providers: [1]\n"), /mapping/);
+  });
+});
+
+describe("shareModel", () => {
+  const host = "anthropic/claude-sonnet-5-5";
+  it("runs on the host's default when none was asked for", () => {
+    assert.equal(share.shareModel(null, host), "agenthub/anthropic/claude-sonnet-5-5");
+  });
+  it("maps a requested model onto the gateway's provider", () => {
+    assert.equal(share.shareModel("claude-opus-5-5", host), "agenthub/anthropic/claude-opus-5-5");
+    assert.equal(share.shareModel("openai-codex/gpt-5.5", host), "agenthub/openai-codex/gpt-5.5");
+    assert.equal(share.shareModel("agenthub/anthropic/x", host), "agenthub/anthropic/x");
+  });
+  it("leaves the choice to omp when there is nothing to go on", () => {
+    assert.equal(share.shareModel(null, null), null);
+  });
+});
+
+describe("forSpawn", () => {
+  const member = { login: "ah-mia", home: path.join(TMP, "home-mia") };
+
+  it("is null while sharing is off, for a host pane, or without S3", () => {
+    assert.equal(share.forSpawn(member, "agenthub-lane-1"), null); // off
+    fs.mkdirSync(path.dirname(flag), { recursive: true });
+    fs.writeFileSync(flag, "");
+    assert.equal(share.forSpawn(member, "agenthub-lane-1"), null); // no S3
+    linux.s3Enabled = () => true;
+    assert.equal(share.forSpawn(null, "agenthub-lane-1"), null); // the host's
+  });
+
+  it("hands out a key the gateway already listed, and writes models.yml AS the member", () => {
+    turnOn();
+    share.syncClients(); // the queue, listed before any pane asks
+    const listedBefore = JSON.parse(fs.readFileSync(clientsFile, "utf8"));
+    const writes = [];
+    const real = { read: runAs.readFileSafe, mkdir: runAs.mkdirAs, write: runAs.writeAs };
+    runAs.readFileSafe = () => {
+      const e = new Error("missing");
+      e.code = "ENOENT";
+      throw e;
+    };
+    runAs.mkdirAs = (acct, dir) => writes.push(["mkdir", acct.login, dir]);
+    runAs.writeAs = (acct, file, mode, content) => writes.push([mode, acct.login, file, content]);
+    tmux.liveSessions = () => new Set();
+    try {
+      const s = share.forSpawn(member, "agenthub-lane-7");
+      const key = s.env.AGENTHUB_OMP_KEY;
+      assert.match(key, /^ahomp_/);
+      assert.equal(s.env.OMP_SKIP_SETUP, "1");
+      const hash = sha(key);
+      assert.ok(
+        Object.values(listedBefore).some((c) => c.tokenSha256 === hash),
+        "the key was listed before the pane started"
+      );
+      const after = JSON.parse(fs.readFileSync(clientsFile, "utf8"));
+      assert.deepEqual(after["agenthub-lane-7"], { tokenSha256: hash });
+      // its place in the queue is filled again, and no plaintext reaches the clients file
+      assert.equal(Object.keys(after).filter((k) => k.startsWith("standby-")).length, 4);
+      assert.ok(!fs.readFileSync(clientsFile, "utf8").includes("ahomp_"));
+      assert.equal((fs.statSync(clientsFile).mode & 0o777).toString(8), "600");
+      s.place();
+      const agentDir = path.join(member.home, ".omp", "agent");
+      assert.deepEqual(writes[0], ["mkdir", "ah-mia", agentDir]);
+      assert.equal(writes[1][0], "replace");
+      assert.equal(writes[1][2], path.join(agentDir, "models.yml"));
+      assert.equal(yaml.load(writes[1][3]).providers.agenthub.apiKey, "AGENTHUB_OMP_KEY");
+    } finally {
+      runAs.readFileSafe = real.read;
+      runAs.mkdirAs = real.mkdir;
+      runAs.writeAs = real.write;
+    }
+  });
+});
+
+describe("pruneTokens", () => {
+  const now = 1_000_000;
+  const tokens = () => ({
+    standby: [],
+    used: {
+      "agenthub-lane-21": { hash: "b", at: now - 120_000 }, // live
+      "agenthub-lane-22": { hash: "c", at: now - 120_000 }, // pane gone
+      "agenthub-lane-23": { hash: "d", at: now - 5_000 }, // just started
+    },
+  });
+
+  it("drops only a gone pane's key past the grace, and keeps the queue full", () => {
+    const t = share.pruneTokens(tokens(), new Set(["agenthub-lane-21"]), now);
+    assert.deepEqual(Object.keys(t.used).sort(), ["agenthub-lane-21", "agenthub-lane-23"]);
+    assert.equal(t.standby.length, 4);
+  });
+
+  it("drops nothing when tmux could not be asked", () => {
+    const t = share.pruneTokens(tokens(), null, now);
+    assert.equal(Object.keys(t.used).length, 3);
+  });
+});
+
+describe("/api/ai-tools/omp-sharing", () => {
+  let server;
+  let BASE;
+  before(async () => {
+    server = await startServer(createApp(), 0);
+    BASE = `http://127.0.0.1:${server.address().port}`;
+  });
+  after(() => server.close());
+
+  it("reports it unavailable and refuses the switch outside S3", async () => {
+    const got = await (await fetch(`${BASE}/api/ai-tools/omp-sharing`)).json();
+    assert.equal(got.available, false);
+    assert.equal(got.enabled, false);
+    const put = await fetch(`${BASE}/api/ai-tools/omp-sharing`, {
+      method: "PUT",
+      headers: { "content-type": "application/json", origin: BASE },
+      body: JSON.stringify({ enabled: true }),
+    });
+    assert.equal(put.status, 409);
+    assert.equal((await put.json()).error.code, "ENOS3");
+    assert.equal(fs.existsSync(flag), false);
+  });
+
+  it("wants a boolean", async () => {
+    const put = await fetch(`${BASE}/api/ai-tools/omp-sharing`, {
+      method: "PUT",
+      headers: { "content-type": "application/json", origin: BASE },
+      body: JSON.stringify({ enabled: "yes" }),
+    });
+    assert.equal(put.status, 400);
+  });
+});

server/__tests__/pty-run.test.js

@@ -815,6 +815,8 @@ describe("pty-run", () => {
       );
       assert.deepEqual(paneArgv(call), [
         at("omp"),
+        // A workspace at the account's home stays there (omp moves to a temp dir otherwise).
+        "--allow-home",
         "--model",
         "opus",
         "--resume",
@@ -823,7 +825,12 @@ describe("pty-run", () => {
       ]);
       assert.throws(
         () =>
-          pty.spawnRun({ laneId: 18, cwd: "/tmp/repo", tool: "omp", resumeSessionId: "--abcdefgh" }),
+          pty.spawnRun({
+            laneId: 18,
+            cwd: "/tmp/repo",
+            tool: "omp",
+            resumeSessionId: "--abcdefgh",
+          }),
         { code: "EBADSESSION" }
       );
     });

server/__tests__/server-mode-password-change.test.js

@@ -0,0 +1,181 @@
+/**
+ * @file server-mode-password-change.test.js
+ * @description A password an admin GIVES (Users page create or reset) may be
+ * anything non-empty, and the account must then pick its own before anything
+ * else: its login reaches only the `/me` reads and `POST /api/me/password`
+ * (EPWCHANGE), opens no WebSocket, and its own password must pass every rule
+ * (EWEAKPASSWORD with the failed `rules`, never the current one). Also: the
+ * last login survives a logout (`users.last_login_at`), the last enabled
+ * admin can never be demoted or disabled (ELASTADMIN, the CLI's path
+ * included) and old audit entries are pruned (`AGENTHUB_AUDIT_DAYS`).
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("node:path");
+const fs = require("node:fs");
+const os = require("node:os");
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "server-mode-password-change-"));
+process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
+process.env.DASHBOARD_LIVENESS_PROBE = "0";
+
+const { createApp, startServer } = require("../index");
+const { db } = require("../db");
+const auth = require("../lib/auth");
+
+let server;
+let BASE;
+const BOSS_PASS = "Admin-pass-2026";
+
+async function call(method, p, { cookie, body } = {}) {
+  const res = await fetch(BASE + p, {
+    method,
+    headers: { "Content-Type": "application/json", ...(cookie ? { cookie } : {}) },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  return { status: res.status, body: await res.json().catch(() => null) };
+}
+
+async function login(username, password) {
+  const res = await fetch(BASE + "/api/auth/login", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ username, password }),
+  });
+  if (res.status !== 200) return null;
+  return { cookie: res.headers.get("set-cookie").split(";")[0], user: (await res.json()).user };
+}
+
+before(async () => {
+  process.env.AGENTHUB_MODE = "server";
+  server = await startServer(createApp(), 0);
+  BASE = `http://127.0.0.1:${server.address().port}`;
+  await auth.createUser("boss", BOSS_PASS, "admin");
+});
+
+after(() => {
+  delete process.env.AGENTHUB_MODE;
+  delete process.env.AGENTHUB_AUDIT_DAYS;
+  server?.close();
+  fs.rmSync(TMP, { recursive: true, force: true });
+});
+
+describe("a password an admin gave", () => {
+  it("is accepted weak, then the user must pick a strong one of their own", async () => {
+    const boss = (await login("boss", BOSS_PASS)).cookie;
+    const made = await call("POST", "/api/users", {
+      cookie: boss,
+      body: { username: "neo", password: "123", currentPassword: BOSS_PASS },
+    });
+    assert.equal(made.status, 201);
+    assert.equal(made.body.user.mustChangePassword, true);
+
+    const neo = await login("neo", "123");
+    assert.equal(neo.user.mustChangePassword, true);
+    // Only its own account and the password change, until it has one.
+    assert.equal(
+      (await call("GET", "/api/lanes", { cookie: neo.cookie })).body.error.code,
+      "EPWCHANGE"
+    );
+    const patch = await call("PATCH", "/api/me/account", {
+      cookie: neo.cookie,
+      body: { displayName: "Neo" },
+    });
+    assert.equal(patch.body.error.code, "EPWCHANGE");
+    assert.equal((await call("GET", "/api/me/account", { cookie: neo.cookie })).status, 200);
+    const me = await call("GET", "/api/auth/me", { cookie: neo.cookie });
+    assert.equal(me.body.user.mustChangePassword, true);
+
+    const weak = await call("POST", "/api/me/password", {
+      cookie: neo.cookie,
+      body: { currentPassword: "123", newPassword: "neo12345" },
+    });
+    assert.equal(weak.status, 400);
+    assert.equal(weak.body.error.code, "EWEAKPASSWORD");
+    assert.deepEqual(weak.body.error.rules, ["upper", "symbol", "username"]);
+
+    const ok = await call("POST", "/api/me/password", {
+      cookie: neo.cookie,
+      body: { currentPassword: "123", newPassword: "Green-Tea-42" },
+    });
+    assert.equal(ok.status, 200);
+    assert.equal((await call("GET", "/api/lanes", { cookie: neo.cookie })).status, 200);
+    assert.equal(
+      (await call("GET", "/api/auth/me", { cookie: neo.cookie })).body.user.mustChangePassword,
+      false
+    );
+  });
+
+  it("an admin's reset flags the account again; their own new password must pass every rule", async () => {
+    const boss = (await login("boss", BOSS_PASS)).cookie;
+    const neoId = auth.findUser("neo").id;
+    const reset = await call("PATCH", `/api/users/${neoId}`, {
+      cookie: boss,
+      body: { password: "abc", currentPassword: BOSS_PASS },
+    });
+    assert.equal(reset.status, 200);
+    assert.equal(reset.body.user.mustChangePassword, true);
+    assert.equal((await login("neo", "abc")).user.mustChangePassword, true);
+
+    const bossId = auth.findUser("boss").id;
+    const own = (password) =>
+      call("PATCH", `/api/users/${bossId}`, {
+        cookie: boss,
+        body: { password, currentPassword: BOSS_PASS },
+      });
+    assert.equal((await own("123")).body.error.code, "EWEAKPASSWORD");
+    const same = await own(BOSS_PASS);
+    assert.equal(same.body.error.code, "EWEAKPASSWORD");
+    assert.deepEqual(same.body.error.rules, ["reused"]);
+    const done = await own("Blue-Sky-77!");
+    assert.equal(done.status, 200);
+    assert.equal(done.body.user.mustChangePassword, false);
+  });
+});
+
+describe("account bookkeeping", () => {
+  it("keeps the last login after the user signs out", async () => {
+    const pass = "Blue-Sky-77!";
+    const s = await login("boss", pass);
+    await call("POST", "/api/auth/logout", { cookie: s.cookie });
+    const id = auth.findUser("boss").id;
+    db.prepare("DELETE FROM auth_sessions WHERE user_id = ?").run(id);
+    const stats = auth.loginStats(id);
+    assert.equal(stats.logins, 0);
+    assert.ok(stats.lastLoginAt, "the last login is still known");
+    assert.equal(auth.allLoginStats().get(id).lastLoginAt, stats.lastLoginAt);
+  });
+
+  it("never demotes, disables or deletes the last enabled admin", () => {
+    for (const fn of [
+      () => auth.setRole("boss", "developer"),
+      () => auth.setDisabled("boss", true),
+      () => auth.deleteUser("boss"),
+    ]) {
+      assert.throws(fn, { code: "ELASTADMIN" });
+    }
+    assert.equal(auth.findUser("boss").role, "admin");
+    assert.equal(auth.findUser("boss").disabled, 0);
+  });
+
+  it("prunes audit entries older than AGENTHUB_AUDIT_DAYS", () => {
+    const { pruneAudit } = require("../lib/audit");
+    const insert = db.prepare(
+      "INSERT INTO audit_log (user_id, owner_id, method, path, at) VALUES (1, 1, 'GET', ?, ?)"
+    );
+    insert.run("/old", new Date(Date.now() - 40 * 864e5).toISOString());
+    insert.run("/new", new Date().toISOString());
+    process.env.AGENTHUB_AUDIT_DAYS = "0";
+    assert.equal(pruneAudit({ force: true }), 0, "0 keeps everything");
+    process.env.AGENTHUB_AUDIT_DAYS = "30";
+    assert.ok(pruneAudit({ force: true }) >= 1);
+    const paths = db
+      .prepare("SELECT path FROM audit_log")
+      .all()
+      .map((r) => r.path);
+    assert.ok(!paths.includes("/old"));
+    assert.ok(paths.includes("/new"));
+  });
+});

server/__tests__/server-mode-user-edit.test.js

@@ -230,19 +230,26 @@ describe("Settings → Account (/api/me)", () => {
       body: { currentPassword: "nope", newPassword: "leo-new-pass" },
     });
     assert.equal(wrong.body.error.code, "EREAUTH");
-    const ok = await call("POST", "/api/me/password", {
+    const weak = await call("POST", "/api/me/password", {
       cookie: leo,
       body: { currentPassword: "member-pass-2", newPassword: "leo-new-pass" },
     });
+    assert.equal(weak.status, 400);
+    assert.equal(weak.body.error.code, "EWEAKPASSWORD");
+    assert.deepEqual(weak.body.error.rules, ["upper", "digit", "username"]);
+    const ok = await call("POST", "/api/me/password", {
+      cookie: leo,
+      body: { currentPassword: "member-pass-2", newPassword: "New-Pass-2026" },
+    });
     assert.equal(ok.status, 200);
     assert.equal((await call("GET", "/api/me/account", { cookie: leo })).status, 200);
     assert.equal((await call("GET", "/api/me/account", { cookie: other })).status, 401);
-    assert.ok(await login("leo", "leo-new-pass"));
+    assert.ok(await login("leo", "New-Pass-2026"));
   });
 
   it("signs out other devices", async () => {
-    const a = await login("leo", "leo-new-pass");
-    const b = await login("leo", "leo-new-pass");
+    const a = await login("leo", "New-Pass-2026");
+    const b = await login("leo", "New-Pass-2026");
     const r = await call("POST", "/api/me/sign-out-others", { cookie: a });
     assert.ok(r.body.ended >= 1);
     assert.equal((await call("GET", "/api/me/account", { cookie: a })).status, 200);

server/__tests__/server-s3-review5.test.js

@@ -116,6 +116,10 @@ before(async () => {
     });
     cookies[n] = login.headers.get("set-cookie").split(";")[0];
   }
+  // A second admin, so demoting "boss" never leaves the install without one (ELASTADMIN).
+  db.prepare(
+    "INSERT INTO users (username, role, password_hash) VALUES ('boss2', 'admin', 'x')"
+  ).run();
 });
 
 after(() => {

server/__tests__/tool-profiles.test.js

@@ -0,0 +1,257 @@
+/**
+ * @file Tests for the non-Claude login profiles (tool-profiles.js): saving the
+ * live Codex login, switching between logins, the guards that keep a switch from
+ * losing the only copy of one, and Oh My Pi's credential identity.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const os = require("node:os");
+const path = require("node:path");
+const fs = require("node:fs");
+
+const ROOT = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-tool-profiles-"));
+process.env.CLAUDE_HOME = path.join(ROOT, ".claude");
+process.env.CODEX_HOME = path.join(ROOT, ".codex");
+
+const { describe, it, beforeEach, after } = require("node:test");
+const assert = require("node:assert/strict");
+
+const profiles = require("../lib/tool-profiles");
+
+const AUTH = path.join(process.env.CODEX_HOME, "auth.json");
+
+after(() => fs.rmSync(ROOT, { recursive: true, force: true }));
+
+const jwt = (claims) => `x.${Buffer.from(JSON.stringify(claims)).toString("base64url")}.sig`;
+
+/** Leave a ChatGPT login on disk the way `codex login` would. */
+function login(account, email, refresh = "rt-1") {
+  fs.mkdirSync(process.env.CODEX_HOME, { recursive: true });
+  fs.writeFileSync(
+    AUTH,
+    JSON.stringify({
+      OPENAI_API_KEY: null,
+      tokens: {
+        id_token: jwt({
+          email,
+          "https://api.openai.com/auth": { chatgpt_account_id: account, chatgpt_plan_type: "plus" },
+        }),
+        access_token: "at",
+        refresh_token: refresh,
+        account_id: account,
+      },
+      last_refresh: "2026-10-01T00:00:00Z",
+    })
+  );
+}
+
+beforeEach(() => {
+  fs.rmSync(process.env.CLAUDE_HOME, { recursive: true, force: true });
+  fs.rmSync(process.env.CODEX_HOME, { recursive: true, force: true });
+});
+
+describe("tool-profiles: codex", () => {
+  it("reports the live login and saves it under a name derived from it", () => {
+    login("acct-a", "alice@example.com");
+    assert.deepEqual(profiles.listProfiles("codex").active, {
+      kind: "chatgpt",
+      email: "alice@example.com",
+      detail: "plus",
+    });
+    const r = profiles.saveProfile("codex");
+    assert.equal(r.name, "alice");
+    const { items } = profiles.listProfiles("codex");
+    assert.equal(items.length, 1);
+    assert.equal(items[0].active, true);
+    assert.equal(items[0].secret, undefined, "never a token in a listing");
+    const mode = fs.statSync(path.join(profiles.profilesDir("codex"), "alice.json")).mode & 0o777;
+    assert.equal(mode, 0o600);
+  });
+
+  it("re-saving refreshes the login's own profile; a second name is EDUPLICATE", () => {
+    login("acct-a", "alice@example.com");
+    profiles.saveProfile("codex");
+    login("acct-a", "alice@example.com", "rt-2");
+    assert.equal(profiles.saveProfile("codex").name, "alice");
+    assert.equal(profiles.readProfile("codex", "alice").secret.tokens.refresh_token, "rt-2");
+    assert.throws(() => profiles.saveProfile("codex", "other"), { code: "EDUPLICATE" });
+  });
+
+  it("switches, saving the outgoing login back first", () => {
+    login("acct-a", "alice@example.com");
+    profiles.saveProfile("codex");
+    login("acct-b", "bob@example.com");
+    profiles.saveProfile("codex");
+    // Alice's tokens rotated while she was live? Bob is live now; switch to Alice.
+    const r = profiles.activateProfile("codex", "alice");
+    assert.equal(r.savedOutgoing, "bob");
+    const live = JSON.parse(fs.readFileSync(AUTH, "utf8"));
+    assert.equal(live.tokens.account_id, "acct-a");
+    const { items } = profiles.listProfiles("codex");
+    assert.deepEqual(
+      items.map((p) => [p.name, p.active]),
+      [
+        ["alice", true],
+        ["bob", false],
+      ]
+    );
+  });
+
+  it("refuses to switch away from an unsaved login", () => {
+    login("acct-a", "alice@example.com");
+    profiles.saveProfile("codex");
+    login("acct-c", "carol@example.com");
+    assert.throws(() => profiles.activateProfile("codex", "alice"), { code: "EUNSAVED" });
+  });
+
+  it("will not delete the live login's profile, deletes another", () => {
+    login("acct-a", "alice@example.com");
+    profiles.saveProfile("codex");
+    login("acct-b", "bob@example.com");
+    profiles.saveProfile("codex");
+    assert.throws(() => profiles.deleteProfile("codex", "bob"), { code: "EACTIVE" });
+    profiles.deleteProfile("codex", "alice");
+    assert.deepEqual(
+      profiles.listProfiles("codex").items.map((p) => p.name),
+      ["bob"]
+    );
+  });
+
+  it("renames the label only, and refuses a taken one", () => {
+    login("acct-a", "alice@example.com");
+    profiles.saveProfile("codex");
+    login("acct-b", "bob@example.com");
+    profiles.saveProfile("codex");
+    profiles.renameProfile("codex", "alice", "Công việc");
+    assert.equal(
+      profiles.listProfiles("codex").items.find((p) => p.name === "alice").label,
+      "Công việc"
+    );
+    assert.throws(() => profiles.renameProfile("codex", "bob", "công việc"), {
+      code: "ELABELTAKEN",
+    });
+  });
+
+  it("an API-key login is identified by its key, shown by its last four", () => {
+    fs.mkdirSync(process.env.CODEX_HOME, { recursive: true });
+    fs.writeFileSync(AUTH, JSON.stringify({ OPENAI_API_KEY: "sk-test-abcdefghij1234" }));
+    const r = profiles.saveProfile("codex");
+    assert.equal(r.kind, "apikey");
+    assert.equal(r.detail, "…1234");
+  });
+
+  it("saving with no login is ENOAUTH", () => {
+    assert.throws(() => profiles.saveProfile("codex"), { code: "ENOAUTH" });
+  });
+});
+
+describe("tool-profiles: tools", () => {
+  it("lists antigravity as unsupported and refuses it", () => {
+    const agy = profiles.tools().find((t) => t.tool === "antigravity");
+    assert.equal(agy.supported, false);
+    assert.throws(() => profiles.listProfiles("antigravity"), { code: "EUNSUPPORTED" });
+    assert.throws(() => profiles.listProfiles("nope"), { code: "EBADTOOL" });
+  });
+
+  it("an omp credential is identified by who it is, never by its rotating token", () => {
+    const a = { provider: "anthropic", credential: { type: "oauth", access: "1", email: "a@x" } };
+    const b = { provider: "anthropic", credential: { type: "oauth", access: "2", email: "a@x" } };
+    assert.equal(profiles.ompCredentialId(a), profiles.ompCredentialId(b));
+    assert.equal(profiles.ompCredentialId(a), "anthropic:a@x");
+  });
+
+  it("a switch hands the adapter the outgoing login so it can restore it", () => {
+    let disk = { who: "a" };
+    const writes = [];
+    profiles.__setAdapter("fake", {
+      label: "Fake",
+      read: () => disk,
+      write: (secret, outgoing) => {
+        writes.push([secret.who, outgoing && outgoing.who]);
+        disk = secret;
+        return [];
+      },
+      identify: (s) => ({ key: s.who, kind: "x", email: null, detail: null }),
+    });
+    profiles.saveProfile("fake", "a");
+    disk = { who: "b" };
+    profiles.saveProfile("fake", "b");
+    profiles.activateProfile("fake", "a");
+    assert.deepEqual(writes, [["a", "b"]]);
+  });
+});
+
+describe("tool-profiles: omp", () => {
+  it("switches through a cleared store + `omp auth import -`, never by argv", () => {
+    const omp = path.join(ROOT, ".omp");
+    const db = path.join(omp, "agent", "agent.db");
+    const state = path.join(ROOT, "omp-state.json");
+    const argv = path.join(ROOT, "omp-argv.log");
+    fs.mkdirSync(path.dirname(db), { recursive: true });
+    const { DatabaseSync } = require("node:sqlite");
+    const d = new DatabaseSync(db);
+    d.exec(`CREATE TABLE auth_credentials (id INTEGER PRIMARY KEY, provider TEXT, data TEXT);
+      CREATE TABLE auth_credential_blocks (credential_id INTEGER);
+      CREATE TABLE auth_credential_refresh_leases (credential_id INTEGER);
+      INSERT INTO auth_credentials (provider, data) VALUES ('anthropic', '{}');`);
+    d.close();
+    // A fake omp: export prints the state file, import REPLACES it from stdin
+    // only when the store was cleared first (as the real one merges).
+    const bin = path.join(ROOT, "omp");
+    fs.writeFileSync(
+      bin,
+      `#!/usr/bin/env node
+const fs = require("fs");
+fs.appendFileSync(${JSON.stringify(argv)}, process.argv.slice(2).join(" ") + "\\n");
+const { DatabaseSync } = require("node:sqlite");
+const db = new DatabaseSync(${JSON.stringify(db)});
+const rows = db.prepare("SELECT COUNT(*) AS n FROM auth_credentials").get().n;
+if (process.argv[3] === "export") {
+  process.stdout.write(fs.readFileSync(${JSON.stringify(state)}, "utf8"));
+} else {
+  const input = JSON.parse(fs.readFileSync(0, "utf8"));
+  if (rows) { process.stderr.write("merged into a non-empty store"); process.exit(1); }
+  fs.writeFileSync(${JSON.stringify(state)}, JSON.stringify(input));
+}
+`,
+      { mode: 0o755 }
+    );
+    const set = (email, token) =>
+      fs.writeFileSync(
+        state,
+        JSON.stringify({
+          version: 1,
+          credentials: [
+            { provider: "anthropic", credential: { type: "oauth", access: token, email } },
+          ],
+        })
+      );
+    process.env.AGENTHUB_OMP_DIR = omp;
+    process.env.AGENTHUB_OMP_BIN = bin;
+    try {
+      set("a@x", "secret-a");
+      assert.equal(profiles.saveProfile("omp").name, "a");
+      set("b@x", "secret-b");
+      profiles.saveProfile("omp");
+      const r = profiles.activateProfile("omp", "a");
+      assert.equal(r.savedOutgoing, "b");
+      assert.equal(
+        JSON.parse(fs.readFileSync(state, "utf8")).credentials[0].credential.email,
+        "a@x"
+      );
+      assert.ok(!fs.readFileSync(argv, "utf8").includes("secret"), "secrets only on stdin");
+      const { items, active } = profiles.listProfiles("omp");
+      assert.equal(active.email, "a@x");
+      assert.deepEqual(
+        items.map((p) => [p.name, p.active, p.detail]),
+        [
+          ["a", true, "anthropic"],
+          ["b", false, "anthropic"],
+        ]
+      );
+    } finally {
+      delete process.env.AGENTHUB_OMP_DIR;
+      delete process.env.AGENTHUB_OMP_BIN;
+    }
+  });
+});

server/data/ai-tools/README.md

@@ -13,7 +13,7 @@ id follows, as one more argv element — `pty-run.js` emits them in place of
 `resume` when a start carries `resumeSessionId`, and only for an id that starts
 with a letter or digit. A tool without it (and without a `launcher`) refuses a
 resume by id (`EUNSUPPORTED`) rather than start fresh under a "resume".
-Built-in: omp, Grok and Cursor (`--resume`), OpenCode (`--session`). A session id may carry `_` (OpenCode's `ses_…`).
+Built-in: omp, Grok and Cursor (`--resume`), OpenCode (`--session`). omp always gets `--allow-home`: started in its account's home (a workspace there) it would otherwise move to a temp dir, and its session would name that folder, not the workspace's. A session id may carry `_` (OpenCode's `ses_…`).
 
 ## Install / update (A2)
 

server/data/ai-tools/omp.json

@@ -4,6 +4,9 @@
   "detect": [
     "omp"
   ],
+  "args": [
+    "--allow-home"
+  ],
   "prompt": {
     "mode": "argv"
   },

server/db.js

@@ -1933,15 +1933,29 @@ try {
 }
 // An account's own display name and email (the Users page's Edit user and
 // Settings → Account), and when its avatar was last set (server/lib/avatars.js
-// — the image is a file, the column only versions its URL). Additive; after
-// the rebuild above, which predates them.
-for (const col of ["display_name", "email", "avatar_at"]) {
+// — the image is a file, the column only versions its URL — or `avatar_link`,
+// a link the avatar routes redirect to). Additive; after the rebuild above,
+// which predates them.
+for (const col of ["display_name", "email", "avatar_at", "avatar_link"]) {
   try {
     db.prepare(`SELECT ${col} FROM users LIMIT 1`).get();
   } catch {
     db.prepare(`ALTER TABLE users ADD COLUMN ${col} TEXT`).run();
   }
 }
+// When the account last logged in (kept past its logins' expiry, unlike
+// `auth_sessions`), and whether it must pick its own password before anything
+// else (set when an admin creates it or resets its password — server/lib/auth.js).
+for (const [col, type] of [
+  ["last_login_at", "TEXT"],
+  ["must_change_password", "INTEGER NOT NULL DEFAULT 0"],
+]) {
+  try {
+    db.prepare(`SELECT ${col} FROM users LIMIT 1`).get();
+  } catch {
+    db.prepare(`ALTER TABLE users ADD COLUMN ${col} ${type}`).run();
+  }
+}
 // An admin's pin of one server-mode user to one pool account per tool
 // (server/lib/account-pins.js): that user's new sessions skip the balancer.
 // The account is named, not referenced — the pool lives in files.